Modular specification and verification of interprocess communication

Authors:
Eyad Alkassar;Ernie Cohen;Mark Hillebrand;Hristo Pentchev
Affiliations:
Saarland University, Saarbrücken, Germany;European Microsoft Innovation Center (EMIC GmbH), Aachen, Germany;European Microsoft Innovation Center (EMIC GmbH), Aachen, Germany;Saarland University, Saarbrücken, Germany
Venue:
Proceedings of the 2010 Conference on Formal Methods in Computer-Aided Design
Year:
2010

Citing 7
Cited 0

Reduction in TLA

CONCUR '98 Proceedings of the 9th International Conference on Concurrency Theory
Permission accounting in separation logic

Proceedings of the 32nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Certifying Low-Level Programs with Hardware Interrupts and Preemptive Threads

Journal of Automated Reasoning
Proving Fairness and Implementation Correctness of a Microkernel Scheduler

Journal of Automated Reasoning
seL4: formal verification of an OS kernel

Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles
Concurrent abstract predicates

ECOOP'10 Proceedings of the 24th European conference on Object-oriented programming
Local verification of global invariants in concurrent programs

CAV'10 Proceedings of the 22nd international conference on Computer Aided Verification

Quantified Score

Hi-index	0.00

Visualization

Abstract

The usual goal in implementing IPC is to make a cross-thread procedure call look like a local procedure call. However, formal specifications of IPC typically talk only about data transfer, forcing IPC clients to use additional global invariants to recover the sequential function call semantics. We propose a more powerful specification in which IPC clients exchange knowledge and permissions in addition to data. The resulting specification is polymorphic in the specification of the service provided, yet allows a client to use IPC without additional global invariants. We verify our approach using VCC, an automatic verifier for (suitably annotated) concurrent C code, and demonstrate its expressiveness by applying it to the verification of a multiprocessor flush algorithm.