Mixed-size concurrency: ARM, POWER, C/C++11, and SC

Flur, Shaked; Sarkar, Susmit; Pulte, Christopher; Nienhuis, Kyndylan; Maranget, Luc; Gray, Kathryn E.; Sezgin, Ali; Batty, Mark; Sewell, Peter

doi:10.1145/3093333.3009839

Cited by 9 publications

(12 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As explored in recent work [Flur et al 2017], mixed size guarantees are under-explored, and surprisingly weak on hardware, so Wasm, like JavaScript, picks a maximally weak (but defined) semantics. However, as discussed by [Flur et al 2017], some hyper-optimised low-level data structures rely on mixed-size consistency guarantees which our model does not currently provide. As our formal understanding of mixed-size accesses grows, it should become possible for us to give more guarantees.…”

Section: Axiomatic Memory Modelmentioning

confidence: 99%

“…To the best of our knowledge, the only existing formal work on the correctness of a mixed-size compilation scheme is [Flur et al 2017]. This work presents mixed-size operational models for ARMv8 and Power, and sketches a mixed-size generalisation of a previous proof from non-mixedsize C/C++11 to Power .…”

Section: Compiling Wasm To Hardwarementioning

confidence: 99%

“…Our model allows atomics to be mixed-size, although such accesses do not provide the same guarantees as non-mixed-size atomics (for example, mixed-size atomics are not related by sync in our model). Flur et al [2017] state that creating an abstract axiomatic model, suitable for more involved proofs, is important future work. We can still give some limited intuition regarding the correctness of the scheme, as a guide for future proof.…”

Section: Compiling Wasm To Hardwarementioning

confidence: 99%

See 2 more Smart Citations

Weakening WebAssembly

Watt

Rossberg²,

Pichon-Pharabod

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

is a safe, portable virtual instruction set that can be hosted in a wide range of environments, such as a Web browser. It is a low-level language whose instructions are intended to compile directly to bare hardware. While the initial version of Wasm focussed on single-threaded computation, a recent proposal extends it with low-level support for multiple threads and atomic instructions for synchronised access to shared memory. To support the correct compilation of concurrent programs, it is necessary to give a suitable specification of its memory model. Wasm's language definition is based on a fully formalised specification that carefully avoids undefined behaviour. We present a substantial extension to this semantics, incorporating a relaxed memory model, along with a few proposed operational extensions. Wasm's memory model is unique in that its linear address space can be dynamically grown during execution, while all accesses are bounds-checked. This leads to the novel problem of specifying how observations about the size of the memory can propagate between threads. We argue that, considering desirable compilation schemes, we cannot give a sequentially consistent semantics to memory growth. We show that our model guarantees Sequential Consistency of Data-Race-Free programs (SC-DRF). However, because Wasm is to run on the Web, we must also consider interoperability of its model with that of JavaScript. We show, by counterexample , that JavaScript's memory model is not SC-DRF, in contrast to what is claimed in its specification. We propose two axiomatic conditions that should be added to the JavaScript model to correct this difference. We also describe a prototype SMT-based litmus tool which acts as an oracle for our axiomatic model, visualising its behaviours, including memory resizing. CCS Concepts: • Software and its engineering → Virtual machines; Assembly languages; Runtime environments; Just-in-time compilers.

show abstract

Section: Axiomatic Memory Modelmentioning

confidence: 99%

Section: Compiling Wasm To Hardwarementioning

confidence: 99%

Section: Compiling Wasm To Hardwarementioning

confidence: 99%

See 1 more Smart Citation

Weakening WebAssembly

Watt

Rossberg²,

Pichon-Pharabod

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…Now, following extensive work by many people [36,37,19,18,22,8,31,45,7,46,48,35,6,2,47,13,1], ARMv8-A has a well-defined and simplified model as part of its specification [9, B2.3], including a prose transcription of a mathematical model [15], and an equivalence proof between operational and axiomatic presentations [36,37]; RISC-V has adopted a similar model [52]; and IBM POWER and x86 have well-established de-facto-standard models. All of these are experimentally validated against hardware, and supported by tools for exhaustively running tests [17,4]. The combination of these models and the ISA semantics above is enough to let one reason about or modelcheck concurrent algorithms.…”

Section: Introductionmentioning

confidence: 99%

“…We run tests on hardware with a mild extension of the Litmus tool [5,7]. We make the operational model executable as a test oracle by integrating it into the RMEM tool and its web interface [17], introducing optimisations that make it possible to exhaustively execute the examples. We make the axiomatic model executable as a test oracle with a new tool that takes litmus tests and uses a Sail [11] definition of a fragment of the ARMv8-A ISA to generate SMT problems for the model.…”

Section: Introductionmentioning

confidence: 99%

ARMv8-A System Semantics: Instruction Fetch in Relaxed Architectures

Simner

Flur

Pulte

et al. 2020

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

Computing relies on architecture specifications to decouple hardware and software development. Historically these have been prose documents, with all the problems that entails, but research over the last ten years has developed rigorous and executable-as-test-oracle specifications of mainstream architecture instruction sets and "user-mode" concurrency, clarifying architectures and bringing them into the scope of programming-language semantics and verification. However, the system semantics, of instruction-fetch and cache maintenance, exceptions and interrupts, and address translation, remains obscure, leaving us without a solid foundation for verification of security-critical systems software. In this paper we establish a robust model for one aspect of system semantics: instruction fetch and cache maintenance for ARMv8-A. Systems code relies on executing instructions that were written by data writes, e.g. in program loading, dynamic linking, JIT compilation, debugging, and OS configuration, but hardware implementations are often highly optimised, e.g. with instruction caches, linefill buffers, out-of-order fetching, branch prediction, and instruction prefetching, which can affect programmer-observable behaviour. It is essential, both for programming and verification, to abstract from such microarchitectural details as much as possible, but no more. We explore the key architecture design questions with a series of examples, discussed in detail with senior Arm staff; capture the architectural intent in operational and axiomatic semantic models, extending previous work on "user-mode" concurrency; make these models executable as test oracles for small examples; and experimentally validate them against hardware behaviour (finding a bug in one hardware device). We thereby bring these subtle issues into the mathematical domain, clarifying the architecture and enabling future work on system software verification.

show abstract

Isla: Integrating Full-Scale ISA Semantics and Axiomatic Concurrency Models

Armstrong,

Campbell,

Simner

et al. 2021

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

Architecture specifications such as Armv8-A and RISC-V are the ultimate foundation for software verification and the correctness criteria for hardware verification. They should define the allowed sequential and relaxed-memory concurrency behaviour of programs, but hitherto there has been no integration of full-scale instruction-set architecture (ISA) semantics with axiomatic concurrency models, either in mathematics or in tools. These ISA semantics can be surprisingly large and intricate, e.g. 100k+ lines for Armv8-A. In this paper we present a tool, Isla, for computing the allowed behaviours of concurrent litmus tests with respect to full-scale ISA definitions, in Sail, and arbitrary axiomatic relaxed-memory concurrency models, in the Cat language. It is based on a generic symbolic engine for Sail ISA specifications, which should be valuable also for other verification tasks. We equip the tool with a web interface to make it widely accessible, and illustrate and evaluate it for Armv8-A and RISC-V. By using full-scale and authoritative ISA semantics, this lets one evaluate litmus tests using arbitrary user instructions with high confidence. Moreover, because these ISA specifications give detailed and validated definitions of the sequential aspects of systems functionality, as used by hypervisors and operating systems, e.g. instruction fetch, exceptions, and address translation, our tool provides a basis for developing concurrency semantics for these. We demonstrate this for the Armv8-A instruction-fetch model and self-modifying code examples of Simner et al.

show abstract

Mixed-size concurrency: ARM, POWER, C/C++11, and SC

Abstract: The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

Cited by 9 publications

References 47 publications

Weakening WebAssembly

Weakening WebAssembly

ARMv8-A System Semantics: Instruction Fetch in Relaxed Architectures

Isla: Integrating Full-Scale ISA Semantics and Axiomatic Concurrency Models

Contact Info

Product

Resources

About