A Better x86 Memory Model: x86-TSO

  • Scott Owens
  • Susmit Sarkar
  • Peter Sewell
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5674)


Real multiprocessors do not provide the sequentially consistent memory that is assumed by most work on semantics and verification. Instead, they have relaxed memory models, typically described in ambiguous prose, which lead to widespread confusion. These are prime targets for mechanized formalization. In previous work we produced a rigorous x86-CC model, formalizing the Intel and AMD architecture specifications of the time, but those turned out to be unsound with respect to actual hardware, as well as arguably too weak to program above. We discuss these issues and present a new x86-TSO model that suffers from neither problem, formalized in HOL4. We believe it is sound with respect to real processors, reflects better the vendor’s intentions, and is also better suited for programming. We give two equivalent definitions of x86-TSO: an intuitive operational model based on local write buffers, and an axiomatic total store ordering model, similar to that of the SPARCv8. Both are adapted to handle x86-specific features. We have implemented the axiomatic model in our memevents tool, which calculates the set of all valid executions of test programs, and, for greater confidence, verify the witnesses of such executions directly, with code extracted from a third, more algorithmic, equivalent version of the definition.


Event Structure Memory Model Abstract Machine Memory Order Actual Processor 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    AMD64 Architecture Programmer’s Manual (3 vols). Advanced Micro Devices, rev. 3.14 (September 2007)Google Scholar
  2. 2.
    Intel 64 and IA-32 Architectures Software Developer’s Manual (5 vols). Intel Corporation, rev. 29 (November 2008)Google Scholar
  3. 3.
    Adve, S., Gharachorloo, K.: Shared memory consistency models: A tutorial. IEEE Computer 29(12), 66–76 (1996)CrossRefGoogle Scholar
  4. 4.
    Ahamad, M., Neiger, G., Burns, J., Kohli, P., Hutto, P.: Causal memory: Definitions, implementation, and programming. Distributed Computing 9(1), 37–49 (1995)MathSciNetCrossRefGoogle Scholar
  5. 5.
    Aspinall, D., Ševčík, J.: Formalising Java’s data race free guarantee. In: Schneider, K., Brandt, J. (eds.) TPHOLs 2007. LNCS, vol. 4732, pp. 22–37. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  6. 6.
    Boehm, H.-J., Adve, S.: Foundations of the C++ concurrency memory model. In: Proc. PLDI (2008)Google Scholar
  7. 7.
    Boudol, G., Petri, G.: Relaxed memory models: an operational approach. In: Proc. POPL, pp. 392–403 (2009)Google Scholar
  8. 8.
    Burckhardt, S., Musuvathi, M.: Effective program verification for relaxed memory models. Technical Report MSR-TR-2008-12, Microsoft Research (2008); Gupta, A., Malik, S. (eds.) CAV 2008. LNCS, vol. 5123, pp. 107–120. Springer, Heidelberg (2008)Google Scholar
  9. 9.
    Dice, D.: Java memory model concerns on Intel and AMD systems (January 2008),
  10. 10.
    Hangal, S., Vahia, D., Manovit, C., Lu, J.-Y.J., Narayanan, S.: TSOtool: A program for verifying memory systems using the memory consistency model. In: Proc. ISCA, pp. 114–123 (2004)Google Scholar
  11. 11.
    The HOL 4 system,
  12. 12.
    Intel. Intel 64 architecture memory ordering white paper. SKU 318147-001 (2007)Google Scholar
  13. 13.
    Higham, L., Kawash, J., Verwaal, N.: Defining and comparing memory consistency models. PDCS, Full version as TR #98/612/03, U. Calgary (1997)Google Scholar
  14. 14.
    Loewenstein, P.: Personal communication (November 2008)Google Scholar
  15. 15.
    Loewenstein, P.N., Chaudhry, S., Cypher, R., Manovit, C.: Multiprocessor memory model verification. In: Proc. AFM (Automated Formal Methods), FLoC workshop (August 2006),
  16. 16.
    Owens, S., Sarkar, S., Sewell, P.: A better x86 memory model: x86-TSO (extended version). Technical Report UCAM-CL-TR-745, Univ. of Cambridge (2009), Supporting material at,
  17. 17.
    Roy, A., Zeisset, S., Fleckenstein, C.J., Huang, J.C.: Fast and generalized polynomial time memory consistency verification. In: Ball, T., Jones, R.B. (eds.) CAV 2006. LNCS, vol. 4144, pp. 503–516. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  18. 18.
    Saraswat, V., Jagadeesan, R., Michael, M., von Praun, C.: A theory of memory models. In: Proc. PPoPP (2007)Google Scholar
  19. 19.
    Sarkar, S., Sewell, P., Zappa Nardelli, F., Owens, S., Ridge, T., Braibant, T., Myreen, M., Alglave, J.: The semantics of x86-CC multiprocessor machine code. In: Proc. POPL 2009 (January 2009)Google Scholar
  20. 20.
    Sindhu, P.S., Frailong, J.-M., Cekleov, M.: Formal specification of memory models. In: Scalable Shared Memory Multiprocessors, pp. 25–42. Kluwer, Dordrecht (1991)Google Scholar
  21. 21.
    SPARC International, Inc. The SPARC architecture manual, v. 8. Revision SAV080SI9308 (1992),
  22. 22.
    Yang, Y., Gopalakrishnan, G., Lindstrom, G., Slind, K.: Nemos: A framework for axiomatic and executable specifications of memory consistency models. In: IPDPS (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Scott Owens
    • 1
  • Susmit Sarkar
    • 1
  • Peter Sewell
    • 1
  1. 1.University of CambridgeUK

Personalised recommendations