Simulation and Debugging of Full System Binary Translation

1. Simulation and Debugging of Full System Binary Translation Erik R. Altman and Kemal Ebcioglu IBM T.J. Watson Research Center Presenter : Kim Jin Chul

2. Table of Contents • What is DAISY? • DAISY Architecture • Full System Simulation of DAISY • Problem Debugging DAISY • Conclusion

3. DAISY Background • Problem: Many previous novel ILP Machines were quite different from x86, PowerPC, and S/390  Compatibility difficult. • Observation: Acceptance of novel ILP Machines would be helped by compatibility with existing architectures. • Solution: DAISY–Dynamically Architected Instruction Set from Yorktown

4. DAISY Principles • First time a fragment of code is executed, it is rapidly translated to ILP code for a simple underlying ILP Machine and saved in main memory. • Subsequent execution of same fragment do not require a translation. • All software is translated to ILP code.

5. DAISY Features • Achieves 100% architectural compatibiity with complex architectures. • Dynamic compilation  unprecedented amount of runtime info at compile time. • Unlike SimOS and SimICS, DAISY emulation is operating system and device independent. • The simulator model a complete system

6. AIX Application AIX Application AIX AIX DAISY Translator DAISY Translator DAISY Machine DAISY Machine PowerPC Machine (a) DAISY Hardware System (b) DAISY Simulator System DAISY Architecture: DAISY Schmatic

7. DAISY VLIW PowerPC604e Simulator PowerPCFlash ROM 60x Bus PCI Bus MemoryController Keyboard Disk Video Network Memory DAISY PowerPC DAISY Architecture: DAISY Simulation System

8. DAISY Architecture : DAISY Memory Map DAISY Memory • Translator • Translated Code • Side Tables • SystemSoftware • Simulator • PowerPC Pages 0,1,2 PowerPC Memory -- Except PowerPC Pages 0, 1, 2

9. DAISY Register Conventions • DAISY registers r0-r31 always contain the values in PowerPC registers r0-r31. • DAISY registers r36-r63 are used for renaming speculative results during scheduling, and as scratchpads. • DAISY register r32 has PowerPC counter value. • DAISY register r33 has PowerPC linkreg value. • DAISY register r35 contains the constant 0. • On PowerPC memory accesses, using r0 as an address means literal 0. Keeping 0 in r35 simplifies renaming of r0 in some cases. • DAISY register r34 contains the now deleted Power MQ register.

10. Bootstrapping the DAISY Simulator • Loading the traslator and simulator software into hgh real memory. • This load of the translator and simulator is accomplished via AIX kernel extension. • The kernel extension runs with address translation on initially. • Translation of PowerPC code to DAISY VLIW code.

11. DAISY Scheduling Example Translated VLIW Code Original PowerPC Code 1) add r1,r2,r3  2) bc L1 3) sli r12,r1,3 4) xor r4,r5,r6 5) and r8,r4,r7 6) bc L2 7) b OFFPAGE 8) L1: sub r9,r10,r11 9) b OFFPAGE 10) L2: cntlz r11,r4 11) b OFFPAGE VLIW1 : add r1,r2,r3

12. DAISY Scheduling Example Translated VLIW Code Original PowerPC Code 1) add r1,r2,r3 2) bc L1  3) sli r12,r1,3 4) xor r4,r5,r6 5) and r8,r4,r7 6) bc L2 7) b OFFPAGE 8) L1: sub r9,r10,r11 9) b OFFPAGE 10) L2: cntlz r11,r4 11) b OFFPAGE VLIW1 : add r1,r2,r3 bc L1

13. DAISY Scheduling Example Translated VLIW Code Original PowerPC Code 1) add r1,r2,r3 2) bc L1 3) sli r12,r1,3  4) xor r4,r5,r6 5) and r8,r4,r7 6) bc L2 7) b OFFPAGE 8) L1: sub r9,r10,r11 9) b OFFPAGE 10) L2: cntlz r11,r4 11) b OFFPAGE VLIW1 : add r1,r2,r3 bc L1 b VLIW2 VLIW2 : sli r12,r1,3

14. DAISY Scheduling Example Translated VLIW Code Original PowerPC Code 1) add r1,r2,r3 2) bc L1 3) sli r12,r1,3 4) xor r4,r5,r6  5) and r8,r4,r7 6) bc L2 7) b OFFPAGE 8) L1: sub r9,r10,r11 9) b OFFPAGE 10) L2: cntlz r11,r4 11) b OFFPAGE VLIW1 : add r1,r2,r3 bc L1 xor r63,r5,r6 b VLIW2 VLIW2 : sli r12,r1,3 r4 = r63

15. DAISY Scheduling Example Translated VLIW Code Original PowerPC Code 1) add r1,r2,r3 2) bc L1 3) sli r12,r1,3 4) xor r4,r5,r6 5) and r8,r4,r7  6) bc L2 7) b OFFPAGE 8) L1: sub r9,r10,r11 9) b OFFPAGE 10) L2: cntlz r11,r4 11) b OFFPAGE VLIW1 : add r1,r2,r3 bc L1 xor r63,r5,r6 b VLIW2 VLIW2 : sli r12,r1,3 r4 = r63 and r8,r63,r7

16. DAISY Scheduling Example Translated VLIW Code Original PowerPC Code 1) add r1,r2,r3 2) bc L1 3) sli r12,r1,3 4) xor r4,r5,r6 5) and r8,r4,r7 6) bc L2 7) b OFFPAGE 8) L1: sub r9,r10,r11 9) b OFFPAGE 10) L2: cntlz r11,r4 11) b OFFPAGE VLIW1 : add r1,r2,r3 bc L1 xor r63,r5,r6 sub r9,r10,r11 b VLIW2 b OFFPAGE VLIW2 : sli r12,r1,3 r4 = r63 and r8,r63,r7 bc L2 cntlz r11,r63 b OFFPAGE b OFFPAGE

17. Problem Debugging DAISY • PowerPC  VLIW  PowerPC • More difficult still is debugging!

18. Problem Debugging DAISY • The bugs and difficulties changed over time as DAISY reached ever further through the boot process • For the first 10-20 million instruction of firmware, the serial port on the RS/6000 machine on which we run DAISY is disabled. • The parallel port is also disabled. • The debug output can be obtained during this time is via a 3 hex digit LED on the front of the machine.

19. Problem Debugging DAISY • The firmware decompresses part of itself from ROM into system RAM. • We often use a binary search technique in looking for bugs. • Once the AIX kernel is loaded, a semantic understanding of what code is doing becomes slightly easier again. • But, in this threaded multitasking environment, it can be very difficult to isolate where bugs occur since things do not happen in a deterministic order

20. Problem Debugging DAISY • Finally, Is the bug in? • VLIW code • Simulation code for the VLIW code • The simulator and system software

21. Debugging Approach • Debugging is a difficult problem when operating on a bare machine during a boot. • How to solve it? • Binary Search Approach

22. Binary Search Approach 1000groups 500groups 500 groups 250groups 250groups We isolate the precise group with the problem.

23. Conclusion • DAISY uses dynamic binary translation to make a VLIW architecture appear to be a complete 32-bit PowerPC architecture, running both user and operating system level code.