Formal Verification of a Novel Snoopi ng Cache Coherence Protocol for CMP Xuemei Zhao Karl Sammut and Fangpo He School of Informatics and Engineering Flinders University Australia zhao karl PDF document - DocSlides

Page 1
Formal Verification of a Novel Snoopi ng Cache Coherence Protocol for CMP Xuemei Zhao, Karl Sammut, and Fangpo He School of Informatics and Engineering Flinders University, Australia {zhao0043, karl.sammut, fangpo.he}@flinders.edu.au Abstract The Chip Multiprocessor (CMP) architecture offers dramatically faster retrieval of shared data which is cached on-chip rather than in an off-chip memory. Remote cache requests are handled through a cache coherence protocol. In order to obtain the best possible performance with the CMP architecture, the cache coherence protocol must be optimized to reduce time lost during remote cache and off- chip memory accesses. This paper proposes a novel snooping cache coherence protoc ol for CMP in which each processor has both private and shared L2 caches. The cache coherence protocol is proven by means of formal verification methods. 1. Introduction With the emergence of the CMP design paradigm, it has become possible to integrate multiple processors and large caches on a single chip to increase computation performance for a wide variety of workloads. The bus- based shared-memory mul tiprocessor architecture, formerly developed for the Symmetric Multiprocessor (SMP), is still commonly used for the design of small- scale CMPs. It facilitates the use of snooping protocols and achieves low-latency cache-to-cache misses by broadcasting requests for shared data on the bus. However, in comparison with the SMP, the access time of remote cache requests on CMP is reduced dramatically, and is faster than the off-chip me mory access time. Therefore, directly employing the traditional SMP memory hierarchy and coherence protocol with the CMP would diminish its performance advantage. The optimal design of the CMP’s on-chip cache presents a key ch allenge in efficiently using limited on-chip cache capacity while keeping the number of off-chip accesses to a minimum. Some CMP systems employ private L2 caches [1][2] to attain fast average cache access latency by placing data close to the requesting processor. To prevent replication and improve the CMP's performance, IBM Power 4 [3] and Sun Niagara [4] use shared L2 caches to maximize the on-chip capacity. Recently, several hybri d L2 organizations have been proposed to reduce access latency by a compromise between the low latency of private L2 and the low off-chip access rate of shared L2. For instance, CMP-NuRapid [5], Victim replication [6], Ad aptive Selective Replication scheme [7], and Cooperative Caching [8] are mainly based on either private L2 or shared L2. These schemes represent modifications to the basic architecture and coherence protocol (snooping or directory-based), however, no formal verification of the modified cache coherence protocols is available. We propose an alternative novel L2 cache architecture, in which each processor has plit rivate and hared L2 (SPS2). When data is loaded it is located in private L2 or shared L2 according to its state (exclusive or shared). This scheme makes efficient use of on-chip L2 capacity and has low average access latency. The use of formal verification techniques to prove the functional correctness of CMP cache structures is becoming an increasingly essential part of the design process, particularly si nce most cache performance improvements come at the cost of greater hardware design and cache protocol complexity. It is especially useful for discovering and correcting any er rors at the early stage of protocol design before expending valuable time and resources on a novel strategy. Several formal verification methods have been applied to verify the correctness of some cache coherence pr otocols [9][10][11]. The principal contributions presented here include: (i) a novel L2 cache architectur e - SPS2, and (ii) a novel snooping cache-coherence prot ocol accompanied with its formal verification method. Due to the distinctive architecture of SPS2, we use a new state graph method to express state transactions in our cache coherence protocol, and verify its correctness an d properties using the formal verification method. 2. Cache Architecture In this paper, we limit our consideration to a 2-level on-chip cache hierarchy, although the proposed SPS2 architecture can be readily extended to include more than 2 levels. A traditional bus-based shared-memory multiprocessor has either private L1s and private L2s, or private L1s and a shared L2. Both cache architectures have their pros and cons. The private L2 architecture has fast L2 hit latency but can suffer from large amounts of replicated shared data copies which reduce on-chip capacity and increase the off-chip access ra te. Conversely, the shared L2 architecture reduces the off-chip access rates for large shared working datasets by avoiding wasting cache space on replicated copies. The banked shared L2 cache organization is a well-known method to reduce access latency. However, average L2 access latency is still influenced by relative placem ent on the die and network congestion. We propose a new scheme, SPS2, to organize the placement of data. All data items are categorised into one of two classes depending on whether the data is shared or exclusive. Correspondingly, the L2 cache hardware organization of each processor is also divided into two parts, private and shared L2 . The proposed scheme places
Page 2
exclusi e data in t e pri ate L2 cac he a nd sha data i the s are L2 cache. T is a rangem nt provides fast cac he accesses for unique data from the pri ate L . It also allows rge am ount dat be ed bet een se veral pr ocess rs wi re pl cat on o t e dat a nd t hus m kes better use of t e available s ed L2 cache c pacity whic h is d str bu ted betw een t e ocessor . e p se d SPS 2 cac he sc hem i sho n i Fi gu 1. Each pr oces sor ha s ow private L (PL1), pri ate L (PL2 ) an d sh ared L2 (SL2). Th e sh ared L2 is a m lti- ban cac he t at co ul d be a ccessed by al t e p oce sso rs directly ove r t e bus The co rres onding ca che cohe rence pr ot oc ol i re rre d t as t SPS 2 p ot oc . In t pa pe we fi a nod e as an en tity co risin a sing le pr ocess r a d t ree cac hes, i e., PL 1, PL2 and SL2 I a phy si cal real zat on, SL c d ha ve t e sa n er o banks as the num er of proc essors, where each SL 2 ba nk is ph ysically lo cated clo e to its resp ectiv e cesso r. Th regu lar stru cture is v ry am ab le to VLSI en tatio n al hou ot he ba nk ar ran ent co ul d al so be use . Th e ro le of t e SL2 is to store sh ared d ta, wh ile th e ro le of PL2 i t st e odi fi ed e cl usi e dat . Al new ta fo r readi i fe hed fr om m ry and sim neo y loade into PL1 and SL2. Da ta for writing will be placed PL1 . P 1 an d PL 2 a e excl usi e, b PL1 an d SL 2 are in clu e. If a d ta item ex ists in PL1 th en it can not also ex ist in PL2, wev r, if ex clusiv e ta is ev icted fro PL1 it will b p aced in PL2 fro where it m y later ev icted ag ain b ck to m ry. If a sh ared ta ite ex ists in PL1 th en a cop m st ex ist in SL2 ho wev r, t e ex isten ce a ta ite in SL2 s no t i y th at a cop st also exist in a PL 1 cac he. CP c L1 L1 PL SL CP c L1 L1 PL SL CP c L1 L1 PL SL CP c L1 L1 PL SL To Me mo Figure 1. SPS2 cache a itecture Unlike the unifie d L cache struct ure the SPS2 syste with its split pri ate and share L2 caches ca n be fl exi a i ndi vi al de si gne d acc or di ng t dem nd. First, PL2 c uld be designe as a direct-mappe d cache t ov id e st access and l w po wh ile SL2 cou d be designe as a set-ass ciative cache t re duce c nflict. Secon , PL2 an d SL2 do no t hav to m tch each r in size, and they could ha ve differe nt replac ent policies. We c e al t ad va nt ages o di vi di ng s are d and m odified data. Ta ke for e am ple an a pplication co risin a l rg e qu an tity of sh ared d ta th at eeds to use by se vera t rea f om di ffe re nt pr oce ssor a d al a larg e tity o ta th at is ex cl iv e to cesso r. In the case of a private L architecture se veral copies of the sam share data set will exist in t e L2 caches of the di ffe re nt p oc essor . T a chitecture wil suffer from wasted cac he space nd r higher numbers of on-c hi p sses for l rge dat set an d/ or m pl e co nc ur ren processes/threa s. In the case of a s are L arc itecture, any proces sor can access all of t e sha data, howeve , si nce m ny of t e req est dat bl oc ks wo ul n be available in the local ba nk , it will result in high access nci s whi bl oc ks are f hed fr om ot her ba nk s. I t case of t e SPS2 a itecture, eac h proc essor has t separate caches (PL and SL 2), which oul d be indivi dually a d sim ltaneously accessed. This sc hem reduces acce ss latency and c ntention betwe n s are data and e cl usi e dat . It i pose a l L hi l ncy beca use st of t e e cl usi e dat sho be i t l ca PL2. Sha data will be pl aced in SL2 which collectively pr hi gh st ora capaci hel re duce of f-c hi access. T e SPS2 c ache syste does not need any new ad ition l CPU i stru ction to su ppo rt its , and hence c nge s t t i ruct n-set o U ha rd ware interface a e requi red t ena le the cac he syste to work with a co nv en tio l m ltip rocessor d si gn . Th e y rts that need to be m odified c rise the cac he arc itecture and t e cache controller tha includes t realization of cache c here nc e prot ocol. 3. Description of Coherence Protoco e pr ot ol em pl oy ed i SPS i base d t e M (M ne d, S I val pr ot oc ol a d ces n new st at es. Da cont ai ne d i PL1 m have all four possi ble states (M, O, S, I), while share data cont ai ne i 2 has t st at es ( , I), an d e dat co nt ai ne i PL 2 has t ee possi ble states (M, O, I). The S p ot oc ol use t e wri -i nval dat p o write-back ca ches. T kee consistency and c ohe re ncy betwee n the t ree differe t caches, t e ca che c ohe rence pr ot oc ol s al be m odi fi ed acc or di ngl Th e pro oco wo rk s ro ug y as fo llows. In itially, an y ta en tr y i t e t e cach s (PL1 , PL2 an d SL2) shou ld be In val Whe n ode m kes a read access for a st ruct o dat bl oc k at a gi ven ad es s, P will searche fi rst. Since PL is em y, th en PL2 and SL2 w be searc next. Again, ne ither PL nor SL2 hav t requ ested d ta, so a GetS m ssag will b sen on th e bu s. Since all the caches in all the proce ssors are initially in lid , th e m ry will pu t th e ta th e bu s, an d SL2 and PL will b store t e ta and ch ang th ei r states fr om I to S. If a other n e requ ires th is sam d ta sh ortly after, t e ta will be cop ed fro SL2 t PL1 without nee ing fetch the data from mory or to place anot her c py i PL . If a rea re est fin the data in t local PL , th en no s tran sactio is n ed ed and ta will be s ppl t t e pr ocess di rect . Whe no de needs to m ke a write access a nd a write ss i det ect ed bec use t e dat bl ock i not pres ent i PL1 , P , a d SL 2, t ca che c nt st art a bl oc k replacem ent cycle, possibly evic ting a dirty bloc k from the cache. A Get m ssage will be sent on the bus to fetch data from the other node or m ry and place the requested data in the rece ntly vacated slot. All the othe r nodes will che k thei r own PL1 a d PL2 caches for the requested data. If a node, for e am ple , f nds M di fi
Page 3
(M) d ta wit sam add ess as th e requ ested ta, th e co en ts will be sen t PL1 and all the cac hes (includi ng an d ex clud ing ) sh ou i te ta with th is ad dress. Once t e data is placed in PL1 and up dat d, i st at e wi be cha ged t M Si nce t e S PS2 sc hem em pl oy s a wri ack po licy, m fied d ta will n b written ack t me ry until it is replaced. A data ite m with state M means this node exclusi ely re tains the m st recent versi on th e ta and t at t e in m ry is ob so lete. If, con sel , t wri ope rat n fi nd s t dat bl oc k i PL or PL with st ate M (im lyin a write h it), th en t e write process will proceed with no bus tra sactions invol ved. Su pp ose t at a r ode e ec a ite co mma anot her no de n eeds read d ta o fetch in stru ctio n from sam ad ess, it will ch eck PL1 first, t en PL2 an d SL 2. Since a y copy that node have p evi ousl hel wo ul ha ve be en val at ed by e wri o erat n fr no de , it will b e to fi th e ta lo cally. Th erefore a GetS m ssag will p aced on th e requ esting t e ot he r n ode s t send bac t e dat . N de will ch eck its ow PL and PL2 , an d f th e r qu ested data b k w ith state M in PL . The odifie data will then be placed on the bus and st ored i both SL 2 and PL . The cache state in PL1 will b chan fro M to O and th at i PL1 will b set to S. If a free sl ot is not ava ilable in a y of the caches, the th e ex isting data b will n ed to swapp an d repl ace d wi t e new bl oc ol d dat bl ock 1 will b ev icted to PL2 if it s state is M or O. An y ta ev icted fro PL2 will b wri tten b ck to me ry. If th e state of t dat e icted from PL 1 is S, whi h m eans that SL2 m st ha a co py , t en t e dat nee n be c pi ed ack to SL2, bu t sim ly in lid ated . Wh en ta in SL2 is ev icted write ack is n n ed ed. 4. Formal Verification of Cache Coherence Protocol Cache c here nce is a critical requirement for c rrect or of a m syst . Th e go al of a fo al pr ot oc ol veri fi cat on pr oce e i t p ove at i ad heres to a gi ven s ecification. T e s ecification is a list of cor ect ness ope rt s re qui red fr om t e pr ot oc ol . T e cache protoc ol veri fication pr oce ure i cludes c ecki g fo r dat c nsi ncy i pr ot oc ol speci fi cat n, and a se nce of deadl and l el ock Usi g f rm al verification i the ea rly stage of t e des gn proces s is lpfu l in find ing con istency p em s a elim in atin g them before c tting to ha rd ware . To m in tain ta co nsistency b tween cach es and me ry, each node is e qui ppe d with a finite-state cont roller t at reacts to the rea a d write re quests Ab st ractin g fro th e lo w-lev l im en tio tails of read, write, an d syn hron izatio primitiv es, o e consider cac he cohe re nce protoc ol as fam ilies of i entical fin ite-state ach in es. Th e follo wing section will illu strat ho t SP pr ot ol w usi a st at e m achi e descri pt 4. 1 St at e gra o SP S2 cac he p ot ocol Each node i the SPS2 a itecture has three cac hes (PL , PL 2, a d SL 2), each of whic h has its own state represe tation. Thes e three s ates can be c oncate ated to form a single vector { YZ } representing the state of si ngl e cac he bl ock i a ode . X indicates the state of a PL 1 cache bl oc k with four pos ible states (I, S, M, O), Y indicates the state of a PL 2 ca che bl oc k wi ree p ssi bl states (I, M, O), and Z indicates the state of a SL 2 cache wh ich has on ly two states ( an d S) . Th er ef or e, fo each node cache bloc k oul d ha ve up to 4× 3× 2=24 di ffe re nt st at es, al gh so of the e states are unreac hable. For e am ple, SM S is a i possible state, because if PL 2 has a m odifi ed bloc k, it is im possible for bot h P an SL 2 t h ve sha ed c opi es o t bl ock An ot he r i pos si bl e st at e f a dat bl oc k i IM S, whi h lies th at the b k in PL1 is inv lid, wh e PL2 a odi fi ed ver an d SL 2 s a share c py . Excl g the set of i nval d states, the e are only seve n pos sible states, i.e., III, IIS, SIS, II, IMI, OIS, and IOS. III is th e in itial state of ea ch data bloc k. III II SI OI IO MI IM re re /w ri te ead ri ead rep re (a) State transition graph (from processor perspective) III IIS SI OI IO MI IM Ge (b) State transition graph (from bus perspective) Fig re State tran sitio n graph SPS2 cache pro Ou r co he rence pr ot oc ol re qui res t o di ere set of co mman . All th e transitio arcs i Figure 2(a) corres pond to access c mmands iss by a local process r. T e comm ands are labeled as re , write , and replacem ent ( rep1 , re p2 and repS ). All th e arcs in Fi gu re 2( b) c rres on d t c ands i ssue by pr cesso rs vi a t sn oop ing bu s. Th ey i clud e GetS , GetX , in , invS . All ese c nds a e defi ned bel w: read : issue when a process r nee s to fetch in stru ction or l ad d ta; write : issued when a process r n eed s to write ta; rep1 i ssue en PL 1 nee s ro om for ne w dat rep2 i ssue en PL 2 nee s ro om for ne w dat repS i ssue en SL 2 nee s ro om for ne w dat
Page 4
GetS : issu ed wh en requ estin g r no s or m ry to sh are d ta, fo llo wi a read ss; GetX i ssue whe req est ng ot her ode or m ry for ex clu e data, fo llo wi a write miss; in i ssue t nval at co pi es i ot her no des en a local write access res lts in a hit. in vS : issu ed t inv lid ate her co es in PL1 wh en a cache bloc k i SL2 is re place d. As s n i Fi gu re 2, t e cac he st at e o a no de wi change to t e next state accord g to its curre nt state a the recei ved command. 4. 2 Veri fi cat n usi g Hy Tec One of t ne w t hni que s descri bed i t e resea literatu re relat t form al v ri ficatio coh ren e pr ot oc ol s, i val at e pr ot oc ol s i de nde nt of t num ber of p ocess rs i t e sy st em . Thi t echni qu e i refe rre to as param terized verificatio n. In this sectio n, HyTech [12], an a straction- lev l m l check er, is ed to ve rify the SPS2 cach coherence prot oc ol. The fi st t d fi ne t e SP S2 pr ot oc ol usi a fin ite-state m ach in e m l. Accord ing t [13 [14 , we li mit o rselv s to con er pro s con ro llin g sing le me ry bloc ks a d si ngle cache bl oc ks although the proce ure c uld be easily extended to e com ass the whole m ry and cac he syst . Let be t e er of n es o a gi ve n ltiprocess r syste . The beha vior of the caches in no de is re presented as a finite system < , > whe e Q a fi ni set of st at es of a no de (s h as I S, IO S, etc.), is the set op eratio read , write , GetS , GetX , etc.) cau ing state tran sitio ns, : tru , fa lse } is the characte istic function from the pers pective of , a d fi s th e stat e tran sition Im (w Im ) is th e im ag e o ). Sim rl we coul d use E (e xt en ded ni -st machine) [14] to m odel pa ra terized ca che c here nce pr ot oc ol T e beha vi o sy st em i m odel d a t gl obal machine = < > wh ich is asso ciated with pr ot oc ol , where ={ , .. }. is the pos sible states of cac he bl oc one n , =< ,..., > , Im . W odel vi a a EFS with on ly on e lo catio and dat vari s < , .. ., > (d eno ed as x) rang ing ov er t e set po sitiv e in teg rs. For si licit y, lo catio cou d o itted h e th e EFSM- st at es are t upl of nat ral n bers < ,..., > (de not as c) where de not es t num ber of n es i st at es du ri a ru n of . Tra si ons a e re pr esent d vi a a col ect on of ar de d l ear t ans orm ons defi ned o the vector of varia les ..., > (de noted as x) and , .. ., > (denoted a x' ), whe e and de not e nodes in state , respectively, be fore a d after th e o cu rren ce o an ev en t. Tran sition hav th e form (x) (x,x' , where (x ) is th e gu ar and (x ,x ') is the tra rma tion Th e tr an orma tio (x ,x' is de fine as '= +c whe e is an -m at ri x wi uni vect ors as colum s. Si nc e the num er of nod es is an in rian t the syste , we req re th e tran sform to satisfy th e co nd itio n +... + x +...+ . The f wi gi ves a i al defi ni of ho t transitions of a cache ohe re nce prot ocol n be odeled vi a g de d t sf orm ons. Int nal act . Caches in a node m ove from state to state : -1, +1 with th e so th at 1 part of (x). For e am ple, a rea m ss kes the st at e of a n e ove fr om IIS to SIS. Sync hr at . Two no s syn hr on ize on a sign al: a no de in ate c ange s to state an d ano r no de in state changes t state . Th is is m led as '= -1, '= +1, '= -1, '= +1 , with th pr o t at 1, 1 part of (x). For i stance, a rea m ss not o m ke a n e c an ge fr om II S S, b al m ke an ot he r no de cha ge fr om M II t OIS Re-a llo ca tion . T e state of all nodes ,... is a con nt num ber no des wh ose st at e ch ange s fo r and to state fo r : '=0,. .., '= '= +...+ , '= . Thi feat ure ca n be use t odel bus i va at on si gnal . So o th e tran sition ru les are listed in Fig re 3. Because SPS2 prot ocol has s ve n diffe rent stat es (III, IIS, SIS, IM I, OIS nd IOS , we use ese se ven vari s of i ger t t i ndi cat e seven st at es resp ectiv ely. R le co rres on ds t a read h ev en t: i.e., no act on i ne eded; a d r s 2 - 7 c rre spo to read miss eve . r t e sa ke o bre , ot he r event (s uch a write h it, writ e ss, rep ac ent, etc.) a e om itted in Fi gu re 3. SI S+ S+ MII __ III 1, MII= 0, IMI= 0 III'= , S S'= IS+ , II S'= IS III- 1 III 1, M 1 III'= SIS , MI I'= II- 1, S'= S+ 1, II S'= III- 1 III 1, IM 1 III'= SIS , IM I'= MI- IO S'= IO S+ 1, II S'= III- 1 5) I 1 IIS IIS- , SIS 6) I 1 MI I'= II+ 1, IMI MI -1 7) I 1 OIS OI S' =I OS ...... Fi gu re 3. EFS fo r S p ot ocol Po ssi e sou ces o ta in co isten y are o tlin ed bel w. (i) OIS>=1 & MII >= Th is ind cates t at ta is in con isten if a n with state OIS co ex ists with o her cache bloc ks i othe r nodes with state MII. OIS im plies at PL 1 m odi fi ed t e dat and has o ne rshi p, a d t at r s sh are th is data th ro ugh SL2. Th is is cont radi ct ed t co rres on di bl oc k bel M I anot her ode whi h i fo rm s t at PL 1 ha s odi fi ed dat and t at PL 2 a SL 2 have val dat . We ca n see t e are two con licts. Th e first inco nsisten y is th at if a cach o e n e ha s odi fi ed dat , n ot her cac he sh ha ve valid copies (l abeled O or S). T sec nd i consistency i th at sin e t e state e nod e is OIS th en all th e cor es po g st at es of t e ot her odes co ul d o be II S or SIS. Si nce SL2 is a c mm sha ed cac he , the the state of SL 2 s oul d be c ohe re nt . (i OI S >= 2 I m re t an on e no de has st at e OIS fo
Page 5
th e sam b k, th en ta in teg ity will no t ho ld , b ecau e it i possi bl e t o m re PL 1s t o n t e sam bl ock of dat . (iii) IIS>=1 & IMI >= If a i e nod e is share as indicated by state II S, t en no ot he r cac he sh have a m odifi ed c py, i.e. with state IMI, of t e s bl oc k. In or de r t veri fy dat co nsi ncy al pos si e sou ces of dat i ncy m st fi rst be defi ned As p ove i [1 3] [1 5] 16] whe er bot gua s o a gi ve n EFSM and the ta rget states are represente d via c onst aints t at represe t upward-close d se , a sym bolic reacha ility al go ri usi g i ger co nst ai nt s fo r rep ent g set states always terminates. In this way we autom tically ed t e pr op er ties of ou r SPS2 pro u g the HyTech tool. 4. 3 Veri fi cat n usi g SM put at on Tree Lo gi c TL) i a v ry si sub et o m ode t nse l gi c fi ne d by C ar k a Em erson [17]. It can express e ma ndat ry p ope rt s o t e protoc ols. It has three c pone nts: atom ic propositions , boolean connectives, and te poral o at ors. At om op ition t lk abou t th e v lu es of i du al state varia les. T boolea n connectives are the standa rd ones ). E ach tem poral operat or consist of t o pa rts: a p th qu an tifi r (A E) an d a te al m lity (F, G, X, U). Qu an tifier A ind cates that the operator de notes a op erty th at sh ou ld b tru all ex ecu tion th s fro a give n state whereas qua tifier E d no tes that th e p op erty is ex cl iv e to on e th. Th e m lities d scribe the or deri ng of ev ent i t e al on g a exec on pat a th e fo llowing in itiv e mean in : (i) F ( hold so ti me i t e fu tu re) is tru a p if th ere ex ists a state o t e th for wh ich th e fo rm is tru . (ii) G hol ds gl al ) m eans t at is tru fo r every state al ong the path. (iii) X hol ds in t e next state) m s that is true i the sec nd state along the path. (iv) hol ds unt hol ds) means that t ere ex ists so state alon g th e th for wh ich is tru , and for all prece ding states, is tru . Th e fo llowing ex am es illu strate th e ex pressi po we r of t e l gi c. (i) AG re AF ack ): it au cally fo llo ws th at i th e si gnal re is h , th en ev en tually ack will also gh . ii) AG AF enabled : en ab led ho ld s i fi itely o ev ery com put at on p . (iii) AG EF res : it is poss ible to reach t restart state from any state. (iv) AG ( send A( se nd recv )): it is al ways t e case th at if se nd oc curs , t en eve tually recv i t ue , a d unt th at ti , send mu r ma t To av oi st at e xpl osi n, rec nt m odel c kers use an im licit rep esen tation for fin ite-state sy ste s b sed on dered b nary d ecision d ag ra ( BD D) . SM V (sy bol del veri fi er) [1 4] i one suc t ool f checki g t at fi nite-state s ste s satisfy s ecifications gi ve n i C L. ppl cat ns o t sy bol odel checki g m thod ha ve bee used t s ccess ully veri fy the sno g pr ocol s of t e Gi gam x [1 8] an d t e Futu re bus+ [ 9] . T e fo rm al ve rification o the Stan FLASH cache cohe re nce prot ocol via SMV proof ssistant is g in [9 ]. The fo llowing section show w SM V i use t m odel and ve ri fy t pr pose SPS p ot ocol . 4. 3. 1 M del t e pr ot oc ol SM V Fi gu re 4 s ows a p rt n t e SM V pr ra used t odel t e st ate t ansact ns of a si ngl e bl k i a no de i the SPS2 ca che system . In lin es 1-3, th e ASSIGN eclaration i itially assig t e state of th e cach e t e lu e III an d th en pro ceeds to assi it th e state depe nding on the comm and received. Li nes 5-9 re veal t at whe n c nd i p ese t ne xt val e of state is a rando v lu e. Lin s 10 -27 ex press that if th is n is st er, e n xt co rres on di val e of state di ffe rs depe g on t e c nd ( ead , w , ETS, ... ). Li ne s 28 re veal e ne xt val of state wh en th cur ode is not m ster and comm and is GET . SSIG 1 init (sta te ) := III 2 ne xt( ta te ) := 3 c CM none : 5 c 6 ... 7 1 at e; 8 es ac; 9 ste : 10 c 1 C ge ts: 12 c 1 sta III: SI S; 14 1: 15 es ac; 1 C 1 c 1 s at e=I SI 1 s at e=I OI 2 sta IMI: MII; 21 at e i {S IS , MI OI s at e; 1: 23 es ac; 2 .. 25 1: 26 es ac; 2 C ge ts: 28 c 2 sta III: II S; 30 s at e=MI OI 3 sta IMI: IO S; 32 at e i {I , SI O I st at e; 1: 34 es ac; 3 CMD=r ad at e; 3 ... 3 1: 38 es ac 3 Fi gu re 4. ng pr ocol usi g SM V 4. 3. 2. Ve ri fy g t p ot oc ol To rify ta in tegrity, we i trodu ce ano r vari M t ndi cat e i t cont of a c ache bl oc k has been m odi fi ed. The ef ore we co ul d c ec k et he r t b has ha a e rs usi f rm ul as, s a . d Sect on 4. 3,
Page 6
formula means that it is always true that when the command is replacement, M must be high because if this data block has not been modified, there is no need to replace it. Another form of error is processor error which typically reveals when state and command conflict. The specification could be shown in the following formulae: The first formula states that it is always true that if one node has a shared data block, then eventually another node (for example, node 2) will also have this shared data. The second formula declares that if the states of two nodes are both SIS, the value of the data in both nodes must be the same. Similarly, the third form ula declares if the state of one node is OIS and the state of another node 2 is IIS, the value of the data in both nodes must be the same. The fourth formula means that if the data in node 1 is readable and not modified, then data should have same value as that stored in the memory. The fifth formula means that if node 1 has exclusive data, then no other node has corresponding data. Similarly, the SPS2 protocol could be verified for liveness using the following formula by proving that from any state it is possible to get to the states (OIS, MII, SIS) or that the block is readable or writable: The SMV verification process has been used to check 250 OBDD nodes. The safety properties of the SPS2 protocol are thus proved conclusively. 5. Summary To improve the CMP cache performance, we propose a new cache architecture SPS2 with split private and shared L2 cache, which takes advantages of the low latency of L2P and the high capacity of L2S. We also propose a correspo nding SPS2 cache c oherence protocol described by means of new state transition graphs in which each node has three states to indicate the states of private L1, split private L2 and split shared L2 respectively. Using the state transition graphs, the functional correctness of coherence protocol is proven through two formal verification methods. The use of formal design verification methods helps identify coherence problems in the early stage, and provide assurance of the correctness of the protocol before commencing on the hardware development. References [1] K. Krewell. UltraSPARC IV Mirrors Predecessor. Microprocessor Report , pages 1-3, Nov. 2003. [2 C. McNairy and R. Bhatia. Montecito: A Dual-core Dual- thread Intalium Processor. IEEE Micro , 25(2): 10-20, March/April 2005. [3] K. Diefendorff. Power4 Focuses on Memory Bandwidth. Microprocessor Report . 13(13): 1-8, Oct. 1999. [4] P, Jibgetura. A 32-way Multithreaded SPARC/E processor. In proceedings of the 16th HotChips Symposium , Aug. 2004. [5] Z. Chishti, M. D. Powell, and T. N. Vijaykumar. Optimizing Replication, Communication a nd Capacity Allocation in CMPs. In proceedings of 32th International Symposium on Computer Architecture, pages 357-368, June 2005. [6] M. Zhang and K. Asanovic. Victim Replication: Maximizing Capacity while Hiding Wire Delay in Tiled Chip Multiprocessors. In proceedings of 32th International Symposium on Computer Architecture, pages 336-345, June 2005. [7] B. M. Beckmann, M. R. Mart y, and D. A. Wood. Balancing Capacity and Latency in CMP Caches. Univ. of. Wisconsin Computer Sciences Tec hnical Report CS-TR-2006-1554, February 2006. [8] J. Chang, and G. S. Sohi. Cooperative Caching for Chip Multiprocessors. In proceedings of 33th International Symposium on Computer Architecture, pages 264-2765, June 2006. [9] K. L. McMillian, Parameterized Verification of the FLASH Cache Coherence Protocol by Compositional Model Checking. In CHARME'01 , Livingston, Sc otland, LNCS 2144, Springer-Verlag, 2001, pp.179--195. [10] D. J. Sorin, M. Plakai, A. E. Condon, et. al. Specifying and Verifying a Broadcast and a Multicast Snooping Cache Coherence Protocol. IEEE Transaction on Parallel and Distribution System . 13(6): 556-578, 2002 [11] Milo M. K. Martin. Formal Verification and its Impact on the Snooping versus Direct ory Protocol Debate. In Proceedings of the 2005 International Conference on Computer Design . 2005: 543-449 [12] T. A. Henzinger, P.-H. Ho, and H. Wong-Toi. HyTech: a Model Checker for Hybrid Systems. In Orna Grumberg, editor, In Proceedings of 9th Conf. on Computer Aided Verification (CAV'97) , LNCS 1254:460-463. Springer- Verlag, 1997. [13] G. Delzanno. Automatic Verification of Parameterized Cache Coherence Protocols. 12th International Conference 2000 , LNCS 1855,Chicago, IL, USA, pp.53-68. [14] K.L. McMillan, Symbolic M odel Checking: An Approach to the State Explosion Problem, Ph .D. Dissertation, Carnegie Mellon University, May 1992. [15] J. Esparza, A. Finkel, and R. Mayr. On the Verification of Broadcast Protocols. In Procedings of the 14th Annual Symposium on Logic in Co mputer Science (LICS'99) , 352- 359, 1999. [16] G. Delzanno, J. Esparza, an d A. Podelski. Constraint-based Analysis of Broadcast Protocols. In Proceedings of the Annual Conference of the European Association for Computer Science Logic (CSL'99) , LNCS 1683, 50-66, Springer-Verlag, 1999. [17] E. M. Clarke and E. A. Emerson. Synthesis of Synchronization Skeletons for Branching Time Temporal Logic. In Dexter Kozen, editor, Logic of Programs: Workshop , LNCS 131 , Springer-Verlag, 1981 [18] K.L. McMillan, and J. Schw albe, Formal Verification of the Gigamax Cache Consistency Protocol, In Proceedings of the ISSM Int’l Conf. on Parallel and Distributed Computing , Oct. 1991. [19] E.M. Clarke, O. Grumberg, H. Hiraishi, S. Jh a, D.E. Long, K.L. McMillan, and L.A. Ne ss, Verification of the Futurebus+ Cache Coherence Protocol, In Proceedings of the 11th Int’l Symp. on Computer Hardware Description Languages and Their Applications , Apr. 1993.