Repairing sequential consistency in C/C++11

Abstract

The C/C++11 memory model defines the semantics of concurrent memory accesses in C/C++, and in particular supports racy "atomic" accesses at a range of different consistency levels, from very weak consistency ("relaxed") to strong, sequential consistency ("SC"). Unfortunately, as we observe in this paper, the semantics of SC atomic accesses in C/C++11, as well as in all proposed strengthenings of the semantics, is flawed, in that (contrary to previously published results) both suggested compilation schemes to the Power architecture are unsound. We propose a model, called RC11 (for Repaired C11), with a better semantics for SC accesses that restores the soundness of the compilation schemes to Power, maintains the DRF-SC guarantee, and provides stronger, more useful, guarantees to SC fences. In addition, we formally prove, for the first time, the correctness of the proposed stronger compilation schemes to Power that preserve load-to-store ordering and avoid "out-of-thin-air" reads.

Mixed-size concurrency: ARM, POWER, C/C++11, and SC

“…This argument builds on previous proof attempts [34,35]. It has recently become clear that those are unsound [47,48,49], but those issues and the mixed-size extensions appear to be orthogonal.…”

“…We now sketch an argument to show that mixed-size phenomena introduce no further complication to correctness proof for the standard compilation scheme [58] from C/C++11 concurrency to POWER, by adapting a previous proof attempt [34] to cover the models of §5 and §3. Note, however, that that previous result and proof are now known to be unsound, for unrelated reasons [47,48,49]. Specifically, the previous result does not hold for mixtures of SC and non-SC atomic C/C++11 accesses, where the requirement that the SC order of C/C++11 is consistent with happens-before is not be satisfied in all cases.…”

A Formal Analysis of the NVIDIA PTX Memory Consistency Model

“…The first bullet translates to an fr relation, and the second translates to co. In our model (which for modeling purposes splits atom into separate read and write components [32]), Figure 8. Without a No-Thin-Air axiom, nothing would prevent each loads from speculating a return value of 42 and then using the other's speculation to justify its own, even though the value 42 would never be produced otherwise.…”

“…• Empirical testing often runs into tractability limits and is inherently incomplete [2,35]. • Memory models change regularly, either intentionally [12] or because bugs are found [11,32,51]. • Writing proofs can be hard and/or tedious, especially because the use of rigorous but pedantic theorem provers such as Coq [4] or HOL [5] is the accepted standard.…”

A Separation Logic for a Promising Semantics

“…The main reason for this gap is that the behaviour of relaxed accesses is notoriously hard to specify [3,5]. Up until recently, memory models have either been too strong (e.g., [5,14,17]), forbidding some behaviours observed with modern hardware and compilers, or they have been too weak (e.g., [4]), allowing so-called out-of-thin-air (OOTA) behaviour even though it does not occur in practice and is highly problematic.…”