The Essence of Higher-Order Concurrent Separation Logic

Abstract

Abstract. Concurrent separation logics (CSLs) have come of age, and with age they have accumulated a great deal of complexity. Previous work on the Iris logic attempted to reduce the complex logical mechanisms of modern CSLs to two orthogonal concepts: partial commutative monoids (PCMs) and invariants. However, the realization of these concepts in Iris still bakes in several complex mechanisms-such as weakest preconditions and mask-changing view shifts-as primitive notions.In this paper, we take the Iris story to its (so to speak) logical conclusion, applying the reductionist methodology of Iris to Iris itself. Specifically, we define a small, resourceful base logic, which distills the essence of Iris: it comprises only the assertion layer of vanilla separation logic, plus a handful of simple modalities. We then show how the much fancier logical mechanisms of Iris-in particular, its entire program specification layer-can be understood as merely derived forms in our base logic. This approach helps to explain the meaning of Iris's program specifications at a much higher level of abstraction than was previously possible. We also show that the step-indexed "later" modality of Iris is an essential source of complexity, in that removing it leads to a logical inconsistency. All our results are fully formalized in the Coq proof assistant. IntroductionIn his paper The Next 700 Separation Logics, Parkinson [26] observed that "separation logic has brought great advances in the world of verification. However, there is a disturbing trend for each new library or concurrency primitive to require a new separation logic." He argued that what is needed is a general logic for concurrent reasoning, into which a variety of useful specifications can be encoded via the abstraction facilities of the logic. "By finding the right core logic," he wrote, "we can concentrate on the difficult problems."The logic he suggested as a potential candidate for such a core concurrency logic was deny-guarantee [12]. Deny-guarantee was indeed groundbreaking in its support for "fictional separation"-the idea that even if threads are concurrently manipulating the same shared piece of physical state, one can view them as operating on logically disjoint pieces of it and use separation logic to reason modularly about those pieces. It was, however, far from the last word on the subject. Rather, 2 Krebbers, Jung, Bizjak, Jourdan, Dreyer, Birkedal it spawned a new breed of logics with ever more powerful fictional-separation mechanisms for reasoning modularly about interference [11,16,29,9,30,27]. Several of these also incorporated support for impredicative invariants [28,18,17,4], which are needed if one aims to verify code in languages with semantically cyclic features (such as ML or Rust, which support higher-order state).Although exciting, the progress in this area has come at a cost: as these new separation logics become ever more expressive, each one accumulates increasingly baroque and bespoke proof rules, which are primitive in the sense that their sou...

Go with the flow: compositional abstractions for concurrent data structures

“…Higher-order concurrent separation logic [Jung et al 2015;Krebbers et al 2017] can express ghost state within the assertion language of the logic itself. This feature can be used to eliminate the restriction of RGSep[FI] that the semantics of the flow interface predicates is defined on the meta level and that it does not support nesting of flow interface abstractions (i.e., cases where a node of a flow graph should abstract from another flow graph contained in the node).…”

A separation logic for concurrent randomized programs

“…For reasons of space, we cannot explain all of Iris. We refer the reader to the Iris papers and manual [37,38,41, 59] for a full account. Instead, we will just describe some essential aspects needed to understand our extensions and examples.…”

Separation logic

“…Technically, these works are based on "non-standard models" of SL, different from the heaplet model but instances of Pym's resource semantics as in Figure 2; see Pym et al 36 There are many such models, including ones incorporating read and other permissions, 7 auxiliary state, 39 time, 39 protocols, 29 and others. Abstract SL 13 showed how general program logic could be defined based on these models, and the works just mentioned and others showed that some of them had surprising ramifications.…”