Certified and efficient instruction scheduling: application to interlocked VLIW processors

Abstract

CompCert is a moderately optimizing C compiler with a formal, machine-checked, proof of correctness: after successful compilation, the assembly code has a behavior faithful to the source code. Previously, it only supported target instruction sets with sequential semantics, and did not attempt reordering instructions for optimization.We present here a CompCert backend for a VLIW core (i.e. with explicit parallelism at the instruction level), the first CompCert backend providing scalable and efficient instruction scheduling. Furthermore, its highly modular implementation can be easily adapted to other VLIW or non-VLIW pipelined processors.

Simple, light, yet formally verified, global common subexpression elimination and loop-invariant code motion

“…Optimizing compilers, including gcc, schedule instructions to minimize stalls. The Kalray KV3 port of CompCert schedules instructions inside basic blocks, after register allocation Six et al [2020], but such post-pass scheduling is not available for other architectures. It would be unfair to compare performance between gcc with scheduling and CompCert without.…”

“…Because of these two reasons, we run our experiments with a pre-pass (before register allocation) instruction scheduler. It formally checks that the instructions are properly reordered in a manner similar to Six et al [2020]; it will be covered in another publication. This experimental scheduler was developed without access to microarchitectural documentation; improvements may thus be expected in the future.…”

“…This is not in general considered to be a serious issue: one is unlikely to distinguish such an "absurd case" by accident. It is possible to work around this issue by wrapping the external OCaml code in a nondeterministic monad, Six et al [2020], when building the scheduling validator for the KV3, used another approach for their hash-consing: a special constructor function is used, but no assumption is made about its soundness (the returned term is checked); and physical equality is modeled as a nondeterministic function, such that when it returns true there is equality. Their approach has a smaller trusted computing base, but it loses the hash-consing axiom (which we do not really need) that when two terms are structurally equal, they are also at the same address in memory.…”

Formal verification of high-level synthesis

“…For instance, our HTL language already allows arbitrary Verilog to appear in each state of the FSMD; currently, each state just contains a single Verilog assignment, but when scheduling is added, it will contain a list of assignments that can all be executed in parallel. We expect to follow the lead of Tristan and Leroy [2008] and Six et al [2020], who have previously added scheduling support to CompCert in a VLIW context, by invoking an external (unverified) scheduling tool and then using translation validation to verify that each generated schedule is correct (as opposed to verifying the scheduling tool itself).…”

Formally verified superblock scheduling

“…Motivations. Six et al [2020] added instruction scheduling and some peephole optimizations to CompCert (thus creating CompCertSched) at the assembly level, in postpass (after register allocation and final transformations, Fig. 1 and 2).…”