[Paper Review] Bringing Iris into the Verified Software Toolchain

William Mansky|arXiv (Cornell University)|Jul 14, 2022

Parallel Computing and Optimization Techniques4 citations

TL;DR

This paper integrates advanced features from the Iris concurrent separation logic into the Verified Software Toolchain (VST), enabling formal verification of complex concurrent C programs with fine-grained locking and C11 atomics. By extending VST with ghost state, global invariants, and Iris Proof Mode, the system achieves stronger correctness guarantees while maintaining compatibility with CompCert’s verified compilation pipeline.

ABSTRACT

The Verified Software Toolchain (VST) is a system for proving correctness of C programs using separation logic. By connecting to the verified compiler CompCert, it produces the strongest possible guarantees of correctness for real C code that we can compile and run. VST included concurrency from its inception, in the form of reasoning about lock invariants, but concurrent separation logic (CSL) has advanced by leaps and bounds since then. In this paper, we describe efforts to integrate advancements from Iris, a state-of-the-art mechanized CSL, into VST. Some features of Iris (ghost state and invariants) are re-implemented in VST from the ground up; others (Iris Proof Mode) are imported from the Iris development; still others (proof rules for atomic operations) are axiomatized, with the hope that they will be made foundational in future versions. The result is a system that can prove correctness of sophisticated concurrent programs implemented in C, with fine-grained locking and non-blocking atomic operations, that yields varying soundness guarantees depending on the features used.

Motivation & Objective

• To extend the Verified Software Toolchain (VST) with modern concurrent separation logic (CSL) features from Iris to support verification of sophisticated concurrent C programs.
• To bridge foundational differences between VST’s traditional separation logic and Iris’s ghost-state-based model by extending VST’s heap with ghost state and re-implementing core constructs.
• To enable the use of Iris Proof Mode in VST for more scalable and modular reasoning about complex invariants and atomic operations.
• To axiomatize C11 atomic operations in VST using Iris’s physical and logical atomicity rules, providing a path toward verified compilation of atomic code.
• To demonstrate the practicality of the extended system by verifying a linearizable hash table with concurrent atomic operations and client-side linearizability proofs.

Proposed method

• Extended VST’s heap model to include ghost state, enabling representation of logical ownership and invariants similar to Iris’s foundational model.
• Proved that VST’s logic is an instance of Iris’s typeclass for separation logics, enabling direct reuse of Iris Proof Mode (IPM) for VST proofs without modifying VST’s core tactics.
• Axiomatized C11 atomic operations using Iris’s rule for physical atomics, allowing reasoning about sequentially consistent atomic reads and writes in C programs.
• Introduced logically atomic triples (via the ATOMIC keyword) in VST specifications to capture linearizability and support modular verification of concurrent data structures.
• Integrated IPM into VST proof scripts to manage ghost state and invariant operations during proofs, allowing seamless switching between IPM and native VST tactics.
• Verified a concurrent hash table implementation with 2kLoC of Coq code, including atomic operations and client-side proofs of linearizability using ghost histories.

Experimental results

Research questions

• RQ1 How can the foundational model of Iris, based on ghost state and invariants, be adapted to the VST framework, which traditionally treats points-to assertions as primitive?
• RQ2 To what extent can Iris Proof Mode be integrated into VST without altering its existing tactic system or soundness guarantees?
• RQ3 Can C11 atomic operations be soundly axiomatized within VST using Iris’s atomicity rules, and what are the implications for verified compilation?
• RQ4 How can logically atomic triples be used to verify linearizable concurrent data structures in C, and what is the role of ghost state and invariants in this process?
• RQ5 What are the limitations of the current approach in terms of soundness down to assembly, and how can they be addressed in future work?

Key findings

• The integration successfully extends VST with ghost state and global invariants from Iris, enabling modular and scalable reasoning about concurrent C programs.
• Iris Proof Mode was successfully imported into VST, allowing for more structured and maintainable proofs of complex separation logic implications.
• The system supports verification of C11 atomic operations via axiomatized physical and logical atomicity rules, providing a foundation for verified weak-memory reasoning.
• A complete 2kLoC Coq verification of a linearizable hash table was achieved, including atomic operations and client-side proofs of linearizability using ghost histories.
• The extended system enables verification of fine-grained concurrent data structures with strong correctness guarantees, even though full foundational verification of atomic rules remains future work.
• The approach demonstrates that key innovations from Iris can be effectively transferred to VST, significantly enhancing its expressiveness while preserving compatibility with CompCert’s verified compilation pipeline.