bridgingthegapbetweenprogramminglanguagesand...

Bridging the Gap between Programming Languages andHardware Weak Memory Models

Anton Podkopaev Ori Lahav Viktor Vafeiadis

Bridging the Gap between PL and Hardware Weak MMs

ProgrammingLanguage HardwareCompiler

CorrectCompiler

∀P ∈ Syntax(PL).

JPKPLJcompile(P)KHWJ−K{PL,HW} is Memory Model

ProgrammingLanguage Hardware

CompilerCorrectCompiler

ProgrammingLanguage HardwareCompiler

CorrectCompiler

Compiler

CorrectCompiler

Compiler

CorrectCompiler

JPKPLJcompile(P)KHW

J−K{PL,HW} is Memory Model

Compiler

CorrectCompiler

Compiler

CorrectCompiler

Strong (SC) MM disallows a = b = 1

Memory;[x]← 0 [y]← 0

Values;a = ⊥ b = ⊥

a := [x];[y] := 1;

b := [y];[x] := b;

ARM and POWER weak MMs allow a = b = 1!

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 0 b = ⊥

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 0 b = ⊥

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 0 b = 1

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 0 b = 1

a := [x];[y] := 1;

b := [y];[x] := b;

Strong (SC) MM

disallows a = b = 1

Values;a = 0 b = 1

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 0 b = 1

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 0 b = 1

a := [x];[y] := 1;

b := [y];[x] := b;

Promise

(R)C11

WeakestMO[Chakraborty and Vafeiadis, 2019]

x86-TSO

ARMv8.3

RISC-V

CompCert Weak MMs1. Declarative1. Declarative2. Preserves syntactic dependencies

(deps ∪ rf is acyclic)

1. Declarative2. Preserves syntactic dependencies

(deps ∪ rf is acyclic)3. Uses C11-style coherence

(hb; eco? is irreflexive)

(hb; eco? is irreflexive)4. Non-multicopy-atomic

w/o mutually recursive relations

plv.mpi-sws.org/imm/ Thank you!

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

CompCert Weak MMs

1. Declarative

(Declarative) Executions in IMMa := [x];[y] := 1;

b := [y];[x] := b;

Wx0fr ,Rx0

Wx1data

frrf ,

Wx1data

Wx1po data

Axioms:1. data ∪ rf is acyclic…

b := [y];[x] := b;

Wx0fr ,Rx0

Wx1data

frrf ,

Wx1data

Wx1po data

b := [y];[x] := b;

Wx0fr ,Rx0

Wx1data

frrf ,

Wx1data

Wx1po data

b := [y];[x] := b;

Wx0fr ,Rx0

Wx1data

frrf ,

Wx1data

Wx1po data

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

CompCert Weak MMs

1. Declarative

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

CompCert Weak MMs1. Declarative

1. Declarative2. Preserves syntactic dependencies(deps ∪ rf is acyclic)

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

3. Uses C11-style coherence(hb; eco? is irreflexive)

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

3. Uses C11-style coherence(hb; eco? is irreflexive)

4. Non-multicopy-atomicw/o mutually recursive relations

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

(Operational) Execution in Promise

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Requires certification

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Promised

a := [x];[y] := 1;

b := [y];[x] := b;Requires certification

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = ⊥ b = 1

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = ⊥ b = 1

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 1 b = 1

Promised

a := [x];[y] := 1;

b := [y];[x] := b;

Values;a = 1 b = 1

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

How to prove correctness ofcompilation?

Simulation

How to simulate graphs?

Traverse in proper order!

How to prove correctness ofcompilation? Simulation

Traversal of IMM executiona := [x];[y] := 1;

b := [y];[x] := b;

Promised

Covered

Issued

Promise → IMM compilation correctness proof1. Operational semantics of IMM’s traversal:

G ⊢ ⟨C, I⟩ → ⟨C ′, I ′⟩

2. Completeness of traversal:

∀G ∈ JPKIMM. G ⊢ initTraverse →∗ ⟨G.Events,G.Writes⟩3. Simulation theorems:

initTraverse initPromisesimulated by traverse

traverse′

promise

∃ promise′

simulated by

Promise’s certificationPromise’s certificationvia traversal ofcertification graph

G ⊢ ⟨C, I⟩ → ⟨C ′, I ′⟩2. Completeness of traversal:

∀G ∈ JPKIMM. G ⊢ initTraverse →∗ ⟨G.Events,G.Writes⟩

3. Simulation theorems:

traverse′

promise

∃ promise′

simulated by

traverse′

promise

∃ promise′

simulated by

traverse′

promise

∃ promise′

simulated by

traverse′

promise

∃ promise′

simulated by

Promise’s certification

Promise’s certificationvia traversal ofcertification graph

traverse′

promise

∃ promise′

simulated by

Promise’s certification

Promise’s certificationvia traversal ofcertification graph

b := [y];[x] := b;

Promised Promised

Covered

Issued

b := [y];[x] := b;

Promised

Covered

Issued

b := [y];[x] := b;

Promised

Covered

Issued

b := [y];[x] := b;

Promised Promised

Covered

Issued

b := [y];[x] := b;

Promised

Covered

Issued

b := [y];[x] := b;

Promised

Covered

Issued

b := [y];[x] := b;

Promised Promised

Covered

Issued

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

CompCert Weak MMs

1. Declarative1. Declarative2. Preserves syntactic dependencies

Promise

(R)C11

x86-TSO

ARMv8.3

RISC-V

CompCert Weak MMs

1. Declarative1. Declarative2. Preserves syntactic dependencies

Links I

Chakraborty, S. and Vafeiadis, V. (2019).Grounding thin-air reads with event structures.In POPL 2019. ACM.Kang, J., Hur, C.-K., Lahav, O., Vafeiadis, V., and Dreyer, D. (2017).A promising semantics for relaxed-memory concurrency.In POPL 2017. ACM.

Backup slides

IMM definition

Def. G is called IMM-consistent if the following hold:• codom(G.rf) = G.R.• For every location ℓ ∈ Loc, G.co totally orders G.Wℓ.• G.rmw ∩ (G.fre ; G.coe) = ∅.• G.hb ; G.eco? is irreflexive.• G.ar is acyclic.

ar ≜ rfe ∪ bob ∪ ppo ∪ detour ∪ psc ∪ [Wstrong] ; po ; [W]bob ≜ po ; [Wrel] ∪ [Racq] ; po ∪ po ; [F] ∪ [F] ; po ∪ [Wrel] ; po|loc ; [W]ppo ≜ [R] ; (deps ∪ rfi)+ ; [W]deps ≜ data ∪ ctrl ∪ addr ; po? ∪ casdep ∪ [Rex] ; po

Traversal definition

a ∈ Next(G,C) ∩ Coverable(G,C, I)G ⊢ ⟨C, I⟩ → ⟨C ∪ {a}, I⟩

w ∈ Issuable(G,C, I) \ IG ⊢ ⟨C, I⟩ → ⟨C, I ∪ {w}⟩

Def. w ∈ Issuable(G,C, I) iff w ∈ G.W and the following hold:• dom(([G.Wrel] ; G.po|G.loc ∪ [G.F] ; G.po) ; [w]) ⊆ C• dom((G.detour ∪ G.rfe) ; G.ppo ; [w]) ⊆ I• dom((G.detour ∪ G.rfe) ; [G.Racq] ; G.po ; [w]) ⊆ I• dom([G.Wstrong] ; G.po ; [w]) ⊆ I

Def. e ∈ Coverable(G,C, I) iff e ∈ G.E, dom(G.po ; [e]) ⊆ C and either(i) e ∈ G.W ∩ I; (ii) e ∈ G.R and dom(G.rf ; [e]) ⊆ I;(iii) e ∈ G.F<sc; or (iv) e ∈ G.Fsc and dom(G.sc ; [e]) ⊆ C.

Mistake in Kang et al.17’s compilation to POWER correctness proof

Rrlxz1

Wrlxx1

Wrlxx2

Wrlxy1

Rrlxy1

Wrlxz1

Consistent in Strong-POWER.Not consistent in the promise-free declarative model of[Kang et al., 2017].

Promise → IMM compilation of RMWs

a := [y]rlx // 1[z]rlx := a

b := [z]rlx // 1c := FADDrlx,rel

strong (x, 1) // 0[y]rlx := c+ 1

Rrlxy1

Wrlxz1

Rrlxz1

Rrlxx0

Wrelstrongx1

Wrlxy1

data rmwdata

bobrfe

bridgingthegapbetweenprogramminglanguagesand...

Documents