Bridging Pre- and Post-silicon Debugging with BiPeD Andrew DeOrio - PowerPoint PPT Presentation

Bridging Pre- and Post-silicon Debugging with BiPeD Andrew DeOrio Jialin Li and Valeria Bertacco University of Michigan ICCAD “Simulation - based Verification” Session November 2012

Verification Opportunities Pre-Silicon Post-Silicon - Low speed + High speed + High observability - Poor observability + Reproducible bugs - Intermittent bugs little information sharing 2

Verification Opportunities Pre-Silicon Post-Silicon High observability → High speed → - Low speed + High speed learn enforce + High observability - Poor observability correct behavior correct behavior + Reproducible bugs - Intermittent bugs little information Shared correctness model sharing 3

Contributions Pre-Silicon Post-Silicon High speed High observability, detailed debugging info No need for bug reproduction little information Shared correctness model sharing 4

BiPeD Overview Pre - silicon Post - silicon on-line off-line Protocol extraction Protocol detection Transaction extraction • Run many • Run correct tests • Transfer debug unknown tests data off-chip • Monitor • HW detects • Extract interfaces protocols debugging • Learn correct • Detect errors in information protocols protocols 5

BiPeD Overview Pre - silicon Post - silicon on - line protocol detection off - line transaction extraction occurrence test platform time ! transaction protocol error logic Protocol extraction simulator extraction location Database ( signals ) test transaction errant test tests history transaction 1. Pre-silicon protocol extraction 2. Post-silicon protocol detection 3. Offline transaction extraction 6

Pre-silicon Protocol Extraction Pre-silicon Tests protocol module testbench initial extraction begin clock = 0; #5 clock = 1; end Design select Under Test Simulation interface signals to analyze protocol diagram: 01100 00100 describes 00000 interface behavior 00010 00101 “INFERNO: Streamlining Verification with Inferred Semantics”, DeOrio, et. al, 2009 7

Pre-silicon Protocol Extraction protect thread sync … TLB bypass ASI reload flush time (cycles) protocol diagram 01100 00100 transition 00000 event 00010 00101 8

TLU Protocol Example SPARC core bit 0: protect bit 1: thread sync bit 2: TLB bypass TLU LSU bit 3: ASI reload interface bit 4: flush 01100 00100 00000 00010 00101 9

Outline Pre - silicon Post - silicon on - line protocol detection off - line transaction extraction occurrence test platform time ! transaction protocol error logic Protocol extraction simulator extraction location Database ( signals ) test transaction errant test tests history transaction 1. Pre-silicon protocol extraction 2. Post-silicon protocol detection 3. Offline transaction extraction 10

Post-silicon Protocol Detection Memory Cache crossbar TLU 01100 00100 00000 00010 00101 load protocols into programmable HW post-si test platform tests protocol Error! module testbench initial begin detector clock = 0; #5 clock = 1; end circular buffer run high-coverage only stop when post-silicon tests error is detected 11

Post-silicon protocol detection test platform protocol detector circular buffer ... event history history out detect priority enc ... ... ... ... current event multiple monitored event transition interface protocols CAM CAM previous simultaneously event valid transition error valid event out 12

Protocol detector hardware • Programmable • Circular history buffer record history ... event history history out priority enc check ... ... ... ... current event event monitored event transition interface CAM CAM previous event valid transition check error transition valid event out 13

Area overhead • 0.7% of OpenSPARC T2 for 10 detectors – 15.3KB storage each, for biggest OST2 protocol 1,024 events 10 protocols ... event history history out priority enc 33 bits x ... ... ... ... current event 62 events monitored event transition interface CAM CAM previous event valid transition 622 error transitions valid event out 14

TLU Protocol Example • Injected bug in OpenSPARC TLU/LSU interface – Cycle 10,000 • Programmed TLU/LSU protocol into detector • Ran test • BiPeD HW detected bug at cycle 10,017 SPARC core TLU LSU interface 15

Outline Pre - silicon Post - silicon on - line protocol detection off - line transaction extraction occurrence test platform time ! transaction protocol error logic Protocol extraction simulator extraction location Database ( signals ) test transaction errant test tests history transaction 1. Pre-silicon protocol extraction 2. Post-silicon protocol detection 3. Offline transaction extraction 16

Off-line transaction extraction Memory Cache crossbar TLU 01100 00100 00000 00010 00101 Post-si test platform Tests protocol module testbench transaction initial begin detector clock = 0; #5 clock = 1; extraction end circular buffer transfer off-chip 17

Transaction extraction • Leverage transaction extraction similar to Inferno [DeOrio, et. al, 2009] • Input: circular event buffer • Output: intuitive, high-level transactions 00000 00000 01100 00100 00100 00100 01100 thread sync TLB bypass burst TLB bypass w/ thread sync 18

TLU Protocol Example SPARC core bit 0: protect bit 1: thread sync bit 2: TLB bypass TLU LSU bit 3: ASI reload interface bit 4: flush burst TLB bypass w/sync 01100 00100 TLB bypass 00000 address reload TLB bypass w/ flush 00010 00101 19

Transaction extraction example 01100 00100 00000 00010 00101 TLU protocol diagram (subset) Extracted transaction history ... 01100 00000 00000 00000 00000 00100 00010 00101 00100 00100 00100 01100 00100 buggy transition! thread sync burst TLB bypass w/ TLB bypass TLB bypass 10100 thread sync 4,545-4,602 ... 3,694-3,732 4,492-4,531 4,539-4,543 4,609 – 10,017 cycle 20

Transaction extraction example • Time: cycle 10,017 • Interface: TLU • Signals: protect, thread sync, TLB bypass, ASI reload, flush • Preceding activity: thread sync, burst TLB bypass w/thread sync, TLB bypass, TLB bypass • Event: 10100 Transition: 00100 -> 10100 • Transaction: 00000 00100 00010 00101 buggy transition! 10100 21

Limitations • False negatives – May miss bugs that only affect data signals – Interface signal selection important • Control signals work well in practice • False positives – High pre-silicon coverage → fewer false positives – If f.p. is encountered, update the database 22

Experimental setup 100 random seeds: variable memory delay, crossbar random traffic 1,000 passing runs BiPeD BiPeD detected transactions HW SW 10 testcases 100 buggy 10 interfaces runs 10 bugs: e.g. , functional bug in PCX, fetch thread ID 23

Signal Localization Bugs FPU execept. CCX/PCX req EX valid inst. fetch thread MEM rd ack cache-proc LSU access table walk PCX stall branch 16 CPX 1,719 branch 242 CCX 16k 39 16 742 Interfaces memory 223 execute 16 f.n. FPU f.p. 22k 48k 739 48k 22k fetch 47 perf. TLU 16 PCX 767 764 24 first interface to find bug f.p. false positive f.n. false negative

Protocol Extraction 200 25 Cumulative transitions Cumulative events 160 20 120 15 80 10 transitions 40 5 events 0 0 Testcase and total number of test executions 25

Transaction Extraction 240 Total transactions Number of transactions 200 Unique transactions 160 120 80 40 0 32 64 128 256 512 1024 Circular buffer size (entries) 0.1 KB 4 KB 26

Leave-one-out Cross Validation 30% False positives (percent) 20% 10% 0% Omitted testcase 27

Related Work • Invariant detection [Ammons 2002, Ernst 2008] – Detect invariants – Check tests against invariants • Pre-silicon verification – Inferno: verification with transactions [DeOrio 2009] – Data mining high-level specifications [Li 2010] • Post-silicon validation – Manual debugging [Abramovici 2006] – Automated debugging of specific components [Park 2011] – Manual, hardcoded txn checkers [Singerman 2011] 28

Conclusions and Future Work • BiPeD bridges pre-silicon protocol extraction with post-silicon detection • Automatically detects bugs • Provides intuitive debugging information • Future applications for flexible hardware – Coverage metrics – Runtime verification 29