Adding 32-bit Mode to the ACL2 Model of the x86 ISA

Abstract

Intel's modern x86 processors offer various modes of operation [15, Volume 1, Section 3.1]. The IA-32 architecture supports 32-bit computing by giving access to 2 32 bytes of memory, and it provides three modes:1. Real-address mode, which is the x86 processor's mode upon power-up or reset. 2. Protected mode, which is informally referred to as the "32-bit mode"; this mode can also emulate the real-address mode if its virtual-8086 mode attribute is set. 3. System management mode, which is used to run firmware to obtain fine-grained control over system resources to perform operations like power management. The Intel 64 architecture added the IA-32e mode, which has two sub-modes:1. 64-bit mode, which gives access to 2 64 bytes of memory, and thus, allows the execution of 64-bit code. 2. Compatibility mode, which allows the execution of legacy 16-and 32-bit code inside a 64-bit operating system; in this sense, it is similar to 32-bit protected mode vis-à-vis application programs. The 64-bit model of the x86 ISA, discussed briefly in Section 2.2, specified only the 64-bit sub-mode of IA-32e mode. In the subsequent sections, we focus on 32-bit protected mode and compatibility mode. Modeling the rest of the modes is a task for the future (see Section 5).IA-32e and 32-bit protected modes are the most used operating modes of x86 processors today. A big difference between these modes is in their memory models -we first briefly discuss the memory organization on x86 machines. There are two main types of memory address spaces: physical address space and linear address space. The physical address space refers to the processor's main memory; it is the range of addresses that a processor can generate on its address bus. The linear address space refers to the processor's linear memory, which is an abstraction of the main memory (see paging below). Programs usually do not access the physical address space directly; instead, they access the linear address space.Segmentation and paging are two main facilities on x86 machines that manage a program's view of the memory; see Figure 1. When using segmentation, programs traffic in logical addresses, which consist of a segment selector and an effective address. The x86 processors provide six (user-level) segment selector registers -CS, SS, DS, ES, FS, and GS. A segment selector points to a data structure, called a segment descriptor, that contains, among other information, the segment base, which specifies the starting address of the segment, and the segment limit, which specifies the size of the segment. As an optimization, the processor caches information from this data structure in the hidden part of these registers whenever a selector register is loaded. The segment base is added to the effective address to obtain the linear address. The upshot of this is that the linear address space is divided into a group of segments. An operating system can assign different sets of segments to different programs or even different segments to the same program (e.g., separate ones for code, data, an...

Verifying x86 instruction implementations

“…We use the ACL2 theorem prover [2] and built-in verified proof routines [37,35] to model and verify a target RTL implementation of instruction execution. All specifications are written in ACL2-our x86 ISA specification [31,16] as well as our proprietary micro-architectural model. Leveraging publicly available ACL2 libraries (many of which were developed by our team), we translate the SystemVerilog design into a formal model within ACL2.…”