Elementary Microarchitecture Algebra

1
Elementary Microarchitecture Algebra

• John Matthews and John Launchbury
• Oregon Graduate Institute

2
Hawk Goals

• Develop specifications that are clear and
  concise
• Simulate the specifications, both concretely and
  symbolically
• Formally verify specifications at the source-code
  level

3
Algebraic Verification

• Developed a domain-specific algebra for
  microarchitectures
• Proved equational laws that hold between
  microarchitecture components
• We simplify pipelines using these laws while
  preserving functional (cycle-accurate) behavior
• But clock cycle period may change!

4
Transactions

• Group data and control information together
• Transactions - containing destinations, sources,
  and operations - flow through the model
• Decide control locally whenever possible

R3 lt- Add R1 R2
16
5
11
5
Example The SuperSimple Pipeline
Reg
ALU
Reference machine

• Each transaction is completed in one (long) clock
  cycle
• Results are written back to register file on the
  next clock cycle

6
Example The SuperSimple Pipeline
Reg
ALU
Reference machine
R3 lt- Add R1 R2
-
-
-
7
Example The SuperSimple Pipeline
Reg
ALU
Reference machine
R3 lt- Add R1 R2
R3 lt- Add R1 R2
-
-
-
-
5
11
8
Example The SuperSimple Pipeline
Reg
ALU
Reference machine
R3 lt- Add R1 R2
R3 lt- Add R1 R2
R3 lt- Add R1 R2
-
-
-
-
5
11
16
5
11
9
Example The SuperSimple Pipeline
Reg
ALU
Reference machine
R3 lt- Add R1 R2
R3 lt- Add R1 R2
R3 lt- Add R1 R2
-
-
-
-
5
11
16
5
11
R3 lt- Add R1 R2
16
5
11
10
Example The SuperSimple Pipeline
Reg
ALU
Reference machine
Reg
ALU
Pipelined machine
11
Verifying SuperSimple

• Pipelined machine should behave the same as
  reference machine, except the pipelined machine
  has one more cycle of latency

Reg
ALU
Reg
ALU
12
Verifying SuperSimple

• We incrementally simplify the pipeline
• Use local algebraic laws, each proved by
  induction over time

Reg
ALU
Reg
ALU
13
Circuit Duplication Law

• We can always duplicate a circuit without
  changing its functional behavior

F
F
F
14
Retiming the Pipeline

• We first move delay circuits forward, using the
  circuit duplication law

Reg
ALU
Reg
ALU
15
Retiming the Pipeline

• We first move delay circuits forward, using the
  circuit duplication law

Reg
ALU
Reg
ALU
16
Retiming the Pipeline

• We first move delay circuits forward, using the
  circuit duplication law

Reg
ALU
Reg
ALU
17
Time-Invariance Laws

• Delay circuits can be moved across time-invariant
  circuits without changing behavior

ALU
ALU
18
Retiming the Pipeline

• Apply time-invariance laws to continue moving
  delay circuits

Reg
ALU
Reg
ALU
19
Retiming the Pipeline

• Apply time-invariance laws to continue moving
  delay circuits

Reg
ALU
Reg
ALU
20
Retiming the Pipeline

• Apply time-invariance laws to continue moving
  delay circuits

Reg
ALU
Reg
ALU
21
Removing Forwarding Logic

• The register-bypass laws allow us to remove a
  bypass circuit on the output of a registerFile

Reg
Reg
Reg
Reg
22
Removing Forwarding Logic

• Apply register-bypass law to remove bypass circuit

Reg
ALU
Reg
ALU
23
Removing Forwarding Logic

• Apply register-bypass law to remove bypass circuit

Reg
ALU
Reg
ALU
24
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
25
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
26
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
27
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
28
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
29
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
30
Removing Forwarding Logic

• Repositioning components

Reg
ALU
Reg
ALU
31
Simplification Complete!

• Pipeline has been reduced to reference machine,
  but delayed by one clock cycle

Reg
ALU
Reg
ALU
32
Simplifying Stalling Pipelines

• More complex pipelines often have to stall to
  resolve hazards or mis-speculation
• A stalling pipeline wont be cycle-accurate with
  respect to a reference machine
• We still simplify as much as possible
• Then use other verification techniques on
  simplified pipeline
• Simplified pipeline should be easier to verify

33
The SomewhatSimple Pipeline

• Resolves mem-alu data hazards by stalling
• Resolves branch mispredictions by squashing

misp ?
hazard?
ICache
Reg
ALU
Mem
Kill
34
misp ?
hazard?
ICache
Reg
ALU
Mem
Kill
Original Pipeline
35
misp ?
hazard?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
36
misp ?
hazard?
ICache
Reg
ALU
Mem
Kill
Various Retiming Laws
Simplifying pipeline .....
37
misp ?
hazard?
ICache
Reg
ALU
Mem
Kill
Various Retiming Laws
Simplifying pipeline .....
38
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
39
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
40
misp ?
hazard?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
41
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
42
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
43
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
44
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
45
hazard?
misp ?
ICache
ALU
Mem
Reg
Kill
Simplifying pipeline .....
46
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
47
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
48
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
49
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
50
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
51
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
52
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
53
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
54
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
55
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
56
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
57
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
58
Projection Laws

• Projections are circuits that reset selected
  transaction fields to default values
• Used to indicate that only a portion of a
  transaction is needed
• Also used to capture constraints holding on a
  wire
• Projections can express conditional laws

ICache
ICache
br
59
More Projection Laws
br
misp ?
misp ?
hazard?
hazard?
ctrl
ctrl
60
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Various Projection Laws
Simplifying pipeline .....
61
br
hazard?
misp ?
br
ICache
Reg
ALU
Mem
Kill
Various Projection Laws
Simplifying pipeline .....
62
br
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
63
br
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
64
hazard?
misp ?
br
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
65
Conditional Laws

• Many components never modify branch info
• Expressed with branch projections

br
br
br
br
Mem
Mem
66
hazard?
misp ?
br
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
67
hazard?
misp ?
br
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
68
hazard?
misp ?
br
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
69
br
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
70
br
hazard?
misp ?
br
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
71
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
72
Hazard Projection

• Kill logic guarantees no data hazards on output
  wire
• H is a sequential circuit projecting out all
  hazards

hazard?
hazard?
H
Kill
Kill
73
Hazard-Bypass Law

• Conditional law that allows us to remove
  forwarding logic between pipeline stages
• But only if no hazards occur on the input
• Applicable to any two execution-unit like stages

Exec1
Exec2
H
Exec1
Exec2
H
74
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
75
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
76
hazard?
misp ?
ICache
Reg
ALU
Mem
H
Kill
Simplifying pipeline .....
77
hazard?
misp ?
ICache
Reg
ALU
Mem
H
Kill
Simplifying pipeline .....
78
hazard?
misp ?
ICache
Reg
ALU
Mem
H
Kill
Hazard-bypass Law
Simplifying pipeline .....
79
hazard?
misp ?
ICache
Reg
ALU
Mem
H
Kill
Hazard-bypass Law
Simplifying pipeline .....
80
hazard?
misp ?
ICache
Reg
ALU
Mem
H
Kill
Simplifying pipeline .....
81
hazard?
misp ?
ICache
Reg
ALU
Mem
H
Kill
Simplifying pipeline .....
82
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
83
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
84
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
85
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
86
hazard?
misp ?
ctrl
ctrl
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
87
hazard?
misp ?
ctrl
ctrl
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
88
hazard?
misp ?
ctrl
ctrl
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
89
hazard?
misp ?
ctrl
ctrl
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
90
hazard?
misp ?
ctrl
ctrl
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
91
hazard?
misp ?
ctrl
ctrl
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
92
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
93
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Register-bypass Law
Simplifying pipeline .....
94
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Register-bypass Law
Simplifying pipeline .....
95
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Register-bypass Law
Simplifying pipeline .....
96
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
97
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Simplifying pipeline .....
98
hazard?
misp ?
ICache
Reg
ALU
Mem
Kill
Final Pipeline
99
Finishing the Verification

• Pipeline is as close to reference machine as
  possible without breaking cycle-accurate behavior
• Use other techniques to finish the verification
• Removal of forwarding and delay logic makes
  verification simpler

100
Related Work

• Recursive signal definitions (Johnson)
• Transactions (Aagaard Leeser)
• Retiming (Leiserson, Saxe et al)
• Ruby (Sheeran et al) Lustre (Halbwachs)
• Term-rewriting systems (Arvind et al)
• Much work on state-machine-based verification
  (Birch Dill, McMillan, Hosabettu)
• Unpipelining (Levitt Olukotun)

101
Future Work

• Perform complete verification algebraically
• Create a remove-NOP component
• Discover appropriate simplification laws
• Extend verification to superscalar and
  out-of-order microarchitectures
• Add sequence numbers to transactions
• Create a reorder-transactions component
• Discover appropriate simplification laws

102
Conclusions

• Algebraic verification can be used to simplify
  microarchitectures prior to verification
• Can reason about microarchitectures at the
  source-code level
• Laws can be expressed visually
• Using laws doesnt require theorem-prover
  expertise
• Proving laws does perhaps use decision
  procedures
• Discovering laws can be challenging
• But laws tend to be reusable across similar
  pipelines

103
Further Reading

• Most of these laws and transformations are
  described in the following paper
• Elementary Microarchitecture Algebra, by John
  Matthews and John Launchbury, in CAV 99.
• We have several other papers introducing Hawk and
  describing microarchitecture verification based
  on transactions.
• All of these papers can be found
  at http/www.cse.ogi.edu/PacSoft/Hawk