arxiv: v1 [cs.lo] 3 Dec 2018

Transcription

1 A high-level opeational semantics fo hadwae weak memoy models axiv: v1 [cs.lo] 3 Dec 2018 Abstact Robet J. Colvin School of Electical Engineeing and Infomation Technology The Univesity of Queensland Gaeme Smith School of Electical Engineeing and Infomation Technology The Univesity of Queensland Moden pocessos deploy a vaiety of weak memoy models, which fo efficiency easons may execute instuctions in an ode diffeent to that specified by the pogam text. The consequences of instuction eodeing can be complex and subtle, and can impact on ensuing coectness. In this pape we build on extensive wok elucidating the semantics of assemble-level languages on hadwae achitectues with weak memoy models (specifically TSO, ARM and POWER) and lift the pinciples to a staightfowad opeational semantics which allows easoning at a highe level of abstaction. To this end we intoduce a wide-spectum language that encompasses opeations on abstact data types as well as low-level assemble code, define its opeational semantics using a novel appoach to allowing eodeing of instuctions, and deive some efinement laws that can be used to explain behavious of eal pocessos. In this famewok memoy models ae mostly distinguished via a pai-wise static odeing on instuction types that detemines when late instuctions may be eodeed befoe ealie instuctions. In addition, memoy models may use diffeent types of stoage systems. Fo instance, non-multicopy atomic systems allow sibling pocesses to see updates to diffeent vaiables in diffeent odes. We encode the semantics in the ewiting engine Maude as a model- addesses:.colvin@uq.edu.au (Robet J. Colvin), smith@itee.uq.edu.au (Gaeme Smith) Pepint submitted to Theoetical Compute Science Decembe 5, 2018

2 checking tool, and develop confidence in ou famewok by validating ou semantics against existing sets of litmus tests small assemble pogams compaing ou esults with those obseved on hadwae and in existing semantics. We also use the tool as a pototype to model check implementations of data stuctues fom the liteatue against thei abstact specifications. Keywods: weak memoy models, opeational semantics, veification 1. Intoduction Moden pocesso achitectues povide a challenge fo developing efficient and coect softwae. Pefomance can be impoved by paallelising computation and utilising multiple coes, but communication between theads is notoiously eo pone. Weak memoy models go futhe and impove oveall system efficiency though sophisticated techniques fo batching ead and wites to the same vaiables and to and fom the same pocessos. Howeve, code that is un on such memoy models is not guaanteed to execute in the ode specified in the pogam text, ceating unexpected behavious fo those who ae not foewaned [1]. To aid the pogamme, achitectues typically povide memoy baie/fence instuctions which can enfoce thead-local ode coesponding to the pogam text, but if oveused fences can eliminate pefomance gains. Pevious wok on fomalising hadwae weak memoy models has esulted in abstact fomalisations which wee developed incementally though communication with pocesso vendos and igoous testing on eal machines [2, 3, 4]. A lage collection of litmus tests [5, 6] demonstate the sometimes confusing behaviou of hadwae. We build on this existing wok and povide a pogamming language and opeational semantics that uns on the same elaxed pinciples that apply to the assemble instuctions. The semantics is validated against litmus tests fom the liteatue, and then applied to model check some ealistic concuent data stuctues. We begin in Sect. 2 with the basis of a staightfowad opeational semantics that allows eodeing of instuctions accoding to pai-wise elationships between instuctions, and an oveview of the esults of the pape. In Sect. 3 we intoduce ou wide-spectum language and an infomal desciption of the instuctions. In Sect. 4 we descibe the semantics in moe detail, and deive some popeties that suppot algebaic and efinement-based easoning as a basis fo theoem poving. Late we show the instantiations of the thead- 2

3 local definitions to thee well-known weak memoy models, TSO[7] in Sect. 5, ARM[4] insections 6and7andPOWER [2]inSect. 8. Wethenconside the implications of weak memoy models on moe complex algoithms in Sect. 9: we veify a simple lock [8, Sect. 7.3], the Teibe lock-fee stack [9] unning on ARM and POWER, and find (and fix) a bug in an implementation of the Chase-Lev wok-stealing deque (double-ended queue) [10] developed specifically fo ARM [11]. We discuss elated wok in Sect. 10. Contibutions. This pape extends ou ealie wok[12] in the following ways: We addess TSO. We take into account a moe ecent vesion of ARM. We compae ou semantics to a lage set of litmus test esults (ove 18,000 in this pape vs. appox 1,000 in [12]), and as a esult handle moe constucts (e.g., POWER s lightweight fences and eieio fences), and othe types of constaints (e.g., addess shifting). We apply the semantics to moe case studies. 2. Instuction eodeing in weak memoy models 2.1. Thead-local eodeings It is typically assumed pocesses ae executed in a fixed sequential ode (as given by sequential composition the pogam ode ). Howeve pogam ode may be inefficient, e.g., when etieving the value of a vaiable fom main memoy afte setting its value, as in x:=1; :=x, and hence weak memoy models sometimes allow execution to appea out of pogam ode to impove oveall system efficiency. Specifically, in the above case, the value 1 may be used fo in late calculations, possibly including witing to some othe shaed vaiable, without waiting fo the update to x to popagate to all othe theads in the system. While many eodeings can seem supising, thee ae basic pinciples at play which limit the numbe of possible pemutations, the key being that the new odeing of instuctions peseves the oiginal sequential intention. A classic example of weak memoy models poducing unexpected behaviou is the stoe buffe patten below [5]. Assume that all vaiables ae 3

4 initially 0, that 1 and 2 ae thead-local vaiables, and that x and y ae shaed vaiables. (x :=1; 1 :=y) (y :=1; 2 :=x) (1) It is possible to each a final state in which 1 = 2 = 0 in seveal weak memoy models: the two assignments in each pocess ae independent (they efeence diffeent vaiables), and hence can be eodeed. Fom a sequential semantics pespective, eodeing the assignments in pocess 1, fo example, peseves the final values fo 1 and x. Assume that c and c ae pogams epesented as sequences of atomic actions α ; β ;..., as in a sequence of instuctions of a thead o moe abstactly a semantic tace. Pogam c may be eodeed to c, witten c c, if the following holds: 1. c is a pemutationof theactionsof c, possibly with some modifications due to fowading (see below). 2. c peseves the sequential semantics of c. Fo example, in a weakest peconditions semantics [13], fo all pedicates P, wp(c, P) wp(c,p). 3. c peseves coheence-pe-location with espect to c (cf. po-loc in [3]). This means that the ode of updates and accesses of each shaed vaiable, consideed individually, is maintained. We fomalise these constaints in the context of pai-wise eodeing of instuctions below. The key challenge fo easoning about pogams executed on a weak memoy model is that the behaviou of c d is in geneal quite diffeent to the behaviou of c d, even if c c Reodeing and fowading instuctions We wite α β if instuction β may be eodeed befoe instuction α. Fo TSO the well-known weakening of instuction ode is that loads can appea befoe stoes (to diffeent vaiables). If we let x and y be shaed vaiables, be a local vaiable, and v some value, we can epesent this as x :=v :=y whee x and y ae distinct. This ule applies to a specific case of assignment statements that coespond to assemble-level stoes and loads; the elation is genealised to all assignments fo TSO in Sect. 5. 4

5 We give the moe complex ule fo eodeing of updates in the ARM and POWER memoy models below. We use the notation e v f to mean that expessions e and f do not efeence any vaiables in common; hence x v f can be ead as x is not fee in f. The elated notation e sv f is weake, equiing only that the shaed vaiables of e and f ae distinct. e v f iff the fee vaiables of e and f ae distinct (2) e sv f iff the shaed vaiables of e and f ae distinct (3) x :=e y :=f iff (i) x v y (ii) x v f (iii) y v e (iv) e sv f (4) Note that as defined above is symmetic, howeve when calculated afte the effect of fowading is applied (as descibed below) thee ae instuctions that may be eodeed in one diection but not the othe. The elation is neithe eflexive no tansitive. Povisos (i), (ii) and (iii) ensue executing the two assignments in eithe ode esults in the same final values fo x and y, and poviso (iv) maintains ode on accesses of the shaed state. If two updates do not efe to any common vaiables they may be eodeed. Poviso (i)eliminates eodeingssuch as(x:=1; x:=2) (x:=2; x:=1) which would violate the sequential semantics (the final value of x). Poviso (ii) eliminates eodeings such as (x :=1; :=x) ( :=x ; x :=1) which again would violate the sequential semantics (the final value of ). Poviso (iii) eliminates eodeings such as ( := y ; y := 1) (y := 1 ; := y) which again would violate the sequential semantics (the final value of ). Poviso (iv), equiing the update expessions shaed vaiables ae distinct, peseves coheence-pe-location, eliminating eodeings such as ( 1 := x ; 2 :=x) ( 2 :=x ; 1 :=x), whee 2 may eceive an ealie value of x than 1 in an envionment which modifies x. The instuctions used in the above examples, whee each instuction efeences at most one global vaiable and uses simple intege values, coespond to the basic load and stoe instuction types of ARM and POWER pocessos. We may instantiate (4) to such instuctions, giving eodeing ules such as the following, which states that a stoe may be eodeed befoe a load if they ae to diffeent locations ( 1 :=y x:= 2 ). We use ARM syntax to emphasise the application to a eal achitectue. LDR 1,y STR x, 2 (5) 5

6 In pactice, poviso (ii) may be cicumvented by fowading. 1 This efes totakingintoaccount theeffectoftheupdatemovedealieontheexpession of the othe update. We wite β α to epesent the effect of fowading the (assignment) instuction α to the instuction β. Fo assignments we define (y :=f) x :=e = y:=(f [x\e] ) if e does not efe to global vaiables (6) whee the tem f [x\e] stands fo the syntactic eplacement in expession f of efeences to x with e. The poviso of (6) pevents additional loads of globals being intoduced by fowading. We specify the eodeing and fowading elationships with othe instuctions such as banches and fences in the sections on specific achitectues Geneal opeational ules fo eodeing The key opeational pinciple allowing eodeing is given by the following tansition ules fo a pogam (α; c), i.e., a pogam with initial instuction α. (α; c) α c (a) c β c α β α (α; c) β α (α; c ) (b) (7) Rule (7a) is the staightfowad pomotion of the fist instuction into a step in a tace, simila to the basic pefixing ules of CCS [14] and CSP [15]. Rule (7b), howeve, states that, unique to weak memoy models, an instuction of c, say β, can happen befoe α, povided that β α can be eodeed befoe α accoding to the ules of the achitectue. Note that we fowad the effect of α to β befoe deciding if the eodeing is possible. Applying Rule(7b) then Rule(7a) gives the following eodeed behaviou of two assignments. ( :=1; x := ; skip) x :=1 ( :=1; skip) :=1 skip (8) We use the command skip to denote temination. The fist tansition above is possible because we calculate the effect of :=1 on the update of x befoe executing that update, i.e., x := :=1 = x :=1. The definition of instuction eodeing, α β is achitectue-specific (instuction fowading, β α, is constant fo the achitectues we conside). 2 1 We adopt the tem fowading fom ARM and POWER [3]. The equivalent effect is sometimes efeed to as bypassing on TSO [7]. 2 Typically this is the only definition equied to specify an achitectue s instuction 6

7 2.4. Reasoning about eodeings The opeational ules allow a standad tace model of coectness to be adopted, i.e., we say pogam c efines to pogam d, witten c d, iff evey tace of d is a tace of c. Let the pogam α c have the standad semantics of pefixing, that is, the action α always occus befoe any action in c (Rule (7a)). Then we can deive the following laws that show the inteplay of eodeing and tue pefixing. α; c α c (9) α; (β c) β α (α; c) if α β α (10) Note that in Law (10) α may be futhe eodeed with instuctions in c. Let c d denote pogam c unning concuently with pogam d. A tacebased inteleaving semantics allows us to deive the following laws staightfowadly. (α c) d α (c d) (11) c c d d c d c d (12) Law(11) is a typical inteleaving law, and Law(12) states that efining eithe pogam, o both pogams, esults in a efinement of thei composition. We leave the use of Law (12), and popeties such as commutativity, implicit in ou deivations in this pape. We may use these laws to show how the supise behaviou of the stoe buffe patten above aises. 3 In deivations such as the following, to save space, we abbeviate a thead α; skip o α skip to α, that is, we omit the tailing skip. (x :=1; 1 :=y) (y :=1; 2 :=x) Fom Law (10) (twice), since x :=1 1 :=y fom (4). ( 1 :=y x :=1) ( 2 :=x y :=1) Law (11) (fou times). 1 :=y 2 :=x x :=1 y :=1 odeing, but some behavious may equie specialised opeational ules, e.g., see Sect In addition, diffeent achitectues may have diffeent stoage subsystems, howeve, and these need to be sepaately defined (see Sect. 4.1). 3 To focus on instuction eodeings we leave local vaiable declaations and pocess ids implicit, and assume a multi-copy atomic stoage system (see Sect. 4.1). 7

8 If initially x = y = 0, a standad sequential semantics shows that 1 = 2 = 0 is a possible final state in this behaviou. 3. Wide-spectum language In this section we give an oveview of the syntax fo ou wide-spectum language. Its elements ae actions (instuctions) α, commands (pogams) c, pocesses (local state and a command) p, and the top level system s, encompassing a shaed state and all pocesses. Below x is a vaiable (shaed o local) and e an expession. α::=x :=e [e] fence α c ::=skip α; c c 1 c 2 while b do c p ::=(lcl σ c) (tid n p) p 1 p 2 s ::=(stoe σ p) (13) The basic actions of a weak memoy model ae an update x :=e, a guad [e], a (full) fence, o a finite sequence of actions, α, executed atomically. Thoughout the pape we denote an empty sequence by, and constuct a non-empty sequence as α 1, α ARM and POWER intoduce othe instuction types, especially diffeent types of fences, which we discuss in the elevant sections. A command may be the empty command skip, which is aleady teminated, a command pefixed by some action α, a choice between two commands, o an iteation (fo bevity we conside only one type of iteation, the while loop). Awell-fomedpocessisstuctuedasapocessidn PIDencompassing a(possibly empty) localstateσ andcommand c, i.e., atem(tid n lcl σ c). Weassume thatalllocalvaiablesefeenced inc aecontainedinthedomain of σ. A system is stuctued as the paallel composition of pocesses within the global stoage system. The typical stuctue is that of a global state, σ, that maps all global vaiables to thei values, which models the stoage systems of TSO, the most ecent vesion of ARM [17], and abstact specifications. (stoe σ (tid 1 lcl σ 1 c 1 ) (tid 2 lcl σ 2 c 2 )...) (14) Olde vesions of ARM and POWER have a moe complex stoage system, though the stuctue of the oveall system emains the same, as discussed in Sect

9 3.1. Abbeviations Conditionals ae modelled using guads and choice (whee false banches ae neve executed). if b then c 1 else c 2 = ([b]; c 1 ) ([ b]; c 2 ) (15) By allowing instuctions in c 1 o c 2 to be eodeed befoe the guads one can model speculative execution, i.e., ealy execution of instuctions which occu afte a banch point [16]: see Sect Although the basic thead language is vey simple (eflecting a sequence of instuction on a pocesso, o a tace in a denotational semantics model) we may constuct moe familia impeative pogamming constucts in the usual way. Sequential composition of commands, as opposed to action pefixing, can be defined by induction. skip ; c = c (16) (α; c 1 ) ; c 2 = α; (c 1 ; c 2 ) (17) (c 1 c 2 ) ; c 3 = (c 1 ; c 3 ) (c 2 ; c 3 ) (18) Loops ae modelled using unfolding, as in Rule (23) below. Read-modify-wite pimitives that allow atomic access of moe than one vaiable can be modelled as an atomic sequence of steps. Fo instance, conside a fenced compae-and-swap (CAS) instuction, whee CAS(x,,e) updates shaed vaiable x to the value of expession e if x =, and othewise does nothing. CAS(x,,e) = [x = ], x :=e, fence [x ] (19) When used as the expession in a conditional we use the following abbeviation. if CAS(x,,e) then c 1 else c 2 = ( [x = ], x :=e, fence ; c 1 ) ([x ]; c 2 ) (20) 4. Opeational semantics The meaning of ou language is fomalised using an opeational semantics, which, excluding the global stoage system, is summaised in Fig. 1. Given a pogam c the opeational semantics geneates a tace, i.e., a possibly 9

10 Rule 21 (Pefix with eodeing). (α; c) α c (a) c β c α β α (α; c) β α (α; c ) (b) Rule 22 (Choice). c d c d τ c τ d Rule 23 (Loop). while b do c τ ([b]; c ; while b do c) ([ b]; skip) Rule 24 (Locals - update). c τ (lcl σ c) (lcl σ [ :=v] c ) c :=v Rule 25 (Locals - stoe). c x := c σ() = v (lcl σ c) x :=v (lcl σ c ) Rule 26 (Locals - load). c :=x c (lcl σ c) [x=v] (lcl σ [ :=v] c ) Rule 27 (Locals - guad). c [e] c (lcl σ c) [eσ] (lcl σ c ) Rule 28 (Thead id). p α p (tid n p) n:α (tid n p ) Rule 29 (Inteleave paallel). p 1 α p 1 p 1 p 2 α p 1 p 2 p 2 α p 2 p 1 p 2 α p 1 p 2 Figue 1: Semantics of the language 10

11 α infinite sequence of steps c 1 α 0 2 c1... whee the labels in the tace ae actions, o a special label τ epesenting a silent o intenal step that has no obsevable effect. Fo bevity we omit ules that ae a staightfowad pomotion of a label fom a subtem to a paent tem, i.e., ules of the fom p l p l C[p] C[p ]. The teminated command skip has no behaviou; a tace that ends with this command is assumed to have completed. The effect of instuction pefixing in Rule (21) is discussed in Sect Note that actions become pat of the tace. A nondeteministic choice (the intenal choice of CSP [15]) can choose eithe banch, as given by Rule (22). The semantics of loops is given by unfolding, e.g., Rule (23) fo a while loop. Note that speculative execution is theoetically unbounded, and loads fom inside late iteations of the loop could occu in ealie iteations. Fo ease of pesentation in defining the semantics fo local states, we give ules fo specific foms of actions, i.e., assuming that is a local vaiable in the domain of σ, and that x is a global (not in the domain of σ). The moe geneal vesion can be staightfowadly constucted fom the pinciples below. Rule (24) states that an action updating vaiable to value v esults in a change to the local state (denoted σ [ :=v] ). Since this is a puely local opeation thee is no inteaction with the stoage subsystem and hence the tansition is pomoted as a silent step τ. Rule (25) states that a stoe of the value in vaiable to global x is pomoted as an instuction x :=v whee v is the local value fo. Rule (26) coves the case of a load of x into. The value of x is not known locally. The pomoted label is a guad equiing that the value ead fo x is v. This tansition is possible fo any value of v, but the coect value will be esolved when the label is pomoted to the stoage level. Rule (27) states that a guad is patially evaluated with espect to the local state befoe it is pomoted to the global level. The notation e σ eplaces x with v in e fo all (x v) σ. Rule (28) simply tags the pocess id to an instuction, to assist in the inteaction with the stoage system, and othewise has no effect. Instuctions of concuent pocesses ae inteleaved in the usual way as descibed by Rule (29). Othe staightfowad ules which we have omitted above include the pomotion of fences though a local state, and that atomic sequences of 11

12 Rule 30 (Globals - stoe). n:x :=e p p τ (stoe σ p) (stoe σ [x :=eσ] p ) Rule 31 (Globals - guad). p n:[e] p e σ tue τ (stoe σ p) (stoe σ p ) Figue 2: Semantics of a standad (multicopy-atomic) stoage system actions ae handled inductively by the above ules Multi-copy atomic stoage subsystem. Taditionally, changes to shaed vaiables occu on a shaed global state, and when witten to the global state ae seen instantaneously by all pocesses in the system. This is efeed to as multi-copy atomicity and is a featue of TSO and the most ecent vesion of ARM [17]. Olde vesions of ARM and POWER, howeve, lack such multi-copy atomicity and equie a moe complex semantics. We give the simple case (coveed in Fig. 2) fist. Fo the stoe model the thead ids ae not used, but they do become impotant in late sections. Recall that at the global level the pocess id n has been tagged to the actions by Rule (28). Rule (30) coves a stoe of some expession e to x. Since all local vaiable efeences have been eplaced by thei values at the pocess level due to Rules (24)-(27), expession e must efe only to shaed vaiables in σ. The value of x is updated to the fully evaluated value, e σ. Rule (31) states that a guad tansition [e] is possible exactly when e evaluates to tue in the global state. If it does not, no tansition is possible; this is how incoect banches ae eliminated fom the taces, which we discuss in moe detail in the context of speculative execution in Sect Reodeing and fowading (fo sequential consistency) It emains to define the eodeing elation fo paticula achitectues and the effect of fowading so that the effect of Rule (21) can be detemined; and to model the global stoage system whee the system lacks multi-copy 12

13 x :=e y :=f = x :=e [y\f] if e has no shaed vaiables (32) [e] y :=f = [e [y\f] ] if e has no shaed vaiables (33) β α = β othewise Figue 3: Fowading (bypassing) atomicity defined by the ules given above. We define the eodeing elation in the following sections, though we may staightfowadly define the eodeing fo an atomic sequence of instuctions ecusively as below, whee s is a sequence of instuctions. α (34) α β s α β α s (35) We define similaly fo the cases s α. We note the tivial case fo defining eodeing fo sequentially consistent (SC) pocessos: α β fo all α,β, and thee is no fowading. Since eodeing is not possible the second case of Rule (7) neve applies and hence the standad pefixing semantics is maintained. SC semantics uses a stoage system defined by the ules in Fig. 2. Fowading, as given in Fig. 3, is egula acoss all the achitectues we have consideed: α β, whee α is an assignment y := f whee f does not contain shaed vaiables, is staightfowad eplacement of y by f in the expession of an assignment (32) o guad (33). Othewise fowading has no effect. If fowading was applied when f contained shaed vaiables, e.g., when f is the expession z, this would ceate moe loads of z esulting in potentially diffeent values. This appoach to modelling fowading contasts with an explicit FIFO buffe which is often used in modelling TSO. The most ecent stoe to a global x is ecoded in the pogam text, and need not be explicitly kept sepaately in a buffe stuctue Tool suppot and validation The opeational semantics have been encoded in Maude[18, 19] as ewite ules. A pocess in the language is ewitten to a tace, with the Maude system geneating all possible taces though backtacking. To validate the semantics of paticula achitectues and to veify data stuctues unning 13

14 on them, we devised a staightfowad mechanism fo checking the final state against a condition. Modelling a paticula achitectue equies instantiating the eodeing elation. Fo commecial easons, fomal definitions of the hadwae ae not povided by the vendos. To establish confidence in ou semantics, theefoe, we validated it against litmus tests, small assemble pogams. We ae fotunate in that consideable effot has gone into testing eal hadwae, collecting the esults, and using these to fine-tune an undestanding of the hadwae fo TSO, ARM and POWER. Howeve, it must be noted that the use of litmus tests, and thei esults on hadwae, ae poblematic fo validation fo seveal easons: The set of litmus tests is unlikely to be complete. Thee may be a bug in the paticula hadwae tested giving incoect behaviou. The paticula hadwae tested may not implement all featues allowed by the memoy model. The specification of the hadwae may have impecisions that esulted in vendos allowing behavious that wee intended to be fobidden. Expected behavious can change as new hadwae is eleased. The absence of a behaviou does not mean that it is fobidden. Due to the above limitations, we do not attempt to achieve full confomance to the hadwae esults epoted (whee the above limitations ae also noted), no do we ty to match exactly the esults of othe models indeed some of the models themselves do not achieve full confomance, in paticula allowing many behavious that wee not obseved on hadwae. Instead we aim to agee with litmus tests in the majoity of cases, noting that efining a model to agee on all known litmus tests may quickly become edundant due to easons above. The litmus tests ae povided in assemble syntax which we must tanslate to ou wide-spectum language. Banch instuctions (e.g., ARM s BNE) ae modelled using a combination of guads and nondeteministic choice. A guad [e], whee e is an expession, does not diectly map fom a hadwae 14

15 instuction. Abstactly, a command ([ = 0]; c) means that if = 0 in the local state then c may continue execution. If 0, then no execution is possible. As such, ou guad coesponds to the guads in Dijksta s guaded command language[13]. In ou language we can use guads to model banching povided a staightfowad stuctue is used, as outlined below. Let α i stand fo instuctions. The BNE L instuction jumps to label L if a special egiste is not equal to 0, while B L unconditionally jumps to L. Thus a stuctue such as the following α 1 ; BNE L1; α 2 ; B L2; L1: α 3 ; L2:... (36) becomes α 1 ; (if cmp = 0 then α 2 else α 3 );... (37) We have used the name cmp fo the local egiste implicitly accessed by the BNE instuction. Note that in ou famewok a banch instuction such as BNE in the assemble code stuctually coesponds to a guad (coveing the tue and false cases). This stuctued pogamming appoach to denoting banching cannot cove all possible jumps within hadwae addesses, but is sufficiently expessive to captue the behavious found in the litmus tests, and is suitable fo modelling highe-level stuctued code. 5. TSO α fence (38) fence α (39) [b] α (40) α [b] (41) x :=e :=f if x v f, v e, and (42) e has no fee globals α β in all othe cases (43) Figue 4: Reodeing following TSO assemble semantics. x denotes any vaiable, and a local vaiable. The eodeing elation fo TSO is given in Fig. 4. It uses a multi-copy atomic stoage system as defined by the ules in Fig. 2. TSO is a elatively 15

16 stong memoy model with α β fo all α,β except as specified in (42), which allows loads to come befoe independent stoes. In addition (42) allows independent egiste opeations to also be eodeed befoe stoes, allowing fowading (o bypassing). This means that a load of x may take the value of the most ecently witten value to x. In ou famewok, this means that if a load of x is eodeed befoe a stoe to x, it takes that value. That is, since fom (32), we have :=x x:=1 = :=1 (44) x :=1; :=x :=1 x :=1 (45) by Law (10). Note that the instuction type changes fom a load ( :=x) to a simple update to a local egiste ( :=1), and hence is not affected by any ealie stoes to x. TSO s fence instuction can be employed to pevent the eodeing of stoes and loads (38,39) Validation We tested ou definitions fo TSO against the litmus tests mentioned in[7] and 25 geneated tests using the hed tool ( Those litmus tests cove the essence of TSO, namely that loads can appea to come befoe stoes, and fowading (o bypassing) takes place. 6. Revised ARM v8 In this section we conside the latest (evised) vesion of ARM v8 which is multi-copy atomic [17]. We conside olde vesions of ARM which lack multi-copy atomicity in Sect. 7. In addition to stoes, loads, egiste opeations, and full fences, ARM s instuction set includes a contol fence, cfence, which affects local eodeing by acting as a baie peventing subsequent loads being eodeed with ealie instuctions. It is used in conjunction with banches to avoid the effect of speculative execution, discussed in Sect ARM also has a stoe only fence. Ou geneal semantics is instantiated fo ARM pocessos in Fig. 5 which povides paticula definitions fo the eodeing elation that ae genealised fom the odeings on stoes and loads in these pocessos. 16

17 α ::=... fence.st cfence (46) α fence (47) fence α (48) x :=e fence.st if x is shaed (49) fence.st x :=e if x is shaed (50) [b] cfence (51) cfence :=e (52) sv [b 1 ] [b 2 ] if b 1 b 2 (53) [b] x :=e if x is shaed (54) [b] x :=e x :=e α :=e if v b and e sv b (55) [b] if x v b and e sv b (56) y :=f if x v y, x v f, y v e, and e sv f (57) β in all othe cases Figue 5: Reodeing following ARM assemble semantics. x, y denote any vaiable and a local vaiable. 17

18 Fences pevent all eodeings as with TSO (47,48), while a stoe-only baies fence.st (coesponding to ARM s DMB.ST and DSB.ST instuctions) maintains ode on stoes but not on othe instuction types (49,50). A contol fence cfence pevents speculative loads when placed between a guad and a load(51,52). Guads may be eodeed with othe guads povided they do not both access the same shaed vaiables (53) (othewise local coheence would be violated), but stoes to shaed vaiables may not come befoe a guad evaluation (54). This pevents speculative execution fom modifying theglobalstate,intheeventthatthespeculationwasdownthewongbanch. An update of a local vaiable may be eodeed befoe a guad povided it does not affect the guad expession and espects local coheence (55). Guads may be eodeed befoe updates if those updates do not affect the guad expession and local coheence is espected (56). (Note that in ARM assemble the e sv b constaints fo guads ae always satisfied as guads (banch points) do not efeence globals.) Assignments may be eodeed as shown in (57) and discussed in Sect Speculative execution Many pocessos allow some fom of speculative execution, whee the instuctions in a banch ae tentatively executed and the effect stoed locally while, fo instance, waiting fo a load of a global to be seviced. On TSO and elated achitectues the esult of speculative execution ae not visible, i.e., speculatively executed loads ae estated if it is detected that an old value was loaded. On ARM pocessos the effect of speculative execution can become visible, i.e., the effect of speculatively executing loads is not (conditionally) unwound. Howeve, in all cases, if speculation was down a banch that was eventually detemined to be incoectly chosen, no effect is (o should be) visible. 4 Fotunately this complication can be handled staightfowadly in ou semantics. If a guad does not evaluate to tue, execution stops in the sense that no tansition is possible. This coesponds to a false guad, i.e., magic [21, 22], and such behavious do not teminate and ae ignoed fo the puposes of detemining behaviou of a system. Inteestingly, this simple concept fom standad efinement theoy allows us to handle speculative execution 4 The ecently discoveed Specte secuity vulneability [20] shows that this is not stictly the case. 18

19 staightfowadly. In existing appoaches, the semantics is complicated by needing to estat eads if speculation poceeds down the wong path. Teating banch points as guads woks because speculation should have no effect if the wong banch was chosen. To undestand how this appoach to speculative execution woks, conside the following deivation. 1 :=x ; (if 1 = 0 then 2 :=y) = Definition of if (15) 1 :=x ; (([ 1 = 0]; 2 :=y) [ 1 0]) Resolve to the fist banch, since (c d) c 1 :=x ; [ 1 = 0]; 2 :=y Fom Law (10) and (52) 1 :=x ; 2 :=y [ 1 = 0] Fom Law (10) and (54) 2 :=y 1 :=x ; [ 1 = 0] This shows that the inne load (undelined) may be eodeed befoe the banch point, and subsequently befoe an ealie load. Note that this behaviou esults in a teminating tace only if 1 = 0 holds when the guad is evaluated, and othewise becomes magic (speculation down an incoect path). On ARM pocessos, placing a contol fence (cfence) instuction inside the banch, befoe the inne load, pevents this eodeing Addess shifting In ARM the addess an instuction loads fom (o stoes to) may be shifted. The instuction LDR R1, [R2, X] loads into R1 the value at addess X shifted by the amount in R2. The pesence of addess shifting, o othe mechanisms fo modifying the addess taget of an instuction, can have an influence on the eodeing elation, as captued by the add elation in [3]. In ou famewok most of the estictions intoduced by addess shifting ae aleady captued by Rule (21), whee we intepet x to ange ove expessions including addess shifts such as y &+, and hence the set of vaiables being checked against the conditions is {y,}. Howeve, as mentioned in [4], an instuction x &+e :=f has at least one othe effect on eodeing, which is that late stoes cannot be eodeed befoe it, in case the shift amount e gives an invalid addess and esults in an exception being thown. In such cases, the effect of late wites should not be visible to othe pocesses. x &+e :=f y :=g if y is a shaed vaiable 19

20 To pecisely model the semantics of addess shifting equies a moe concete model than the one we popose, howeve, as detemined by the litmus tests of [4], the effects of addess shifting on eodeings can be investigated even when the shift amount is 0 (esulting in a load of the value at the addess). As such we define x &+0 = x, and leave the effect of othe shift amounts undefined. Note that when the shift amount expession is evaluated to 0 (e.g., by fowading) the addess shifting is emoved and this can have an effect on the allowed eodeings Load speculation A futhe aspect of addess shifting is that in some cicumstances a load 2 := x may be eodeed befoe a load 1 := x &+e, even though this would appea to violate coheence-pe-location. Howeve, the load into 2 must not load a value of x that was witten befoe the value ead by the load into 1. This complex situation is handled in [4] by estating load instuctions if an ealie value is ead into 2. We handle it moe abstactly by teating the load as speculation, whee if an ealie value fo 2 is loaded then the effect of that speculation is thown away (the point of allowing this eodeing is appaently to allow execution afte the second load to continue while the value of the shift amount e is calculated). This is given by the following opeational ule. p 2:=x p (58) 1 :=x &+n ; p 2:=x 1 :=x &+n ; [ 1 = 2 ]; p In pactical tems it is possible the fist load of x (into 1 ) is delayed while detemining the offset value. The late load is allowed to poceed, feeing up p to continue speculatively executing until the dependency is esolved. The load into 1 then must still be issued, the esult being checked against 2. This check must occu to peseve coheency as the load into 2 cannot ead a value ealie than that ead into 1. Note that loads in p can now potentially be eodeed to execute ahead of the load into Eliminating ealie wites An additional aspect of ARM pocessos is that when thee ae consecutive wites to a vaiable x on a pocess the fist wite can effectively be eliminated: locally only the effect of the second wite will be seen (sequential semantics is peseved), and globally it is always a valid behaviou that a 20

21 sibling pocess did not see the effect of the fist wite because the second occued immediately afte it. Wite elimination is captued by the following ule. c x :=v c We may deive the following elimination law Validation x :=w ; c x :=v c (59) x :=w ; x :=v ; c x :=v ; c (60) The new vesion of ARM as epoted in [17] is quite ecent and the litmus tests used in that pape ae not available at the time of witing. We have validated ealie vesions of ARM which ae moe complicated, and as such we defe discussion of validation until Sect Oiginal ARM v8 and ealie non-multicopy atomicity In this section we conside the vesions of ARM which lack multi-copy atomicity. These include the oiginal vesion of ARM v8 [4] and all ealie vesions. These vesions of ARM allow pocesses to communicate values to each othe without accessing the heap. That is, if pocess p 1 is stoing v to x, and pocess p 2 wants to load x into, p 2 may peemptively load the value v into, befoe p 1 s stoe hits the global shaed stoage. Theefoe diffeent pocesses may have diffeent views of the values of global vaiables; see litmus tests such as the WRC family [3]. To popely model these vesions of ARM we must theefoe intoduce the stoage subsystem, (stoage ω c), which eplaces the (stoe σ p) notation defined ealie Stoage subsystem We conceptualise the stoes in the system as a list ω of wites w 1,w 2,..., with each wite w i being of the fom (x v) n S (61) whee n is the pocess id of the thead that executed a stoe of value v to addess x. The list S is a list of pocess ids that have seen this wite, that is, loaded that value into some local egiste. Fo such a wite w, we let 21

22 w.va = x, w.thead = n and w.seen = S. Fo a wite (x v) n S it is always the case that n S. The ode of wites in ω and pevious values seen by a pocess affect the values it loads, which in geneal ae nondeteministic. When a new wite w is executed by a thead, w is not necessaily appended to the end of ω, but instead may be inseted ealie, accoding to cetain ules. The basic pinciples of inseting a new wite w of the fom (x v) n {n} into the list ω ae: 1. Request w may not come befoe any ealie wite by n(local coheence). 2. Request w may not come befoe a wite w to x by anothe pocess that has been seen by n (global coheence). When pocess n loads the value of location x fom ω it may see eithe the most ecent value of x that n has aleady seen, o any that have been added moe ecently in ω. When n sees some wite w then n is added to the list of seen pocess ids in w. The shaed state fom the pespective of a given pocess is a paticula view of this list. Thee is no single definitive shaed state. In addition, viewing a value in the list causes the list to be updated and this affects late views. Initially ω holds wites giving the initial values of the shaed vaiables. These initial values ae assumed to have been seen by evey pocess. We give two specialised ules (fo a load and stoe) in Fig. 6. To handle the geneal case of an assignment x := e, whee e may contain moe than one shaed vaiable, the antecedents of the ules ae combined, etieving the value of each vaiable efeenced in e individually and accumulating the changes to ω. Rule (63) states that pocess n can load the value v fo x povided thee is a wite (x v) m S in the system whee all ealie wites can be seen past, i.e., as given in (66), an ealie wite to vaiable x has not been seen. As a esult, n is added to the set of pocess ids that have seen that wite (and hence late eads of x by n will not be able to see any ealie wites to x). Rule (64) govens whee a new wite w may be inseted into the global stoage. Wite w may appea ealie than wites that ae aleady in system, povided it can be eodeed with them as given in (67). We say w can come befoe a wite v, witten v w w, povided v was by anothe pocess, and if it is a wite tothe same vaiable asw then it has not been seen. This constaint keeps all wites by a single pocess in the same ode, and keeps a systemwide coheence on any one shaed vaiable, but allows diffeent pocesses to 22

23 Rule 63 (Stoage - load). s ::=... (stoage ω p) (62) p n:[x=v] p w an(ω 2 ) canseepast n (x,w) (stoage ω 1 (x v) m S ω 2 p) n:[x=v] (stoage ω 1 (x v) m S {n} ω 2 p ) Rule 64 (Stoage - stoe). n:x :=v p p w = (x v) n {n} w an(ω 2 ) w w w (stoage ω 1 ω 2 p) Rule 65 (Stoage - fence). n:x :=v (stoage ω 1 w ω 2 p ) p n:fence p (stoage ω p) n:fence (stoage flush n (ω) p ) whee canseepast n (x,w) = x = w.va n w.seen (66) w w (x v) n {n} = n w.thead (x = w.va n w.seen) (67) flush n ( ) = flush n (ω w) = flush n (ω) flush n (w) (68) { w[seen flush n (w) = :=PID] if n w.seen (69) w othewise Figue 6: Rules fo the non-multi-copy atomic subsystem of ARM and POWER. 23

24 see updates to diffeent vaiables in a diffeent ode. Fo instance, if the global stoage contains wites to x and y by pocess n, (x v) n S 1 (y w) n S 2 then pocess m may see that x has changed but ead the initial value fo y, while anothe pocess p may see that y has changed but ead the initial value fo x (assuming neithe m no p ae in S 1 o S 2 ). Rule (65) states that a fence action by pocess n flushes all pevious wites seen by n (which includes those wites by n). The flush function modifies ω so that all pocesses can see all wites by n, effectively ovewiting ealie wites. This is achieved by updating the wite so that all pocesses have seen it, witten as w [seen:=pid], and defined ecusively by (68,69). A fence.st instuction also flushes the stoage as in Rule (65) Validation The semantics was validated against 2 sets of litmus tests (with many ovelapping tests). The fist was a set of 348 litmus tests developed in [4] (we excluded some that could not be automatically tanslated, and also exclude one that involves shadow egistes, fo easons descibed in Appendix A). We compaed ou esults (pass/fail) against the expected esults on hadwae taken fom the supplemental mateial fo [4] 5. The tanslation pocess was staightfowad, with conditional statements tanslated into guaded banches as descibed in Sect In addition some edundant egiste opeations wee eliminated to educe tool time, fo instance, := 1; x := becomes x :=1 povided is not used elsewhee in the code. The majoity of the tests (333) wee pefomed in unde 3s of pocesso time. Those with 3 o moe pocesses, limited local odeing (lack of fences, etc.), and many wites, wee the slowest. The Maude system measues ewites and the lagest test equied appoximately 50 million ewites, taking 33s. Results of thee of the 348 tests wee not ecoded in [4] as they did not complete in a easonable time. Of the emaining litmus tests all but thee ageed with the model esults in [4] which we discuss below in Sect The second set of tests we used fo validation was the set of 9790 tests fom [3]. These tests wee used to validate an axiomatic semantics athe

25 than an opeational model as in [4]. Ou esults fo this lage set, excluding 5 that did not pase and 133 that did not complete in a easonable amount of time, is 9556 tests ae in ageement with [3] and 96 in disageement. Of those 96, we agee with the esults obtained by hadwae in 52: 5 whee we allow a behaviou seen on hadwae (but disallowed by [3]), the emainde whee ou model says such behavious should be fobidden (and wee not obseved on hadwae). Of the emaining 44, all but 3 involve a stoe(x);stoe(x) o load(x);load(x) patten; of those 3, 2 ae identical (MP+dmb+add-po-ctlisb and MP0110). Those 2 identical tests ae allowed in ou model possibly eoneously, as they allow load speculation in the pesence of an unesolved wite with addess shifting. The emaining test, MP+PPO015, looks like it is disallowed by us eoneously because we do not have chain fowading, o possibly fowading fom a egiste assignment, which is necessay inside a banch to esolve an addess shift expession. If we instead exclude fom the 96 disageements those tests involving addess shifting we ae left with 20 tests whee we disagee with [3]. In all 20 cases we allow the behaviou that is disallowed by [3] (and which has not been obseved on hadwae). All of these 20 cases involve at least one instanceofanaccesstoashaedvaiabletwiceomoeinatleastonepocess, i.e., po-loc becomes elevant. By allowing moe behavious than [3], we ae eing on the side of soundness, i.e., if we can pove a pogam involving one of these 20 cases coect in ou semantics, it is also cetainly coect in the semantics of [3]. We note that the esults in [3] include 558 tests whee thei model fobids a esult which was obseved on hadwae, and 1525 tests whee the [3] model allows a behaviou which was not obseved. Regading the fome, the discepancy is attibuted to the load-load hazad (e.g., [23]) and fewe discepancies emain between thei model and hadwae when the affected litmus tests ae excluded Discepancies with [4] We pesent litmus test PPO017 below, 6 tanslated into ou wide-spectum language, fo which ou model gives a diffeent esult to that of [4]. 7 This 6 Available at litmus 7 We simplified some of the syntax fo claity, in paticula intoducing a highe-level if statement to model a jump command and implicit egiste (efeenced by the compae 25

26 is stuctually simila to the test PPO015, discussed in [12], and test PPO012: those two othe tests pass in ou model fo essentially the same eason as PPO017. x :=1; fence; y :=1 0 :=y ; 2 :=z &+( 0 xo 0 ) ; z :=1; 4 :=z; (if 4 = 4 then skip else skip) ; cfence; 5 :=x (70) The tested condition is 0 = 1 5 = 0, which asks whethe it is possible to load x (the last statement of pocess 2) befoe loading y (the fist statement of pocess 2). At a fist glance the contol fence pevents the load of x happening befoe the banch. Howeve, as indicated by litmus tests such as MP+dmb.sy+fi-fi-ctisb, [4][Sect 3,Out of ode execution], unde some cicumstances the banch condition can be evaluated ealy. We expand on this below by manipulating the second pocess, taking the case whee the success banch of the if statement is chosen. To aid claity we undeline the instuction that is the taget of the (next) efinement step. 0 :=y ; 2 :=z &+( 0 xo 0 ) ; z :=1; 4 :=z ; [ 4 = 4 ]; cfence; 5 :=x Pomote load with fowading (fom z :=1), fom Laws (9) and (10) 4 :=1 0 :=y ; 2 :=z &+( 0 xo 0 ) ; z :=1; [ 4 = 4 ]; cfence; 5 :=x Pomote guad by Laws (9) and (10) (fom (56)) 4 :=1 [ 4 = 4 ] 0 :=y ; 2 :=z &+( 0 xo 0 ) ; z :=1; cfence; 5 :=x Pomote contol fence by Laws (9) and (10) ((51) does not now apply) 4 :=1 [ 4 = 4 ] cfence 0 :=y ; 2 :=z &+( 0 xo 0 ) ; z :=1; 5 :=x Pomote load by Laws (9) and (10) 4 :=1 [ 4 = 4 ] cfence 5 :=x 0 :=y ; 2 :=z &+( 0 xo 0 ) ; z :=1 The load 5 :=x has been eodeed befoe the load 0 :=y, and hence when inteleaved with the fist pocess fom (70) it is staightfowad that the condition may be satisfied. In the Flowing/POP model of [4], this behaviou is fobidden because thee is an addess dependency fom the load of y into 0 to 4, via z. In the (CMP) and banch-not-equal (BNE) instuctions). We have also combined some commands, etaining dependencies, in a way that is not possible in the assemble language. The xo opeato is exclusive-o; its use hee(atificially) ceates an addess dependency [3] between the updates to 0 and 2. The 4 = 4 empty conditional ceates a contol dependency (and with the contol fence, a contol fence dependency) between loads. 26

27 testing of eal pocessos epoted in [4], the behaviou that we allow was neve obseved, but it is also allowed by the model in [3]. 8. POWER POWER pocessos allow simila eodeings to ARM, as well as those aspects discussed in Sect. 6.1 to Sect Additionally, POWER includes so-called lightweight fences, lwfence, which have both a local and global effect, and the simila eieio baies. The eodeing and fowading definitions fo POWER ae othewise the same as those in Fig. 5; we discuss how that elates to hadwae tests in Sect Lightweight fences A lightweight fence, denoted lwfence, maintains ode between loads, loads then stoes, and stoes, but not stoes and subsequent loads (i.e., load;load, load;stoe, stoe;stoe, but not stoe;load). As shown in the eodeing ule (72) of Fig. 7 we use two types of instuction to model the lightweight fence instuction. 8 These ae gates, with the stoegate instuction allowing stoes to move backwads and the loadgate instuction allowing loads to move fowad, as given by the eodeing ules (73,74). Fo instance, assume the following sequence of instuctions, whee l i ae loads and s i ae stoes. l 1 ; s 1 ; stoegate; loadgate; l 2 ; s 2 Assuming all loads and stoes ae to diffeent vaiables and hence thee ae no paiwise constaints on eodeing, application of the Laws (9) and (10) gives l 1 stoegate l 2 s 1 loadgate s 2 Note that the ode between loads, between stoes, and between loads then stoes has been maintained, but load l 2 may be eodeed befoe the stoe s 1. 8 If lightweight fences did not maintain load;load ode it would be staightfowad to define thei effect in tems of one instuction. It is possible to do it with one fence that maks any late load which jumps it so that load can be eodeed with ealie stoes but not ealie loads, howeve this seems less elegant and less amenable to algebaic analysis. 27

28 In addition to a local constaint on possible eodeings, a lightweight fence also has a global effect on the stoage system, which we encode in the semantics of the loadgate instuction (Rule (77)). Infomally, a lightweight fence equies othe pocesses to see changes to (diffeent) shaed vaiables in the same ode as the pocess that wote them. This is subtly diffeent to a full fence, as we descibe below. Effect on the stoage subsystem. As given in Rule(77) a loadgate instuction by pocess n has an effect on the stoage ω simila to a full fence, but in this case all wites that n has seen (which includes all wites by n) ae also tagged as lightweight-fenced by n by adding the lwf(n) tag to the seen pat of a wite. This is given by the ecusive definition of lwflush in (79). Inthepesenceoflightweightfencestheulefoaload(Rule(63))changes to Rule (78). The change is that if pocess n sees a wite by pocess m then it must also see any ealie wites by m that m has lightweight-fenced. This is given by the function see m n(ω) which simply maks any wites that ae lightweight-fenced by m to be seen and lightweight-fenced by n. This tansitive effect gives cumulativity of lightweight fences [3]. The inclusion of a lightweight fence also has a subtle effect on the wite ode in the stoage subsystem: the definition of wite eodeing as used in Rule (64) is updated to (81), whee w 1 w w 2 is defined so that wite w 2 by n to x may come befoe wite w 1 (to diffeent vaiable y) povided that w 1 has not peviously been lightweight-fenced by n. In addition to lightweight fences POWER also includes an eieio baie. Based on the discussion in [3] we teated this as a baie on stoes only (75,76). In addition an eieio baie acts as a lightweight flush on the stoage system as in Rule (77) Validation Thee ae two litmus test esouces we used. Fistly, we validated the semantics against a set of 758 litmus tests taken fom the supplementay mateial of [2] 9 (the eason fo moe tests is due to the exta lwfence cases). As with ARM, some tests wee excluded due to pasing issues. As with the esults fom [4], ou model disagees on the same thee tests discussed in Sect , and othewise agees with the expected esults on hadwae, and agees with the esults of thei model whee available (