C++ Concurrency - Formalised

Transcription

1 C++ Concurrency - Formalised Salomon Sickert Technische Universität München 26 th April 2013

2 Mutex Algorithms At most one thread is in the critical section at any time. 2 / 35

3 Dekker s Mutex Algorithm [2] Initialisation 1 x = 0; y = 0; Thread 1 1 x = 1; 2 if (y == 1) { 3... //Busy Wait 4 } 5 // Critical Section Thread 2 1 y = 1; 2 if (x == 1) { 3... //Busy Wait 4 } 5 // Critical section 3 / 35

4 Dekker s Mutex Algorithm [2] Initialisation 1 x = 0; y = 0; Thread 1 1 x = 1; 2 if (y == 1) { 3... //Busy Wait 4 } 5 // Critical Section Thread 2 1 y = 1; 2 if (x == 1) { 3... //Busy Wait 4 } 5 // Critical section 1 MOV [x] <- 1 2 MOV r1 <- [y] 1 MOV [y] <- 1 2 MOV r2 <- [x] 3 / 35

5 Modern x86 Multiprocessors - simplified (based on [4]) r1 r2 r1 r2 H/W Thread 1 H/W Thread 2 Shared Memory 4 / 35

6 Modern x86 Multiprocessors - simplified r1 r2 r1 r2 H/W Thread 1 H/W Thread 2 Write B. Write B. Shared Memory 5 / 35

7 Modern x86 Multiprocessors and Dekker s Algorithm - - H/W Thread H/W Thread x = 0, y = 0 6 / 35

8 Modern x86 Multiprocessors and Dekker s Algorithm - - H/W Thread H/W Thread 2 x = 1 - x = 0, y = 0 7 / 35

9 Modern x86 Multiprocessors and Dekker s Algorithm - - H/W Thread H/W Thread 2 x = 1 y = 1 x = 0, y = 0 8 / 35

10 Modern x86 Multiprocessors and Dekker s Algorithm r1 = 0 - H/W Thread H/W Thread 2 x = 1 y = 1 x = 0, y = 0 9 / 35

11 Modern x86 Multiprocessors and Dekker s Algorithm r1 = 0 - H/W Thread 1 - r2 = 0 H/W Thread 2 x = 1 y = 1 x = 0, y = 0 10 / 35

12 Modern x86 Multiprocessors Both threads may enter the critical section at the same time! 11 / 35

13 Modern x86 Multiprocessors Both threads may enter the critical section at the same time! Due to write buffers threads may see a subtly different memory. 11 / 35

14 Modern x86 Multiprocessors Both threads may enter the critical section at the same time! Due to write buffers threads may see a subtly different memory. The processor exhibits a relaxed memory model. 11 / 35

15 Modern x86 Multiprocessors Both threads may enter the critical section at the same time! Due to write buffers threads may see a subtly different memory. The processor exhibits a relaxed memory model. Solutions: Assembler: FENCE instructions. C++11: Special types. (Atomics) 11 / 35

16 Modern x86 Multiprocessors Both threads may enter the critical section at the same time! Due to write buffers threads may see a subtly different memory. The processor exhibits a relaxed memory model. Solutions: Assembler: FENCE instructions. C++11: Special types. (Atomics) Sequential consistency is restored by paying a performance penalty. 11 / 35

17 Modern x86 Multiprocessors Both threads may enter the critical section at the same time! Due to write buffers threads may see a subtly different memory. The processor exhibits a relaxed memory model. Solutions: Assembler: FENCE instructions. C++11: Special types. (Atomics) Sequential consistency is restored by paying a performance penalty. Some Non-x86 architectures exhibit even weaker models, e.g ARM. 11 / 35

18 Mathematizing C++ Concurrency ([3]) Given a program p, what are the possible ways to execute it? 12 / 35

19 Mathematizing C++ Concurrency ([3]) Given a program p, what are the possible ways to execute it? 1. Calculate X opsem from p. Loosely speaking: Structure of the program. 12 / 35

20 Mathematizing C++ Concurrency ([3]) Given a program p, what are the possible ways to execute it? 1. Calculate X opsem from p. Loosely speaking: Structure of the program. 2. Find all X witness consistent with X opsem. Loosely speaking: Different executions of the program. 12 / 35

21 Mathematizing C++ Concurrency ([3]) Given a program p, what are the possible ways to execute it? 1. Calculate X opsem from p. Loosely speaking: Structure of the program. 2. Find all X witness consistent with X opsem. Loosely speaking: Different executions of the program. 3. Check for undefined behaviour. Reading from uninitialized variables Unsequenced Races (e.g. x == (x = 2)) Data Races / 35

22 X opsem : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } 13 / 35

23 X opsem : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } e:w x=1 14 / 35

24 X opsem : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 15 / 35

25 X opsem : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 a:w a=1 c:r y=? b:r x=? d:w z=(x? == y?) 16 / 35

26 X opsem : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 a:w a=1 sb sb c:r y=? b:r x=? sb sb d:w z=(x? == y?) 17 / 35

27 X opsem : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 asw asw a:w a=1 sb sb c:r y=? b:r x=? sb sb d:w z=(x? == y?) 18 / 35

28 X opsem Independent from the architecture 19 / 35

29 X opsem Independent from the architecture Composed of (among other parts): Actions (simplified) aid : R l = v aid : W l = v 19 / 35

30 X opsem Independent from the architecture Composed of (among other parts): Actions (simplified) aid : R l = v aid : W l = v Binary relations: sequenced before (sb) additional synchronized with (asw) 19 / 35

31 X opsem Independent from the architecture Composed of (among other parts): Actions (simplified) aid : R l = v aid : W l = v Binary relations: sequenced before (sb) additional synchronized with (asw) In this special case: simple happens before = ( sequenced before ) additional synchronized with + 19 / 35

32 X witness : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 hb hb a:w a=1 hb hb c:r y=? b:r x=? hb hb d:w z=(x? == y?) 20 / 35

33 X witness : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 hb hb rf a:w a=1 hb hb c:r y=2 b:r x=? hb hb d:w z=(x? == 2) 21 / 35

34 X witness : An Example 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 hb hb rf a:w a=1 rf hb hb c:r y=2 b:r x=1 hb hb d:w z=0 22 / 35

35 X witness Dependent on the architecture 23 / 35

36 X witness Dependent on the architecture Composed of: Binary relations: reads from (rf) 23 / 35

37 X witness Dependent on the architecture Composed of: Binary relations: reads from (rf) sequentialconsistency (sc) (not applicable in the example) modificationorder (mo) (not applicable in the example) 23 / 35

38 X = (X opsem, X witness ) : An execution candidate 1 int main() { 2 int x, y, z, a; 3 {{{ x = 1; 4 y = 2; 5 }}}; 6 a = 1; 7 z = (x == y); 8 return 0; 9 } f:w y=2 e:w x=1 hb hb rf a:w a=1 rf hb hb c:r y=2 b:r x=1 hb hb d:w z=0 24 / 35

39 X = (X opsem, X witness ) : Undefined Behaviour? f:w y=2 e:w x=1 hb hb Uninitialised Reads? Unsequenced Races? Data Races? rf a:w a=1 rf hb hb c:r y=2 b:r x=1 hb hb d:w z=0 25 / 35

40 X = (X opsem, X witness ) : Undefined Behaviour? f:w y=2 e:w x=1 hb hb Uninitialised Reads? Unsequenced Races? Data Races? rf a:w a=1 rf hb hb c:r y=2 b:r x=1 hb hb d:w z=0 25 / 35

41 X = (X opsem, X witness ) : Undefined Behaviour? f:w y=2 e:w x=1 hb hb Uninitialised Reads? Unsequenced Races? Data Races? rf a:w a=1 rf hb hb c:r y=2 b:r x=1 hb hb d:w z=0 25 / 35

42 X = (X opsem, X witness ) : Undefined Behaviour? f:w y=2 e:w x=1 hb hb Uninitialised Reads? Unsequenced Races? Data Races? rf a:w a=1 rf hb hb c:r y=2 b:r x=1 hb hb d:w z=0 25 / 35

43 Undefined Behaviour: Data Races 1 int main() { 2 int x = 0; 3 {{{ x = 1; 4 x = 2; 5 }}}; 6 return x; 7 } c:w x=1 a:w x=0 asw asw b:r x=? asw d:w x=2 asw 26 / 35

44 Undefined Behaviour: Data Races 1 int main() { 2 int x = 0; 3 {{{ x = 1; 4 x = 2; 5 }}}; 6 return x; 7 } c:w x=1 a:w x=0 hb hb d:w x=2 hb hb b:r x=? 27 / 35

45 Undefined Behaviour: Data Races 1 int main() { 2 int x = 0; 3 {{{ x = 1; 4 x = 2; 5 }}}; 6 return x; 7 } c:w x=1 a:w x=0 hb hb dr d:w x=2 hb hb b:r x=? 28 / 35

46 The Formalised C++ Memory Model cpp_memory_model opsem (p : program) = let pre_executions = {(X opsem, X witness ) opsem p X opsem consistent_execution X opsem X witness } in if X pre_executions. undefined_behaviour X then NONE else SOME pre_executions 29 / 35

47 C++11 Concurrency / Language Features Concurrency Idioms (Atomics, Mutexes, Threads) 30 / 35

48 C++11 Concurrency / Language Features Concurrency Idioms (Atomics, Mutexes, Threads) Pre-C++11 No memory model for multi-threaded code Concurrency Idioms provided by a third party: pthreads OpenMP Drawbacks: No formalised standard, compiler may produce incorrect code. 30 / 35

49 C++11 Concurrency / Language Features Concurrency Idioms (Atomics, Mutexes, Threads) Pre-C++11 No memory model for multi-threaded code Concurrency Idioms provided by a third party: pthreads OpenMP Drawbacks: No formalised standard, compiler may produce incorrect code. C++11 A memory model for multi-threaded code Concurrency Idioms in are part of the language (std::atomic<t> [1], std::mutex, std::thread) Similar to Java Benefits: Compiler is able to produce correct code. 30 / 35

50 Applications of the Formal Memory Model Corrections to the C++0x standard. memory_order_seq_cst was in fact not sequentially consistent 31 / 35

51 Applications of the Formal Memory Model Corrections to the C++0x standard. memory_order_seq_cst was in fact not sequentially consistent Confidence in memory model and specification. 31 / 35

52 Applications of the Formal Memory Model Corrections to the C++0x standard. memory_order_seq_cst was in fact not sequentially consistent Confidence in memory model and specification. Verify correctness of prototype implementations. Figure: Figure taken from [3] 31 / 35

53 Applications of the Formal Memory Model Corrections to the C++0x standard. memory_order_seq_cst was in fact not sequentially consistent Confidence in memory model and specification. Verify correctness of prototype implementations. Developer support. 31 / 35 Figure: Figure taken from [3]

54 32 / 35 Questions?

55 Bonus: Atomics vs. Mutexes - short presentation 33 / 35

56 Bonus: Dekker s algorithm in CppMem 34 / 35

57 References C++ atomic types and operations, Dekker s algorithm, Mark Batty, Scott Owens, Susmit Sarkar, Peter Sewell, and Tjark Weber. Mathematizing c++ concurrency. SIGPLAN Not., 46(1):55 66, January Peter Sewell, Susmit Sarkar, Scott Owens, Francesco Zappa Nardelli, and Magnus O. Myreen. x86-tso: a rigorous and usable programmer s model for x86 multiprocessors. Commun. ACM, 53(7):89 97, July / 35