maksim jenihhin - t&vs...automated bug localization (mtv’12) algorithm: 1.static slicing +...

http

://za

miaca

d.sf.net

: Shall we dance?

Maksim JenihhinSenior Research Fellow, Tallinn University of Technology, ESTONIA

DVClub Webinar, January 14, 2013

http

://za

miaca

d.sf.net

zamiaCAD

Motivation

• Engineers need tools – to quickly understand and navigate through

complex, (partially) unknown design code– scalable to cope with very large designs– non-invasive requiring minimal configuration

• Challenges in the academic world– Development of an experimental environment

from scratch is a big effort– Weak front-ends– Limited “sharability”

• dirty patches, constant work-in-progress

Maksim Jenihhin, "zamiaCAD: Shall we dance?", DVClub, January 14, 2013

2

http

://za

miaca

d.sf.net

zamiaCAD

An open initiative

is an open-source platform for hardware design and debug

• Base for academic research environments• Practical aid at industry

– convenient design entry– efficient design exploration

– scalable front-end– free simulator

– debug infrastructure– community support


3

http

://za

miaca

d.sf.net

zamiaCAD

Agenda

• zamiaCAD overview

• Automated bug localization and research

• Live demo

• Conclusions


5

http

://za

miaca

d.sf.net

zamiaCAD

The triplicity of zamiaCAD

• HW design and analysis framework– elaboration engine– advanced code entry and navigation– emphasis on scalability– primary abstraction is RTL

• Platform for integration– Code level (open-source)– Eclipse IDE level– Scripting level (Python)

• Open-source project– GPLv3, sources at SourceForge.Net, 200K+ LOC Java• plug-in for Eclipse, compiled product (Win, Linux, MacOS)


6

http

://za

miaca

d.sf.net

zamiaCAD

zamiaCAD flow

• Front-end:– VHDL: AST + IG– Verilog: AST

• Elaboration– semantic rules– checks (types…)– name resolution

• Database ZDB – Persistence– Scalability – Highly optimized

for performance


7

http

://za

miaca

d.sf.net

zamiaCAD

Design Code Size Tool 1 Tool 2 Tool 3 Tool 4 Tool 5 zamia

B19 834 7 1 5 1 4 3Plasma 1068 3 1 9 2 7 9L3-SoC 38107 83 5 135 104 918 183L3-1 27409 87 6 82 187 694 137L3-64 27409 OOM 23 87 OOM 693 162L3-896 27409 OOM 97 OOM OOM 695 223L3-3584 27409 OOM OOM OOM OOM 692 405

Scalability Experiments (VLSI-SoC’12)


8

Design Code Size Tool 1 Tool 2 Tool 3 Tool 4 Tool 5 zamia

B19 834 7 1 5 1 4 3Plasma 1068 3 1 9 2 7 9L3-SoC 38107 83 5 135 104 918 183L3-1 27409 87 6 82 187 694 137L3-64 27409 OOM 23 87 OOM 693 162L3-896 27409 OOM 97 OOM OOM 695 223L3-3584 27409 OOM OOM OOM OOM 692 405El

abor

atio

n tim

e (s

ec)

L3-3584 is an artificial SoC with 3584 LEON3 processor cores

• In zamiaCAD the elaborated design model IG is stored in the scalable and custom designed database

http

://za

miaca

d.sf.net

zamiaCAD

Static Analysis

• Precise global tracing– parts of signals – through generate

statements– BW/FW static slices

• matching of overloaded subprograms

• source-less and sink-less signal detection• advanced signal value annotations

– (e.g. a single bit of a vector)

• compute expressions on the fly• type check FSM recognition declaration search


9

http

://za

miaca

d.sf.net

zamiaCAD

Simulator

• Built-in interpreted simulation (acc. to VHDL LRM)

• VCD import from external simulators

• Value annotations Code coverage highlight Force values Jumps between code and waveform


10

http

://za

miaca

d.sf.net

zamiaCAD

Agenda



• Live demo

• Conclusions


11

http

://za

miaca

d.sf.net

zamiaCAD

Automated bug localization (MTV’12)

Algorithm:1.Static slicing + dynamic

code coverage metrics = “zamia dynamic slicing”

2.Statistical ranking: suspiciousness scores

3.Static cone inspection

• accurate localization • large industrial designs • multiple bugs• executed on the original

functional testMaksim Jenihhin, "zamiaCAD: Shall we dance?", DVClub, January 14, 2013

12

http

://za

miaca

d.sf.net

zamiaCAD

ROBSY


13

# Stm. score

Bran. score

Cond. score Line Source code lines

alu.vhd10 5 1 11 12 13

0.53 0.57 0.78 0.51 0.51 0.51

88 108 110 112 116 127 ...

4 14 NA

0.61 0.51 0.50

0.61T 0.50F

0.51T 0.50F

0.611T 0.631T 0.512T 0.632T 0.511T 0.512T 0.511T 0.512T

260 261 262 263 264 265

266 267

268 269

270 271 272 273 274 275 276 277 278 279 280 281 282 283

svFlag_new(0) <= '1' when afClass=cfClass_1 and ((svOp_mux(cnD_w)=REG_SOURCE_DEST_IN(cnD_w)‐‐add case and svOp_mux(cnD_w)/=svRes(cnD_w) and ((aCmd=cvCmd_ADD_R_R and c_en_ADD_R_R) or (aCmd=cvCmd_ADD_R_IMM and c_en_ADD_R_IMM))) or (svOp_mux(cnD_w)/=REG_SOURCE_DEST_IN(cnD_w)‐‐sub case‐‐ Bug: correct compar. between REG_SOURCE_DEST_IN and svRes and svOp_mux(cnD_w)/=svRes(cnD_w) and ((aCmd=cvCmd_SUB_R_R and c_en_SUB_R_R) or (aCmd=cvCmd_SUB_R_IMM and c_en_SUB_R_IMM) or (aCmd=cvCmd_CMP_R_R and c_en_CMP_R_R) or (aCmd=cvCmd_CMP_R_IMM and c_en_CMP_R_IMM))) or (REG_SOURCE_DEST_IN(cnD_w)/=svRes(cnD_w)‐‐shift cases and ((aCmd=cvCmd_SHL_R and c_en_SHL_R) or (aCmd=cvCmd_SHR_R and c_en_SHR_R)))) else '0' when afClass=cfClass_1 ‐‐overflow reset and ((aCmd=cvCmd_ADD_R_R and c_en_ADD_R_R) or (aCmd=cvCmd_ADD_R_IMM and c_en_ADD_R_IMM) or (aCmd=cvCmd_SUB_R_R and c_en_SUB_R_R) or (aCmd=cvCmd_SUB_R_IMM and c_en_SUB_R_IMM) or (aCmd=cvCmd_CMP_R_R and c_en_CMP_R_R) or (aCmd=cvCmd_CMP_R_IMM and c_en_CMP_R_IMM) or (aCmd=cvCmd_SHL_R and c_en_SHL_R) or (aCmd=cvCmd_SHR_R and c_en_SHR_R)) else svFlag(0);

data_interface_mod.vhd2 3

0.72 0.72

155 158

gprs_mod.vhd6 0.57 97 jump_target.vhd15 0.51 119 state_machine.vhd7 8 9

0.57 0.57 0.57

100 123168

RO

BSY

proc

esso

r ca

se-s

tudy

: lo

caliz

atio

n of

a r

eal b

ug–

usin

g th

e or

igin

al fun

ctio

nal t

est

http

://za

miaca

d.sf.net

zamiaCAD

WIP and research directions

• RTL graphs for design visualisations

• SystemC/TLM support (IP-SOC’12) Generation of RTL SystemC from RTL VHDL

• Readability! + Correspondence to VHDL!– Automated abstraction of RTL IP cores into TLM

• Legacy RTL IP cores reuse in TLM systems– zamia interaction with Eclipse ECORE metamodel


14

http

://za

miaca

d.sf.net

zamiaCAD

Agenda



• Live demo

• Conclusions


15

http

://za

miaca

d.sf.net

zamiaCAD

Agenda



• Live demo

• Conclusions


16

http

://za

miaca

d.sf.net

zamiaCAD

Team and cooperation

• Günter Bartsch, Germany– founder and principal developer

• Tallinn University of Technology:– Anton Chepurov, Valentin Tihhomirov, Syed Saif Abrar– Maksim Jenihhin, Jaan Raik

• Dr. Rainer Dorsch (IBM and Bosch)

• Ilmenau UT; ISPRAS Moscow; FP7-DIAMOND

• Open-source project since December 2010– 3000 downloads

• IBM Faculty Award 2011/2012


17

http

://za

miaca

d.sf.net

zamiaCAD

Shall we dance?

• It’s easy to try– http://zamiacad.sf.net

• It’s easy to addict– non-invasive– convenient design entry– scalable front-end– efficient design analysis– free simulator– debug infrastructure

• It’s easy to contribute– git://zamiacad.git.sourceforge.net– Share your contributions with community


18

http

://za

miaca

d.sf.net

zamiaCAD

Thank you!


19

To probe further:• Maksim Jenihhin

– [email protected]• zamiaCAD website

– http://zamiacad.sf.net• Recent zamiaCAD publications:

– ”A Scalable Model Based RTL Framework zamiaCAD for Static Analysis”, A.Tsepurov, G.Bartsch, R.Dorsch, M.Jenihhin, J.Raik, V.Tihhomirov, In Proc. IEEE VLSI-SOC 2012

– „Open-source Framework and Practical Considerations for Translating RTL VHDL to SystemC”, S. A.Syed, M.Jenihhin, J.Raik, Pub. by IP-SOC 2012

– „Localization of Bugs in Processor Designs Using zamiaCAD Framework”, A.Tšepurov, V.Tihhomirov, M.Jenihhin, J.Raik, G. Bartsch, J.H. Meza Escobar, H.D.Wuttke, In Proc. IEEE MTV 2012

maksim jenihhin - t&vs...automated bug localization (mtv’12) algorithm: 1.static slicing +...

Documents