Processor verification with precise exceptions and speculative execution

Abstract

We describe a framework for verifying a pipelined microprocessor whose implementation contains precise exceptions, external interrupts, and speculative execution. We present our correctness criterion which compares the state transitions of pipelined and non-pipelined machines in presence of external interrupts. To perform the verification, we created a table-based model of pipeline execution. This model records committed and in-flight instructions as performed by the microarchitecture. Given that certain requirements are met by this table-based model, we have mechanically verified our correctness criterion using the ACL2 theorem prover.

Reducing Manual Abstraction in Formal Verification of Out- of- Order Execution

“…Sawada and Hunt's theorem-proving approach uses a table of history variables, called a micro-architectural execution trace table (MAETT) [10,11]. The MAETT is an intermediate abstraction that contains selected parts of the implementation as well as extra history variables and variables holding abstracted values.…”

“…Several techniques for formally verifying out-of-order microprocessor designs using theorem proving have recently been suggested [4,[10][11][12]. These techniques all use some form of intermediate abstraction to bridge the gap in abstraction level between the implementation and the specification, as defined by an instructionset architecture (ISA).…”

Instantiating Uninterpreted Functional Units and Memory System: Functional Verification of the VAMP

“…Also, one can transform specification machines into simple pipelines (with forwarding and stalling mechanism) by an automatic transformation, and automatically generate formal correctness proofs for this transformation [15]. ii) Tomasulo schedulers with reorder buffers for the support of precise interrupts [5,8,16,24]. Exploiting symmetries, McMillan [16] has shown the correctness of a powerful Tomasulo scheduler with a remarkable degree of automation.…”

“…Exploiting symmetries, McMillan [16] has shown the correctness of a powerful Tomasulo scheduler with a remarkable degree of automation. Using theorem proving, Sawada and Hunt [24] show the correctness of an entire out-of-order processor, precise interrupts, and a store buffer for the memory unit. They also consider self-modifying code (by means of a sync instruction).…”

“…Five typical extra instructions are trap, return from exception, move to and from special registers, and sync [24]. The branch equal zero instruction is generalized in [28] by an uninterpreted test evaluation function.…”