Jakob Engblom - Workshop Simics

8/9/2019 Jakob Engblom - Workshop Simics

1/100

Workshops

Hands-on With Virtutech SimicsJakob Engblom


2/100

Welcome


3/100

3

What will we do today?

• A hands-on look at Virtutech Simics

• Compile, download, and execute programs– For cross-targets running (embedded) Linux

– Single virtual development board

– Network of virtual machines

• Inspect and debug functionality

• Running code on a machine with no OS– Extend the model with a new hardware device

– Test a simple device driver


4/100

4

Network

Server

Simics is a Systems Simulator

IP Phone

PC

Phone

Internet


5/100

5

Simics

Simics/PhoneSimics/Phone

Simics

Sim Network

Simics

Simics/Server


Simics

IPSimics

Simics/IP Phone

Simics

Simics/PC

Simics/Phone


6/100

6

Simics

Simics/PhoneSimics/Phone

Simics

Sim Network

Simics

Simics/Server


Simics

IPSimics

Simics/IP Phone

Simics

Simics/PC

Simics/PhoneHardware model

RTOS

Applications

HW Model

RTOS

Apps

Behavioralsimulation of

function


7/100

7

Traditional Development Process

• Use hardware to test and debug software

– Expensive

– Unwieldy environment for debugging– Not available early enough

– Often, not every developer can have a test bed


8/100

8

Virtutech Simics• Virtualized Software Development

– Simulates the system under development and itsimmediate environment

– Runs entire software image unchanged– Model peripheral devices

• Benefits of software overhardware– Customizable

– Cheaper

– Programmer-friendly– Scriptable & controllable

– Available earlier


9/100

9Hardware

Virtualized Software Development

CPU

Operating system

User program

RAM

FLASH

MiddlewareDBServer

Complete

productionsoftware

LCD

ASICROM

PCI

I2C

Bus

CPU

Drivers Firmware

The software can’t

tell the difference

Network net

Identical build

tools chain

DiskSimulated

hardware

Runs binaries

from real target

Disk Ctrl


10/100

10

Complete Virtualization

Host hardwareHost hardware

Host operating systemHost operating system

SimicsSimics

Simulated target hardware

Target operating system

User program

PC (32- & 64-bit)or Sparc

PC (32- & 64-bit)

or Sparc

Linux, Solaris,Windows

Linux, Solaris,

Windows

Arbitrary; currently supports Alpha, ARM, IA64, 32/64 bit

x86, 32/64 bit Sparc,32/64 bit MIPS, 32/64 bitPowerPC, TI C6400, msp430

Arbitrary; currently supports Alpha, ARM, IA64, 32/64 bit

x86, 32/64 bit Sparc,32/64 bit MIPS, 32/64 bit

PowerPC, TI C6400, msp430

All software: arbitrary &

unmodified. Same as on a

real system.

All software: arbitrary &unmodified. Same as on a

real system.


11/100

Getting Started


12/100

12

Getting Started: VmWare Player

• Start VmWare player

• Select the ”simics-on-linux.vmx” file


13/100

13

Getting Started: Boot

• When the virtual computer starts

• It will boot into grub• Press ”return” to boot the Linux we need


14/100

14

Getting Started: Login

• At login prompt:

– User “user”– Password “user”

• Or wait to be

automaticallylogged-in as “user”


15/100

15

Getting Started: Terminal

• When the Linux has

booted, you will be atthe desktop with nowindows open

• Click the “terminal” toget a text console


16/100

16

Getting Started: More Terminals

• I find it convenient with two terminals

– Or even better, two tabs in the terminal


17/100

17

Getting Started: Simics Docs

• Simics has HTML, PDF,

and online help• To access HTML & PDF,

open the ”Simics

documentation” folderon the desktop

• User guide is linkeddirectly as well


18/100


19/100

19

Starting Simics

• On Linux, Simics is a command-line app

• Simics exposes a sophisticated command-line interface

– And graphical or text windows for the displaysand serial ports of the target systems

• Simics uses a workspace directory:

– /home/user/simics-workspace in this case


20/100

20

Starting Simics

• Linux command-line

– Will be prefixed “host$” in the following slides– What you type is going to be bold

• So we do the following:host$ cd simics-workspacehost$ ./simics target/ebony/ebony-linux-firststeps.simics


21/100

21

Starting SimicsLinux commandsto start Simics

Simics prompt,

also called the

Simics console

Target console,

output from

target machineappears here


22/100

22

Starting Simics: target & host

Host hardwareHost: PC

Host operating systemHost OS: Linux

SimicsSimics

PowerPC 440

SimicsSimics

consoleconsole

Linux

ProgramsComplete and un-modified

TargetTarget

consoleconsole


23/100

23

Simics Workspaces

• Based on the eclipse concept

• Provides a base location for:– checkpoints– machine configuration files– locally built simics modules– scripts

• Keeps user data

• Simics installation separate from workspace– (here: /opt/virtutech/simics-3.0.22/)• Multiple workspaces & Simics installations

can coexist on a system


24/100


25/100

25

Boot the Target

• Simics command-line

– Prefixed “simics>” in the following• To run 2 billion cycles for the boot:

simics> c 2_000_000_000• To stop simulation at any point: ctrl-C

• To run simulation until stopped:simics> c


26/100

26

Inspect Target State from Simics

• Some Simics

commands:simics> ptimesimics> pregs

simics> pregs –allsimics> da count=10

simics> x %r1

simics> helpsimics> si


27/100

27

Inspect Target State from Simics

• Simics logs all device accesses

– simics> uart0.log• Devices present their state

– simics> uart0.status– simics> emac0.status

– simics> emac0.info


28/100

28

Test the Target Machine

• Commands on the target machine CLI:

– Prefixed “$” in the following• Make Simics run, then use target console:

simics> c$ pwd

$ uname –a

$ cat /proc/cpuinfo

$ ifconfig


29/100

Compile & Load

a User Program


30/100

30

Create and Load a User Program

• Stop Simics in the meanwhile

• Use the second terminal/tab to compile


31/100


32/100

32


33/100

33

Compile the Program

• We have a script prepared to compile for

the target, using a PPC cross-compiler• Use in the second terminal/tab

• The script (does NOT want .c for filename):host$ compile-for-linux

• Use here:host$ cd simics-workspace/

host$ compile-for-linux targets/ebony/helloworld-440


34/100

34

Load the Program on the Target

• Use simicsfs

– A special file system on the target machine– Mounts the host machine file system

– Requires simicsfs driver in target linux

• Start Simics again– Otherwise, we cannot type commands in the

target console

– Note that unlike VmWare (Player), Simics canstop and hold execution of the target machine


35/100

35

Load the Program on the Target

• Start Simics simulation again

simics> c• Mount the host & copy the program

$ mount /host$ ls /host

– Navigate to /home/user/simics-

workspace/targets/ebony within simicsfs$ cp helloworld-440 .


36/100

36

Run the Program on the Target

• Check that the program has been copied

$ ls• And then run it

$ ./helloworld-440


37/100

37

Scripting the Target

• You can put breakpoints on console output

from the target, and send text to the targetsimics> (ctrl-C) to stop simulation

simics> con0.input “helloworld-440\n“

simics> con0.break “# “

simics> c

• When simulation stops, try some otherinput


38/100

Network Simulation

S


39/100

39

Target System

SimicsSimics

Argo Navis MPC8641D

Linux 2.6

Application

Ebony PPC 440 GP

Linux 2.4

Application

Simulated

machines send

packets onto the

simulated network

Simics

Ethernet Link

Simulation

Regular Linux

networking API for

the applications

Linux talks to the

network device,

like on a real

machine Dual-core e600

machine from

Freescale

S i h N k T


40/100

40

Starting the Network Target

• Use the provided target script

host$ ./simics targets/network/network.simics• Use text editor to look at the script

– Note how machine scripts are called withparameters

– If you want, try changing some parameters

T S C l


41/100

41

Target System Consoles

SimicsSimics

Argo Navis MPC8641D

Linux 2.6

Application

Ebony PPC 440 GP

Linux 2.4

Application

SimicsEthernet Link

SimulationConsole on Ebony

Console on

ArgoNavis

Simics console, for

the entire system

B t th N t k T t


42/100

42

Boot the Network Target

• Tell Simics to run 2 billion instructions on

the ebony cardsimics> current-processor

simics> c 2_000_000_000

• After the boot, check the time

simics> ptime –all

– Note that processors have different time

– The 8641D processors are higher clocked

T k Ch k i t


43/100

43

Take a Checkpoint

• This boot took some time

• Save the outcome as a checkpoint for laterreference and instant “reboot”

simics> write-configuration netbooted.ckpt

• Check the result in second terminal:

– Should be in /home/user/simics-workspace

host$ ls

T th N t k


44/100

44

Try the Network

• Both targets have “ping” installed

– Ebony is 10.10.0.50– ArgoNavis is 10.10.0.40

– Also try:

$ ifconfig

$ cat /proc/cpuinfo

C t t th O t id W ld


45/100

45

Connect to the Outside World

• Tell Simics to create a bridge to the host

simics> connect-real-network 10.10.0.50simics> c

– Simics network hides behind a simple NATrouter inside Simics

– With port-forwarding for incoming connections

– To connect to telnetd on ebony:• In the second terminal window on the host

host$ telnet localhost 4023



46/100

46


Simics

Argo Navis MPC8641D

Linux 2.6

Application

Ebony PPC 440 GP

Linux 2.4

Application

SimicsEthernet LinkSimulation

Host PC (VmWare)

Host Linux

10.10.0.40

SimicsNATrouter

10.10.0.1

10.10.0.50

Telnet

Quit Simics


47/100

47

Quit Simics

• simics> exit


48/100

Compiling a Network Program

Network Test Programs


49/100

49

Network Test Programs

• targets/network/sender.c

– Simple program sending a single string– Arguments: dest IP, dest port, string

• targets/network/receiverserver.c

– Simple daemon program

– Waits for connections from sender, prints the

received string on the console– Argument: port to listen on


50/100

Load Programs on the Targets


51/100

51


• Start Simics from the checkpoint we took host$ ./simics –c netbooted.ckpt

simics> ptime -all

• Use simicsfs again

– Simicsfs configured to point to targets/network simics> ebony_hfs0.root

simics> argo_hfs.root• Start simulationsimics> c



52/100

52


• Ebony requires /host to be mountedebony$ mount /hostebony$ cp /host/sender .ebony$ ./senderebony$ umount /host

• Argo already has it mounted

argo$ cp /host/receiverserver .argo$ ./receiverserverargo$ ls -largo$ umount /host

• Save the simulation statesimics> ctrl-Csimics> write-configuration netswloaded.ckpt

Binary is big since argo (and

ebony) do not have many

shared files installed. Instead,

the programs are statically

linked.

Unmount /host to

maintain determinism inthe simulation. Typical

way things are done with

simicsfs.

Try Programs


53/100

53

Try Programs

• Argo navis: start receiver:

argo$ ./receiverserver 4000 &argo$ ps

• Ebony: send a message:

ebony$ ./sender 10.10.0.40 4000 “hi there”


54/100

Source-Level Inspect & Debug

Quit and Restart Simics


55/100

55

Quit and Restart Simics

• Exit Simics

• Start using the netswloaded checkpointhost$ ./simics –c netswloaded.ckpt

simics> c

• Start the receiver program again, test it

– We took the checkpoint before it had started

Stop at Magic Breakpoint


56/100

56


• Sender program has a hook in it

– Magic breakpoint• NOP on target

• Simics catches it and treats it specially

• Runs with no side effect on physical hardware– Useful to find interesting points in SW loads

• To stop when magic executes:simics> magic-break-enable



57/100

57


• Rerun sender program, wait for stopebony$ ./sender 10.10.0.40 4000 “help!”

– ...”magic instruction (or r0,r0,r0)”

• When Simics has stopped, set up for debug

– simics> run-command-filetargets/network/sendersymbols.simics

– Loads the debug symbols for sender and sets up Simicsso that it uses the symbols to display the code

– Note that debug symbols are non-trivial in a systemenvironment like Simics: multiple machines, multipleprocessors, operating systems and programs running


58/100


59/100


60/100

Symbols for Receiver


61/100

61

Symbols for Receiver

• Activate symbol information for Argosimics> run-command-file target/network/receiversymbols.simics

– Also includes the kernel symbol information

• Set breakpoint on “recv” call in receiver

simics> break –x (sym “recv”)

• Send a message from ebony, wait for

breakpointsimics> current-processorsimics> where


62/100

Hardware Access Break


63/100

63

• Simics lets you break on hardware access

simics> break-io ebony_emac0– Then start sender program again, wait for break

simics> where

simics> list main 37


64/100

Running a Machine with no OS

A Machine with No OS


65/100

65

• Target: targets/ppc-simple– Only a PPC603e CPU, memory, and serial-port

• Look at the script ppc-simple-uart-driver.simics– load-binary used to put a program in memory

– set-pc to point PC to program start point– write-reg r1 to setup stack pointer

• Start it and inspect the system setuphost$ ./simics targets/ppc-simple/ppc-simple-uart-driver.simicssimics> list-objectssimics> phys_mem.map

Run the Program


66/100

66

g

• You can single-step or run free– Symbols for the program are loaded

– Right from the first instruction

– Very useful for operating system debug

simics> sisimics> ptime

simics> next

– ...

simics> reverse 4000 (when reached for(;;))


67/100

Device Modeling

Add a DMA Controller


68/100

68

• Simics provides the Device ModelingLanguage

to write new devices for targets– New devices are easy to add

– DML is a very efficient device modeling system

• We will add a simple DMA controller to ppc-simple and do a polled device driver for it

Building a new Device Model


69/100

69

• Device models located in the workspace:

– /home/user/simics-workspace/modules/host$ cd /home/user/simics-workspace

host$ ls modules/

• Modules built from workspace top-level

host$ make clean

host$ make

The Simics Equation


70/100

70

DML

Fast

CPU Models

Simulation

Infrastructure

User

Interface

Device Modeling

Language

Simics API

Event QueueDebug Features

Interface to 3rd Party Tools

High Speed ISSInstruction Set

Simulators

Simics Architecture


71/100

71SimicsSimics

Debugging

Profiling

Fault Injection

Tracing

Test Harnesses

Timing Models

Reverse Execution

Real Network

Simics Core

Processors Standard Devices Networks

Multiprocessor

MultipleMachines

ScalabilityDistribution

Virtual Memory

Checkpointing

Determinism

Visibility

Advanced

Breakpoints

Events

Proven API

Virtual Time

Configuration

32/64-bitHandling

EndiannessHandling

Custom Devices

Target Operating System

Programs

Simics Architecture


72/100

72SimicsSimics

Debugging

Profiling

Fault Injection

Tracing

Test Harnesses

Timing Models

Reverse Execution

Real Network

Simics Core

Processors Standard Devices Networks

Multiprocessor

MultipleMachines

ScalabilityDistribution

Virtual Memory

Checkpointing

Determinism

Visibility

Advanced

Breakpoints

Events

Proven API

Virtual Time

Configuration

32/64-bitHandling

EndiannessHandling

Custom Devices


ProgramsProvided by

Virtutech

Added by Virtutech,user, or third party

consultant

What is DML?


73/100

73

• A simple declarative language for modelingdevices

– A C-like syntax for model semantics– Declarative structures for interfaces

– Encourages compactness and readability

– Reduces the risk of errors

– Reduces the code length

• Designed for hardware device modeling inSimics

– Makes using the Simics API much simpler

– Generates bulky repetitive code for you

• Compiled using dmlc – as you have alreadyseen


74/100

Simple DMA Device in DML

So What is Modeled?


75/100

75

• To start DMA:– DMA_source


76/100

DML General Syntax


77/100

77

• Comments– Both C style /* … */ and C++ style //

• Statements– Terminate with a semi-colon

• Block and Scope– C style using { and }

• Literals– C style– Integers: 123 and 0b11110101 and 0x5ab3– Floating-point: 3.1415 and 6.6e-11

– Strings: "hello world"– Booleans: true or false

DML General Syntax


78/100

78

• Object names prefixed with $– $DMA_source

– $event• Sub-objects accessed using dot notation– $DMA_control.TS

– call $event.post(time,data)

• Many objects take description strings in declaration– register MSR “Master Status Register”;

• Methods called explicitly, or inlined

– call $method(...)– inline $method(...)

DML General Syntax


79/100

79

• Arrays and Subscripts– A mix of C and Python style using [ and ]

• Log command built into language– log “info”, 2 : “device model doing something”;

• Objects can be declared in any order– No need to declare objects before use– DMLC compiler resolves all dependencies and names

• Many objects have default methodsautomatically generated by the DMLcompiler– post in events

– read, write for registers

Driver Software


80/100

80

• The file targets/ppc-simple/dmadriver.c

• Compile using compile-for-no-os scripthost$ compile-for-no-os targets/ppc-simple/dmadriver– Does not rely on any part of libc

– Compiles for a static start address of code

– Loaded just like UART driver

– Polled driver for simplicity


81/100

Testing the DMA Device


82/100

82

• Look at the evolving device state

– Using Simics attributes

• Attributes export the complete state of a device

• Used for inspection, state change, and checkpoints

• Auto-generated for all registers in DML– Use OBJECT->ATTRIBUTE to get & set

simics> output-radix 16 2

simics> dma0->b_DMA_control

simics> dma0->b_DMA_status

Interfaces of a Device Model


83/100

83SimicsSimics

Simics

Core

Memory access

Processor

Device


Programs

CLI or PythonScript

Checkpointing

Device

Register

read()

get or set

attributes

write()

get()

set()

connect

implementsconnect

implements



84/100

84

• To let us follow the activity, stop on eachaccess to the DMA devicesimics> break-io dma0

• Start simulation with “continue” (c)

– It will stop at each access

– When stopped, look at attributes and the log

simics> dma0.log



85/100

85

• After access to DMA_source and DMA_dest,look at the source and dest of the DMAsimics> x (dma0->b_DMA_source)

simics> x (dma0->b_DMA_dest)



86/100

86

Simics prints the next

instruction (and sourceline) to execute

Memory contents ofdestination before

copying using DMA

The DMA driver programprints what it thinks is

going to be copied



87/100

87

• When simulation stops before the line:52 *dma_control = DMA_SWT | DMA_EN | count;

• Do ”next” to get to the next line

• Note the log about delay to completion

• Look at the Simics event queuesimics> peq



88/100

88

• Advance simulation until DMA completessimics> unbreak-io dma0

simics> c 49151

• Check state of things

simics> dma0->b_DMA_statussimics> x 0x22000

• Finish program worksimics> c 100_000


89/100

That’s It!

Summary


90/100

90

• Simics models runs the real software– Single & multiple boards and processors

– Models can be extended with new devices– Used as an alternative to physical hardware

• Simics is powerful debug system– Inspect both software and hardware

– Reverse debugging for arbitrary systems

– Global stop

– Breakpoints impossible on real hardware

• Simics can be scripted and automated

What Now?


91/100

91

• Feel free to play around with Simics usingthe tools we have seen today

• If you want to keep playing with Simics,copy the VmWare player image you used

– It is about 2GB in size, fits on a large USB stick – License is valid for about one more week

• If you want to discuss more, grab me during

the conference– I also have a talk about Simics on Thursday


92/100

Inside the DML File

DML File Structure


93/100

93

• dml 1.0;– Declare language version

– Multiple versions can be in use simultaneously

• device simple_dma;

– Declare the name of the class of the device– Multiple objects of the same class can be used

• parameter documentation = “...”;– Provide simple description of the device

– Accessible in Simics help system

DML File Structure


94/100

94

• import “....dml”;– Import files containing functionality to use

• constant time_per_byte=...;– Declare symbolic constants for use in the code

• connect target_mem_space ...– Connect to other parts of the simulated system– Here: the memory space (phys_mem)

– Needed so that the device can read & write memory

DML File Structure


95/100

95

• bank b { ... }– Declares a bank of one or more registers

– Registers can contain fields– Bank is memory-mapped in system configuration

• The device does not know where it is mapped

• A device can have many banks, each mapped separately– Registers specify offsets in the bank

– Provides settings for all registers in the bank

• Byte order – big-endian here, we attach to a PPC processor• Size (if uniform)

– The core of the DML device model

DML File Structure


96/100

96

• register DMA_control size 4 @ 0x00 “...” {– Declare a register of 4 bytes at offset zero

• field EN[31]– A single-bit field inside the register– We use little-endian bit order here, i.e the usual way with the least-

significant bit being bit zero– PowerPC-attached devices often use big-endian bit numbering

since that is IBM standard– By default, registers and fields store values written

• field TS[15:0]– 16-bit field

• method after_write() { ... }– Performs an action after all fields of the register has been written– Standard way to handle activity in a register split into fields


97/100

DML File Structure

h d d d f ()


98/100

98

• method do_dma_transfer()– The actual work of DMA_control.after_write()

• inline $complete_delay_ev.post(...)– ”post” function is automatically generated for event– Post an event to complete the DMA operation later

– Time computed from number of words to transfer• event complete_delay_ev {

– Declares the event used to delay completion of the

DMA operation• method event(data) {– Called when event triggers, i.e. DMA is to complete

DML File Structure


99/100

99

• method complete_dma () {

– Performs the actual movement of data

– In one chunk, after the time needed to transfer

• More efficient than modeling piecewise movement

• Typical for Simics transaction-oriented modeling– Called from the event posted by after_write()

– Reads and modifies values of registers andfields in the bank


100/100

100

Remember!Enter the evaluation form and be a part of making Øredev even better.

You will automatically be part of the evening lottery

Documents

Jakob Engblom - Workshop Simics