Promising-ARM/RISC-V: a simpler and faster operational concurrency model

Abstract

For ARMv8 and RISC-V, there are concurrency models in two styles, extensionally equivalent: axiomatic models, expressing the concurrency semantics in terms of global properties of complete executions; and operational models, that compute incrementally. The latter are in an abstract microarchitectural style: they execute each instruction in multiple steps, out-of-order and with explicit branch speculation. This similarity to hardware implementations has been important in developing the models and in establishing confidence, but involves complexity that, for programming and modelchecking, one would prefer to avoid.We present new more abstract operational models for ARMv8 and RISC-V, and an exploration tool based on them. The models compute the allowed concurrency behaviours incrementally based on thread-local conditions and are significantly simpler than the existing operational models: executing instructions in a single step and (with the exception of early writes) in program order, and without branch speculation. We prove the models equivalent to the existing ARMv8 and RISC-V axiomatic models in Coq. The exploration tool is the first such tool for ARMv8 and RISC-V fast enough for exhaustively checking the concurrency behaviour of a number of interesting examples. We demonstrate using the tool for checking several standard concurrent datastructure and lock implementations, and for interactively stepping through model-allowed executions for debugging.

HMC

“…2. HMC outperforms all other SMC tools that support non-porf-acyclic memory models-i.e., Nidhugg [3] and CDSChecker [32]-as well as memory model simulators-i.e., Herd [9] and rmem [36]. 3.…”

“…rmem [37] is a memory model simulator that, among others, supports operational definitions of ARMv8 and RISC-V. Pulte et al [36] claim that rmem's current operational definitions are suitable for model checking, as they are much faster than the previous ones [35], and tools like Herd. rmem operates on the ARMv8/RISC-V ISA, but does not support dynamic thread creation.…”

“…We begin by comparing against the most intensive benchmarks for which Pulte et al [36] published results for rmem (cf. Table 4).…”

“…and restrict to a fragment of the memory model for the sake of efficiency, e.g., [26,27], or they sacrifice scalability by naively emulating all the possible out-of-order executions that could arise in a program, e.g., [3,32,36].…”

“…In this paper, we develop HMC (Hardware-memory Model Checker), the first efficient SMC algorithm that supports dependency-tracking models. In HMC, we do not try to directly emulate out-of-order execution as the prior work [32,36] does. We instead extend the approach of GenMC [27] to lift its assumption of porf-acyclicity.…”