Test Apparatus Performing Runtime Replacement of Program Instructions With Breakpoint Instructions for Processor Having Multiple Instruction Fetch Capabilities

This invention relates to test apparatus for monitoring the operation of a processor, and in particular, apparatus for tracing the step-by-step program execution of a processor that has the capability to retrieve a plurality of program instructions in a single instruction fetch.

It is a problem in the field of test apparatus to monitor the step-by-step program execution of a processor that retrieves more than a single program instruction during the processor's instruction fetch cycle. Many thirty-two (32) bit processors use a thirty-two (32) bit wide data bus to retrieve two sixteen (16) bit instructions during each instruction fetch cycle of the processor. This operation improves the efficiency of the thirty-two (32) bit processor since the program instructions are primarily executed in sequential order by the processor and only one-half as many program instruction fetch cycles are required. In such an arrangement, it is difficult to exactly trace the sequence of program instructions that are executed by some processors when a jump type of operation is encountered in the sequence of program instructions. When a jump operation takes place, the processor flushes any remaining program instructions from the instruction buffer and begins to fetch program instructions from a different address. The first program instruction fetch at this different address may be designed to always obtain 32 bits of instructions even if only the second 16 bits are needed. The test equipment cannot determine which of the two retrieved instructions is the target of the jump operation. Thus, in a processor that retrieves a plurality of program instructions during each instruction fetch cycle, the presently available test apparatus cannot distinguish which instructions are actually executed by the processor and which instructions were temporarily stored in the instruction buffer and not used immediately after the execution of a jump instruction.

The above described problems are solved and a technical advance achieved in the field by a test apparatus for monitoring the operation of a processor that has multiple instruction fetch capability. This test apparatus monitors the instruction fetches from program memory. The test apparatus detects when the processor executes a jump operation and determines the target address of the jump operation by inserting a break point instruction in place of one of the program instructions that are retrieved by the processor from program memory. This instruction substitution is accomplished by an instruction jamming circuit that forces the break point instruction onto the processor data bus as part of the program instruction fetch cycle in lieu of one of the instructions retrieved as part of the instruction fetch after the execution of the jump instruction. If the break point operation is executed, then the target address of the jump operation is the address location that contains the breakpoint instruction that was substituted for one of the program instructions retrieved from the instruction memory. In this case, the test apparatus responds to the execution of the break point instruction by replacing the program instruction originally retrieved from program memory and substituted for by the break point instruction. Thus, the break point instruction acts as a flag to indicate, when executed, that this address is the target address of the jump instruction. If the break point instruction is not executed by the processor, it is because the jump instruction target address is the location that contains the other retrieved program instruction. Thus, the execution or non-execution of the break point instruction acts as a flag to indicate to the test apparatus which of the retrieved program instructions that the processor has fetched as a result of the jump instruction was actually executed. In this manner, the test apparatus provides an accurate record of the sequence of program instructions that are actually executed by the processor under test.

FIG. 1 illustrates, in block diagram form, the test apparatus for monitoring the operation of a processor that has the capability of retrieving a plurality of program instructions;

FIG. 2 illustrates, in memory map form, the instruction memory and the contents thereof;

FIG. 3 illustrates, in flow diagram form, the operation of the test apparatus for monitoring the operation of a processor that has the capability of retrieving a plurality of program instructions; and

FIG. 4 illustrates further details of the interconnection of the test apparatus and the system under test.

It is a problem in the field of test apparatus to monitor the step-by-step program execution of a processor that retrieves more than a single instruction during each processor instruction fetch cycle. Many processors use a thirty-two (32) bit wide data bus to retrieve two sixteen (16) bit instructions during each instruction fetch cycle of the processor. This operation improves the efficiency of the processor since the program instructions are primarily executed in sequential order by the processor and only one half as many program instruction fetch cycles are required. In such an arrangement, it is difficult to exactly trace the sequence of program instructions that are executed by some processors when a jump type of operation is encountered in the sequence of program instructions. When a jump operation takes place, the processor flushes any remaining program instructions from the instruction buffer and begins to fetch program instructions from a different address. The first program instruction fetch at this different address may be designed to always obtain 32 bits of instructions even if only the second 16 bits are needed. The test equipment cannot determine which of the two retrieved instructions is the target of the jump operation. Thus, in a processor that retrieves a plurality of program instructions during each instruction fetch cycle, the presently available test apparatus cannot distinguish which instructions are actually executed by the processor and which instructions were temporarily fetched but not used immediately after the execution of a jump instruction.

FIG. 1 illustrates in block diagram form the test apparatus for monitoring the operation of a processor that can retrieve a plurality of program instructions during each instruction fetch cycle and the interconnection of this test apparatus with a system under test. The test apparatus 100 is interconnected with a processor controlled system under test 101 via a set of cables 102. The interconnection of the test apparatus 100 and the system under test 101 is such that the processor status (121), address (120) and data busses (122) in the system under test 101 are interconnected with the test apparatus 100. This interconnection enables test apparatus 100 to monitor the exact operation of the system under test 101.

Test apparatus 100 typically includes a host such as a computer 109 that is equipped with a keyboard 108 and a video monitor 110. The function of computer 109 and the additional circuitry (not shown) found in test apparatus 100 is to record the sequence of program instruction operations executed by the processor 111 in system under test 101. The function of this additional circuitry in test apparatus 100, as well as the software in computer 109, is well known and is not disclosed in detail herein. Computer 109 can be for example a Hewlett Packard Model 9000, Series 300 computer and the additional test apparatus is included in for example a Hewlett Packard 64120 instrumentation package.

The recording and analysis circuitry and software of test apparatus 100 typically cannot exactly follow the instruction flow of the processor 111 in system under test 101 since the program flow can become nonsequential whenever a jump, branch, interrupt or other similar operation is executed by the processor 111. In these situations, the processor 111 may fetch multiple instructions from a new address, called the target address, rather than following the sequence of operations that were originally retrieved from program memory. While it is possible to either replicate or simulate the internal operation of the processor 111 in system under test 101 and thereby uncover which instructions were and were not executed, this requires extensive human intervention and is expensive and subject to error. Emulator pod 103 functions to indirectly force the processor 111 in system under test 101 to reveal which instructions were not executed. This is accomplished without the execution of a software monitor or the need to execute a dump operation which significantly impacts on the real time operation of the system under test 101.

The interconnection illustrated in FIG. 4 represents the emulation of the operation of the processor 111 in the system under test 101. In this application, the processor 111 normally found in the system under test 101 is replaced by the emulator pod 103 which functions in the same manner as the processor 111 removed from the system under test 101. Cable 102 plugs into the connector in which the processor 111 in system under test 101 is normally installed. Cable 102 brings the address 120, status 121 and data 122 busses from system under test 101 to a processor 104 in emulator pod 103 as illustrated in FIG. 1. Processor 104 is either the same device as processor 111 or is a device that can emulate the operation of processor 111 so that processor 104 executes the program instructions in system under test 101 in transparent fashion. The processor address 120 and status 121 busses of system under test 101 are connected directly to processor 104. The processor data bus 122 of system under test 101 is connected to processor 104 by way of buffer 105, the function of which is described below. Thus, emulator pod 103 functions as processor 111.

An example of a processor that retrieves a plurality of instructions on every instruction fetch cycle is the Motorola Incorporated MC68020 Microprocessor. This device has an instruction repertoire based on sixteen bit words. However, to improve the performance of this microprocessor, the MC68020 fetches two words totalling thirty-two bits of information on every instruction fetch cycle thereby improving the throughput of the data bus. An example of this is when a jump operation such as "JMP (A0)" instruction occurs, thirty-two bits of instruction are fetched from the designated address. This operation entails a jump to the target address contained in the processor's internal register (A0). Since register A0 is an internal register in the processor, it is impossible to determine the value of the address contained in this register without duplicating the internal arithmetic and logic of the processor. Thus, it is impossible to determine which of the two words retrieved by the processor represents the target address and which of the two words retrieved by the processor represents an instruction that is not executed by the processor.

In order to resolve this problem, the emulator pod circuitry 103 illustrated on FIG. 1 indicates in indirect fashion which of the two words is executed by the processor in the sequence of program instructions. This is accomplished by the use of buffer 105 and instruction jam circuit 106 and counter/comparator 107 shown on FIG. 1. Counter/comparator 107 monitors the sequencing of program instructions as determined by the addresses that appear on the address bus 120 from processor 104. Whenever counter/comparator 107 detects an address on the address bus 120 that does not represent the next numerical address in the sequence of program instructions that are executed by processor 104, this indicates that processor 104 is fetching from an out of sequence address.

In the case of the MC68020 processor, either the upper sixteen bits or the lower sixteen bits of the thirty-two bit word that is retrieved is the instruction that processor 104 will continue execution with. Unless the sequence of program instructions are extensively analyzed, it is impossible to determine which of the two sixteen bit words are executed by processor 104 in this situation. In order to determine which of these two words are executed by processor 104, counter/comparator 107 in response to the out of sequence address appearing on the address bus 120, simultaneously activates buffer 105 and instruction jam circuit 106 via lead 112. Buffer 105 captures one of the two sixteen bit words that appears on the data bus 122 of system under test 101 in response to the address output by processor 104 on the address bus 120 of system under test 101. Concurrently, the instruction jam circuit 106 outputs a predetermined instruction on the local data bus 123 in place of the instruction that was captured from the data bus 122 of system under test 101. Thus, an example would be the capture of the lower sixteen bits of the thirty-two bit word in buffer 105 and the substitution of a break point (BKPT) instruction in its place on the data bus 123 by instruction jam circuit 106. If the lower sixteen bit word was the target of the jump operation that caused the out of sequence address to appear on the address bus 120, then a break point acknowledge cycle is executed by processor 104, thereby indicating that the lower sixteen bit word was the instruction executed in response to the jump operation. If this is the case, counter/comparator 107 activates buffer 105 to output the originally retrieved instruction that was captured as described above. Processor 104 then continues its operation and the sequence of program instructions executed by processor 104 is thereby determined.

If the upper sixteen bits of the thirty-two bit word were the target of the jump instruction, then the break point acknowledge cycle does not occur and test apparatus 100 can thereby determine that the upper sixteen bit word was the target of the jump operation. Thus, this apparatus can accurately identify which of the two sixteen bit words retrieved by processor 104 is the target of the jump operation with only the overhead of executing a break point instruction.

In the above example, a break point instruction was used to illustrate the operation of this invention although other similar instructions could be used in its place. The requirement is that the predetermined instructions require only a minimum amount of program execution time and do not affect that actual operation of processor 104 by corrupting data or impacting the code in the program that is being executed. This arrangement permits real time tracking of program flow with only a minimum of overhead since the predetermined instruction causes only minimal impact in the operation of processor 104. Examples of other predetermined instructions that can be substituted for a break point operation is a trap instruction that forces the processor into a monitor program that consists of only one more instruction. This requires a slightly more significant intrusion into the program flow than a break point instruction but is a viable alternative when real time operation of system under test 101 is not of prime importance.

In order to further illustrate the operation of this system, FIGS. 2 and 3 illustrate respectively the instruction memory and the contents thereof, and a flow diagram of the operation of this apparatus respectively. FIG. 2 illustrates the sequence of program instructions that are retrieved by processor 104 from program memory. The first two instructions illustrated in FIG. 2 represent the last retrieved instructions in what can be a long sequence of instructions executed by processor 104. Instructions are labeled on the lefthand side by their addresses. In this case, the addresses are arbitrarily selected for the purpose of illustration to be 1000 and 1002 respectively. These two sequential addresses are read by processor 104 in a single program instruction fetch cycle to thereby retrieve two sixteen bit words from memory. In the example illustrated in FIG. 2, these instructions are NOP and JMP (A0) respectively. Processor 104, in executing the sequence of instructions retrieved from program memory, first executes the instruction at address 1000. Processor 104 on completion of this operation advances to the instruction that was retrieved from address 1002 and executes the JMP (A0) instruction. This program instruction causes the processor 104 to retrieve the instruction that is stored at the address indicated by the variable A0. A0 in the case of the Motorola MC68020 processor represents an internal register in the processor 104.

In flow diagram form on FIG. 3 is illustrated the operation of the apparatus shown in FIG. 1. At step 301, counter/comparator 107 monitors the address bus 120 for each new address that is output by processor 104. At step 302, counter/comparator 107 determines whether this address is the next address in the sequence of retrieved program instructions. In the case of the addresses 1000 and 1002 illustrated in FIG. 2 these addresses are assumed to be part of a sequence of program instructions that follow in numerical order. Therefore, counter/comparator 107 determines that these retrieved instructions are next in the sequential order of addresses accessed by processor 104 and returns to step 301 to monitor the next address that appears on the address bus 120. When processor 104 executes the instruction retrieved from address 1002, the sequence of program instructions is interrupted since processor 104 is required to jump to the address location indicated by register A0. For the purpose of illustration, the value A0 is selected to be 2000. Thus, processor 104 outputs 2000 on the address bus 120 and at step 301, counter/comparator 107 responds to the appearance of a new address on the address bus 120 by comparing this address at step 302 with the previously recorded address that appeared on the address bus 120. Since this address (2000) presently extant on the address bus 120 is not the next address in the sequence of addresses, processing advances to step 303 where counter/comparator 107 activates buffer 105 to capture one word of the two words that are retrieved by processor 104 from the program memory.

In FIG. 2 instruction 2000 is illustrated as a "MOVE D0, D1" instruction while the next instruction at address 2002 is a "MOVE D1, D2" instruction. Since the processor 104 retrieves both of these instructions in a single instruction fetch cycle it is not obvious which one of these two addresses is the target of the jump operation that was executed at the previous step. Therefore, at step 303, buffer circuit 105 captures one of the two instructions that are retrieved by processor 104 from memory. For the purpose of illustration, the instruction at address 2000 representing the lower half of the two words retrieved from memory is stored in buffer 105. At step 304, counter/comparator 107 activates instruction jam circuit 106 to output a predetermined instruction onto the data bus in place of instruction that is stored at memory location 2000 in the program memory. For the purpose of illustration, a break point instruction (BKPT n) is output on the local data bus 123 in place of the program instruction that was stored in memory location 2000. At step 305, the emulator pod circuit 103 determines whether the next instruction executed by processor 104 is the predetermined instruction that was output on the local data bus 123 in place of the captured instruction that appeared in the lower half of the thirty-two bit word that was retrieved by processor 104. In the case where this instruction is not the predetermined instruction, processing advances to step 306 where the computer 110 records that the upper half of the retrieved word is the instruction that was executed by processor 104 during this processing cycle. Processing then returns to step 301 where counter/comparator circuit 107 continues to monitor the address bus 120 as described above.

If, at step 305, the next instruction executed by processor 104 was the predetermined instruction jammed onto the local data bus 123 in place of the captured word that was retrieved from the program memory, then at step 307 computer 110 records the captured instruction as the next instruction in the sequence of program instructions executed by processor 104. In the MC68020 processor, execution of the BKPT n instruction is a unique operation and easily detected. At step 308, buffer 105 outputs the captured instruction that appeared at address location 2000 on the local data bus 123 to enable processor 104 to execute this instruction as part of the normal cycle of its operation. In this fashion, the use of a buffer 105, counter/comparator circuit 107 and instruction jam circuit 106 enables test apparatus 100 to exactly determine the sequence of program instructions that are executed by processor 104 while following through a predetermined program. The operation of processor 104 is only minimally impacted in its real time performance by the use of this test apparatus since the only deviation from the normal flow of program instruction execution is the occasional insertion of a break point operation to indirectly flag which of the two retrieved program instructions are executed by processor 104 in response to a jump operation.

While a specific embodiment of the invention has been disclosed it is expected that those skilled in the art can and will devise alternate embodiments that fall within the scope of the appended claims.