1. 24 May, 2019 1 commit
    • Robbert Krebbers's avatar
      More consistent naming for `auth`. · 597ec42e
      Robbert Krebbers authored
      This MR is a follow up on the renamings performed (implicitly) as part of
      !215. This MR makes the following changes:
      
      - `auth_both_frac_valid` and `auth_both_valid` are now of the same shape
        as `auth_both_frac_validN` and `auth_both_validN`. That is, both are
        now biimplications.
      - The left-to-right  direction of `auth_both_frac_valid` and
        `auth_both_valid` only holds in case the camera is discrete. The
        right-to-left versions for non-discrete cameras are prefixed `_2`, the
        convention that we use throughout the development.
      - Change the direction of lemmas like `auth_frag_valid` and
        `auth_auth_valid` so that it's consistent with the other lemmas. I.e.
        make sure that the ◯ and ● are always on the LHS of the biimplication.
      597ec42e
  2. 23 May, 2019 1 commit
  3. 05 Mar, 2019 1 commit
  4. 27 Feb, 2019 1 commit
  5. 24 Jan, 2019 1 commit
  6. 29 Nov, 2018 1 commit
  7. 31 Oct, 2018 5 commits
    • Robbert Krebbers's avatar
    • Robbert Krebbers's avatar
      Get rid of `irisG'`. · d0f42b2a
      Robbert Krebbers authored
      d0f42b2a
    • Robbert Krebbers's avatar
    • Robbert Krebbers's avatar
      f7af5b3f
    • Robbert Krebbers's avatar
      Fine-grained post-conditions for forked-off threads. · ebf06f91
      Robbert Krebbers authored
      This commit extends the state interpretation with an additional parameter to
      talk about the number of forked-off threads, and a fixed postcondition for each
      forked-off thread:
      
          state_interp : Λstate → list Λobservation → nat → iProp Σ;
          fork_post : iProp Σ;
      
      This way, instead of having `True` as the post-condition of `Fork`, one can
      have any post-condition, which is then recorded in the state interpretation.
      The point of keeping track of the postconditions of forked-off threads, is that
      we get an (additional) stronger adequacy theorem:
      
          Theorem wp_strong_all_adequacy Σ Λ `{invPreG Σ} s e σ1 v vs σ2 φ :
             (∀ `{Hinv : invG Σ} κs,
               (|={⊤}=> ∃
                   (stateI : state Λ → list (observation Λ) → nat → iProp Σ)
                   (fork_post : iProp Σ),
                 let _ : irisG Λ Σ := IrisG _ _ _ Hinv stateI fork_post in
                 stateI σ1 κs 0 ∗ WP e @ s; ⊤ {{ v,
                   let m := length vs in
                   stateI σ2 [] m -∗ [∗] replicate m fork_post ={⊤,∅}=∗ ⌜ φ v ⌝ }})%I) →
            rtc erased_step ([e], σ1) (of_val <$> v :: vs, σ2) →
            φ v.
      
      The difference with the ordinary adequacy theorem is that this one only applies
      once all threads terminated. In this case, one gets back the post-conditions
      `[∗] replicate m fork_post` of all forked-off threads.
      
      In Iron we showed that we can use this mechanism to make sure that all
      resources are disposed of properly in the presence of fork-based concurrency.
      ebf06f91
  8. 22 Oct, 2018 1 commit
  9. 18 Oct, 2018 1 commit
  10. 05 Oct, 2018 5 commits
  11. 03 Oct, 2018 1 commit
  12. 18 Jun, 2018 1 commit
  13. 24 May, 2018 1 commit
  14. 23 May, 2018 1 commit
  15. 07 Dec, 2017 2 commits
  16. 26 Nov, 2017 1 commit
  17. 23 Nov, 2017 1 commit
  18. 09 Nov, 2017 3 commits
  19. 08 Nov, 2017 4 commits
  20. 30 Oct, 2017 1 commit
  21. 25 Oct, 2017 2 commits
  22. 24 Mar, 2017 1 commit
    • Robbert Krebbers's avatar
      Generic big operators that are no longer tied to CMRAs. · 6fbff46e
      Robbert Krebbers authored
      Instead, I have introduced a type class `Monoid` that is used by the big operators:
      
          Class Monoid {M : ofeT} (o : M → M → M) := {
            monoid_unit : M;
            monoid_ne : NonExpansive2 o;
            monoid_assoc : Assoc (≡) o;
            monoid_comm : Comm (≡) o;
            monoid_left_id : LeftId (≡) monoid_unit o;
            monoid_right_id : RightId (≡) monoid_unit o;
          }.
      
      Note that the operation is an argument because we want to have multiple monoids over
      the same type (for example, on `uPred`s we have monoids for `∗`, `∧`, and `∨`). However,
      we do bundle the unit because:
      
      - If we would not, the unit would appear explicitly in an implicit argument of the
        big operators, which confuses rewrite. By bundling the unit in the `Monoid` class
        it is hidden, and hence rewrite won't even see it.
      - The unit is unique.
      
      We could in principle have big ops over setoids instead of OFEs. However, since we do
      not have a canonical structure for bundled setoids, I did not go that way.
      6fbff46e
  23. 09 Mar, 2017 1 commit
  24. 11 Feb, 2017 1 commit
  25. 24 Jan, 2017 1 commit