Wind River Blog Network

UEFI on Simics

By Jakob Engblom

This week, at the Intel Development Forum in San Francisco, we are announcing the upcoming availability of UEFI support in the Simics source code debugger. It is thus a good time to talk a bit more about UEFI and UEFI debug.

UEFI is the modern BIOS standard that is finally starting to replace classic BIOS in PCs and related machines. It provides for much more powerful and modular BIOSes, as well as secure booting and other important modern firmware features. For quite a few years now, Intel reference BIOSes for new platforms (like Crystal Forest, Tunnel Creek, and Haswell) have been built using UEFI, and the Simics models for these platforms have been tested using these reference BIOSes.

Continue reading >>

Back to Reverse Execution

By Jakob Engblom 

Simics reverse execution and reverse debugging is a unique and very powerful feature of the simulator. In this blog post and accompanying video, we will look at what exactly it is you can do with reverse execution in Simics. It is not just a matter of running backwards to a breakpoint or stepping instructions (pick up my 2012 S4D article for more on reverse debugging). Reverse execution fundamentally is about undoing arbitrary operations on the target and going back to a prior state from a previous point in time. Furthermore, with Simics, you can go back in time and choose to do something different than you did in the original execution. In this blog post, we will take a look at just what you can do with reverse.

The basic operation of reverse execution is to stop at some point in a system execution, go backwards to visit the past and see what happens, and then go forward again. Reverse execution lets you go back and forth over the execution to investigate a particular execution path in detail.

Continue reading >>

How Simics Gets Started (with video)

By Jakob Engblom

Having worked with Simics for more than a decade, it is easy to get blind to the obvious. To me, starting a Simics simulation is a trivial thing that I do many times per day. However, to a newcomer to the product, it is not so obvious, and it might even seem a bit daunting. It is not daunting, and it is not difficult, as shown in this video on YouTube.

As can be seen in the video, we start Simics sessions by invoking a target setup script or opening a checkpoint. This can be done from Eclipse, from a command-line, or from the old Simics stand-alone GUI. Whether on Windows or Linux host, the same options are available. No matter how you do it, the end result is the same. The same Simics engine is used in all cases, interpreting the startup script in the same way.

Continue reading >>

Inspecting and Reconfiguring a Target in Simics 4.8

By Jakob Engblom 

As we said in the first blog post on Simics 4.8, a really big new feature is the System Editor function. The system editor combines two functions into a single view, both the exploration of an existing target as well as the modification and even construction of a new target from existing pieces. A demo video is available on the Wind River channel on YouTube, and read on for more information on how it works.

The basic view that the System Editor provides is the Simics component hierarchy of a target system. The components are used to organize a target in a manner that is very similar to how the target hardware system is organized, including the encapsulation of chips on boards, PCI cards into PCI slots, and functional clusters inside SoCs.

Continue reading >>

Collborating using Simics Recording Checkpoints

By Jakob Engblom

One of the main themes of the Simics 4.8 release is the use of Simics to collaborate between team members, teams, and organizations. To facilitate this, Simics checkpoints have been extended with significant new metadata capabilities as well as the ability to record a simulation session and communicate the recording as part of a checkpoint. Checkpointing can really transform how developers and testers and users communicate issues in their systems, and the new checkpointing features and metadata makes the mechanism even more powerful. We have a video up on YouTube demonstrating this Simics feature. 

Continue reading >>

Serving Windows Files from a Simics Quick-Start Platform

By Jakob Engblom

Windows file sharing has always felt a bit magical to me. I use it all the time, certainly, but I never quite understood how it worked; it was just this big chunk of Microsoft protocol that felt like it really did not want to talk to other types of operating systems. Sure, I have used the open-source "samba" server for a long time with great success… but it always seemed to suffer from issues with access rights (probably the fault of me and server setup and mixing Unix and Windows accounts, not a fault in the server itself).

With this background, I was really delighted and surprised  when  I managed to almost effortlessly get a Simics target to share and serve files to my Windows host. A big-endian Power Architecture QSP target at that, running VxWorks, how cool isn’t that? The key to the puzzle was the Visuality NQ Server from Visuality Systems Ltd. in Israel. It just worked, and let me try some interesting and educational setups.

Continue reading >>

A Better way to Connect: TCF and Simics

By Jakob Engblom

How do you actually connect an integrated development environment or a debugger to a target system? This question is more complicated than it might seem to the uninitiated outsider. Traditionally, a range of protocols have been used to connect the development host to a target, most of them vendor-proprietary, and often specialized for a particular purpose (such as debug, downloading code, or uploading profile data). However, there is a better alternative available today, the open-source TCF, Target Connection Framework. The TCF is much more than a debugger connection.  Based on decades of industry experience as to what you actually need to do with a target, TCF combines everything on a single connection: analysis, testing, configuration, control, provisioning, inspection, tracing, debugging, and anything else you might think of. Simics is making good use of TCF to simplify the connection between the Simics runtime engine and the Simics Eclipse-based GUI. In this blog post, I will go into how TCF is used with Simics and what it has enabled us to do that would have been very difficult without the TCF.

First, we need a little background on TCF itself. The TCF is a project in Eclipse, with contributions from Wind River, Xilinx, and others. The TCF protocol is service-based, and each target exposes the services that it supports to the host. The host can then activate the appropriate functionality, based on what the target reports. In this way, there is no need for the host to know very much about the target a priori, as all its capabilites are reported dynamically after a connection has been setup.

Anyway, on to Simics and TCF. Given what TCF is, how did we use it with Simics?

Continue reading >>

Debug Quicker with Simics (video demo)

By Jakob Engblom

Late last year, I presented a one-hour webinar on how Simics lets you “resolve bugs in minutes instead of weeks.” Part of that webinar were two Simics demos that show Simics in action, from the first booting of a target system through loading software onto it and debugging a nasty crash in a server program. The webinar demos are now available as a single Youtube movie, on the Wind River Youtube channel.

The target system used in the demo is a heterogeneous network of four machines. Two ARM-based and two PPC-based. Two of them are running a client application, and two are running a server application. They are all connected on the same virtual Ethernet network, and the client applications can talk to the server applications over the network.

Continue reading >>

Debugging Simics -- on Simics

By Jakob Engblom

I often write and talk about how useful Simics is for debugging concurrency bugs and glitches in multithreaded and multicore systems. Recently, we had a case where we proved this on a very complex application, namely Simics itself. This nicely demonstrated both the recursive completeness of Simics, and its usefulness for conquering tricky bugs in complex software.

The beginning of this story is a bug in Simics, triggered by a certain Simics configuration. The Simics target is a Power Architecture machine, running some bare-metal test code testing the processor simulation. Occasionally, this setup would crash Simics, due to some bug in Simics or the models. It was a difficult bug to track down, as it only happened in one run out of 50 or so. When attaching a debugger to try to diagnose it, it invariably did not happen (a classic Heisenbug).

Continue reading >>

Determinism, Simics, and Flying Piggies

By Jakob Engblom 

In a recent Simics seminar, I was asked about repeatability, variability, determinism and Simics. This is a question that comes up almost every time I present about Simics in front of an audience with testing experience. The people asking the question intuitively think that determinism is a bad thing - since it sounds like it will limit the execution scenarios that will be explored in testing. For a tester, variation is a good thing. However, determinism is not in conflict with variation. And I think I found a perfect illustration of this in a setting that is a bit more accessible and easy to understand than computer simulators. In a computer game, Bad Piggies, from Rovio.  

Bad Piggies is a game based on a physics simulation (not particularly realistic, but still reasonably consistent with everyday experience), where you put together strange contraptions to guide an endearing little pig pilot from the starting point to a goal. What struck me about the game is its incredible sensitivity to inputs, while still being 100% deterministic. To me, this is absolutely analogous to how Simics works (and I guess drawing that analogy indicates a pretty warped mind too).

Continue reading >>

Simulation is a competitive advantage!

By Michel Genard

The American general election is over. Pundits providing postmortem analysis will continue to generate a ton of studies. Let’s examine one aspect of the election that has already generated some interesting ink. This article in Time Magazine mentions how analytic teams tried to predict election results, even running as many as 66,000 simulations night after night. The Obama campaign managed to create hundreds of models (likely electors) and run election simulations each day to define and validate the “design” of the path to victory. Each morning, after looking at simulation results they would adjust the campaign. This process is recognized as a competitive advantage. Let’s now map this phenomenon to embedded software development. 

Continue reading >>

The Role of Tools in Improving Embedded Software Security / Part 3: Mapping the Tools to Activities

By Bill Graham

In the previous posts in this series, Part 1: Automation is the Key and Part 2: Security Improvement and the Software Development Lifecycle, I talked about the connection between the typical embedded device development process and the 5+1 improvement framework for embedded security.  Figure 1 is an illustration of this connection (and discussed in more detail in a previous post). 

 

Figure 1: Mapping the security improvement framework and the device software lifecycle

Continue reading >>

Systematically Exposing OS Kernel Races – An Interview with Ben Blum

By Jakob Engblom

Full-system simulators like Simics provide unparalleled insight into what is going on in a target system. Indeed, better insight is one of the main features of simulation that we get regardless of what we simulate and how. In addition, if we want to, we can also exert control over the target system to make it take different execution paths than it otherwise would. Earlier this year, Ben Blum at Carnegie-Mellon University  CMU presented a Master’s thesis that provides a very good example of just what can be achieved by combing the insight and control of a simulator with intelligence and domain knowledge. The system is called Landslide, and it is used to expose race conditions inside of operating-system kernels.

Landslide systematically explores the possible execution paths of the kernel in order to provoke latent bugs that might only happen very rarely in actual use of the operating system – but as we all know, such glitches are the ones that tend to be found by customers in critical situations and force engineering to spend months in reproduction attempts.

Continue reading >>

Analyzing Manycore Scaling with Simics

By Jakob Engblom

In my previous blog post on multicore scaling investigations with Simics, I tested a simple parallel program on a variety of machines. The scaling obtained was not particularly impressive, especially not on a 60-core target machine. In this post, we will use the Simics timeline view to look a bit closer at what is going on inside the target machines. In particular, with respect to operating system scheduling of the target threads. 

Before we look at the runs that indicated a lack of scaling, we should look at a well-behaved case to make sure we have something to compare to. For this, I brought up the 5-core heavy load experiment again, and reran it. Some things in the target setup had changed compared to the last blog post, so the scaling of the length 100 line is a bit different (once again showing the sensitivity of this program to noise and initial conditions just like it would be on physical hardware). If we look at the behavior for a nicely scaling line and compare it to the timeline view plotting the active threads, we can see that nice scaling does indeed correspond to good parallelism.

Continue reading >>

The Role of Tools in Improving Embedded Software Security / Part 2: Security Improvement and the Software Development Lifecycle

By Bill Graham

In many of my previous posts, I’ve discussed Wind River's 5+1 step improvement framework for embedded device security. By design, it’s meant to complement the software development lifecycle (SDLC) that our customers are using – the stages or phases how they define them and the processes they follow. It’s important for a discussion on tools to put them in the context of the SDLC to see where they apply and how they are useful beyond just the coding stage.

Figure 1 shows the relationship between the SDLC and our security improvement framework. The phase names and number of phases may change from customer to customer but the general idea remains the same. It’s important to note that the improvement framework is equally compatible with Microsoft’s Secure Design Lifecycle that is gaining traction amongst embedded developers too.

Continue reading >>

The Role of Tools in Improving Embedded Software Security / Part 1: Automation is the Key

By Bill Graham

Security Vulnerabilities are Expensive

Shipping security vulnerabilities in a finished product and having them discovered or worse, exploited, is a very expensive proposition for embedded device vendors. As I’ve discussed in an earlier post, security defects are much more expensive to patch and fix the later they are discovered. If you’re lucky to catch a vulnerability during development, you can likely save your company and project thousands if not hundreds of thousands of dollars. So, security vulnerabilities are expensive and costly not only in dollars but in reputation and customer satisfaction.

On average, a vendor loses around 0.6 percent value in stock price when a vulnerability is reported. This is equivalent to a loss in market capitalization values of $0.86 billion per vulnerability announcement.  --Telang & Wattal 2007

Continue reading >>

Inside a Synthetic Simulation Platform

By Jakob Engblom

Recently, we introduced a synthetic simulation-only Simics target machine called QSP (Quick-Start Platform) and it's included in the latest version of Wind River Simics. The idea of QSP is to give every user a useful Simics target that allows them to immediately start using Simics and begin reaping the benefits of simulation for software development. In this blog post, we'll be taking a look under the hood of QSP to see how it works.

The idea behind QSP is to design a piece of virtual-only hardware that is as simple as possible, while still running real operating systems similar to how they work on ordinary hardware.

This is not a new idea. The Simics team and other simulation providers have done similar things in the past - but never with the bottom-up design done with Simics QSP. 

Continue reading >>

Resistance is futile. You will be simulated!

By Michel Genard

Within our blog series, we frequently refer to functional simulation as a requisite to do things that aren't possible in the real world when working on a physical board and a cross development system to develop embedded software. By using simulation, you’re transported to a novel dimension where, because of the control over time, you can become Neo from the movie The Matrix and pull off clever and powerful tricks.

However, access to this dream requires you to have a model of your hardware system (i.e. virtual platform). Alas, these types of artifacts are not always at one's disposal soon enough or available at an affordable price point. This in turn, might initially seem like a major roadblock from using simulation and hence cause someone to give up any dreams of fundamentally changing how they develop software. To help users overcome any hesitations and achieve a new development paradigm, we are introducing an update to the core simulator of Wind River Simics.

Continue reading >>

 

Teaching Networking using Simics

By Jakob Engblom

Wind River Education Services provides user training for a variety of topics, including Wind River operating systems and tools, as well as more general topics like networking. Training always includes hands-on labs, which can complicate logistics for training sessions. Shipping boards and configuring networks is time-consuming and error-prone. For that reason, we are looking into using Simics as an alternative to physical hardware to streamline training logistics. It also makes it simple to encapsulate configurations, while maintaining the reality of cross-development. In this blog post, we will look at how Simics is used as a tool to facilitate network labs in the context of education.

Continue reading >>

Forcing Rare Bugs to Appear - an Interview with Tingting Yu

By Jakob Engblom

One use of Simics that has always been fascinating is to use the power you have over the target to somehow force error conditions in software. The hardware state control inherent in a tool like Simics should be useful to knock a system off of the expected common path and into code less tested, and to reveal bugs that normally only appear in particular rare circumstances.  Recently, there was a paper published that discussed exactly such an application of Simics.  In this blog post, I will be interviewing Tingting Yu from the University of Nebraska at Lincoln (UNL) about her paper.

Continue reading >>

Getting Code Coverage with LDRA Tools on Simics

By Jakob Engblom

A system development tool like Simics is rarely used completely on its own. Simics is usually brought in by companies and development teams who are already using a variety of tools and expect to keep doing so along with Simics. Also, Simics by itself cannot reasonably be expected to solve all problems for all people. Instead, we need to connect Simics with outside tools to provide an integrated solution.

In this blog post, Jay Thomas of LDRA and I will discuss one concrete example of such a tool integration. In particular, how Simics can be used together with the code coverage and certification tools from LDRA to perform code analysis on safety-critical software in a way that is more efficient than with most hardware platforms.

Continue reading >>

Happy 30, 80186 (and 0b100000, 8051)

By Jakob Engblom 

As mentioned in past blog posts on Simics, maintaining old software and developing new software for older hardware is a not-too-uncommon use case for Simics. Case in point: we recently added a couple of new target processors to the Simics model library that most people would probably consider "surprisingly old" hardware. For a long-time embedded programmer like myself, it just feels like going back to the roots.

Continue reading >>

Crystal Forest on Simics

By Jakob Engblom

A few week ago, Intel announced the Crystal Forest platform, a new IA-based platform for networking and communications applications. The first Crystal Forest hardware is appearing now, but we have been working with Crystal Forest on Simics for more than a year already. 

While we cannot yet talk about the details of the hardware (and in any case, that is more Intel's story to tell, not ours), it is a pretty complex piece of silicon.  Crystal Forest is based around Sandy Bridge processors and features hardware acceleration for network and security tasks.  It features multicore 64-bit processors with virtualization and the latest iteration of the IA instruction set.  All of this is faithfully modeled in Simics.

Continue reading >>

Detecting security problems – using static analysis to catch them early and less expensively

By Bill Graham

In my previous post I discussed the potential benefits in quality and costs that static analysis brings to software development. In addition to common coding errors, many of the bugs found by static analysis are potential security defects as well.  Buffer overflow, OS command injection, unrestricted string format and integer overflows are among the top 25 most dangerous security coding defects (according to the Common Weakness Enumeration (CWS) from the MITRE organization). These types of defects are common in C and C++ and are dangerous to correct operation in general but also pose significant security threats – often because the right exploit can lead to arbitrary code execution on the target. Once an attacker can execute code on your device, they can gain complete control, which might include reflashing the firmware, installing malware or rewriting the command and control software.

Continue reading >>

Making a Faulty Serial Port

By Jakob Engblom 

As noted before, one common use case for Simics is doing fault injection.  Fault injection is typically added to an existing system without changing it, since the goal is to maintain a fundamentally fast simulator when not injecting faults.  There are a range of mechanisms available in Simics to implement fault injection. This blog post will take a look at two such mechanisms and how they are used in the context of injecting faults on a serial port.

Continue reading >>

Secure Mobility Message Resonates at MILCOM 2011

By Chip Downing

MILCOM 2011 last week in Baltimore, MD was not only educational, but it was a watershed event.   Last year, it was a “coming out” party for custom Android devices; this year however, was the year where many companies are now using COTS hardware and software to their fullest extent, along the entire supply chain, from core to edge and user devices.   I believe this COTS adoption is driven by two powerful forces – the exploding capabilities of commercial tablet devices, and global military budget pressures.

The vastly increasing power and capability of commercially available mobile communications devices is simply amazing. Just a few years ago, almost everything in this military communications space was purpose built, and most commercial products were simply inadequate to address the rugged and complex system demands of military communications systems.   As seen at MILCOM 2011, this has officially changed -- COTS end-to-end communications domains rule.

So if all of these MILCOM vendors are not making customized hardware and software, what are they doing?   Wind River had over 500 people visit its booth at MILCOM this year, and most of the discussions I had with both suppliers and end users at the show were about increasing device security and leveraging high volume COTS components in demanding deployment scenarios.

Continue reading >>

Simics for Networked Systems: An Interview with RTI

By Jakob Engblom

Networked systems is one of the primary application areas for Simics. Simics can run many machines inside a single Simics simulation, and apply all Simics features to the system, not just to a single machine inside the system. This is something that Dan Poirot from Real-Time Innovations, RTI, has made quite extensive use of recently. It is a pretty cool use-case for Simics, so we arranged to interview Dan about his use of Simics.

Continue reading >>

Leveraging Virtual Platforms to Improve the Intel Product Lifecycle Process

By Eddie Glenn

An Interview with Atul Kwatra, Principal Engineer at Intel

My colleague Jakob Engblom and I had the opportunity to meet with Atul Kwatra, Principal Engineer at Intel recently.  Atul is responsible for driving virtual platform strategy and technical direction for the Intelligent Systems Group (ISG) at Intel.  ISG focuses on products for the embedded, networking, and communications markets. 

Specifically, we wanted to learn more about Atul’s vision on how Intel leverages virtual platforms to improve their product lifecycle to reduce risks, time to market, and costs.

Continue Reading >>

 

Improving Embedded Security: Proper Runtime Selection

By Bill Graham

Selection of secure components for an embedded system is key to a secure system. Leveraging a secure RTOS, middleware, virtualization and tools significantly reduces the effort and development costs. Moreover, there are additional benefits from using commercial-off-the-shelf (COTS) software components over Roll Your Own (RYO) code or self-ported and maintained open source code. Some of the COTS components worth considering include:

Continue reading >>

Why Simics Won't Run Super Mario

By Jakob Engblom

Emulating old computer gaming systems is a popular consumer-market application of simulation technology similar to Wind River Simics. There are a large number of emulators out there, emulating everything from old arcade games to the home computers of the 1980's to gaming consoles.  These emulators might seem quite similar to Simics on the surface, but in practice, the simulation technology employed is quite different.  You will never see Simics simulate an old Super NES running Super Mario Bros. 

It all comes down to the level of timing accuracy required.

To accurately run games written to run well on the very limited hardware of the 1980s, you need a fairly detailed simulation of the hardware circuits and their timing. 

Continue reading >>