Mathematizing C++ concurrency

Abstract

Shared-memory concurrency in C and C++ is pervasive in systems programming, but has long been poorly defined. This motivated an ongoing shared effort by the standards committees to specify concurrent behaviour in the next versions of both languages. They aim to provide strong guarantees for race-free programs, together with new (but subtle) relaxed-memory atomic primitives for highperformance concurrent code. However, the current draft standards, while the result of careful deliberation, are not yet clear and rigorous definitions, and harbour substantial problems in their details.In this paper we establish a mathematical (yet readable) semantics for C++ concurrency. We aim to capture the intent of the current ('Final Committee') Draft as closely as possible, but discuss changes that fix many of its problems. We prove that a proposed x86 implementation of the concurrency primitives is correct with respect to the x86-TSO model, and describe our CPPMEM tool for exploring the semantics of examples, using code generated from our Isabelle/HOL definitions.Having already motivated changes to the draft standard, this work will aid discussion of any further changes, provide a correctness condition for compilers, and give a much-needed basis for analysis and verification of concurrent C and C++ programs.

The Problem of Programming Language Concurrency Semantics

“…The C/C++11 Model The C/C++11 model [13,8,2,9] aims to support DRF-SC for simple programs (those using only locks and SC atomics), but also provides a range of low-level atomics that provide less synchronisation but without the cost of restoring full SC: release/acquire write/read pairs for message-passing synchronisation, relaxed atomics that should be implementable just with single machine-level loads and stores, and release/consume pairs to expose some dependency preservation guarantees of the hardware to make them available in the language. As we shall see, the semantics of all these remains problematic.…”

“…For a more complete account of the proof, see Batty's thesis [5]. Recalling that the prose ISO standards for C++11 and C11 [9,2] and the mathematical formalisation of the model by Batty et al [8] correspond closely, this is effectively a mechanised proof of a key metatheoretic property of a mainstream language definition.…”

“…We start with a graph over memory accesses, called a pre-execution [8], that captures the syntactic structure of the program with a relation for parent-to-child thread ordering and another (sequenced-before) for program order. The total model and C/C++11 differ in the relations added to the pre-execution to form their candidate-executions: C/C++11 represents the dynamic behaviour of memory with many partial orders (modification order, lock order and SC order), whereas the total model has only a single total order over all memory accesses in the pre-execution.…”

“…The basic design was outlined by Boehm and Adve [13], and Batty et al [8] developed a formal semantics in the latter stages of the standardisation process, identifying various flaws in the draft standard and feeding back into the ratified standards and later defect reports. C/C++11 concurrency has been supported by GCC and Clang since versions 4.9 and 3.2 respectively, and the model by Batty et al has been used for many purposes, including correctness proofs for compilation schemes to x86, by Batty et al [8], and to IBM Power, by Batty et al [7] and Sarkar et al [32]; compiler testing via a theory of sound optimisations, by Morisset et al [29]; model checking, by Norris and Demsky [30]; compositional library abstraction, by Batty et al [6]; and program logics, by Vafeiadis and Narayan [39] and by Turon et al [37]. Elements of the model have also been incorporated into OpenCL 2.0.…”

“…We introduce aspects of the C/C++11 model as required, but it is not possible to recap the whole model here; for a full description we refer to [8].…”