The C11 and C++11 Concurrency Model

207
atomic x(0); atomic y(0);
T0 x.store(1,memory_order_release);
T1 r1=x.load(memory_order_acquire);
r2=y.load(memory_order_acquire);
T2 y.store(1,memory_order_release);
T3 r3=y.load(memory_order_acquire);
r4=x.load(memory_order_acquire);
The Power analogue of this program allows IRIW behaviour. Full sync instructions
would be required between the loads in order to forbid this. The sync is stronger than
an lwsync: it requires all Group A and program-order preceding writes to be propagated
to all threads before the thread continues. This is enough to forbid the IRIW relaxed
behaviour. If we replace the memory orders in the program above with the seq cst
memory order, then the mapping would provide sync instructions between the reads, and
the IRIW outcome would be forbidden in the compiled Power program, as required.
The examples presented here help to explain how the synchronisation instructions
in the mapping forbid executions that the language does not allow. We can also show
that if the mapping were weakened in any way, it would fail to correctly implement
C/C++11 [26]. The proof of this involves considering each entry in the mapping, weakening
it, and observing some new relaxed behaviour that should be forbidden.
For example, consider two of the cases in the mapping in the context of the examples
above. First, if we remove the dependency from the implementation of consume atomics,
then we enable read-side speculation in the message-passing example, and we allow the
relaxed behaviour. Second, if we swap the sync for an lwsync in the implementation of
SC loads, then we would be able to see IRIW behaviour in the example above.
7.2.2 Overview of the formal proof
The proof of correctness of the Power mapping (primarily the work of Sarkar and Memarian)
has a similar form to the x86 result at the highest level, but the details are rather
different. The Power model is an abstract machine, comprising a set of threads that
communicate with a storage subsystem. In Chapter 2 the role of each component was explained:
the threads enable speculation of read values, and the storage subsystem models
the propagation of values throughout the processor.
Write request
Read request
Barrier request
Thread
Read response
Barrier ack
Thread
Storage Subsystem