Foundations of the C++ concurrency memory model

Abstract

Currently multi-threaded C or C++ programs combine a singlethreaded programming language with a separate threads library. This is not entirely sound [7].We describe an effort, currently nearing completion, to address these issues by explicitly providing semantics for threads in the next revision of the C++ standard. Our approach is similar to that recently followed by Java [25], in that, at least for a welldefined and interesting subset of the language, we give sequentially consistent semantics to programs that do not contain data races. Nonetheless, a number of our decisions are often surprising even to those familiar with the Java effort:• We (mostly) insist on sequential consistency for race-free programs, in spite of implementation issues that came to light after the Java work.• We give no semantics to programs with data races. There are no benign C++ data races.• We use weaker semantics for trylock than existing languages or libraries, allowing us to promise sequential consistency with an intuitive race definition, even for programs with trylock.This paper describes the simple model we would like to be able to provide for C++ threads programmers, and explain how this, together with some practical, but often under-appreciated implementation constraints, drives us towards the above decisions.

A Better x86 Memory Model: x86-TSO

“…These are essentially causal-consistency models [4]. They allow independent readers to see independent writes (by different processors to different addresses) in different orders, as below (IRIW, see also [6]), but require that, in some sense, causality is respected: "P5. In a multiprocessor system, memory ordering obeys causality (memory ordering respects transitive visibility)".…”

The Problem of Programming Language Concurrency Semantics

“…The C/C++11 Model The C/C++11 model [13,8,2,9] aims to support DRF-SC for simple programs (those using only locks and SC atomics), but also provides a range of low-level atomics that provide less synchronisation but without the cost of restoring full SC: release/acquire write/read pairs for message-passing synchronisation, relaxed atomics that should be implementable just with single machine-level loads and stores, and release/consume pairs to expose some dependency preservation guarantees of the hardware to make them available in the language. As we shall see, the semantics of all these remains problematic.…”

“…There have been two previous results along these lines, but both were preliminary: Boehm and Adve [13] give a hand proof for a preliminary model that omits many features, while Batty et al [7,Thm. 5] give a hand proof based on an earlier version of their formal model that uses that model's notion of races for the SC semantics.…”

“…The basic design was outlined by Boehm and Adve [13], and Batty et al [8] developed a formal semantics in the latter stages of the standardisation process, identifying various flaws in the draft standard and feeding back into the ratified standards and later defect reports. C/C++11 concurrency has been supported by GCC and Clang since versions 4.9 and 3.2 respectively, and the model by Batty et al has been used for many purposes, including correctness proofs for compilation schemes to x86, by Batty et al [8], and to IBM Power, by Batty et al [7] and Sarkar et al [32]; compiler testing via a theory of sound optimisations, by Morisset et al [29]; model checking, by Norris and Demsky [30]; compositional library abstraction, by Batty et al [6]; and program logics, by Vafeiadis and Narayan [39] and by Turon et al [37].…”

Generating Litmus Tests for Contrasting Memory Consistency Models

“…The emergence of mainstream multi-core processors as well as recent developments in language-level memory models [3,18], have stirred new interest in hardware-level memory models. The formal specification of memory models is challenging due to the many subtle differences between them.…”