An Executable Formalisation of the SPARCv8 Instruction Set Architecture: A Case Study for the LEON3 Processor

Abstract

The SPARCv8 instruction set architecture (ISA) has been used in various processors for workstations, embedded systems, and space missions. However, there are no publicly available formal models for the SPARCv8 ISA. In this work, we give the first formal model for the integer unit of SPARCv8 ISA in Isabelle/HOL. We capture the operational semantics of the instructions using monadic definitions. Our model is a detailed model, which covers many features specific to SPARC processors, such as delayed-write for control registers, windowed general registers, and more complex memory access. Our model is also general, as we retain an abstract layer of the model which allows it to be instantiated to support all SPARCv8 compliant processors. We extract executable code from our formalisation, giving us the first systematically verified executable semantics for the SPARCv8 ISA. We have tested our model extensively against a LEON3 simulation board, covering both single-step executions and sequential execution of programs. We prove some important properties for our formal model, including a non-interference property for the LEON3 processor.

An Isabelle/HOL Formalisation of the SPARC Instruction Set Architecture and the TSO Memory Model

“…High-level ISA model and TSO model. The low-level ISA model was published at FM 2016 [28]. This journal paper extends the FM 2016 paper with two components: a high-level ISA model, which serves as the interface for memory operations, and two TSO memory models.…”

“…However, the current set of modelled ISA does not include any variance for the SPARC ISA. Although it would have been possible to rewrite the semantics of [28] in Sail, this language lacks some important features necessary for our work. First, Sail does not provide some low-level system semantics such as exceptions and interrupts; second, their framework does not include an execution model for multi-core processors.…”

“…2. The low-level model can be exported to OCaml code for both single step execution and sequential execution [28]. 3.…”

Validation of Abstract Side-Channel Models for Computer Architectures

“…These approaches differ from ours in that they try to give a formal guarantee that a processor model is a valid abstraction of the actual hardware, and to achieve that they require the hardware to be accessible as a white box. More similar to ours are black-box approaches that validate an abstract model by randomly generated instructions or based on dynamic instrumentation [ 20 , 29 ]. Combinations of formal verification and testing approaches for hardware verification and validation have also been considered [ 11 ].…”

An Executable Formal Model of the VHDL in Isabelle/HOL

“…The project adopts a multi-layer verification approach where we formalise each layer separately and use a refinement-based approach to show that properties proved at the top level are preserved at the lower levels. This work closely connects with the other components of the project such as the formal modelling and verification of verilog [8] and the SPARCv8 instruction set architecture for the LEON3 processor [9], [10], a verification framework for concurrent C-like programs [11], and automated reasoning techniques for separation logic [12]- [14]. For easy integration, these related sub-projects partly determine our software choices such as Isabelle/HOL and hardware choices such as LEON3 and VHDL.…”