[urcu.git] / formal-model / ooomem-two-writes / mem.spin

/*
 * mem.spin: Promela code to validate memory barriers with out-of-order memory
 * and out-of-order instruction scheduling.
 *
 * Algorithm verified :
 *
 * alpha = 0;
 * beta = 0;
 *
 * Process A                  Process B
 * alpha = 1;                 beta = 1;
 * mb();                      mb();
 * x = beta;                  y = alpha;
 *
 * if x = 1, then y = 1 when read.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (c) 2009 Mathieu Desnoyers
 */

/* Promela validation variables. */

/*
 * Produced process control and data flow. Updated after each instruction to
 * show which variables are ready. Using one-hot bit encoding per variable to
 * save state space. Used as triggers to execute the instructions having those
 * variables as input. Leaving bits active to inhibit instruction execution.
 * Scheme used to make instruction disabling and automatic dependency fall-back
 * automatic.
 */

#define CONSUME_TOKENS(state, bits, notbits)			\
	((!(state & (notbits))) && (state & (bits)) == (bits))

#define PRODUCE_TOKENS(state, bits)				\
	state = state | (bits);

#define CLEAR_TOKENS(state, bits)				\
	state = state & ~(bits)

#define NR_PROCS 2

#define get_pid()	(_pid)

/*
 * Each process have its own data in cache. Caches are randomly updated.
 * smp_wmb and smp_rmb forces cache updates (write and read), wmb_mb forces
 * both.
 */

#define DECLARE_CACHED_VAR(type, x, v)		\
	type mem_##x = v;			\
	type cached_##x[NR_PROCS] = v;		\
	bit cache_dirty_##x[NR_PROCS] = 0;

#define IS_CACHE_DIRTY(x, id)	(cache_dirty_##x[id])

#define READ_CACHED_VAR(x)			\
	(cached_##x[get_pid()])

#define WRITE_CACHED_VAR(x, v)			\
	atomic {				\
		cached_##x[get_pid()] = v;	\
		cache_dirty_##x[get_pid()] = 1;	\
	}

#define CACHE_WRITE_TO_MEM(x, id)		\
	if					\
	:: IS_CACHE_DIRTY(x, id) ->		\
		mem_##x = cached_##x[id];	\
		cache_dirty_##x[id] = 0;	\
	:: else ->				\
		skip				\
	fi;

#define CACHE_READ_FROM_MEM(x, id)		\
	if					\
	:: !IS_CACHE_DIRTY(x, id) ->		\
		cached_##x[id] = mem_##x;	\
	:: else ->				\
		skip				\
	fi;

/*
 * May update other caches if cache is dirty, or not.
 */
#define RANDOM_CACHE_WRITE_TO_MEM(x, id)	\
	if					\
	:: 1 -> CACHE_WRITE_TO_MEM(x, id);	\
	:: 1 -> skip				\
	fi;

#define RANDOM_CACHE_READ_FROM_MEM(x, id)\
	if					\
	:: 1 -> CACHE_READ_FROM_MEM(x, id);	\
	:: 1 -> skip				\
	fi;

inline ooo_mem()
{
	atomic {
		RANDOM_CACHE_WRITE_TO_MEM(alpha, get_pid());
		RANDOM_CACHE_WRITE_TO_MEM(beta, get_pid());
		RANDOM_CACHE_READ_FROM_MEM(alpha, get_pid());
		RANDOM_CACHE_READ_FROM_MEM(beta, get_pid());
	}
}

/* must consume all prior read tokens */
inline smp_rmb()
{
	atomic {
		/* todo : consume all read tokens .. ? */
		CACHE_READ_FROM_MEM(alpha, get_pid());
		CACHE_READ_FROM_MEM(beta, get_pid());
	}
}

/* must consume all prior write tokens */
inline smp_wmb()
{
	atomic {
		CACHE_WRITE_TO_MEM(alpha, get_pid());
		CACHE_WRITE_TO_MEM(beta, get_pid());
	}
}

/* sync_core() must consume all prior read and write tokens, including rmb/wmb
 * tokens */

/* must consume all prior read and write tokens */
inline smp_mb()
{
	atomic {
		smp_wmb();
		/* sync_core() */
		smp_rmb();
	}
}

/* Keep in sync manually with smp_rmb, wmp_wmb and ooo_mem */
DECLARE_CACHED_VAR(byte, alpha, 0);
DECLARE_CACHED_VAR(byte, beta, 0);

/* value 2 is uninitialized */
byte read_one = 2;
byte read_two = 2;

/*
 * Bit encoding, proc_one_produced :
 */

#define P1_PROD_NONE	(1 << 0)

#define P1_WRITE	(1 << 1)
#define P1_WMB		(1 << 2)
#define P1_SYNC_CORE	(1 << 3)
#define P1_RMB		(1 << 4)
#define P1_READ		(1 << 5)

int proc_one_produced;

active proctype test_proc_one()
{
	assert(get_pid() < NR_PROCS);

	PRODUCE_TOKENS(proc_one_produced, P1_PROD_NONE);

#ifdef NO_WMB
	PRODUCE_TOKENS(proc_one_produced, P1_WMB);
#endif
#ifdef NO_RMB
	PRODUCE_TOKENS(proc_one_produced, P1_RMB);
#endif
#ifdef NO_SYNC
	PRODUCE_TOKENS(proc_one_produced, P1_SYNC_CORE);
#endif

	do
	:: CONSUME_TOKENS(proc_one_produced, P1_PROD_NONE, P1_WRITE) ->
		ooo_mem();
		WRITE_CACHED_VAR(alpha, 1);
		ooo_mem();
		PRODUCE_TOKENS(proc_one_produced, P1_WRITE);
	:: CONSUME_TOKENS(proc_one_produced, P1_WRITE, P1_WMB) ->
		smp_wmb();
		PRODUCE_TOKENS(proc_one_produced, P1_WMB);
	:: CONSUME_TOKENS(proc_one_produced, P1_WRITE | P1_WMB, P1_SYNC_CORE) ->
		/* sync_core(); */
		PRODUCE_TOKENS(proc_one_produced, P1_SYNC_CORE);
	:: CONSUME_TOKENS(proc_one_produced, P1_SYNC_CORE, P1_RMB) ->
		smp_rmb();
		PRODUCE_TOKENS(proc_one_produced, P1_RMB);
	:: CONSUME_TOKENS(proc_one_produced, P1_RMB | P1_SYNC_CORE, P1_READ) ->
		ooo_mem();
		read_one = READ_CACHED_VAR(beta);
		ooo_mem();
		PRODUCE_TOKENS(proc_one_produced, P1_READ);
	:: CONSUME_TOKENS(proc_one_produced, P1_PROD_NONE | P1_WRITE
		| P1_WMB | P1_SYNC_CORE | P1_RMB | P1_READ, 0) ->
		break;
	od;

	//CLEAR_TOKENS(proc_one_produced,
	//	P1_PROD_NONE | P1_WRITE | P1_WMB | P1_SYNC_CORE | P1_RMB |
	//	P2_READ);

	// test : [] (read_one == 0 -> read_two != 0)
	// test : [] (read_two == 0 -> read_one != 0)
	assert(!(read_one == 0 && read_two == 0));
}


/*
 * Bit encoding, proc_two_produced :
 */

#define P2_PROD_NONE	(1 << 0)

#define P2_WRITE	(1 << 1)
#define P2_WMB		(1 << 2)
#define P2_SYNC_CORE	(1 << 3)
#define P2_RMB		(1 << 4)
#define P2_READ		(1 << 5)

int proc_two_produced;

active proctype test_proc_two()
{
	assert(get_pid() < NR_PROCS);

	PRODUCE_TOKENS(proc_two_produced, P2_PROD_NONE);

#ifdef NO_WMB
	PRODUCE_TOKENS(proc_two_produced, P2_WMB);
#endif
#ifdef NO_RMB
	PRODUCE_TOKENS(proc_two_produced, P2_RMB);
#endif
#ifdef NO_SYNC
	PRODUCE_TOKENS(proc_two_produced, P2_SYNC_CORE);
#endif

	do
	:: CONSUME_TOKENS(proc_two_produced, P2_PROD_NONE, P2_WRITE) ->
		ooo_mem();
		WRITE_CACHED_VAR(beta, 1);
		ooo_mem();
		PRODUCE_TOKENS(proc_two_produced, P2_WRITE);
	:: CONSUME_TOKENS(proc_two_produced, P2_WRITE, P2_WMB) ->
		smp_wmb();
		PRODUCE_TOKENS(proc_two_produced, P2_WMB);
	:: CONSUME_TOKENS(proc_two_produced, P2_WRITE | P2_WMB, P2_SYNC_CORE) ->
		/* sync_core(); */
		PRODUCE_TOKENS(proc_two_produced, P2_SYNC_CORE);
	:: CONSUME_TOKENS(proc_two_produced, P2_SYNC_CORE, P2_RMB) ->
		smp_rmb();
		PRODUCE_TOKENS(proc_two_produced, P2_RMB);
	:: CONSUME_TOKENS(proc_two_produced, P2_SYNC_CORE | P2_RMB, P2_READ) ->
		ooo_mem();
		read_two = READ_CACHED_VAR(alpha);
		ooo_mem();
		PRODUCE_TOKENS(proc_two_produced, P2_READ);
	:: CONSUME_TOKENS(proc_two_produced, P2_PROD_NONE | P2_WRITE
		| P2_WMB | P2_SYNC_CORE | P2_RMB | P2_READ, 0) ->
		break;
	od;

	//CLEAR_TOKENS(proc_two_produced,
	//	P2_PROD_NONE | P2_WRITE | P2_WMB | P2_SYNC_CORE | P2_RMB |
	//	P2_READ);

	// test : [] (read_one == 0 -> read_two != 0)
	// test : [] (read_two == 0 -> read_one != 0)
	assert(!(read_one == 0 && read_two == 0));
}
Commit	Line	Data
03c9e0f3	1	/*
27afafe2 MD	2	* mem.spin: Promela code to validate memory barriers with out-of-order memory
	3	* and out-of-order instruction scheduling.
	4	*
	5	* Algorithm verified :
	6	*
	7	* alpha = 0;
	8	* beta = 0;
	9	*
	10	* Process A Process B
	11	* alpha = 1; beta = 1;
b245dd5c	12	* mb(); mb();
27afafe2 MD	13	* x = beta; y = alpha;
	14	*
	15	* if x = 1, then y = 1 when read.
03c9e0f3 MD	16	*
	17	* This program is free software; you can redistribute it and/or modify
	18	* it under the terms of the GNU General Public License as published by
	19	* the Free Software Foundation; either version 2 of the License, or
	20	* (at your option) any later version.
	21	*
	22	* This program is distributed in the hope that it will be useful,
	23	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	24	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	25	* GNU General Public License for more details.
	26	*
	27	* You should have received a copy of the GNU General Public License
	28	* along with this program; if not, write to the Free Software
	29	* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	30	*
	31	* Copyright (c) 2009 Mathieu Desnoyers
	32	*/
	33
	34	/* Promela validation variables. */
	35
	36	/*
dfa8abef MD	37	* Produced process control and data flow. Updated after each instruction to
	38	* show which variables are ready. Using one-hot bit encoding per variable to
	39	* save state space. Used as triggers to execute the instructions having those
	40	* variables as input. Leaving bits active to inhibit instruction execution.
	41	* Scheme used to make instruction disabling and automatic dependency fall-back
	42	* automatic.
03c9e0f3 MD	43	*/
03c9e0f3 MD	44
dfa8abef MD	45	#define CONSUME_TOKENS(state, bits, notbits) \
dfa8abef MD	46	((!(state & (notbits))) && (state & (bits)) == (bits))
03c9e0f3	47
dfa8abef MD	48	#define PRODUCE_TOKENS(state, bits) \
dfa8abef MD	49	state = state \| (bits);
03c9e0f3	50
dfa8abef MD	51	#define CLEAR_TOKENS(state, bits) \
dfa8abef MD	52	state = state & ~(bits)
03c9e0f3	53
03c9e0f3 MD	54	#define NR_PROCS 2
	55
	56	#define get_pid() (_pid)
	57
	58	/*
	59	* Each process have its own data in cache. Caches are randomly updated.
	60	* smp_wmb and smp_rmb forces cache updates (write and read), wmb_mb forces
	61	* both.
	62	*/
	63
	64	#define DECLARE_CACHED_VAR(type, x, v) \
	65	type mem_##x = v; \
	66	type cached_##x[NR_PROCS] = v; \
	67	bit cache_dirty_##x[NR_PROCS] = 0;
	68
	69	#define IS_CACHE_DIRTY(x, id) (cache_dirty_##x[id])
	70
	71	#define READ_CACHED_VAR(x) \
	72	(cached_##x[get_pid()])
	73
	74	#define WRITE_CACHED_VAR(x, v) \
	75	atomic { \
	76	cached_##x[get_pid()] = v; \
	77	cache_dirty_##x[get_pid()] = 1; \
	78	}
	79
	80	#define CACHE_WRITE_TO_MEM(x, id) \
	81	if \
	82	:: IS_CACHE_DIRTY(x, id) -> \
	83	mem_##x = cached_##x[id]; \
	84	cache_dirty_##x[id] = 0; \
	85	:: else -> \
	86	skip \
	87	fi;
	88
	89	#define CACHE_READ_FROM_MEM(x, id) \
	90	if \
	91	:: !IS_CACHE_DIRTY(x, id) -> \
	92	cached_##x[id] = mem_##x; \
	93	:: else -> \
	94	skip \
	95	fi;
	96
	97	/*
	98	* May update other caches if cache is dirty, or not.
	99	*/
	100	#define RANDOM_CACHE_WRITE_TO_MEM(x, id) \
	101	if \
	102	:: 1 -> CACHE_WRITE_TO_MEM(x, id); \
	103	:: 1 -> skip \
	104	fi;
	105
	106	#define RANDOM_CACHE_READ_FROM_MEM(x, id)\
	107	if \
	108	:: 1 -> CACHE_READ_FROM_MEM(x, id); \
	109	:: 1 -> skip \
	110	fi;
	111
	112	inline ooo_mem()
	113	{
	114	atomic {
	115	RANDOM_CACHE_WRITE_TO_MEM(alpha, get_pid());
	116	RANDOM_CACHE_WRITE_TO_MEM(beta, get_pid());
	117	RANDOM_CACHE_READ_FROM_MEM(alpha, get_pid());
118	RANDOM_CACHE_READ_FROM_MEM(beta, get_pid());
119	}
120	}
121
122	/* must consume all prior read tokens */
123	inline smp_rmb()
124	{
125	atomic {
126	/* todo : consume all read tokens .. ? */
127	CACHE_READ_FROM_MEM(alpha, get_pid());
128	CACHE_READ_FROM_MEM(beta, get_pid());
129	}
130	}
131
132	/* must consume all prior write tokens */
133	inline smp_wmb()
134	{
135	atomic {
136	CACHE_WRITE_TO_MEM(alpha, get_pid());
137	CACHE_WRITE_TO_MEM(beta, get_pid());
138	}
139	}
140
141	/* sync_core() must consume all prior read and write tokens, including rmb/wmb
142	* tokens */
143
144	/* must consume all prior read and write tokens */
145	inline smp_mb()
146	{
147	atomic {
148	smp_wmb();
149	/* sync_core() */
150	smp_rmb();
151	}
152	}
153
154	/* Keep in sync manually with smp_rmb, wmp_wmb and ooo_mem */
155	DECLARE_CACHED_VAR(byte, alpha, 0);
156	DECLARE_CACHED_VAR(byte, beta, 0);
157
158	/* value 2 is uninitialized */
159	byte read_one = 2;
160	byte read_two = 2;
161
3db2d75b MD	162	/*
	163	* Bit encoding, proc_one_produced :
	164	*/
	165
	166	#define P1_PROD_NONE (1 << 0)
	167
	168	#define P1_WRITE (1 << 1)
	169	#define P1_WMB (1 << 2)
	170	#define P1_SYNC_CORE (1 << 3)
	171	#define P1_RMB (1 << 4)
	172	#define P1_READ (1 << 5)
	173
	174	int proc_one_produced;
	175
03c9e0f3 MD	176	active proctype test_proc_one()
	177	{
	178	assert(get_pid() < NR_PROCS);
	179
	180	PRODUCE_TOKENS(proc_one_produced, P1_PROD_NONE);
	181
	182	#ifdef NO_WMB
	183	PRODUCE_TOKENS(proc_one_produced, P1_WMB);
	184	#endif
	185	#ifdef NO_RMB
	186	PRODUCE_TOKENS(proc_one_produced, P1_RMB);
	187	#endif
4b8839f1 MD	188	#ifdef NO_SYNC
	189	PRODUCE_TOKENS(proc_one_produced, P1_SYNC_CORE);
	190	#endif
03c9e0f3 MD	191
	192	do
	193	:: CONSUME_TOKENS(proc_one_produced, P1_PROD_NONE, P1_WRITE) ->
	194	ooo_mem();
	195	WRITE_CACHED_VAR(alpha, 1);
	196	ooo_mem();
	197	PRODUCE_TOKENS(proc_one_produced, P1_WRITE);
	198	:: CONSUME_TOKENS(proc_one_produced, P1_WRITE, P1_WMB) ->
	199	smp_wmb();
	200	PRODUCE_TOKENS(proc_one_produced, P1_WMB);
	201	:: CONSUME_TOKENS(proc_one_produced, P1_WRITE \| P1_WMB, P1_SYNC_CORE) ->
	202	/* sync_core(); */
	203	PRODUCE_TOKENS(proc_one_produced, P1_SYNC_CORE);
	204	:: CONSUME_TOKENS(proc_one_produced, P1_SYNC_CORE, P1_RMB) ->
	205	smp_rmb();
	206	PRODUCE_TOKENS(proc_one_produced, P1_RMB);
	207	:: CONSUME_TOKENS(proc_one_produced, P1_RMB \| P1_SYNC_CORE, P1_READ) ->
	208	ooo_mem();
	209	read_one = READ_CACHED_VAR(beta);
	210	ooo_mem();
	211	PRODUCE_TOKENS(proc_one_produced, P1_READ);
	212	:: CONSUME_TOKENS(proc_one_produced, P1_PROD_NONE \| P1_WRITE
	213	\| P1_WMB \| P1_SYNC_CORE \| P1_RMB \| P1_READ, 0) ->
	214	break;
	215	od;
	216
	217	//CLEAR_TOKENS(proc_one_produced,
	218	// P1_PROD_NONE \| P1_WRITE \| P1_WMB \| P1_SYNC_CORE \| P1_RMB \|
	219	// P2_READ);
	220
	221	// test : [] (read_one == 0 -> read_two != 0)
	222	// test : [] (read_two == 0 -> read_one != 0)
	223	assert(!(read_one == 0 && read_two == 0));
	224	}
	225
3db2d75b MD	226
	227	/*
	228	* Bit encoding, proc_two_produced :
	229	*/
	230
	231	#define P2_PROD_NONE (1 << 0)
	232
	233	#define P2_WRITE (1 << 1)
	234	#define P2_WMB (1 << 2)
	235	#define P2_SYNC_CORE (1 << 3)
	236	#define P2_RMB (1 << 4)
	237	#define P2_READ (1 << 5)
	238
	239	int proc_two_produced;
	240
03c9e0f3 MD	241	active proctype test_proc_two()
	242	{
	243	assert(get_pid() < NR_PROCS);
	244
	245	PRODUCE_TOKENS(proc_two_produced, P2_PROD_NONE);
	246
	247	#ifdef NO_WMB
	248	PRODUCE_TOKENS(proc_two_produced, P2_WMB);
	249	#endif
	250	#ifdef NO_RMB
	251	PRODUCE_TOKENS(proc_two_produced, P2_RMB);
	252	#endif
4b8839f1 MD	253	#ifdef NO_SYNC
	254	PRODUCE_TOKENS(proc_two_produced, P2_SYNC_CORE);
	255	#endif
03c9e0f3 MD	256
	257	do
	258	:: CONSUME_TOKENS(proc_two_produced, P2_PROD_NONE, P2_WRITE) ->
	259	ooo_mem();
	260	WRITE_CACHED_VAR(beta, 1);
	261	ooo_mem();
	262	PRODUCE_TOKENS(proc_two_produced, P2_WRITE);
	263	:: CONSUME_TOKENS(proc_two_produced, P2_WRITE, P2_WMB) ->
	264	smp_wmb();
	265	PRODUCE_TOKENS(proc_two_produced, P2_WMB);
	266	:: CONSUME_TOKENS(proc_two_produced, P2_WRITE \| P2_WMB, P2_SYNC_CORE) ->
	267	/* sync_core(); */
	268	PRODUCE_TOKENS(proc_two_produced, P2_SYNC_CORE);
	269	:: CONSUME_TOKENS(proc_two_produced, P2_SYNC_CORE, P2_RMB) ->
	270	smp_rmb();
	271	PRODUCE_TOKENS(proc_two_produced, P2_RMB);
	272	:: CONSUME_TOKENS(proc_two_produced, P2_SYNC_CORE \| P2_RMB, P2_READ) ->
	273	ooo_mem();
	274	read_two = READ_CACHED_VAR(alpha);
	275	ooo_mem();
	276	PRODUCE_TOKENS(proc_two_produced, P2_READ);
	277	:: CONSUME_TOKENS(proc_two_produced, P2_PROD_NONE \| P2_WRITE
	278	\| P2_WMB \| P2_SYNC_CORE \| P2_RMB \| P2_READ, 0) ->
	279	break;
	280	od;
	281
	282	//CLEAR_TOKENS(proc_two_produced,
	283	// P2_PROD_NONE \| P2_WRITE \| P2_WMB \| P2_SYNC_CORE \| P2_RMB \|
	284	// P2_READ);
	285
	286	// test : [] (read_one == 0 -> read_two != 0)
	287	// test : [] (read_two == 0 -> read_one != 0)
	288	assert(!(read_one == 0 && read_two == 0));
	289	}