Concurrent Separation Logic and AssumeGuarantee 竞争对手的分离逻辑和假设的保证.pptVIP

On the Relationship Between Concurrent Separation Logic and Assume-Guarantee Reasoning Xinyu Feng Yale University Motivation Concurrency verification is challenging! Two kinds of modularity Control modularity a.k.a. thread-modularity each thread is verified independently of others Data modularity a.k.a. information hiding each thread only cares about data it uses Existing work Assume-Guarantee (A-G) reasoning  [MisraChandy’81, Jones’83] thread modularity general: no restriction over synchronization pattern spec of AG requires global data invariants Concurrent Separation Logic (CSL) [O’Hearn, Brookes 2004] thread modularity data modularity: local reasoning restrictive synchronization pattern shared resources can be accessed only inside critical regions Our Contributions SAGL: combining CSL and A-G reasoning extend A-G logic with local reasoning better data modularity (than A-G reasoning) thread modularity no restriction over synchronization pattern A formal study of the relationship between CSL and A-G reasoning Outline of this talk Background Concurrent Separation Logic Assume-Guarantee reasoning SAGL: combination of CSL A-G reasoning Interpretation of CSL in SAGL Concurrent Separation Logic Assertions capture ownerships of resources Cannot access resource without ownership Shared resources are protected by critical regions (CRs) Transfer of ownership at boundary of CR CSL assertions Locks and Critical Regions Lock-based critical regions (CR): Concurrent Separation Logic Example: List Concurrent Separation Logic Thread modularity Data modularity by local reasoning do not need knowledge of other threads’ data Ownership transfer is bound with CRs requires built-in critical regions hard to support ad-hoc synchronizations Outline of this talk Background Concurrent Separation Logic Assume-Guarantee reasoning SAGL: combination of CSL A-G reasoning Interpretation of CSL in SAGL Assume-Gu