Dynamic synthesis for relaxed memory models

Abstract

Modern architectures implement relaxed memory models which may reorder memory operations or execute them non-atomically. Special instructions called memory fences are provided, allowing control of this behavior.To implement a concurrent algorithm for a modern architecture, the programmer is forced to manually reason about subtle relaxed behaviors and figure out ways to control these behaviors by adding fences to the program. Not only is this process time consuming and error-prone, but it has to be repeated every time the implementation is ported to a different architecture.In this paper, we present the first scalable framework for handling real-world concurrent algorithms running on relaxed architectures. Given a concurrent C program, a safety specification, and a description of the memory model, our framework tests the program on the memory model to expose violations of the specification, and synthesizes a set of necessary ordering constraints that prevent these violations. The ordering constraints are then realized as additional fences in the program.We implemented our approach in a tool called DFENCE based on LLVM and used it to infer fences in a number of concurrent algorithms. Using DFENCE, we perform the first in-depth study of the interaction between fences in real-world concurrent C programs, correctness criteria such as sequential consistency and linearizability, and memory models such as TSO and PSO, yielding many interesting observations. We believe that this is the first tool that can handle programs at the scale and complexity of a lock-free memory allocator.

Herding Cats

“…To some extent, decidability and verification papers Burckhardt et al 2007;Atig et al 2010Atig et al , 2011Atig et al , 2012Bouajjani et al , 2013Kuperstein et al 2010Kuperstein et al , 2011Liu et al 2012;Abdulla et al 2012Abdulla et al , 2013 do provide some general principles about weak memory, although we find them less directly applicable Adir et al [2003] axiomatic based on discussion with IBM architects; precumulative barriers axiomatic based on documentation; not tested on h/w and single-event axiomatic based on extensive testing; semantics of lwsync stronger than on r+lwsync+sync, weaker on mp+lwsync+addr operational based on discussion with IBM architects and extensive testing; flawed w.r.t. Power h/w on, e.g., mp+lwsync+addr-po-detour (see Fig.…”

“…This problem has been studied before for TSO and its siblings PSO and RMO (e.g., see Kuperstein et al [2010], Bouajjani et al [ , 2013, and Liu et al [2012]), or for previous versions of the Power model .…”

Replicated data types

“…We formalize the correspondence to C/C++ in [12, §D]. In the future, this correspondence may open the door to applying technology developed for shared-memory models to eventually consistent systems; promising directions include model checking [3,9], automatic inference of required consistency levels [26] and compositional reasoning [4].…”

Fence-free work stealing on bounded TSO processors

“…However, the Cilk THE and Chase-Lev work stealing algorithms are not linearizable under TSO [30]. For example, a put() may be delayed in the worker's store buffer and missed by a thief, causing a linearizability violation as the following Chase-Lev execution shows:…”

“…Therefore, while adding a fence before the put() completes fixes these violations [30], deployed work stealing implementations do not do so.…”