A Better x86 Memory Model: x86-TSO

Abstract

Abstract. Real multiprocessors do not provide the sequentially consistent memory that is assumed by most work on semantics and verification. Instead, they have relaxed memory models, typically described in ambiguous prose, which lead to widespread confusion. These are prime targets for mechanized formalization. In previous work we produced a rigorous x86-CC model, formalizing the Intel and AMD architecture specifications of the time, but those turned out to be unsound with respect to actual hardware, as well as arguably too weak to program above. We discuss these issues and present a new x86-TSO model that suffers from neither problem, formalized in HOL4. We believe it is sound with respect to real processors, reflects better the vendor's intentions, and is also better suited for programming. We give two equivalent definitions of x86-TSO: an intuitive operational model based on local write buffers, and an axiomatic total store ordering model, similar to that of the SPARCv8. Both are adapted to handle x86-specific features. We have implemented the axiomatic model in our memevents tool, which calculates the set of all valid executions of test programs, and, for greater confidence, verify the witnesses of such executions directly, with code extracted from a third, more algorithmic, equivalent version of the definition.

Generating Litmus Tests for Contrasting Memory Consistency Models

“…Many studies describe tools for testing litmus tests on a formally specified memory model [10,20,21,23,24]. Given a parallel program and an expected outcome, these tools report whether the specified outcome is feasible on a specified memory model.…”

“…Given a parallel program and an expected outcome, these tools report whether the specified outcome is feasible on a specified memory model. Most of these tools test for one outcome at a time [10,20,23,24]. Park and Dill [21] presented a tool that enabled exploring all outcomes for a given parallel program using an operational specification for RMO.…”

“…This work finds a refinement map between the two models via model-checking and uses an intermediate abstraction that exploit structural similarities between the two models to facilitate the proof. Other studies [10,20] use theorem proving to prove equivalence between an operational and axiomatic specification of the same model.…”

Context-Bounded Analysis for POWER

“…For instance, while TSO allows reordering stores past loads (of different addresses/variables) reflecting the use of store buffers, a model such as POWER allows reordering of all kinds of store and load operations under quite subtle conditions. A lot of work has been devoted to the definition of formal models that accurately capture the program semantics corresponding to models such as TSO and POWER [35,32,30,34,11]. Still, programming against weak memory models is a hard and error prone task.…”

Getting Rid of Store-Buffers in TSO Analysis

“…Loads from a variable for which there is a store operation in the buffer gets the value of the last of such operation. The TSO model is in some sense the kernel of many common weak memory models [15,19].…”