C.6 Shared Variable Control
{
AI05-0229-1}
{
AI05-0299-1}
[This subclause defines representation aspects that control the use of
shared variables.]
Static Semantics
Atomic
The type of aspect Atomic is Boolean.
Aspect Description for Atomic: Declare
that a type, object, or component is atomic.
Independent
The type of aspect Independent is Boolean.
Aspect Description for Independent:
Declare that a type, object, or component is independently addressable.
Volatile
The type of aspect Volatile is Boolean.
Aspect Description for Volatile: Declare
that a type, object, or component is volatile.
Atomic_Components
The type of aspect Atomic_Components is Boolean.
Aspect Description for Atomic_Components:
Declare that the components of an array type or object are atomic.
Volatile_Components
The type of aspect Volatile_Components is Boolean.
Aspect Description for Volatile_Components:
Declare that the components of an array type or object are volatile.
Independent_Components
The type of aspect Independent_Components is Boolean.
Aspect Description for Independent_Components:
Declare that the components of an array or record type, or an array
object, are independently addressable.
{
AI05-0229-1}
If any of these aspects are directly specified, the
aspect_definition
shall be a static expression. If not specified (including by inheritance),
each of these aspects is False.
{
AI95-00272-01}
{
AI05-0229-1}
An
atomic type is one for which the aspect
Atomic is True. An
atomic object (including a component) is one
for which the aspect Atomic is True, or a component of an array for which
the aspect Atomic_Components is True for the associated type, or any
object of an atomic type, other than objects obtained by evaluating a
slice.
Ramification: {
AI95-00272-01}
A slice of an atomic array object is not itself atomic. That's necessary
as executing a read or write of a dynamic number of components in a single
instruction is not possible on many targets.
{
AI05-0229-1}
A
volatile type is one for which the aspect
Volatile is True. A
volatile object (including a component) is
one for which the aspect Volatile is True, or a component of an array
for which the aspect Volatile_Components is True for the associated type,
or any object of a volatile type. In addition, every atomic type or object
is also defined to be volatile. Finally, if an object is volatile, then
so are all of its subcomponents [(the same does not apply to atomic)].
{
AI05-0009-1}
{
AI05-0229-1}
{
AI12-0001-1}
When True, the aspects Independent and Independent_Components
specify
as independently addressable the named object or component(s), or
in the case of a type, all objects or components of that type. All atomic
objects and aliased objects are considered to be specified as independently
addressable.
Ramification: If the compiler cannot
guarantee that an object (including a component) for which aspect Independent
or aspect Independent_Components is True is independently addressable
from any other nonoverlapping object, then the aspect specification must
be rejected.
Similarly, an atomic object (including atomic
components) is always independently addressable from any other nonoverlapping
object. Any representation item which would prevent this from being true
should be rejected, notwithstanding what this Standard says elsewhere
(specifically, in the Recommended Level of Support).
Legality Rules
{
AI05-0229-1}
{
AI12-0001-1}
It is illegal to specify either of the aspects Atomic
or Atomic_Components to have the value True for an object or type if
the implementation cannot support the indivisible and independent reads
and updates required by the aspect (see below).
{
AI12-0001-1}
It is illegal to specify the Size attribute of an atomic object, the
Component_Size attribute for an array type with atomic components, or
the layout attributes of an atomic component, in a way that prevents
the implementation from performing the required indivisible and independent
reads and updates.
{
AI05-0142-4}
{
AI05-0218-1}
If an atomic object is passed as a parameter, then the formal parameter
shall either have an atomic type or allow pass by copy. If an atomic
object is used as an actual for a generic formal object of mode
in
out, then the type of the generic formal object shall be atomic.
If the
prefix
of an
attribute_reference
for an Access attribute denotes an atomic object [(including a component)],
then the designated type of the resulting access type shall be atomic.
If an atomic type is used as an actual for a generic formal derived type,
then the ancestor of the formal type shall be atomic. Corresponding rules
apply to volatile objects and types.
Ramification: {
AI05-0142-4}
A formal parameter allows pass by copy if it is not
aliased and
it is of a type that allows pass by copy (that is, is not a by-reference
type).
{
AI05-0218-1}
If a volatile type is used as an actual for a generic formal array type,
then the element type of the formal type shall be volatile.
{
AI05-0229-1}
If an aspect Volatile, Volatile_Components, Atomic, or Atomic_Components
is directly specified to have the value True for a stand-alone constant
object, then the aspect Import shall also be specified as True for it.
Ramification: Hence, no initialization
expression is allowed for such a constant. Note that a constant that
is atomic or volatile because of its type is allowed.
Reason: Stand-alone constants that are
explicitly specified as Atomic or Volatile only make sense if they are
being manipulated outside the Ada program. From the Ada perspective the
object is read-only. Nevertheless, if imported and atomic or volatile,
the implementation should presume it might be altered externally. For
an imported stand-alone constant that is not atomic or volatile, the
implementation can assume that it will not be altered.
To be honest: {
AI05-0218-1}
Volatile_Components and Atomic_Components actually are aspects of the
anonymous array type; this rule only applies when the aspect is specified
directly on the constant object and not when the (named) array type has
the aspect.
{
AI05-0009-1}
{
AI05-0229-1}
It is illegal to specify the aspect Independent or Independent_Components
as True for a component, object or type if the implementation cannot
provide the independent addressability required by the aspect (see
9.10).
{
AI05-0009-1}
{
AI05-0229-1}
It is illegal to specify a representation aspect for a component, object
or type for which the aspect Independent or Independent_Components is
True, in a way that prevents the implementation from providing the independent
addressability required by the aspect.
Dynamic Semantics
For an atomic object (including an atomic component)
all reads and updates of the object as a whole are indivisible.
{
AI05-0117-1}
{
AI05-0275-1}
All tasks of the program (on all processors) that read or update volatile
variables see the same order of updates to the variables. A use of an
atomic variable or other mechanism may be necessary to avoid erroneous
execution and to ensure that access to nonatomic volatile variables is
sequential (see
9.10).
Implementation Note: {
AI05-0117-1}
{
AI05-0275-1}
To ensure this, on a multiprocessor, any read or update of an atomic
object may require the use of an appropriate memory barrier.
Discussion: {
AI05-0275-1}
From
9.10 it follows that (in non-erroneous
programs) accesses to variables, including those shared by multiple tasks,
are always sequential. This guarantees that no task will ever see partial
updates of any variable. For volatile variables (including atomic variables),
the above rule additionally specifies that all tasks see the same order
of updates.
{
AI05-0275-1}
If for a shared variable
X, a read of
X occurs sequentially
after an update of
X, then the read will return the updated value
if
X is volatile or atomic, but may or or may not return the updated
value if
X is nonvolatile. For nonvolatile accesses, a signaling
action is needed in order to share the updated value.
{
AI05-0275-1}
Because accesses to the same atomic variable by different tasks establish
a sequential order between the actions of those tasks, implementations
may be required to emit memory barriers around such updates or use atomic
instructions that imply such barriers.
Two actions are sequential (see
9.10) if each is the read or update of the
same atomic object.
If a type is atomic or volatile
and it is not a by-copy type, then the type is defined to be a by-reference
type. If any subcomponent of a type is atomic or volatile, then the type
is defined to be a by-reference type.
If an actual parameter is atomic or volatile, and
the corresponding formal parameter is not, then the parameter is passed
by copy.
Implementation Note: Note that in the
case where such a parameter is normally passed by reference, a copy of
the actual will have to be produced at the call-site, and a pointer to
the copy passed to the formal parameter. If the actual is atomic, any
copying has to use indivisible read on the way in, and indivisible write
on the way out.
Reason: It has to be known at compile
time whether an atomic or a volatile parameter is to be passed by copy
or by reference. For some types, it is unspecified whether parameters
are passed by copy or by reference. The above rules further specify the
parameter passing rules involving atomic and volatile types and objects.
Implementation Requirements
The external effect of a program
(see
1.1.3) is defined to include each read
and update of a volatile or atomic object. The implementation shall not
generate any memory reads or updates of atomic or volatile objects other
than those specified by the program.
Discussion: The presumption is that volatile
or atomic objects might reside in an “active” part of the
address space where each read has a potential side effect, and at the
very least might deliver a different value.
The rule above
and the definition of external effect are intended to prevent (at least)
the following incorrect optimizations, where V is a volatile variable:
X:= V; Y:=V; cannot be allowed to be translated
as Y:=V; X:=V;
Deleting redundant loads: X:= V; X:= V; shall
read the value of V from memory twice.
Deleting redundant stores: V:= X; V:= X; shall
write into V twice.
Extra stores: V:= X+Y; should not translate
to something like V:= X; V:= V+Y;
Extra loads: X:= V; Y:= X+Z; X:=X+B; should
not translate to something like Y:= V+Z; X:= V+B;
Reordering of loads from volatile variables:
X:= V1; Y:= V2; (whether or not V1 = V2) should not translate to Y:=
V2; X:= V1;
Reordering of stores to volatile variables:
V1:= X; V2:= X; should not translate to V2:=X; V1:= X;
Implementation Advice
{
AI95-00259-01}
A load or store of a volatile object whose size is a multiple of System.Storage_Unit
and whose alignment is nonzero, should be implemented by accessing exactly
the bits of the object and no others.
Implementation Advice: A load or store
of a volatile object whose size is a multiple of System.Storage_Unit
and whose alignment is nonzero, should be implemented by accessing exactly
the bits of the object and no others.
Reason: Since any object can be a volatile
object, including packed array components and bit-mapped record components,
we require the above only when it is reasonable to assume that the machine
can avoid accessing bits outside of the object.
Ramification: This implies that the load
or store of a volatile object that meets the above requirement should
not be combined with that of any other object, nor should it access any
bits not belonging to any other object. This means that the suitability
of the implementation for memory-mapped I/O can be determined from its
documentation, as any cases where the implementation does not follow
Implementation Advice must be documented.
{
AI95-00259-01}
A load or store of an atomic object should, where possible, be implemented
by a single load or store instruction.
Implementation Advice: A load or store
of an atomic object should be implemented by a single load or store instruction.
9 An imported volatile or atomic constant
behaves as a constant (i.e. read-only) with respect to other parts of
the Ada program, but can still be modified by an “external source.”
10 {
AI12-0001-1}
Specifying the Pack aspect cannot override the effect of specifying an
Atomic or Atomic_Components aspect.
Incompatibilities With Ada 83
Pragma Atomic replaces Ada
83's pragma Shared. The name “Shared” was confusing, because
the pragma was not used to mark variables as shared.
Wording Changes from Ada 95
{
AI95-00259-01}
Added Implementation Advice to clarify the meaning of Atomic and Volatile
in machine terms. The documentation that this advice applies will make
the use of Ada implementations more predictable for low-level (such as
device register) programming.
{
AI95-00272-01}
Added wording to clarify that a slice of an object of an atomic type
is not atomic, just like a component of an atomic type is not (necessarily)
atomic.
Incompatibilities With Ada 2005
{
AI05-0218-1}
Correction: Plugged a hole involving volatile
components of formal types when the formal type's component has a nonvolatile
type. This was done by making certain actual types illegal for formal
derived and formal array types; these types were allowed for Ada 95 and
Ada 2005.
Extensions to Ada 2005
{
AI05-0009-1}
{
AI05-0229-1}
Aspects Independent and Independent_Components are
new; they eliminate ambiguity about independent addressability.
{
AI05-0229-1}
Aspects Atomic, Atomic_Components, Volatile, and Volatile_Components
are new;
pragmas
Atomic, Atomic_Components, Volatile, and Volatile_Components are now
obsolescent.
Wording Changes from Ada 2005
{
AI05-0117-1}
{
AI05-0275-1}
Revised the definition of volatile to eliminate overspecification and
simply focus on the root requirement (that all tasks see the same view
of volatile objects). This is not an inconsistency; "memory"
arguably includes on-chip caches so long as those are kept consistent.
Moreover, it is difficult to imagine a program that could tell the difference.
{
AI05-0142-4}
Added wording to take explicitly aliased parameters (see
6.1)
into account when determining the legality of parameter passing of volatile
and atomic objects.
Wording Changes from Ada 2012
{
AI12-0001-1}
Corrigendum: Clarified that aliased objects are considered to
be specified as independently addressable, and also eliminated an unnecessary
rule.
Ada 2005 and 2012 Editions sponsored in part by Ada-Europe
