1. Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 1 Georg Hofferek and Roderick Bloem Institute for Applied Information Processing and Communications Graz University of Technology, Austria georg.hofferek@iaik.tugraz.at Quaint Kick-OffGeorg HofferekFebruary 2012 Controller Synthesis for Pipelined Circuits Using Uninterpreted Functions

2. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 2 Quaint Kick-OffGeorg HofferekFebruary 2012 Imperative vs. Declarative  Imperative Paradigm  How to do something  Declarative Paradigm  What to do int compute(int input) { if(input > 0) return (input-1); else return (input+1); } assert(abs(result-input)==1);

3. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 3 Quaint Kick-OffGeorg HofferekFebruary 2012 Motivation: Pipelined Microprocessor Registers / Memory f1f1 f2f2 fnfn c1c1 c2c2 cncn Controller Registers / Memory f1f1 f2f2 fnfn Non-pipelined processor: Pipelined processor, using the same combinational datapath elements:

4. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 4 Quaint Kick-OffGeorg HofferekFebruary 2012 Equivalence: Commutativity Pipelined Architecture Non-Pipelined Architecture complete step Instr. Set Arch. (ISA) Burch-Dill paradigm: Instruction Set Architecture Pipelined Architecture

5. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 5 Quaint Kick-OffGeorg HofferekFebruary 2012 Abstraction by Uninterpreted Functions f f a a f(a)

6. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 6 Quaint Kick-OffGeorg HofferekFebruary 2012 (Very) Simple Example Registers REG ALU c ontrol v w d est s ource Read Write Registers REG ALU s ource d est Read Write Non-pipelined Architecture (=reference): Pipelined Architecture:

7. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 7 Quaint Kick-OffGeorg HofferekFebruary 2012 Example: Equivalence Criterion complete – ISA: step – complete: analogous Equivalence criterion: complete ISA Registers REG AL U c ontrol v w d est s ource Read Write Pipelined Architecture: Registers REG ALU s ource d est Read Write Non-pipelined Architecture (=reference):

8. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 8 Quaint Kick-OffGeorg HofferekFebruary 2012 Synthesis Approach  Define equivalence criterion:  Claim:  If the claim is valid, extract Registers REG ALU c ontrol v w d est s ource Read Write

9. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 9 Quaint Kick-OffGeorg HofferekFebruary 2012 Reductions  Equivalence criterion is a (closed) second-order formula, using the theories of  Arrays (A)  Uninterpreted Functions (U)  Equality (E)  with limited quantification.  Three (validity-preserving) reductions:  AUE  UE(cf. Bradley et al.)  UE  E(cf. Ackermann’s reduction)  E  Propositional Logic(cf. Bryant et al.)

10. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 10 Quaint Kick-OffGeorg HofferekFebruary 2012 Proof Structure  Construct from, according to standard procedure(s)  Show that if is valid, then also is valid. 1. Choose arbitrarily 2. Map to according to 3. Find some by using validity of 4. Map to according to 5. Choose arbitrarily 6. Map to according to 7. Show that implies (by using structural similarities) Directionof proof

11. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 11 Quaint Kick-OffGeorg HofferekFebruary 2012 AUE  UE 1.Replace Array-Writes with fresh variables and apply write axiom 2.Replace universal quantifications with conjunction over index set 3.Replace Array-Reads with uninterpreted functions

12. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 12 Quaint Kick-OffGeorg HofferekFebruary 2012 Ackermann’s Reduction: UE  E  Replace all function instances with fresh variables  Add functional consistency constraints

13. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 13 Quaint Kick-OffGeorg HofferekFebruary 2012 E  Propositional Logic  Replace equalities with fresh Boolean variables to obtain  Compute transitivity constraints from (chordal) equality graph

14. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 14 Quaint Kick-OffGeorg HofferekFebruary 2012 Extract Function for Control Logic  We started from:  Apply transformations, obtain  Universally quantify “next states”  i.e., quantify all variables which “come from” one of the next state variables. E.g.  Expand existential quantification of  Example:  Find cofactors of  Positive Cofactor: ON-Set + DC-Set  Negative Cofactor: OFF-Set + DC-Set  Find function in this interval Don’t-Care-Set OFF-Set ON-Set Solution

15. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 15 Quaint Kick-OffGeorg HofferekFebruary 2012 Experimental Results  Equivalence Criterion for Simple Example:  Manually reduced from AUE to UE and from UE to E  Semi-manually reduced from E to propositional logic  BDD-based computation of c:  ~14 hours for simple example  Most time for reordering during creation of transitivity constraints  ~10 minutes with variable order determined by the 14 hour run  Resulting interval had two non-trivial boundaries and contained the expected result

16. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 16 Quaint Kick-OffGeorg HofferekFebruary 2012 Synthesis via Interpolation A B Both 0 and 1 allowed. “Don’t Care-Set” I

17. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 17 Quaint Kick-OffGeorg HofferekFebruary 2012 Summary of Synthesis algorithm  We started from  a datapath of the target system  a reference implementation  an equivalence criterion  We obtained  Boolean function(s) for the control logic  in terms of  (dis-)equalities between inputs and states  Example: = Datapath Registers REG ALUALU c ontrol v w d est s ourc e Read Write Pipelined Architecture: Registers REG ALUALU s ou rce d e st Read Write Non-pipelined Architecture (=reference): DIAMOND Review Meeting, Graz, Feb 14th 2012 17

18. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 18 Quaint Kick-OffGeorg HofferekFebruary 2012 SURAQ Tool  Synthesizer using Uninterpreted functions, aRrays And eQuality  SMTLIB 2  AUE  UE Reduction  Existential Expansion Not to be confused with Surak, a legendary Vulcan philosopher, scientist, and logician. © Paramount Pictures and/or CBS Studios

19. http://www.iaik.tugraz.at Institute for Applied Information Processing and Communications (IAIK) – Secure & Correct Systems 19 Quaint Kick-OffGeorg HofferekFebruary 2012 Open Challenges  Interpolating Multiple Control Signals at once  Joint work with Ashutosh Gupta, IST Austria  Semi-solved  Multiple (time) instances of one control signal in formula  Basic idea, but not proof yet  Is it possible at all?  Quantitative Aspects  Small interpolants, strong interpolants  Joint work with Georg Weissenbacher, Princeton University, Vienna University of Technology  Other Application Domains  Concurrent software