Overhauling SC atomics in C11 and OpenCL

Abstract

Despite the conceptual simplicity of sequential consistency (SC), the semantics of SC atomic operations and fences in the C11 and OpenCL memory models is subtle, leading to convoluted prose descriptions that translate to complex axiomatic formalisations. We conduct an overhaul of SC atomics in C11, reducing the associated axioms in both number and complexity. A consequence of our simplification is that the SC operations in an execution no longer need to be totally ordered. This relaxation enables, for the first time, efficient and exhaustive simulation of litmus tests that use SC atomics. We extend our improved C11 model to obtain the first rigorous memory model formalisation for OpenCL (which extends C11 with support for heterogeneous many-core programming). In the OpenCL setting, we refine the SC axioms still further to give a sensible semantics to SC operations that employ a ‘memory scope’ to restrict their visibility to specific threads. Our overhaul requires slight strengthenings of both the C11 and the OpenCL memory models, causing some behaviours to become disallowed. We argue that these strengthenings are natural, and that all of the formalised C11 and OpenCL compilation schemes of which we are aware (Power and x86 CPUs for C11, AMD GPUs for OpenCL) remain valid in our revised models. Using the HERD memory model simulator, we show that our overhaul leads to an exponential improvement in simulation time for C11 litmus tests compared with the original model, making *exhaustive* simulation competitive, time-wise, with the *non-exhaustive* CDSChecker tool.

Automatically comparing memory consistency models

“…We have included some recently-proposed simplifications. In particular, the simpler release sequence (proposed by Vafeiadis et al [77]) makes deadness easier to define ( §3.4), and omitting the total order 'S ' over SC events (as proposed by Batty et al [14]) avoids having to iterate over all total orders when showing an execution to be inconsistent.…”

“…Batty et al have proposed a change to the C11 consistency axioms that enables them to be simplified, and also avoids the need for a total order, S , over all SC events [14]. Having already incorporated their proposal in our …”

Automatically comparing memory consistency models

“…We find that Alloy has several advantages over other frameworks that have been used to reason about MCMs, such as Isabelle (e.g., [16]), Lem [56] (e.g., [15]), Coq (e.g., [77]), and .cat [12] (e.g., [14]). A key advantage is that the entire memory modelling process can be conducted within Alloy: the Alloy modelling language can express programming languages, compiler mappings, MCMs, and properties to test, the Alloy Analyzer can discover solutions, and the Alloy Visualizer can display solutions using theming customised for the model at hand.…”

“…That is, is there a litmus test that can pass under one but must fail under the other? [11,14,43,48,50,58,63] Q3 Can 'strengthening' a program (syntactically) ever enable additional behaviours? For instance, can we take a litmus test that must fail, impose additional sequencing or dependencies between its instructions (or, in the C11 case, give an atomic operation a stronger 'memory order' [38 ( §7.17.3)]), and thereby allow it to pass?…”

The Hitchhiker's Guide to Cross-Platform OpenCL Application Development

“…If no memory order is provided, a default memory order of sequentially consistent is used [14, p. 103]. Rules on the orderings provided by these annotations are given both in the standard and (more formally) in recent academic work [5].…”