Into the depths of C: elaborating the de facto standards

Abstract

C remains central to our computing infrastructure. It is notionally defined by ISO standards, but in reality the properties of C assumed by systems code and those implemented by compilers have diverged, both from the ISO standards and from each other, and none of these are clearly understood. We make two contributions to help improve this errorprone situation. First, we describe an in-depth analysis of the design space for the semantics of pointers and memory in C as it is used in practice. We articulate many specific questions, build a suite of semantic test cases, gather experimental data from multiple implementations, and survey what C experts believe about the de facto standards. We identify questions where there is a consensus (either following ISO or differing) and where there are conflicts. We apply all this to an experimental C implemented above capability hardware. Second, we describe a formal model, Cerberus, for large parts of C. Cerberus is parameterised on its memory model; it is linkable either with a candidate de facto memory object model, under construction, or with an operational C11 concurrency model; it is defined by elaboration to a much simpler Core language for accessibility, and it is executable as a test oracle on small examples. This should provide a solid basis for discussion of what mainstream C is now: what programmers and analysis tools can assume and what compilers aim to implement. Ultimately we hope it will be a step towards clear, consistent, and accepted semantics for the various use-cases of C.

Detecting Undefined Behaviors in CUDA C

“…Several research groups have conducted the detection of undefined behavior for C, including Wang et al [5], Memarian et al [27], Hathhorn et al [8], Ellison et al [28], Kang et al [29], Nagarakatte et al [30], Brown et al [31], and Chisnall et al [32]. We divide these works into two categories, one is based on static analysis and the other is based on semantics.…”

“…Memarian et al [27] presents an in-depth analysis of the design space for the semantics of pointers and memory in C, and a formal semantics named Cerberus, which is used to capture the ISO text for these aspects as clearly as possible. The authors applied the analysis to a C dialect supported by some processors that implement unforgeable and bounds-checked C pointers.…”

Intel MPX Explained

“…Not supported C idioms. MPX does not work correctly with several common C idioms (see Table 4), especially when narrowing of bounds is applied and applications deviate from the standard memory model [8,31]. First, flexible array fields with array size of one (e.g., arr [1]) as well as variable-sized arrays (e.g., arr[]) get incorrect bounds under Intel MPX, which leads to false positives.…”

Into the depths of C: elaborating the de facto standards

“…All this is a considerable body of material: our designspace analysis alone is an 80+ page document; we refer to the extensive supplementary material [32] for that and for our test suite, survey results, and experimental data. We summarise selected design-space analysis in §2, apply it in §3 and §4, and summarise aspects of Cerberus in §5.…”