Separation Logic Research Articles

Verifying Custom Synchronization Constructs Using Higher-Order Separation Logic

Synchronization constructs lie at the heart of any reliable concurrent program. Many such constructs are standard (e.g., locks, queues, stacks, and hash-tables). However, many concurrent applications require custom synchronization constructs with special-purpose behavior. These constructs present a significant challenge for verification. Like standard constructs, they rely on subtle racy behavior, but unlike standard constructs, they may not have well-understood abstract interfaces. As they are custom built, such constructs are also far more likely to be unreliable. This article examines the formal specification and verification of custom synchronization constructs. Our target is a library of channels used in automated parallelization to enforce sequential behavior between program statements. Our high-level specification captures the conditions necessary for correct execution; these conditions reflect program dependencies necessary to ensure sequential behavior. We connect the high-level specification with the low-level library implementation to prove that a client’s requirements are satisfied. Significantly, we can reason about program and library correctness without breaking abstraction boundaries. To achieve this, we use a program logic called iCAP (impredicative Concurrent Abstract Predicates) based on separation logic. iCAP supports both high-level abstraction and low-level reasoning about races. We use this to show that our high-level channel specification abstracts three different, increasingly complex low-level implementations of the library. iCAP’s support for higher-order reasoning lets us prove that sequential dependencies are respected, while iCAP’s next-generation semantic model lets us avoid ugly problems with cyclic dependencies.

Report on SL-COMP 2014

A competition of solvers for Separation Logic was held in May 2014, as an unofficial satellite event of the FLoC Olympic Games. Six solvers participated in the competition; the success and performance of each solver was measured over an appropriate subset of a library of benchmarks accumulated for the purpose. The benchmarks consisted of satisfiability and entailment problems over formulas in the fragment of symbolic heaps with inductive definitions, which is the fragment of Separation Logic that is most used in program analysis and verification tools. We report in this paper on the competition rules, the participants, the results, the findings, and the future of this event.

Proof of Soundness of Concurrent Separation Logic for GPGPU in Coq

We design a concurrent separation logic for GPGPU, namely GPUCSL, and prove its soundness by using Coq. GPUCSL is based on a CSL proposed by Blom et al., which is for automatic verification of GPGPU kernels, but employs different inference rules because the rules in Blom’s CSL are not standard. For example, Blom’s CSL does not have a frame rule. Our CSL is a simple extension of the original CSL, and it is more suitable as a basis of advanced properties proposed for other studies on CSLs. Our soundness proof is based on Vafeiadis’ method, which is for a CSL with a fork-join concurrency model. The proof reveals two problems in Blom’s approach in terms of soundness and extensibility. First, their assumption that thread ID independence of a kernel implies barrier divergence freedom does not hold. Second, it is not easy to extend their proof to other CSLs with a frame rule. Although our CSL covers only a subset of CUDA, our preliminary experiment shows that it is useful and expressive enough to verify a simple kernel with barriers.

Separation Logic for High-Level Synthesis

High-Level Synthesis (HLS) promises a significant shortening of the FPGA design cycle by raising the abstraction level of the design entry to high-level languages such as C/C++. However, applications using dynamic, pointer-based data structures and dynamic memory allocation remain difficult to implement well, yet such constructs are widely used in software. Automated optimizations that leverage the memory bandwidth of FPGAs by distributing the application data over separate banks of on-chip memory are often ineffective in the presence of dynamic data structures due to the lack of an automated analysis of pointer-based memory accesses. In this work, we take a step toward closing this gap. We present a static analysis for pointer-manipulating programs that automatically splits heap-allocated data structures into disjoint, independent regions. The analysis leverages recent advances in separation logic , a theoretical framework for reasoning about heap-allocated data that has been successfully applied in recent software verification tools. Our algorithm focuses on dynamic data structures accessed in loops and is accompanied by automated source-to-source transformations that enable automatic loop parallelization and memory partitioning by off-the-shelf HLS tools. We demonstrate the successful loop parallelization and memory partitioning by our tool flow using three real-life applications that build, traverse, update, and dispose of dynamically allocated data structures. Our case studies, comparing the automatically parallelized to the direct HLS implementations, show an average latency reduction by a factor of 2 × across our benchmarks.

Reasoning about the POSIX file system: local update and global pathnames

We introduce a program logic for specifying a core sequential subset of the POSIX file system and for reasoning abstractly about client programs working with the file system. The challenge is to reason about the combination of local directory update and global pathname traversal (including '..' and symbolic links) which may overlap the directories being updated. Existing reasoning techniques are either based on first-order logic and do not scale, or on separation logic and can only handle linear pathnames (no '..' or symbolic links). We introduce fusion logic for reasoning about local update and global pathname traversal, introducing a novel effect frame rule to propagate the effect of a local update on overlapping pathnames. We apply our reasoning to the standard recursive remove utility (rm -r), discovering bugs in well-known implementations.

A modal separation logic for resource dynamics

The logic of Bunched implications (BI), and its boolean version (Boolean BI), are logics that allow us to express properties on resources and to provide logical frameworks for the so-called separation logics. In this paper we study a new modal separation logic that extends Boolean BI with two kinds of modalities, in order to deal with resources having dynamic properties (which depend on the current state of a system) and also to capture some resource evolutions or transformations. We show how we can model concurrent processes manipulating resources, and we provide a sound and complete tableau calculus, with a counter-model extraction method, for proving properties expressed in this logic.

Verification of a cryptographic primitive: SHA-256 (abstract)

A full formal machine-checked verification of a C program: the OpenSSL implementation of SHA-256. This is an interactive proof of functional correctness in the Coq proof assistant, using the Verifiable C program logic. Verifiable C is a separation logic for the C language, proved sound w.r.t. the operational semantics for C, connected to the CompCert verified optimizing C compiler.

Verification of a Cryptographic Primitive

This article presents a full formal machine-checked verification of a C program: the OpenSSL implementation of SHA-256. This is an interactive proof of functional correctness in the Coq proof assistant, using the Verifiable C program logic. Verifiable C is a separation logic for the C language, proved sound with respect to the operational semantics for C, connected to the CompCert verified optimizing C compiler.

Witnessing the elimination of magic wands.

This paper discusses static verification of programs that have been specified using separation logic with magic wands. Magic wands are used to specify incomplete resources in separation logic, i.e., if missing resources are provided, a magic wand allows one to exchange these for the completed resources. One of the applications of the magic wand operator is to describe loop invariants for algorithms that traverse a data structure, such as the imperative version of the tree delete problem (Challenge 3 from the VerifyThis@FM2012 Program Verification Competition), which is the motivating example for our work. Most separation logic-based static verification tools do not provide support for magic wands, possibly because validity of formulas containing the magic wand is, by itself, undecidable. To avoid this problem, in our approach the program annotator has to provide a witness for the magic wand, thus circumventing undecidability due to the use of magic wands. A witness is an object that encodes both instructions for the permission exchange that is specified by the magic wand and the extra resources needed during that exchange. We show how this witness information is used to encode a specification with magic wands as a specification without magic wands. Concretely, this approach is used in the VerCors tool set: annotated Java programs are encoded as Chalice programs. Chalice then further translates the program to BoogiePL, where appropriate proof obligations are generated. Besides our encoding of magic wands, we also discuss the encoding of other aspects of annotated Java programs into Chalice, and in particular, the encoding of abstract predicates with permission parameters. We illustrate our approach on the tree delete algorithm, and on the verification of an iterator of a linked list.

Two-Variable Separation Logic and Its Inner Circle

Separation logic is a well-known assertion language for Hoare-style proof systems. We show that first-order separation logic with a unique record field restricted to two quantified variables and no program variables is undecidable. This is among the smallest fragments of separation logic known to be undecidable, and this contrasts with the decidability of two-variable first-order logic. We also investigate its restriction by dropping the magic wand connective, known to be decidable with nonelementary complexity, and we show that the satisfiability problem with only two quantified variables is not yet elementary recursive. Furthermore, we establish insightful and concrete relationships between two-variable separation logic and propositional interval temporal logic (PITL), data logics, and modal logics, providing an inner circle of closely related logics.

Permission-Based Separation Logic for Multithreaded Java Programs

This paper presents a program logic for reasoning about multithreaded Java-like programs with dynamic thread creation, thread joining and reentrant object monitors. The logic is based on concurrent separation logic. It is the first detailed adaptation of concurrent separation logic to a multithreaded Java-like language. The program logic associates a unique static access permission with each heap location, ensuring exclusive write accesses and ruling out data races. Concurrent reads are supported through fractional permissions. Permissions can be transferred between threads upon thread starting, thread joining, initial monitor entrancies and final monitor exits. In order to distinguish between initial monitor entrancies and monitor reentrancies, auxiliary variables keep track of multisets of currently held monitors. Data abstraction and behavioral subtyping are facilitated through abstract predicates, which are also used to represent monitor invariants, preconditions for thread starting and postconditions for thread joining. Value-parametrized types allow to conveniently capture common strong global invariants, like static object ownership relations. The program logic is presented for a model language with Java-like classes and interfaces, the soundness of the program logic is proven, and a number of illustrative examples are presented.

Brand wars: consumer–brand engagement beyond client–agency fights

Engaging consumers with their brands has emerged as a priority in marketers’ agenda. Brand decision-makers share a clear representational view of consumer-brand engagement (CBE). Despite this agreement, practitioners are currently finding hard to practically achieve CBE. The clash between an ideal representation of CBE focused on consumer protagonism and its fragile execution urges a rethinking of consumer-brand relationship modes and timeframe. We argue that this clash is nurtured by the long-established conflicting relational dynamics among brand decision-makers illustrated by client–agency (CA) disputes of which consumers represent the ending-point recipient. This paper reflects on how consumer protagonism as an inherent component of CBE is currently reshaping the relation dynamics among all brand actors. We represent CBE as a relational hub resting upon a co-creation rather than a separation logic. We finally provide a pragmatic reflection on the relationship culture required by CBE among actors beyond the CA dyad.

Modal algebra and Petri nets

We use the by now well established setting of modal semirings to derive a modal algebra for Petri nets. It is based on a relation-algebraic calculus for separation logic that enables calculations of properties in a pointfree fashion and at an abstract level. Basically, we start from an earlier logical approach to Petri nets that in particular uses modal box and diamond operators for stating properties about the state space of such a net. We provide relational translations of the logical formulas which further allow the characterisation of general behaviour of transitions in an algebraic fashion. From the relational structure an algebra for frequently used properties of Petri nets is derived. In particular, we give connections to typical used assertion classes of separation logic. Moreover, we demonstrate applicability of the algebraic approach by calculations concerning a standard example of a mutex net.

Iris

We present Iris, a concurrent separation logic with a simple premise: monoids and invariants are all you need. Partial commutative monoids enable us to express---and invariants enable us to enforce---user-defined *protocols* on shared state, which are at the conceptual core of most recent program logics for concurrency. Furthermore, through a novel extension of the concept of a *view shift*, Iris supports the encoding of *logically atomic specifications*, i.e., Hoare-style specs that permit the client of an operation to treat the operation essentially as if it were atomic, even if it is not.

Sound Modular Verification of C Code Executing in an Unverified Context

Over the past decade, great progress has been made in the static modular verification of C code by means of separation logic-based program logics. However, the runtime guarantees offered by such verification are relatively limited when the verified modules are part of a whole program that also contains unverified modules. In particular, a memory safety error in an unverified module can corrupt the runtime state, leading to assertion failures or invalid memory accesses in the verified modules. This paper develops runtime checks to be inserted at the boundary between the verified and the unverified part of a program, to guarantee that no assertion failures or invalid memory accesses can occur at runtime in any verified module. One of the key challenges is enforcing the separation logic frame rule, which we achieve by checking the integrity of the footprint of the verified part of the program on each control flow transition from the unverified to the verified part. This in turn requires the presence of some support for module-private memory at runtime. We formalize our approach and prove soundness. We implement the necessary runtime checks by means of a program transformation that translates C code with separation logic annotations into plain C, and that relies on a protected module architecture for providing module-private memory and restricted module entry points. Benchmarks show the performance impact of this transformation depends on the choice of boundary between the verified and unverified parts of the program, but is below 4% for real-world applications.

Separation logics and modalities: a survey

Like modal logic, temporal logic, and description logic, separation logic has become a popular class of logical formalisms in computer science, conceived as assertion languages for Hoare-style proof systems with the goal to perform automatic program analysis. In a broad sense, separation logic is often understood as a programming language, an assertion language and a family of rules involving Hoare triples. In this survey, we present similarities between separation logic as an assertion language and modal and temporal logics. Moreover, we propose a selection of landmark results about decidability, complexity and expressive power.

Symbolic Execution Proofs for Higher Order Store Programs

Higher order store programs are programs which store, manipulate and invoke code at runtime. Important examples of higher order store programs include operating system kernels which dynamically load and unload kernel modules. Yet conventional Hoare logics, which provide no means of representing changes to code at runtime, are not applicable to such programs. Recently, however, new logics using nested Hoare triples have addressed this shortcoming. In this paper we describe, from top to bottom, a sound semi-automated verification system for higher order store programs. We give a programming language with higher order store features, define an assertion language with nested triples for specifying such programs, and provide reasoning rules for proving programs correct. We then present in full our algorithms for automatically constructing correctness proofs. In contrast to earlier work, the language also includes ordinary (fixed) procedures and mutable local variables, making it easy to model programs which perform dynamic loading and other higher order store operations. We give an operational semantics for programs and a step-indexed interpretation of assertions, and use these to show soundness of our reasoning rules, which include a deep frame rule which allows more modular proofs. Our automated reasoning algorithms include a scheme for separation logic based symbolic execution of programs, and automated provers for solving various kinds of entailment problems. The latter are presented in the form of sets of derived proof rules which are constrained enough to be read as a proof search algorithm.

Extended transitive separation logic

Separation logic (SL) is an extension of Hoare logic by operators and formulas for reasoning more flexibly about heap portions or linked object/record structures. In the present paper we give an algebraic extension of SL at the data structure level. At the same time we step beyond standard SL by studying not only domain disjointness of heap portions but also disjointness along transitive links. To this end we define operations that allow expressing assumptions about the linking structure. Phenomena to be treated comprise reachability analysis, (absence of) sharing, cycle detection and preservation of substructures under destructive assignments. We demonstrate the practicality of this approach with examples of in-place list-reversal, tree rotation and threaded trees.

Shared contract-obedient channels

Recent advances in the formal verification of message-passing programs are based on proving that programs correctly implement a given protocol. Many existing verification techniques for message-passing programs assume that at most one thread may attempt to send or receive on a channel endpoint at any given point in time, and expressly forbid endpoint sharing. Approaches that do allow such sharing often do not prove that channels obey their protocols. In this paper, we identify two principles that can guarantee obedience to a communication protocol even in the presence of endpoint sharing. Firstly, threads may concurrently use an endpoint in any way that does not advance the state of the protocol. Secondly, threads may compete for receiving on an endpoint provided that the successful reception of the message grants them ownership of that endpoint retrospectively. We develop a program logic based on separation logic that unifies these principles and allows fine-grained reasoning about endpoint-sharing programs. We demonstrate its applicability on a number of examples. The program logic is shown sound against an operational semantics of programs, and proved programs are guaranteed to follow the given protocols and to be free of data races, memory leaks, and communication errors.

On Grainless Footprint Semantics for Shared-memory Programs

We develop an improved grainless denotational semantics for shared-memory parallel programs, building on ideas from earlier trace-based models with local states and footprints [S. Brookes. A Grainless Semantics for Parallel Programs with Shared Mutable State. Proc. 21st Conference on Mathematical Foundations of Programming Semantics (MFPS XXI). Birmingham, 17–21 May, 2005]. The key new idea is a more refined approach to race detection, leading to a model with better abstraction properties. Rather than treat a race condition as a “global” catastrophe [S. Brookes. A Semantics for Concurrent Separation Logic. Invited paper, CONCUR 2004, Philippa Gardner and Nobuko Yoshida (Eds.), Springer LNCS 3170, London, August/September 2004, pp. 16–34; S. Brookes. A Grainless Semantics for Parallel Programs with Shared Mutable State. Proc. 21st Conference on Mathematical Foundations of Programming Semantics (MFPS XXI). Birmingham, 17–21 May, 2005], we track information about variables whose value may be tainted by a race, and retain accurate information about unaffected variables. As in the prior work, we abstract away from state changes that occur in between synchronization points, in a manner consistent with Dijkstra's Principle [E. W. Dijkstra. Cooperating sequential processes. In: Programming Languages, F. Genuys (editor), pp. 43–112. Academic Press, 1968]. We obtain a model in which only synchronization operations (for locking and unlocking binary semaphores) are deemed to be atomic, which matches the usual implementation of these constructs in an abstract manner. Apart from this, no other atomicity assumptions are made, so our model is truly grainless. Our semantics supports compositional program analysis based on “sequential” reasoning for sequential code fragments, even when this code occurs in parallel contexts, and yields a simple semantic characterization of race-free code. The semantics validates the static constraints on “critical variables” imposed in concurrent programming methodology [C.A.R. Hoare. Towards a Theory of Parallel Programming. In Operating Systems Techniques, C.A.R. Hoare and R.H. Perrott, editors, pp. 61–71, Academic Press, 1972; S. Owicki and D. Gries. Verifying properties of parallel programs: An axiomatic approach, Comm. ACM. 19(5):279–285, May 1976] and serves as a foundation for reasoning about safe partial correctness, as in concurrent separation logic [P.W. O'Hearn. Resources, Concurrency, and Local Reasoning. Invited paper, CONCUR 2004, Philippa Gardner and Nobuko Yoshida (Eds.), Springer LNCS 3170, London, August/September 2004, pp. 49–67]. The new treatment of race detection allows for more refined analysis of racy programs. By framing our ideas and concepts in a general manner we hope that our results may be applied in a wider setting.