Repairing Sequential Consistency in C/C++11 Ori Lahav 1 Viktor - PowerPoint PPT Presentation

Repairing Sequential Consistency in C/C++11 Ori Lahav 1 Viktor Vafeiadis 1 Jeehoon Kang 2 Chung-Kil Hur 2 Derek Dreyer 1 1 Max Planck Institute for Software Systems (MPI-SWS) 2 Seoul National University PLDI 2017

C11’s spectrum of consistency Access modes non- release/ relaxed sc � � � atomic acquire

C11’s spectrum of consistency Access modes non- release/ relaxed sc � � � atomic acquire Message passing x := sc 1; a := y sc ; / / 1 x := rlx 1; a := y acq ; / / 1 ∼ = y := sc 1; b := x sc ; / / 0 y := rel 1; b := x rlx ; / / 0 Store buffer x := sc 1; y := sc 1; x := rel 1; y := sc 1; �∼ = a := y sc ; / 0 b := x sc ; / 0 a := y sc ; / / 0 b := x sc ; / / 0 / /

C11’s spectrum of consistency Access modes non- release/ relaxed sc � � � atomic acquire Message passing x := sc 1; a := y sc ; / / 1 x := rlx 1; a := y acq ; / / 1 ∼ = y := sc 1; b := x sc ; / / 0 y := rel 1; b := x rlx ; / / 0 Store buffer x := sc 1; y := sc 1; x := rel 1; y := sc 1; �∼ = a := y sc ; / 0 b := x sc ; / 0 a := y sc ; / / 0 b := x sc ; / / 0 / /

C11’s spectrum of consistency Access modes non- release/ relaxed sc � � � atomic acquire Message passing 1. SC semantics is too strong (new correctness problem!) x := sc 1; a := y sc ; / / 1 x := rlx 1; a := y acq ; / / 1 ∼ = y := sc 1; b := x sc ; / / 0 y := rel 1; b := x rlx ; / / 0 2. SC semantics is too weak (SC-fences) Store buffer x := sc 1; y := sc 1; x := rel 1; y := sc 1; �∼ = a := y sc ; 3. Out-of-thin-air reads (relaxed accesses) / 0 b := x sc ; / 0 a := y sc ; / / 0 b := x sc ; / / 0 / /

C11’s spectrum of consistency Access modes non- release/ relaxed sc � � � atomic acquire Message passing 1. SC semantics is too strong (new correctness problem!) x := sc 1; a := y sc ; / / 1 x := rlx 1; a := y acq ; / / 1 ∼ = y := sc 1; b := x sc ; / / 0 y := rel 1; b := x rlx ; / / 0 We show how to get SC semantics just right! 2. SC semantics is too weak (SC-fences) Store buffer x := sc 1; y := sc 1; x := rel 1; y := sc 1; �∼ = a := y sc ; 3. Out-of-thin-air reads (relaxed accesses) / 0 b := x sc ; / 0 a := y sc ; / / 0 b := x sc ; / / 0 / /

C11’s spectrum of consistency Access modes non- release/ relaxed sc � � � atomic acquire Message passing 1. SC semantics is too strong (new correctness problem!) x := sc 1; a := y sc ; / / 1 x := rlx 1; a := y acq ; / / 1 ∼ = y := sc 1; b := x sc ; / / 0 y := rel 1; b := x rlx ; / / 0 We show how to get SC semantics just right! 2. SC semantics is too weak (SC-fences) Store buffer x := sc 1; y := sc 1; x := rel 1; y := sc 1; �∼ = a := y sc ; 3. Out-of-thin-air reads (relaxed accesses) / 0 b := x sc ; / 0 a := y sc ; / / 0 b := x sc ; / / 0 / /

Semantics of SC-atomics is too strong! Example due to Yatin Manerkar et al. [CoRR abs/1611.01507] a := x acq ; / / 1 c := y acq ; / / 1 x := sc 1; y := sc 1; b := y sc ; / / 0 d := x sc ; / / 0 C/C++11: behavior disallowed

Semantics of SC-atomics is too strong! Example due to Yatin Manerkar et al. [CoRR abs/1611.01507] a := x acq ; / / 1 c := y acq ; / / 1 x := sc 1; y := sc 1; b := y sc ; / / 0 d := x sc ; / / 0 C/C++11: behavior disallowed Compilation of C/C++11 to Power R rlx �→ W rlx �→ ld st R acq �→ W rel �→ lwsync;st ld;lwsync R sc �→ sync;ld;lwsync W sc �→ Leading sync : sync;st R sc �→ W sc �→ lwsync;st;sync Trailing sync : ld; sync

Semantics of SC-atomics is too strong! Example due to Yatin Manerkar et al. [CoRR abs/1611.01507] a := x acq ; / / 1 c := y acq ; / / 1 x := sc 1; y := sc 1; b := y sc ; / / 0 d := x sc ; / / 0 C/C++11: behavior disallowed Compilation of C/C++11 to Power R rlx �→ W rlx �→ ld st R acq �→ W rel �→ lwsync;st ld;lwsync R sc �→ sync;ld;lwsync W sc �→ Leading sync : sync;st R sc �→ W sc �→ lwsync;st;sync Trailing sync : ld; sync Compilation result with “trailing sync ” convention: a := x ; / / 1 c := y ; / / 1 lwsync ; x := 1; y := 1; lwsync ; b := y ; / / 0 sync ; sync ; d := x ; / / 0 sync ; sync ; Power: behavior allowed

Semantics of SC-atomics is too strong! Other examples show unsoundness of: ◮ Leading sync compilation (implemented in GCC and LLVM) ◮ Placing sync both before and after SC-accesses In order to recover the correctness of existing compilers, we suggest to weaken the standard.

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / /

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0)

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 0: choose reads-from Every read reads from a corresponding write.

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 0: choose reads-from Every read reads from a corresponding write.

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 1: calculate happens-before po rf hb hb a : W ⊒ rel b : R ⊒ acq a b a c b b hb hb hb a a b b a c

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 1: calculate happens-before po rf hb hb a : W ⊒ rel b : R ⊒ acq a b a c b b hb hb hb a a b b a c

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 2: “SC-per-location” W na W na x (0) y (0) R acq R acq W sc W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0)

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 2: “SC-per-location” W na W na x (0) y (0) R acq R acq W sc W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0)

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 2: “SC-per-location” W na W na x (0) y (0) R acq R acq W sc W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0)

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) R sc R sc y (0) x (0) Stage 2: “SC-per-location” W na W na x (0) ① y (0) R acq R acq W sc W sc x (1) ④ x (1) ③ y (1) y (1) R sc R sc y (0) x (0) ②

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) sc-per-loc R sc R sc y (0) x (0) Stage 2: “SC-per-location” W na W na x (0) ① y (0) R acq R acq W sc W sc x (1) ④ x (1) ③ y (1) y (1) R sc R sc y (0) x (0) ②

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) sc-per-loc R sc R sc y (0) x (0) Stage 3: global restrictions on SC-accesses Order all SC-accesses while respecting: sc-per-loc hb a : * sc b : W sc a : * sc b : * sc x x sc-order sc-order a a b b

C11’s declarative semantics 101 Batty et al. [POPL’16] a := x acq ; / 1 c := y acq ; / 1 / / x := sc 1; y := sc 1; b := y sc ; / 0 d := x sc ; / 0 / / program order W na W na y (0) x (0) reads from happens-before R acq W sc R acq W sc x (1) x (1) y (1) y (1) sc-per-loc R sc R sc y (0) x (0) sc-order Stage 3: global restrictions on SC-accesses Order all SC-accesses while respecting: sc-per-loc hb a : * sc b : W sc a : * sc b : * sc x x sc-order sc-order a a b b