Specifying I/O using abstract nested hoare triples in separation logic

Abstract

One common approach for verifying safety properties of multithreaded programs is assigning appropriate permissions, such as ownership of a heap location, and obligations, such as an obligation to send a message on a channel, to each thread and making sure that each thread only performs the actions for which it has permissions and it also fulfills all of its obligations before it terminates. Although permissions can be transferred through synchronizations from a sender thread, where for example a message is sent or a condition variable is notified, to a receiver thread, where that message or that notification is received, in existing approaches obligations can only be transferred when a thread is forked. In this paper we introduce two mechanisms, one for channels and the other for condition variables, that allow obligations, along with permissions, to be transferred from the sender to the receiver, while ensuring that there is no state where the transferred obligations are lost, i.e. where they are discharged from the sender thread but not loaded onto the receiver thread yet. We show how these mechanisms can be used to modularly verify deadlock-freedom of a number of interesting programs, such as some variations of client-server programs, fair readers-writers locks, and dining philosophers, which cannot be modularly verified without such transfer. We also encoded the proposed separation logic-based proof rules in the VeriFast program verifier and succeeded in verifying the mentioned programs. ACM Subject ClassificationTheory of computation → Separation logic; Software and its engineering → Deadlocks; Software and its engineering → Process synchronization; Software and its engineering → Formal software verification; Theory of computation → Hoare logic Acknowledgements We thank three anonymous reviewers for their careful reading of our manuscript and their many insighful comments and suggestions, and also Amin Timany for his guidance on Coq. . Iris: Monoids and invariants as an orthogonal basis for concurrent reasoning.

Modular Verification of Liveness Properties of the I/O Behavior of Imperative Programs

“…For specifying the safety properties of the I/O behavior, we apply our earlier work [9,8,7]: we use abstract nested Hoare triples in separation logic [11]. For example, a specification for the program send("Hello"); send("world!")…”

“…For a discussion of related work on verifying safety of I/O behavior and on verifying program termination, we refer to our earlier work [9,5].…”

“…For specifying the safety properties of the I/O behavior, we apply our earlier work [9,8,7] on abstract nested Hoare triples in separation logic [11]. For specifying liveness properties, we build on earlier work [5] on verification of basic liveness.…”

The future is ours: prophecy variables in separation logic

“…Since we introduced prophecy variables into Iris, they have already been put to good use. Penninckx et al [2019] use them for giving abstract specifications of I/O behavior. In a paper appearing alongside ours in the present issue of PACMPL, de Vilhena et al [2020] use them in an essential way in verifying a łlocal generic solverž in Iris.…”