44nd DAC, June 4-8, 2007

Processor External Interrupt Verification Tool (PEVT)Processor External Interrupt Verification Tool (PEVT)

Fu-Ching Yang, Wen-Kai Huang and

Ing-Jer Huang

Dept. of Computer Science and Engineering

National Sun Yat-Sen University, Kaohsiung Taiwan

2/22

MotivationMotivation Microprocessor verificationMicroprocessor verification

– Instruction-based verificationInstruction-based verification– Branch prediction, Data hazard, etc…Branch prediction, Data hazard, etc…

– External interrupt verificationExternal interrupt verification

Why the external interrupt verification requires automationWhy the external interrupt verification requires automation– External interrupt is an External interrupt is an unexpected eventunexpected event– Tightly related to Tightly related to instructioninstruction– Trigger timing must be Trigger timing must be preciseprecise– Pipelined behaviorPipelined behavior must keep precise must keep precise

Processor

Add instructionSub instructionJPEGMPEG

FIQIRQ

Abort

?Fetch Decode Execute1 Execute2 Execute3 INT. vector SRV. RTN. addr.

Fetch Hold Hold Decode Execute

Fetch Decode Execute

IRQFIQ

Dabort

Pabort Pabort PabortFIQ IRQ

3/22

Comparison with manual approachComparison with manual approach

Processor External Interrupt Verification Tool (PEVT)Processor External Interrupt Verification Tool (PEVT)– Automatically insert external interrupt signals– Automatically insert instructions– Automatically verify the microprocessor

– RTL level– Cycle accurate

– Time-efficiencyTime-efficiency– High functional coverageHigh functional coverage

4/22

Proposed Verification FrameworkProposed Verification Framework

Required micro-architecture informationRequired micro-architecture information– MicroprocessorMicroprocessor pipeline stagespipeline stages– Instruction cyclesInstruction cycles– External interrupt informationExternal interrupt information

– Instruction’s Instruction’s relationshiprelationship with external interrupt with external interrupt

Fetch Decode ExecutionLoad

3-cycle instruction

Execution2 Execution3

3 cycles

IRQ IRQ IRQ

INT. VectorExecution1

5/22

Proposed Verification FrameworkProposed Verification Framework Exception Description LanguageException Description Language

((EXPDLEXPDL))– Microprocessor modelMicroprocessor model

Assertion rule databaseAssertion rule database– Processor-independentProcessor-independent

verification rulesverification rules– ExtendableExtendable

– Individual interruptIndividual interrupt– Concurrent interruptConcurrent interrupt– Nested interruptNested interrupt

PEVT generates PEVT generates verification casesverification cases– Combine Combine EXPDLEXPDL and and

assertion rule databaseassertion rule database

For automatic RTL verificationFor automatic RTL verification– Generate triggerGenerate trigger

– Comprise Comprise HWHW and and SWSW– Generate monitor hardwareGenerate monitor hardware

Automatic External Interrupt HW/SW Generation

Operation section

Exception section

Pipeline

section

MUV in EXPDL

Assertion rule

datadbase

Verification cases

Monitor generator

Verification case generator

Hardware monitor

Hardware trigger

Software trigger

Trigger generator

6/22

Exception Description Languages (EXPDL)Exception Description Languages (EXPDL)

Architecture Description LanguageArchitecture Description Language

LISP-like languageLISP-like language

Based on EXPRESSIONBased on EXPRESSION– Cycle-accurate simulationCycle-accurate simulation– Instruction set information -> Instruction set information -> Instruction cyclesInstruction cycles– Structure information -> Structure information -> pipeline stagespipeline stages– Can’t describe interrupt behaviorsCan’t describe interrupt behaviors

– Extensions – Extensions – Exception DescriptionException Description– Instruction’s Instruction’s relationshiprelationship with external with external

interruptinterrupt– Vector addressVector address– Trigger timeTrigger time : legal interrupt arrival time : legal interrupt arrival time– Action timeAction time : when the microprocessor : when the microprocessor

responsesresponses– Etc …Etc …

Automatic External Interrupt HW/SW Generation

Operation section

Exception section

Pipeline

section

MUV in EXPDL

Assertion rule

datadbase

Verification cases

Monitor generator

Verification case generator

Hardware monitor

Hardware trigger

Software trigger

Trigger generator

Automatic External Interrupt HW/SW Generation

Operation section

Exception section

Pipeline

section

MUV in EXPDL

Assertion rule

datadbase

Verification cases

Monitor generator

Verification case generator

Hardware monitor

Hardware trigger

Software trigger

Trigger generator

7/22

Assertion rule data baseAssertion rule data base

Automatic External Interrupt HW/SW Generation

Operation section

Exception section

Pipeline

section

MUV in EXPDL

Assertion rule

datadbase

Verification cases

Monitor generator

Verification case generator

Hardware monitor

Hardware trigger

Software trigger

Trigger generator

Automatic External Interrupt HW/SW Generation

Operation section

Exception section

Pipeline

section

MUV in EXPDL

Monitor generator

Assertion rule

datadbase

Verification cases

Verification case generator

Hardware monitor

Hardware trigger

Software trigger

Trigger generator

8/22

Individual InterruptsIndividual Interrupts

For (each interrupt source i) for( each instruction j in processor’s instruction-set) { for( every cycle k of the instruction j) generate a test case to trigger interrupt i at k cycle of instruction j }

IRQ IRQ IRQPabort DabortFIQ FIQ FIQ

Fetch Decode Execute1 Execute2 Execute3

Mem. access

Load

Only Only oneone external interrupt arrives before the microprocessor external interrupt arrives before the microprocessor accepts another oneaccepts another one

8 individual interrupt for load instruction

9/22

Concurrent interruptsConcurrent interrupts

For (each instruction j in processor’s instruction set){ Find out the legal time slot of instruction j for all external interrupt Select 2..n external interrupts to trigger For( each combination) generate a test case to trigger interrupt i and i+1 and ...n while executing instruction j}

MultipleMultiple external interrupts arrive before the external interrupts arrive before the microprocessor responses to any of themmicroprocessor responses to any of them

IRQPabort Dabort FIQ FIQ

Fetch Decode Execute1 Execute2 Execute3

Mem. access

Load

IRQ IRQ IRQ

Pabort

Dabort

FIQ FIQ FIQ

10/22

Graph Model for Nested InterruptsGraph Model for Nested Interrupts

ARM7

Normal

FIQPrefetch

abortData abort

Softwareinterrupt

Undefinedinstruction

IRQ

FIQ

Data abort

FIQ

Normal

Normal

One nested interrupt case

The microprocessor can accept another external interrupt when executing the interrupt service routine caused by a previous interrupt– StateState : microprocessor’s mode : microprocessor’s mode– Directed edgeDirected edge : legal mode transition from predecessor state to successor state : legal mode transition from predecessor state to successor state– PathPath : A legal nested interrupt mode transition : A legal nested interrupt mode transition

Depth-First-SearchDepth-First-Search to find all cases to find all cases

Stack

5

PIC16

11/22

Verification environmentVerification environment

Automatic External Interrupt HW/SW Generation

Operation section

Exception section

Pipeline

section

MUV in EXPDL

Assertion rule

datadbase

Verification cases

Monitor generator

Verification case generator

Hardware monitor

Hardware trigger

Software trigger

Trigger generator

Interrupt verification environment

Verification Hardware

Monitor engine

Interruptactivator

Program Memory

Microprocessor under

verification

Data Memory

Peripherals

Interrupt signals

Software trigger

V-ROM

12/22

Verification Hardware

Monitor engine

Interruptactivator

V-ROM

VerifyWaitVerify

Microprocessor under

verification

Reset B initialUndef NOPSWI B Swi_svAbt_p B Abtpsv …

MOV R0, R0MOV R0, R0BXLS R9MOV R0, R0

…LDR R0, [R1]MOV R0, R0MOV R0, R0

MOV R0, R0MOV R0, R0

Swi_sv MOVS PC, R14

Abtpsv SUBS PC, R14, #4 …

MRS R0, CPSRLDR R1, =0xFFFFFF3FAND R0, R0, R1MSR CPSR_cxsf, R0

Beginning Code

Interrupt Vector

Interrupt Service Routine

Initial Code

Software Code under

Verification

Boundary address

Automatic verification mechanismAutomatic verification mechanism

Software triggerIRQ

INT. Vector SRV.

RTN. addr.Fetch DecodeLoad Exe.3Exe.1 Exe.2

n cycles

Instruction address

Match MatchT=A= 2Trigger23451 1

IRQ

13/22

Summary of Generated Test CasesSummary of Generated Test Cases

Interrupt behaviorInterrupt behavior # of test cases# of test casesSimulation timeSimulation time

(cycles)(cycles) (sec.)(sec.)

Individual interruptIndividual interrupt 18301830 34,77034,770 167167

Concurrent interruptConcurrent interrupt 23942394 45,48645,486 219219

Nested interruptNested interrupt 105105 7,9807,980 3838

TotalTotal 43294329 88,23688,236 424424

Microprocessor under verify : ARM7Microprocessor under verify : ARM7

SUN Blade 2000 workstationSUN Blade 2000 workstation

Every case takesEvery case takes 20 20 cycles on average to complete cycles on average to complete

More cases can be verifiedMore cases can be verified– AutomaticallyAutomatically

14/22

Verification hardwareVerification hardware

Simple hardwareSimple hardware

Good for FPGA and chipGood for FPGA and chip

Verification moduleVerification module Code sizeCode size

Interrupt ActivatorInterrupt Activator 129 lines129 lines

Monitor EngineMonitor Engine 127 lines127 lines

V-ROMV-ROM 27 k-bytes27 k-bytes

15/22

Bugs foundBugs found

Branch instruction Branch instruction ignores interruptignores interrupt– Individual interruptIndividual interrupt

The return address of an The return address of an interrupted 2-cycle MOVinterrupted 2-cycle MOV instruction is wronginstruction is wrong– Individual interruptIndividual interrupt

Latency in external interruptLatency in external interrupt– Individual interruptIndividual interrupt

16/22

ConclusionConclusion

An An architecture description languagearchitecture description language extension is proposed extension is proposed

A CAD tool is proposed to verify the interrupt behaviorA CAD tool is proposed to verify the interrupt behaviorof processorsof processors– AutomaticallyAutomatically generate the generate the hardwarehardware and and softwaresoftware for verification for verification– AutomaticallyAutomatically verify the processor verify the processor– The generated hardware is very The generated hardware is very smallsmall– Highly focusedHighly focused verification cases verification cases– Less simulation cyclesLess simulation cycles

– 43294329 verification cases verification cases – Less than Less than 8800088000 cycles of RTL simulationcycles of RTL simulation– 424424 seconds in real time seconds in real time