Relaxed Memory Model Zoo

ARMv8 / AArch64 Memory Model
← Back to the map

ARMv8 / AArch64 Memory Model

2018 · Pulte, Flur, Deacon, French, Sarkar, Sewell · hardware, formal · axiomatic formalism

A strengthened, formally specified model for ARMv8. Multi-copy atomic (stores become visible to all threads simultaneously). Introduces the LDAR/STLR acquire-release instructions. Strictly stronger than ARMv7.

Properties

Property vector author-extrapolated — set only where the model’s definition pins the cell down (unknown cells are omitted); cells citing a specific source are marked.

Reordering sound
  • yes Store→Load
  • yes Store→Store
  • yes Load→Load
  • yes Load→Store
Reasoning guarantees
  • yes Coherence
  • yes No undefined behaviour
  • no In-order execution
  • yes No out-of-thin-air
Atomicity guarantees

Ordering relationships

Strictly weaker than
  • Total Store Order (TSO) — ARMv8 allows more reorderings than TSO though it is multi-copy-atomic. The TSO ⊆ ARMv8 containment is a model-level monotonicity argument over different instruction sets, not a cited theorem, so the edge is recorded as litmus-grade: the strict order is argued (monotonicity) and corroborated by the sweep, not independently proven — a genuine strict order, drawn lighter than a literature-backed one, not an edge that might be incomparable.
Strictly stronger than
Equivalent to
  • Persistent ARMv8 (PARMv8) — Raad, Wickerson & Vafeiadis (OOPSLA 2019): PARMv8's crash-free behaviour coincides with ARMv8. fragment_restricted because the equivalence holds only on the crash-free fragment; the persist-order axiom is orthogonal.
  • ARMv8 + DJR Transactions (ARMv8+DJR) — Dongol, Jagadeesan & Riely (POPL 2018) instantiate their transactional framework at ARMv8; the added transactional axioms only constrain transactional events, so on programs with no transactions the ARMv8 instance coincides with ARMv8 by construction. fragment_restricted: the coincidence holds only on the non-transactional fragment.
  • Armv8-A Relaxed Virtual Memory (ArmVM) — Simner et al., ESOP 2022, Sec. 6 (metatheorems 1–2): for programs with stable, injectively-mapped address spaces the relaxed virtual-memory model collapses exactly to the base Armv8-A user-mode concurrency model. The model is built as an extension of that base model; outside this fragment (translation-table manipulation, TLBI) it admits additional executions not expressible in base ARMv8, so the equivalence is fragment-restricted to static/injective mappings.
  • Armv8-A System Semantics: Instruction Fetch (ArmIF) — Simner et al., ESOP 2020: the instruction-fetch system-semantics model is built by extending the base Armv8-A user-mode concurrency (Flat) model with instruction-fetch and IC/DC cache-maintenance events (Sec. 4-5, 'extending previous work on user-mode concurrency'). Validation (Sec. 6) reports the model's results are identical to the base model over all 8950 non-instruction-fetch Flat regression tests, so on the fragment with no instruction fetch or cache maintenance it coincides with base ARMv8; outside that fragment (self-modifying code, IC/DC) it admits additional relaxed executions, hence the equivalence is fragment-restricted.
  • Promising-ARM/RISC-V (P-ARM/RV) — Pulte et al. (PLDI 2019), Appendix D, Theorem D.1: the operational Promising-ARM model is proven equivalent in Coq to the axiomatic ARMv8 model for finite executions.
Compilation target of
Incomparable with
  • RISC-V Weak Memory Ordering (RVWMO) — Both are multi-copy atomic and coincide on every standard litmus family over the common instruction set (verified against herd7's aarch64.cat and riscv.cat). The incomparability is instruction-level: RISC-V's fence.tso (which allows SB) and the RCsc/RCpc atomics differ from ARMv8's. See litmus/incomparable/ARMv8-vs-RVWMO.

References

  • Christopher Pulte, Shaked Flur, Will Deacon, Jon French, Susmit Sarkar, Peter Sewell. Simplifying ARM Concurrency: Multicopy-atomic Axiomatic and Operational Models for ARMv8. POPL 2018, 2018. doi:10.1145/3158107