The C11 and C++11 Concurrency Model

223
to y, the conditional in the right-hand thread is never satisfied, and the write it guards
never executes.
Now consider the execution of the client composed with the implementation drawn on
the right above. This execution features load-buffering style relaxed behaviour where each
load reads from a future write on the other thread. In this execution, the library-internal
load of x reads from the client’s write of x, violating safety. This example shows that
for a given client, we cannot establish safety of the implementation as a consequence of
safety of the specification.
It is easy to recognise the client as a potentially unsafe one in the example above
because syntactically it contains an access of the library-internal variable x. The same
sort of behaviour can be observed with a client that acts on an address that is decided
dynamically, so that the potential safety violation would not be so easily identified.
In the formulation of the abstraction theorem, this example forces us to require safety
of the client composed with the specification as well as non-interference of the client
composed with the implementation:
Theorem 21 (Abstraction). Assume that (L 1 ,I 1 ), (L 2 ,I 2 ), (C(L 2 ),I ⊎ I 2 ) are safe,
(C(L 1 ),I⊎I 1 ) is non-interfering and (L 1 ,I 1 ) ⊑ (L 2 ,I 2 ). Then (C(L 1 ),I⊎I 1 ) is safe and
client(C(L 1 )(I ⊎I 1 )) ⊆ client(C(L 2 )(I ⊎I 2 )).
The unfortunate requirement for non-interference of the implementation in the abstraction
theorem is an important limitation of the C/C++11 memory model design. It
means that we cannot alleviate the complexity of the relaxed memory model by encapsulating
part of the program in a library and then providing a simple specification. The
programmer will always have to establish that their program is non-interfering according
to the C/C++11 memory model with the library implementation.
The problematic example was a consequence of the presence of self-satisfying conditional
executions: we placed a safety violation in the guarded block on each thread so that
the violations only occurred when self satisfying behaviour was witnessed. If the memory
model forbade self satisfying conditionals (this is difficult to ensure, see Chapter 5 for
details), then the client presented above would be safe. Moreover, we would not need to
check that (C(L 1 ),I ⊎I 1 ) is non-interfering because, after restricting dependency cycles,
any incidence of interference that remained allowed would be a safety violation of either
(L 1 ,I 1 ) or (C(L 2 ),I ⊎ I 2 ). This new restriction in the model would make the language
compositional.
8.3 Abstraction in the Treiber stack
This section presents an overview of the proof of safety, non-interference and abstraction
for the specification and implementation of the Treiber stack. The full proof can be found
in the paper [25]. The proof relies on a derived total order,