Formal Verification of VLIW Microprocessors with Speculative Execution

There is wide agreement that one of the most important impediments to the performance of current and future pipelined superscalar processors is the presence of conditional branches in the instruction stream. Speculative execution seems to be one solution of choice to the branch problem, but speculative work is discarded if a branch is mispredicted. Therefore, we need a very accurate branch predictor; 95% accuracy is not good enough. This paper proposes branch classification to help improve the accuracy of branch predictors. Branch classification allows an individual branch instruction to be associated with the branch predictor best suited to predict its direction. Using this approach, a hybrid branch predictor can be constructed such that each component branch predictor predicts those branches for which it is best suited. This paper suggests one classification scheme, analyzes several branch predictors, and proposes a hybrid branch predictor that achieves higher prediction accuracy than any branch predictor previously reported in the literature.

The schedulability analysis of real-time embedded systems requires worst case execution time (WCET) analysis for the individual tasks. Bounding WCET involves not only language-level program path analysis, but also modeling the performance impact of complex micro-architectural features present in modern processors. In this paper, we statically analyze the execution time of embedded software on processors with speculative execution. The speculation of conditional branch outcomes (branch prediction) significantly improves a program's execution time. Thus, accurate modeling of control speculation is important for calculating tight WCET estimates. We present a parameterized framework to model the different branch prediction schemes. We further consider the complex interaction between speculative execution and instruction cache performance, that is, the fact that speculatively executed blocks can generate additional cache hits/misses. We extend our modeling to capture this effect of branch prediction on cache performance. Starting with the control flow graph of a program, our technique uses integer linear programming to estimate the program's WCET. The accuracy of our method is demonstrated by tight estimates obtained on realistic benchmarks.

This paper proposes a parallel cycle-accurate microarchitectural simulator which efficiently executes its workload by splitting the simulation process along time-axis into many intervals. This time-division parallelization is similar to the concept of trace-splitting parallelization but is completely different from this conventional technique because our simulator assures that its result is perfectly equivalent to what a sequential simulator produces. The assurance of the perfect accuracy is endued by a simple failure recovery mechanism; if i-th interval is simulated by a node with an approximate initial machine state which causes invalid result, the interval is simulated again by the node responsible to (i - 1)-th interval and thus having the correct state at the beginning of i-th interval. In order to reduce the possibility of the interval failure for efficiency, the fully cycle-accurate simulation for an interval is preceded by a partial and thus fast micro architectural simulation including that for caches, branch predictors and their interaction in speculative execution. Another important technique is to check the validity of an interval simulation by comparing approximate and correct initial states with respect to their effect to the subsequent execution, rather than the raw values of them. The effectiveness of these techniques are exhibited by our SimpleScalar-based implementation and its evaluation with SPEC CPU95 benchmarks which results that 8-node and 16-node parallel simulations achieve up to 5.8-fold and 9.4-fold speedup respectively

In the push for ever increasing performance out of processor architectures, there is a need to expand beyond the limitations of existing scalar approaches. Superscalar architectures provide one such means. By dynamically executing more than one instruction per clock cycle, superscalar architectures can improve performance without relying solely on technology improvements for these gains. This paper examines a new technique for superscalar control implementation, called the schedule table. The schedule table facilitates dependency checking, out of order instruction issue, out of order execution, branch prediction, speculative execution, precise interrupts, and fast and efficient misprediction recovery.

Due to the prohibitive cost of worst-case timing analysis for modern processors, the design of time-predictable processors has become increasingly important for hard real-time and safety-critical systems. However, to the best of our knowledge currently there is no effective and widely accepted metric to quantitatively evaluate time predictability of processors, which greatly impedes the advancement of time-predictable processor design. This paper first introduces the concept of architectural time predictability (ATP), which separates timing uncertainty concerns caused by hardware from software. We then propose a metric called Architectural Time-predictability Factor (ATF) to measure architectural time predictability. Our evaluation on a Very Long Instruction Word (VLIW) processor indicates that ATF is an effective metric to quantitatively evaluate architectural time predictability of a whole processor as well as its architectural and microarchitectural components such as caches, branch prediction, speculative execution, parallel pipelines, and Scratch-Pad Memory (SPM). Thus ATF can be used to quantitatively guide architectural design for enhancing time predictability or making better trade-offs between performance and time predictability.

It has been shown that control flow decisions often reduce the amount of fine-grain, or instruction-level parallelism in many computations. There exists various architectural solutions to this problem, such as branch prediction and speculative execution. Here we present an alternative solution, based on the use of partial evaluation for statically increasing the parallelism of a computation. In particular we explore the capability of a partial evaluator to remove control flow decisions.A partial evaluator is described, which specializes data flow graphs produced by a compiler for a fine-grained processor array. The data flow graphs can be viewed as the equivalent of a machine-code program for conventional processor, and consequently some aspects of the architecture can be taken into account by the partial evaluator.Results from the use of the partial evaluator show that it can significantly improve the performance of a computation. The performance improvement is partly due to improved parallelism, but mostly due to a reduce dynamic instruction count, i.e. a reduction in the number of operations executed.

Formal Verification of Compiler Transformations for Speculative Real-Time Execution>>>A short version of t>his paper was presented at the 20th IFAC/IFIP Workshop on Real Time Programming (WRTP’95), which was held in Gt. Lauderdale, Florida, U.S.A., during November 1995. The Published Proceedings of this IFAC Meeting may be ordered from: Elsevier Science Limited, The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, United

A conditional branch predictor based on weightless neural networks

Speculative execution is one of the key issues to boost the performance of future generation microprocessors. In this paper, we introduce a novel approach to evaluate the effects of branch and value prediction, which allow the processor to execute instructions beyond the limits of control and true data dependences. Until now, almost all the estimations of their performance potential under different scenarios have been obtained using trace-driven or execution-driven simulation. Occasionally, some simple deterministic models have been used. We employ an analytical model based on recently introduced Fluid Stochastic Petri Nets (FSPNs) in order to capture the dynamic behavior of an ILP processor with aggressive use of prediction techniques and speculative execution. Here we define the FSPN model, derive the state equations for the underlying stochastic process and present performance evaluation results to illustrate its usage in deriving measures of interest. Our implementation-independent stochastic modeling framework reveals considerable potential for further research in this area using numerical solution of systems of partial differential equations and/or discrete-event simulation of FSPN models.

We show how to automatically verify that complex XScale-like pipelined machine models satisfy the same safety and liveness properties as their corresponding instruction set architecture models, by using the notion of well-founded equivalence bisimulation (WEB) refinement. Automation is achieved by reducing the WEB-refinement proof obligation to a formula in the logic of counter arithmetic with lambda expressions and uninterpreted functions (CLU). We use the tool UCLID to transform the resulting CLU formula into a Boolean formula, which is then checked with a SAT solver. The models we verify include features such as out of order completion, precise exceptions, branch prediction, and interrupts. We use two types of refinement maps. In one, flushing is used to map pipelined machine states to instruction set architecture states; in the other, we use the commitment approach, which is the dual of flushing, since partially completed instructions are invalidated. We present experimental results for all the machines modelled, including verification times. For our application, we found that the time spent proving liveness accounts for about 5% of the over-all verification time.

In this paper, we present a case study of formal verification of analog and mixed signal designs using SPICE circuit simulation traces. We consider verifying safety properties of Full Wave Rectifier (FWR) using SPICE circuit simulation traces. We follow the formal verification approach of where authors have used the SPICE circuit simulation traces for doing the formal analysis of the Analog and Mixed Signal circuits. We have used the Checkmate tool from CMU, which is a public domain formal verification tool for hybrid systems. Checkmate is built on the top of the Simulink/Stateflow Framework (SSF) from MATLAB from Math Works. Due to restriction imposed by Checkmate it necessitates to make the changes in the Checkmate implementation to implement the complex and non-linear systems. FWR has been implemented by using Checkmate custom blocks and Simulink blocks from MATLAB. The FWR model has been implemented in LTSPICE. The formal verification has been done for both the implementation i.e. Simulink implementation as well as LTSPICE implementation. We are able to efficiently verify the safety properties of the full wave rectifier using simulation traces from Simulink model and LTSPICE simulation.

This article explores the evolution and effectiveness of formal verification enhanced with Assertion-Based Verification (ABV) as a superior alternative to traditional Universal Verification Methodology (UVM) in complex computing chip design. Through analysis of implementation data from major semiconductor companies, including Intel's Core i7 and IBM's POWER processors, the article demonstrates how formal methods achieve up to 100% coverage of critical modules compared to UVM's typical 80-85% coverage. The research presents quantitative evidence of formal verification's advantages, including a 25-30% reduction in verification cycles, a 40% increase in security vulnerability detection, and a 55% reduction in overall verification time through advanced techniques such as compositional verification and proof decomposition. The article also addresses scalability challenges and resource optimization strategies, providing a comprehensive framework for implementing formal verification in modern chip design workflows.

Reasoning about correctness and security of software is increasingly difficult due to the complexity of modern microarchitectural features such as out-of-order execution. A class of security vulnerabilities termed Spectre that exploits side effects of speculative, out-of-order execution was announced in 2018 and has since drawn much attention. In this paper we formalise speculative execution and its side effects as an extension of a framework for reasoning about out-of-order execution in weak memory models. Our goal is to allow speculation to be reasoned about abstractly at the software level. To this end we encode speculative execution explicitly using a novel language construct and modify the definition of conditional statements correspondingly. Underlying this extension is a model that has sufficient detail to enable specification of the relevant microarchitectural features. We add an abstract cache to the global state of the system, and derive some general refinement rules that expose cache side effects due to speculative loads. The rules are encoded in a simulation tool, which we use to analyse an abstract specification of a Spectre attack and vulnerable code fragments.

In CMPs (Chip Multi-Processors), with thousand of processors, the issue of power dissipation has emerged as a matter of serious concern. Out of several factors responsible for huge power drainage the branch prediction unit of a processor contributes almost 10% of the overall power dissipation. This work aims to analyse the impact of inaccurate/faulty design on the branch predictors' power dissipation while realising speculative execution. The issue has been addressed through introduction of probable faults in a predictor that lead to mis-speculation. The prediction mechanism in CMPs also plays a role in dead-block identification, that is to avoid unutilised power consumption in a system as well as to overcome the poor cache efficiency. The performance loss of a system due to design inaccuracies/faults in dead-block prediction is also evaluated. The detail analysis reveals that the design inaccuracies of a predictor can cause a huge power loss, even up to 95%. The additional power loss in a processor can effectively be sensed to enable diagnosis of the faulty module (design inaccuracies) of predictor as well as to frame guidelines for operating mode of a CMP's cache system.

During requirement specification process of software development activities, many existing systems or business process requirements have been captured using natural language or specialized tools such as UML. However, the capturing of informal requirements into formalized properties has not been taken into attention by software developers due to time and budget constraints. It is critical for the informally captured requirements to be formally specified in order to perform system verification. Formal verification checks whether a system model meets the formal specifications while validation checks whether the developed system fulfills its intended purpose. Therefore, in this paper, we present our studies of formal verification of multi agent system using model checking approach. We have utilized model checking tool in order to execute the formal verification procedures based on a particular basic theory to verify certain kind of properties of requirement specifications. We show an example of how model checking tool could support the verification of Universiti Teknologi Malaysia (UTM) multi agent online application system and conclude that the propose model checking approach will benefit multi agent system.