R I S C - V s u p p o r t i n O T A WA : V a l - PowerPoint PPT Presentation

R I S C - V s u p p o r t i n O T A WA : V a l i d a t i o n o f t h e I S A d e s c r i p t i o n E m m a n u e l C a u s s é , H u g u e s C a s s é , P a s c a l S a i n r a t , T R A C E S – I R I T – U n i v e r s i t y o f T o u l o u s e P a r i s 1 - 2 / 1 0 / 2 0 1 9

I n t r o d u c t i o n ● s t a t i c a n a l y s i s t o o l s o n m a c h i n e c o d e ( WC E T ) – d e c o d i n g a n d p r o c e s s i n g m a c h i n e c o d e – s o u n d m o d e l o f t h e I n s t r u c t i o n S e t A r c h i t e c t u r e ( I S A ) ● a p p l i e d t o R I S C - V – A r c h i t e c t u r e D e s c r i p t i o n L a n g u a g e ( A D L ) m o d e l – “ v e r i f i e d ” b y c o - s i m u l a t i o n 2

P r e s e n t a t i o n O u t l i n e ● I n t r o d u c t i o n ● I S S g e n e r a t i o n ● I S A v a l i d a t i o n ● T o w a r d s s t a t i c a n a l y s i s ● C o n c l u s i o n 3

I S S G e n e r a t i o n Wo r k prog.elf (risc-v) riscv-sim risc.nmp gliss2 ISS simulator Instruction Architecture Set Simulator riscv-disasm Description generator Language ISS disassembler (SimNML) 4

I n s t r u c t i o n S e t A r c h i t e c t u r e D e s c r i p t i o n S i m N M L risc.nml – t y p e s type byte = int ( 8) type word = int (32) – r e g i s t e r s type address = card (32) – m e m o r i e s mem M [32, byte] mem M32 [32, word] alias = M – o p e r a t i o n s – m o d e s reg PC [ 1, address] is_pc = 1 reg NPC [ 1, address] [ F r e e r i c k s – 1 9 9 1 ] reg R [32, word] reg F [32, float (23,9)] 5

Mo d e d e s c r i p t i o n risc.nml ● a d d r e s s i n g m o d e s mode reg_t (r: index) = r syntax = ● s p e c i a l f o r m a t switch ( r ) { case 0: "zero" ( r e g i s t e r ) case 1: "ra" case 2: "sp" ● s p e c i a l c a l c u l a t i o n case 3: "gp" case 4: "tp ( h a r d w i r e d r e g i s t e r ) … } ● . . . image = format ( "%5b", r ) 6

O p e r a t i o n d e s c r i p t i o n risc.nml ● i m a g e – b i n a r y op addi(imm: int(12), s: reg_t, d: reg_t) ● s y n t a x – a s s e m b l y syntax = format ("addi %s, %s, %d", d, s, imm) ● a c t i o n image = format ("%12b %s 000 %s 0010011", i, s, d) – i m p e r a t i v e l a n g u a g e – b i t o r i e n t e d action = { if d != 0 then – f o r m a l l y d e f i n e d R[d] = R[s] + imm; – s y n t h e s i z a b l e endif ; [ B a s u , M o o n a - 2 0 0 3 ] } – c l o s e t o h a n d b o o k p s e u d o - c o d e ( l e s s e r r o r - p r o n e ? ) 7

O u r i m p l e m e n t a t i o n ● n o p s e u d o - c o d e i n [ T h e R I S C - V I n s t r u c t i o n S e t M a n u a l , V o l u m e I : U s e r - L e v e l I S A , V e r s i o n 2 . 0 – 2 0 1 4 ] ● s e v e r a l c o n t r i b u t o r s – M . F r i e b – A u g s b u r g U n i v e r s i t y ( i n i t i a l i m p l e m e n t a t i o n ) – E . C a u s s é – U n i v e r s i t y o f T o u l o u s e – P . S a i n r a t – U n i v e r s i t y o f T o u l o u s e ● o v e r a l l r e s u l t s – 1 7 4 i n s t r u c t i o n s 3 2 - b i t , 1 3 i n s t r u c t i o n s 6 4 - b i t – e x t e n s i o n s – 3 2 - b i t ( I , M , A , F , D , C ) , 6 4 - b i t ( I ) – m i s s i n g – 2 i n s t r u c t i o n s 3 2 - b i t , 2 5 i n s t r u c t i o n s 6 4 - b i t 8

R I S C - V F r e a k s risc.nml let gliss_isize = “32,16” Compact extension: 16 15 31 op c_add(dest: enum(1..31), src2: enum(1..31)) 0 image = format("100 1 %5b %5b 10",dest,src2) bbb11 32-bit ... 15 0 op add(src2: reg_t, src1: reg_t, dest: reg_t) image = format("0000000 %s %s 000 %s 0110011", aa 16-bit src2, src1, dest) ... � 16-bit if aa = 11 bbb ≠ 111 Already supported by GLISS2 for ARM Thumb-2, PowerPC VLE , TriCore, Star12X, x86. 9

I m p l e m e n t a t i o n a c t i v i t y Fixing an existing Adding a new instruction instruction Understanding re-read the action The handbook → fix obvious mistakes Writing the examine the simulation binary encoding → detect anomalies Writing the disassembly Wh a t ’ s a b o u t t h e v a l i d i t y Writing the o f t h e r e s u l t ? action 1 0

P r e s e n t a t i o n O u t l i n e ● I n t r o d u c t i o n ● I S S g e n e r a t i o n ● I S A v a l i d a t i o n ● T o w a r d s s t a t i c a n a l y s i s ● C o n c l u s i o n 1 1

C o - s i m u l a t i o n 1041e ld ra,8(sp) 1041e ld ra,8(sp) 10420 ld s0,0(sp) 10420 ld s0,0(sp) 10422 addi sp,sp,16 10422 addi sp,sp,16 pc = pc 10424 ret 10424 ret ra = ra binary_search: binary_search: sp = sp 10426 addi sp,sp,-48 10426 addi sp,sp,-48 gp = gp 10428 sd s0,40(sp) 10428 sd s0,40(sp) 1042a addi s0,sp,48 1042a addi s0,sp,48 … 1042c mv a5,a0 1042c mv a5,a0 t5 = t5 1042e sw a5,-36(s0) 1042e sw a5,-36(s0) 10432 sw zero,-24(s0) 10432 sw zero,-24(s0) t6 = t6 10436 li a5,14 10436 li a5,14 10438 sw a5,-28(s0) 10438 sw a5,-28(s0) 1043c li a5,-1 1043c li a5,-1 ISS Third-party Validator Simulator execution source Real Other hardware simulator 1 2

F o r R I S C - V spike easy to connect openocd with a real hardware riscv-gdb riscv-sim validator riscv template validator tuned by hand → gliss2 1 3

E x p e r i m e n t a t i o n ● b e n c h m a r k s – r i s c v - t e s t s ( g i t h u b ) – ( c ) U n i v e r s i t y o f C a l i f o r n i a – 1 t e s t / i n s t r u c t i o n ( 2 1 7 t e s t s – ~ 9 5 0 0 l i n e s o f c o d e ) ● r e s u l t s – s l o w – 5 - 6 x ( d o e s n ’ t m a t t e r ) – > 1 0 0 – f i x e s – s o m e i n s t r u c t i o n s c a n ’ t b e t e s t e d ! ( i n t e r n a l / s y s t e m – 1 3 i n s t r u c t i o n s ) 1 4

Me m o r y C o m p a r i s o n execution riscv-sim source performances memory risc.nmp register gliss2 riscv-sim address hardware simulation address + value riscv-sim risc-validator register / value memory spy 1 5

P a r t i a l c o n c l u s i o n ● I t ’ s n o t a p r o o f ! ● We t e s t i f 2 m a c h i n e s a r e e q u i v a l e n t … ● E r r o r = m a c h i n e 1 ? m a c h i n e 2 ? B o t h ? ● B u t w e i m p r o v e c o n f i d e n c e i n o u r R I S C - V A D L d e s c r i p t i o n ( n o t s o b a d ) 1 6

P r e s e n t a t i o n O u t l i n e ● I n t r o d u c t i o n ● I S S g e n e r a t i o n ● I S A v a l i d a t i o n ● T o w a r d s s t a t i c a n a l y s i s ● C o n c l u s i o n 1 7

B i n a r y s t a t i c a n a l y s e r : O T A WA OTAWA riscv-decoder Loader risc.nmp gliss2 riscv-disasm gliss-used-regs riscv-regs OTAWA Framework branch.nmp (WCET) riscv-branch kind.nmp gliss-attr riscv-kind sem.nmp riscv-sem 1 8