Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Iris
Fairis
Commits
042e24dc
Commit
042e24dc
authored
Feb 14, 2016
by
Ralf Jung
Browse files
prove 'strong' allocation of ghost state, with more control over the name that has been picked
parent
22cf8bd9
Changes
4
Hide whitespace changes
Inline
Side-by-side
algebra/fin_maps.v
View file @
042e24dc
...
...
@@ -295,16 +295,22 @@ Proof. eauto using map_singleton_updateP_empty. Qed.
Section
freshness
.
Context
`
{
Fresh
K
(
gset
K
),
!
FreshSpec
K
(
gset
K
)
}
.
Lemma
map_updateP_alloc
(
Q
:
gmap
K
A
→
Prop
)
m
x
:
✓
x
→
(
∀
i
,
m
!!
i
=
None
→
Q
(
<
[
i
:=
x
]
>
m
))
→
m
~~>:
Q
.
Lemma
map_updateP_alloc
_strong
(
Q
:
gmap
K
A
→
Prop
)
(
I
:
gset
K
)
m
x
:
✓
x
→
(
∀
i
,
m
!!
i
=
None
→
i
∉
I
→
Q
(
<
[
i
:=
x
]
>
m
))
→
m
~~>:
Q
.
Proof
.
intros
?
HQ
mf
n
Hm
.
set
(
i
:=
fresh
(
dom
(
gset
K
)
(
m
⋅
mf
))).
assert
(
i
∉
dom
(
gset
K
)
m
∧
i
∉
dom
(
gset
K
)
mf
)
as
[
?
?
].
{
rewrite
-
not_elem_of_union
-
map_dom_op
;
apply
is_fresh
.
}
exists
(
<
[
i
:=
x
]
>
m
)
;
split
;
first
by
apply
HQ
,
not_elem_of_dom
.
intros
?
HQ
mf
n
Hm
.
set
(
i
:=
fresh
(
I
∪
dom
(
gset
K
)
(
m
⋅
mf
))).
assert
(
i
∉
I
∧
i
∉
dom
(
gset
K
)
m
∧
i
∉
dom
(
gset
K
)
mf
)
as
[
?
[
??
]
].
{
rewrite
-
not_elem_of_union
-
map_dom_op
-
not_elem_of_union
;
apply
is_fresh
.
}
exists
(
<
[
i
:=
x
]
>
m
)
.
split
;
first
by
(
apply
HQ
;
last
done
;
apply
not_elem_of_dom
)
.
rewrite
-
map_insert_op_None
;
last
by
apply
not_elem_of_dom
.
by
apply
map_insert_validN
;
[
apply
cmra_valid_validN
|
].
Qed
.
Lemma
map_updateP_alloc
(
Q
:
gmap
K
A
→
Prop
)
m
x
:
✓
x
→
(
∀
i
,
m
!!
i
=
None
→
Q
(
<
[
i
:=
x
]
>
m
))
→
m
~~>:
Q
.
Proof
.
move
=>??
.
eapply
map_updateP_alloc_strong
with
(
I
:=
∅
);
by
eauto
.
Qed
.
Lemma
map_updateP_alloc_strong
'
m
x
(
I
:
gset
K
)
:
✓
x
→
m
~~>:
λ
m
'
,
∃
i
,
i
∉
I
∧
m
'
=
<
[
i
:=
x
]
>
m
∧
m
!!
i
=
None
.
Proof
.
eauto
using
map_updateP_alloc_strong
.
Qed
.
Lemma
map_updateP_alloc
'
m
x
:
✓
x
→
m
~~>:
λ
m
'
,
∃
i
,
m
'
=
<
[
i
:=
x
]
>
m
∧
m
!!
i
=
None
.
Proof
.
eauto
using
map_updateP_alloc
.
Qed
.
...
...
program_logic/auth.v
View file @
042e24dc
...
...
@@ -82,17 +82,19 @@ Section auth.
(
*
Notice
how
the
user
has
to
prove
that
`b
⋅
a
'`
is
valid
at
all
step
-
indices
.
However
,
since
A
is
timeless
,
that
should
not
be
a
restriction
.
*
)
Lemma
auth_fsa
{
B
C
}
(
fsa
:
FSA
Λ
(
globalF
Σ
)
B
)
`
{!
FrameShiftAssertion
fsaV
fsa
}
L
{
Lv
}
{
LU
:
∀
c
:
C
,
LocalUpdate
(
Lv
c
)
(
L
c
)
}
N
E
P
(
Q
:
B
→
iPropG
Λ
Σ
)
γ
a
:
a
restriction
.
"I"
here
is
an
index
type
,
so
that
the
proof
can
still
have
some
influence
on
which
concrete
action
is
executed
*
after
*
it
saw
the
full
,
authoritative
state
.
*
)
Lemma
auth_fsa
{
B
I
}
(
fsa
:
FSA
Λ
(
globalF
Σ
)
B
)
`
{!
FrameShiftAssertion
fsaV
fsa
}
L
{
Lv
}
{
LU
:
∀
i
:
I
,
LocalUpdate
(
Lv
i
)
(
L
i
)
}
N
E
P
(
Q
:
B
→
iPropG
Λ
Σ
)
γ
a
:
fsaV
→
nclose
N
⊆
E
→
P
⊑
auth_ctx
AuthI
γ
N
φ
→
P
⊑
(
auth_own
AuthI
γ
a
★
(
∀
a
'
,
■
✓
(
a
⋅
a
'
)
★
▷
φ
(
a
⋅
a
'
)
-
★
fsa
(
E
∖
nclose
N
)
(
λ
x
,
∃
c
,
■
(
Lv
c
a
∧
✓
(
L
c
a
⋅
a
'
))
★
▷
φ
(
L
c
a
⋅
a
'
)
★
(
auth_own
AuthI
γ
(
L
c
a
)
-
★
Q
x
))))
→
∃
i
,
■
(
Lv
i
a
∧
✓
(
L
i
a
⋅
a
'
))
★
▷
φ
(
L
i
a
⋅
a
'
)
★
(
auth_own
AuthI
γ
(
L
i
a
)
-
★
Q
x
))))
→
P
⊑
fsa
E
Q
.
Proof
.
rewrite
/
auth_ctx
=>?
HN
Hinv
Hinner
.
...
...
@@ -104,7 +106,7 @@ Section auth.
(
*
Getting
this
wand
eliminated
is
really
annoying
.
*
)
rewrite
[(
■
_
★
_
)
%
I
]
comm
-!
assoc
[(
▷φ
_
★
_
★
_
)
%
I
]
assoc
[(
▷φ
_
★
_
)
%
I
]
comm
.
rewrite
wand_elim_r
fsa_frame_l
.
apply
(
fsa_mono_pvs
fsa
)
=>
x
.
rewrite
sep_exist_l
.
apply
exist_elim
=>
c
.
apply
(
fsa_mono_pvs
fsa
)
=>
x
.
rewrite
sep_exist_l
.
apply
exist_elim
=>
i
.
rewrite
comm
-!
assoc
.
apply
const_elim_sep_l
=>-
[
HL
Hv
].
rewrite
assoc
[(
_
★
(
_
-
★
_
))
%
I
]
comm
-
assoc
.
rewrite
auth_closing
//; []. erewrite pvs_frame_l. apply pvs_mono.
...
...
program_logic/ghost_ownership.v
View file @
042e24dc
...
...
@@ -82,14 +82,19 @@ Proof. unfold own; apply _. Qed.
(
*
TODO
:
This
also
holds
if
we
just
have
✓
a
at
the
current
step
-
idx
,
as
Iris
assertion
.
However
,
the
map_updateP_alloc
does
not
suffice
to
show
this
.
*
)
Lemma
own_alloc
a
E
:
✓
a
→
True
⊑
pvs
E
E
(
∃
γ
,
own
i
γ
a
).
Lemma
own_alloc
_strong
a
E
(
G
:
gset
gname
)
:
✓
a
→
True
⊑
pvs
E
E
(
∃
γ
,
■
(
γ
∉
G
)
∧
own
i
γ
a
).
Proof
.
intros
Ha
.
rewrite
-
(
pvs_mono
_
_
(
∃
m
,
■
(
∃
γ
,
m
=
to_globalF
i
γ
a
)
∧
ownG
m
)
%
I
).
rewrite
-
(
pvs_mono
_
_
(
∃
m
,
■
(
∃
γ
,
γ
∉
G
∧
m
=
to_globalF
i
γ
a
)
∧
ownG
m
)
%
I
).
*
eapply
pvs_ownG_updateP_empty
,
(
iprod_singleton_updateP_empty
i
);
first
(
eapply
map_updateP_alloc
'
,
cmra_transport_valid
,
Ha
);
naive_solver
.
*
apply
exist_elim
=>
m
;
apply
const_elim_l
=>-
[
γ
->
].
by
rewrite
-
(
exist_intro
γ
).
first
(
eapply
map_updateP_alloc_strong
'
,
cmra_transport_valid
,
Ha
);
naive_solver
.
*
apply
exist_elim
=>
m
;
apply
const_elim_l
=>-
[
γ
[
Hfresh
->
]].
by
rewrite
-
(
exist_intro
γ
)
const_equiv
.
Qed
.
Lemma
own_alloc
a
E
:
✓
a
→
True
⊑
pvs
E
E
(
∃
γ
,
own
i
γ
a
).
Proof
.
intros
Ha
.
rewrite
(
own_alloc_strong
a
E
∅
)
//; []. apply pvs_mono.
apply
exist_mono
=>?
.
eauto
with
I
.
Qed
.
Lemma
own_updateP
P
γ
a
E
:
...
...
program_logic/saved_prop.v
View file @
042e24dc
...
...
@@ -15,6 +15,10 @@ Section saved_prop.
Implicit
Types
P
Q
:
iPropG
Λ
Σ
.
Implicit
Types
γ
:
gname
.
Lemma
saved_prop_alloc_strong
N
P
(
G
:
gset
gname
)
:
True
⊑
pvs
N
N
(
∃
γ
,
■
(
γ
∉
G
)
∧
saved_prop_own
SPI
γ
P
).
Proof
.
by
apply
own_alloc_strong
.
Qed
.
Lemma
saved_prop_alloc
N
P
:
True
⊑
pvs
N
N
(
∃
γ
,
saved_prop_own
SPI
γ
P
).
Proof
.
by
apply
own_alloc
.
Qed
.
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment