Oracle Semantics
Total Page:16
File Type:pdf, Size:1020Kb
Oracle Semantics Aquinas Hobor A Dissertation Presented to the Faculty of Princeton University in Candidacy for the Degree of Doctor of Philosophy Recommended for Acceptance By the Department of Computer Science Advisor: Andrew W. Appel November Copyright c Aquinas Hobor. All rights reserved. Abstract We define a Concurrent Separation Logic with first-class locks and threads for the C language, and prove its soundness in Coq with re- spect to a compilable operataional semantics. We define the language Concurrent C minor, an extension of the C minor language of Leroy. C minor was designed as the highest-level intermediate language in the CompCert certified ANSI C compiler, and we add to it lock, unlock, and fork statements to make Concurrent C minor, giving it a standard Pthreads style of concurrency. We define a Concurrent Separation Logic for Concurrent C minor, which extends the original Concurrent Separation Logic of O’Hearn to handle first- class locks and threads. We then prove the soundness of the logic with respect to the opera- tional semantics of the language. First, we define an erased concurrent operational semantics for Concurrent C minor that is a reasonable ab- straction for concurrent execution on a real machine. Second, we define a new modal substructural logic which we use as the model for as- sertions in Concurrent Separation Logic. Third, we define an unerased iii concurrent operational semantics for Concurrent C minor that keeps track of additional bookkeeping to demonstrate the programs are well- behaved. Fourth, we define an oracle semantics that is a thread-local se- mantics of Concurrent C minor; this allows us to separate the metathe- ory of sequential and concurrent computation from each other. Fifth, we give a new semantics to the Hoare tuple using our modal substructural logic that connects Concurrent Separation Logic to our oracle semantics and then connect our oracle semantics to our concurrent semantics. Our soundness proofs are largely implemented in 60,000 lines of Coq; our modular proof design allows us to largely reuse a significant portion of the soundness proofs of the sequential subset of Concurrent Separation Logic developed by Appel and Blazy. Our ability to reuse those proofs gives us confidence that we will be able to modify the CompCert compiler proofs to handle Concurrent C minor in the future. iv Acknowledgements A PhD takes considerable effort, and I am very grateful to the many people who have provided friendship and support during my five years at Princeton. I would like to acknowledge the following people. My advisor, Andrew Appel, for being extremely generous with his time and energy. I have very much enjoyed learning from and working with him and am very proud of what we have done. It has been fun. My thesis readers, David Walker and Peter O’Hearn, provided help- ful suggestions to improve the text and did a wonderful job reading a long thesis in a short time. I would also like to thank my nonreaders, Brian Kernighan and Vivek Pai, for their support. My friends near and far, including Ian Adams, Stephen Adams, David Beazley, C.J. Bell, Christian Bienia, Elizabeth Cheehy, Manuvir Das, Rob Dockins, M. and Mme. Dubosc, R.J. Dragani, Gilles Goulas, Carl Haefling and Pam Johnson, Joe Helmer, Mark Kormes, Jason (Wen Di) Li, David MacQueen, Francesco Zappa Nardelli, Travis Pew, Christopher Richards, Ari Schwayder, Tushar and Rupa Shanbhag, Chris Sherman, Colleen Smith, Dan Suberviola, Charlie Trapp, Steve v Wilson, and Daniel Wang. My in-laws, Steve and Fonde Werts, for being so kind and generous to their son in law. My brother in-law, Charlie Werts, deserves special mention, among other reasons, for his loan of the somewhat incompre- hensible yet enjoyable anime series RahXephon. My three grandparents- in-law—Ernie, Joe, and Martha—have been very generous as well. My family, including my mother, Nancy Hobor; my father, Mike Hobor; my Grandmother, Jane Coulson; and last (but probably not least) my brother, Justinian Hobor. Few things in life give me more pleasure than blowing up his wonders in Civ 4. My Aunt Nancy and Uncle Andy have been very generous in letting me and my wife visit them in Maine, which we have throughly enjoyed. My Aunt Jane and Uncle Jim helped make New Jersey more hospitable. I would also like to thank my cousin George Ellis for letting me stay with him when I visited Rochester. Finally, my wonderful wife, Lucy Day. We made it! This research was supported in part by National Science Foundation grant CCF-0540914. In addition, I gratefully acknowledge three sum- mer internships and the people who made them possible: the Program Analysis Group at Microsoft Redmond (Stephen Adams), Lapides As- set Management (Steve Wilson), and the MOSCOVA project at INRIA Rocquencourt (Francesco Zappa Nardelli). vi Contents Abstract iii Acknowledgements v Contents vii List of Figures xii List of Tables xv 1 Introduction 1.1 Concurrency and Multiple Cores . 1.2 FormalMethods....................... 1.3 TheGoalofOracleSemantics . 1.4 StructureofThesis . 2 Related Work 2.1 Hoarelogicandseparationlogic . 2.2 ConcurrentSeparationLogic . 2.3 Rely/Guarantee. vii 2.4 CminorandCompCert . 2.5 SeparationLogicforCminor . 2.6 GenerationofproofsinCSL . 2.7 Gotsmanetal.’sCSL. 2.8 Miscellaneous related work . 3 Concurrent C minor 3.1 The Concurrent C minor language . 3.2 Programmingwithlocks . 4 Concurrent Separation Logic 4.1 Basicassertions . .. .. 4.2 Sequential separation logic assertions . 4.3 Fractionalownership . 4.4 Stratifiedseparationalgebras . 4.5 Additionalpropertiesforshares . 4.6 Sharemodels ........................ 4.7 NewassertionsforCSL. 4.8 Concurrent separation logic Hoare rules . 4.9 Applying CSL to the example program . 4.10 Conclusions ......................... 5 Erased Concurrent Operational Semantics 5.1 Erased sequential step relation . 5.2 Erased concurrent step relation . 5.3 Reasonableness of interleaving model . viii 5.4 Conclusion.......................... 6 Engineering Isolation 6.1 ModularizationGoals. 6.2 Shareddefinitionsforglue . 6.3 An Extensible Semantics . 6.4 Building an extension . 6.5 Gluing a core and extension together . 6.6 Notationfortherestofthethesis . 7 A Modal Substructural Logic 7.1 Modelling difficulties . 7.2 A substructural modal model . 7.3 Reasoning about the model with a modal substructural logic ............................. 7.4 Conclusions ......................... 8 Concurrent Operational Semantics 8.1 Architecture......................... 8.2 Sequential submachine . 8.3 Machinestate ........................ 8.4 Consistent machines . 8.5 Concurrentsteprelation . 8.6 Reasonableness of the step relation . 8.7 Conclusions ......................... ix 9 Oracle Semantics 9.1 Whyanoracularsemantics. 9.2 Concurrentoracle. 9.3 Concurrent consult relation................. 9.4 Theoracularstep .. .. 9.5 Conclusion.......................... 10 A Modal Hoare Judgment and Oracular Soundness 10.1 AmodalHoarejudgment. 10.2 HoarejudgmentsinCSL . 10.3 Soundness of the Oracular Approach . 10.4 Conclusion.......................... 11 Conclusions and Future Work 11.1 StateoftheCoqDevelopment . 11.2Futurework ......................... 11.3 Concludingthoughts . A A Miniature Model in Coq A.1 Headers ........................... A.2 StratifiedModel. A.3 DependentModel . A.4 Private definitions relating public to private . A.5 Public interface to acquire resource . B Proofs x B.1 Theunlockrule ....................... B.2 Forkingachild ....................... Bibliography xi List of Figures 2.1 Leroy’s C minor expressions . 2.2 Leroy’sCminorstatements . 2.3 Appel and Blazy’s C minor . 2.4 Models of the Sequential Separation Logic Operators . 2.5 Continuation-passing style definition of Hoare tuple . 2.6 Axiomatic Semantics of Separation Logic (without call and return).............................. 3.1 Sampleconcurrentprogram . 3.2 Informal description of R(l) .................. 4.1 ConcurrentSeparationLogic. 4.2 Resource invariant for example program . 5.1 Erased sequential step relation . 5.2 Erased concurrent step relation . 6.1 Anextensiblelanguage. 6.2 Shared definitions in all CompCert languages . xii 6.3 Axiomatic presentation of resources and resource maps . 6.4 Interface for extensible semantics . 6.5 Axioms for Extensible Semantics . 6.6 Axioms for C minor memory model . 6.7 Basic definitions for Extensible Semantics . 6.8 Interfaceforextension . 6.9 Coqoracularsteprelation . 6.10 Oracularsteprelation . 7.1 Na¨ıveassertionmodel . 7.2 Sketch of substructural modal model . 7.3 Increasing approximation . 7.4 Interface to substructural modal model . 7.5 Modelsoflogicalassertions . 7.6 Modelsofmodalassertions. 7.7 Models of substructural assertions . 7.8 Rules for reasoning in the modal substructural logic . 7.9 Models of Concurrent Separation Logic assertions . 7.10 Logicalimplicationinthelogic . 7.11 Extensionality, validity, precision, and tightness . ...... 7.12Recursion ............................ 8.1 Simplified subset of sequential step relation . 8.2 The consult relation of the sequential submachine . 8.3 Sequential steps in the concurrent step relation . xiii 8.4 Fully concurrent steps in the concurrent step relation . 9.1 The oracle allows for reasoning after a concurrent instruction 9.2 Oracularprojection. 9.3 Runningtheotherthreads . 9.4 The oracular consult relation.................. 10.1 Oracularsafety . .. .. 10.2 Na¨ıve continuation-passing style