Advanced Debug Methods for ARM DSM-Based

Advanced Debug Methods for
ARM DSM-Based Simulation
Jim Kenney
SoC Verification Product Manager
Agenda
ƒ
The ARM Design Simulation (signoff) Model
ƒ
Processor driven tests
ƒ
Current DSM debug methods
ƒ
Advanced DSM debug
ƒ
Accelerating processor driven tests
ƒ
Demonstration
2
The ARM Design Simulation Model
ƒ
Compiled version of the core RTL description
ƒ Full device functionality
ƒ Phase accuracy
ƒ Register visibility
ƒ Min/typ/max pin-pin delays
ƒ Setup/hold, input pulse checking, output delays
ƒ Cache and memory size configuration
ƒ Timing back annotation
ƒ 9-value logic & resolution
ƒ Disassembler (execution instruction stream)
source: ARM Technical Support FAQs
3
What Does DSM Stand For?
ƒ
DSM has stood for a couple of different things in the past.
Originally it stood for Design Simulation Model. That was then
changed to Design Sign-off Model. However, it has recently
reverted back to the original designation.
source: ARM Technical Support FAQs
4
Traditional Testbench
Synchronization
Testbench
Stimulus
Testbench
Response
Slave I/F
Master I/F
0x1000
Source:
0x2000
Dest:
0x16
Size:
Testbench
DMA
5
Processor-Driven Testbench
Binary Code
and data
H e l l
o
ARM
Design
Simulation
Model
Program
Memory
Destination
Memory
Slave I/F
H e l l
o
Master I/F
Source:
0x1000
Dest:
0x2000
Size:
0x5
Source
Memory
DMA
6
Processor-Driven Tests are Inherently Portable
HDL
Behavioral
SystemC
System Verilog
Processor
Driven Test
High-Level
Simulation
RTL/Gate
Simulation
Emulation
7
Prototype
or FPGAs
PostFabrication
Processor-Driven Verification with DSM
ƒ
Most design teams run processor driven tests with the DSM
ƒ
The DSM executes compiled C or assembly code
ƒ
The DSM does not support source-level debug
ƒ
Debugging Processor-Driven Tests on the DSM is tedious
and time consuming.
8
Loading Processor Driven Tests
C
Program
DSM
File
Splitter
ARMcc
Link
IP
Block
Memory
Controller
Memory
9
Memory
Memory
Memory
Memory
Object
Executable
Memory
Image
file
Memory
image
Image
Memory
Image
Image
Dual
Ported
RAM
DSP
Custom
Logic
I/O
Hmm…. Looks Like it Failed
10
DSM Debug Visibility is Limited
Pins & Registers in Wave Window
ARM
DSM
Model
Dual
Ported
RAM
DSP
Execution Instruction Stream (log.eis)
52399
EIS
Data Write Byte
LDR_STR
00000160
E59F36DC
4000EF04
LDR r3,0x844
Data Read
00000844 40004000
40004004 00001001
LDR_STR
LDR_STR
00000164
E5933004
LDR r3,[r3,#4]
Data Read
LDR_STR
LDR_STR
00000168
E5823000
0000016C
E1A0F00E
STR r3,[r2,#0]
Data Write
MOV pc,r14
0000022C
E59D0000
LDR r0,[r13,#0]
Data Read
00000230
00000234
00000238
0000023C
00000240
E240CD40
E25CC002
0A000001
E3E00000
E8BD800C
SUB r12,r0,#0x1000
SUBS r12,r12,#2
BEQ 0x244
MVN r0,#0
LDMFD r13!,{r2,r3,pc}
Data Read
4000EF00 00001001
CCFAIL
Custom
Logic
4000EF00 00001001
4000EF00 00001001
LDMSTM_2
(seq) 4000EF04 00000001
LDMSTM_N
(seq) 4000EF08 00000310
11
Memory
DP
DP
DP
BR_1
DP
LDMSTM_1
IP
Block
Memory
Controller
Memory
MOVPC_1
MOVPC_2
IDLE
LDR_STR
01
Memory
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
EIS
Memory
52400
52400
52407
52408
52408
52417
52422
52422
52423
52424
52431
52432
52432
52433
52434
52435
52440
52447
52448
52448
52449
52449
52450
52450
I/O
Find the Value of a SW Variable
Source Code
Assembly Code View
Symbol Table Listing
simple.x:
void set_reg (int a, int b, int c, int d, int *e, int f)
simple.x:
file *e,
format
elf32-little
test.x:
file
format
elf32-little
void
set_reg (int a, int b, int c,
int d, int
int
f)
{
unsigned long value;
{ for (f=0; f<*e; f++) {
SYMBOL
SYMBOLTABLE:
TABLE:
value = *(unsigned long *) (0x80000000+(4*f));
00000005
l
*ABS*
00000000 $m
unsigned
long
value;
*((unsigned long *) 0x50000000) = value;
00000005 l
*ABS* 00000000 $m
SYMBOL TABLE:
00000005 l
00000000 l
000000c4 l
000000d8 l
00000180 l
00000000 l
000000d8 l
000000f0 l
00000100 l
00000108 l
00000120 l
00000130 l
0000013c l
00000148 l
00000178 l
00000000 l
00000000 l
00000380 l
00000180 l
00000280 l
00000480 l
00000011 l
00000012 l
00000013 l
00000020 l
00000074 l
00000078 l
0000007c l
00000080 l
00000084 l
00000088 l
0000008c l
000000a8 l
00000380 l
00000480 l
00000580 l
00000000 g
000000d8 g
000000dc g
000000e0 g
00000124 g
00000180 g
00000184 g
00000188 g
0000018c g
00000190 g
00000194 g
file format elf32-little
F
O
F
O
df
d
F
F
F
F
F
F
F
F
df
d
d
d
d
d
*ABS*
ER_RO
ER_RO
ER_RO
ER_RW
*ABS*
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
*ABS*
ER_RO
ER_RW
ER_RW
ER_RW
ER_RW
*ABS*
*ABS*
*ABS*
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RO
ER_RW
ER_RW
ER_RW
*ABS*
ER_RO
ER_RO
ER_RO
ER_RO
ER_RW
ER_RW
ER_RW
ER_RW
ER_RW
ER_RW
00000000
00000000
00000000
00000000
00000000
00000000
000000a8
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
000000d8
00000100
00000100
00000100
00000100
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000004
00000004
00000044
0000005c
00000004
00000004
00000004
00000004
00000004
00000004
$m
$a
$d
$a
$d
simple.s
.text
L1.24
L1.40
L1.48
L1.72
L1.88
L1.100
L1.112
L1.160
boot_code.s
EXCEPTION_VECTORS
!!IRQ_STACK
!!!!DSEG
!!!SVC_STACK
!FIQ_STACK
FIQ_MODE
IRQ_MODE
SVC_MODE
ResetHandler
Start
TestEnd
UndefinedHandler
SWIHandler
PrefetchHandler
AbortHandler
IRQHandler
FIQHandler
SVC_STACK_TOP
IRQ_STACK_TOP
FIQ_STACK_TOP
BuildAttributes$$ARM_ISAv4$M$PE$A:L22$X:L11$S22$~IW$USESV6$~STKCKD$USESV7$~SHL$OSPACE
_main
__main
func
main
MemoryErrors
MemoryWordErrors
MemoryHWordErrors
MemoryByteErrors
NumberOfIRQs
NumberOfFIQs
00000000 l
F ER_RO
00000000 $a
00000000 l
F ER_RO 00000000 $a
000000c4 l
O ER_RO
00000000 $d
000000c4l l
O ER_RO 00000000
00000000$a$d
for (f=0; f<*e; f++) {
000000d8
F ER_RO
…
00000180
l
O ER_RW
00000000 $d
value = *(unsigned long *)
(0x80000000+(4*f));
00000380l l df *ABS*
O ER_RW 00000000
00000000simple.s
SVC_STACK_TOP
00000000
*((unsigned long *) 0x50000000) = value;
000000d8
00000480l l d ER_RO
O ER_RW 000000a8
00000000.text
IRQ_STACK_TOP
*e = value;
000000f0
F ER_RO
00000580l l
O ER_RW 00000000
00000000L1.24
FIQ_STACK_TOP
00000100
F ER_RO
Waveform
View
}
00000000l g
*ABS* 00000000
00000000L1.40
BuildAttributes$$ARM_ISAv4$M$PE$A
00000108
lg
F ER_RO
00000000
L1.48
000000d8
F
ER_RO
00000004
_main
}
00000120 l
F ER_RO
00000000 L1.72
000000dc g
F ER_RO 00000004 __main
00000130 l
F ER_RO
00000000 L1.88
000000e0
g
F ER_RO 00000000
00000044L1.100
set_reg
0000013c l
F ER_RO
00000124
g
F
ER_RO
0000005c
main
00000148 l
F ER_RO
00000000 L1.112
00000180l g
O ER_RW 00000000
00000004L1.160
MemoryErrors
00000178
F ER_RO
00000184l g df *ABS*
O ER_RW 00000000
00000004boot_code.s
MemoryWordErrors
00000000
00000000
00000188l g d ER_RO
O ER_RW 000000d8
00000004EXCEPTION_VECTORS
MemoryHWordErrors
00000380
0000018cl g d ER_RW
O ER_RW 00000100
00000004!!IRQ_STACK
MemoryByteErrors
00000180
l
d
ER_RW
00000100
!!!!DSEG
00000190 g
O ER_RW 00000004 NumberOfIRQs
00000280 l
00000194 g d ER_RW
O ER_RW 00000100
00000004!!!SVC_STACK
NumberOfFIQs
00000480 l
d ER_RW
00000100 !FIQ_STACK
*e = value;
}
}
F
F
F
F
F
F
F
F
F
O
O
O
F
F
F
F
O
O
O
O
O
O
Then
gothe
to value
the and
waveform
trace
and
find
a Symbol
write
cycle
to…
Between
L1.24
L1.72
(labels
assigned
by the
compiler)
“e” isbe
in in
R5this range
Find
the
values
for
and
L1.72
in
table
listing
To
find
address
where
ofL1.24
variable
the
function
“e”
isthe
active
– PC
register
must
Anyway,
thisrange
gives it
you
some
idea of
involved
Outside
of this
is in
memory
at the
the difficulty
Stack pointer
+ 12
12
Find the Value of a SW Variable
ƒ
ƒ
Add code to store variable value in a known location
Compile, split, load and re-simulate
C
Program
ARM
DSM
Model
Dual
Ported
RAM
DSP
ARMcc
Object
file
Memory
Memory
13
Memory
Memory
Memory
ImageMemory
Image Memory
Image
Image
Memory
File
Splitter
IP
Block
Memory
Controller
Custom
Logic
I/O
Find the Value of a SW Variable
void set_reg (int a, int b, int c, int d, int *e, int f)
{
unsigned long value;
for (f=0; f<*e; f++) {
value = *(unsigned long *) (0x80000000+(4*f));
*((unsigned long *) 0x50000000) = value;
*e = value;
}
}
e = 12
Hold your cursor over the “e” in the source view
14
Questa Source-Level Debug for the DSM
ƒ
ƒ
ƒ
ƒ
ƒ
15
Step through source &
assembly
Set breakpoints
Examine SW variables &
processor registers
View stack
View memory
Questa Interactive or Post-Simulation Debug
ƒ
The DSM is slow and simulations run for hours
ƒ
You don’t want to re-simulate failing batch runs in order to
isolate the cause
ƒ
Questa creates a SW log file in addition to the wave log file so
you can debug batch runs post-simulation
16
Replay Movie
17
Easy Setup – No Changes
ƒ No modification to design, models or testbench
ƒ Debugger connects to your DSM
ƒ Setup
ƒ
ƒ
ƒ
Add switch to Questa invocation
Specify path to the DSM
Specify ELF file directory
18
Questa DSM Debug Limitations
ƒ
Slow - same simulation performance as existing DSM
ƒ
Read Only View of Software State
ƒ
Can’t change register or variables contents
19
Want More Speed & Better Debug?
ƒ
Replace the DSM with a cycle-accurate model
Cycle
ARM
Accurate
DSM
Model
Dual
Ported
RAM
IP
Block
Memory
Controller
Memory
Memory
Memory
Memory
20
DSP
Custom
Logic
I/O
Accelerating Processor Driven Tests
ƒ
Cycle accurate model runs 200,000
instructions/second stand alone
ƒ
Overall simulation is 5X to 10X faster
than with the DSM
ƒ
Full featured SW debug
ƒ Change variable, register and memory
contents
21
Your Mileage May Vary
ƒ
Acceleration factor is dependant on the ratio of SW execution
to logic simulation
SW Intensive
Logic Intensive
SW Intensive
Memory
References
Load
Registers
Propagate
Values
Unload
Registers
Evaluate
Results
>1,000x
10x to 100x
1x
10x to 100x
>1,000x
Cycle-Accurate Model Acceleration Factor
22
DSM vs. Cycle-Accurate Model
Questa
DSM
Firmware
Cycle Accurate Model
Firmware
23
Questa Source-Level Debug for DSM
ƒ Source-level debug for simulations using the ARM
Design Simulation Model.
ƒ Debug during or post simulation
ƒ Step backward through code execution
ƒ No changes to the design, models, or testbench
ƒ Cycle-accurate model yields 5x to 10x speedup
24
Demonstration
25
To Learn More
ƒ
Hands-on sessions in Booth 114
ƒ Wednesday @ 3:00
ƒ Thursday @ 9:30 & 12:30
log.eis
Booth 114
26