This paper presents several techniques for formally verifying pipelined microprocessor implementations that contain out-of-order execution and dynamic resolution of data-dependent hazards. Our principal technique models the trace of executed instructions using a tablebased representation called a MAETT. We express invariant properties of pipelined implementations by specifying relations between elds in the MAETT. To show the viability of this technique, we have proved the correctness of a simple out-of-order completion pipelined microprocessor design using the ACL2 theorem prover. This verication was performed incrementally by proving that the specied relations hold for all microarchitectural states reachable from a ushed implementation state, eventually permitting us to prove that the entire pipelined machine design implements its ISA specication.

Based on our experience with modelling and verifying microarchitectural designs within Haskell, this paper examines our use of Haskell as host for an embedded language. In particular, we highlight our use of Haskell's lazy lists, type classes, lazy state monad, and unsafePerformIO, and point to several areas where Haskell could be improved in the future. We end with an example of a benefit gained by bringing the functional perspective to microarchitectural modelling.

Modern microprocessors require an immense investment of time and effort to create and verify, from the high-level architectural design downwards. We are exploring ways to increase the productivity of design engineers by creating a domain-specific language for specifying and simulating processor architectures. We believe that the structuring principles used in modern functional programming languages, such as static typing, parametric polymorphism, first-class functions, and lazy evaluation provide a good formalism for such a domain-specific language, and have made initial progress by creating a library on top of the functional language Haskell. We have specified the integer subset of an out-of-order, superscalar DLX microprocessor, with register-renaming, a reorder buffer, a global reservation station, multiple execution units, and speculative branch execution. Two key abstractions of this library are the signal abstract data type (ADT), which models the simulation history of a wire, and the transaction ADT, which models the state of an entire instruction as it travels through the microprocessor. 1

Hawk is a language for the specification of microprocessors at the microarchitectural level. In this paper we use Hawk to specify a modern microarchitecture based on the Intel P6 with features such as speculation, register renaming, and superscalar out-of-order execution.

This paper introduces a new specification style for processor microarchitectures. Our goal is to produce very simple, compact, but cycle-accurate descriptions, in order to enable early exploration of different microarchitectures and their performance. The key idea behind our approach is that we can derive the difficult-to-design forwarding and stall logic completely automatically. We have implemented a specification language for pipelined processors, along with an automatic translator that creates cycle-accurate software simulators from the specifications. We have specified a pipelined MIPS integer core in our language. The entire specification is less than 300 lines long and implements all user-mode instructions except for coprocessor support. The resulting, automatically-generated, cycle-accurate simulator achieves over 240,000 instructions per second simulating MIPS machine code. This performance is within an order of magnitude of large, hand-crafted, cycle-accurate simulators, but our specification is far easier to create, read, and modify.

The effectiveness of hardware verification techniques has increased markedly in the past decade. As hardware verification techniques become increasingly powerful the idea of transitioning verification technology to industry can be taken seriously. Nevertheless, powerful decision procedures that can completely automate the verification of certain types of hardware, whether they are BDD based model-checkers [10] or automatic microprocessor verification tools [4], cannot be adequate on their own for industrial hardware verification. However, a high-level, general-purpose theorem prover with specific capabilities can provide an overall framework in which these tools can be embedded and in which they can then be effectively used for industrial hardware verification. 1 Introduction The effectiveness of hardware verification techniques has increased markedly in the past decade. These techniques span a spectrum from automatic techniques to interactive theorem proving techniques. At one end o...

this paper, we would rather define a concrete pipelined machine model and discuss its verification. We believe that our method is not limited to our specific machine design, and we hope we can reuse our methodology for other processor designs in future projects. Our pipelined machine model tries to capture several interesting features of today's pipelined microprocessor, such as out-of-order execution of instructions, speculative execution and multiple execution units. One of the hardest parts to verify in processor designs is the control logic, so we added a relatively complex issuing logic to our machine design, which stalls the pipeline whenever necessary to prevent data and structural hazards. We want to claim that the verification of our pipelined machine is much more difficult than a simple DLX pipeline implemation which has little pipeline interlocks, because it is this complexity in This research was supported in part by the Semiconductor Research Corporation under con