Repairing sequential consistency in C/C++11

Abstract

The C/C++11 memory model defines the semantics of concurrent memory accesses in C/C++, and in particular supports racy "atomic" accesses at a range of different consistency levels, from very weak consistency ("relaxed") to strong, sequential consistency ("SC"). Unfortunately, as we observe in this paper, the semantics of SC atomic accesses in C/C++11, as well as in all proposed strengthenings of the semantics, is flawed, in that (contrary to previously published results) both suggested compilation schemes to the Power architecture are unsound. We propose a model, called RC11 (for Repaired C11), with a better semantics for SC accesses that restores the soundness of the compilation schemes to Power, maintains the DRF-SC guarantee, and provides stronger, more useful, guarantees to SC fences. In addition, we formally prove, for the first time, the correctness of the proposed stronger compilation schemes to Power that preserve load-to-store ordering and avoid "out-of-thin-air" reads.

Verifying C11 programs operationally

“…The formalisation in this section follows the existing literature on axiomatic C11 semantics [5,17]. First we give some preliminary definitions.…”

“…The relation fr = (rf −1 ; mo)\Id (where ; is relational composition) is the "from-read" relation 1 that relates each read to all writes that are mo-after the write the read has read from. We must subtract Id (identity) edges from rf −1 ; mo to cope with update events, which have the potential to induce reflexivity in fr [4,17]. Example 3.2.…”

“…Relation mo describes the order of modifications for each variable. The unsynchronised read rd 4 (z, 3) is justified by the rf from wr 3 (z, 3), whereas 1 fr is also referred to as "reads-before" [17]. the synchronised read rd A 3 (x, 2) is justified by the sw from wr R 2 (x, 2) and fixed before upd RA 1 (x, 2, 4) via the fr relation.…”

“…If the write being read is releasing, then an update induces an sw (e.g., see upd RA 1 (x, 2, 4)). In addition, our semantics uses the extended coherence order 2 [17], denoted eco, which is an order that fixes the order of reads and writes to each variable (see Example 3.3 below). Formally we define: Reads r 1 , r ′ 1 and r ′′ 1 read from the write w 1 , inducing fromread edges to w 2 (the write that immediately follows w 1 in mo).…”

Automatically comparing memory consistency models

“…Work in progress by Lahav et al [44] has uncovered a bug in the C11/Power mapping previously thought to have been proven sound by Batty et al [15]. 6 Before becoming aware of their work, we had used Alloy to verify the soundness of the mapping for up to 6 software-level events and up to 6 architecture-level events.…”