Synchronising C/C++ and POWER

Shared memory concurrency relies on synchronisation primitives: compare-and-swap, load-reserve/store-conditional (aka LL/SC), language-level mutexes, and so on. In a sequentially consistent setting, or even in the TSO setting of x86 and Sparc, these have well-understood semantics. But in the very relaxed settings of Power, ARM, or C/C++, it remains surprisingly unclear exactly what the programmer can depend on.

This paper studies relaxed-memory synchronisation. On the hardware side, we give a clear semantic characterisation of the load-reserve/store-conditional primitives as provided by Power multiprocessors, for the first time since they were introduced 20 years ago; we cover their interaction with relaxed loads, stores, barriers, and dependencies. Our model, while not officially sanctioned by the vendor, is validated by extensive testing, comparing actual implementation behaviour against an oracle generated from the model, and by detailed discussion with a senior IBM Power designer/architect. We believe the ARM semantics to be similar.

On the software side, we prove sound a proposed compilation scheme of the C/C++ synchronisation constructs to Power, including C/C++ spinlock mutexes, fences, and read-modify-write operations, together with the simpler atomic operations for which soundness is already known; this is a first step in verifying concurrent algorithms that use load-reserve/store-conditional w.r.t. a realistic semantics. We also build confidence in the C/C++ model in its own terms, fixing some omissions and contributing to the C standards committee adoption of the C++11 concurrency model.

Papers

Errata

See here.

Supplementary material

The models are expressed in Lem code, a lightweight language for executable mathematical definitions.

POWER Model (for more details of the model without load-reserve/store-conditional, see Understanding POWER Multiprocessors)

C++11 Models (for more details of the core model see Mathematizing C++ Concurrency, though this is revised)

Proofs

Examples mentioned in the paper

TODO: collect links for those examples

Experimental results

We compare our model of the Power architecture and three generations of Power machines:

People

University of Cambridge:

Oxford University:

INRIA Paris-Rocquencourt:

IBM:


[validate]