Verifying x86 instruction implementations

Abstract

Verification of modern microprocessors is a complex task that requires a substantial allocation of resources. Despite significant progress in formal verification, the goal of complete verification of an industrial design has not been achieved. In this paper, we describe a current contribution of formal methods to the validation of modern x86 microprocessors at Centaur Technology. We focus on proving correctness of instruction implementations, which includes the decoding of an instruction, its translation into a sequence of micro-operations, any subsequent execution of traps to microcode ROM, and the implementation of these micro-operations in execution units. All these tasks are performed within one verification framework, which includes a theorem prover, a verified symbolic simulator, and SAT solvers. We describe the work of defining the needed formal models for both the architecture and micro-architecture in this framework, as well as tools for decomposing the requisite properties into smaller lemmas which can be automatically checked. We additionally cover the advantages and limitations of our approach. To our knowledge, there are no similar results in the verification of implementations of an x86 microprocessor.

Balancing Automation and Control for Formal Verification of Microprocessors

“…-how memory is organized -how an instruction is decoded into a sequence of microoperations -the set of microoperations implemented in hardware -the throughput and latency of microoperations and instructions and various others features of the microprocessor. In our previous work [21], we described what it means for an x86 instruction to be decoded and executed correctly and how our proofs capture this property. For illustrative purposes, we use the same example that was described in that work.…”

“…Finally, we note that in our previous work [21], we used GL-the predecessor of FGL-as our core verification tool. The benefits of switching to FGL have been considerable.…”

“…During the first years of FV at Centaur, we limited the proof for each microoperation to the specific unit where it was executed [25,26,37]. Since then, improvements to our RTL modeling and symbolic simulation (i.e., FGL) allow us to do the proofs in the scope of the module containing all those units (we refer to that module as the execution module or EXE) [21]. Migration to a higher scope has a huge advantage for the stability of the proofs.…”

Scalable validation of binary lifters

“…Formal specification of instruction sets are critical in directly reasoning about low-level machine code [86,89,88,112], verifying computer processor architectures [138,139,132,140], compilers [141,90,142,143], verifying assembly language functions against a specification [144], binary rewriting across architectures [82], verified binary decompilation [145,78,146,103], abstract interpretation of binaries [147,148], automated testcase generation [149,100], synthesis of instruction semantics [87], and formalizing multiprocessor memory models [127,126]. There exist a number of notable specifications of ISAs (e.g., RISC-V [128,90,141], MIPS [128,119], CHERI-MIPS [128], PowerPC [143,91,90], SPARC [91], ARM [150,151,152,119,140,132,153,154] etc.)…”

“…Second, since our method can symbolically execute instructions, it can be used to generate input tests that have high coverage. While such analyses have been done at the detailed RTL level [191,192,193,139,140,194,155,138], there exists limited similar line of work at the x86-64 ISA level 15 . The most significant advantage of such symbolic execution is the ability to detect corner case or hard to detect bugs [191,195].…”