PipeProof: Automated Memory Consistency Proofs for - - PowerPoint PPT Presentation
PipeProof: Automated Memory Consistency Proofs for Microarchitectural Specifications Yatin A. Manerkar , Daniel Lustig*, Margaret Martonosi, and Aarti Gupta Princeton University *NVIDIA MICRO-51 http:/ ://check.cs.p .princeton.edu/ Memory
Yatin A. Manerkar, Daniel Lustig*, Margaret Martonosi, and Aarti Gupta
PipeProof: Automated Memory Consistency Proofs for Microarchitectural Specifications
http:/ ://check.cs.p .princeton.edu/
Princeton University *NVIDIA MICRO-51
Memory Consistency Models (MCMs)
▪Specify rules governing values returned by loads in parallel programs ▪MCM must be correctly implemented for all possible programs
Compiler Microarchitecture
Memory Consistency Models (MCMs)
ISA-Level MCM (x86-TSO, Power, ARMv8, etc)
▪Specify rules governing values returned by loads in parallel programs ▪MCM must be correctly implemented for all possible programs
Compiler Microarchitecture
Memory Consistency Models (MCMs)
ISA-Level MCM (x86-TSO, Power, ARMv8, etc)
▪Specify rules governing values returned by loads in parallel programs ▪MCM must be correctly implemented for all possible programs
Target for compilers… Compiler Microarchitecture
Memory Consistency Models (MCMs)
ISA-Level MCM (x86-TSO, Power, ARMv8, etc)
▪Specify rules governing values returned by loads in parallel programs ▪MCM must be correctly implemented for all possible programs
Target for compilers… Compiler Microarchitecture …and a specification that microarchitecture must implement
Memory Consistency Models (MCMs)
▪Specify rules governing values returned by loads in parallel programs ▪MCM must be correctly implemented for all possible programs
Target for compilers… Compiler Microarchitecture …and a specification that microarchitecture must implement
[Images: HeeWann Kim, tzblacktd, audino]
The Infinite Forest
+∞
+∞
[Images: HeeWann Kim, tzblacktd, audino]
The Infinite Forest Forest goes on forever (infinite number of possible programs)
+∞
+∞
[Images: HeeWann Kim, tzblacktd, audino]
The Infinite Forest Can check known hideouts (verify design for test programs)
+∞
+∞
[Images: HeeWann Kim, tzblacktd, audino]
The Infinite Forest Are Pokemon lurking in unexplored areas? (Do tested programs provide complete coverage?)
+∞
+∞
[Images: HeeWann Kim, tzblacktd, audino]
The Infinite Forest
Have we caught all the Pokemon? (Are there any MCM bugs left in the design?)
PipeProof Overview
µarch and ISA MCM Specs + Auxiliary Inputs All-Program MCM Correctness Proof!
PipeProof
▪First automated all-program microarchitectural MCM verification!
▪Proof methodology based on automatic abstraction refinement ▪Early-stage: Can be conducted before RTL is written!
Outline
▪Background
▪Microarchitectural Correctness Proof
▪Overall PipeProof Operation
▪Results
ISA-Level MCM Specifications
▪Defined in terms of relational patterns [Alglave et al. TOPLAS 2014] ▪ISA-level executions are graphs
▪Correctness based on acyclicity, irreflexivity, etc of relational patterns
Mes essage passin ing (mp mp) litm litmus tes est An IS ISA-level l execution of
mp [x] ← 1 fr [y] ← 1 r1 ← [y] r2 ← [x] rf po po
(i4) (i3) (i1) (i2)
ISA-Level MCM Specifications
▪Defined in terms of relational patterns [Alglave et al. TOPLAS 2014] ▪ISA-level executions are graphs
▪Correctness based on acyclicity, irreflexivity, etc of relational patterns
Mes essage passin ing (mp mp) litm litmus tes est An IS ISA-level l execution of
mp [x] ← 1 fr [y] ← 1 r1 ← [y] r2 ← [x] rf po po
(i4) (i3) (i1) (i2)
ISA-Level MCM Specifications
▪Defined in terms of relational patterns [Alglave et al. TOPLAS 2014] ▪ISA-level executions are graphs
▪Correctness based on acyclicity, irreflexivity, etc of relational patterns
Mes essage passin ing (mp mp) litm litmus tes est An IS ISA-level l execution of
mp [x] ← 1 fr [y] ← 1 r1 ← [y] r2 ← [x] rf po po
(i4) (i3) (i1) (i2)
ISA-Level MCM Specifications
▪Defined in terms of relational patterns [Alglave et al. TOPLAS 2014] ▪ISA-level executions are graphs
▪Correctness based on acyclicity, irreflexivity, etc of relational patterns
Mes essage passin ing (mp mp) litm litmus tes est An IS ISA-level l execution of
mp [x] ← 1 fr [y] ← 1 r1 ← [y] r2 ← [x] rf po po
(i4) (i3) (i1) (i2)
ISA-Level MCM Specifications
▪Defined in terms of relational patterns [Alglave et al. TOPLAS 2014] ▪ISA-level executions are graphs
▪Correctness based on acyclicity, irreflexivity, etc of relational patterns
Mes essage passin ing (mp mp) litm litmus tes est An IS ISA-level l execution of
mp [x] ← 1 fr [y] ← 1 r1 ← [y] r2 ← [x] rf po po
(i4) (i3) (i1) (i2)
Microarchitectural Ordering Specifications
▪Set of axioms in µspec DSL [Lustig et al. ASPLOS 2016] ▪Used to generate microarchitectural executions as µhb graphs
▪Observability based on cyclicity of graphs
Mes essage passin ing (mp mp) litm litmus tes est A µhb hb gr graph of
mp on
imple leSC (i1) (i2) IF EX WB po (i3) (i4) fr rf po
Microarchitectural Ordering Specifications
▪Set of axioms in µspec DSL [Lustig et al. ASPLOS 2016] ▪Used to generate microarchitectural executions as µhb graphs
▪Observability based on cyclicity of graphs
Mes essage passin ing (mp mp) litm litmus tes est A µhb hb gr graph of
mp on
imple leSC (i1) (i2) IF EX WB po (i3) (i4) fr rf po
Microarchitectural Ordering Specifications
▪Set of axioms in µspec DSL [Lustig et al. ASPLOS 2016] ▪Used to generate microarchitectural executions as µhb graphs
▪Observability based on cyclicity of graphs
Mes essage passin ing (mp mp) litm litmus tes est A µhb hb gr graph of
mp on
imple leSC (i1) (i2) IF EX WB po (i3) (i4) fr rf po
Microarchitectural Ordering Specifications
▪Set of axioms in µspec DSL [Lustig et al. ASPLOS 2016] ▪Used to generate microarchitectural executions as µhb graphs
▪Observability based on cyclicity of graphs
Mes essage passin ing (mp mp) litm litmus tes est A µhb hb gr graph of
mp on
imple leSC (i1) (i2) IF EX WB po (i3) (i4) fr rf po
Microarchitectural Ordering Specifications
▪Set of axioms in µspec DSL [Lustig et al. ASPLOS 2016] ▪Used to generate microarchitectural executions as µhb graphs
▪Observability based on cyclicity of graphs
Mes essage passin ing (mp mp) litm litmus tes est A µhb hb gr graph of
mp on
imple leSC (i1) (i2) IF EX WB po (i3) (i4) fr rf po
Our Prior Work: Litmus Test-Based MCM Verification
Axiom “Decode_is_FIFO": ... EdgeExists ((i1, Decode), (i2, Decode)) => AddEdge ((i1, Execute), (i2, Execute)). ... Axiom "PO_Fetch": ... SameCore i1 i2 /\ ProgramOrder i1 i2 => AddEdge ((i1, Fetch), (i2, Fetch)).
Mic icroarchit itecture Litm Litmus Tes est in in µspec ec DS DSL
[Lustig et al. MICRO-47, …]
Our Prior Work: Litmus Test-Based MCM Verification
Mic icroarchit itectural happen ens-before (µ (µhb hb) gr graphs
Axiom “Decode_is_FIFO": ... EdgeExists ((i1, Decode), (i2, Decode)) => AddEdge ((i1, Execute), (i2, Execute)). ... Axiom "PO_Fetch": ... SameCore i1 i2 /\ ProgramOrder i1 i2 => AddEdge ((i1, Fetch), (i2, Fetch)).
Mic icroarchit itecture Litm Litmus Tes est in in µspec ec DS DSL
[Lustig et al. MICRO-47, …]
Our Prior Work: Litmus Test-Based MCM Verification
Mic icroarchit itectural happen ens-before (µ (µhb hb) gr graphs
Axiom “Decode_is_FIFO": ... EdgeExists ((i1, Decode), (i2, Decode)) => AddEdge ((i1, Execute), (i2, Execute)). ... Axiom "PO_Fetch": ... SameCore i1 i2 /\ ProgramOrder i1 i2 => AddEdge ((i1, Fetch), (i2, Fetch)).
Mic icroarchit itecture Litm Litmus Tes est in in µspec ec DS DSL ISA-Level Outcome Observable (≥ 1 Graph Acyclic) Not Observable (All Graphs Cyclic) Allowed OK OK (stricter than necessary) Forbidden Consistency violation! OK
[Lustig et al. MICRO-47, …]
Our Prior Work: Litmus Test-Based MCM Verification
Mic icroarchit itectural happen ens-before (µ (µhb hb) gr graphs
Axiom “Decode_is_FIFO": ... EdgeExists ((i1, Decode), (i2, Decode)) => AddEdge ((i1, Execute), (i2, Execute)). ... Axiom "PO_Fetch": ... SameCore i1 i2 /\ ProgramOrder i1 i2 => AddEdge ((i1, Fetch), (i2, Fetch)).
Mic icroarchit itecture Litm Litmus Tes est in in µspec ec DS DSL ISA-Level Outcome Observable (≥ 1 Graph Acyclic) Not Observable (All Graphs Cyclic) Allowed OK OK (stricter than necessary) Forbidden Consistency violation! OK
[Lustig et al. MICRO-47, …]
Our Prior Work: Litmus Test-Based MCM Verification
Mic icroarchit itectural happen ens-before (µ (µhb hb) gr graphs
Axiom “Decode_is_FIFO": ... EdgeExists ((i1, Decode), (i2, Decode)) => AddEdge ((i1, Execute), (i2, Execute)). ... Axiom "PO_Fetch": ... SameCore i1 i2 /\ ProgramOrder i1 i2 => AddEdge ((i1, Fetch), (i2, Fetch)).
Mic icroarchit itecture Litm Litmus Tes est in in µspec ec DS DSL ISA-Level Outcome Observable (≥ 1 Graph Acyclic) Not Observable (All Graphs Cyclic) Allowed OK OK (stricter than necessary) Forbidden Consistency violation! OK
[Lustig et al. MICRO-47, …]
Perennial Question: “Do your litmus tests cover all possible MCM bugs?” How to automatically prove correctness for all programs?
The Transitive Chain (TC) Abstraction
i1 in
r1…n-1 fr All non-unary cycles containing fr
i1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po …
The Transitive Chain (TC) Abstraction
i1 in
r1…n-1 fr All non-unary cycles containing fr
i1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po … Transitive chain (sequence)
The Transitive Chain (TC) Abstraction
i1 in
r1…n-1 fr All non-unary cycles containing fr
i1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po …
Using TC Abstraction
i1 in fr Som Some µhb hb edg edge fr from i1 to to in (transitive connection)
IF EX WB
i1 in
IF EX WB fr
i1 in
IF EX WB fr
i1 in
IF EX WB fr
The Transitive Chain (TC) Abstraction
i1 in
r1…n-1 fr All non-unary cycles containing fr
i1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po …
Using TC Abstraction
i1 in fr Som Some µhb hb edg edge fr from i1 to to in (transitive connection)
IF EX WB
i1 in
IF EX WB fr
i1 in
IF EX WB fr
i1 in
IF EX WB fr
The Transitive Chain (TC) Abstraction
Using TC Abstraction
Infinite
i1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po
The Transitive Chain (TC) Abstraction
Using TC Abstraction
Infinite
i1 in
IF EX WB fri1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po
Finite!
i1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fr The Transitive Chain (TC) Abstraction
Using TC Abstraction
Infinite
i1 in
IF EX WB fri1
fr
i2
po
i1 i3
fr
i2
po co po rf
i1 i3
fr
i2 i4
po co rf
i1 i3
fr
i2 i4
po
Finite!
i1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB fri1 in
IF EX WB frSoundness verified as a supporting proof!
Microarchitectural Correctness Proof
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Al All po possible tr tran. . con
Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ?
AbsCounterX
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ?
AbsCounterX
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Acyclic graph with transitive connection => Abstract Counterexample (i.e. possible bug)
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ?
AbsCounterX
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Transitive connection may represent one or multiple ISA-level edges
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ?
AbsCounterX
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Try to
Concretiz ize (R (Rep epla lace tr transit itiv ive con
with th
e ISA-level edg edge) Micr Microarch Bugg Buggy, Return Co Coun unterexample le Ob Observ rvable Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ?
AbsCounterX
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Try to
Concretiz ize (R (Rep epla lace tr transit itiv ive con
with th
e ISA-level edg edge) Uno nobs. Micr Microarch Bugg Buggy, Return Co Coun unterexample le Ob Observ rvable Co Cons nsider al all De Decompos
itio ions (I (Ind nductiv ively ly br break do down wn Tran ansit itiv ive Cha Chain in) Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Microarchitectural Correctness Proof
i1 in
IF EX WB fr ?
AbsCounterX
i1 in
IF EX WB fr ✓
NoDecomp
i1 in
fr Som Some µhb hb ed edge fr from i1 to
(transitive con
Try to
Concretiz ize (R (Rep epla lace tr transit itiv ive con
with th
e ISA-level edg edge) Uno nobs. Micr Microarch Bugg Buggy, Return Co Coun unterexample le Ob Observ rvable Co Cons nsider al all De Decompos
itio ions (I (Ind nductiv ively ly br break do down wn Tran ansit itiv ive Cha Chain in) Al All po possible tr tran. . con
Oth Other tr transit itiv ive connections… Oth Other ISA-level cycles…
“Refinement Loop”
i1 in
po Som Some µhb hb ed edge fr from i1 to
(transitive con
Cy Cycle les con
fr Cy Cycle les con
po
Concretization
Concretization: Replace transitive connection with single ISA-level edge
p i1 r q in IF EX WB fr ?
AbsCounterX
▪All concretizations must be unobservable ▪Observable concretizations are counterexamples
Concretization
✓
p i1 r q in IF EX WB fr rf p i1 r q in IF EX WB fr po
Concretization: Replace transitive connection with single ISA-level edge
✓
p i1 r q in IF EX WB fr ?
AbsCounterX
▪All concretizations must be unobservable ▪Observable concretizations are counterexamples
Decomposition
p i1 r q in IF EX WB fr
▪Additional instruction and ISA-level edge modelled => extra constraints
Decomposition: Inductively break down transitive chain
(Chain of length n == Chain of length n-1 + single “peeled-off” edge)
?
AbsCounterX
Decomposition
p i1 in-1 IF EX WB rf r q in fr p i1 i2 IF EX WB co r q in fr p i1 r q in IF EX WB fr
▪Additional instruction and ISA-level edge modelled => extra constraints
Decomposition: Inductively break down transitive chain
(Chain of length n == Chain of length n-1 + single “peeled-off” edge)
?
AbsCounterX
Decomposition
p i1 in-1 IF EX WB rf r q in fr p i1 i2 IF EX WB co r q in fr
✓
p i1 r q in IF EX WB fr
▪Additional instruction and ISA-level edge modelled => extra constraints
Decomposition: Inductively break down transitive chain
(Chain of length n == Chain of length n-1 + single “peeled-off” edge)
?
AbsCounterX
Decomposition
p i1 in-1 IF EX WB rf r q in fr p i1 i2 IF EX WB co r q in fr
✓ ?
p i1 r q in IF EX WB fr
▪Additional instruction and ISA-level edge modelled => extra constraints
Decomposition: Inductively break down transitive chain
(Chain of length n == Chain of length n-1 + single “peeled-off” edge)
?
AbsCounterX
Decomposition
p i1 in-1 IF EX WB rf r q in fr p i1 i2 IF EX WB co r q in fr
✓ ?
p i1 r q in IF EX WB fr
▪Additional instruction and ISA-level edge modelled => extra constraints
Decomposition: Inductively break down transitive chain
(Chain of length n == Chain of length n-1 + single “peeled-off” edge)
?
AbsCounterX
Outline
▪Background
▪Microarchitectural Correctness Proof
▪Overall PipeProof Operation
▪Results
PipeProof Block Diagram
Microarchitecture Ordering Spec. ISA-Level MCM Spec. PipeProof ISA Edge ->
Result: All-Program MCM Correctness Proof? Counterexample found?
Chain Invariants Transitive Chain Abstraction Support Proof Microarch. Correctness Proof
Proof of Chain Invariants
Fail Fail Pass Pass
PipeProof Block Diagram
Microarchitecture Ordering Spec. ISA-Level MCM Spec. PipeProof ISA Edge ->
Result: All-Program MCM Correctness Proof? Counterexample found?
Chain Invariants Transitive Chain Abstraction Support Proof Microarch. Correctness Proof
Proof of Chain Invariants
Fail Fail Pass Pass
PipeProof Block Diagram
Microarchitecture Ordering Spec. ISA-Level MCM Spec. PipeProof ISA Edge ->
Result: All-Program MCM Correctness Proof? Counterexample found?
Chain Invariants Transitive Chain Abstraction Support Proof Microarch. Correctness Proof
Proof of Chain Invariants
Fail Fail Pass Pass
Links ISA- level and µarch executions
PipeProof Block Diagram
Microarchitecture Ordering Spec. ISA-Level MCM Spec. PipeProof ISA Edge ->
Result: All-Program MCM Correctness Proof? Counterexample found?
Chain Invariants Transitive Chain Abstraction Support Proof Microarch. Correctness Proof
Proof of Chain Invariants
Fail Fail Pass Pass
Represent repeated ISA-level patterns
PipeProof Block Diagram
Microarchitecture Ordering Spec. ISA-Level MCM Spec. PipeProof ISA Edge ->
Result: All-Program MCM Correctness Proof? Counterexample found?
Chain Invariants Transitive Chain Abstraction Support Proof Microarch. Correctness Proof
Proof of Chain Invariants
Fail Fail Pass Pass
If design can’t be verified, a counterexample (a forbidden execution that is observable) is often returned
PipeProof Block Diagram
Microarchitecture Ordering Spec. ISA-Level MCM Spec. PipeProof ISA Edge ->
Result: All-Program MCM Correctness Proof? Counterexample found?
Chain Invariants Transitive Chain Abstraction Support Proof Microarch. Correctness Proof
Proof of Chain Invariants
Fail Fail Pass Pass
Supporting proofs provide foundation for correctness proof
Transitive Chain (TC) Abstraction Support Proof
▪Ensure that ISA-level pattern and µarch. support TC Abstraction ▪Base case: Do initial ISA-level edges guarantee connection? ▪Inductive case: Extend transitive chain => extend transitive connection?
i1 i2 IF EX WB po i1 i2 IF EX WB rf i1 i2 IF EX WB fr i1 i2 IF EX WB co
i1 in IF EX WB rn in+1
So Some me Tran an Co Conn nn.
i1 in+1 IF EX WB
So Some me Tran ansitive Co Conn nnection
Chain Invariants
▪Abstractly represent repeated ISA-level patterns ▪Sometimes needed for refinement loop to terminate ▪Inductively proven by PipeProof before their use in proof algorithms ▪Example: checking for edge from i1 to i5 (TC abstraction support proof)
Abstract Counterexample
i1 i3 i4 fr i5 po
Chain Invariants
▪Abstractly represent repeated ISA-level patterns ▪Sometimes needed for refinement loop to terminate ▪Inductively proven by PipeProof before their use in proof algorithms ▪Example: checking for edge from i1 to i5 (TC abstraction support proof)
Repeating ISA-Level Pattern
i1 i3 i4 fr i5 po i1 i3 i4 fr i2 po i5 po
Chain Invariants
▪Abstractly represent repeated ISA-level patterns ▪Sometimes needed for refinement loop to terminate ▪Inductively proven by PipeProof before their use in proof algorithms ▪Example: checking for edge from i1 to i5 (TC abstraction support proof)
Repeating ISA-Level Pattern
i1 i3 i4 fr i5 po i1 i3 i4 fr i2 po i5 po
Can continue decomposing in this way forever!
Chain Invariants
▪Abstractly represent repeated ISA-level patterns ▪Sometimes needed for refinement loop to terminate ▪Inductively proven by PipeProof before their use in proof algorithms ▪Example: checking for edge from i1 to i5 (TC abstraction support proof)
Chain Invariant Applied
i1 i3 i4 fr i5 po i1 i3 i4 fr i2 po i5 po i1 i4 fr i2 po_plus i5
number of repetitions of po
be something other than po
In the paper…
▪Optimizations
▪Inductive ISA edge generation ▪Adequate Model Over-Approximation
▪…and more!
simpleTSO simpleTSO (w/ Covering Sets + Memoization) Total Time Timeout 2449.7 sec (≈ 41 mins)
Results
▪Ran PipeProof on simpleSC (SC) and simpleTSO (TSO) µarches
▪Proved correctness of both microarchitectures for all programs
simpleSC simpleSC (w/ Covering Sets + Memoization) Total Time 225.9 sec 19.1 sec
simpleTSO simpleTSO (w/ Covering Sets + Memoization) Total Time Timeout 2449.7 sec (≈ 41 mins)
Results
▪Ran PipeProof on simpleSC (SC) and simpleTSO (TSO) µarches
▪Proved correctness of both microarchitectures for all programs
simpleSC simpleSC (w/ Covering Sets + Memoization) Total Time 225.9 sec 19.1 sec
simpleTSO simpleTSO (w/ Covering Sets + Memoization) Total Time Timeout 2449.7 sec (≈ 41 mins)
Results
▪Ran PipeProof on simpleSC (SC) and simpleTSO (TSO) µarches
▪Proved correctness of both microarchitectures for all programs
simpleSC simpleSC (w/ Covering Sets + Memoization) Total Time 225.9 sec 19.1 sec
simpleTSO simpleTSO (w/ Covering Sets + Memoization) Total Time Timeout 2449.7 sec (≈ 41 mins)
Results
▪Ran PipeProof on simpleSC (SC) and simpleTSO (TSO) µarches
▪Proved correctness of both microarchitectures for all programs
simpleSC simpleSC (w/ Covering Sets + Memoization) Total Time 225.9 sec 19.1 sec
simpleTSO simpleTSO (w/ Covering Sets + Memoization) Total Time Timeout 2449.7 sec (≈ 41 mins)
Results
▪Ran PipeProof on simpleSC (SC) and simpleTSO (TSO) µarches
▪Proved correctness of both microarchitectures for all programs
simpleSC simpleSC (w/ Covering Sets + Memoization) Total Time 225.9 sec 19.1 sec
Conclusions
▪PipeProof: Automated All-Program Microarchitectural MCM Verification
▪Transitive Chain Abstraction allows inductive modelling and verification
▪Verified simple microarchitectures implementing SC and TSO in < 1 hour!
Code available at https://github.com/ymanerka/pipeproof
[Image: Napish]
Yatin A. Manerkar, Daniel Lustig*, Margaret Martonosi, and Aarti Gupta
PipeProof: Automated Memory Consistency Proofs for Microarchitectural Specifications
http:/ ://check.cs.p .princeton.edu/
Code available at https://github.com/ymanerka/pipeproof
Covering Sets Optimization
▪ Must verify across all possible transitive connections ▪ Each decomposition creates a new set of transitive connections
▪ The Covering Sets Optimization eliminates redundant transitive connections
x y i1 z in IF EX WB fr x y i1 z in IF EX WB fr
B A
Covering Sets Optimization
▪ Must verify across all possible transitive connections ▪ Each decomposition creates a new set of transitive connections
▪ The Covering Sets Optimization eliminates redundant transitive connections
x y i1 z in IF EX WB fr x y i1 z in IF EX WB fr
B A
Graph A has an edge from x→z (tran conn.)
Covering Sets Optimization
▪ Must verify across all possible transitive connections ▪ Each decomposition creates a new set of transitive connections
▪ The Covering Sets Optimization eliminates redundant transitive connections
x y i1 z in IF EX WB fr x y i1 z in IF EX WB fr
B A
Graph B has edges from y→z (tran conn.) and x→z (by transitivity) Graph A has an edge from x→z (tran conn.)
Covering Sets Optimization
▪ Must verify across all possible transitive connections ▪ Each decomposition creates a new set of transitive connections
▪ The Covering Sets Optimization eliminates redundant transitive connections
x y i1 z in IF EX WB fr x y i1 z in IF EX WB fr
B A
Graph B has edges from y→z (tran conn.) and x→z (by transitivity) Graph A has an edge from x→z (tran conn.) Correctness of A => Correctness of B (since B contains A’s tran conn.) Checking B explicitly is redundant!
Memoization Optimization
▪Base PipeProof algorithm examines some cycles multiple times ▪Memoization eliminates redundant checks of cycles that have already been verified
i1 fr i2 i3 i4 rf po po
Memoization Optimization
▪Base PipeProof algorithm examines some cycles multiple times ▪Memoization eliminates redundant checks of cycles that have already been verified
i1 in IF EX WB fr
Some Tran. Conn.
i1 fr i2 i3 i4 rf po po fr
Memoization Optimization
▪Base PipeProof algorithm examines some cycles multiple times ▪Memoization eliminates redundant checks of cycles that have already been verified
i1 in IF EX WB fr
Some Tran. Conn.
i1 fr i2 i3 i4 rf po po
i1 in IF EX WB po
Some Tran. Conn.
po po
Memoization Optimization
▪Base PipeProof algorithm examines some cycles multiple times ▪Memoization eliminates redundant checks of cycles that have already been verified
i1 in IF EX WB fr
Some Tran. Conn.
i1 in IF EX WB rf
Some Tran. Conn.
i1 fr i2 i3 i4 rf po po
i1 in IF EX WB po
Some Tran. Conn.
rf Same cycle is checked 3 times!
Memoization Optimization
▪Base PipeProof algorithm examines some cycles multiple times ▪Memoization eliminates redundant checks of cycles that have already been verified
i1 in IF EX WB fr
Some Tran. Conn.
i1 in IF EX WB rf
Some Tran. Conn.
i1 fr i2 i3 i4 rf po po
i1 in IF EX WB po
Some Tran. Conn.
rf Procedure: If all ISA-level cycles containing edge ri have been checked, do not peel off ri edges when checking subsequent cycles Same cycle is checked 3 times!
The Adequate Model Over-Approximation
▪Addition of an instruction can make unobservable execution observable! ▪Need to work with over-approximation of microarchitectural constraints ▪PipeProof sets all exists clauses to true as its over-approximation
t i1 i2 IF EX WB fr v i3 co SubsetExec u t i1 i2 IF EX WB fr v i3 SubsetWithExternal u i4 rf co