DCL17-C. Beware of miscompiled volatile-qualified variables

As described in-depth in [DCL34-C. Use volatile for data that cannot be cached], a volatile-qualified variable "shall be evaluated strictly according to the rules of the abstract machine" [[ISO/IEC 9899:1999]].  In other words, the volatile qualifier is used to instruct the compiler to not make caching optimizations about a variable.

However, as demonstrated in [[Eide and Regehr]], all tested compilers generated some percentage of incorrect compiled code with regards to volatile accesses.  Therefore, it is necessary to know how your compiler behaves when the standard volatile behavior is required.  There is also a workaround that eliminates some or all of these errors [[Eide and Regehr]].

Incorrectly-compiled Code Example

As demonstrated in [[Eide and Regehr]], the following code example compiles incorrectly using GCC version 4.3.0 for IA32 and the -Os optimization flag:

const volatile int x;
volatile int y;
void foo(void) {
    for(y = 0; y < 10; y++) {
        int z = x;
    }
}

Because the variable x is volatile-qualified, it should be accessed ten times in this program.  However, as shown in the compiled object code, it is only accessed once due to a loop-hoisting optimization [[Eide and Regehr]]:

foo:
    movl $0, y
    movl x, %eax
    jmp .L2
.L3:
    movl y, %eax
    incl %eax
    movl %eax, y
.L2:
    movl y, %eax
    cmpl $10, %eax
    jg .L3
    ret

Should x represent a hardware register or some other memory-mapped device that has side effects when accessed, the previous miscompiled code example may produce unexpected behavior.

Workaround Code Example

Eide and Regehr tested a workaround by wrapping volatile accesses with function calls.  They describe it with the intuition that "we can replace an action that compilers empirically get wrong by a different action — a function call — that compilers can get right" [[Eide and Regehr]]. For example, consider the following code example that could be miscompiled:

volatile x;
x = x;

To work around some of the volatile-access compiler bugs, wrap both accesses to x in function calls [[Eide and Regehr]]:

int vol_read_int(volatile int *vp) {
    return *vp;
}
volatile int *vol_id_int(volatile int *vp) {
    return vp;
}

volatile x;
x = x;

*vol_id_int(&x) = vol_read_int(&x);

The workarounds proposed in [[Eide and Regehr]] fix many of the volatile-access bugs in the tested compilers.  However, compilers are always changing so critical sections of code should be compiled as if for deployment and the compiled object code should be inspected for the correct behavior.

Risk Assesment

The volatile qualifier should be used with caution in mission-critical situations. Always make sure that code that assumes certain behavior when using the volatile qualifier is inspected at the object code level for compiler bugs.

References

[[Eide and Regehr]] "Volatiles Are Miscompiled, and What to Do about It"
[[ISO/IEC 9899:1999]] Section 6.7.3, "Type qualifiers"