Capturing RISC-V Instruction Traces with TracerV
FireSim can provide a cycle-by-cycle trace of a target CPU’s architectural state over the course of execution, including fields like instruction address, raw instruction bits, privilege level, exception/interrupt status and cause, and a valid signal. This can be useful for profiling or debugging. TracerV is the FireSim bridge that provides this functionality. This feature was introduced in our FirePerf paper at ASPLOS 2020 .
This section details how to capture these traces in cycle-by-cycle formats, usually for debugging purposes.
For profiling purposes, FireSim also supports automatically producing stack traces from this data and producing Flame Graphs, which is documented in the TracerV + Flame Graphs: Profiling Software with Out-of-Band Flame Graph Generation section.
Building a Design with TracerV
In all FireChip designs, TracerV is included by default. Other targets can enable it by attaching a TracerV Bridge to the RISC-V trace port of each core they wish to trace (there should be one bridge per core). By default, only the cycle number, instruction address, and valid bit are collected.
Enabling Tracing at Runtime
To improve simulation preformance, FireSim does not collect and record data
from the TracerV Bridge by default. To enable collection, modify the
flag in the
tracing section in your
config_runtime.yaml file to
tracing: enable: yes
Now when you run a workload, a trace output file will be placed in the
sim_slot_<slot #> directory on the F1 instance under the name
C0 represents core 0 in the simulated
SoC. If you have multiple cores, each will have its own file (ending in
C2, etc). To copy all TracerV trace files back to your manager, you can
TRACEFILE* to your
simulation_outputs in your workload
.json file. See the
Defining Custom Workloads section for more information about these
Selecting a Trace Output Format
FireSim supports three trace output formats, which can be set in your
config_runtime.yaml file with the
output_format option in the
tracing: enable: yes # Trace output formats. Only enabled if "enable" is set to "yes" above # 0 = human readable; 1 = binary (compressed raw data); 2 = flamegraph (stack # unwinding -> Flame Graph) output_format: 0
See the “Interpreting the Trace Result” section below for a description of these formats.
Setting a TracerV Trigger
Tracing the entirety of a long-running job like a Linux-based workload can generate a large trace and you may only care about the state within a certain timeframe. Therefore, FireSim allows you to specify a trigger condition for starting and stopping trace data collection.
By default, TracerV does not use a trigger, so data collection starts at cycle
0 and ends at the last cycle of the simulation. To change this, modify the
following under the
tracing section of your
selector field to choose the type of trigger (options are described
end fields are used to supply the start and end
values for the trigger.
tracing enable: yes # Trace output formats. Only enabled if "enable" is set to "yes" above # 0 = human readable; 1 = binary (compressed raw data); 2 = flamegraph (stack # unwinding -> Flame Graph) output_format: 0 # Trigger selector. # 0 = no trigger; 1 = cycle count trigger; 2 = program counter trigger; 3 = # instruction trigger selector: 1 start: 0 end: -1
The four triggering methods available in FireSim are as follows:
Records the trace for the entire simulation.
This is option
0 in the
end fields are ignored.
Target cycle trigger
Trace recording begins when a specified start cycle is reached and ends when a specified end cycle is reached. Cycles are specified in base target-clock cycles (the zeroth output clock from the ClockBridge). For example, if the base clock drives the uncore, and the core clock frequency is 2x the uncore frequency, specifying start and end cycles of 100 and 200 result in instructions being collected between core-clock cycles 200 and 400.
This is option
1 in the
end fields are interpreted as decimal integers.
Program Counter (PC) value trigger
Trace recording begins when a specified program counter value is reached and ends when a specified program counter value is reached.
This is option
2 in the
end fields are interpreted as hexadecimal values.
Instruction value trigger
Trace recording begins when a specific instruction is seen in the instruction trace and ends when a specific instruction is seen in the instruction trace. This method is particularly valuable for setting the trigger from within the target software under evaluation, by inserting custom “NOP” instructions. Linux distributions included with FireSim include small trigger programs by default for this purpose; see the end of this subsection.
This is option
3 in the
end fields are interpreted as hexadecimal values. For
each, the field is a 64-bit value, with the upper 32-bits representing a
mask and the lower 32-bits representing a comparison value. That is, the
start or stop condition will be satisfied when the following evaluates to true:
((inst value) & (upper 32 bits)) == (lower 32 bits)
That is, setting
start: ffffffff00008013 will cause recording to start when
the instruction value is exactly
addi x0, x1, 0
instruction in RISC-V).
This form of triggering is useful when recording traces only when a particular
application is running within Linux. To simplify the use of this triggering
mechanism, workloads derived from
br-base.json in FireMarshal automatically
include the commands
which issue a
addi x0, x1, 0 and
addi x0, x2, 0 instruction
respectively. In your
config_runtime.yaml, if you set the following
selector: 3 start: ffffffff00008013 end: ffffffff00010013
And then run the following at the bash prompt on the simulated system:
$ firesim-start-trigger && ./my-interesting-benchmark && firesim-end-trigger
The trace will contain primarily only traces for the duration of
my-interesting-benchmark. Note that there will be a small amount of extra
trace information from
as well as the OS switching between these and
While it is unlikely that a compiler will generate the aforementioned trigger instructions within normal application code, it is also a good idea to confirm that these instructions are not inadvertently present within the section of code you wish to profile. This will result in the trace recording inadvertently turning on and off in the middle of the workload.
On the flip-side, a developer can deliberately insert the aforementioned
instructions into the code they wish to profile, to enable more fine-grained
Interpreting the Trace Result
Human readable output
The human readable trace output format looks like so:
# Clock Domain: baseClock, Relative Frequency: 1/1 of Base Clock Cycle: 0000000000000079 I0: 0000000000010040 Cycle: 0000000000000105 I0: 000000000001004c Cycle: 0000000000000123 I0: 0000000000010054 Cycle: 0000000000000135 I0: 0000000000010058 Cycle: 0000000000000271 I0: 000000000001005c Cycle: 0000000000000307 I0: 0000000000010000 Cycle: 0000000000000327 I0: 0000000000010008 Cycle: 0000000000000337 I0: 0000000000010010 Cycle: 0000000000000337 I1: 0000000000010014 Cycle: 0000000000000337 I2: 0000000000010018
In this output, each line begins with the cycle (in decimal) in the core’s
clock domain that instruction was committed. For a given cycle, the instruction
address (in hex) of each committed is prefixed
I<#> according to their
appearance in program order:
I0 is the oldest instruction committed,
is the second oldest, and so forth. If no instructions were committed in a
given cycle, that cycle will be skipped in the output file.
Cycle: 0000000000000337 I0: 0000000000010010 Cycle: 0000000000000337 I1: 0000000000010014 |--------------| ^ |--------| | | └ 40 bits of instruction address (hex) | └ per-cycle commit-order └ 64-bit local-cycle count
This simply writes the 512 bits received from the FPGA each cycle to the output file in binary. Each 512-bit chunk is stored little-endian. The lowermost 64 bits stores the cycle, the second 64-bits stores the address and valid bits of committed instruction 0 in little-endian, the next 64-bits stores the address and valid bits of committed instruction 1 in little-endian, and so on, up to a maximum of 7 instructions.
Flame Graph output
output_format: 2. See the TracerV + Flame Graphs: Profiling Software with Out-of-Band Flame Graph Generation section.
There are currently a few restrictions / manual tweaks that are required when using TracerV under certain conditions:
TracerV by default outputs only instruction address and a valid bit and assumes that the combination of these fits within 64 bits. Changing this requires modifying
The maximum IPC of the traced core cannot exceed 7.
Please reach out on the FireSim mailing list if you need help addressing any of these restrictions: https://groups.google.com/forum/#!forum/firesim