Formalising Java’s Data Race Free Guarantee

Aspinall, David; Ševčík, Jaroslav

doi:10.1007/978-3-540-74591-4_4

Cited by 64 publications

(85 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Saraswat et al [18] also define memory models in terms of local reordering, and prove a DRF theorem, but focus on high-level languages. Several groups have used proof tools to tame the intricacies of these models, including Yang et al [22], using Prolog and SAT solvers to explore an axiomatic Itanium model, and Aspinall anď Sevčík [5], who formalised and identified problems with the Java Memory Model using Isabelle/HOL.…”

Section: Verified Checker and Resultsmentioning

confidence: 99%

A Better x86 Memory Model: x86-TSO

Owens

Sarkar

Sewell

2009

Lecture Notes in Computer Science

323

271

View full text Add to dashboard Cite

Abstract. Real multiprocessors do not provide the sequentially consistent memory that is assumed by most work on semantics and verification. Instead, they have relaxed memory models, typically described in ambiguous prose, which lead to widespread confusion. These are prime targets for mechanized formalization. In previous work we produced a rigorous x86-CC model, formalizing the Intel and AMD architecture specifications of the time, but those turned out to be unsound with respect to actual hardware, as well as arguably too weak to program above. We discuss these issues and present a new x86-TSO model that suffers from neither problem, formalized in HOL4. We believe it is sound with respect to real processors, reflects better the vendor's intentions, and is also better suited for programming. We give two equivalent definitions of x86-TSO: an intuitive operational model based on local write buffers, and an axiomatic total store ordering model, similar to that of the SPARCv8. Both are adapted to handle x86-specific features. We have implemented the axiomatic model in our memevents tool, which calculates the set of all valid executions of test programs, and, for greater confidence, verify the witnesses of such executions directly, with code extracted from a third, more algorithmic, equivalent version of the definition.

show abstract

Section: Verified Checker and Resultsmentioning

confidence: 99%

A Better x86 Memory Model: x86-TSO

Owens

Sarkar

Sewell

2009

Lecture Notes in Computer Science

323

271

View full text Add to dashboard Cite

show abstract

“…For programs without data races in the sense of the JMM, the JMM guarantees sequential consistency [3], i.e. our interleaving semantics can reproduce all allowed executions.…”

Section: Discussionmentioning

confidence: 99%

Verifying a Compiler for Java Threads

Lochbihler

2010

Programming Languages and Systems

View full text Add to dashboard Cite

Abstract.A verified compiler is an integral part of every security infrastructure. Previous work has come up with formal semantics for sequential and concurrent variants of Java and has proven the correctness of compilers for the sequential part. This paper presents a rigorous formalisation (in the proof assistant Isabelle/HOL) of concurrent Java source and byte code together with an executable compiler and its correctness proof. It guarantees that the generated byte code shows exactly the same observable behaviour as the semantics for the multithreaded source code.

show abstract

“…Thus, it clarifies our model, aids reuse of common parts, and simplifies our proofs. Nevertheless, it rigorously links Java and the JMM, which has been sorely missing in the literature [1,3]. Although most language features have already been studied in isolation, we have found many new intricate interactions between them.…”

Section: Modular Structurementioning

confidence: 99%

Analysing Java's safety guarantees under concurrency

Lochbihler

2014

It – Information Technology

View full text Add to dashboard Cite

Two features distinguish Java from other mainstream programming languages like C and C++: its builtin support for concurrency and safety guarantees such as type safety or safe execution in a sandbox. In this work, we build a formal, unified model of Java concurrency, validate it empirically, and analyse it with respect to the safety guarantees using a proof assistant. We show that type safety and Java's data race freedom guarantee hold. Our analysis, however, revealed a weakness in the Java security architecture, because the Java memory model theoretically allows pointer forgery. As a result, this work clarifies the specification of the Java memory model.

show abstract

Formalising Java’s Data Race Free Guarantee

Cited by 64 publications

References 21 publications

A Better x86 Memory Model: x86-TSO

A Better x86 Memory Model: x86-TSO

Verifying a Compiler for Java Threads

Analysing Java's safety guarantees under concurrency

Contact Info

Product

Resources

About