System and Method for Hardware Emulation of a Digital Circuit

Appendix A, which is a part of the present disclosure, is an appendix consisting of 10 sheets of listing of a computer program and related data in one embodiment of this invention. This listing of computer programs contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the present disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.

1. Field of the Invention

The present invention relates to design, development and testing of complex digital circuits. In particular the present invention relates to a hardware emulation of complex digital circuits, e.g. a microprocessor.

2. Discussion of the Related Art

In developing a complex integrated circuit, e.g. a microprocessor, hardware emulation is a useful technique to test and debug a design. In hardware emulation, the integrated circuit's logic design is compiled, using various automated tools, into a logic circuit which can be implemented in an hardware emulation system, such as any one of the hardware emulation systems available from Quickturn Systems, Inc., Mountain View, Calif. Such an emulation system consists primarily of a "breadboard" of field programmable gate arrays (FPGAs), and software for programming and controlling the breadboard to emulate the desired logic circuit. An integrated circuit emulated on such a breadboard is effectively an operating working model of the final integrated circuit, and thus can be used reliably to validate the design, by running actual software targeted for the integrated circuit. For example, a developer of an X86 compatible microprocessor would connect the emulation circuit into a system board and debug the design by running on the emulation circuit programs compiled for an X86 compatible microprocessor. When used in this manner, the emulation circuit is said to be "fast simulating" the X86 microprocessor. However, even though hardware emulation provides the fastest means to emulate an integrated circuit, the emulated design still runs hundreds of time slower than the actual integrated circuit it emulates. For example, an emulation circuit for a 200 Megahertz microprocessor can be emulated only at 500 Kilohertz.

With such discrepancy in speed, while it is possible to execute the target software, the process can be extremely frustrating to the development engineer. For example, at the beginning of a design cycle, design errors often lead to hard errors, or "hard crashes", that require the emulated circuit to reset ("reboot"). A reboot sequence includes reinitializing the system and loading an operating system, e.g. DOS or Windows NT.sup.1. However, because of the speed discrepancy, a reboot sequence that takes less than a minute in the target microprocessor can take hours on an emulated circuit, thereby limiting the usefulness of the emulating circuit.

Thus, a method and an apparatus that would allow the emulation circuit to begin execution from an intermediate execution point in a program sequence without requiring the emulation circuit to perform the time-consuming execution sequence to arrive at the same execution point is desired. Preferably, the intermediate execution point can be specified to a particular instruction boundary.

The present invention allows an emulation circuit to begin execution from a specified instruction boundary. Such an instruction boundary can be an instruction immediately preceding a hard error, for example. Thus, a development engineer can quickly "zoom in" an execution sequence of interest, without incurring the extremely time-consuming overhead of initializing the emulation circuit.

The present invention provides a computer system which includes (a) a first terminal for receiving an interrupt signal, (b) a second terminal for receiving a halt signal, (c) a main memory, (d) a first processor, and (e) a second processor. In response to the interrupt signal, the first processor (i) saves the states of a program executing in the first processor in the main memory system; and then halts operation of the first processor. The second processor, which receives both the interrupt signal and the halt signal, in response to the interrupt signal, (i) waits until the halt signal is deasserted; (ii) restores the saved states of the program from the main memory into the second processor; and (iii) resumes execution of the program from the restored saved states.

In one embodiment, the computer system is implemented in a development system. In that development system, the first processor is a processor to be emulated, and the second processor is a logic circuit emulating the first processor. Further, in the development system, switches are provided for asserting the interrupt signal and deasserting the halt signal respectively. Alternatively, devices such as a logic analyzer can be used to generate the interrupt or halt signal. The present invention can be implemented in processors supporting operations under system management mode (SMM) of the X86 architecture. When the emulated processor and the emulating processor operate in different clock speeds, the computer system further includes a clock circuit generating the requisite clock frequencies.

A method of the present invention transfers control between two processors. The processors are configured in a computer system, such that either of the processors can control operation of the computer system, the processors being configured for responding to a common interrupt signal, which initially places one of the processors in a hold state. The computer system initially executes a program in the first processor (i.e., the initially executing processor, typically the emulated processor). An interrupt signal, which has a higher execution priority than the executing program, is then generated to both processors. The interrupt signals can be provided, for example, by analyzing the operation of the executing processor. If the instructions executed can be carefully stepped, such as by the use of a logic analyzer, the interrupt signal can be generated to cause an interrupt service routine to be invoked at a specific instruction boundary. Upon detection of the interrupt signal, execution of the program is then suspended, with the execution states of the program in the first processor saved to a memory device. Then, the first processor is then placed in a hold state. The second processor, i.e., the processor halted hitherto, is then released from its hold state, and the saved states of the program are then loaded from the memory device to the second processor. Finally, execution of the program is resumed in the second processor from the restored saved states.

In one embodiment of the present invention, the step of saving the execution states of the program, and the step of placing the first processor in a hold state are controlled by an interrupt handling program executed in the first processor. Similarly, the step of loading the saved states can be controlled by an interrupt handling program executed in the second processor, in which the interrupt handling program returns from servicing the interrupt signal to allow carrying out in the second processor the step of resuming execution of the program. In fact, the interrupt handling program of the first and second processors can be two copies of a common interrupt handling program. In that instance, the common interrupt handling program performs the respective steps in the first and second processors according to the identity of the processor executing the common interrupt handling program.

When the first and second processors operate at different clock frequencies, the clock frequencies can be generated from a common clock circuit.

The present invention is better understood upon consideration of the detailed description below and the accompanying drawings.

FIG. 1 is a block diagram of a development system 100 for a microprocessor, in an embodiment of the present invention.

FIG. 2 shows a hardware configuration in development system 100 which handles the HLDA and SMI.sub.-- ACK signals of processor 101 and processor 102, so as to enable passing control (i.e., "switching over") of development system 100 between processor 102 and processor 101, in accordance with the present invention.

FIG. 3 is a flow chart showing the installation tasks of the switch-over handler in both processor 101 and processor 102.

FIG. 4 is a flow-chart showing the tasks performed by the switch-over handler in both processor 101 and processor 102.

In the following description, the present invention is illustrated in the context of a development system for developing a compatible microprocessor. Even so, one skilled in the art would appreciate that the techniques discussed herein are applicable to all areas of digital logic design.

FIG. 1 is a block diagram of a development system 100 for a microprocessor, in an embodiment of the present invention. As shown in FIG. 1, the microprocessor under development (hereinafter "processor 101"), typically implemented in the FPGAs of a hardware emulation system (not shown) and interfaced with development system 100 through a connector, is configured to work cooperatively with another microprocessor (hereinafter "processor 102"), which can execute at least a subset of the instruction set to be implemented in processor 101. Using the popular X86 microprocessor family as an example to further illustrate this development system, processor 101 can be a "next-generation" microprocessor under development, and processor 102 can be a microprocessor of the X86 family, such as an AMD K5 microprocessor, available from Advanced Micro Devices, Inc., Sunnyvale, Calif.

According to the present invention, either processor 102 or processor 101 can assume the role of the central processing unit ("CPU") for development system 100. As shown in FIG. 1, the CPU accesses over a memory bus 103 (not shown) to a main memory 107, which includes (i) non-volatile memories 105 and 106, for storing the basic input and output system ("BIOS") programs and the microcodes of other system programs, respectively, and (ii) main storage 107, implemented by dynamic random access memories (DRAM). In addition, the CPU accesses secondary cache memory 108, also provided on memory bus 103. In this embodiment, a "synchronous burst" static random access memory is used to implement the data portion 108a of secondary cache memory 108. A secondary cache memory tag array 108b is provided for the tag portion of secondary cache memory 108. Built-in primary cache memories are provided in development system 100 for both processor 101 and processor 102. A "chipset" 109, which includes PCI and ISA bus controllers 109a and 109b, DMA controller 109c, clock system 109d, IDE and floppy disk controllers 109e and 109f, memory controller 109g, keyboard controller 109h and "data steering" logic circuit 109i, is provided in development system 100 to allow the CPU to interface with a host of peripheral devices. In the embodiment shown in FIG. 1, development system 100 provides three industry standard PCI "slots" 110a-110c and four industry standard ISA slots 110d-110h. Floppy disk controller 109f supports up to two floppy drives over floppy drive port 111. Likewise, IDE controller 108e supports up to four IDE devices over IDE ports 112a and 112b. Data steering logic circuit 109i steers data among the various devices and data buses in development system 100. Keyboard controller 109h supports both an industry standard "PC" keyboard interface 114a and an industry standard "PS/2" keyboard interface 114b. LEDs, not illustrated, are provided to indicate certain operating conditions conventionally provided in a "PC" type motherboard. Power to development system 100 is provided by power supply, not illustrated. A voltage regulation circuit 116 provides output voltages 3 volts and 5 volts for processor 102 and the various integrated circuits implementing chipset 109.

In this embodiment, (a) non-volatile memories 105 and 106 can be implemented by such electrically programmable read-only memory (EPROM) integrated circuits as the 27C256 or 27C010 EPROMs, (b) clock system 109d can be implemented by a MACH 210 clock generation integrated circuit, (c) the data portion 108a of secondary cache memory 108 can be implemented by MT58LC32K32 static random access memories (SRAMs), (d) the tag array 108b of secondary cache memory 108 can be implemented by CY7B180/181 SRAMs, (e) floppy disk controller 109f can be implemented by an FDC37C669 integrated circuit, which also includes support for a host interface, two serial ports and one parallel port; and (f) keyboard interface 109h can be implemented by a 8042 keyboard interface integrated circuit. The remaining logic circuits of development system 100 can be implemented as custom logic circuits in field programmable gate arrays (FPGAs), such as those obtainable from Xilinx, Inc.

Because processor 101 emulates processor 102, the signals received and driven by processor 101 and processor 102 are substantially identical. Thus, except for the signals discussed below, corresponding signals of processor 101 and processor 102 are commonly connected in development system 100. Because, at any given time, only one of processor 101 and processor 102 is executing, while the other processor is in a "hold" state, only one processor is actively driving the commonly connected output signals. The output terminals of the processor under a "hold" state are tristated. During a "hold" state, a processor asserts an output signal "HLDA" (hold acknowledge). By convention under the X86 architecture, a "system management mode (SMM)" interrupt ("SMI"), is trapped by a processor, whether or not the processor is executing or halted. The present invention takes advantage of this feature to enable passing control, or "switching over" of development system 100 between processor 101 and processor 102. SMM is a standard system operating mode under the X86 architecture which is used typically for power saving applications. Under SMM, a protected region of the memory space is made available for running certain applications programs typically geared towards energy saving operations.

Each processor, upon receiving an asserted "SMI" signal (i.e., the SMM interrupt), acknowledges the SMM interrupt by asserting an acknowledgement signal "SMI.sub.-- ACK". Thus, to enable control of development system 100 to switch between processor 101 and processor 102, special hardware support is provided to handle each processor's SMI.sub.-- ACK and HLDA signals, which can be asserted simultaneously, despite the fact that only one of processor 101 and microprocessor 102 is executing at any given time. FIG. 2 shows a hardware configuration in development system 100 which handles the HLDA and SMI.sub.-- ACK signals of processor 101 and processor 102, so as to enable switching over of development system 100 between processor 102 and processor 101, in accordance with the present invention.

As shown in FIG. 2, a commonly connected SMI signal ("EXT.sub.-- SMI") is provided at terminal 202 to both processor 101 and processor 102. The present invention causes control of development system 100 to be passed from processor 102 to processor 101 in response to an SMM interrupt. In response to an asserted EXT.sub.-- SMI signal, processor 101 and processor 102 each asserts its SMI.sub.-- ACK signal, labelled respectively "K6.sub.-- SMI.sub.-- ACK" and "K5.sub.-- SMI.sub.-- ACK" in FIG. 2. A multiplexor circuit 205 receives both "K6.sub.-- SMI.sub.-- ACK" and "K5.sub.-- SMI.sub.-- ACK" signals and selects, according to the value of a select signal CPU.sub.-- SEL, one of these signals for output at terminal 207 as the signal "HEAD.sub.-- SMI.sub.-- ACK". Signal HEAD.sub.-- SMI.sub.-- ACK is the SMI acknowledge signal provided to chipset 109 to indicate a pending SMM interrupt to be serviced. A hold select signal HLD.sub.-- SEL is provided to place one of processor 101 and processor 102 in the "hold" mode. The hold acknowledge signals of processor 101 and processor 102, labelled respectively as K6.sub.-- HLDA and K5.sub.-- HLDA, are output from processor 102 and processor 101 at terminals 206 and 208 to indicate whether or not processor 101 or processor 102 is placed in a hold state.

In development system 100, three special switches 120, 121 and 122 are provided to activate the aforementioned signals HLD.sub.-- SEL, EXT.sub.-- SMI and CPU.sub.-- SEL. Switch 120 is set to couple signal HLD.sub.-- SEL, or its complement, to the "hold" pins of processor 101 and processor 102. When held in a logic high signal level, the "hold" pin suspends execution of its processor (in this instance, the respective one of processor 101 and processor 102 at which the hold signal is active). Thus, switch 120 selects one of processor 101 and processor 102 to be the CPU of development system 100. Switch 121 is provided to couple the EXT.sub.-- SMI signal to the SMI pins of both processor 101 and processor 102, thereby generating at each processor an SMM interrupt. Switch 122 is provided to select in multiplexor 205 which of the SMI.sub.-- ACK signals to provide to chipset 109 as signal HEAD.sub.-- SMI.sub.-- ACK. Because processor 101 and processor 102 run at different clock frequencies, switch 122 also selects the appropriate clock frequencies for processor 101 and processor 102, during their respective tenures as the CPU of development system 100.

Under the present invention, initially, switch 120 is set to select processor 102 as development system 100's CPU. At the same time, switch 122 is set to provide the appropriate clock frequency for processor 101's operation. Processor 102 then boots development system 100 into normal operation. Under this mode, development system 100 runs in the operating clock frequency of processor 102. Thus, the process of booting up development system 100 normally takes no more than a minute or two. To exercise and debug processor 101, one or more system or application programs are then launched by processor 102. These application or system programs are allowed to run until a region of interest is reached. The region of interest can be, for example, a section of an application program which includes an instruction which is improperly executed in processor 101. When the region of interest is reached, the user activates switch 121 to generate an interrupt signal at the SMI pin of both processor 101 and processor 102. If a logic analyzer is used to analyze the output signals of processor 102, or a software tool is used to monitor the execution of an instruction sequence, the interrupt signal can be raised at a specified instruction boundary. Under existing SMM convention, even though execution of processor 101 is suspended by the hold signal asserted by switch 120, the occurrence of an SMM interrupt is still latched by processor 101. Upon receiving the SMM interrupt, processor 102 executes an interrupt service routine for handling the pending SMM interrupt.

To enable control to be passed from processor 102 to processor 101, a SMM interrupt handler, called the "switch-over handler" performs the tasks illustrated in the FIGS. 3 and 4. A copy of the switch-over interrupt handler of the present embodiment, written in X86 assembly language, is included in Appendix A.

At "boot-up" time, i.e., the initialization of development system 100, the switch-over handler is installed. FIG. 3 is a flow chart 300 showing the installation tasks of the switch-over handler in both processor 101 and processor 102. After installation, the switch-over handler is executed first in processor 102 and then executed in processor 101. FIG. 4 is a flow-chart showing the tasks performed by the switch-over handler in both processor 101 and processor 102.

The installation tasks shown in FIG. 3 are executed at boot time from a location in the BIOS, illustrated in Appendix A by a switch-over handler installation routine "INST.sub.-- SO.sub.-- HND". At step 301 of FIG. 3, a reserved area of memory, which is located at segment address 3000h and is known as the "system management RAM" ("SMRAM"), is made available to the switch-over handler installation routine. At step 302, switch-over handler installation routine tests whether it is executed in processor 102 (i.e., "K5", the emulated microprocessor) or processor 101 (i.e., "K6", the processor under development). If the executing processor is processor 102, the identity of the processor is stored into a register of processor 102 at step 303 and the switch-over handler is copied from the BIOS to a portion of SMRAM at step 304, beginning at address 3000h:8000h where, by convention, an SMM interrupt handler is expected by a CPU. If the switch-over handler is successfully copied, as verified at step 305, a software initiated SMM interrupt is generated at step 306. This SMM interrupt is generated with a parameter value or flag (i.e., "RELOC.sub.-- FLAG" in Appendix A) set to indicate a further relocation of the switch-over handler to segment address A000h is to be performed, before returning, at step 307, to the calling routine in the BIOS. If the switch-over handler is incorrectly copied, an appropriate error handler is called at step 308, before returning, at step 309, to the calling routine in the BIOS. Referring back to step 302, if the executing processor is found to be processor 101, the identity of processor 101 is stored in a register of processor 101 and the switch-over installation routine returns at step 311.

An SMM interrupt, including the software initiated SMM interrupt generated at step 306 of FIG. 3, is handled by the switch-over handler illustrated by flow chart 400 of FIG. 4. The flow chart 400 of FIG. 4 is implemented in the source code of Appendix A as near procedure "SMI.sub.-- SO.sub.-- HANDLER". As shown in FIG. 4, the switch-over handler first tests whether the executing processor is processor 101, processor 102 or another processor. As shown at step 402, if switch-over handler tests that the executing processor is neither processor 102 nor processor 101, an error condition is reported and the switch-over handler returns, at step 413, to the calling routine in the BIOS.

Alternatively, if switch-over handler tests that the executing processor is processor 102, switch-over handler then loads, at step 403, the current base address of the processor's state-save area in main memory 107 to preserve the states of processor 102 prior to the SMM interrupt. If the current SMM interrupt is the software interrupt generated during the installation of the switch-over handler (i.e., the SMM interrupt illustrated by step 306 of FIG. 3), the SMM interrupt handler is relocated, at step 405, from address 3000h:8000h to address A0000h:8000h, as expected by processor 101. The new base address of the processor's state-save area, i.e., segment A000h, is then updated at step 406. At step 407, switch-over handler then resets the SMI pending signal (i.e., K5.sub.-- SMI.sub.-- ACK) and enables SMI, so as to allow the next SMM interrupt to be raised At this point, installation and initialization of the switch-over handler are complete. Application programs can then be run on processor 102, while processor 101 is held at "hold" state, until a pre-determined switch-over point is reached.

The switch-over point is triggered by asserting signal EXT.sub.-- SMI. In the present embodiment, signal EXT.sub.-- SMI is asserted by activation of switch 121. Alternatively, a logic analyzer monitoring the signals on the input/output pins of processor 102 can also be used to more precisely trigger signal EXT.sub.-- SMI. When signal EXT.sub.-- SMI is asserted, an SMM interrupt is raised at both processor 101 and processor 102. Processor 102 responds to the SMM interrupt by saving the current processor states in the processor state-save area, and then calling the switch-over handler routine at A000h:8000h when SMM is entered (step 401). In this instance, at step 404, switch-over handler determines that the executing processor is processor 102, and the switch-over handler is already relocated to the predetermined segment address of A000h.

At step 408, the saved states in the processor's state-save area is copied to a temporary buffer area (addresses A000h:0E00h to A000h:0FFFh), being at the same time modified to the format expected by processor 101. Then, a code is posted at a debug port (80h) to indicate the successful saving of processor 102's states in the format expected by processor 101 and a switch-over to processor 101 is next expected. At step 410, processor 102 halts execution.

In this embodiment, subsequent to step 410, a user activates switch 122 to select signal K6.sub.-- SMI.sub.-- ACK as signal HEAD.sub.-- SMI.sub.-- ACK and to activate the clock signal to allow processor 101 to take over execution of the application program which is run on processor 102 prior to the current SMM interrupt. Switch 120 is then activated to release processor 101 from its hold state. When processor 101 is released from its hold state, it executes the switch-over handler at A000h:8000h to service the pending SMM interrupt generated by switch 121. The switch-over handler, upon determining at step 402 that the executing processor is processor 101, loads the current base address of the processor's state-save area and copies, at steps 411 and 412 respectively, the modified processor states from the temporary buffer area to the processor's state-save area. Upon restoring the processor states, step 407 is entered, in which signal SMI.sub.-- ACK is reset to indicate that the present SMM interrupt is satisfactorily serviced. At step 407 also, the SMI input terminal of processor 101 is re-enabled. At step 409, processor 101 returns from servicing the SMM interrupt generated by switch 121.

After step 409, processor 101 inherits from the states of processor 102 prior to the SMM interrupt, executing the application program from the instruction boundary at which processor 102 was executing prior to the SMM interrupt. Thus, a region of interest in an application program can be accessed quickly without the emulating circuit executing all instructions since the boot-up sequence of development system 100.

The above detailed description are provided to illustrate specific embodiments of the present invention and is not intended to be limiting. Numerous modifications and variations within the present invention are possible. The present invention is defined by the appended claims.