Formalising CXL Cache Coherence

2024-10-21

arXiv.org

AI Summary

This work addresses the lack of formal semantics in the CXL.cache protocol, which poses cache coherence risks. We present the first complete Isabelle/HOL formal model grounded in the official English specification. Our methodology integrates formal semantic modeling, scenario-driven verification, and a novel automated proof strategy to support mechanized reasoning over tens of thousands of lemmas. Key contributions include: (1) identifying and driving the CXL Consortium’s adoption of multiple critical clarifications and bug fixes—e.g., the “Snoop-pushes-GO” constraint; (2) achieving the first full formalization of the CXL.cache protocol and the first fully mechanized proof of its cache coherence theorem; and (3) developing a reusable automated proof toolchain that significantly enhances scalability and reliability in verifying complex interconnect protocols.

Technology Category

• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Conceptual Inference and Reasoning

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Security and Privacy: Large-scale security measurements
• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems

Abstract

We report our experience formally modelling and verifying CXL.cache, the inter-device cache coherence protocol of the Compute Express Link standard. We have used the Isabelle proof assistant to create a formal model for CXL.cache based on the prose English specification. This led to us identifying and proposing fixes to several problems we identified as unclear, ambiguous or inaccurate, some of which could lead to incoherence if left unfixed. Nearly all our issues and proposed fixes have been confirmed and tentatively accepted by the CXL consortium for adoption, save for one which is still under discussion. To validate the faithfulness of our model we performed scenario verification of essential restrictions such as"Snoop-pushes-GO", and produced a fully mechanised proof of a coherence property of the model. The considerable size of this proof, comprising tens of thousands of lemmas, prompted us to develop new proof automation tools, which we have made available for other Isabelle users working with similarly cumbersome proofs.

Problem

• Formal modeling and verification of CXL.cache protocol
• Identifying and fixing unclear, ambiguous, or inaccurate specifications
• Developing proof automation tools for large-scale formal proofs

Innovation

• Formal modeling using Isabelle proof assistant
• Identified and fixed protocol ambiguities
• Developed new proof automation tools