PVCoherence: Designing flat coherence protocols for scalable verification

Abstract

The goal of this work is to design cache coherence protocols with many cores that can be verified with state-of-the-art automated verification methodologies. In particular, we focus on flat (non-hierarchical) coherence protocols, and we use a mostly-automated methodology based on parametric verification (PV). We propose several design guidelines that architects should follow if they want to design protocols that can be parametrically verified. We experimentally evaluate performance, storage overhead, and scalability of a protocol verified with PV compared to a highly optimized protocol that cannot be verified with PV.

Hemiola: A DSL and Verification Tools to Guide Design and Proof of Hierarchical Cache-Coherence Protocols

“…In order to verify cache-coherence protocols with arbitrary numbers of cores (but no hierarchy), parameterization has been used in designing and modelchecking the protocols [2,35,36]. Since Hemiola is built on Coq, we can take full advantage of parameterization, and indeed the framework supports verification of cache-coherence protocols with an arbitrary tree shape as a parameter.…”

Kami: a platform for high-level parametric hardware specification and its modular verification

“…There are many abstraction techniques to reduce parameterized designs to finite state spaces, which can be explored exhaustively. Optimizations on symbolic model checking (e.g., partial order reduction [Bhattacharya et al 2005], symmetry reduction [Bhattacharya et al 2006;Chen et al 2010;Chou et al 2004;Emerson and Kahlon 2003;Ip et al 1996;Zhang et al 2014], compositional reasoning [Jhala and McMillan 2001;McMillan 1999McMillan , 2001], extended-FSM [Delzanno 2000], etc.) further scale the approach.…”

“…They also acknowledge (in their CAV'16 paper) that they would need invariants to get proofs of infinite families of designs, while our technique already admits such proofs. Chou et al [2004]; Matthews et al [2016]; Talupur and Tuttle [2008]; Zhang et al [2014Zhang et al [ , 2010 have all verified cache-coherence protocols using model checking in settings where the number of cores, number of levels in the hierarchy, etc. have been parameterized, by relying on paper-and-pencil proofs for properties about compositions and supplying the invariants manually.…”

CCICheck

“…Early work in this realm explored the verification of the Fu-tureBus+ protocol [13], while subsequent efforts used formal languages like Murphi to check the FLASH coherence protocols [34]. More recently, Zhang et al [44,45] proposed techniques for designing cache coherence protocols that are more amenable to formal verification. In all these cases, however, consistency is not verified, thus retaining the isolation of coherence and consistency and ignoring the CCI.…”

“…Generally, coherence protocols and consistency models are verified independently [6,7,13,34,44,45], with coherence verifiers ignoring consistency implications and consistency verifiers making assumptions about coherence. However, coherence and consistency are often tightly interwoven at the implementation level, commonly for the sake of aggressive performance optimizations such as speculative load reordering, but even in simpler microarchitectures as well [9,20,25,40].…”