heap.v 9.26 KB
Newer Older
1
2
3
4
From iris.heap_lang Require Export lifting.
From iris.algebra Require Import upred_big_op frac dec_agree.
From iris.program_logic Require Export invariants ghost_ownership.
From iris.program_logic Require Import ownership auth.
Ralf Jung's avatar
Ralf Jung committed
5
From iris.proofmode Require Import weakestpre.
6
7
8
9
10
Import uPred.
(* TODO: The entire construction could be generalized to arbitrary languages that have
   a finmap as their state. Or maybe even beyond "as their state", i.e. arbitrary
   predicates over finmaps instead of just ownP. *)

11
Definition heapUR : ucmraT := gmapUR loc (prodR fracR (dec_agreeR val)).
12

13
(** The CMRA we need. *)
14
Class heapG Σ := HeapG {
15
  heap_inG :> authG heap_lang Σ heapUR;
16
17
  heap_name : gname
}.
18
(** The Functor we need. *)
19
Definition heapGF : gFunctor := authGF heapUR.
20

21
22
Definition to_heap : state  heapUR := fmap (λ v, (1%Qp, DecAgree v)).
Definition of_heap : heapUR  state := omap (maybe DecAgree  snd).
23

24
25
Section definitions.
  Context `{i : heapG Σ}.
26

27
  Definition heap_mapsto (l : loc) (q : Qp) (v: val) : iPropG heap_lang Σ :=
28
    auth_own heap_name {[ l := (q, DecAgree v) ]}.
29
  Definition heap_inv (h : heapUR) : iPropG heap_lang Σ :=
30
31
32
33
    ownP (of_heap h).
  Definition heap_ctx (N : namespace) : iPropG heap_lang Σ :=
    auth_ctx heap_name N heap_inv.

34
  Global Instance heap_inv_proper : Proper (() ==> ()) heap_inv.
35
  Proof. solve_proper. Qed.
36
  Global Instance heap_ctx_persistent N : PersistentP (heap_ctx N).
37
38
  Proof. apply _. Qed.
End definitions.
Robbert Krebbers's avatar
Robbert Krebbers committed
39

40
Typeclasses Opaque heap_ctx heap_mapsto.
Robbert Krebbers's avatar
Robbert Krebbers committed
41
42
43
Instance: Params (@heap_inv) 1.
Instance: Params (@heap_mapsto) 4.
Instance: Params (@heap_ctx) 2.
44

Robbert Krebbers's avatar
Robbert Krebbers committed
45
46
47
Notation "l ↦{ q } v" := (heap_mapsto l q v)
  (at level 20, q at level 50, format "l  ↦{ q }  v") : uPred_scope.
Notation "l ↦ v" := (heap_mapsto l 1 v) (at level 20) : uPred_scope.
48

49
Section heap.
50
  Context {Σ : gFunctors}.
51
  Implicit Types N : namespace.
52
53
  Implicit Types P Q : iPropG heap_lang Σ.
  Implicit Types Φ : val  iPropG heap_lang Σ.
54
  Implicit Types σ : state.
55
  Implicit Types h g : heapUR.
56

57
  (** Conversion to heaps and back *)
58
  Global Instance of_heap_proper : Proper (() ==> (=)) of_heap.
59
  Proof. solve_proper. Qed.
60
  Lemma from_to_heap σ : of_heap (to_heap σ) = σ.
61
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
62
63
64
    apply map_eq=>l. rewrite lookup_omap lookup_fmap. by case (σ !! l).
  Qed.
  Lemma to_heap_valid σ :  to_heap σ.
65
  Proof. intros l. rewrite lookup_fmap. by case (σ !! l). Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
66
  Lemma of_heap_insert l v h :
67
68
    of_heap (<[l:=(1%Qp, DecAgree v)]> h) = <[l:=v]> (of_heap h).
  Proof. by rewrite /of_heap -(omap_insert _ _ _ (1%Qp, DecAgree v)). Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
69
  Lemma of_heap_singleton_op l q v h :
70
71
     ({[l := (q, DecAgree v)]}  h) 
    of_heap ({[l := (q, DecAgree v)]}  h) = <[l:=v]> (of_heap h).
Robbert Krebbers's avatar
Robbert Krebbers committed
72
73
74
75
  Proof.
    intros Hv. apply map_eq=> l'; destruct (decide (l' = l)) as [->|].
    - move: (Hv l). rewrite /of_heap lookup_insert
        lookup_omap (lookup_op _ h) lookup_singleton.
Robbert Krebbers's avatar
Robbert Krebbers committed
76
      case _:(h !! l)=>[[q' [v'|]]|] //=; last by move=> [??].
Robbert Krebbers's avatar
Robbert Krebbers committed
77
78
      move=> [? /dec_agree_op_inv [->]]. by rewrite dec_agree_idemp.
    - rewrite /of_heap lookup_insert_ne // !lookup_omap.
79
      by rewrite (lookup_op _ h) lookup_singleton_ne // left_id_L.
Robbert Krebbers's avatar
Robbert Krebbers committed
80
81
  Qed.
  Lemma to_heap_insert l v σ :
82
    to_heap (<[l:=v]> σ) = <[l:=(1%Qp, DecAgree v)]> (to_heap σ).
83
  Proof. by rewrite /to_heap -fmap_insert. Qed.
84
  Lemma of_heap_None h l :  h  of_heap h !! l = None  h !! l = None.
85
  Proof.
86
    move=> /(_ l). rewrite /of_heap lookup_omap.
Robbert Krebbers's avatar
Robbert Krebbers committed
87
    by case: (h !! l)=> [[q [v|]]|] //=; destruct 1; auto.
88
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
89
  Lemma heap_store_valid l h v1 v2 :
90
91
     ({[l := (1%Qp, DecAgree v1)]}  h) 
     ({[l := (1%Qp, DecAgree v2)]}  h).
92
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
93
94
    intros Hv l'; move: (Hv l'). destruct (decide (l' = l)) as [->|].
    - rewrite !lookup_op !lookup_singleton.
95
      by case: (h !! l)=> [x|] // /Some_valid/exclusive_l.
Robbert Krebbers's avatar
Robbert Krebbers committed
96
    - by rewrite !lookup_op !lookup_singleton_ne.
97
  Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
98
  Hint Resolve heap_store_valid.
Robbert Krebbers's avatar
Robbert Krebbers committed
99

100
  (** Allocation *)
101
  Lemma heap_alloc N E σ :
102
    authG heap_lang Σ heapUR  nclose N  E 
103
    ownP σ ={E}=>  _ : heapG Σ, heap_ctx N  [ map] lv  σ, l  v.
Ralf Jung's avatar
Ralf Jung committed
104
  Proof.
105
    intros. rewrite -{1}(from_to_heap σ). etrans.
106
    { rewrite [ownP _]later_intro.
Robbert Krebbers's avatar
Robbert Krebbers committed
107
      apply (auth_alloc (ownP  of_heap) N E); auto using to_heap_valid. }
108
    apply pvs_mono, exist_elim=> γ.
109
    rewrite -(exist_intro (HeapG _ _ γ)) /heap_ctx; apply and_mono_r.
110
    rewrite /heap_mapsto /heap_name.
111
112
113
    induction σ as [|l v σ Hl IH] using map_ind.
    { rewrite big_sepM_empty; apply True_intro. }
    rewrite to_heap_insert big_sepM_insert //.
114
    rewrite (insert_singleton_op (to_heap σ));
Robbert Krebbers's avatar
Robbert Krebbers committed
115
      last by rewrite lookup_fmap Hl; auto.
116
    by rewrite auth_own_op IH.
Ralf Jung's avatar
Ralf Jung committed
117
  Qed.
Ralf Jung's avatar
Ralf Jung committed
118

119
120
121
  Context `{heapG Σ}.

  (** General properties of mapsto *)
Robbert Krebbers's avatar
Robbert Krebbers committed
122
123
124
  Global Instance heap_mapsto_timeless l q v : TimelessP (l {q} v).
  Proof. rewrite /heap_mapsto. apply _. Qed.

125
  Lemma heap_mapsto_op_eq l q1 q2 v : l {q1} v  l {q2} v  l {q1+q2} v.
126
  Proof. by rewrite -auth_own_op op_singleton pair_op dec_agree_idemp. Qed.
Robbert Krebbers's avatar
Robbert Krebbers committed
127
128

  Lemma heap_mapsto_op l q1 q2 v1 v2 :
129
    l {q1} v1  l {q2} v2  v1 = v2  l {q1+q2} v1.
130
  Proof.
Robbert Krebbers's avatar
Robbert Krebbers committed
131
132
    destruct (decide (v1 = v2)) as [->|].
    { by rewrite heap_mapsto_op_eq const_equiv // left_id. }
133
    rewrite -auth_own_op op_singleton pair_op dec_agree_ne //.
134
    apply (anti_symm ()); last by apply const_elim_l.
135
    rewrite auth_own_valid gmap_validI (forall_elim l) lookup_singleton.
136
137
    rewrite option_validI prod_validI frac_validI discrete_valid.
    by apply const_elim_r.
138
139
  Qed.

140
  Lemma heap_mapsto_op_split l q v : l {q} v  (l {q/2} v  l {q/2} v).
141
142
  Proof. by rewrite heap_mapsto_op_eq Qp_div_2. Qed.

143
  (** Weakest precondition *)
144
  Lemma wp_alloc N E e v Φ :
Ralf Jung's avatar
Ralf Jung committed
145
    to_val e = Some v  nclose N  E 
146
    heap_ctx N   ( l, l  v - Φ (LitV (LitLoc l)))  WP Alloc e @ E {{ Φ }}.
Ralf Jung's avatar
Ralf Jung committed
147
  Proof.
Ralf Jung's avatar
Ralf Jung committed
148
149
    iIntros {??} "[#Hinv HΦ]". rewrite /heap_ctx.
    iPvs (auth_empty heap_name) as "Hheap".
150
151
    iApply (auth_fsa heap_inv (wp_fsa _)); simpl; eauto.
    iFrame "Hinv Hheap". iIntros {h}. rewrite left_id.
Ralf Jung's avatar
Ralf Jung committed
152
153
    iIntros "[% Hheap]". rewrite /heap_inv.
    iApply wp_alloc_pst; first done. iFrame "Hheap". iNext.
154
    iIntros {l} "[% Hheap]". iExists {[ l := (1%Qp, DecAgree v) ]}.
Ralf Jung's avatar
Ralf Jung committed
155
    rewrite -of_heap_insert -(insert_singleton_op h); last by apply of_heap_None.
156
    iFrame "Hheap". iSplit; first iPureIntro.
157
    { by apply alloc_unit_singleton_local_update; first apply of_heap_None. }
158
    iIntros "Hheap". iApply "HΦ". by rewrite /heap_mapsto.
159
160
  Qed.

Ralf Jung's avatar
Ralf Jung committed
161
162
  Lemma wp_load N E l q v Φ :
    nclose N  E 
163
    heap_ctx N   l {q} v   (l {q} v - Φ v)
164
     WP Load (Lit (LitLoc l)) @ E {{ Φ }}.
Ralf Jung's avatar
Ralf Jung committed
165
  Proof.
166
    iIntros {?} "[#Hh [Hl HΦ]]". rewrite /heap_ctx /heap_mapsto.
167
    iApply (auth_fsa heap_inv (wp_fsa _)); simpl; eauto.
168
    iFrame "Hh Hl". iIntros {h} "[% Hl]". rewrite /heap_inv.
Ralf Jung's avatar
Ralf Jung committed
169
    iApply (wp_load_pst _ (<[l:=v]>(of_heap h)));first by rewrite lookup_insert.
170
171
172
    rewrite of_heap_singleton_op //. iFrame "Hl".
    iIntros "> Hown". iExists _; iSplit; first done.
    rewrite of_heap_singleton_op //. by iFrame.
Ralf Jung's avatar
Ralf Jung committed
173
174
  Qed.

175
176
  Lemma wp_store N E l v' e v Φ :
    to_val e = Some v  nclose N  E 
177
    heap_ctx N   l  v'   (l  v - Φ (LitV LitUnit))
178
     WP Store (Lit (LitLoc l)) e @ E {{ Φ }}.
Ralf Jung's avatar
Ralf Jung committed
179
  Proof.
180
    iIntros {??} "[#Hh [Hl HΦ]]". rewrite /heap_ctx /heap_mapsto.
181
    iApply (auth_fsa heap_inv (wp_fsa _)); simpl; eauto.
182
    iFrame "Hh Hl". iIntros {h} "[% Hl]". rewrite /heap_inv.
183
    iApply (wp_store_pst _ (<[l:=v']>(of_heap h))); rewrite ?lookup_insert //.
184
185
186
187
    rewrite insert_insert !of_heap_singleton_op; eauto. iFrame "Hl".
    iIntros "> Hown". iExists {[l := (1%Qp, DecAgree v)]}; iSplit.
    { iPureIntro; by apply singleton_local_update, exclusive_local_update. }
    rewrite of_heap_singleton_op //; eauto. by iFrame.
Ralf Jung's avatar
Ralf Jung committed
188
189
  Qed.

190
191
  Lemma wp_cas_fail N E l q v' e1 v1 e2 v2 Φ :
    to_val e1 = Some v1  to_val e2 = Some v2  v'  v1  nclose N  E 
192
    heap_ctx N   l {q} v'   (l {q} v' - Φ (LitV (LitBool false)))
193
     WP CAS (Lit (LitLoc l)) e1 e2 @ E {{ Φ }}.
Ralf Jung's avatar
Ralf Jung committed
194
  Proof.
195
    iIntros {????} "[#Hh [Hl HΦ]]". rewrite /heap_ctx /heap_mapsto.
196
    iApply (auth_fsa heap_inv (wp_fsa _)); simpl; eauto 10.
197
    iFrame "Hh Hl". iIntros {h} "[% Hl]". rewrite /heap_inv.
198
    iApply (wp_cas_fail_pst _ (<[l:=v']>(of_heap h))); rewrite ?lookup_insert //.
199
200
201
    rewrite of_heap_singleton_op //. iFrame "Hl".
    iIntros "> Hown". iExists _; iSplit; first done.
    rewrite of_heap_singleton_op //. by iFrame.
Ralf Jung's avatar
Ralf Jung committed
202
  Qed.
Ralf Jung's avatar
Ralf Jung committed
203

204
205
  Lemma wp_cas_suc N E l e1 v1 e2 v2 Φ :
    to_val e1 = Some v1  to_val e2 = Some v2  nclose N  E 
206
    heap_ctx N   l  v1   (l  v2 - Φ (LitV (LitBool true)))
207
     WP CAS (Lit (LitLoc l)) e1 e2 @ E {{ Φ }}.
Ralf Jung's avatar
Ralf Jung committed
208
  Proof.
209
    iIntros {???} "[#Hh [Hl HΦ]]". rewrite /heap_ctx /heap_mapsto.
210
    iApply (auth_fsa heap_inv (wp_fsa _)); simpl; eauto 10.
211
    iFrame "Hh Hl". iIntros {h} "[% Hl]". rewrite /heap_inv.
212
    iApply (wp_cas_suc_pst _ (<[l:=v1]>(of_heap h))); rewrite ?lookup_insert //.
213
214
215
216
    rewrite insert_insert !of_heap_singleton_op; eauto. iFrame "Hl".
    iIntros "> Hown". iExists {[l := (1%Qp, DecAgree v2)]}; iSplit.
    { iPureIntro; by apply singleton_local_update, exclusive_local_update. }
    rewrite of_heap_singleton_op //; eauto. by iFrame.
Ralf Jung's avatar
Ralf Jung committed
217
  Qed.
218
End heap.