A promising semantics for relaxed-memory concurrency

Abstract

Despite many years of research, it has proven very difficult to develop a memory model for concurrent programming languages that adequately balances the conflicting desiderata of programmers, compilers, and hardware. In this paper, we propose the first relaxed memory model that (1) accounts for a broad spectrum of features from the C++11 concurrency model, (2) is implementable, in the sense that it provably validates many standard compiler optimizations and reorderings, as well as standard compilation schemes to x86-TSO and Power, (3) justifies simple invariant-based reasoning, thus demonstrating the absence of bad "out-of-thin-air" behaviors, (4) supports "DRF" guarantees, ensuring that programmers who use sufficient synchronization need not understand the full complexities of relaxed-memory semantics, and (5) defines the semantics of racy programs without relying on undefined behaviors, which is a prerequisite for applicability to type-safe languages like Java. The key novel idea behind our model is the notion of *promises*: a thread may promise to execute a write in the future, thus enabling other threads to read from that write out of order. Crucially, to prevent out-of-thin-air behaviors, a promise step requires a thread-local certification that it will be possible to execute the promised write even in the absence of the promise. To establish confidence in our model, we have formalized most of our key results in Coq.

Automatically comparing memory consistency models

“…Indeed, we are already working with two large processor vendors to apply our technique to their recent and upcoming architectures and languages. Other future work includes applying our technique to more recent MCMs that are defined in a non-axiomatic style [27,40,41,65].…”

Verifying C11 programs operationally

“…This complicates a verification technique that follows program order. Kang et al [13] develop an operational model aimed at handling cycles in sb ∪ rf. Again, their sophisticated model handles a larger subset of the C11 language, but at the cost of a more complicated state space and transition relation.…”

“…However, their work aims to support Java compiler optimisations and they do not consider program verification. One avenue for future work is to see how our notions of determinate-value and variableordering assertions might be applied to a more sophisticated semantics [10,13].…”

“…However precise, axiomatic definitions are unsuitable for program verification (in particular, those involving invariant-based reasoning), which requires one to consider the step-wise execution of a program. There has therefore Conference'17, July 2017, Washington, DC, USA 2019. been a substantial effort to develop an operational semantics: for weak memory models in general [12,13,15] and for C11 specifically [19,20].…”

“…Some operational models (e.g., [20]) attempt to deal with the full complexity of the language and its behaviour. Other models focus on a well-behaved and well-understood fragment (e.g., [13,15]). In order to support an intuitive verification method, we take the latter course.…”