[Paper Review] Checking Robustness against TSO

Ahmed Bouajjani, Egor Derevenetc+1 more|arXiv (Cornell University)|Aug 30, 2012

Formal Methods in Verification25 references3 citations

TL;DR

This paper presents a source-to-source transformation that reduces the problem of checking trace-robustness against the Total Store Ordering (TSO) memory model to state reachability under Sequential Consistency (SC). By characterizing non-robustness via 'attacks'—specific reordering of load and store instructions—the method enables precise, scalable verification using SC model checkers, with applications to decidability and optimal fence insertion for robustness.

ABSTRACT

We present algorithms for checking and enforcing robustness of concurrent programs against the Total Store Ordering (TSO) memory model. A program is robust if all its TSO computations correspond to computations under the Sequential Consistency (SC) semantics. We provide a complete characterization of non-robustness in terms of so-called attacks: a restricted form of (harmful) out-of-program-order executions. Then, we show that detecting attacks can be parallelized, and can be solved using state reachability queries under SC semantics in a suitably instrumented program obtained by a linear size source-to-source translation. Importantly, the construction is valid for an arbitrary number of addresses and an arbitrary number of parallel threads, and it is independent from the data domain and from the size of store buffers in the TSO semantics. In particular, when the data domain is finite and the number of addresses is fixed, we obtain decidability and complexity results for robustness, even for an arbitrary number of threads. As a second contribution, we provide an algorithm for computing an optimal set of fences that enforce robustness. We consider two criteria of optimality: minimization of program size and maximization of its performance. The algorithms we define are implemented, and we successfully applied them to analyzing and correcting several concurrent algorithms.

Motivation & Objective

• Address the challenge of verifying whether concurrent programs remain behaviorally equivalent under TSO and SC semantics.
• Provide a precise, scalable algorithm to detect non-robustness caused by store-to-load reordering in TSO.
• Enable the synthesis of optimal fence placements to enforce robustness, minimizing performance impact and code size.
• Overcome limitations of prior testing-based or over-approximate static analysis methods that cannot prove robustness or insert fences optimally.
• Support general concurrent programs with arbitrary numbers of threads, shared variables, and data domains, independent of store buffer size.

Proposed method

• Introduce the concept of 'attacks'—a pair of load and store instructions whose reordering leads to non-SC behavior under TSO.
• Define a linear-size source-to-source transformation that instruments the program to encode potential attacks as reachability queries under SC semantics.
• Reduce the TSO robustness problem to standard SC state reachability, enabling use of existing SC verification tools.
• Construct a witness computation for each feasible attack to ensure soundness and completeness of the reduction.
• Use the same instrumentation to compute optimal fence sets by solving reachability queries under SC with constraints on fence placement.
• Support both minimization of program size and maximization of performance as optimization criteria for fence insertion.

Experimental results

Research questions

• RQ1 Can we precisely check whether a concurrent program is robust under TSO, i.e., whether all TSO executions correspond to some SC execution?
• RQ2 How can we characterize and detect harmful out-of-order executions (attacks) that lead to non-SC behaviors in TSO?
• RQ3 Can we reduce the TSO robustness problem to a standard SC reachability problem in a way that is both sound and complete?
• RQ4 What is the optimal set of memory fences to insert such that the resulting program is robust, while minimizing code bloat or maximizing performance?
• RQ5 Under what conditions is TSO robustness decidable, and what is its complexity in the general case?

Key findings

• The proposed reduction transforms TSO robustness checking into SC state reachability, enabling precise verification using existing SC model checkers.
• The method is sound and complete for detecting non-robustness via attacks, with no false positives or negatives.
• For finite data domains and a fixed number of shared variables, robustness is decidable and PSpace-complete, even with unbounded store buffers and arbitrary thread counts.
• The source-to-source transformation is linear in size and independent of data domain size and buffer capacity.
• The fence insertion algorithm produces optimal solutions under two criteria: minimizing program size and maximizing performance.
• The approach has been implemented and successfully applied to verify and correct real concurrent algorithms, demonstrating practicality and scalability.