Skip to content

Simd Models #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 40 commits into from
Closed

Simd Models #1

wants to merge 40 commits into from

Conversation

satiscugcat
Copy link
Collaborator

@satiscugcat satiscugcat commented Jun 30, 2025

Solution to challenge 15, via cryspen-ext/core-models

Resolves model-checking#173

This PR provides testable models for core::arch intrinsics, including abstractions to streamline the process of implementing these intrinsics and their tests.

Currently there are 256 x86 intrinsics modelled, and 181 aarch64 intrinsics modelled.

The methodology for writing the models is decribed in testable-simd-models/README.md.
First, we model the SIMD types as bitvectors that can be converted to and from arrays of machine integers.
Then, we model the raw operations on these types as functions over bitvectors, while keeping as much code as possible unchanged from the Rust code in rust-lang/stdarch/crates/core_arch.
Finally, we write tests (using a generic macro) to compare the behaviour of our models with the corresponding intrinsic implementations in Rust core.

Interestingly, in the process of modeling these intrinsivcs, we found bugs in the implementation of two intrinsics, _mm256_bsrli_epi128 and _mm512_bsrli_epi128. These bugs were fixed by our PR in the 2025-06-30 version of the library. In a small way, this shows off the impact of writing testable models of the SIMD intrinsics.

The model of intrinsics defined here is also used as the basis of formal proofs of Rust programs that use intrinsics. In particular, the libcrux cryptographic library uses these models in its proofs of the post-quantum cryptographic algorithms.

As next steps, we intend to extend these testable models to a larger subset of core (beyond SIMD) and then translate these Rust models to models in F*, Rocq, and Lean, to enable proofs using our models in these backends. This work is being done as part of the hax project.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.

Copy link
Collaborator

@maximebuyse maximebuyse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed and have questions/remarks about documentation (which is also what I mostly looked at). Otherwise things look fine, thanks for the cleanup!

satiscugcat and others added 20 commits July 10, 2025 17:58
Copy link
Collaborator

@maximebuyse maximebuyse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added 2 suggested changes to fix warnings when running cargo doc. Apart from that it looks good to me with the latest changes!

@@ -0,0 +1,173 @@
# testable-simd-models
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README looks good to me, it is clear and concise. The example takes a lot of space though, mostly because of the enumeration of masks. Maybe we could shorten it, for example cutting the middle values for the masks and adding a ...

@karthikbhargavan
Copy link

This PR has been turned into an upstream PR over here:
model-checking#423

The work in this branch has been merged into main.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Challenge 15: High-Assurance SIMD Intrinsics for Rust
3 participants