Simics as a Tool for Embedded Research

Intel SSG/SSD/PTAC

Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR DEATH MAY OCCUR.

Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked "reserved" or "undefined." Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The information here is subject to change without notice. Do not finalize a design with this information.

The products described in this document may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order.

Copies of documents which have an order number and are referenced in this document, or other Intel literature, may be obtained by calling 1-800-548-4725, or go to: http://www.intel.com/design/literature.htm

This document contains information on products in the design phase of development.

All products, computer systems, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel, Intel Atom, Intel Core, and the Intel logo are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

* Other names and brands may be claimed as the property of others.

Copyright © 2011, Intel Corporation. All rights reserved.

What is Simics?

Simics is a high-performance, full system simulator used by software developers to simulate large and complex electronic systems.

Simics allows you to break the rules of embedded systems development

Any target system

Any target system

• Simulate any size of target system

• Run unmodified binaries

• Other use cases as add-ons

Simics History

Research project at SICS started in 1991

Virtutech was founded in Sweden in 1998 and incorporated in USA in 2003.

Acquired by Intel in 2010

Marketed and sold through Wind River (subsidiary)

Some Example Simics Users

• BAE Systems

• Boeing

• GE Aviation

• Honeywell

• General Dynamics

• Iridium

• L3 Communications

• Lockheed Martin

• NASA

• Northrop Grumman

• Raytheon

Aerospace and Defense

• AMCC

• Freescale

• Hitachi

• IBM

• Intel

• Rockwell

• Xerox

Semiconductor and Systems

• Alcatel-Lucent

• Cisco

• Ericsson

• Huawei

• Motorola

Network and Communications

WHY USE A SIMULATOR?

Common Feedback from Users

Repeatability Scripting

Reverse execution Non-intrusive

Inspection and debugging

Great tool for embedded

development

Compare to Hardware

Hardware

• Actual behavior

• Speed

Simulator

• Non-intrusive debugging

• Save and restore state

• Repeatability

• Reverse execution

• Scripting

• Hardware replication

• Speed!?

• More features discussed later…

Speed? Really?

• Embedded processors slower than server ones • Almost host speed for x86 on x86 (VMP) • Complex systems often boot slowly

– Waiting for slow hardware, mandatory timeouts – Clearing memory – Hardware self-tests – Lots of idle time in parallel systems

• Simics can fast forward when system is waiting! • Loading SW on real system:

– Program flash memory, load over network or USB

• Loading SW on Simics: – Load binary directly into target memory in no time

• Checkpointing – No need to reboot every time

Increasing Value of Simics

Processor and Memory SoC Devices

Complete Boards

Complete Systems

Networks of Systems

Complexity Moves, Simics Stays

Telecom

Servers

Embedded

Simics use

1998 2010

Multiple processors

Many and/or complex devices

Different kinds of interconnects

Networked systems

Full system development

Server in 1998 - Mobile device today!

Mobile

SIMICS FEATURES

Some Simics Features and Capabilities

• High performance • Synchronized System Stop • Save/restore of simulated state • Repeatability • Dynamic reconfiguration • Large systems, hundreds of processors • Runs all software unmodified

– Windows, Linux, VxWorks, Hypervisor, etc

• Heterogenous systems • Run simulation in reverse • C/C++ debugging • Code coverage • Trace generation • Non-intrusive inspection • Real-world connections • Hardware-in-the-loop • Record/replay of user input • Connections to hardware emulators • Gear shift to cycle accurate models • Host virtualisation for native IA performance • Binary translation for cross target simulation • Synchronize virtual time with external tools

• Modeling language for fast development • Models in any language

– DML, C/C++, SystemC, Python

• Large collection of model interfaces • User developed simulator features • Integrates with external tools • Scripting for automated sessions • Operating System awareness • Process tracking • Instruction and data profiling • Supported, stable, well-documented API • Cache modeling • Advanced memory breakpoints • Distributed simulation • DHCP, DNS, FTP, TFTP services • Connections to remote debuggers

– E.g. GDB

• IP-XACT import/export • Import of SystemC models • Build kit for system panels • Huge model library

Highlight of a Few Features

• High performance • Synchronized System Stop • Save/restore of simulated state • Repeatability • Dynamic reconfiguration • Large systems, hundreds of processors • Runs all software unmodified

– Windows, Linux, VxWorks, Hypervisor, etc

• Heterogenous systems • Run simulation in reverse • C/C++ debugging • Code coverage • Trace generation • Non-intrusive inspection • Real-world connections • Hardware-in-the-loop • Record/replay of user input • Connections to hardware emulators • Gear shift to cycle accurate models • Host virtualisation for native IA performance • Binary translation for cross target simulation • Synchronize virtual time with external tools

• Modeling language for fast development • Models in any language

– DML, C/C++, SystemC, Python

• Large collection of model interfaces • User developed simulator features • Integrates with external tools • Scripting for automated sessions • Operating System awareness • Process tracking • Instruction and data profiling • Supported, stable, well-documented API • Cache modeling • Advanced memory breakpoints • Distributed simulation • DHCP, DNS, FTP, TFTP services • Connections to remote debuggers

– E.g. GDB

• IP-XACT import/export • Import of SystemC models • Build kit for system panels • Huge model library

Synchronized System Stop

Identical platforms

Connection to the World

Interfaces:

Backplane

RapidIO

PCI-express

shared memory

Chassis and Racks

Multicore Boards

Network hubs & switches

Mixed Architectures

Dedicated Subsystems

Without Simics: A Single Component may stop …

Identical platforms

Connection to the World

Interfaces:

Backplane

RapidIO

PCI-express

shared memory

Chassis and Racks

Multicore Boards

Network hubs & switches

Mixed Architectures

Dedicated Subsystems … but the rest of the system

continues to run

… or a Single Component Stops …

Identical platforms

Connection to the World

Interfaces:

Backplane

RapidIO

PCI-express

shared memory

Chassis and Racks

Multicore Boards

Network hubs & switches

Mixed Architectures

Dedicated Subsystems … and the whole system crashes.

But where is the bug?

Simics: Synchronized System Stop

Identical platforms

Connection to the World

Interfaces:

Backplane

RapidIO

PCI-express

shared memory

Chassis and Racks

Multicore Boards

Network hubs & switches

Mixed Architectures

Dedicated Subsystems … the whole system freezes in

an operational state

Taking a Check Point

Identical platforms

Connection to the World

Interfaces:

Backplane

RapidIO

PCI-express

shared memory

Chassis and Racks

Multicore Boards

Network hubs & switches

Mixed Architectures

Dedicated Subsystems

Resume From Same State Later

Identical platforms

Connection to the World

Interfaces:

Backplane

RapidIO

PCI-express

shared memory

Chassis and Racks

Multicore Boards

Network hubs & switches

Mixed Architectures

Dedicated Subsystems

Systems Take Time to Boot

• Windows 7 boots in about 1 minute on Simics

• Windows 7 is restored from a checkpoint in about 1 second

• Some of our customers’ systems takes almost 30 minutes to boot (on real hardware).

• Add to this, loading application, running to interesting points etc…

• Physical systems are not wholly predictable or controllable • The system will usually follow a slightly different path from

start to finish • Some runs will hit bugs, others will not.

Repeatability Traditional Hardware

Run 1

• Physical systems are not wholly predictable or controllable • The system will usually follow a slightly different path from

start to finish • Some runs will hit bugs, others will not.

Repeatability Traditional Hardware

Run 2

Repeatability Traditional Hardware

Run 3

• Physical systems are not wholly predictable or controllable • The system will usually follow a slightly different path from

start to finish • Some runs will hit bugs, others will not.

Repeatability Virtual Platform

• Simics virtual platforms are predictable and controllable

• The system will follow exactly the same path from start to finish

• Every developer will precisely duplicate every execution step

Run 1

Repeatability Virtual Platform

• Simics virtual platforms are predictable and controllable

• The system will follow exactly the same path from start to finish

• Every developer will precisely duplicate every execution step

Run 2

Repeatability Virtual Platform

• Simics virtual platforms are predictable and controllable

• The system will follow exactly the same path from start to finish

• Every developer will precisely duplicate every execution step

Run 3

Repeatability Virtual Platform

• New stimuli can be injected to ensure different paths

• Random paths can be generated

Run 4 (new stimuli)

Non-Intrusive Inspection • Processor and device registers

• Internal hardware state

• Software on the target

Catch state changes in scripts for:

• Statistics collection

• Trace generation

• Testing

• Fault injection

• Stubbing out hardware not present in simulator

• Communication between host and target

OS Awareness & Non-Intrusive Inspection

SIMICS USE CASES

Develop SW Before HW is Ready

• Most typical Simics use

– Lots of success stories

– But far from the only use case

• SW team can work in parallel with HW team

• System bring up in days instead of months

Customer: “Software bring up on real hardware was

ready three months earlier than in previous projects”

Always Have Working Software

• Start with a Simics model of the old system

• Replace one part at a time

• Adapt OS and drivers to each replaced part

• Gradually transform model into new system

• Requires good coordination between teams!

Easily Reconfigurable Hardware

• Easy to reconfigure and replicate hardware – Vary the number of disks, processors, etc

– PCI boards in different slots

– Network topology

– Memory configurations (min, max)

• Test software with all hardware configurations – Run in parallel on server farms

– Everything scriptable

• Save time it takes to configure real hardware

Easily Reconfigurable Hardware

• Test large expensive configurations

• Keep configurations for regression testing

Customer: cluster of 200+ networked storage

systems, more than the test group had access to

Develop SW for Fault Tolerance

• Inject errors in the model

– Lost network connections

– Corrupt packets

– Disks that stop responding

– Memory errors

• Simple to script and control in Simics

• Can be very difficult to test on real hardware

– Easy to track down issues once triggered in Simics

Post Silicon OS Development

• Example: Multi-pro support added to RTOS

– Scripts in Simics that verify proper locking without changing the target software

• Driver development

– Simics devices tell developers what is happening

– Real devices are silent

• Port of OSes to new hardware

Customer: “All development now on

Simics. Real hardware only used for release testing.”

Catch Hard-to-Find Bugs

• Use simulator unique features to find bugs

– Non-intrusive insight in complete system

– Repeatability

– Unmodified software

– Reverse execution

• Combine with standard debug features

– Source level debugging

– OS awareness

Verify Correct Programming of HW

• Model can warn when software misbehaves

• Drivers ported to new revisions of hardware

– But still accesses removed or changed registers

• “Undefined” may be defined in next revision

• Example: Overlapping MMU mappings

Hybrid Simulation

• Integrate a detailed model with Simics

– Timing

– Power & thermal

• Run real workload on fast Simics model

• Switch to detailed for interesting part

– Only replace units of interest

• Requires model specific work

Controlled Environment

• Examine viruses, Trojans, cyber attack software

• Run unmodified software

• Full inspection capabilities

• Sandboxed multi-machine environment

SIMICS IN ACADEMIA

Background

• Computer architecture research – Cache and memory hierarchies in MP systems

• Add-ons – UW-Madison Multifacet GEMS

• OOO processor models, memory hierarchies

– CMU SimFlex • Timing-accurate processor, memory and interconnect

– UIUC FeS2 • Timing-first multiprocessor x86 simulator

Academic Use

• http://blogs.windriver.com/engblom/

– Blog posts about Simics

– Information on Wind River academic program

– Interviews with Simics users

• Projects by interviewed researchers

– Improved HW support for virtualization

– Multicore partitioning for avionic systems

– Fault injection in reliable embedded systems

Current Availability

• Always been available at low or no cost

• Wind River academic program

– Simics 4.2, soon Simics 4.4

– ARM, PPC, SPARC V8, SPARC V9, X86

• Intel 440BX with several different processors

– 486sx, Pentium II, Pentium 4, one x86-64 CPU

Simics from Intel

• Will soon launch an academic Simics program

• Simics 4.6, the most recent version

• Intel based models – Intel X58/ICH10 system

• Core i7

– Intel Tunnel Creek • Atom E600 SoC

• ETA Late spring 2012

– More models to come