On Thin Air Reads Towards an Event Structures Model of Relaxed Memory

Transcription

1 On Thin Air Ras Towars an Evnt Struturs Mol of Rlax Mmory Alan Jffry an Jams Rily Bll Labs an Mozilla Rsarh DPaul Univrsity Abstrat This is th first papr to propos a pur vnt struturs mol of rlax mmory. W propos onfusion-fr vnt struturs ovr an alphabt with a justifiation rlation as a mol. Exutions ar mol by justifi onfigurations, whr vry ra vnt has a justifying writ vnt. Justifiation alon is too wak a ritrion, sin it allows yls of th kin that rsult in so-all thin-air ras. Ayli justifiation forbis suh yls, but also invaliats vnt rorrings that rsult from ompilr optimizations an ynami instrution shuling. W propos a notion wll-justifiation, bas on a gam-lik mol, whih striks a mil groun. W show that wll-justifi onfigurations satisfy th DRF thorm: in any ata-ra fr program, all wll-justifi onfigurations ar squntially onsistnt. W also show that rlyguarant rasoning is soun for wll-justifi onfigurations, but not for justifi onfigurations. For xampl, wll-justifi onfigurations ar typ-saf. Wll-justifiation allows many, but not all rorrings prform by rlax mmory. In partiular, it fails to valiat th ommutation of inpnnt ras. W isuss variations that may arss ths shortomings. 1. Introution Th last fw as hav sn svral attmpts to fin a suitabl smantis for shar-mmory onurrny unr rlax assumptions; s Batty t al. [2015] for a rnt summary. Evnt struturs [Winskl 1986] provi a way to visualiz all of th onfliting xutions of a program as a singl smanti objt. In this papr, w xploit th visual natur of vnt struturs to provi a frsh approah to rlax mmory mols. Consir a simpl programming languag whr all valus ar boolans, rgistrs (rang ovr by r) ar thraloal an variabls (rang ovr by x an y) ar global. In orr to fin th smantis ompositionally, variabl ra is fin as a hoi among th possibl valus that might b ra. For xampl, th vnt strutur for (r=x; y=r;) is as follows. Rgistr valus ar rsolv via substitution an thrfor o not appar in th vnt strutur. Th arrows rprsnt program orr, an th zigzag rprsnts a primitiv onflit. If two vnts ar in onflit, thn all following vnts ar also in onflit. This strutur has two maximal onflit-fr onfigurations, whih rprsnt a possibl xution of th program: an. If w suppos that this o fragmnt is mb in a largr program, th two onfigurations ar qually snsibl: x oul b anything. Howvr, if w tak to b th toplvl ialization of th program an suppos that variabls ar ializ to 0, thn th first onfiguration abov sms snsibl, whras th son os not: x must b 0. A ra vnt is justifi by a mathing visibl writ, rawn with a ash arrow in th abov onfigurations. Writs ar hin if thy our latr or ar blok by an intrvning writ. Whn moling xutions of whol programs, on xpts that all ras in a onfiguration must b justifi. In a happns-bfor mol [Manson t al. 2005], all onurrnt writs ar visibl, making this notion of justifiation quit prmissiv. Consir a program with two thras an th orrsponing vnt strutur, with vnts numbr for rfrn (r 1 =x; y=r 1 ;) (r 2 =y; x=r 2 ;) (P 1 ) Ry 1 14 Wx 1 18 Hr, th vnts that ar nithr orr nor in onflit ar onurrnt. Th vnt strutur for P 1 has th following onfiguration, in whih vry ra vnt is justifi by a mathing writ that is ithr bfor it, or onurrnt: (C 0 ) 15 17

2 Unfortunatly, th vnt strutur also has a onfiguration in whih thr is a yl in justifiation-an-program-orr: Ry 1 14 Wx 1 18 (C 1 ) Du to th yl, any availabl valu an b so justifi, thus arising out of thin air. Som mmory mols hav unfin smantis in th prsn of suh ata ras [Batty t al. 2011]. In th absn of suh unfin bhaviour, howvr, languags that laim mmory safty must isallow thin-air valus in orr to prsrv typ safty. Unfortunatly, yls suh as that in onfiguration C 1 annot b bann outright without also banning usful program transformations, suh as instrution rorring. For xampl, onsir th following program. (r 1 =x; y=1;) (r 2 =y; x=1;) (P 2 ) Th vnt strutur for P 2 is th sam as that for P 1 xpt that all writs hav valu 1. Thus, P 2 also allows onfiguration C 1. Clarly, if th orr of th two instrutions is swapp in ithr thra of P 2, thn it is possibl for both thras to ra 1. Sin program transformations may not introu nw bhaviors, C 1 must also b onsir a vali onfiguration of th original program. Thr ar svral mols in th litratur sign to allow onfiguration C 1 for P 2, yt ny it for P 1. Roughly ths an b ivi into two approahs: working with multipl xutions [Manson t al. 2005; Jagasan t al. 2010] or working with axioms an rwrit ruls [Cniarlli t al. 2007; Saraswat t al. 2007; Pihon-Pharabo an Swll 2016]. W propos a nw approah, bas on two-playr gams. Th gam is as follows: w start in onfiguration C, an th playr s goal is to xtn it to onfiguration D. Th opponnt piks a onfiguration C whih inlus C, an whos nw vnts ar aylially justifi. Th playr thn piks a onfiguration C whih inlus C, an whos nw vnts ar also aylially justifi. If C justifis D thn th playr has won, othrwis th opponnt has won. If th playr has a winning stratgy for this gam, w say that C AE-justifis D. From this gam, w an fin th wll-justifi onfigurations inutivly: /0 is wll-justifi; if C is wll-justifi an C AE-justifis D thn D is wll-justifi. Consir th following program, P (r 1 =x; y=1;) (r 2 =y; x=r 2 ;) (P 3 ) W show that both ras may b rsolv to 1 in th wlljustifi onfiguration {30, 32, 34, 36, 38}. In this as th yli justifir mols a vali xution, aus by a ompilr or harwar optimization rorring (r 1 =x; y=1;) as (y=1; r 1 =x;). W first show that /0 AE-justifis {30, 34, 38}. Th opponnt may hoos any onfiguration aylially justifi from /0; th intrsting hois ar th maximal onfigurations {30, 31, 33, 35, 37} an {30, 31, 34, 35, 38}. Sin both of ths inlu 35, whih justifis 34, th playr os not hav to a any vnts to justify {30, 34, 38}. Not that /0 os not AE-justify {30, 32}, sin th opponnt an hoos th onfiguration {30, 31, 35, 33, 37}. W now show that th onfiguration {30, 34, 38} AEjustifis {30, 32, 34, 36, 38}. Th opponnt may hoos any onfiguration aylially justifi from {30, 34, 38}; sin any hoi inlus 38, whih justifis 32, th playr os not hav to a any vnts to justify {30, 32, 34, 36, 38}. W hav thus shown a yli onfiguration similar to C 1 is wll-justifi for P This rasoning fails for onfiguration C 1 of P 1. In this as, th playr is unabl to stablish that /0 AE-justifis {10, 14, 18}. W provi a proof in 6. Intuitivly, th only maximal onfiguration availabl to th opponnt is {10, 11, 13, 15, 17}, an this fails to justify 14 sin thr is no writ of 1 to y. W rviw th litratur on onfusion-fr vnt struturs in 3. In 4 w fin wll-justifiation an provi furthr xampls. W giv th fion for a Java-lik happns-bfor mol [Manson t al. 2005]. W isuss synhronization ations, suh as loks, in 7. Prhaps th most important proprty of a rlax mmory mol is DRF: that programs without ata ras bhav as thy woul with strong mmory that is, as thy woul with squntially onsistnt mmory [Lamport 1979]. In 5, w srib our proof of th DRF thorm, whih w hav vrifi in Aga. In 6, w show that invariant rasoning is possibl using our fion. W stat a gnral thorm also vrifi in Aga whih is suffiint to stablish typ safty for stati alloation. W srib som of th limitations of our fion in 8. Whil th fion prsnt hr is a stp in th right irtion, it fails to valiat ommon rorrings, suh as th rorring of ras on iffrnt variabls. W giv an altrnativ fion that is bttr bhav on th Java Mmory Mol ausality tst ass [Pugh 2004]. Th inution prinipl us in our proof of DRF fails for this altrnativ fion. Th papr ns with a isussion of opn problms. Th Aga vlopmnt unrlying this papr is availabl at 2

3 2. Rlat work Batty t al. [2015] srib th problm of thin-air xutions an provi a tail rviw of th litratur. Lohbihlr [2013] provis an nylopi survy an history of th Java Mmory Mol, in partiular. Evnt struturs hav appar in prvious attmpts to formaliz rlax mmory smantis. Cniarlli t al. [2007] fin a smantis for Java using ias from vnt struturs to srib th stats of an oprational transition rlation. Pihon-Pharabo an Swll [2016] fin a smantis for C/C++ rlax atomis using vnt struturs as stats us to fin rwrit ruls. In ontrast, w fin th smantis of programs using vnt struturs alon, without rquiring a aitional layr of rwrit ruls. Castllan [2016] prsnts an intrlaving smantis for mmory using vnt struturs. In ontrast, our smantis uss th stanar nonintrlaving intrprtation of paralll omposition. Th us of univrsal quantifiation ovr onfigurations in th fion of AE-justifiation is novl in this work. Othr fions of vali xution for wak mmory, suh as th JMM [Manson t al. 2005; Švčík 2008; Lohbihlr 2013], ar purly xistntial in thir quantifiation ovr possibl xutions. 3. Evnt Struturs Evnt struturs wr introu by Winskl [1989] as a non-intrlaving mol of onurrny. Thy ar notabl for proviing a ompat mol of onurrnt systms, for xampl an vnt strutur mol for n onurrnt prosss will oftn hav only O(n) vnts, ompar to th O(2 n ) stats in a labll transition systm. In this stion, w rviw th fions assoiat with onflit-fr labll vnt struturs, an thir visualization as graphs. Rars familiar with vnt struturs an skip to 4, whr th nw matrial bgins. A partial orr (E, ) is a st E (th vnt st) quipp with a rflxiv, transitiv, antisymmtri rlation (th ausal orr). A wll orr is a partial orr that has no inf rasing squn. W visualiz partial orrs as irt ayli graphs whr gs not orr. For xampl th orr on {0,1,2,3} whr an 0 3 is visualiz on th right. A prim vnt strutur (E,,#) is a wll orr togthr with a symmtri rlation # on E (th onflit rlation), suh that if # thn #. For any prim vnt strutur, fin th primitiv onflit rlation # µ on E as # µ whnvr #, an for any b # w hav = b an =. Primitiv onflit is also known as minimal onflit. A prim vnt strutur is onfusion-fr [Nilsn t al. 1979] whnvr # µ is transitiv, an if # µ thn. For any onfusion-fr vnt strutur, fin th primitiv onflit quivaln whnvr = or # µ. It is routin to show that primitiv onflit quivaln is symmtri an transitiv, an hn forms an quivaln on E. W visualiz onfusion-fr vnt struturs by inluing th primitiv onflit quivaln in th visualization. For xampl th vnt strutur whih xtns th prvious partial orr with 1 # 3 an 2 # 3 has 1 3, so is visualiz as on th right. A labll vnt strutur (E,,#,λ) ovr a labl st Σ is a prim vnt strutur togthr with a funtion λ : E Σ. W visualiz labll vnt struturs as no-labll graphs. For xampl th labll vnt strutur whih xtns th prvious vnt strutur with lablling λ(0) =, λ(1) = (), λ(2) = () an λ(3) = () is visualiz as follows. For any prim vnt strutur, a st C E is onflit-fr whnvr thr is no, C suh that #. C is ownlos whnvr C implis C. A onfiguration is a st whih is onflit-fr an own-los. Sin onfigurations ar onflit-fr, thy an b visualiz as no-labll irt ayli graphs, for xampl th two largst onfigurations for th prvious labll vnt strutur ar an. Givn labll vnt struturs ES 1 an ES 2 (without loss of gnrality, w assum vnt sts ES 1 an ES 2 ar isjoint) fin th prout vnt strutur ES 1 ES 2 as having: vnt st E is E 1 E 2, ausal orr is 1 2, onflit # is # 1 # 2, an lablling λ is λ 1 λ 2. Th sum vnt strutur ES 1 + ES 2 is th sam xpt: onflit # is # 1 # 2 (E 1 E 2 ) (E 2 E 1 ). W writ 0 for th mpty vnt strutur with vnt st /0. For a labl σ Σ, th prfix σ ES 0 introus a nw σ-labl vnt orr bfor all th vnts of ES 0. It is fin as having: vnt st E is E 0 { }, ausal orr is 0 ({ } E), onflit # is # 0, an lablling λ is λ 0 {(,σ)}. Using an appropriat alphabt (isuss in mor tail in 4), w an giv th smantis of a simpl shar-mmory onurrnt languag. Th onstrution uss sum, prout, prfix an th mpty vnt strutur. Lt r rang ovr rgistrs. A stor maps rgistrs to valus. Lt ρ rang ovr stors an ρ 0 b th ial stor, 3

4 whih maps all rgistrs to 0. W writ ρ[r v] for stor upat: { ρ[r v](r v if r = r ) = ρ(r ) othrwis Lt M rang ovr xprssions, whih may inlu rgistrs, but not variabls. Lt V b a st of valus. Lt M b an intrprtation that maps xprssions an stors to valus. W giv th smantis of a singl-thra program, faturing ras, writs an onitionals as an vnt strutur: T r =x; T ρ = v V (Rx v) T T (ρ[r v]) T x =M; T ρ = (Wx M Mρ) T T ρ T onρ = 0 T if M T 1 ls T 0 ρ = { T T 0 ρ if M Mρ = 0 T T 1 ρ othrwis A program is an olltion of thras T 1 T n, intrprt as prout of vnt struturs with an ial vnt: PT 1 T n = (T T 1 ρ 0 T T n ρ 0 ) W us stanar abbrviations. For xampl, th program sugars to th following. if (x==0) {y=1;} r=x; if (r==0) {y=1; on} ls {on} If w tak V = {0, 1}, thn this has smantis ((() () 0) + (() 0)) visualiz as follows. Not that in this smantis, onflit is only introu by ras. Eah onfliting vnt rprsnts th ra of a istint valu; sin only on valu an b ra, th vnts ar in primitiv onflit. 4. Mmory Evnt Struturs A mmory alphabt (Σ,R,W,J,K) onsists of a st Σ (th ations), st R Σ (th ra ations) st W Σ (th writ ations), binary rlation J (W R) (justifiation), an binary rlation K J (synhroniz justifiation). Whn (a,b) J, w say that a justifis b. Synhronization os not play a rol in this stion; w rturn to it in 7. A mmory vnt strutur ovr suh a mmory alphabt is a onfusion-fr labll vnt strutur ovr Σ. Th prototypial mmory alphabt onsists of an ial ation, an ra an writ ations ovr som st of variabls X, an som st of valus V : Σ = R W R = {(Rx v) x X,v V } W = {(Wx v) x X,v V } {} In 3 w saw that suh an alphabt an b us to giv th smantis for a simpl shar-mmory onurrnt languag. Th justifiation rlation for this alphabt is that justifis a ra of 0, an that a writ of v justifis a ra of v to th sam variabl: J = {(,()) x X} {((Wx v),(rx v)) x X,v V } In a mmory vnt strutur, an vnt is a ra vnt whnvr λ() R, an a writ vnt whnvr λ() W. Th sts R an W n not b isjoint; thus, a mmory alphabt may inlu ra-moify-writ ations suh as xhang, ompar-an-st or inrmnt. Th smantis of ths oprators as vnt struturs is straightforwar, following th styl givn in 3. In a mmory vnt strutur, w an lift justifiation from labls to vnts, but this is not just a mattr of looking at th lablling, sin vnts shoul not b justifi by latr vnts, by vnts in onflit, or by vnts with an intrvning vnt in ra-writ onflit. For xampl, in th program if (y) { x=0; } ls { x=1; x=x; } with vnt strutur smantis Ry 1 Wx 1 Wx 1 th only justifi ra of x is 1, not 0, an th only justifi ra of y is 0, not 1. W visualiz justifiation as a ash g. In a mmory vnt strutur, w say writ vnt justifis ra vnt whnvr: (1) (λ(),λ()) J, (2) w o not hav <, (3) w o not hav #, an (4) thr is no < b < suh that λ(b) justifis λ(). Th following statmnt is quivalnt to itm (4): thr is no < b < suh that b justifis. Howvr, w annot us this as th fion without worrying about irularity. 4

5 Visually ths onitions ar that annot justify whn: or Dfion 4.1 (Justifi). A onfiguration C is justifi whnvr vry ra vnt in C is justifi by an vnt in C. For xampl, th program y=x; has two maximal onfigurations, but only on of thm is justifi: an or Unfortunatly, justifi onfigurations, although nssary, ar not a suffiint onition for moling vali xutions, as thy allow yls in th union of ausal orr an justifiation, whih aus thin air ras. For xampl, th program P 1 from th introution inlus th justifi onfigurations {10, 11, 13, 15, 17} an {10, 12, 14, 16, 18} : b 10 Ry 1 14 Wx 1 18 In th lattr, thr is a yl in ausal+justifiation orr. It is straightforwar to ban suh yls. Dfion 4.2 (Aylially justifi). On onfigurations, fin C justifis D whnvr for any ra vnt D thr xists a writ vnt C suh that justifis. Writ C D whnvr C D an C justifis D. Writ for th rflxiv, transitiv losur of. Dfin C is aylially justifi whnvr /0 C. Any aylially justifi onfiguration is also justifi. In aition, any justifi onfiguration with ayli ausal+ justifiation orr is aylially justifi. For xampl, for P 1, w hav that /0 {10}, sin 10 is not a ra. In aition, w hav {10} {10, 11} an {10} {10, 13} sin 10 justifis both 11 an 13. Taking a maximal onfiguration at ah stp, w hav: /0 {10} {10, 11, 13, 15, 17} Howvr, thr is no suh hain laing from /0 to {10, 12, 14, 16, 18}. Consir th following program. (y=x; x=1 r=y;) (P 4 ) Wx 1 47 Ry 1 44 In this as th writ to x is immiatly availabl, sin it is not ausally pnnt on any ra. Thus: /0 {40, 47} {40, 47, 41, 45} {40, 47, 41, 45, 43} /0 {40, 47} {40, 47, 42, 46} {40, 47, 42, 46, 44} Hr th ra of x is a oin-toss, whih trmins whthr it is possibl to ra (Ry 1): A onfiguration that ontains 41 annot also ontain 44. Th son of ths squns an b sn in Figur 1, ra from top to bottom. Th vnts inlu in ah sussiv onfiguration ar highlight using a arkr, blu bakgroun. Evnts that ar in onflit with an inlu vnt ar ovr in whit. Thus in a maximal onfiguration, suh as th last onfiguration in Figur 1, all vnts ar ithr highlight or ovr. Ayli justifiation ruls out yls, sin in any aylially justifi C, thr must b onfigurations /0 = C 0 C n = C, an for any ra vnt C thr must b a j suh that C j+1 an a C j whih justifis. Sin onfigurations ar -los, this mans that thr is no inf squn 1 1, 2 2,..., whr i justifis i+1, an in partiular thr ar no yls. Unfortunatly, ayli justifiation is too strong a rquirmnt, as it ruls out som vali xutions in th prsn of optimizations whih rorr mmory asss. For xampl, th program P 3 = (r=x; y=1; x=y;) has vnt strutur givn th introution. In this as th yli justifir mols a vali xution, aus by a ompilr or harwar optimization rorring (r=x; y=1;) as (y=1; r=x;). If w ar going to amit suh rorrings, w annot mol vali xutions by a proprty of onfigurations, an must look at th ntir vnt strutur (this obsrvation was ma, in a iffrnt mol, by Batty t al. [2015]). Dfion 4.3 (Wll-justifi). On onfigurations, fin C always vntually justifis (AE-justifis) D whnvr for any C C thr xists a C C suh that C justifis D. Writ C D whnvr C D an C AE-justifis D. Writ for th rflxiv, transitiv losur of. Dfin C is wll-justifi whnvr C is justifi an /0 C. A wll-justifi onfiguration must b both justifi an AE-justifi. Th notion of AE-justifiation sribs whn a ra vnt is justifi by som writ vnt no mattr whih xution path is hosn. AE-justifiation has th flavor of a two-playr gam: in a onfiguration C i, th opponnt hooss a C i C i, aftr whih th playr hooss a C i C i whih justifis C i+1. If th playr an justify C i+1 rgarlss of th opponnt mov, thn th playr wins th roun. Th playr wll-justifis C if thy an rpat this gam to mov from th ial onfiguration /0 to th final onfiguration C. Any aylially justifi onfiguration is AE-justifi. 5

6 Ry Wx Wx 1 47 Ry Wx 1 47 Ry Figur 1: Ayli- an AE-justifiation for P 4 Exampl 4.4. Consir th proof of ayli justifiation givn in Figur 1. Starting from C 0 = /0, th playr follows th proof of ayli justifiation to slt C 1 = {40, 47}, thn C 2 = {40, 47, 42, 46} an finally C 3 = {40, 47, 42, 46, 44}. In ah as, th vnts in C i ar justifi by an xtnsion C i 1 of C i 1, rgarlss of th opponnt s hoi of C i 1. For any opponnt mov /0 C 0, th playr must hoos C 0 C 0 so that C 0 justifis C 1. In this as, th playr an always hoos C 0 {40, 47}, sin 40 an 47 onflit with no vnt an o not rquir justifiation. Th first two movs of th playr an b ollaps, hoosing C 1 to b {40, 47, 42, 46}, sin 42 an b justifi rgarlss of th opponnt mov. Howvr, th last two movs annot b ollaps. Th playr annot ially slt 44; in this as th opponnt woul win by hoosing C 0 = {40, 41, 43, 45}. Exampl 4.5. W now onsir th proof that P 3 is wlljustifi to ra all ons, givn in Figur 2. Th prvious stratgy os not work, sin th goal onfiguration is not aylially justifi. Th playr hooss C 1 = {30}, C 2 = {30, 34, 38} an finally C 3 = {30, 34, 38, 32, 36}. As in th prvious xampl, th first two playr movs an b ollaps, but not th last two. W show th first two playr movs sparatly to mak th opponnt hois lar. Th opponnt an hoos C 1 to inlu any vnts xpt 32 (an thrfor 36); thr is no aylially justifi onfiguration that inlus 32. For this rason vnts 32 an 36 ar gray in th top onfiguration of Figur 2. Th opponnt option to inlu 33 C 1 prvnts th playr from slting 32 C 1. Th () annot b justifi in this as. Howvr, (Ry 1) an b justifi rgarlss of th opponnt s hoi. Thus 34 an b inlu in C 1 (or C 2, as shown). On th playr has won th roun inluing 34, th opponnt is no longr at librty to inlu 33 th hoi Figur 2: AE-orr for P 3 has bn ma. Thus th playr may inlu 32 in th nxt roun. Exampl 4.6. As not in th introution, onfiguration C 1 of P 1 fails to b wll-justifi. W provi a proof in 6. Intuitivly, th playr is unabl to slt 14 C 1, baus th opponnt an hoos 11 C 0. In th pross of rvising th Java Mmory Mol, Pugh [2004] vlop a st of twnty ausality tst ass. Using han alulation, w tst our smantis against nintn of ths ass. (TC9 is bas on th ia that an xution shoul b allow if thr xists an augmntation, suh as thra inlining, that allows it. This is a non-goal for our smantis; thrfor, w o not onsir TC9.) Our smantis agrs with sixtn of th tst ass an isagrs with thr: TC3, TC7 an TC11. In 8, w isuss TC7, whih bst luiats th issus. Also by han alulation, w foun that our smantis givs th sir rsults for all xampls in Batty t al. [2015, 4] an all but on in Švčík [2008, 5.3]: runantwrit-aftr-ra-limination this ountrxampl applis to any snsibl non-ohrnt smantis. 5. Data-ra-fr vnt struturs W say that ES is an augmntation of ES if it has sam vnts, onflit an labls, an possibly mor orr. Formally, (E,,#,λ) is an augmntation of (E,,#,λ) if. It is straightforwar to show that justifiation, ayli justifiation an wll-justifiation ar all rflt by augmntation. For xampl, if ES augmnts ES an C is a wll-justifi onfiguration of ES thn C is a wll-justifi onfiguration of ES. 6

7 A squntial mmory vnt strutur is on whr, for any vnts an, ithr, or #. A squntially onsistnt onfiguration of a mmory vnt strutur is a justifi onfiguration of a squntial augmntation of it. That is, a onfiguration C of ES is squntially onsistnt if thr xists an augmntation ES of ES suh that ES is squntial an C is a justifi onfiguration of ES. Not that in a squntial mmory vnt strutur, if justifis thn. It follows that any justifi onfiguration of a squntial mmory vnt strutur is wll-justifi, an hn that any squntially onsistnt onfiguration of a mmory vnt strutur is wll-justifi. Th onvrs is not tru. Thr ar wll-justifi onfigurations that ar not squntially onsistnt, u to ata ras. For xampl, th program (w=1; y=(w<=x); z=(x<=w); x=1;) has smantis with onfiguration: Ww1 Rw1 Wx 1 Rw0 Wz 0 This is aylially justifi, an hn wll-justifi, but not squntially onsistnt. In this stion, w shall show that suh ata ras ar th only sour of onfigurations whih ar wll-justifi but not squntially onsistnt. In a mmory vnt strutur, fin onurrnt vnts an to b a rawrit ra whnvr thr is som suh that justifis, as shown on th right. Dfin onurrnt vnts an to b a writ-writ ra whnvr thr is som b suh that justifis b an justifis, as shown on th right. Dfin a onfiguration to b ata-ra-fr whn it ontains no ra-writ or writ-writ ras. W stat th thorm gnrally for any mmory vnt strutur that is ra-nabl an ommutativ. Th prototypial xampl, givn in 4, satisfis both ths ritria. A mmory vnt strutur is ranabl whnvr, for any ra vnt thr xists som suh that justifis, as shown on th right. Any vnt strutur that is th smantis of a program is ra nabl. For xampl, if is (), thn it suffis to tak to b, sin justifis (), whih is in primitiv onflit with (). A mmory vnt strutur is ommutativ whnvr an justifis implis thr xists b whr justifis b, that is: implis If ra an writ ations ar isjoint, thn it follows immiatly that th rsulting vnt strutur will b ommutativ. b b Ra-moify-writ oprators suh as swap an fth-ana ar ommutativ. Compar-an-st (CAS) is ommutativ if w intrprt a fail CAS as both ra an writ (of th ol valu), but not if w onsir a fail CAS only as a ra. Unr this intrprtation, for xampl, CAS(x,0,1) gnrats th following vnt strutur for bit rgistr x. RM1 Th (RM1) vnt may justify som othr ra of x; howvr, th minimal onfliting vnt () is a plain ra. W lav wakning ommutativity as futur work. Thorm 5.1 (DRF). In any ommutativ ra-nabl mmory vnt strutur, if all squntially onsistnt onfigurations ar ata-ra-fr, thn all wll-justifi onfigurations ar squntially onsistnt. PROOF. Dfin a onfiguration C to b pr-justifi if vry ra ation C is justifi by a writ ation C whr. It is routin to show that any pr-justifi onfiguration is squntially onsistnt. Th or lmma of th proof follows [Lohbihlr 2013], whih is that if C is pr-justifi, an C justifis D, thn D is pr-justifi. Aftr this, th proof is routin: w first show that if C is prjustifi an C D thn D is pr-justifi; thn that if C is pr-justifi an C D thn D is pr-justifi. Th rsult follows, sin /0 is trivially pr-justifi. This proof has bn mhaniz in Aga. 6. Invariants Whil thr is no formal fion of thin-air ra [Batty t al. 2015], th xampls point to a failur of inutiv rasoning, typially u to a yl in th union of th ausal an ata pnny orrs. In orr to stablish that ths forms of thin-air ra ar impossibl, it is suffiint to show that is possibl to rason inutivly. In this stion, w show that wll-justifiation nabls inutiv rasoning. W onsir a limit form of invariant rasoning, whih is strong nough to aptur non-tmporal safty proprtis, suh as typ safty. Givn a suitabl notion of formula, φ, w show that if, in vry onfiguration of ES, th ra vnts satisfy φ, thn, in vry onfiguration of ES, all vnts satisfy φ. Signifiantly, th rsult an b appli without rasoning about wll-justifiation. To kp th stting as simpl as possibl, w onsir logis ovr labls rathr than vnts. In orr to stablish th rsult, w must rstrit attntion to logis that ar subst los. This allows th xprssion of rtain safty proprtis suh as x 1, but not livnss proprtis suh as x=1. For a labl st Σ, a program logi (Φ,) onsists of: a st Φ (th formula), an a binary rlation btwn P(Σ) an Φ (satisfation). A formula φ is subst los whnvr A B φ implis A φ. It is satisfiabl whnvr A φ for som A. It 7

8 rspts justifiation whnvr A justifis B an A φ implis B φ. For any onfiguration C, lt Σ(C ) b th labls of C : Σ(C ) = {λ() C } A formula φ is an invariant of a mmory vnt strutur whnvr Σ(C ) R φ implis Σ(C ) φ for any onfiguration C (ralling that R is th st of all ra ations). A formula φ is a tautology of a mmory vnt strutur whnvr Σ(C ) φ for any wll-justifi onfiguration C. Thorm 6.1. For any satisfiabl, subst-los φ whih rspts justifiation, if φ is an invariant of ES thn φ is a tautology of ES. PROOF. Mhaniz in Aga. In th rmainr of this stion, w onsir an xampl logi. Lt T b a st of typ nams, rang ovr by τ. Th st Φ of formula is gnrat by th following BNF. φ, ψ ::= x v x:τ tru fals φ ψ φ ψ Givn a smantis V τ V for ah typ τ, lt b th obvious satisfation rlation gnrat by th following ruls for th atoms. A x v whn for any a A, if a = (Rx w) or a = (Wx w), thn w v. A x:τ whn for any a A, if a = (Rx v) or a = (Wx v), thn v V τ. Not that th logi is satisfiabl an subst los an thus satisfis th ritria of Thorm 6.1. Suppos that w attmpt to show that φ 1 = (x 1 y 1) is a tautology for P 1 = (y=x; x=y;). Rall th vnt strutur for this program, givn in th introution Ry 1 14 Wx 1 18 Not that any onfiguration whih inlus writ vnts 16 or 18, must also inlu ra vnts 12 or 14. Thus, if th ra vnts satisfy φ 1 thn th writ vnts satisfy φ 1, an so φ 1 is invariant for P 1. Thus, by Thorm 6.1, φ 1 is a tautology for P 1. For P 3 =(r=x; y=1; x=y;), insta, φ 1 fails. Rall th vnt strutur for this program, also givn in th introution Th onfiguration {30, 31, 35} fails to satisfy φ 1 vn though its only ra vnt 31 satisfis φ 1. Ths xampls an b aapt to show rasoning using typs. Lt 0 b th uniqu valu of typ Unit. Thn P 1 satisfis th typing x:unit y:unit, but P 2 os not. 7. Fning In 4, w not that a mmory alphabt inlus synhroniz justifiation, suh as lok rlas an aquir; howvr, w hav not ma any us of synhronization up to now. In this stion, w vlop a notion of fning, in whih synhroniz justifiations ontribut to ausal orr. W mol lok-bas synhronization, in a vry simpl stting. W assum that thr is only on, statially alloat lok an that lok rlas always ours in th sam thra as th prvious aquir. Th lattr assumption nsurs that ah rlas ausally follows th orrsponing aquir. Th mmory alphabt from 4 is moifi to inlu aquir an rlas ations, whih ar onsir both ra an writ ations. (W ommnt on this sign in 9.) Σ = R W R = {(Rx v),aq,rl x X,v V } W = {(Wx v),aq,rl x X,v V } {} Th smantis of loking ations ar as follows. T aq;t ρ = Aq T T ρ T rl;t ρ = Rl T T ρ Th justifiation rlation, J, now inlus lok ations: J = {(,()),((Wx v),(rx v)) x X,v V } {(,Aq),(Aq,Rl),(Rl,Aq)} Th synhroniz justifiation rlation, K, is rstrit to lok ations. K = {(,Aq),(Aq,Rl),(Rl,Aq)} Rall from 4 that vnt justifis vnt whnvr (1) (λ(),λ()) J, (2) os not follow, (3) is not in onflit with, an (4) thr is no intrvning b btwn an that justifis an vnt in primitiv onflit with. W say vnt synhronously justifis vnt whnvr justifis an (λ(),λ()) K. A fn mmory vnt strutur is on whr, for any vnts an, if synhronously justifis thn. A wll-fn onfiguration of a mmory vnt strutur is a wll-justifi onfiguration of a fn augmntation of it. That is, a onfiguration C of ES is wll-fn if thr xists a augmntation ES of ES suh that ES is fn an C is a justifi onfiguration of ES. To show that a onfiguration is wll-fn, th playr must first hoos a fning. Thn th inutiv argumnt for wll-justifiation pros as bfor. For xampl, onsir th following program, P 5. (aq; x=1; x=0; rl;) (aq; r=x; rl;) (P 5 ) 8

9 Aq Wx 1 Rl Rl Aq Rl 59 Whras th son thra an ra 1 in a wll-justifi onfiguration, this is not possibl in a wll-fn onfiguration. Thr ar two possibl fnings. On inlus th augmntation 57 52, an th othr inlus an In ithr as, 54 an b justifi, but 55 annot. Thrfor, thr is no wll-fn onfiguration that inlus 55. Not that any squntial mmory vnt strutur is fn. It follows that any squntial augmntation of a mmory vnt strutur is a fn augmntation of it, an hn that any squntially onsistnt onfiguration is a wll-fn onfiguration. Now, if vry justifiation is synhroniz (that is J = K) w hav that vry wll-fn onfiguration is squntially onsistnt, but in gnral this is not tru. In partiular, if thr is no synhronization (that is K = /0) thn vry wlljustifi onfiguration is wll-fn. Fortunatly, th proof of th DRF Thorm for wllfn onfigurations follows irtly from th DRF thorm for wll-justifi onfigurations: w just us DRF on ah fning. Thorm 7.1 (DRF). In any ommutativ ra-nabl mmory vnt strutur, if all squntially onsistnt onfigurations ar ata-ra-fr, thn all wll-fn onfigurations ar squntially onsistnt. PROOF. Follows irtly from Thorm Limitations As not at th n of 4, our smantis agrs with sixtn tst ass from [Pugh 2004] an isagrs with thr: TC3, TC7 an TC11. W now isuss TC7, whih bst luiats th issus. f l b Rz 0 (r=z; y=x;) (z=y; x=1;) a g m h n Rz 1 i o j p Wz 0 Wx 1 (TC7) Ry 1 Wz 1 k Wx 1 q Th qustion is whthr all of th ras an b rsolv to 1. This fails unr our smantis: thr is no wll-justifi onfiguration that inlus vnts, an i, all of whih ra 1. In orr to wll-justify suh a onfiguration, on must first rsolv th onflit on x, thn y an finally z. But this stratgy fails immiatly aftr rsolving x. Starting from th mpty onfiguration, all aylially justifi onfigurations an b xtn to inlu ithr p or q, an thus th playr an slt a onfiguration that inlus ithr g or i. Suppos th playr slts i. Sin onfigurations ar ownlos, th playr must also slt ; howvr is not aylially justifi whn th opponnt slts p. Symmtrially, b is not aylially justifi whn th opponnt slts q. Thus th playr annot rsolv th onflit on y. Th failur of TC7 iniats a failur to valiat th rorring of inpnnt ras. To s this, onsir th program in whih th first thra is rwrittn. b f (y=x; r=z;) (z=y; x=1;) a h l Rz 0 Rz 1 m Rz 0 Rz 1 o n Ry 1 j Wz 0 Wz 1 k p Wx 1 Wx 1 q In this as, th playr an hoos, thn, thn o, as rquir. W now skth a proposal to arss this issu. On sts of vnts, fin C is ompatibl with D whnvr thr is no C an D suh that # µ. Dfin C is onsistnt whnvr C is ompatibl with C. Proposal. Moify Dfion 4.2 an Dfion 4.3 to rang ovr onsistnt sts, rathr than onfigurations. A onfiguration C is alt-wll-justifi whnvr C is justifi an thr xists a onsistnt st D suh that /0 D C. By this proposal, th fion of alt-ae-justifis is as follows: On onsistnt sts, C alt-ae-justifis D whnvr for any C C thr xists a C C suh that C justifis D. Th onfiguration of TC7 that always ras 1 is alt-wlljustifi. Starting from th mpty st, C 1 = {a,g,i} is alt- AE-justifi, sin vry onsistnt st that xtns /0 (via ) an b furthr xtn to inlu ithr p or q, both labl (Wx 1). Although g an i ar in onflit, thy ar not in primitiv onflit, an thrfor may both b inlu in a onsistnt st this is th ky iffrn btwn wllan alt-wll-justifiation. From C 1, C 2 = {a,g,i,} is alt- AE-justifi, sin w an always xtn to inlu ithr m or o, both labl (). From C 2, C 3 = {a,g,i,,} is alt-ae-justifi, sin w an always xtn to inlu k, labl (Wz 1). Thus /0 C 3 an thrfor, sin writs o not rquir justifiation, /0 {a,g,m,i,o,,k,q,} {a,i,o,,k,q,}, as rquir. By han alulation, alt-wll-justifiation agrs with all nintn tst ass; thrfor, th fion looks quit promising. Th qustion of whthr DRF hols for altwll-justifiation rmains opn. Th inutiv strutur of th proof of DRF rlis on th fat that onfigurations ar 9

10 own los. Sin onsistnt sts ar not nssarily own los, th proof stratgy fails. 9. Opn problms This papr has introu th first mol for rlax mmory bas vnt struturs. This frsh approah rats many opportunitis for futur work. Our mol os not nfor ohrn: that writs on a singl variabl appar to our in som global orr. For xampl, in a ohrnt smantis for (x=1;) (x=2;) (r 1 =x; r 2 =x; r 3 =x;) it is not possibl to hav r 1 = r 3 r 2, whras our smantis allows this. To nfor ohrn, it appars to b nssary to istinguish th ausal orr from th orr us to trmin visibility. W hav mol synhronization using a rstrit form of loks. A ohrnt smantis is rquir to mol Java s volatil variabls, an woul also allow a mor satisfatory tratmnt of loks. In th formalization of 7, rlas an aquir ar both ra/writ ations. This guarants that, for xampl, a singl rlas os not nabl two paralll aquirs. In th stanar tratmnt of loks, assuming ohrn, rlas is a writ, an aquir is a ra; thus, rlas justifis aquir, but aquir os not justify rlas. Th orr btwn aquir an rlas is usually guarant by thra orr, whih w hav assum. This assumption guarants that th orr w hav rquir from aquir to rlas is runant. With a ohrnt smantis for loks, th ausal orr from aquir to rlas an b ropp. Sparat from th onrns of 8, variations on th fion of wll-justifiation may b worth xploring. For xampl, w fin of in trms of : whn xploring xtnsions of th urrnt onfiguration, both playr an opponnt ar rstrit to using ayli justifiation. It is natural to ask about a furthr fion, whih uss in pla of. If w lt 0 = an 1 =, w an s this as hirarhy whr ah i uss i 1. It is not th as that i ontains i 1, sin th fion uss i 1 in both positiv an ngativ position: positiv for th playr, an ngativ for th opponnt. Th runant-ra-limination ountrxampl of [Švčík 2008, 5.3.2] an TC18 of [Pugh 2004] ar both intrsting in this rgar. If th opponnt is allow to pik out of thin air, thn th playr is unabl to wll-justify th sir onfiguration. Wll-justifiation boms possibl, howvr, if th opponnt is rstrit to aylially hosn onfigurations. W hav invstigat a vry simpl program logi, whih stablishs a rstrit form of safty. It woul b intrsting to invstigat mor powrful logis, suh as that of Turon t al. [2014]. On of th primary purposs of a mmory mol is to support program transformation. To this n, it woul b usful to hav a rfinmnt rlation ovr mmory vnt struturs that prsrvs wll-justifiation. Our approah to typ safty is novl, in that w hav not rquir a stati assoiation btwn variabls an typs as in prior work [Lohbihlr 2013; Goto t al. 2012]. It woul b intrsting to xtn our approah to mol ynami alloation an alloation. Aknowlgmnt. W thank th anonymous rfrs for thir suggstions, an th mmbrs of th JMM working group for usful isussions. Rfrns M. Batty, S. Owns, S. Sarkar, P. Swll, an T. Wbr. Mathmatizing C++ onurrny. In Pro. Prinipals of Programming Languags, pags 55 66, M. Batty, K. Mmarian, K. Ninhuis, J. Pihon-Pharabo, an P. Swll. Th problm of programming languag onurrny smantis. In Pro. Europan Symp. on Programming, pags , S. Castllan. Wak mmory mols using vnt struturs. In Journés Franophons s Langags Appliatifs, P. Cniarlli, A. Knapp, an E. Sibilio. Th Java mmory mol: Oprationally, notationally, axiomatially. In Pro. Europan Symp. on Programming, pags , M. Goto, R. Jagasan, C. Pithr, an J. Rily. Typs for rlax mmory mols. In Pro. Typs in Languag Dsign an Implmntation, pags 25 37, R. Jagasan, C. Pithr, an J. Rily. Gnrativ oprational smantis for rlax mmory mols. In Pro. Europan Symp. on Programming, L. Lamport. How to mak a multiprossor omputr that orrtly xuts multipross programs. IEEE Trans. Comput., 28(9): , A. Lohbihlr. Making th java mmory mol saf. ACM Trans. Program. Lang. Syst., 35(4):12, J. Manson, W. Pugh, an S. V. Av. Th Java mmory mol. In Pro. Prinipals of Programming Languags, pags , M. Nilsn, G. D. Plotkin, an G. Winskl. Ptri nts, vnt struturs an omains. In Pro. Int. Symp. Smantis of Conurrnt Computation, pags , J. Pihon-Pharabo an P. Swll. A onurrny smantis for rlax atomis that prmits optimisation an avois thin-air xutions. In Pro. Prinipals of Programming Languags, To appar. W. Pugh. Causality tst ass, V. A. Saraswat, R. Jagasan, M. Mihal, an C. von Praun. A thory of mmory mols. In Pro. Prinipls an Prati of Paralll Programming, pags , A. Turon, V. Vafiais, an D. Dryr. GPS: Navigating wak mmory with ghosts, protools, an sparation. In Pro. Objt-Orint Programming, Systms, Languags, an Appliations, pags , J. Švčík. Program Transformations in Wak Mmory Mols. PhD thsis, Laboratory for Founations of Computr Sin, Univrsity of Einburgh, G. Winskl. Evnt struturs. In Avans in Ptri Nts, pags , G. Winskl. An introution to vnt struturs. In Linar Tim, Branhing Tim an Partial Orr in Logis an Mols for Conurrny, pags ,