RTLcheck verifying the memory consistency of RTL designs

• Published in: MICRO-50 : the 50th annual IEEE/ACM International Symposium on Microarchitecture : proceedings : October 14-18, 2017, Cambridge, MA pp. 463 - 476
• Main Authors: Manerkar, Yatin A., Lustig, Daniel, Martonosi, Margaret, Pellauer, Michael
• Format: Conference Proceeding
• Language: English
• Published: New York, NY, USA ACM 14.10.2017
• Series: ACM Conferences
• Subjects: automated verification; Computer bugs; Computer systems organization > Architectures > Parallel architectures; Hardware; Hardware > Hardware validation > Functional verification; Hardware > Hardware validation > Functional verification > Assertion checking; Hardware design languages; Memory consistency models; Microarchitecture; Multicore processing; Pipelines; RTL; SVA; memory consistency models; RTL; automated verification; SVA
• ISBN: 1450349528; 9781450349529
• ISSN: 2379-3155
• DOI: 10.1145/3123939.3124536

Paramount to the viability of a parallel architecture is the correct implementation of its memory consistency model (MCM). Although tools exist for verifying consistency models at several design levels, a problematic verification gap exists between checking an abstract microarchitectural specification of a consistency model and verifying that the actual processor RTL implements it correctly. This paper presents RTLCheck, a methodology and tool for narrowing the microarchitecture/RTL MCM verification gap. Given a set of microarchitectural axioms about MCM behavior, an RTL design, and user-provided mappings to assist in connecting the two, RTLCheck automatically generates the SystemVerilog Assertions (SVA) needed to verify that the implementation satisfies the microarchitectural specification for a given litmus test program. When combined with existing automated MCM verification tools, RTLCheck enables test-based full-stack MCM verification from high-level languages to RTL. We evaluate RTLCheck on a multicore version of the RISC-V V-scale processor, and discover a bug in its memory implementation. Once the bug is fixed, we verify that the multicore V-scale implementation satisfies sequential consistency across 56 litmus tests. The JasperGold property verifier finds complete proofs for 89% of our properties, and can find bounded proofs for the remaining properties.