Strong Formal Verification for RISC-V From Instruction-Set Manual to RTL

Size: px

Start display at page:

Download "Strong Formal Verification for RISC-V From Instruction-Set Manual to RTL"

Leo Park
5 years ago
Views:

1 Strong Formal Verification for RISC-V From Instruction-Set Manual to RTL Adam Chlipala MIT CSAIL RISC-V Workshop November 2017 Joint work with: Arvind, Thomas Bourgeat, Joonwon Choi, Ian Clester, Samuel Duchovni, Jamey Hicks, Muralidaran Vijayaraghavan, Andrew Wright

2 A Cartoon View of Digital Hardware Design Generator Metaprogramming RTL (e.g., Verilog) CAD tools Physical Layout Quite proprietary magic Silicon 2

3 A Cartoon View of Digital Hardware Design Generator Metaprogramming Formal Formal RTL (e.g., Verilog) Formal Formal Formal CAD tools Formal Formal Physical Layout Formal Formal FormalFormal Silicon Quite proprietary magic Formal Formal 3

4 Simplification #1: Prove a Shallow Property 4

5 Simplification #1: Prove a Shallow Property 5

6 Simplification #1: Prove a Shallow Property Common practice: prove some Invariants If Foo is in this register, then Bar is in that one. Never Baz here and Qux there at same time. 6

7 Simplification #1: Prove a Shallow Property or Boolean equivalence check Common practice: prove some Invariants If Foo is in this register, then Bar is in that one. Never Baz here and Qux there at same time. 7

8 Simplification #1: Prove a Shallow Property The Kami way: Behavioral refinement of functional spec ISA Reference 8

9 Simplification #2: Analyze Isolated Components Proved 9

10 Simplification #2: Analyze Isolated Components The Kami way: Modularly compose proofs of pieces Proved Proved 10

11 Simplification #2: Analyze Isolated Components The Kami way: Modularly compose proofs of pieces Proved Proved Proved 11

12 Simplification #2: Analyze Isolated Components The Kami way: Modularly compose proofs of pieces Proved Proved ISA Reference Proved 12

13 Simplification #3: Start Over For Each Design Memory L1 Cache CPU 13

14 Simplification #3: Start Over For Each Design Memory Memory L1 Cache CPU Proved L1 Cache CPU L1 Cache CPU 14

15 Simplification #3: Start Over For Each Design Memory Memory Memory L2 Cache L2 Cac L1 Cache L1 Cache L1 Cache L1 Cache L1 Cache L1 Cache L CPU CPU CPU CPU CPU CPU Proved Proved 15

16 Simplification #3: Start Over For Each Design Memory Memory Memory L2 Cache L2 Cac L1 Cache L1 Cache L1 Cache L1 Cache L1 Cache L1 Cache L CPU Proved CPU CPU Proved CPU CPU CPU Proved 16

17 Simplification #3: Start Over For Each Design Memory Memory Memory L2 Cache L2 Cac L1 Cache L1 Cache L1 Cache L1 Cache L1 Cache L1 Cache L CPU Proved CPU CPU Proved CPU CPU CPU Proved The Kami way: Prove once for all parameters trees. ISA Reference 17

18 A framework to support implementing, specifying, formally verifying, and compiling hardware designs based on the Bluespec high-level hardware design language and the Coq proof assistant 18

19 The Big Ideas (from Bluespec) M Program modules are objects 19

20 The Big Ideas (from Bluespec) M Program modules are objects with mutable private state, 20

21 The Big Ideas (from Bluespec) M f(x) g(y) Program modules are objects with mutable private state, accessed via methods. 21

22 The Big Ideas (from Bluespec) N M O h(u) k(v) f(x) g(y) Program modules are objects with mutable private state, accessed via methods. 22

23 The Big Ideas M f(x) g(y) Every method call appears to execute atomically. 23

24 The Big Ideas Recv f(1), Send h(2) M Recv g(7), Send k(13) f(x) g(y) Every method call appears to execute atomically. Any step is summarized by a trace of calls. 24

25 The Big Ideas Recv f(1), Send h(2) Recv g(7), Send k(13) M Refines M' f(x) g(y) f g Every method call appears to execute atomically. Any step is summarized by a trace of calls. Object refinement is inclusion of possible traces. 25

26 The Big Ideas Recv f(1), Send h(2) M Recv g(7), Send k(13) f(x) g(y) 26

27 The Big Ideas N Recv f(1) M Recv g(7), Send k(13) h(u) f(x) g(y) Composing objects hides internal method calls. 27

28 The Big Ideas Recv f(1) Recv g(7), Recv g(7) Send k(13) N M O h(u) k(v) f(x) g(y) Composing objects hides internal method calls. 28

29 Some Example Kami Code (simple FIFO) Definition deq {ty} : ActionT ty dtype := Read isempty <- ^empty; Assert!#isEmpty; Read eltt <- ^elt; Read enqpt <- ^enqp; Read deqpt <- ^deqp; Write ^full <- $$false; LET next_deqp <- (#deqpt + $1) :: Bit sz; Write ^empty <- (#enqpt == #next_deqp); Write ^deqp <- #next_deqp; Ret #eltt@[#deqpt]. 29

30 An Example Kami Proof (pipelined processor) Lemma p4st_refines_p3st: p4st <<== p3st. Proof. kmodular. - kdisj_edms_cms_ex O. - kdisj_ecms_dms_ex O. - apply fetchdecode_refines_fetchndecode; auto. - krefl. Qed. Uses standard Coq ASCII syntax for mathematical proofs. These proofs are checked automatically, just like type checking. We inherit streamlined IDE support for Coq. 30

31 We Are Building: Coq tactics to prove refinements Design Refines Spec 31

32 We Are Building: Coq tactics to prove refinements Design Refines Spec Compiler Refines RTL Verify semantics preservation of compiler 32

33 Some Useful Refinement Tactics Monolithic Spec Sequential Consistency 33

34 Some Useful Refinement Tactics Monolithic Spec Sequential Consistency 1 Decompose Decoupled Spec Processor Memory 34

35 Some Useful Refinement Tactics Monolithic Spec Sequential Consistency Getting Real Fancy Processor Memory 1 Decompose 2 Replace Module Decoupled Spec Processor Memory 35

36 .... Some Useful Refinement Tactics Monolithic Spec Sequential Consistency Getting Real Fancy Processor Memory 1 Decompose 2 Replace Module Decoupled Spec Processor Memory Processor 36

37 .... Some Useful Refinement Tactics Monolithic Spec Sequential Consistency Getting Real Fancy Processor Memory 1 Decompose 2 Replace Module Decoupled Spec Processor Memory Processor 3 Induction /Simulation Processor' 37

38 .... Some Useful Refinement Tactics Monolithic Spec Sequential Consistency 1 Decompose Decoupled Spec Processor Memory Getting Real Fancy Processor Memory 2 Replace Module Processor 3 Induction /Simulation Processor'' Ideal Queue Processor' 4 Decompose 38

39 .... Some Useful Refinement Tactics Monolithic Spec Sequential Getting Real Fancy Processor = Processor'' Ring Buffer Consistency Memory Processor'' 5 Replace Decompose Decoupled Spec Processor Memory 2 Replace Module Processor 3 Induction /Simulation Ideal Queue Processor' 4 Decompose 39

40 Key Ingredient Formal Semantics for RISC-V ISA(s) Nikhil just explained the semantics style. We are building a translator for the semantics into the language of Coq/Kami. 40

41 An Open Library of Formally Verified Components Microcontroller-class RV32I (multicore; U) Desktop-class RV64IMA (multicore; U,S,M) Cache-coherent memory system Reuse our proofs when composing our components with your own formally verified accelerators! 41

42 The Promise of this Approach ISA Formal Semantics 42

43 The Promise of this Approach ISA Formal Semantics Processor Proved RTL Formal Semantics 43

44 The Promise of this Approach Application Specification Application Machine Code ISA Formal Semantics Processor Proved RTL Formal Semantics 44

45 The Promise of this Approach Application Specification Application Machine Code ISA Formal Semantics Proved Processor Proved RTL Formal Semantics 45

46 The Trusted Computing Base Where can defects go uncaught? 46

47 The Trusted Computing Base Where can defects go uncaught? Coq proof checker (small & general-purpose) RTL formal semantics Application specification 47

48 The Trusted Computing Base Where can defects go uncaught? Coq proof checker (small & general-purpose) RTL formal semantics Application specification ISA formal semantics Hardware design (Bluespec, RTL, ) Software implementation (C, ) 48

49 Shameless plug! Part of a larger project: The Science of Deep Specification A National Science Foundation Expedition in Computing Join our mailing list for updates on our 2018 summer school: hands-on training with these tools! 49

Kami: A Framework for (RISC-V) HW Verification

Kami: A Framework for (RISC-V) HW Verification Murali Vijayaraghavan Joonwon Choi, Adam Chlipala, (Ben Sherman), Andy Wright, Sizhuo Zhang, Thomas Bourgeat, Arvind 1 The Riscy Expedition by MIT Riscy Library