CON02-C. Do not use volatile as a synchronization primitive

The C Standard, section 5.1.2.3, paragraph 2 [ISO/IEC 9899:2011], says,

Accessing a volatile object, modifying an object, modifying a file, or calling a function that does any of those operations are all side effects, which are changes in the state of the execution environment. Evaluation of an expression in general includes both value computations and initiation of side effects. Value computation for an lvalue expression includes determining the identity of the designated object.

In a nutshell, all this keyword does is inform the compiler that this variable may change in ways that cannot be determined; consequently, the compiler should not perform optimizations in memory areas marked as volatile. For example, the compiler should not store the value in a register and use the register instead of accessing expensive memory directly. This concept is closely related to multithreading because if a shared variable is cached, a thread may change it, and the other threads may consequently read stale data.

This property of the volatile keyword is sometimes misunderstood to provide atomicity of a variable that is shared between threads in a multithreaded program. A variable declared as volatile is not cached in a register, leading to the misunderstanding that it can be used safely as a synchronization primitive. When a variable is declared volatile, the compiler does not reorder the sequence of reads and writes to that memory location. However, the compiler might reorder these reads and writes with those to other memory locations. Reordering might result in nonatomic operations on the synchronization variable, causing errors. Do not assume that the volatile qualifier provides any of the following desired properties necessary for a multithreaded program:

• Atomicity: Indivisible memory operations.
• Visibility: The effects of a write action by a thread are visible to other threads.
• Ordering: Sequences of memory operations by a thread are guaranteed to be seen in the same order by other threads.

The volatile qualifier provides no guarantees for any of these properties, either by definition or by the way it is implemented in various platforms. For more information on how volatile is implemented, consult DCL17-C. Beware of miscompiled volatile-qualified variables.

Noncompliant Code Example

This noncompliant code example uses flag as a synchronization primitive:

bool flag = false;

void test() {
  while (!flag) {
    sleep(1000);
  }
}

void wakeup(){
  flag = true;
}

void debit(unsigned int amount){
  test();
  account_balance -= amount;
}

In this example, the value of flag is used to determine whether the critical section can be executed. Because the flag variable is not declared volatile, it may be cached in registers. Before the value in the register is written to memory, another thread might be scheduled to run, resulting in that thread reading stale data.

Noncompliant Code Example

This noncompliant code example uses flag as a synchronization primitive but qualifies flag as a volatile type:

volatile bool flag = false;

void test() {
  while (!flag){
    sleep(1000);
  }
}

void wakeup(){
  flag = true;
}

void debit(unsigned int amount) {
  test();
  account_balance -= amount;
}

Declaring flag as volatile solves the problem of values being cached, which causes stale data to be read. However, volatile flag still does not provide atomicity guarantees needed for synchronization primitives to work correctly. The volatile keyword does not promise to provide the guarantees needed for synchronization primitives.

Compliant Solution

This code uses a mutex to protect critical sections:

#include <threads.h>

int account_balance;
mtx_t flag;

/* Initialize flag */

void debit(unsigned int amount) {
  mtx_lock(&flag);
  account_balance -= amount; /* Inside critical section */
  mtx_unlock(&flag);
}

Risk Assessment

Related Guidelines

Bibliography