a³ Release 14.04
----------------
Targets
-------
a³ for C28x now supports the following CPUs:
TMS320F2801x, TMS320F2802, TMS320F2806, TMS320F2808,
TMS320F2809, TMS320F2810, TMS320F2811, and TMS320F2812.
Qualification Support Kits
--------------------------
* New QSK for aiT for TriCore with board-specific TC1797 test cases.
* New compiler-specific QSK for StackAnalyzer for PPC with DiabData 5.6.1.0.
* New compiler-specific QSK for StackAnalyzer for PPC with DiabData 5.8.0.0p4.
* Added measurement test cases to the QSK for aiT MPC603e (MPC8349).
* A qualification run now logs the name of the QSK package
into the message window and the report file before starting
to execute its test cases.
* Implemented support for non-ASCII characters
in QSK package installation path.
* In case of QSK add-on packages, display buttons for TOR and VTP
allow selecting the document variant.
* QSK test cases are now sorted by ID.
Known issues
------------
* When exporting project data via "Project" -> "Export", annotations
of the following form are omitted:
global "<attribute name>" = "<attribute value>"
* Upon opening any supplied example project as a temporary
working copy, do not save it to a directory containing
non-temporary data, as that directory will be deleted
as soon as you close a³ or load a different project.
GUI
---
* All views can be detached rather than split. Any detached window
can be reattached simply by closing it. To reattach all windows
at once, use "Attach all" in the context menu.
* Analyses can no longer be removed simply by closing their view.
Instead, use either the minus button in the Overview list,
or right-click on the analysis name in the left sidebar
to get the "Remove analysis" option.
* Statistics views can now be opened using a button in the toolbar
when needed, rather than always being created as child items
for each analysis. This prevents the left sidebar from getting
crowded for projects with many analyses.
* More log options in the Message view: "Latest log",
"Recent logs", "All logs".
* Improved AIS wizard.
* Improved handling of projects with additional starts,
including result statistics and result graphs.
* Temporary working copies of example projects can now be opened from
the Welcome view. These are deleted after usage. Do not save temporary
projects to a directory containing non-temporary data (see "known issues").
* ResultCombinator now supports specifying text and XML report files,
as well as an expected result.
* Older versions of the GUI automatically deleted the target directory
for project export whenever the export failed. This behavior was not
intended and has been disabled.
* If target settings are specified via register values, the affected
settings are highlighted.
* Fixed a crash due to a race condition when triggering a (re-)load
of both the Variables and Functions views.
* Improved the shipped XTC examples.
* Improved configuration management.
* CSV export of analysis summary/result table and other table views
like the Source Files view.
* Clicking on a menu bar item a second time will now close
that item's menu again.
* Added option to unify duplicated variables in debug information view
(disabled by default).
* Fixed a display error in the Functions view whereby a function's address
was shown as its end address rather than the start address. (This did not
affect disassembly or analysis start locations, as for these the addresses
are taken from the Symbols table.)
* The debug information views now have a more prominent option
to extract all information at once.
* Improved cloning of analyses. Expected results will no longer be cloned
if analysis type mismatches.
* In the interactive value analysis view, backwards-infeasible contexts
are now visualized differently from infeasible ones, similar to how
this is done in the call graph.
* Improved interactive value analysis by showing sub-register relations.
* Manhattan edges are now the default edge style for the graph visualisation.
* In the Functions and Variables views, the "Absolute address"
and "Relative address" columns have been merged.
* For targets with the generic memory controller (MPC603e, MPC7448s,
MPC755s, PPC750), changing configurations used to reset certain settings
to their default values in the individual configurations. This behavior
was not intended and has been disabled.
* a³ for TriCore: added generic targets for stack analysis of TriCore 1.3
and 1.6 executables.
* a³ for TriCore: external wait cycles are configurable per access type,
i.e. either reads or writes (TCv1.3.1 only).
* a³ for MPC55xx/MPC56xx: the hardware register wizard did not correctly
set up the external memory controller. This has been fixed.
* a³ for V850: "Logical data address space in bits" now defaults
to 32 bit for the generic stack analysis targets.
AIS
---
* Fixed handling of "routine <pp> area <pp> (, <pp>)*" annotations.
The decoder wrongly attempted to resolve the first area program point
as a routine, which usually fails.
* Fixed export of "instruction <pp> area contains …" annotations,
such that "instruction" is no longer wrongly replaced with "routine".
* Changed semantics of the "global accesses default" annotation.
It no longer affects the value analysis, only the pipeline analysis
phase. The threshold for affecting unsharp accesses can be set in the GUI.
* New value analysis for C28x, FR81, KALRAY, MicroBlaze and Patmos
crashed when the data supplied by "area … contains …" was too wide.
This has been fixed, the data now being properly truncated.
* Included AIS files are always searched relative to including AIS file.
* Removed the "routine 'routinename' is watched" AIS annotation and feature.
* New AIS2 annotation to confirm that automatically ignored 0x0 pointers
can be safely discarded:
instruction <pp> null safe(: <boolean_expr>);
* The deprecated "before" expressions are no longer supported.
* The AIS annotation "routine <pp> calls <pp> (, <pp>)*?"
no longer affects traps.
Decoding
--------
* Fixed a possible crash when reading debug information
(was likely to only affect C++ binaries).
* Improved support for GHS CodeFactor optimization.
* Improved handling of unknown (i.e. bad or custom) DWARF debug information.
* Improved handling of debug information for XCOFF32 executables.
* Improved decoding of mixed ARM/THUMB binaries.
* Improved decoding of computed call targets.
* Improved decoding performance if many sections are relocated in the binary,
e.g. by applying copy tables for FLASH to RAM copying.
* Decoder patterns may now access data in sections that are marked as writable
or unreadable.
* Fixed issues with extracting source code annotations that lead to errors
such as "Line break inside character constant".
* Now using DWARF information to provide better function names for targets
that otherwise only have names like "_name" (both "name" and "_name"
will work).
* Additional use is made of DWARF debug information to automatically resolve
computed calls via arrays or structures.
* Improved XCOFF32 reader, solving a fatal error for reading non-code sections
that have invalid line number counts or reading of non-allocated sections.
* C16x: extended automatic decoding of KEIL switch tables.
* C28x: "doubleword" can now be used as a unit in "area contains" annotations.
* HCS12:
* Improved decoding of computed call and branch targets.
* Support copy table (.copy) of CodeWarrior/Hiware/Metrowerks compiler
for HCS12X(E) with far/near mode.
* FR81:
* Support for Fujitsu auto-copying of sections from ROM to RAM.
* Improved automatic decoding of switch tables and calls via arrays
of function pointers.
* PowerPC:
* Extended decoder to support:
* new instruction forms mfocrf and mtocrf,
* the cmpb RA, RS, RB instruction,
* the instructions dnh, e_dnh, and se_dnh,
* device control registers of modern Freescale processors
for mfdcr and mtdcr instructions.
* DiabData:
* Improved decoding of switch table patterns.
* Improved automatic decoding of switch tables and computed calls.
* GreenHills:
* Improved support for speed optimized binaries.
Code factored tail calls are now correctly recognized.
* Improved support for computed call tables in combination
with tail call optimizations.
* Improved support for compiler generated stack restoration routines.
* HighTec: added support for recent compiler version v4.6.4.0.
* TriCore:
* Added support for the "mov eX, dX" move variant.
* Added support for SDA3 + SDA4 base specification and auto-detection
(A[8] and A[9]).
* Tasking:
* Added support for auto-copying of sections from FLASH to RAM.
* Improved guessing of the context save area.
* GCC: improved automatic decoding of computed calls and switch tables.
* HighTec: added support for recent compiler version v4.6.4.0.
* V850: improved decoding of HighTec GCC switch tables.
Stack and value analysis
------------------------
* Improved the statistics about memory accesses. In addition to
access statistics (sum over all access instructions times their
access steps and the number of contexts), instruction statistics
are now provided as well. The numbers are also broken down
by access precision (exact, nearly exact, imprecise and unknown).
* Report information about memory areas (e.g. which are volatile or constant)
to the user not only for value but also for stack analysis.
* In the text and XML report file, the names of global variables
that are accessed are now reported. Example:
memory accesses of function 'Proc0':
instruction 0x80000086 writes to [0xd00007c0]:64
instruction 0x8000008e writes to [0xc000000c]:4 ('PtrGlbNext')
instruction 0x80000092 writes to [0xd00007c0]:64
instruction 0x80000096 writes to [0xc0000008]:4 ('PtrGlb')
instruction 0x8000009a reads from [0xc000000c]:4 ('PtrGlbNext')
instruction 0x8000009e writes to [0xc000004c]:4 (part of 'feld')
* Improved message and report annotation hint
for unresolved computed control flow:
va-fr81: Warning #3082: In "test.c", line 42:
In routine 'testLoop.L3', at address 0x1234560:
Losing precision since there is an unresolved computed call
(routine "testLoop" + 3 computed).
Assuming a balanced stack effect and no violation of calling conventions
for unresolved call.
Results may be incorrect!
You might need an AIS annotation:
instruction routine "testLoop" + 3 computed ...
* If the user annotates an access range for an instruction that contradicts
the analyzed value, then this will be reported and the annotated instruction
will be marked as infeasible, which means that it cannot be part of any
execution path.
* Memory access statistics summaries of the value analysis now take
into account annotations for memory accesses like e.g. accesses,
global restricts or global defaults.
* AIS annotations that assign properties to memory areas such as being
read-only or containing some data are mirrored for the value analysis
if the annotated memory area is part of the mirrored area. If, however,
the annotated memory area crosses the boundary of mirrored areas,
the annotation is ignored and a warning is issued.
* C28x and FR81:
* Added the analysis parameter "Size limit for interval sets".
It will let the analysis not only track one interval with modulo
information, but also a set of precise values up to the given
maximum set size.
* Improved branch splitting.
* Memory accesses for which the analyzed and annotated access area clash
will lead to infeasible paths. A warning will be issued, e.g.:
va-fr81: Warning #3073: In "minmax.c", line 26:
In routine 'main', at address 0x1013ee:
The memory access annotation specifies an area for the read access
which is outside the computed memory area => assuming infeasible path:
computed: [0x00100fec]:4
specified: [0x00100ff0]:4
* Annotations that only affect the mirroring source area are mirrored
automatically. Annotations that affect both the mirroring source area
and the non-mirrored area are ignored, and a corresponding message
is issued to inform the user.
* Improved precision for computations involving a carry flag.
* Improved precision for count leading zeros.
* Improved precision for shifts with imprecise shift amount.
* Improved analysis memory consumption and runtime.
* Improved precision for unsharp reads and writes to memory.
* More precise value analysis for loops.
* Improved tracking of relations between registers and memory cells.
* Improved support for iterative decoding loop.
* Improved precision of loop analysis.
* Improved value analysis precision for mixed register and sub-register
updates.
* C28x:
* Improved precision of value analysis with respect to calling conventions.
* Improved loop bound detection.
* PowerPC:
* Added support for mtocrf/mfocrf instructions.
* Improved handling of 64-bit compare instructions used in 32-bit
PowerPC code. An info message will be issued, and the tool will
continue with safe assumptions.
Cache and pipeline analysis
---------------------------
* ARM Cortex-R4(F): enhanced pipeline and memory model thanks to
additional documentation from ARM and Texas Instruments.
* C28x:
* Added support for finding loop bounds of SPI polling loops.
* Improved local worst-case pipeline analysis mode.
* MPC603e/PPC750/MPC755s/MPC7448s: improved analysis performance
in local worst-case mode.
* MPC603e/PPC750/MPC7448(s): report splits due to imprecise speculative
read/write accesses separately to the non-speculative splits.
* MPC7448(s): implemented configurable branch folding support (HID0[FOLD])
* e500/MicroBlaze/KALRAY: Implemented resource access counting.
* If an access counting region is specified, only accesses to this region
are counted.
* It is possible to specify weights for code/read/write as follows:
global "pipe_code_access_weight" = 2;
global "pipe_read_access_weight" = 2;
global "pipe_write_access_weight" = 2;
The default weight is 1.
* TriCore:
* Changed semantics of external wait cycles. External wait cycles
are only accounted for if they exceed the configured command + command
delay cycles.
* Adjusted timing behavior of demuxed asynchronous external memory
for TCv1.3.1.
Visualization and reporting
---------------------------
* The decoder now reports computed return targets of call instructions
in the textual report.
* When automatically resolving computed control flow targets by means
of iterative decoding the decoder now prints the semantics of the read
register content. This information is made available in the textual report.
Example:
exec2crl.disass: Info: In "<source>", line <number>:
In routine '<name>', at address <address>:
Call has 1 computed target (matched pattern: call_table_indirect_1
using r28 = 0x82 (table index) and r2 = 0x6d1f0 (table address)):
<address>/n <name>.
* The special annotations specifying the execution times
of system call handlers are no longer supported. Use instead:
<program point> additionally takes switch (r5) {...} cycles;
* Added message to inform the user that flow constraints are ignored
for prediction-file based analyses.
* Improved output of XML reports for ValueAnalyzer tasks
to support iterative decoding rounds.
==============================================================================
Last modified on 8 April 2014 by alex@absint.com.
Copyright 2014 AbsInt. http://www.absint.com/
==============================================================================
An HTML version of these release notes is available at
http://www.absint.com/releasenotes/a3/14.04/