Constraint Semantics for Abstract Read Permissions

Abstract

The concept of controlling access to mutable shared data via permissions is at the heart of permission logics such as separation logic and implicit dynamic frames, and is also used in type systems, for instance, to give a semantics to "readonly" annotations. Existing permission models have different strengths in terms of expressiveness. Fractional permissions, for example, enable unbounded (recursive) splitting, whereas counting permissions enable unbounded subtraction of the same permission amount. Combining these strengths in a single permission model appeared to increase the complexity for the user and tools. In this paper we extend our previous work on abstract read permissions by providing them with a novel constraint semantics, which retains the use of the domain of rational numbers but enables unbounded subtraction of identical amounts. Thus we can keep an intuitive model conducive to SMT solvers while enabling "counting."

Dynamic Frames Based Verification Method for Concurrent Java Programs

“…In this example four different threads manipulate two shared buffers to process and "draw" some input data passing the permissions to these buffers in a non-trivial way. Few other examples are available in the KeY distribution, in particular fully specified and verified readwrite lock example from [24] we mentioned above, and the examples from this and earlier paper on symbolic permissions are available on-line [22].…”

“…Our client code (ls. [24][25] specifies that in the locked state it holds a complete write permission to val, while in the unlocked state it holds no permission at all. Note that in this case these two are not the binary opposites of each other, hence the need for the locked parameter in status.…”

“…However, there will always be scenarios that would not fall within such a generic scheme. In particular, our version [11] of the motivating example from [24] that uses a primitive lock combined with a counter variable to effectively implement a semaphore-like read-write lock cannot be put in the frame of our Lock specification presented here without further extensions of this specification. Hence, we did not construct a complete generic specification solution for all API-based synchronisers, we only showed a methodology with a number of possible applications.…”

Automatic Inference of Symbolic Permissions for Sequential Java Programs

“…Furthermore, inference of fractional and quantified permissions has been investigated by Peter Müller and his colleagues [22,20] to verify classbased concurrent programs based on the abstract interpretations [18]. Similarly, permission-based specifications have been used in many formal approaches to address issues related to safe concurrency, security and verification of functional and domain specific properties [35,31,15,47,29,41,17,30,26,37,28].…”