A processor formal verification method and system

Abstract

The application provides a processor formal verification method, comprising: using a first-order logic tautology as an abstract rule required by processor formal verification, the first-order logic tautology comprising a seed tautology and a composite tautology, so as to cover a data path and a control path of the processor by the first-order logic tautology; mapping the first-order logic tautology to an instruction sequence to be tested, and saving the instruction sequence into a scheduler; connecting the scheduler to an instruction fetch stage of the processor, and determining whether the first-order logic tautology is violated according to a result of executing the instruction sequence corresponding to the first-order logic tautology by the processor, so as to determine whether the implementation of the processor is correct. The application also provides a corresponding system. The processor formal verification method of the application realizes the generation of a tautology-induced general property, so as to overcome the defects of incomplete bug type coverage and poor expansibility of the self-consistency property as a general property when performing processor formal verification.

Description

Technical Field

[0001] This invention pertains to static verification technology for processors, particularly formal verification of processors. Specifically, it relates to a formal verification method and system for processors, which uses first-order logic tautologies to induce the automatic generation of verification attributes in formal verification. Background Technology

[0002] Processor design verification is a crucial step in the processor design process, checking whether the processor design is correct and safe. It accounts for nearly half of the cost and time in the processor design process.

[0003] Formal verification of a processor refers to a process of verifying a processor using mathematical and logical reasoning methods. Based on formal specifications and property descriptions, it comprehensively and systematically verifies the correctness and functionality of the chip design through mathematical models and automated reasoning techniques. Chip design specifications (functions, interfaces, constraints, etc.) are typically described using formal languages ​​(such as sequential logic, state machines, and predicate logic). Formal verification is a crucial means of ensuring the correctness and security of processor chips and has been successfully used for chip design verification.

[0004] Model checking, as a formal verification method, has been widely used in hardware development due to its ability to achieve full automation and comprehensive model coverage. The method involves building a mathematical model (state transition system) of the system to be verified, specifying the properties to be proven, and exhaustively traversing the system's state space to check for violations of these properties.

[0005] Current processor design verification primarily utilizes symbolic model checking (SMA). Compared to explicit model checking (SMT), SMA can handle much larger-scale problems. Bounded model checking (BMC) is a highly efficient error-checking technique. BMC uses SAT / SMT to determine whether the model violates the properties being verified within a finite number of state transitions, enabling the verification of chip designs with thousands of registers.

[0006] Properties are primarily described using SVA (System Verilog Assertion) or PSL (Property Specification Language). Writing these assertions demands a high level of skill from the verifiers, requiring them to be well-versed in the details of processor microarchitecture design, and writing assertions is a very tedious task. ARM researchers proposed an end-to-end ISA (Instruction Set Architecture) level verification strategy. Unlike module-level verification that targets individual blocks, end-to-end verification focuses on verifying the chip's architectural specifications. The advantage of end-to-end verification is that it allows for a departure from microarchitectural details, enabling a holistic consideration of the chip design's correctness.

[0007] However, ISA-level formal verification is based on defining properties for each instruction. In some complex instruction processors, defining properties for each instruction is not a simple task. Therefore, a formal verification method using universal properties emerged—Quick Error Detection (QED). Properties are the characteristics to be verified, such as functional correctness, timing constraints, deadlocks, or conflicts. Universal properties mean that the properties are not customized to a specific design, but rather characterize the correctness of the system using a universal principle. The universal property used in QED is called self-consistency, meaning that two executions of the same instruction sequence should produce the same result. QED detection can quickly find some relatively subtle bugs. Methods derived from QED include Symbolic Quick Error Detection (SQED) and Symbolic Quick Error Detection with Symbolic InitialState (SQED). 2 QED (Quick Error Detection with Symbol Initial State), etc.

[0008] However, simply detecting consistency attributes cannot fully cover the types of faults in chip design. Chip design faults can be divided into single-instruction bugs and multi-instruction bugs. A single-instruction bug is caused by a single instruction's implementation not conforming to the specification; the processor will execute that instruction, resulting in the bug. A multi-instruction bug, on the other hand, requires a specific instruction to trigger the bug condition.

[0009] The premise of checking for errors using consistency properties is ensuring that the implementation of each instruction is correct. Modern processors implement various optimization techniques, and different combinations of instruction sequences executed in the pipeline can activate potential bugs. Therefore, even if a single instruction is correctly implemented according to the instruction set manual, it does not guarantee that the processor is correct. These bugs associated with instruction sequences are called multi-instruction bugs. Consistency does not inherently cover single-instruction bugs because a single instruction implementation error will simultaneously affect the behavior of both the original instruction sequence and the copied instruction sequence. Specifically, checking for consistency properties cannot detect errors in the implementation of a single instruction. For example, if an addition instruction is implemented as a subtraction instruction in the decoding unit, this error cannot be covered by consistency properties. The program is compiled into a sequence of instructions and executed on the processor. End-to-end model verification can detect whether the properties are violated after a sequence of instructions is executed. Checking for consistency properties examines whether the execution of the original instruction sequence and the copied instruction sequence produce different results. Since each instruction in the copy instruction sequence corresponds to one instruction in the original instruction sequence and has the same opcode, their execution results should be completely identical. For example, if addition is implemented as subtraction, and the addition instruction in the original instruction sequence is decoded as subtraction, then the addition instruction in the copy instruction sequence will also be decoded as subtraction, and there will be no difference when comparing the results.

[0010] Secondly, methods like QED explore the state space by enumerating various instruction sequences through a solver. The duplication of copies increases the complexity of the proof and often results in poor scalability when dealing with large-scale chip designs. Summary of the Invention

[0011] The purpose of this invention is to provide a processor formal verification method and system to overcome the shortcomings of incomplete bug coverage and poor scalability when using self-consistency attributes as general attributes during processor formal verification.

[0012] To achieve the above objectives, the present invention provides a processor formal verification method, comprising:

[0013] S1: Use first-order logic tautologies as abstract specifications required for processor formal verification. The first-order logic tautologies include seed tautologies and composite tautologies, so as to cover the processor's data path and control path through first-order logic tautologies.

[0014] S2: Use the first-order logic tautology to map out the instruction sequence to be tested, and save the instruction sequence into a scheduler;

[0015] S3: Connect the scheduler to the processor's instruction fetch stage so that the processor fetches instructions from the scheduler. Determine whether the first-order logic tautology has been violated based on the result of the instruction sequence corresponding to the first-order logic tautology executed by the processor, and thus determine whether the processor's implementation is correct.

[0016] The seed tautology is derived from tautologies in mathematics and covers the basic operations of all components in the data path and control path; the composite tautology is generated using the tautology synthesis method based on template tautologies and seed tautologies as raw materials. The template tautology is a tautology that does not contain predicates and functions in form, but only consists of logical connectors and terms.

[0017] The tautology synthesis method includes:

[0018] A1: Select at least one seed tautology and one template. Replace all items in the template with the seed tautology, where the same item is guaranteed to be replaced with the same seed tautology, to obtain a compound tautology.

[0019] A2: Traverse all seed tautologies and all templates, and repeat A1 until all compound tautologies are generated.

[0020] In step S1, the composite tautology and the seed tautology are stored together in a tautology database as a test set.

[0021] Step S2 specifically includes:

[0022] S21: Perform syntactic and semantic analysis on all first-order logical tautologies to parse out the abstract syntax tree, and compile the first-order logical tautologies into an intermediate representation independent of the ISA.

[0023] S22: Using the ISA architecture to translate the intermediate representation into a symbolic instruction sequence;

[0024] S23: Save the symbolic instruction sequence to a scheduler.

[0025] In step S3, if the result of the symbolic instruction sequence corresponding to the first-order logic tautology executed by the processor is false, the processor implementation is incorrect; otherwise, the processor implementation is correct.

[0026] In step S3, the scheduler is connected to the processor's instruction fetch stage, specifically including:

[0027] S31: Initialize the processor's architecture state variables, including setting the Finish register Finish_Reg to 0 and the Result register Result_Reg to 1;

[0028] S32: In the scheduler, for the end of the instruction sequence mapped by at least one first-order logic tautology in the same batch of tests, the instruction with Finish Register set to 1, the instruction with Result Register set to 0, and the instruction with Finish Register set to 1 are stored in sequence to obtain the instruction queue to be launched, instr_queue.

[0029] S33: Based on the processor's value acquisition behavior, the scheduler sends the sequence of instructions to be issued to the processor's pipeline.

[0030] In step S33, the instruction sequence to be issued in the scheduler is issued to the processor pipeline, specifically including: the processor converts the PC value into the fetch index of the instruction queue in the scheduler according to the PC value, so as to fetch instructions from the instruction queue in the scheduler according to the fetch index of the instruction queue.

[0031] The instruction fetch index of the instruction queue is:

[0032] index=(current_PC-ENTRY_POINT) / FETCH_BYTES-1,

[0033] Where current_PC is the current PC value, ENTRY_POINT is the processor's instruction fetch start address, and FETCH_BYTES is the size of the instruction issued by the scheduler in bytes each time.

[0034] Instructions are fetched from the scheduler's instruction queue based on the fetch index of the instruction queue, specifically including:

[0035] Under normal circumstances, the index ptr of the instruction issued from the instruction queue is equal to the fetch index index of the instruction queue;

[0036] When a branch instruction is encountered and the jump distance exceeds the length of the instruction queue, the instruction index ptr = index - 2 is issued, and the instruction that sets the result register Result_Reg to 0 is issued through the instruction index ptr.

[0037] When a branch instruction is encountered and the jump distance is within the length of the instruction queue, the issue instruction index ptr is equal to the fetch index of the instruction queue.

[0038] The specific implementation of the processor is the processor's RTL source code; the scheduler accesses the processor's instruction fetch stage, specifically including: embedding the scheduler's code into the processor's RTL source code, and embedding the assertion Finish_Re g→Result_Re g into the RTL source code to obtain the embedded RTL source code;

[0039] After the scheduler accesses the processor's instruction fetching stage, the process also includes: using an open-source RTL synthesis tool to convert the processor's embedded RTL source code into a BTOR2 file, and then using an SMT solver to solve the BTOR2 file to obtain the result of the instruction sequence corresponding to the processor's execution of the first-order logic tautology.

[0040] On the other hand, the present invention provides a processor formal verification system, comprising:

[0041] The integrated tautology module is configured to use first-order logic tautologies as the abstract specifications required for processor formal verification. The first-order logic tautologies include seed tautologies and composite tautologies, so as to cover the processor's data path and control path through first-order logic tautologies.

[0042] An instruction scheduler construction module is configured to map the instruction sequence to be tested using the first-order logic tautology and save the instruction sequence into a scheduler; and

[0043] The model verification module is configured to connect the scheduler to the processor's instruction fetching stage, so that the processor fetches instructions from the scheduler and determines whether the first-order logic tautology is violated based on the result of the instruction sequence corresponding to the first-order logic tautology executed by the processor, thereby determining whether the processor's implementation is correct.

[0044] The integrated tautology module is further configured to: generate a composite tautology using a tautology synthesis method based on template tautology and seed tautology as raw materials;

[0045] The seed tautology is derived from tautologies in mathematics and covers the basic operations of all components in the data path and control path; the template tautology is a tautology that does not contain predicates and functions in form, but only consists of logical connectors and terms.

[0046] The tautology synthesis method includes:

[0047] A1: Select at least one seed tautology and one template. Replace all items in the template with the seed tautology, where the same item is guaranteed to be replaced with the same seed tautology, to obtain a compound tautology.

[0048] A2: Traverse all seed tautologies and all templates, and repeat A1 until all compound tautologies are generated.

[0049] The innovation of the processor formal verification method of the present invention lies in using the tautology in predicate logic as the abstract specification of chip design. The tautology induces universal properties, which realizes the generation of tautology-induced universal properties (TIUP). This overcomes the shortcomings of incomplete bug coverage and poor scalability faced by self-consistent properties as universal properties when performing processor formal verification. Attached Figure Description

[0050] Figure 1 This is a system architecture diagram of a processor formal verification system according to an embodiment of the present invention.

[0051] Figure 2 This is a schematic diagram of the principle of the comprehensive tautology.

[0052] Figure 3 This is a schematic diagram illustrating the behavior of issuing instructions from the scheduler's instruction queue.

[0053] Figure 4 These are experimental data graphs of the processor formal verification system of the present invention. Detailed Implementation

[0054] The present invention will be further described below with reference to specific embodiments. It should be understood that the following embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0055] The principle of the processor formal verification method of the present invention is as follows:

[0056] Each first-order logic tautology, as a formal system and abstract specification, reflects the correctness of the processor. Here, the abstract specification is in contrast to the concrete specification, which refers to the specific functions, interfaces, constraints, etc., implemented by the processor. A tautology, on the other hand, is a mathematical expression, an abstract specification. This abstract specification, as an attribute, can be represented as the following tautology:

[0057]

[0058] Here, f is a first-order logic formula. A tautology represents a statement that is always true. In mathematics, f is enclosed in a tautology. This symbol indicates that f is a tautology.

[0059] The processor is the object of verification, and the attributes are the properties of verification. Therefore, under the aforementioned formal system, the processor can be modeled as a state machine:<S,S0,r,i> S represents a state variable, and S' represents the next state of S; S0 is a predicate that initializes the state variable; r represents a transition relation, which indicates the condition for the state machine to perform a state transition, i.e., the processor will transition from one state to the next after executing an instruction. r(S,S',i) indicates that the system transitioned from state S to state S' after executing instruction i. Safety attributes are typically restrictions or constraints on system behavior to ensure that the system does not engage in unsafe or unintended behavior. For a safety attribute SP, the formal proof process involves checking whether the transition system will enter a state S that violates the safety attribute from a reachable state. v .

[0060] The principle of the processor formal verification method of the present invention during verification is as follows:

[0061] S0(S)&&I f =C(f)&&r(S0(S),S v ,I f )&&! SP→⊥

[0062] S0(S) represents the initialization of the state variables. The initial state obtained after initialization is the Reset state, and there is only one such state; r(S0(S),S v ,I f In the diagram, the transition is from state S0 to state S. v S v This is the new state of S0 after the transition, and in this state S v This violates a security property. The symbol ⊥ means logically False.

[0063] Among them, I f =C(f) represents the tautology f to the instruction sequence I. f The mapping is such that the instruction sequence is compiled from tautologies, thus making each tautology correspond to an instruction sequence.

[0064] For example, in the tautology x + y = y + x, the instruction sequence contains two addition instructions, one comparison instruction, and one instruction to write the comparison result back to the result register.

[0065] Verifying whether a processor satisfies a tautology involves testing whether the processor system enters a bad state that violates the tautology under the instruction sequence transitions mapped by the tautology. If the processor system enters a bad state that violates the tautology under the instruction sequence transitions mapped by the tautology, then the processor does not satisfy the abstract specification corresponding to the tautology; otherwise, it proves that the processor implementation does not violate the abstract specification corresponding to the current tautology, and the processor implementation is correct.

[0066] Based on the above principles, see Figure 1 The processor formal verification method of the present invention includes:

[0067] Step S1: Use first-order logic tautologies as abstract specifications required for processor formal verification. The first-order logic tautologies include seed tautologies and composite tautologies to cover the processor's data path and control path through first-order logic tautologies.

[0068] Each first-order logic tautology serves as an abstract reduction and is used to determine the instruction sequence I to be tested. f This approach ensures that each first-order logic tautology is equivalent to a test case for a unit test. Unit tests target the detection of one or more general properties within the processor. The advantage of this approach is that it reduces the state space enumerated by the solver during unit testing, allowing for faster completion of unit tests. Furthermore, comprehensive testing ensures the completeness of functional tests, thus improving the scalability of the processor formal verification method in this invention for large-scale circuit designs. The solver here is analogous to an engine that determines whether the processor's hardware model conforms to the abstract specification; examples include AVR, ABC, NuxMV, PONO, and PDTrav.

[0069] Furthermore, since the abstract specifications required for processor formal verification do not originate directly from the architecture manual, but rather rely on a composite tautology constructed using a seed tautology and the tautology synthesis method unique to this invention, these abstract specifications are independent of the ISA (Instruction Set Architecture). Therefore, they can cover both the processor's data path and control path, describing the properties that processor execution units should satisfy through various abstract specifications, thus achieving complete testing. The central processing unit (CPU) includes a data path and a control path. The data path refers to the circuitry and logic units within the processor used to process and manipulate data. It includes hardware components such as registers, arithmetic logic units, data selectors, and shifters, used for performing operations such as computation, data transfer, and logical operations. The control path is the control unit within the processor, responsible for decoding and executing instructions and coordinating the operations of various hardware components. It includes hardware components such as the program counter, decoding unit, branch prediction unit, and reorder cache.

[0070] The seed tautology originates from common mathematical tautologies (such as commutative, associative, and distributive laws), and covers the basic operations of all components in the data and control paths (e.g., the basic operations of the arithmetic logic unit (ALU), multiplication / division unit, and branch prediction unit). In other words, to test a corresponding unit, the seed tautology must contain the opcodes of the corresponding components in the data and control paths. For example, to test the add operation in the arithmetic logic unit, the seed tautology must contain the "+" operation; to test the branch prediction unit, the seed tautology must contain the implied operation.

[0071] Some examples of seed tautologies include:

[0072] a. Commutative property: x + y = y + x; x × y = y × x

[0073] b. Associative Law: x + (y + z) = (x + y) + z; x × (y × z) = (x × y) × z

[0074] c. Distributive Law: x×(y+z)=x×y+x×z;x×(yz)=x×yx×z

[0075]

[0076] f. Modular multiplication identity: (x×y)%z = ((x%z)×(y%z))%z

[0077] g. De Morgan's Laws:

[0078] h. Implication: (x+y>0)&&(y+z<0)→(x+y)×(y+z)<0

[0079] Among them, the commutative law "x+y=y+x" is a tautology in first-order logic (FOL), and any processor that implements the "+" operation should satisfy this property.

[0080] The composite tautology is generated using the unique tautology synthesis method of this invention, based on template tautologies and seed tautologies as raw materials. The composite tautology is used to provide more complex test instruction sequences.

[0081] Template tautologies are tautologies that, in form, contain no predicates or functions, but only logical connectors and terms. The reason for introducing template tautologies is to construct more complex control logic. The role of logical connectors will be further explained below.

[0082] Here are some examples of template tautologies:

[0083] a.

[0084] b.

[0085] c.

[0086] d.

[0087] The various connectors in the formula have the same meaning as those defined in first-order logic, namely, logical NOT, logical AND, logical OR, logical equivalence, and logical implication.

[0088] like Figure 2 As shown, the tautology synthesis method of the present invention includes:

[0089] A1: Select at least one seed tautology and one template. Replace all items in the template with the seed tautology, where the same item is guaranteed to be replaced with the same seed tautology, to obtain a compound tautology.

[0090] A2: Traverse all seed tautologies and all templates, and repeat A1 until all compound tautologies are generated.

[0091] The traversal process employs a depth-first search.

[0092] In this embodiment, F is predefined as the set of all templates, E as the set of all seeds, and G as the output of the algorithm—the set of composite tautologies. A template is sequentially selected from F and replaced with a seed from E; the traversal process employs a depth-first search.

[0093] Therefore, the tautology synthesis method of the present invention still yields a tautology after synthesis.

[0094] The constructed composite tautology, together with the seed tautology, is stored in a tautology database (i.e., a general attribute set) as a test set.

[0095] Step S2: Map a sequence of instructions to be tested using the first-order logic tautology, and save the instruction sequence into a scheduler;

[0096] The scheduler is used to access the instruction fetching stage of the pipeline during the verification stage in step S3.

[0097] Step S2 specifically includes:

[0098] Step S21: Perform syntactic and semantic analysis on all first-order logical tautologies using Flex and Bison respectively, and parse out the abstract syntax tree to compile the first-order logical tautologies into an intermediate representation (IR) that is independent of the ISA.

[0099] The intermediate representation is from a first-order logic tautology to the final instruction sequence I. f The intermediate representation, already reflecting the instruction type, allows for easy expansion to support verification of processors with different instruction set architectures. The intermediate representation is unified, while the architectures vary. The advantage of introducing an intermediate representation is that processors based on different ISAs only need to implement an ISA-related backend (a compiler that translates the intermediate representation into instructions) to convert the intermediate representation into ISA-specific instruction sequences. Furthermore, the backend implementation differs for different ISAs.

[0100] Intermediate representations do not directly contain functions, predicates, or connectors. Instead, they describe the processor's data and control operations as defined by first-order logical tautologies. The functions, predicates, and logical connectors of these tautologies correspond to the instruction's opcode, implying that the connector represents a jump instruction. Variables and constants correspond to the instruction's operands, which in turn correspond to the instruction's registers and immediate values.

[0101] Step S22: Use the ISA architecture to translate the intermediate representation into a symbolic instruction sequence.

[0102] Therefore, the symbolic instruction sequence is an instruction sequence I specific to the ISA. fIn other words, although tautologies are general properties and do not depend on the ISA, the instruction sequence that a tautology is ultimately translated into is related to the ISA architecture. Processor ISAs (Instruction Set Architectures) include x86, ARM, MIPS, RISC, etc.

[0103] Step S23: Save the symbolic instruction sequence to a scheduler.

[0104] The scheduler is used to integrate into the instruction fetch stage of the processor pipeline during the verification phase to simulate the processor's instruction fetch behavior.

[0105] The scheduler design considers various scenarios, including sequential instruction fetching and jump instruction fetching. The scheduler is a Verilog module implemented in this invention, which is embedded into the RTL of the processor under test during verification.

[0106] The symbolic instruction sequence is referred to as IUV (Instruction Under Verification).

[0107] Step S3: Connect the scheduler to the processor's instruction fetch stage so that the processor fetches instructions from the scheduler. Determine whether the first-order logic tautology has been violated based on the result of the instruction sequence corresponding to the first-order logic tautology executed by the processor, and thus determine whether the processor's implementation is correct.

[0108] Specifically, if the processor executes a sequence of symbolized instructions corresponding to a first-order logical tautology and the result is false, it means that the processor's implementation does not satisfy the abstract specifications corresponding to all first-order logical tautologies, and the processor's implementation is incorrect; conversely, it means that the processor satisfies the abstract specifications corresponding to all first-order logical tautologies, and the processor's implementation is correct. In other words, a correctly implemented processor will not obtain any false result for any tautology.

[0109] During verification, the scheduler will be integrated into the instruction fetch stage of the processor pipeline, acting as an I-Cache. However, the scheduler will not appear in the final tape-out code and should not occupy the final chip area or overhead.

[0110] In step S3, the scheduler is connected to the processor's instruction fetch stage, specifically including:

[0111] Step S31: Initialize the processor's architecture state variables;

[0112] In this embodiment, initializing the processor's architecture state variables specifically includes: initializing the values ​​of general-purpose registers, that is, setting two general-purpose registers as Finish_Reg and Result_Reg, setting Finish_Reg to 0, and setting Result_Reg to 1.

[0113] The Finish register Finish_Reg is used to indicate whether all instruction sequences in the scheduler have been committed in the pipeline. When all instruction sequences have been committed in the pipeline, the Finish register Finish_Reg is rewritten to 1.

[0114] The Result_Reg register reflects whether the processor satisfies the abstract specification corresponding to the tautology. Specifically, the Result_Reg register is a reserved register selected from the general-purpose registers, and its value is initialized to 1. Each first-order logical tautology maps to a sequence of instructions I. f After execution, the result is written back to Result_Reg. If the processor satisfies the abstract reduction corresponding to the tautology, the value of Result_Reg is still 1; otherwise, if the processor does not satisfy the abstract reduction corresponding to the tautology, the value of Result_Reg is 0. This corresponds exactly to the tautology being True, where the invariant Inv(S) means Re_sult_Re_g ≡ 1, indicating that the processor satisfies the tautology.

[0115] It should be noted that all tautologies share a single result register, Result_Reg. During testing, on the one hand, tautology reductions can be tested one by one, and if an error occurs, it is basically determined that the tautology being tested has been violated. On the other hand, to improve the efficiency of detection, tautology reductions in the tautology database can be tested simultaneously to obtain the result of whether there is a violated tautology among multiple tautologies.

[0116] Step S32: In the scheduler, for the end of the instruction sequence mapped by at least one first-order logic tautology in the same batch of tests, the instruction with Finish Register set to 1, the instruction with Result Register set to 0, and the instruction with Finish Register set to 1 are stored in sequence to obtain the instruction queue to be launched, instr_queue.

[0117] Therefore, at this time, the scheduler's instruction queue instr_queue stores three types of instructions: instructions mapped by first-order logic tautologies, instructions with the finish register Finish_Reg set to 1, and instructions with the result register Result_Reg set to 0.

[0118] The instruction queue `instr_queue` is used to store one or more tautologies tested at the same time. If multiple tautologies are tested at once, the instruction sequences mapped to these tautologies are all stored in the same instruction queue `instr_queue`.

[0119] The last instruction in the scheduler is to set the Finish_Reg register to 1, which means that all instructions mapped by the tautology have been executed and attribute checks can be performed.

[0120] Therefore, there will be two instructions that set the Finish_Reg register to 1. The first one is placed after all the instruction sequences mapped by the tautology. This one indicates that the instruction sequences mapped by the tautology have been issued from the queue and executed. Once executed, attribute checking can proceed. The second one is placed at the end of the entire queue, preceded by an instruction with Result_Reg set to 0. The reason for setting this one is that if the processor fetches instructions normally, they are fetched sequentially, and the preceding Finish_Reg can indicate the time point for attribute checking. However, there are also branch jumps. If the processor's branching mechanism is incorrect, the scheduler will eventually issue the instruction with Result_Reg set to 0. But after issuance, a final end marker is needed, which is the instruction with Finish_Reg set to 1 at the end of the instruction queue instr_queue.

[0121] Step S33: Based on the processor's value acquisition behavior, issue the sequence of instructions to be issued in the scheduler to the processor's pipeline.

[0122] The scheduler's instruction issuance behavior is consistent with the processor's actual instruction fetching behavior from memory. That is, the sequence of instructions to be issued in the scheduler is issued into the processor's pipeline. Specifically, the processor converts the PC (instruction counter) value into a fetch index for the instruction queue in the scheduler, and then fetches instructions from the instruction queue in the scheduler according to the fetch index.

[0123] Since the scheduler acts as an instruction memory, the PC value needs to be converted into the fetch index of the instruction queue in the scheduler so that instructions can be fetched from the instruction queue in the scheduler according to the fetch index of the instruction queue.

[0124] The instruction fetch index of the instruction queue is:

[0125] index=(current_PC-ENTRY_POINT) / FETCH_BYTES-1,

[0126] Where current_PC is the current PC value, ENTRY_POINT is the processor's instruction fetch start address, and FETCH_BYTES is the size of the instruction issued by the scheduler in bytes each time.

[0127] Instructions are fetched from the scheduler's instruction queue based on their index, specifically including:

[0128] 1) Under normal circumstances (i.e., when no branch instruction is encountered), the index ptr of the instruction issued from the instruction queue is equal to the index index of the instruction queue.

[0129] Because Result_Reg is initialized to 1, if the processor is implemented correctly, executing the instruction sequence mapped by the tautology will not affect Result_Reg = 1. However, if the implementation is incorrect, Result_Reg will be automatically written to 0 during the execution of these instruction sequences. For example, the instruction sequence mapped by xyz = x - (y + z) includes xyz, x - (y + z), and a comparison between xyz and x - (y + z). Result_Reg will only be 1 if the comparison is correct; otherwise, it will be 0. The required comparison instruction is also part of the instruction sequence mapped by xyz = x - (y + z).

[0130] 2) such as Figure 3 As shown, when a branch instruction is encountered (such as P→Q), the processor will jump to fetch the instruction.

[0131] If the jump distance exceeds the length of the instruction queue, the index ptr of the issued instruction is equal to the index index of the instruction queue - 2, and thus the instruction that sets the result register Result_Reg to 0 is issued through the index ptr of the issued instruction.

[0132] During the translation of the intermediate representation into a symbolic instruction sequence, the compiler automatically calculates the jump distance. The length of the instruction queue is a fixed value after a tautology is given; this length depends on the number of instructions translated from the tautology and also on the instruction length.

[0133] Furthermore, even if the jump distance does not exceed the length of the instruction queue, and the index ptr of the instruction issued from the instruction queue is equal to the index of the instruction queue, but a branch prediction error occurs, resulting in an incorrect prediction address (for example, it should jump from instruction block P to instruction block Q, but it incorrectly jumps to instruction block J, indicating an incorrect jump, in which case ptr will be forced to point to the location of the instruction where Result_Reg is 0), and the incorrect instruction is retrieved and successfully committed, this will also cause a violation of the tautology.

[0134] The predicted address is calculated by the processor's BPU unit. As mentioned earlier, processors with branch prediction predict instruction fetch; if the predicted address is incorrect, the final result of this instruction will not be committed to the processor's architectural state.

[0135] In this embodiment, the processor's specific implementation is its RTL source code. The correctness of the processor's implementation is determined based on the result of the processor executing the instruction sequence. Specifically, the scheduler's access to the processor's instruction fetch stage includes: embedding the scheduler's code into the processor's RTL source code, and embedding the assertion Finish_Re g → Result_Re g into the RTL source code to obtain the embedded RTL source code. After the scheduler accesses the processor's instruction fetch stage, the process further includes: using an open-source RTL synthesis tool (such as Yosys) to convert the embedded RTL source code of the processor into a BTOR2 file, and then using an SMT solver to solve the BTOR2 file to obtain the result of the instruction sequence corresponding to the processor executing the first-order logic tautology, for processor verification. The SMT solver is a backend engine used to verify whether the established model meets the specification. The BTOR2 format is a word-level model format that can capture hardware and software models in a bit-precise manner. Therefore, if the processor implementation violates the abstract specification mapped by the current first-order logic tautology, the SMT solver will provide a counterexample trajectory. Based on this counterexample trajectory, engineers can locate the bug. The solver will provide a result of either satisfies or unsaties. If unsaties are found, it will also provide a counterexample trajectory indicating the instruction sequence in which the processor executed the error.

[0136] Therefore, the processor formal verification method of the present invention can directly verify the processor's RTL source code, but does not require verification engineers to insert too many assertions. The processor formal verification method of the present invention only needs to check the assertion Finish_Reg→Result_Reg, where the middle arrow represents logical implication, to determine whether the assertion is true, and thus determine whether the processor implementation is correct. Specifically, if the assertion Finish_Reg→Result_Reg is true, it means that the processor implementation is correct.

[0137] Experimental results:

[0138] In one example of step S2 above, for the first-order logical tautology (x+y>0)&&(y+z<0)→(x+y)×(y+z)<0, this first-order logical tautology (x+y>0)&&(y+z<0)→(x+y)×(y+z)<0 implies that this is an abstract specification related to control flow. That is, when the antecedent (i.e. (x+y>0)&&(y+z<0)) is true, the processor must jump to the code segment of the consequent (i.e. (x+y)×(y+z)<0) for execution, and the result returned after the consequent is executed must be true.

[0139] The efficiency and practicality of the processor formal verification method of this invention were tested using two open-source CPUs. BIRISCV is a dual-issue, seven-stage pipelined sequential processor; RIDECORE is a dual-issue, six-stage pipelined, out-of-order processor. Twenty common bugs in industrial design were injected into both processors. Pono was used as the SMT solver. The experimental machine used an Intel(R) Core(TM) i9-10900K CPU with a 3.70GHz clock speed and 64GB of memory. The experimental comparison selected SQED and SQCORE based on self-consistency properties. 2 QED method.

[0140] Figure 4 The middle section summarizes the experimental data. The first column is the bug number; the second is the bug description; the third indicates whether the bug is single-instruction or multi-instruction; the fourth shows the distribution of the bug across the two processors; the last three columns compare the three methods; and the last five rows summarize the overall results. Experimental results show that TIUP can detect two types of bugs; however, it is slightly slower than SQED and S... 2 QED, but it is significantly better than the former two in terms of the longest time to find bugs.

[0141] Figure 1This is a system architecture diagram of a processor formal verification system according to an embodiment of the present invention. Figure 1 As shown, the processor formal verification system includes a synthesis tautology module 100, an instruction scheduler construction module 200, and a model verification module 300.

[0142] Among them, the comprehensive tautology module 100 is configured to use first-order logic tautology as the abstract specification required for processor formal verification. The first-order logic tautology includes seed tautology and composite tautology, so as to cover the processor's data path and control path through first-order logic tautology.

[0143] The instruction scheduler construction module 200 is configured to use the first-order logic tautology to map the instruction sequence to be tested and save the instruction sequence into a scheduler.

[0144] The model verification module 300 is configured to connect the scheduler to the processor's instruction fetching stage, so that the processor fetches instructions from the scheduler and determines whether the first-order logic tautology is violated based on the result of the instruction sequence corresponding to the first-order logic tautology executed by the processor, thereby determining whether the processor's implementation is correct.

[0145] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of the invention. Various variations can be made to the above embodiments of the present invention. All simple and equivalent changes and modifications made in accordance with the claims and description of this application fall within the protection scope of the claims of this patent. All aspects not described in detail in this invention are conventional technical content.

Claims

1. A processor formal verification method, characterized in that, include: Step S1: Use first-order logic tautologies as abstract specifications required for processor formal verification. The first-order logic tautologies include seed tautologies and composite tautologies to cover the processor's data path and control path through first-order logic tautologies. Step S2: Map the instruction sequence to be tested using the first-order logic tautology, and save the instruction sequence into a scheduler; Step S3: Connect the scheduler to the processor's instruction fetch stage so that the processor fetches instructions from the scheduler. Determine whether the first-order logic tautology is violated based on the result of the instruction sequence corresponding to the first-order logic tautology executed by the processor, and then determine whether the processor's implementation is correct. The seed tautology is derived from tautologies in mathematics and covers the basic operations of all components in the data path and control path; the composite tautology is generated using the tautology synthesis method based on template tautologies and seed tautologies as raw materials. The template tautology is a tautology that does not contain predicates and functions in form, but only consists of logical connectors and terms. The tautology synthesis method includes: A1: Select at least one seed tautology and one template. Replace all items in the template with the seed tautology, where the same item is guaranteed to be replaced with the same seed tautology, to obtain a compound tautology. A2: Traverse all seed tautologies and all templates, and repeat A1 until all compound tautologies are generated.

2. The processor formal verification method according to claim 1, characterized in that, In step S1, the composite tautology and the seed tautology are stored together in a tautology database as a test set.

3. The processor formal verification method according to claim 1, characterized in that, Step S2 specifically includes: Step S21: Perform syntactic and semantic analysis on all first-order logical tautologies to parse out the abstract syntax tree, so as to compile the first-order logical tautologies into an intermediate representation independent of ISA; Step S22: Translate the intermediate representation into a symbolic instruction sequence using the ISA architecture; Step S23: Save the symbolic instruction sequence to a scheduler.

4. The processor formal verification method according to claim 1, characterized in that, In step S3, if the result of the symbolic instruction sequence corresponding to the first-order logic tautology executed by the processor is false, the processor implementation is incorrect; otherwise, the processor implementation is correct.

5. The processor formal verification method according to claim 1, characterized in that, In step S3, the scheduler is connected to the processor's instruction fetch stage, specifically including: Step S31: Initialize the processor's architecture state variables, including setting the Finish register Finish_Reg to 0 and the Result register Result_Reg to 1; Step S32: In the scheduler, for the end of the instruction sequence mapped by at least one first-order logic tautology in the same batch of tests, the instruction with Finish Register set to 1, the instruction with Result Register set to 0, and the instruction with Finish Register set to 1 are stored in sequence to obtain the instruction queue to be launched, instr_queue. Step S33: Based on the processor's value acquisition behavior, issue the sequence of instructions to be issued in the scheduler to the processor's pipeline.

6. The processor formal verification method according to claim 5, characterized in that, In step S33, the instruction sequence to be issued in the scheduler is issued to the processor pipeline, specifically including: the processor converts the PC value into the fetch index of the instruction queue in the scheduler according to the PC value, so as to fetch instructions from the instruction queue in the scheduler according to the fetch index of the instruction queue. The instruction fetch index of the instruction queue is: ， in, The current PC value, To fetch the start address for the processor, This represents the size of the command issued by the scheduler in bytes each time. Instructions are fetched from the scheduler's instruction queue based on their index, specifically including: Under normal circumstances, the index ptr of the instruction issued from the instruction queue is equal to the fetch index of the instruction queue. When a branch instruction is encountered and the jump distance exceeds the length of the instruction queue, the instruction index ptr = index - 2 is issued, and the instruction that sets the result register Result_Reg to 0 is issued through the instruction index ptr. When a branch instruction is encountered and the jump distance is within the length of the instruction queue, the issue instruction index ptr is equal to the instruction queue fetch index index.

7. The processor formal verification method according to claim 1, characterized in that, In step S3, the specific implementation of the processor is the processor's RTL source code; the scheduler access to the processor's instruction fetch stage specifically includes: embedding the scheduler's code into the processor's RTL source code, and embedding assertions in the RTL source code. This yields the embedded RTL source code; After the scheduler accesses the processor's instruction fetching stage, the process also includes: using an open-source RTL synthesis tool to convert the processor's embedded RTL source code into a BTOR2 file, and then using an SMT solver to solve the BTOR2 file to obtain the result of the instruction sequence corresponding to the processor's execution of the first-order logic tautology.

8. A processor formal verification system, characterized in that, include: The integrated tautology module is configured to use first-order logic tautologies as the abstract specifications required for processor formal verification. The first-order logic tautologies include seed tautologies and composite tautologies, so as to cover the processor's data path and control path through first-order logic tautologies. The instruction scheduler construction module is configured to map the instruction sequence to be tested using the first-order logic tautology and save the instruction sequence into a scheduler. and The model verification module is configured to connect the scheduler to the processor's instruction fetching stage so that the processor fetches instructions from the scheduler and determines whether the first-order logic tautology is violated based on the result of the instruction sequence corresponding to the first-order logic tautology executed by the processor, thereby determining whether the processor's implementation is correct. The integrated tautology module is further configured to: generate a composite tautology using a tautology synthesis method based on template tautology and seed tautology as raw materials; The seed tautology is derived from tautologies in mathematics and covers the basic operations of all components in the data path and control path; the template tautology is a tautology that does not contain predicates and functions in form, but only consists of logical connectors and terms. The tautology synthesis method includes: A1: Select at least one seed tautology and one template. Replace all items in the template with the seed tautology, where the same item is guaranteed to be replaced with the same seed tautology, to obtain a compound tautology. A2: Traverse all seed tautologies and all templates, and repeat A1 until all compound tautologies are generated.

Images