Logical Reasoning for Disjoint Permissions

Logical Reasoning for Disjoint Permissions

Xuan-Bach Le Aquinas Hobor

ESOP 2018, Thessaloniki, Greece

This talk is about ...

Permission reasoning in Concurrent Separation Logic

3

Some notations

● Mapsto predicate

x

4

Some notations


● Fractional mapsto predicate

x

x

5

Some notations


● Fractional mapsto predicate

● Disjoint conjunction

x

x

6

Predicate multiplication

permission predicate

7

Ownership reasoning

class Example {

BinaryTree t;

void shareTree{

fork();

readTree(t);

wait();

deallocate(t);

}

}

8

Ownership reasoning

class Example {

BinaryTree t;

void shareTree{

fork();

readTree(t);

wait();

deallocate(t);

}

}

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

9

Case study: Rational permissions

● Model:

● Examples:

● Combine permissions:

10

Reasoning with rational permissions (expected result)

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

11


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

12


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

13


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

14


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

15


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

16


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

17


Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

18

Shortcomming of Rationals

19


20


The latter is always a tree possibly a DAG!

a

b

00

21

Diagnosis

● Without permissions

is not satisfiable

x v x v

22

Diagnosis


● With permissions

is not satisfiable

is equivalent to

x v x v

x (v,1/2) x (v,1/2) x (v,1)

23

Diagnosis


● With permissions

is not satisfiable

is equivalent to

x v x v

x (v,1/2) x (v,1/2) x (v,1)

Rational permissions fail to preserve the disjointness property of Separation Logic!

24

This talk

1. Disjoint permission model

2. Inference systems

3. Disjoint permission analysis

25

Disjoint permission model

partial addition

total multiplication

additive identity

multiplicative identity

26


● Axioms from semiring:– Commutativity over addition

– Associativity over multiplication

– Right distributivity of multiplication over addition

– ...

● Disjointness axiom:

27


● Axioms from semiring:– Commutativity over addition

– Associativity over multiplication

– Right distributivity of multiplication over addition

– ...

● Disjointness axiom:

Not true with rationals!

28

Enable efficient bi-abduction reasoning

● Complete a partial entailment

● With disjoint permissions

● Automatic tool ShareInfer

29





30





31

Roadmap

● Predicate multiplication with disjoint permissions

● Inference systems

● Disjoint permissions analysis

32

Overview of inference system● 10/13 rules are bidirectional

● Some rules don’t hold with rational permissions

33

A closer look

Initiate the sharing mechanism

DOTFULL

34

A closer look

Collapse nested permissions

DOTDOT

35

A closer look

Splitting permissions over predicate

precise(P): P cannot hold in 2 subheaps simultaneously

DOTPLUS

36

A closer look

Distribute permissions over predicates

uniform( ): all addresses have permission

DOTSTAR

37

Inductive Reasoning(honourable mention)

● Inference system for inductive reasoning

– 8 inference rules

– Induction over finiteness of fractional heap

– Can prove side conditions precise, uniform

– Implementation: ShareInfer tool

38

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

39

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

40

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

41

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

42

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

DotStar

43

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

DotStar

44

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

DotPlus

DotStar

45

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

DotPlus

DotFull

DotStar

46

Example

Parent process

fork()

readTree(t)

wait()

deallocate(t)

Child process

readTree(t)

wait()

DotFull

DotPlus

DotPlus

DotFull

DotStar

47

Soundness

● Prove over fractional heap model:

a1

... ...

an

48

Soundness


a1

... ...

an

a1

... ...

an

a1

... ...

an

● Heap multiplication:

49

Soundness


a1

... ...

an

a1

... ...

an

a1

... ...

an

● Heap multiplication:

● Predicate multiplication:

50

Soundness

disjoint permission axioms inference rules

51

Soundness

disjoint permission axioms inference rules

Example:

Associativity of

52

Roadmap

● Predicate multiplication with disjoint permissions

● Inference systems

● Disjoint permissions analysis

53

Inference rules force permission axioms

inference rules disjoint permission axioms

54



DOTFULL

Example:

55



Proof sketch: Let P be and .

By definition,

As , we also have Thus . QED

x

x

DOTFULL

Example:

56

Disjointness in a multiplicative setting

● Disjointness axiom (D)

● Left distributivity (LD)

● Right distributivity (RD)

57





D + LD + RD + other standard axioms Trivial models

58





D + LD + RD + other standard axioms Good models

59


Multiplicative left inverse (LI):

60



D + (LD or RD) + LI + other axioms Trivial models

61



D + (LD or RD) + LI + other axioms Good models

62

Scaling separation algebra

Capture characteristics of fractional heaps

Heap components Permission components

63



a1

a2

a1

a3

a1

a2

a3

Heap join:

64



mul( , )

a1

... ...

an

a1

... ...

an

Heap mul:

65



Heap force:

force( , )

a1

... ...

an

a1

... ...

an

66


14 axioms for scaling separation algebra

Axioms for fractional heaps

67

A graphical summary

Disjoint permission axioms

Inference rules for predicate multiplication

Scaling separationalgebra

68

Conclusion

● We proposed inference systems (with tool support) for predicate multiplication with disjoint permissions.

● Our soundness proof is verified in Coq using fractional heap model and Scaling Separation Algebra.

● We justified why certain properties of disjoint permissions cannot hold simultaneously.

● Future work: further investigation for permission algebra and Scaling Separation Algebra.

Thank you!

Logical Reasoning for Disjoint Permissions

Documents