IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. XX, NO. NN, MMM YYYY 1 Directed Test Generation for Validation of Cache Coherence Protocols Yangdi Lyu, Xiaoke Qin, Mingsong Chen, Member, IEEE and Prabhat Mishra, Senior Member, IEEE Abstract—Computing systems utilize multi-core processors Since all possible behaviors of the cache blocks in a system with complex cache coherence protocols to meet the increasing with n cores can be defined by a global finite state machine need for performance and energy improvement. It is a major (FSM), the entire state space is the product of n cache block challenge to verify the correctness of a cache coherence protocol since the number of reachable states grows exponentially with level FSMs. Although the FSM of each cache controller is the number of cores. In this paper, we propose an efficient test easy to understand, the structure of the product FSM for generation technique, which can be used to achieve full state modern cache coherence protocols usually have quite obscure and transition coverage in simulation based verification for a structures that are hard to analyze. Clearly, it is inefficient to wide variety of cache coherence protocols. Based on effective use breadth-first search (BFS) on this product FSM to achieve analysis of the state space structure, our method can generate more efficient test sequences (50% shorter) on-the-fly compared full state or transition coverage, because a large number of with tests generated by breadth-first search. While our on-the- transitions may be unnecessarily repeated, if they are on the fly method can reduce the numbers of required tests by half, it shortest path to many other states. can still be impractical to verify all possible transitions in the Simulation using random and constrained-random tests is presence of large number of cores. We propose scalable on-the- fly test generation techniques using quotient state space. The widely used in industry because of its good scalability. How- proposed approach guarantees selection of important transitions ever, the random nature of test sequences also introduces by utilizing equivalence classes, and omits only similar transi- unacceptable time requirement to cover all possible state tions. Our experimental results demonstrate that our proposed transitions in modern cache coherence protocols with many approaches can efficiently trade-off between transition coverage cores. Directed tests, on the other hand, are promising to and validation effort. achieve high coverage with a drastically small number of tests Index Terms—Cache coherence, quotient space, test genera- [2]. Therefore, they can be applied in addition to random tests tion, verification. to further improve the chances of capturing potential bugs. However, directed test generation is not practical in this case I. INTRODUCTION since the time and memory requirements can be prohibitive. Therefore, it is desirable to have an on-the-fly test generator YSTEM designers incorporate multi-core processors to with a space- and time-efficient test generation algorithm. S meet the increasing performance requirements. To address In this paper, we propose an on-the-fly test generation the memory bottleneck, caching has been the most effec- technique for cache coherence protocols by analyzing the state tive approach to reduce the memory access time for several space structure of their corresponding global FSMs. Instead decades. When the same data is cached by different processors, of using structure-independent BFS to obtain directed tests, cache coherence protocols are employed to guarantee that a we show that complex state space can be decomposed into read always returns most recently written data. Due to the several components with simple structures. Since the activation power wall encountered by single core architectures, more of states and transitions can be viewed as a path searching and more cores are integrated into the same chip to boost problem in the state space, these decomposed components with the performance. As a result, the modern cache coherence known structures can be exploited for efficient test generation. protocols, like MOESI in AMD [1], are becoming quite Our contributions in this paper are: complex. Unfortunately, since the reachable protocol state space grows exponentially with the number of processing units 1) We develop a graphical state space description of several (cores) and states, the verification teams are facing significant commonly used cache coherence protocols, which can challenges to achieve the required coverage within tight time- be viewed as a composition of simple structures [3], and to-market window. present an on-the-fly directed test generation algorithm based on Euler tour [4]. This work was partially supported by the NSF grant CNS-1441667, Natural 2) We propose an efficient quotient space based test gen- Science Foundation of China 61672230 and Cisco. eration approach to address the scalability concerns in Y. Lyu and P. Mishra are with the Department of Computer and Information Science and Engineering at the University of Florida, Gainesville FL 32611- existing test generation techniques. The proposed ap- 6120, USA. proach utilizes the symmetric structure of protocol state E-mail: lvyangdi@ufl.edu space, which enables designers to cover important state X. Qin is an architect with Nvidia. E-mail: [email protected]. transitions within limited verification budget. M. Chen is with the Shanghai Key Laboratory of Trustworthy Computing at East China Normal University, Shanghai 200062, China. The rest of the paper is organized as follows. Section II E-mail: [email protected]. introduces related works. Section III provides background on 2 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. XX, NO. NN, MMM YYYY cache coherence protocols. Section IV presents our on-the-fly state space to representatives, verification techniques can be test generation algorithms. Section V proposes scalable on-the- used to deal with large number of states. Clarke et al. [20] fly test generation using quotient space. Experimental results and Emerson [21] exploited symmetry reduction techniques are presented in Section VI. Finally, Section VII concludes the in model checking. Kamkin [22] address state exploration paper. problem by projecting state space to a number of subspace. However, to the best of our knowledge, quotient space was never utilized to improve test generation and validation of II. RELATED WORK cache coherence protocols. Researchers have designed many cache coherence proto- cols for different platforms and architectures, such as MSI, III. BACKGROUND AND MOTIVATION MESI, MOSI, MOESI, MESIF [5], MEUSI [6] and many In modern computer systems, each processing unit usually other variations. As these protocols are becoming more and maintains its local copy of the main memory, or cache for more complex, validating the correctness of these protocols fast access. One major problem of caching is that when the also becomes challenging. Existing cache coherence protocol same data, memory block, is cached in two or more different validation techniques can be broadly classified into two cat- places, any modification should be propagated to all the cached egories: formal verification and simulation based validation. copies. Cache coherence protocols are used to define the Formal methods using model checking can prove mathemat- correct behavior of each cache controller. ically whether the description of certain protocol violates the required property. For example, Mur' [7] was used to Eviction Other ST verify various cache coherence protocols based on explicit IS model checking. Symbolic model checking tools are also Self LD Self LD developed for coherence verification. For example, the veri- Other LD Other LD fication problem with parameterized cache coherence protocol Self ST is investigated by Emerson et al. [8] and Li et al. [9]. Fractal Eviction Self ST coherence [10] [11] and PVCoherence [12] enable the scalable Other ST verification of a family of properly designed coherence proto- cols. Deadlock detection techniques [13] [14] are designed to LD=Load M Self LD ST=Store automatically detect deadlock in cache coherence protocols. Although formal methods can guarantee the correctness of a Fig. 1. State transitions for a cache block in MSI protocol. design, they usually require that the design should be described in certain input languages. As a result, it is usually difficult One of the simplest cache coherence protocol is the MSI to apply model checking on implementations directly. More- snoopy protocol [23]. The behavior of the cache controller in a over, manual translation (implementation to formal language) processing unit is modeled as an FSM (Figure 1). The state of associated abstractions may introduce errors. a cache block (line) can be either “Invalid”(I), “Modified”(M), Simulation based approaches, on the other hand, are able or “Shared”(S). At the beginning, all cache blocks are in to handle designs at different abstraction levels and therefore the invalid state. When a load request (Self LD) arrives, the widely used in practice. For example, Wood et al. [15] used cache controller requests the data from the main memory and random tests to verify the memory subsystem of SPUR ma- switches to shared state. When the core issues a store request chine. Genesys Pro test generator [16] from IBM extended this (Self ST), the cache controller first broadcasts an invalidate direction with complex and