Simics as a Tool for Embedded Research - Embedded Community ...
Simics as a Tool for Embedded Research - Embedded Community ...
Simics as a Tool for Embedded Research - Embedded Community ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Simics</strong> <strong>as</strong> a <strong>Tool</strong> <strong>for</strong> <strong>Embedded</strong><br />
<strong>Research</strong><br />
Andre<strong>as</strong> Moestedt<br />
andre<strong>as</strong>.moestedt@intel.com<br />
Software & Services Group
2<br />
BACKGROUND<br />
Software & Services Group
3<br />
What is <strong>Simics</strong>?<br />
<strong>Simics</strong> is a high-per<strong>for</strong>mance, full system simulator used by<br />
software developers to simulate large and complex<br />
electronic systems.<br />
Any target<br />
system<br />
Any target<br />
system<br />
• Simulate any size of<br />
target system<br />
• Run unmodified<br />
binaries<br />
• Other use c<strong>as</strong>es <strong>as</strong><br />
add-ons<br />
<strong>Simics</strong> allows you to break the rules of embedded systems development<br />
Software & Services Group
4<br />
<strong>Simics</strong> History<br />
<strong>Research</strong> project at SICS started in 1991<br />
Virtutech w<strong>as</strong> founded in Sweden in<br />
1998 and incorporated in USA in 2003.<br />
Acquired by Intel in 2010<br />
Marketed and sold through Wind River<br />
(subsidiary)<br />
Software & Services Group
5<br />
• BAE Systems<br />
• Boeing<br />
• GE Aviation<br />
• Honeywell<br />
• General Dynamics<br />
• Iridium<br />
• L3 Communications<br />
• Lockheed Martin<br />
• NASA<br />
• Northrop Grumman<br />
• Raytheon<br />
Aerospace and<br />
Defense<br />
Some Example <strong>Simics</strong> Users<br />
• AMCC<br />
• Freescale<br />
• Hitachi<br />
• IBM<br />
• Intel<br />
• Rockwell<br />
• Xerox<br />
Semiconductor<br />
and Systems<br />
• Alcatel-Lucent<br />
• Cisco<br />
• Ericsson<br />
• Huawei<br />
• Motorola<br />
• Nortel<br />
Network and<br />
Communications<br />
Software & Services Group
6<br />
WHY USE A SIMULATOR?<br />
Software & Services Group
7<br />
Common Feedback from Users<br />
Repeatability Scripting<br />
Reverse execution<br />
Great tool <strong>for</strong><br />
embedded<br />
development<br />
Non-intrusive<br />
Inspection and<br />
debugging<br />
Software & Services Group
8<br />
Hardware<br />
• Actual behavior<br />
• Speed<br />
Compare to Hardware<br />
Simulator<br />
• Non-intrusive debugging<br />
• Save and restore state<br />
• Repeatability<br />
• Reverse execution<br />
• Scripting<br />
• Hardware replication<br />
• Speed!?<br />
• More features discussed later…<br />
Software & Services Group
9<br />
Speed? Really?<br />
• <strong>Embedded</strong> processors slower than server ones<br />
• Almost host speed <strong>for</strong> x86 on x86 (VMP)<br />
• Complex systems often boot slowly<br />
– Waiting <strong>for</strong> slow hardware, mandatory timeouts<br />
– Clearing memory<br />
– Hardware self-tests<br />
– Lots of idle time in parallel systems<br />
• <strong>Simics</strong> can f<strong>as</strong>t <strong>for</strong>ward when system is waiting!<br />
• Loading SW on real system:<br />
– Program fl<strong>as</strong>h memory, load over network or USB<br />
• Loading SW on <strong>Simics</strong>:<br />
– Load binary directly into target memory in no time<br />
• Checkpointing<br />
– No need to reboot every time<br />
Software & Services Group
10<br />
Processor and<br />
Memory<br />
Incre<strong>as</strong>ing Value of <strong>Simics</strong><br />
SoC Devices<br />
Complete<br />
Boards<br />
Complete<br />
Systems<br />
Networks of<br />
Systems<br />
Software & Services Group
11<br />
Multiple processors<br />
Complexity Moves, <strong>Simics</strong> Stays<br />
Many and/or complex devices<br />
Different kinds of interconnects<br />
Networked systems<br />
Full system development<br />
<strong>Simics</strong> use<br />
1998<br />
Servers<br />
Telecom<br />
Server in 1998 - Mobile device today!<br />
<strong>Embedded</strong><br />
2010<br />
Mobile<br />
Software & Services Group
12<br />
SIMICS FEATURES<br />
Software & Services Group
13<br />
Some <strong>Simics</strong> Features and Capabilities<br />
• High per<strong>for</strong>mance<br />
• Synchronized System Stop<br />
• Save/restore of simulated state<br />
• Repeatability<br />
• Dynamic reconfiguration<br />
• Large systems, hundreds of processors<br />
• Runs all software unmodified<br />
– Windows, Linux, VxWorks, Hypervisor, etc<br />
• Heterogenous systems<br />
• Run simulation in reverse<br />
• C/C++ debugging<br />
• Code coverage<br />
• Trace generation<br />
• Non-intrusive inspection<br />
• Real-world connections<br />
• Hardware-in-the-loop<br />
• Record/replay of user input<br />
• Connections to hardware emulators<br />
• Gear shift to cycle accurate models<br />
• Host virtualisation <strong>for</strong> native IA per<strong>for</strong>mance<br />
• Binary translation <strong>for</strong> cross target simulation<br />
• Synchronize virtual time with external tools<br />
• Modeling language <strong>for</strong> f<strong>as</strong>t development<br />
• Models in any language<br />
– DML, C/C++, SystemC, Python<br />
• Large collection of model interfaces<br />
• User developed simulator features<br />
• Integrates with external tools<br />
• Scripting <strong>for</strong> automated sessions<br />
• Operating System awareness<br />
• Process tracking<br />
• Instruction and data profiling<br />
• Supported, stable, well-documented API<br />
• Cache modeling<br />
• Advanced memory breakpoints<br />
• Distributed simulation<br />
• DHCP, DNS, FTP, TFTP services<br />
• Connections to remote debuggers<br />
– E.g. GDB<br />
• IP-XACT import/export<br />
• Import of SystemC models<br />
• Build kit <strong>for</strong> system panels<br />
• Huge model library<br />
Software & Services Group
14<br />
Highlight of a Few Features<br />
• High per<strong>for</strong>mance<br />
• Synchronized System Stop<br />
• Save/restore of simulated state<br />
• Repeatability<br />
• Dynamic reconfiguration<br />
• Large systems, hundreds of processors<br />
• Runs all software unmodified<br />
– Windows, Linux, VxWorks, Hypervisor, etc<br />
• Heterogenous systems<br />
• Run simulation in reverse<br />
• C/C++ debugging<br />
• Code coverage<br />
• Trace generation<br />
• Non-intrusive inspection<br />
• Real-world connections<br />
• Hardware-in-the-loop<br />
• Record/replay of user input<br />
• Connections to hardware emulators<br />
• Gear shift to cycle accurate models<br />
• Host virtualisation <strong>for</strong> native IA per<strong>for</strong>mance<br />
• Binary translation <strong>for</strong> cross target simulation<br />
• Synchronize virtual time with external tools<br />
• Modeling language <strong>for</strong> f<strong>as</strong>t development<br />
• Models in any language<br />
– DML, C/C++, SystemC, Python<br />
• Large collection of model interfaces<br />
• User developed simulator features<br />
• Integrates with external tools<br />
• Scripting <strong>for</strong> automated sessions<br />
• Operating System awareness<br />
• Process tracking<br />
• Instruction and data profiling<br />
• Supported, stable, well-documented API<br />
• Cache modeling<br />
• Advanced memory breakpoints<br />
• Distributed simulation<br />
• DHCP, DNS, FTP, TFTP services<br />
• Connections to remote debuggers<br />
– E.g. GDB<br />
• IP-XACT import/export<br />
• Import of SystemC models<br />
• Build kit <strong>for</strong> system panels<br />
• Huge model library<br />
Software & Services Group
15<br />
Identical<br />
plat<strong>for</strong>ms<br />
Connection<br />
to the World<br />
Synchronized System Stop<br />
Network hubs<br />
& switches<br />
Mixed<br />
Architectures<br />
Interfaces:<br />
Backplane<br />
RapidIO<br />
PCI-express<br />
shared memory<br />
Dedicated<br />
Subsystems<br />
Ch<strong>as</strong>sis and Racks<br />
Multicore Boards<br />
Software & Services Group
Without <strong>Simics</strong>: A Single Component may stop …<br />
16<br />
Identical<br />
plat<strong>for</strong>ms<br />
Connection<br />
to the World<br />
Network hubs<br />
& switches<br />
Mixed<br />
Architectures<br />
Interfaces:<br />
Backplane<br />
RapidIO<br />
PCI-express<br />
shared memory<br />
Ch<strong>as</strong>sis and Racks<br />
Multicore Boards<br />
Dedicated<br />
Subsystems … but the rest of the system<br />
continues to run<br />
Software & Services Group
17<br />
Identical<br />
plat<strong>for</strong>ms<br />
… or a Single Component Stops …<br />
Connection<br />
to the World<br />
Network hubs<br />
& switches<br />
Mixed<br />
Architectures<br />
Interfaces:<br />
Backplane<br />
RapidIO<br />
PCI-express<br />
shared memory<br />
Ch<strong>as</strong>sis and Racks<br />
Multicore Boards<br />
Dedicated<br />
Subsystems … and the whole system cr<strong>as</strong>hes.<br />
But where is the bug?<br />
Software & Services Group
18<br />
Identical<br />
plat<strong>for</strong>ms<br />
<strong>Simics</strong>: Synchronized System Stop<br />
Connection<br />
to the World<br />
Network hubs<br />
& switches<br />
Mixed<br />
Architectures<br />
Interfaces:<br />
Backplane<br />
RapidIO<br />
PCI-express<br />
shared memory<br />
Ch<strong>as</strong>sis and Racks<br />
Multicore Boards<br />
Dedicated<br />
Subsystems … the whole system freezes in<br />
an operational state<br />
Software & Services Group
19<br />
Identical<br />
plat<strong>for</strong>ms<br />
Connection<br />
to the World<br />
Taking a Check Point<br />
Network hubs<br />
& switches<br />
Mixed<br />
Architectures<br />
Interfaces:<br />
Backplane<br />
RapidIO<br />
PCI-express<br />
shared memory<br />
Dedicated<br />
Subsystems<br />
Ch<strong>as</strong>sis and Racks<br />
Multicore Boards<br />
Software & Services Group
20<br />
Identical<br />
plat<strong>for</strong>ms<br />
Resume From Same State Later<br />
Connection<br />
to the World<br />
Network hubs<br />
& switches<br />
Mixed<br />
Architectures<br />
Interfaces:<br />
Backplane<br />
RapidIO<br />
PCI-express<br />
shared memory<br />
Dedicated<br />
Subsystems<br />
Ch<strong>as</strong>sis and Racks<br />
Multicore Boards<br />
Software & Services Group
21<br />
Systems Take Time to Boot<br />
• Windows 7 boots in about 1 minute on <strong>Simics</strong><br />
• Windows 7 is restored from a checkpoint in<br />
about 1 second<br />
• Some of our customers’ systems takes almost<br />
30 minutes to boot (on real hardware).<br />
• Add to this, loading application, running to<br />
interesting points etc…<br />
Software & Services Group
22<br />
Repeatability<br />
Traditional Hardware<br />
Run 1<br />
• Physical systems are not wholly predictable or controllable<br />
• The system will usually follow a slightly different path from<br />
start to finish<br />
• Some runs will hit bugs, others will not.<br />
Software & Services Group
23<br />
Repeatability<br />
Traditional Hardware<br />
Run 2<br />
• Physical systems are not wholly predictable or controllable<br />
• The system will usually follow a slightly different path from<br />
start to finish<br />
• Some runs will hit bugs, others will not.<br />
Software & Services Group
24<br />
Repeatability<br />
Traditional Hardware<br />
Run 3<br />
• Physical systems are not wholly predictable or controllable<br />
• The system will usually follow a slightly different path from<br />
start to finish<br />
• Some runs will hit bugs, others will not.<br />
Software & Services Group
25<br />
Repeatability<br />
Virtual Plat<strong>for</strong>m<br />
Run 1<br />
• <strong>Simics</strong> virtual plat<strong>for</strong>ms are predictable and controllable<br />
• The system will follow exactly the same path from start to finish<br />
• Every developer will precisely duplicate every execution step<br />
Software & Services Group
26<br />
Repeatability<br />
Virtual Plat<strong>for</strong>m<br />
Run 2<br />
• <strong>Simics</strong> virtual plat<strong>for</strong>ms are predictable and controllable<br />
• The system will follow exactly the same path from start to finish<br />
• Every developer will precisely duplicate every execution step<br />
Software & Services Group
27<br />
Repeatability<br />
Virtual Plat<strong>for</strong>m<br />
Run 3<br />
• <strong>Simics</strong> virtual plat<strong>for</strong>ms are predictable and controllable<br />
• The system will follow exactly the same path from start to finish<br />
• Every developer will precisely duplicate every execution step<br />
Software & Services Group
28<br />
Repeatability<br />
Virtual Plat<strong>for</strong>m<br />
Run 4 (new stimuli)<br />
• New stimuli can be injected to ensure different<br />
paths<br />
• Random paths can be generated<br />
Software & Services Group
29<br />
Non-Intrusive Inspection<br />
• Processor and device registers<br />
• Internal hardware state<br />
• Software on the target<br />
Catch state changes in scripts <strong>for</strong>:<br />
• Statistics collection<br />
• Trace generation<br />
• Testing<br />
• Fault injection<br />
• Stubbing out hardware not present in simulator<br />
• Communication between host and target<br />
Software & Services Group
30<br />
OS Awareness & Non-Intrusive Inspection<br />
Software & Services Group
31<br />
SIMICS USE CASES<br />
Software & Services Group
32<br />
Develop SW Be<strong>for</strong>e HW is Ready<br />
• Most typical <strong>Simics</strong> use<br />
– Lots of success stories<br />
– But far from the only use c<strong>as</strong>e<br />
• SW team can work in parallel with HW team<br />
• System bring up in days instead of months<br />
Customer: “Software bring<br />
up on real hardware w<strong>as</strong><br />
ready three months earlier<br />
than in previous projects”<br />
Software & Services Group
33<br />
Always Have Working Software<br />
• Start with a <strong>Simics</strong> model of the old system<br />
• Replace one part at a time<br />
• Adapt OS and drivers to each replaced part<br />
• Gradually trans<strong>for</strong>m model into new system<br />
• Requires good coordination between teams!<br />
Software & Services Group
34<br />
E<strong>as</strong>ily Reconfigurable Hardware<br />
• E<strong>as</strong>y to reconfigure and replicate hardware<br />
– Vary the number of disks, processors, etc<br />
– PCI boards in different slots<br />
– Network topology<br />
– Memory configurations (min, max)<br />
• Test software with all hardware configurations<br />
– Run in parallel on server farms<br />
– Everything scriptable<br />
• Save time it takes to configure real hardware<br />
Software & Services Group
35<br />
E<strong>as</strong>ily Reconfigurable Hardware<br />
• Test large expensive configurations<br />
• Keep configurations <strong>for</strong> regression testing<br />
Customer: cluster of 200+<br />
networked storage<br />
systems, more than the<br />
test group had access to<br />
Software & Services Group
36<br />
Develop SW <strong>for</strong> Fault Tolerance<br />
• Inject errors in the model<br />
– Lost network connections<br />
– Corrupt packets<br />
– Disks that stop responding<br />
– Memory errors<br />
• Simple to script and control in <strong>Simics</strong><br />
• Can be very difficult to test on real hardware<br />
– E<strong>as</strong>y to track down issues once triggered in <strong>Simics</strong><br />
Software & Services Group
37<br />
Post Silicon OS Development<br />
• Example: Multi-pro support added to RTOS<br />
– Scripts in <strong>Simics</strong> that verify proper locking without<br />
changing the target software<br />
• Driver development<br />
– <strong>Simics</strong> devices tell developers what is happening<br />
– Real devices are silent<br />
• Port of OSes to new hardware<br />
Customer: “All<br />
development now on<br />
<strong>Simics</strong>. Real hardware only<br />
used <strong>for</strong> rele<strong>as</strong>e testing.”<br />
Software & Services Group
38<br />
Catch Hard-to-Find Bugs<br />
• Use simulator unique features to find bugs<br />
– Non-intrusive insight in complete system<br />
– Repeatability<br />
– Unmodified software<br />
– Reverse execution<br />
• Combine with standard debug features<br />
– Source level debugging<br />
– OS awareness<br />
Software & Services Group
39<br />
Verify Correct Programming of HW<br />
• Model can warn when software misbehaves<br />
• Drivers ported to new revisions of hardware<br />
– But still accesses removed or changed registers<br />
• “Undefined” may be defined in next revision<br />
• Example: Overlapping MMU mappings<br />
Software & Services Group
40<br />
Hybrid Simulation<br />
• Integrate a detailed model with <strong>Simics</strong><br />
– Timing<br />
– Power & thermal<br />
• Run real workload on f<strong>as</strong>t <strong>Simics</strong> model<br />
• Switch to detailed <strong>for</strong> interesting part<br />
– Only replace units of interest<br />
• Requires model specific work<br />
Software & Services Group
41<br />
Controlled Environment<br />
• Examine viruses, Trojans, cyber attack software<br />
• Run unmodified software<br />
• Full inspection capabilities<br />
• Sandboxed multi-machine environment<br />
Software & Services Group
42<br />
SIMICS IN ACADEMIA<br />
Software & Services Group
43<br />
Background<br />
• Computer architecture research<br />
– Cache and memory hierarchies in MP systems<br />
• Add-ons<br />
– UW-Madison Multifacet GEMS<br />
• OOO processor models, memory hierarchies<br />
– CMU SimFlex<br />
• Timing-accurate processor, memory and interconnect<br />
– UIUC FeS2<br />
• Timing-first multiprocessor x86 simulator<br />
Software & Services Group
44<br />
Academic Use<br />
• http://blogs.windriver.com/engblom/<br />
– Blog posts about <strong>Simics</strong><br />
– In<strong>for</strong>mation on Wind River academic program<br />
– Interviews with <strong>Simics</strong> users<br />
• Projects by interviewed researchers<br />
– Improved HW support <strong>for</strong> virtualization<br />
– Multicore partitioning <strong>for</strong> avionic systems<br />
– Fault injection in reliable embedded systems<br />
Software & Services Group
45<br />
Current Availability<br />
• Always been available at low or no cost<br />
• Wind River academic program<br />
– <strong>Simics</strong> 4.2, soon <strong>Simics</strong> 4.4<br />
– ARM, PPC, SPARC V8, SPARC V9, X86<br />
• Intel 440BX with several different processors<br />
– 486sx, Pentium II, Pentium 4, one x86-64 CPU<br />
Software & Services Group
46<br />
<strong>Simics</strong> from Intel<br />
• Will soon launch an academic <strong>Simics</strong> program<br />
• <strong>Simics</strong> 4.6, the most recent version<br />
• Intel b<strong>as</strong>ed models<br />
– Intel X58/ICH10 system<br />
• Core i7<br />
– Intel Tunnel Creek<br />
• Atom E600 SoC<br />
• ETA Late spring 2012<br />
– More models to come<br />
Software & Services Group
47<br />
Software & Services Group
Change language