Arm Staff Research Articles

Simplifying ARM concurrency: multicopy-atomic axiomatic and operational models for ARMv8

ARM has a relaxed memory model, previously specified in informal prose for ARMv7 and ARMv8. Over time, and partly due to work building formal semantics for ARM concurrency, it has become clear that some of the complexity of the model is not justified by the potential benefits. In particular, the model was originally non-multicopy-atomic : writes could become visible to some other threads before becoming visible to all — but this has not been exploited in production implementations, the corresponding potential hardware optimisations are thought to have insufficient benefits in the ARM context, and it gives rise to subtle complications when combined with other ARMv8 features. The ARMv8 architecture has therefore been revised: it now has a multicopy-atomic model. It has also been simplified in other respects, including more straightforward notions of dependency, and the architecture now includes a formal concurrency model. In this paper we detail these changes and discuss their motivation. We define two formal concurrency models: an operational one, simplifying the Flowing model of Flur et al., and the axiomatic model of the revised ARMv8 specification. The models were developed by an academic group and by ARM staff, respectively, and this extended collaboration partly motivated the above changes. We prove the equivalence of the two models. The operational model is integrated into an executable exploration tool with new web interface, demonstrated by exhaustively checking the possible behaviours of a loop-unrolled version of a Linux kernel lock implementation, a previously known bug due to unprevented speculation, and a fixed version.

Modelling the ARMv8 architecture, operationally: concurrency and ISA

In this paper we develop semantics for key aspects of the ARMv8 multiprocessor architecture: the concurrency model and much of the 64-bit application-level instruction set (ISA). Our goal is to clarify what the range of architecturally allowable behaviour is, and thereby to support future work on formal verification, analysis, and testing of concurrent ARM software and hardware. Establishing such models with high confidence is intrinsically difficult: it involves capturing the vendor's architectural intent, aspects of which (especially for concurrency) have not previously been precisely defined. We therefore first develop a concurrency model with a microarchitectural flavour, abstracting from many hardware implementation concerns but still close to hardware-designer intuition. This means it can be discussed in detail with ARM architects. We then develop a more abstract model, better suited for use as an architectural specification, which we prove sound w.r.t.~the first. The instruction semantics involves further difficulties, handling the mass of detail and the subtle intensional information required to interface to the concurrency model. We have a novel ISA description language, with a lightweight dependent type system, letting us do both with a rather direct representation of the ARM reference manual instruction descriptions. We build a tool from the combined semantics that lets one explore, either interactively or exhaustively, the full range of architecturally allowed behaviour, for litmus tests and (small) ELF executables. We prove correctness of some optimisations needed for tool performance. We validate the models by discussion with ARM staff, and by comparison against ARM hardware behaviour, for ISA single- instruction tests and concurrent litmus tests.

Continuing performance feedback and use of the ultraviolet visible marker to assess cleaning compliance in the healthcare environment

Environmental surfaces have long been suspected to be a reservoir that could contribute to the presence of micro-organisms in healthcare facilities. The objective of this study was to evaluate the effect of providing weekly feedback to the housekeeping staff in improving and sustaining cleaning compliance when using ultraviolet visible marker (UVM) as an audit tool. The housekeeping staff selected 90% as the cleaning compliance target. The UVM was applied to the toilet seat, sink, soap dispenser and door knob surfaces within the patient's washrooms on consecutive weekdays. The study included three arms: staff in arm 1 received cleaning compliance feedback throughout the 24-week study period, arm 2 and arm 3 staff received feedback for weeks 13-24 and weeks 1-12, respectively. Feedback was also provided to housekeeping staff by posting graphs on the wards and in the housekeeping office. A pre-study audit showed 66.9%, 66.5% and 66.4% cleaning compliance for arms 1, 2 and 3 respectively. While receiving weekly feedback, all three arms demonstrated significantly improved cleaning compliance (86.7%, 80.4% and 73.7% for arms 1, 2 and 3, respectively). The use of casual staff may have contributed to difficulty in achieving better cleaning compliance as arms 1, 2 and 3 had 16.1%, 26% and 40.3% of shifts filled by casual staff, respectively. The use of UVM as an audit tool combined with weekly feedback of results to housekeeping staff resulted in significant, sustained improvement in the overall level of cleaning compliance of housekeeping staff.