Reducing Manual Abstraction in Formal Verification of Out- of- Order Execution

Abstract

Abstract. Several methods have recently been proposed for verifying processors with out-of-order execution. These methods use intermediate abstractions to decompose the verification process into smaller steps. Unfortunately, the process of manually creating intermediate abstractions is very laborious. We present an approach that dramatically reduces the need for an intermediate abstraction, so that only the scheduling logic of the implementation is abstracted. After the abstraction, we apply an enhanced incremental-flushing approach to verify the remaining circuitry by comparing the processor description against itself in a slightly simpler configuration. By induction, we demonstrate that any reachable configuration is equivalent to the simplest possible configuration. Finally, we prove correctness on the simplest configuration. The approach is illustrated with a simple example of an out-of-order execution core.

A general decomposition strategy for verifying register renaming

“…High-level models of register renaming with a reorder buffer and retirement register file (RRF) have been verified by Skakkebaek, Jones, and Dill [7], Pnueli and Arons [12], Hosabettu, Srivas, and Gopalakrishnan [6], Sawada and Hunt [13], Velev [17], and Lahiri and Bryant [9]. For both Tomasulo's algorithm and RRF renaming, when the processor is flushed, the projection from the implementation state to the specification state is just a direct projection of the register file and other state variables, such as the program counter.…”

Verifying a Simple Pipelined Microprocessor Using Maude

“…A refinement of the approach in [2], more applicable to out-of-order systems and long pipelines is [19,20]. In addition, work has been undertaken on the complex timing models of superscalar processors [30,1,5]: [18] additionally considers exception processing in such an environment.…”

A Federal Approach to Formal Hardware Design Verification

“…The flushing method becomes computationally infeasible for the deep pipelines that exist in modern out-of-order architectures, so we developed a different method that flushes small numbers of instructions at a time [2,3].…”