scholarly journals Modular verification of preemptive OS kernels

2013 ◽  
Vol 23 (4) ◽  
pp. 452-514 ◽  
Author(s):  
ALEXEY GOTSMAN ◽  
HONGSEOK YANG
Keyword(s):  
Separation Logic ◽  
Multiprocessor Systems ◽  
Proof Rules ◽  
Modular Verification ◽  
Key Features ◽  
Concurrent Separation Logic

AbstractMost major OS kernels today run on multiprocessor systems and are preemptive: it is possible for a process running in the kernel mode to get descheduled. Existing modular techniques for verifying concurrent code are not directly applicable in this setting: they rely on scheduling being implemented correctly, and in a preemptive kernel, the correctness of the scheduler is interdependent with the correctness of the code it schedules. This interdependency is even stronger in mainstream kernels, such as those of Linux, FreeBSD or Mac OS X, where the scheduler and processes interact in complex ways. We propose the first logic that is able to decompose the verification of preemptive multiprocessor kernel code into verifying the scheduler and the rest of the kernel separately, even in the presence of complex interdependencies between the two components. The logic hides the manipulation of control by the scheduler when reasoning about preemptable code and soundly inherits proof rules from concurrent separation logic to verify it thread-modularly. We illustrate the power of our logic by verifying an example scheduler, which includes some of the key features of the scheduler from Linux 2.6.11 challenging for verification.

scholarly journals Linear capabilities for fully abstract compilation of separation-logic-verified code

2021 ◽  
Vol 31 ◽  
Author(s):  
THOMAS VAN STRYDONCK ◽  
FRANK PIESSENS ◽  
DOMINIQUE DEVRIESE
Keyword(s):  
Spatial Separation ◽  
Separation Logic ◽  
Target Language ◽  
Fine Grained ◽  
Dynamic Contract ◽  
Modular Verification ◽  
Source Program ◽  
Memory Accesses ◽  
Memory Resources ◽  
Efficient Memory

Abstract Separation logic is a powerful program logic for the static modular verification of imperative programs. However, dynamic checking of separation logic contracts on the boundaries between verified and untrusted modules is hard because it requires one to enforce (among other things) that outcalls from a verified to an untrusted module do not access memory resources currently owned by the verified module. This paper proposes an approach to dynamic contract checking by relying on support for capabilities, a well-studied form of unforgeable memory pointers that enables fine-grained, efficient memory access control. More specifically, we rely on a form of capabilities called linear capabilities for which the hardware enforces that they cannot be copied. We formalize our approach as a fully abstract compiler from a statically verified source language to an unverified target language with support for linear capabilities. The key insight behind our compiler is that memory resources described by spatial separation logic predicates can be represented at run time by linear capabilities. The compiler is separation-logic-proof-directed: it uses the separation logic proof of the source program to determine how memory accesses in the source program should be compiled to linear capability accesses in the target program. The full abstraction property of the compiler essentially guarantees that compiled verified modules can interact with untrusted target language modules as if they were compiled from verified code as well. This article is an extended version of one that was presented at ICFP 2019 (Van Strydonck et al., 2019).

scholarly journals Cosmo: a concurrent separation logic for multicore OCaml

2020 ◽  
Vol 4 (ICFP) ◽  
pp. 1-29
Author(s):  
Glen Mével ◽  
Jacques-Henri Jourdan ◽  
François Pottier
Keyword(s):  
Separation Logic ◽  
Concurrent Separation Logic

scholarly journals TaDA Live: Compositional Reasoning for Termination of Fine-grained Concurrent Programs

2021 ◽  
Vol 43 (4) ◽  
pp. 1-134
Author(s):  
Emanuele D’Osualdo ◽  
Julian Sutherland ◽  
Azadeh Farzan ◽  
Philippa Gardner
Keyword(s):  
Case Studies ◽  
Separation Logic ◽  
Proof System ◽  
Concurrent Programs ◽  
Semantic Model ◽  
Compositional Reasoning ◽  
Fine Grained ◽  
Fundamental Innovation ◽  
Concurrent Separation Logic

We present TaDA Live, a concurrent separation logic for reasoning compositionally about the termination of blocking fine-grained concurrent programs. The crucial challenge is how to deal with abstract atomic blocking : that is, abstract atomic operations that have blocking behaviour arising from busy-waiting patterns as found in, for example, fine-grained spin locks. Our fundamental innovation is with the design of abstract specifications that capture this blocking behaviour as liveness assumptions on the environment. We design a logic that can reason about the termination of clients that use such operations without breaking their abstraction boundaries, and the correctness of the implementations of the operations with respect to their abstract specifications. We introduce a novel semantic model using layered subjective obligations to express liveness invariants and a proof system that is sound with respect to the model. The subtlety of our specifications and reasoning is illustrated using several case studies.

scholarly journals Skipping the binder bureaucracy with mixed embeddings in a semantics course (functional pearl)

2021 ◽  
Vol 5 (ICFP) ◽  
pp. 1-28
Author(s):  
Adam Chlipala
Keyword(s):  
Order Reduction ◽  
Separation Logic ◽  
Variable Binding ◽  
Type Checking ◽  
Session Types ◽  
The Coq Proof Assistant ◽  
Reduction Program ◽  
Coq Proof Assistant ◽  
Big Ideas ◽  
Concurrent Separation Logic

Rigorous reasoning about programs calls for some amount of bureaucracy in managing details like variable binding, but, in guiding students through big ideas in semantics, we might hope to minimize the overhead. We describe our experiment introducing a range of such ideas, using the Coq proof assistant, without any explicit representation of variables, instead using a higher-order syntax encoding that we dub "mixed embedding": it is neither the fully explicit syntax of deep embeddings nor the syntax-free programming of shallow embeddings. Marquee examples include different takes on concurrency reasoning, including in the traditions of model checking (partial-order reduction), program logics (concurrent separation logic), and type checking (session types) -- all presented without any side conditions on variables.

Concurrent separation logic

2016 ◽  
Vol 3 (3) ◽  
pp. 47-65 ◽  
Author(s):  
Stephen Brookes ◽  
Peter W. O'Hearn
Keyword(s):  
Separation Logic ◽  
Concurrent Separation Logic

scholarly journals Revisiting concurrent separation logic

2017 ◽  
Vol 89 ◽  
pp. 41-66
Author(s):  
Pedro Soares ◽  
António Ravara ◽  
Simão Melo de Sousa
Keyword(s):  
Separation Logic ◽  
Concurrent Separation Logic
Sign in / Sign up

Export Citation Format

Share Document