The C11 and C++11 Concurrency Model

22
by Dubois et al. [48]. C/C++11 coherence matches the coherence property of Censier
and Feautrier [42] The compare and swap feature of C/C++11 follows the IBM 370 instruction
[44]. C/C++11 provides racy programs with undefined behaviour, a concept
borrowed from Adve, Gharachorloo and Hill [12, 10, 11] who defined memory models with
stronger guarantees for race-free programs. The C/C++11 memory model builds upon a
simple precursor model, defined by Boehm and Adve [37], who expressed the high-level
design intent of the memory model (that race-free programs using only the SC atomics
should behave in an SC manner), and proved this property of their memory model.
The C/C++11 memory model is expressed in an axiomatic style: the model is made
up of a predicate that decides whether a particular whole execution is allowed for a
given program, or not. There are several examples of early axiomatic memory models, by
Collier [43], by Kohli et al. [13], and by Adve et al. [12, 10]. Contrast this with operational
memory models, where the model is described as an abstract machine, with a state made
up of buffers and queues. Many formal hardware memory models adopt the operational
style [97, 71, 99, 91, 104], because hardware architecture specifications are often described
in terms of an abstract machine.
Therearemanyformalmemorymodelsofhardwarearchitectures. Sarkaretal. created
an operational formalisation of the x86 architecture’s memory model [99], following the
incomplete and ambiguous published specification documents of the time. This model
was superseded by the operational x86-TSO model of Owens et al. [91, 104], which is easy
to understand and is validated both by discussion with Intel and by hardware testing. We
describe this model in Chapter 2, and refer to it throughout this thesis. In a suggested
extensiontothearchitecture, Rajarametal. proposeahardware-optimisedversionofC11
read-modify-write operations on x86, including an alternative compilation scheme that
preserves the semantics of the language over systems using the optimised variants [93].
For the x86-TSO memory model, Owens provides a stronger alternative to the typical
SC-if-data-race-free guarantee, introducing triangular-race-freedom [89].
There are several formal Power memory models to note. Chapter 2 outlines the operational
model of Sarkar et al. [97, 71] that was developed together with Williams, a
leading processor designer at IBM, and was systematically tested against hardware. This
model can claim to match the architectural intent of the vendor. The axiomatic models
of Alglave et al. [14] are informed by systematic testing of hardware, with tests generated
by the Diy tool [16], executed on current hardware with the Litmus tool [17], and
executed according to the model with the Herd tool [18]. This systematic testing led
to the discovery of a bug in the Power 5 architecture [16]. Mador-Haim et al. present
an axiomatic model [68] that is intended to be abstract and concise, while matching the
relatively intricate model of Sarkar et al.
There is an earlier body of work on the Java memory model (JMM), another relaxedmemory
language, with a rather different design (discussed in Section 5.10.3). Manson
et al. provided a formal description of the official JMM [70]. Cenciarelli et al. provided a