arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2309.08002

HIVE: Scalable Hardware-Firmware Co-Verification using Scenario-based Decomposition and Automated Hint Extraction

Aruna Jayasena·Prabhat Mishra
View original source ↗Read source document ↗Export metadata ↓

Abstract

Hardware-firmware co-verification is critical to design trustworthy systems. While formal methods can provide verification guarantees, due to the complexity of firmware and hardware, it can lead to state space explosion. There are promising avenues to reduce the state space during firmware verification through manual abstraction of hardware or manual generation of hints. Manual development of abstraction or hints requires domain expertise and can be time-consuming and error-prone, leading to incorrect proofs or inaccurate results. In this paper, we effectively combine the scalability of simulation-based validation and the completeness of formal verification. Our proposed approach is applicable to actual firmware and hardware implementations without requiring any manual intervention during formal model generation or hint extraction. To reduce the state space complexity, we utilize both static module-level analysis and dynamic execution of verification scenarios to automatically generate system-level hints. These hints guide the underlying solver to perform scalable equivalence checking using proofs. The extracted hints are validated against the implementation before using them in the proofs. Experimental evaluation on RISC-V based systems demonstrates that our proposed framework is scalable due to scenario-based decomposition and automated hint extraction. Moreover, our fully automated framework can identify complex bugs in actual firmware-hardware implementations.

Explore related subjects

cs.SCcs.SE

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Aruna Jayasena, Prabhat Mishra. 2024-04-17. HIVE: Scalable Hardware-Firmware Co-Verification using Scenario-based Decomposition and Automated Hint Extraction. https://doi.org/10.1109/tcad.2024.3383961

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Refined complexity bounds for rational reconstruction and XGCD through Padé approximants and Cauchy interpolants

When computing with univariate polynomials, two fundamental and related problems are the XGCD and rational reconstruction, classically solved in quasi-linear complexity using the half-gcd algorithm. These problems have various applications in algebraic computations and bear strong connections to linearly recurrent sequences, structured matrices, and continued fractions. This article first gives a collection of algorithmic reductions, showing that rational reconstruction and XGCD can be solved via the computation of bases of relations modulo a freely-chosen polynomial $M(x)$. In particular, one recovers the folklore idea that bases of Padé approximants (i.e., $M(x) = x^d$) can be used to perform quasi-linear rational reconstruction or XGCD, extending to fast algorithms the well-known link between the Berlekamp-Massey algorithm and the extended Euclidean algorithm. One highlight of these reductions is that, instead of approximants, one may rely on Cauchy interpolants (i.e., $M(x)$ vanishes at chosen points). In a second part, this article describes divide-and-conquer algorithms for approximants and interpolants along with complexity analyses showing an explicit leading constant in front of the dominant term. For interpolants, the best leading constant is obtained through a variant that stores polynomials represented by evaluations, and exploits fast extrapolation in order to avoid repeated conversions to the monomial basis; this requires special points, in geometric or arithmetic progression, or FFT points when the base field allows them. Combining the analyses with the reductions leads to the best complexity bounds we are aware of for rational reconstruction and XGCD. Perhaps surprisingly, even Padé approximants or Berlekamp-Massey-like computations, which intrinsically involve $M(x) = x^d$, are accelerated by reducing them to Cauchy interpolation at well-chosen points.

cs.SC↗
arXiv2026

Parallel Integration over Simple Radical Extensions II: Mixed Towers

In Part I we extended the structure theorems underlying the Risch--Norman (parallel Risch) method to a simple radical extension $L=K(y)$, $y^m=q$, of a differential field $K=F(t_1,\dots,t_n)$ closed under the derivation. Here we remove the closure hypothesis: the radical may occupy any position in the tower, so that the derivatives of the generators above it involve $y$ --- the setting of Bronstein's algorithm for mixed elementary functions. The working ring is $\cA=\cO[t_{j+1},\dots,t_n]$, the integral closure of $F[t_1,\dots,t_n]$ in $L$: a Krull domain, free over the polynomial ring on Trager's basis, so that all factorisation remains in a unique factorisation domain. The denominator of the derivation is no longer an element but a divisor $\fd_D$ on $\cA$, and the valuation lemma takes the unified form $v_P(Dg)=v_P(g)-(1+v_P(\fd_D))$ at normal height-one primes, subsuming the shifts $\{1,e_P\}$ of Part I; the proof localises and requires no cancellation analysis. Stability of the class group and the unit group, $\Cl(\cA)\cong\Cl(\cO)$ and $\cA^*=\cO^*$, splits the admissible logands into $S$-units of $\cO$ --- computed by the machinery of Part I --- and irreducible polynomials moving in the upper variables, whose residues must be constants. We prove degree bounds in the top variable and describe the resulting algorithm, which --- unlike the classical parallel method, whose failure proves nothing --- returns certificates of non-elementarity in two situations: a residue outside the constant field, and, when every bound in force is proved, a residue-free remainder that the linear system shows to be non-exact.

cs.SC↗
arXiv2026

Probably correct row echelon form in the F4 algorithm

The computation of row echelon form is one of the main bottlenecks in the F4 algorithm. Several state of the art implementations use a probabilistic algorithm attributed to Monagan, Pearce, and Steel to accelerate this computation. Despite this, no bound on the probability that the algorithm returns an incorrect result appears to be available. In this paper, we provide such a bound. Furthermore, building on this result, we propose a Las-Vegas variant of the F4 algorithm and show experimentally that it can outperform deterministic F4 on some classical examples.

cs.SC↗