No file available
To read the file of this research,
you can request a copy directly from the authors.
A formalisation of the SPARC TSO memory model for multi-core machine code
Preprints and early-stage research may not have been peer reviewed yet.
Abstract
SPARC processors have many applications in mission-critical industries such as aviation and space engineering. Hence, it is important to provide formal frameworks that facilitate the verification of hardware and software that run on or interface with these processors. This paper presents the first mechanised SPARC Total Store Ordering (TSO) memory model which operates on top of an abstract model of the SPARC Instruction Set Architecture (ISA) for multi-core processors. Both models are specified in the theorem prover Isabelle/HOL. We formalise two TSO memory models: one is an adaptation of the axiomatic SPARC TSO model, the other is a novel operational TSO model which is suitable for verifying execution results. We prove that the operational model is sound and complete with respect to the axiomatic model. Finally, we give verification examples with two case studies drawn from the SPARCv9 manual.
ResearchGate has not been able to resolve any citations for this publication.
The SPARCv8 instruction set architecture (ISA) has been used in various processors for workstations, embedded systems, and space missions. However, there are no publicly available formal models for the SPARCv8 ISA. In this work, we give the first formal model for the integer unit of SPARCv8 ISA in Isabelle/HOL. We capture the operational semantics of the instructions using monadic definitions. Our model is a detailed model, which covers many features specific to SPARC processors, such as delayed-write for control registers, windowed general registers, and more complex memory access. Our model is also general, as we retain an abstract layer of the model which allows it to be instantiated to support all SPARCv8 compliant processors. We extract executable code from our formalisation, giving us the first systematically verified executable semantics for the SPARCv8 ISA. We have tested our model extensively against a LEON3 simulation board, covering both single-step executions and sequential execution of programs. We prove some important properties for our formal model, including a non-interference property for the LEON3 processor.
Weakly consistent multiprocessors such as ARM and IBM POWER have been with us for decades, but their subtle programmer-visible concurrency behaviour remains challenging, both to implement and to use; the traditional architecture documentation, with its mix of prose and pseudocode, leaves much unclear.
In this paper we show how a precise architectural envelope model for such architectures can be defined, taking IBM POWER as our example. Our model specifies, for an arbitrary test program, the set of all its allowable executions, not just those of some particular implementation. The model integrates an operational concurrency model with an ISA model for the fixed-point non-vector user-mode instruction set (largely automatically derived from the vendor pseudocode, and expressed in a new ISA description language). The key question is the interface between these two: allowing all the required concurrency behaviour, without overcommitting to some particular microarchitectural implementation, requires a novel abstract structure.
Our model is expressed in a mathematically rigorous language that can be automatically translated to an executable test-oracle tool; this lets one either interactively explore or exhaustively compute the set of all allowed behaviours of intricate test cases, to provide a reference for hardware and software development.
Complete formal verification is the only known way to guarantee that a system is free of programming errors. We present our experience in performing the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, and hardware, and we used a unique design approach that fuses formal and operating systems techniques. To our knowledge, this is the first formal proof of functional correctness of a complete, general-purpose operating-system kernel. Functional correct- ness means here that the implementation always strictly fol- lows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as the kernel will never crash, and it will never perform an unsafe operation. It also proves much more: we can predict precisely how the kernel will behave in every possible situation. seL4, a third-generation microkernel of L4 provenance, comprises 8,700 lines of C code and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels.
The HOL4 interactive theorem prover provides a sound logical environment for reasoning about machine-code programs. The rigour of HOL’s LCF-style kernel naturally guarantees very high levels of assurance, but it does present challenges when it comes implementing efficient proof tools. This paper presents improvements that have been made to our methodology for soundly decompiling machine-code programs to functions expressed in HOL logic. These advancements have been facilitated by the development of a domain specific language, called L3, for the specification of Instruction Set Architectures (ISAs). As a result of these improvements, decompilation is faster (on average by one to two orders of magnitude), the instruction set specifications are easier to write, and the proof tools are easier to maintain.
We propose a new approach to programming multi-core, relaxed-memory architectures in imperative, portable programming languages. Our memory model is based on explicit, programmer-specified requirements for order of execution and the visibility of writes. The compiler then realizes those requirements in the most efficient manner it can. This is in contrast to existing memory models, which---if they allow programmer control over synchronization at all---are based on inferring the execution and visibility consequences of synchronization operations or annotations in the code.
We formalize our memory model in a core calculus called RMC\@. Outside of the programmer's specified requirements, RMC is designed to be strictly more relaxed than existing architectures. It employs an aggressively nondeterministic semantics for expressions, in which actions can be executed in nearly any order, and a store semantics that generalizes Sarkar et al.'s and Alglave et al.'s models of the Power architecture. We establish several results for RMC, including sequential consistency for two programming disciplines, and an appropriate notion of type safety. All our results are formalized in Coq.
We introduce a formal framework for specifying the behavior of memory systems for shared memory multiprocessors. Specifications in this framework are axiomatic, thereby avoiding ambiguities inherent in most existing specifications, which are informal. The framework makes it convenient to construct correctness arguments for hardware implementations and to generate proofs of critical program fragments. By providing a common language in which a range of memory models can be specified, the framework also permits comparison of existing models and facilitates exploration of the space of possible models. The framework is illustrated with three examples: the well-known Strong Consistency model, and two store ordered models TSO and PSO defined by the Sun Microsystem’s SPARC architecture. The latter two models were developed using this framework.
We introduce a new ACL2 feature, the abstract stobj, and show how to apply it
to modeling the instruction set architecture of a microprocessor. Benefits of
abstract stobjs over traditional ("concrete") stobjs can include faster
execution, support for symbolic simulation, more efficient reasoning, and
resilience of proof developments under modeling optimization.
With the rise of multi-core processors, shared-memory concurrency has become a widespread feature of computation, from hardware, to operating systems, to programming languages such as C++ and Java. However, none of these provide sequentially consistent shared memory; instead they have relaxed memory models, which make concurrent programs even more challenging to understand. Programming language implementations run on hardware memory models, so VM and run-time system implementors must reason at both levels. Of particular interest are the low-level implementations of the abstractions that support language-level concurrency—especially because they invariably contain data races.
In this paper, we develop a novel principle for reasoning about assembly programs on our previous x86-TSO memory model, and we use it to analyze five concurrency abstraction implementations: two spinlocks (from Linux); a non-blocking write protocol; the double-checked locking idiom; and java.util.concurrent’s Parker. Our principle, called triangular-race freedom, strengthens the usual data-race freedom style of reasoning.
This paper presents a new HOL4 formalization of the current ARM instruction set architecture, ARMv7. This is a modern RISC
architecture with many advanced features. The formalization is detailed and extensive. Considerable tool support has been
developed, with the goal of making the model accessible and easy to work with. The model and supporting tools are publicly
available – we wish to encourage others to make use of this resource. This paper explains our monadic specification approach
and gives some details of the endeavours that have been made to ensure that the sizeable model is valid and trustworthy. A
novel and efficient testing approach has been developed, based on automated forward proof and communication with ARM development
boards.
Multiprocessors are now dominant, but real multiprocessors do not provide the sequentially consistent memory that is assumed by most work on semantics and verification. Instead, they have subtle relaxed (or weak) memory models, usually described only in ambiguous prose, leading to widespread confusion.
We develop a rigorous and accurate semantics for x86 multiprocessor programs, from instruction decoding to relaxed memory model, mechanised in HOL. We test the semantics against actual processors and the vendor litmus-test examples, and give an equivalent abstract-machine characterisation of our axiomatic memory model. For programs that are (in some precise sense) data-race free, we prove in HOL that their behaviour is sequentially consistent. We also contrast the x86 model with some aspects of Power and ARM behaviour.
This provides a solid intuition for low-level programming, and a sound foundation for future work on verification, static analysis, and compilation of low-level concurrent code.
The problem of verifying multi-threaded execution against the memory consistency model of a processor is known to be an NP hard problem. However polynomial time algorithms exist that detect almost all failures in such execution. These are often used in practice for microprocessor verification. We present a low complexity and fully parallelized algorithm to check program execution against the processor consistency model. In addition our algorithm is general enough to support a number of consistency models without any degradation in performance. An implementation of this algorithm is currently used in practice to verify processors in the post silicon stage for multiple architectures.
Exploiting the multiprocessors that have recently become ubiquitous requires high-performance and reliable concurrent systems code, for concurrent data structures, operating system kernels, synchronization libraries, compilers, and so on. However, concurrent programming, which is always challenging, is made much more so by two problems. First, real multiprocessors typically do not provide the sequentially consistent memory that is assumed by most work on semantics and verification. Instead, they have relaxed memory models, varying in subtle ways between processor families, in which different hardware threads may have only loosely consistent views of a shared memory. Second, the public vendor architectures, supposedly specifying what programmers can rely on, are often in ambiguous informal prose (a particularly poor medium for loose specifications), leading to widespread confusion.
In this paper we focus on x86 processors. We review several recent Intel and AMD specifications, showing that all contain serious ambiguities, some are arguably too weak to program above, and some are simply unsound with respect to actual hardware. We present a new x86-TSO programmer's model that, to the best of our knowledge, suffers from none of these problems. It is mathematically precise (rigorously defined in HOL4) but can be presented as an intuitive abstract machine which should be widely accessible to working programmers. We illustrate how this can be used to reason about the correctness of a Linux spinlock implementation and describe a general theory of data-race freedom for x86-TSO. This should put x86 multiprocessor system building on a more solid foundation; it should also provide a basis for future work on verification of such systems.
The Murψ description language and verification system for
finite-state concurrent systems is applied to the problem of specifying
a family of multiprocessor memory models described in the SPARC Version
9 architecture manual. The description language allows for a
straightforward operational description of the memory model which can be
used as a specification for programmers and machine architects. The
automatic verifier can be used to generate all possible outcomes of
small assembly language multiprocessor programs in a given memory model,
which is very helpful for understanding the subtleties of the model. The
verifier can also check the correctness of assembly language programs
including synchronization routines. This paper describes the memory
models and their encoding in the Murψ description language. We
describe how synchronization routines can be verified and how finite
state programs can be analyzed. We also present some interesting
findings from the verification and the analysis
This paper describes an experiment in formal specification and validation performed in the context of an industrial joint project involving Ansaldobreda Segnalamento Ferroviario (ASF) and CNR Institutes - IEI and CNUCE - of Pisa. Within this project two formal models have been developed, describing different aspects of a wider safety-critical system for the management of medium-large railway networks. Validation of safety and liveness properties has been performed on both models. More specifically safety properties have been checked also in presence of byzantine behavior as well as other kinds of faults embedded in the models themselves. Liveness properties have been more focused on a communication protocol used within the system.
CoqJVM: An executable specification of the Java virtual machine using dependent types
- R Atkey
Atkey, R.: CoqJVM: An executable specification of the Java virtual machine using dependent
types. In: TYPES. pp. 18-32. LNCS, Springer (2005)
Relaxed memory models: an operational approach
- G Boudol
- G Petri
Boudol, G., Petri, G.: Relaxed memory models: an operational approach. In: Proceedings of
the 36th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages,
POPL 2009, Savannah, GA, USA, January 21-23, 2009. pp. 392-403 (2009)
Modelling the armv8 architecture, operationally: Concurrency and ISA
- S Flur
- K E Gray
- C Pulte
- S Sarkar
- A Sezgin
- L Maranget
- W Deacon
- P Sewell
Flur, S., Gray, K.E., Pulte, C., Sarkar, S., Sezgin, A., Maranget, L., Deacon, W., Sewell,
P.: Modelling the armv8 architecture, operationally: Concurrency and ISA. SIGPLAN Not.
51(1), 608-621 (Jan 2016)
Directions in ISA specification
- A Fox
Fox, A.: Directions in ISA specification. In: Interactive Theorem Proving, LNCS, vol. 7406,
pp. 338-344. Springer Berlin Heidelberg (2012)
Certikos: An extensible architecture for building certified concurrent os kernels
- R Gu
- Z Shao
- H Chen
- X Wu
- J Kim
- V Sjöberg
- D Costanzo
Gu, R., Shao, Z., Chen, H., Wu, X., Kim, J., Sjöberg, V., Costanzo, D.: Certikos: An extensible architecture for building certified concurrent os kernels. In: OSDI'16. pp. 653-669.
OSDI'16 (2016)
Tsotool: A program for verifying memory systems using the memory consistency model
- S Hangal
- D Vahia
- C Manovit
- J Y J Lu
Hangal, S., Vahia, D., Manovit, C., Lu, J.Y.J.: Tsotool: A program for verifying memory
systems using the memory consistency model. SIGARCH Comput. Archit. News 32(2), 114-(2004)
Formal certification of a compiler back-end, or: programming a compiler with a proof assistant
- X Leroy
Leroy, X.: Formal certification of a compiler back-end, or: programming a compiler with a
proof assistant. In: In Proceedings. 33rd ACM Symposium on Principles of Programming
Languages (2006)
Executable JVM model for analytical reasoning: A study
- H Liu
- J S Moore
Liu, H., Moore, J.S.: Executable JVM model for analytical reasoning: A study. In: Proceedings of the 2003 Workshop on Interpreters, Virtual Machines and Emulators. pp. 15-23.
ACM (2003)
Multiprocessor memory model verification
- P Loewenstein
- S Chaudhry
Loewenstein, P., Chaudhry, S.: Multiprocessor memory model verification. In: Proc. Automated Formal Methods. FLoC workshop (2006)
Lem: reusable engineering of real-world semantics
- D P Mulligan
- S Owens
- K E Gray
- T Ridge
- P Sewell
Mulligan, D.P., Owens, S., Gray, K.E., Ridge, T., Sewell, P.: Lem: reusable engineering of
real-world semantics. In: Proceedings of the 19th ACM SIGPLAN International Conference
on Functional Programming. pp. 175-188 (2014)
Operational semantics of relaxed memory models
- G Petri
Petri, G.: Operational semantics of relaxed memory models (2010), thesis
Nemos: a framework for axiomatic and executable specifications of memory consistency models
- Y Yang
- G Gopalakrishnan
- G Lindstrom
- K Slind
Yang, Y., Gopalakrishnan, G., Lindstrom, G., Slind, K.: Nemos: a framework for axiomatic
and executable specifications of memory consistency models. In: 18th International Parallel
and Distributed Processing Symposium, 2004. Proceedings. (April 2004)