Isla: integrating full-scale ISA semantics and axiomatic concurrency models (extended version)

Architecture specifications such as Armv8-A and RISC-V are the ultimate foundation for software verification and the correctness criteria for hardware verification. They should define the allowed sequential and relaxed-memory concurrency behaviour of programs, but hitherto there has been no integration of full-scale instruction-set architecture (ISA) semantics with axiomatic concurrency models, either in mathematics or in tools. These ISA semantics can be surprisingly large and intricate, e.g. 100k+ lines for Armv8-A. In this paper we present a tool, Isla, for computing the allowed behaviours of concurrent litmus tests with respect to full-scale ISA definitions, in Sail, and arbitrary axiomatic relaxed-memory concurrency models, in the Cat language. It is based on a generic symbolic engine for Sail ISA specifications, which should be valuable also for other verification tasks. We equip the tool with a web interface to make it widely accessible, and illustrate and evaluate it for Armv8-A and RISC-V. By using full-scale and authoritative ISA semantics, this lets one evaluate litmus tests using arbitrary user instructions with high confidence. Moreover, because these ISA specifications give detailed and validated definitions of the sequential aspects of systems functionality, as used by hypervisors and operating systems, e.g. instruction fetch, exceptions, and address translation, our tool provides a basis for developing concurrency semantics for these. We demonstrate this for the Armv8-A instruction-fetch model and self-modifying code examples of Simner et al.

In this paper we develop semantics for key aspects of the ARMv8 multiprocessor architecture: the concurrency model and much of the 64-bit application-level instruction set (ISA). Our goal is to clarify what the range of architecturally allowable behaviour is, and thereby to support future work on formal verification, analysis, and testing of concurrent ARM software and hardware. Establishing such models with high confidence is intrinsically difficult: it involves capturing the vendor's architectural intent, aspects of which (especially for concurrency) have not previously been precisely defined. We therefore first develop a concurrency model with a microarchitectural flavour, abstracting from many hardware implementation concerns but still close to hardware-designer intuition. This means it can be discussed in detail with ARM architects. We then develop a more abstract model, better suited for use as an architectural specification, which we prove sound w.r.t.~the first. The instruction semantics involves further difficulties, handling the mass of detail and the subtle intensional information required to interface to the concurrency model. We have a novel ISA description language, with a lightweight dependent type system, letting us do both with a rather direct representation of the ARM reference manual instruction descriptions. We build a tool from the combined semantics that lets one explore, either interactively or exhaustively, the full range of architecturally allowed behaviour, for litmus tests and (small) ELF executables. We prove correctness of some optimisations needed for tool performance. We validate the models by discussion with ARM staff, and by comparison against ARM hardware behaviour, for ISA single- instruction tests and concurrent litmus tests.

Computing relies on architecture specifications to decouple hardware and software development. Historically these have been prose documents, with all the problems that entails, but research over the last ten years has developed rigorous and executable-as-test-oracle specifications of mainstream architecture instruction sets and “user-mode” concurrency, clarifying architectures and bringing them into the scope of programming-language semantics and verification. However, the system semantics, of instruction-fetch and cache maintenance, exceptions and interrupts, and address translation, remains obscure, leaving us without a solid foundation for verification of security-critical systems software.In this paper we establish a robust model for one aspect of system semantics: instruction fetch and cache maintenance for ARMv8-A. Systems code relies on executing instructions that were written by data writes, e.g. in program loading, dynamic linking, JIT compilation, debugging, and OS configuration, but hardware implementations are often highly optimised, e.g. with instruction caches, linefill buffers, out-of-order fetching, branch prediction, and instruction prefetching, which can affect programmer-observable behaviour. It is essential, both for programming and verification, to abstract from such microarchitectural details as much as possible, but no more. We explore the key architecture design questions with a series of examples, discussed in detail with senior Arm staff; capture the architectural intent in operational and axiomatic semantic models, extending previous work on “user-mode” concurrency; make these models executable as test oracles for small examples; and experimentally validate them against hardware behaviour (finding a bug in one hardware device). We thereby bring these subtle issues into the mathematical domain, clarifying the architecture and enabling future work on system software verification.

The upcoming many-core architectures require software developers to exploit concurrency to utilize available computational power. Today's high-level language virtual machines (VMs), which are a cornerstone of software development, do not provide sufficient abstraction for concurrency concepts. We analyze concrete and abstract concurrency models and identify the challenges they impose for VMs. To provide sufficient concurrency support in VMs, we propose to integrate concurrency operations into VM instruction sets. Since there will always be VMs optimized for special purposes, our goal is to develop a methodology to design instruction sets with concurrency support. Therefore, we also propose a list of trade-offs that have to be investigated to advise the design of such instruction sets. As a first experiment, we implemented one instruction set extension for shared memory and one for non-shared memory concurrency. From our experimental results, we derived a list of requirements for a full-grown experimental environment for further research.

This paper describes a novel video specific instruction set architecture for ASIP design. With SIMD (Single Instruction Multiple Data) instructions, and video specific instructions, an instruction set architecture is introduced to enhance the performance for video applications. Furthermore, we quantify the improvement on H.263 encoding. In this paper, we evaluate and compare the performance of VS ISA (Video Specific Instruction Set Architecture), other DSPs (digital signal processors) and conventional SIMD media extensions in the context of video coding. Our evaluation results show that VS ISA improves the processors performance by approximate 5x on H.263 encoding, and VS ISA outperforms other architectures by 1.6x to 8.57x in computing IDCT.

Binary code injection into an executing program is a common form of attack. Most current defenses against this form of attack use a 'guard all doors' strategy, trying to block the avenues by which execution can be diverted. We describe a complementary method of protection, which disrupts foreign code execution regardless of how the code is injected. A unique and private machine instruction set for each executing program would make it difficult for an outsider to design binary attack code against that program and impossible to use the same binary attack code against multiple machines. As a proof of concept, we describe a randomized instruction set emulator (RISE), based on the open-source Valgrind x86-to-x86 binary translator. The prototype disrupts binary code injection attacks against a program without requiring its recompilation, linking, or access to source code. The paper describes the RISE implementation and its limitations, gives evidence demonstrating that RISE defeats common attacks, considers how the dense x86 instruction set affects the method, and discusses potential extensions of the idea.

Several techniques have been proposed to reduce the energy consumption of ASIPs (Application-Specific Instruction set Processors). While those techniques can reduce the energy consumption with minimal change in the instruction set (IS), they often fail to exploit the opportunity of designing the entire IS from the energy-efficiency perspective. In this chapter we present an energy-efficient IS synthesis that can comprehensively reduce the energy-delay product (EDP) of ASIPs through optimal instruction encoding, considering both the instruction bitwidth and the dynamic instruction fetch count. Experimental results with a typical embedded RISC processor show that the proposed energy-efficient IS synthesis technique can generate application-specific ISs that are up to 40% more energy-efficient over the native IS for several application benchmarks.

This paper presents BURAQ, a DSP development framework, which aims at optimizing cost, efficiency and turn around time of system-on-chip development. BURAQ accepts an instruction and architecture description (IAD) file that represents the DSP and its instruction set at a higher level of abstraction, in a proprietary language. The system then synthesizes a complete hardware description of the processor core, along with accompanying tools i.e. ILP assembler, linker and instruction set simulator. The synthesized processor core is composed of a processor kernel, registers, addressing units and functional units. A user friendly IDE for the above mentioned framework has also been developed and it allows easy specification and detailed analysis of the target architecture. Hence BURAQ allows a platform for hardware/software co-simulation of a DSP. co-simulation is a very powerful tool for early design space exploration and thus reducing production cost and development time of SOC architectures. The effectiveness of BURAQ was verified with a successful modeling of Texas Instruments' TMS320C6x and StarCore's SC140.

Conventional translation look-aside buffers(TLBs) are required to complete address translation withshort latencies, as the address translation is on the criticalpath of all memory accesses even for L1 cache hits. Such strictTLB latency restrictions limit the TLB capacity, as the latencyincrease with large TLBs may lower the overall performanceeven with potential TLB miss reductions. Furthermore, TLBsconsume a significant amount of energy as they are accessedfor every instruction fetch and data access. To avoid thelatency restriction and reduce the energy consumption, virtualcaching techniques have been proposed to defer translation toafter L1 cache misses. However, an efficient solution for thesynonym problem has been a critical issue hindering the wideadoption of virtual caching.Based on the virtual caching concept, this study proposes ahybrid virtual memory architecture extending virtual cachingto the entire cache hierarchy, aiming to improve both performanceand energy consumption. The hybrid virtual cachinguses virtual addresses augmented with address space identifiers(ASID) in the cache hierarchy for common non-synonymaddresses. For such non-synonyms, the address translationoccurs only after last-level cache (LLC) misses. For uncommonsynonym addresses, the addresses are translated to physicaladdresses with conventional TLBs before L1 cache accesses. Tosupport such hybrid translation, we propose an efficient synonymdetection mechanism based on Bloom filters which canidentify synonym candidates with few false positives. For largememory applications, delayed translation alone cannot solvethe address translation problem, as fixed-granularity delayedTLBs may not scale with the increasing memory requirements.To mitigate the translation scalability problem, this studyproposes a delayed many segment translation designed for thehybrid virtual caching. The experimental results show that ourapproach effectively lowers accesses to the TLBs, leading tosignificant power savings. In addition, the approach providesperformance improvement with scalable delayed translationwith variable length segments.

The size of the embedded software is increasing at a rapid pace. Often, the task of designing hardware that meets a lot of functionality needed in software became a challenging process and it needs more time for projecting. Then, the compression code is a way to reduce this problem. This paper presents an innovative and efficient approach to code compression. Our method reduces code size by up to 31% (including all extra costs). We performed simulations and analyzes, using the applications from benchmark MiBench and use two embedded processors (ARM and MIPS). Our method is orthogonal to approaches that take into account the particularities of a given instruction set architecture, becoming an independent method for any specific architecture. We have implemented the decompressor using VHDL and FPGA and we obtained only one clock from decompression process.

We develop a formal verification procedure to check that elastic pipelined processor designs correctly implement their instruction set architecture (ISA) specifications. The notion of correctness we use is based on refinement. Refinement proofs are based on refinement maps, which—in the context of this problem—are functions that map elastic processor states to states of the ISA specification model. Data flow in elastic architectures is complicated by the insertion of any number of buffers in any place in the design, making it hard to construct refinement maps for elastic systems in a systematic manner. We introduce token‐aware completion functions, which incorporate a mechanism to track the flow of data in elastic pipelines, as a highly automated and systematic approach to construct refinement maps. We demonstrate the efficiency of the overall verification procedure based on token‐aware completion functions using six elastic pipelined processor models based on the DLX architecture.

This study is concerned with measurements of the characteristics of current use of digital computer instruction sets, and an analysis of those measurements to produce conclusions useful for future design evaluation. The results include conclusions about computer architectures and their implementations. In order to apportion the time spent by an executing program among the various system components, a model of high-performance computers is derived from instruction timing formulas, with compensation for pipeline and cache memory effects. The model is used to predict the performance of the IBM 370/168 and the Amdahl 470 V/6 on specific programs, and the results are verified by comparison with actual performance. Measurements are made and discussed for other instruction set architectures, including a current microprocessor (the INTEL 8080), a popular minicomputer (the DEC PDP11), and a pseudo-computer used as an intermediate step for PASCAL compilation or interpretation. Some predictive models are investigated. An improved mechanism for conditional branch prediction is proposed and simulated. The performance of a radically different implementation of the 370 is examined and its performance is predicted. Finally, some of the data gathered is used as the basis for a model of the instruction fetch process; that model is solved analytically. Design rules which should be followed to allow instruction sets to be implemented with high-performance processors are given. 27 figures, 24 tables.

This work proposes a system level design of a special purpose RISC architecture for the implementation of Knowledge Based Systems (KBS). The processor implements an Instruction Set Architecture (ISA) derived from the description of the Rete algorithm given in Forgy (1982) - the paper that proposes the algorithm - alongside some general purpose instructions (not described here). It is part of a System-on-a-Chip (SoC) for the execution of cognitive agents. The computational architecture of this SoC will be presented using the cognitive model of the Concurrent Autonomous Agent (CAA) as a reference, since it has been successfully applied in numerous intelligent robotics applications. The cognitive model of the CAA comprises three levels that run concurrently: the reactive level, which executes the perception-action cycle, the instinctive level, that manages plan execution, and the cognitive level, which performs planning. In the method here proposed, the KBS knowledge base is compiled into a program composed by the application speci c instructions and the matching procedure is executed by the processor using this program. To validate the architecture of this processor, some experiments using an example knowledge base will then be presented. The experiments - performed using a system-level simulator written in the Scala language - shown that the simulated architecture reported the expected matches for additions and exclusions of facts from the Rete memories.

Concern over power dissipation in CMOS microprocessors is increasing, not just for portable battery-based applications, but also for performance-driven designs, where power may soon displace silicon area as the principal design constraint. Traditional methods of power management, such as reduced operating voltage, exotic packaging, and low-power sleep modes can help mitigate the problem, but limits and drawbacks of these methods motivate an examination of processor architecture tradeoffs from a power perspective. This research was undertaken to validate the hypothesis that the instruction set architecture can have a significant effect on power-a smaller program encoding is more energy-efficient than a larger one. In this paper, we explore the relationship of code density and instruction set richness to the energy cost of fetching and delivering instructions to the execution resources. These effects are of particular interest to instruction-level parallel machines where speculative and multiple-path instruction fetching is necessary to exploit the high execution bandwidth. >

In a dynamic reordering superscalar processor, the front-end fetches instructions and places them in the issue queue. Instructions are then issued by the back-end execution core. Till recently, the front-end was designed to maximize performance without considering energy consumption. The front-end fetches instructions as fast as it can until it is stalled by a filled issue queue or some other blocking structure. This approach wastes energy: (i) speculative execution causes many wrong-path instructions to be fetched and executed, and (ii) back-end execution rate is usually less than its peak rate, but front-end structures are dimensioned to sustained peak performance. Dynamically reducing the front-end instruction rate and the active size of front-end structure (e.g. issue queue) is a required performance-energy trade-off. Techniques proposed in the literature attack only one of these effects. In this paper, we propose Speculative Instruction Window Weighting (SIWW), a fetch gating technique that allows to address both fetch gating and instruction issue queue dynamic sizing. A global weight is computed on the set of inflight instructions. This weight depends on the number and types of inflight instructions (non-branches, high confidence or low confidence branches, ...). The front-end instruction rate can be continuously adapted based on this weight. SIWW is shown to perform better than previously proposed fetch gating techniques. SIWW is also shown to allow to dynamically adapt the size of the active instruction queue.