1. Pattern-based Synthesis of Synchronization for the C++ Memory Model Yuri Meshman, Noam Rinetzky, Eran Yahav 1

2. Goal 2 SynSynCpp P P S S

3. Thread 1: store (flag1, 1); while(load (flag0) = 1 ){ if(load (turn) = 0 ){ store (flag1, 0); while(load (turn) = 0 )yield(); store (flag1, 1); }... // critical section store (turn, 0); store(flag1, 0); store (flag0, 0); store (flag1, 0); store (turn, 0); Thread 0: store(flag0, 1); while(load (flag1) = 1 ){ if(load (turn) =1 ){ store (flag0, 0); while(load (turn) = 1 ) yield(); store (flag0, 1); } }... // critical section store (turn, 1); store (flag0, 0); Dekker’s Algorithm sequential consistency Yes spec: mutual exclusion over critical section 3

4. Thread 1: store (flag1, 1); while(load (flag0) = 1 ){ if(load (turn) = 0 ){ store (flag1, 0); while(load (turn) = 0 )yield(); store (flag1, 1); }... // critical section store (turn, 0); store(flag1, 0); store (flag0, 0); store (flag1, 0); store (turn, 0); Thread 0: store(flag0, 1); while(load (flag1) = 1 ){ if(load (turn) =1 ){ store (flag0, 0); while(load (turn) = 1 ) yield(); store (flag0, 1); } }... // critical section store (turn, 1); store (flag0, 0); Dekker’s Algorithm sequential consistency C++ relaxed model Yes No rf spec: mutual exclusion over critical section 4

5. Thread 1: store SC (flag1, 1); while(load SC (flag0) = 1 ){ if(load SC (turn) = 0 ){ store RLX (flag1, 0); while(load RLX (turn) = 0 )yield(); store RLX (flag1, 1); }... // critical section store SC (turn, 0); store REL (flag1, 0); store SC (flag0, 0); store SC (flag1, 0); store SC (turn, 0); Thread 0: store SC (flag0, 1); while(load SC (flag1) = 1 ){ if(load SC (turn) =1 ){ store RLX (flag0, 0); while(load RLX (turn) = 1 ) yield(); store RLX (flag0, 1); } }... // critical section store SC (turn, 1); store REL (flag0, 0); Dekker’s Algorithm sequential consistency C++ relaxed model Yes No spec: mutual exclusion over critical section 5 Yes

6. In a nutshell Goal Automatic inference of efficient and correct synchronization under C++ memory model. finite-state programs with bounded executions. Challenge Adding minimal and correct synchronization. Solution 1.Assume maximally relaxed parameters setting and 2.Iteratively remove behaviors until specification satisfied. 6

7. Dekker’s Algorithm 7 Thread 1: store RLX (flag1, 1); while(load RLX (flag0) = 1 ){ if(load RLX (turn) = 0 ){ store RLX (flag1, 0); while(load RLX (turn) = 0 )yield(); store RLX (flag1, 1); }... // critical section store RLX (turn, 0); store REL (flag1, 0); store RLX (flag0, 0); store RLX (flag1, 0); store RLX (turn, 0); Thread 0: store RLX (flag0, 1); while(load RLX (flag1) = 1 ){ if(load RLX (turn) =1 ){ store RLX (flag0, 0); while(load RLX (turn) = 1 ) yield(); store RLX (flag0, 1); } }... // critical section store RLX (turn, 1); store RLX (flag0, 0); store flag0, 0 store flag1, 0 store turn, 0 store flag0, 1 load flag1 store flag1, 1 store turn, 1 load flag0 sb asw store flag1, 0store flag0, 0 sb rf store turn, 0 sb critical section

8. What is an execution Execution trace is: – Instructions – relations: total/partial orders – Axioms on those relations 8 store flag0, 0 store flag1, 0 store turn, 0 store flag0, 1 load flag1 store flag1, 1 store turn, 1 load flag0 sb asw store flag1, 0store flag0, 0 sb rf store turn, 0 sb critical section *rf – read from sb – sequence before asw – additionally synchronize with sw – synchronize with

9. Error trace 1  find pattern LB *rf – read from sb – sequence before asw – additionally synchronize with sw – synchronize with 9 store flag0, 0 store flag1, 0 store turn, 0 store flag0, 1 load flag1 store flag1, 1 store turn, 1 load flag0 sb asw store flag1, 0store flag0, 0 sb rf store turn, 0 sb critical section load buffering

10. 10 Error trace 1 prevented store flag0, 0 store flag1, 0 store turn, 0 store flag0, 1 load ACQ flag1 store flag1, 1 store turn, 1 load flag0 sb asw store REL flag1, 0store flag0, 0 sb rf store turn, 0 sb critical section sw *rf – read from sb – sequence before asw – additionally synchronize with sw – synchronize with

11. Dekker’s Algorithm sequential consistency C++ relaxed model Yes No spec: mutual exclusion over critical section 11 Thread 1: store RLX (flag1, 1); while(load RLX (flag0) = 1 ){ if(load RLX (turn) = 0 ){ store RLX (flag1, 0); while(load RLX (turn) = 0 )yield(); store RLX (flag1, 1); }... // critical section store RLX (turn, 0); store REL (flag1, 0); store RLX (flag0, 0); store RLX (flag1, 0); store RLX (turn, 0); Thread 0: store RLX (flag0, 1); while(load ACQ (flag1) = 1 ){ if(load RLX (turn) =1 ){ store RLX (flag0, 0); while(load RLX (turn) = 1 ) yield(); store RLX (flag0, 1); } }... // critical section store RLX (turn, 1); store RLX (flag0, 0);

12. Thread 1: store SC (flag1, 1); while(load SC (flag0) = 1 ){ if(load SC (turn) = 0 ){ store RLX (flag1, 0); while(load RLX (turn) = 0 )yield(); store RLX (flag1, 1); }... // critical section store SC (turn, 0); store REL (flag1, 0); store SC (flag0, 0); store SC (flag1, 0); store SC (turn, 0); Thread 0: store SC (flag0, 1); while(load SC (flag1) = 1 ){ if(load SC (turn) =1 ){ store RLX (flag0, 0); while(load RLX (turn) = 1 ) yield(); store RLX (flag0, 1); } }... // critical section store SC (turn, 1); store REL (flag0, 0); Dekker’s Algorithm sequential consistency C++ relaxed model Yes No spec: mutual exclusion over critical section 12 Yes

13. Goal 13 SynSynCpp P P S S

14. Synthesis of Synchronization for the C++ Memory Model 14 SynSynCpp P P S S Model Checker Detect patterns and avoid traces implement

15. Challenges 1.ModelChecker: Enumerate error traces? 2.How to detect patterns and avoid traces? 3.How to collect all blocked bad traces and produce a solution? 15 CDSchecker

16. Step 1: Get an error trace 16 store flag0, 0 store flag1, 0 store turn, 0 store flag0, 1 load flag1 store flag1, 1 store turn, 1 load flag0 sb asw store flag1, 0store flag0, 0 sb rf store turn, 0 sb critical section

17. Step 2: Find a pattern 17 load flag1 load flag0 store flag1, 0store flag0, 0 sb rf sb Load Buffering pattern

18. 18 Step 3: block the pattern repeat 1-3 for all error traces Load Buffering pattern REL -- store flag0, 1 ACQ -- load flag1 REL -- store flag1, 1 ACQ -- load flag0

19. 19 REL -- store flag0, 1 ACQ -- load flag1 REL -- store flag1, 1 ACQ -- load flag0

20. Step 5: Constructing Program Solution 20 sol1 sol2 REL -- store flag0, 1 ACQ -- load flag1 REL -- store flag1, 1 ACQ -- load flag0

21. Litmus test patterns First approach: From litmus tests to patterns 21 (Store Buffering) (Message Passing) (Write Read Causality) (Independent Reads Independent Writes) (Load Buffering)

22. Patterns relaxation 22 (Load Buffering) Unwinding the cycle Abstraction Generalization

23. Abstract patterns 23 RD_CL RD_MS Missed Store based on C++RMM RD property Cycle R one of two: 1.R = hb U rf --- preventable with Rel-Acq synchronization 2.R = possible order of instruction – preventable with SC

24. Benchmarks 9 concurrent algorithms – Mutual exclusion algorithms – RCU where an update waits only for the reads whose consistency it affects Safety specifications – mutual exclusion and reachability invariants – stack/RCU coherence invariants 24

25. Results 25 Algorithm Time (s) # mini mal soluti ons Inferred synchronization (SC, REL, ACQ, RLX) abp20s.895(5, 0, 0, 1), (4, 0, 0, 2), … dekker3m:2213(10, 1, 0, 8), (13, 0, 1, 5), … d-prcu-v13m:147(7, 2, 1, 0), (7, 1, 0, 2), … d-prcu-v23h:53m17(9, 2, 1, 4), (12, 1, 1, 2),... Kessel57m:162(13, 1, 0, 0), (14, 0, 0, 0) peterson26m:412(11, 1, 0, 1), *(12, 1, 0, 0), (13, 0, 0, 0) bakery10m:216(16, 1, 1, 0), (17, 0, 1, 0), … ticket1m:084(9, 0, 0, 1), (8, 0, 0, 2), … treiber stack1h:051(0, 5, 3, 4) SC RLX ACQREL Memory access patterns hierarchy

26. Synthesis of Synchronization for the C++ Memory Model 26 SynSynCpp P P S S Model Checker Detect patterns and avoid traces implement avoidance

27. Summary Synthesis procedure for inferring memory order synchronizations for C++ RMM Searching for violation patterns Generalized concrete patterns to abstract ones Successfully synthesized nontrivial memory order synchronization for challenging algorithms Future Work: Violation patterns and avoidance templates are not complete Finite-state programs with bounded executions. 27 Tool: http://www.cs.technion.ac.il/~yurime/SynSynCpp/SynSynCppTool_v1stat.htmhttp://www.cs.technion.ac.il/~yurime/SynSynCpp/SynSynCppTool_v1stat.htm