Instruction Set Simulator

This utility is available only with Rational Apex Embedded for Rational Exec.

In combination, the Apex compiler and the Apex simulator compile and execute target code on the host system.

In addition to executing code, the simulator gathers statistics and timing information about your code. Instruction tracing is also available and can record up to 1000 of the last executed instructions.

The same set of Apex tools which interface to the embedded target from the development host are also used to interface to the simulator.

Because simulating instructions is CPU bound, you can achieve better performance running the simulator on a host separate from your development system.

The following sections make up this chapter:

• Simulator Overview
• Simulator Invocation
• Simulator Special Traps

The instruction set simulator runs as a server in the background.

The debugger and apex_execute or File > Run communicate with the simulator using standard UNIX sockets. They transmit messages to each other using the UDP protocol. The client connects to the simulator by first looking up the name of the simulator service in a file determined by UNIX conventions, /etc/services. The /etc/services file associates service names with service port numbers.

The choice of service port number is usually arbitrary, as long as each unique service name is associated with a unique service port number.

Once the debugger or executable connects to the simulator target, it sends and receives three distinct classes of messages:

• Debugging commands/replies, read/write registers and memory, set breakpoints, single step, etc.
• Cross I/O messages carry requests from the simulated program to perform I/O or perform file management operations. The cross I/O messages make it possible for programs running in the simulator to read/write UNIX files and to print messages on the standard output device.
• Diagnostic messages transmit text messages from the target environment, such as panic messages that always go to the standard output device, or are displayed to the user.

The instruction set simulator can be invoked from the Apex GUI using the Tools > Target Control... command or from a command line. In either case, the invocation starts the simulator, makes it the current target (does an implicit add_target) and downloads the kernel using the switch values of CPP_COMPILER_HOME.

The Instruction Set Simulator has several commands that can be invoked using the debugger pass command. The pass command sends commands to the simulator. All the text following the pass keyword is sent to the simulator. If any output is generated by the simulator, it is displayed on the screen.

The following pass commands are available:

help

Display available commands

history

Display all instructions in the history log.

history_big

Turn on the history log and allocate a big buffer for the log. One thousand (1000) executed instructions are saved.

history_on
history_off

Turn the history log on or off. All the executed instructions are recorded and can be viewed with the history command. The last one hundred (100) executed instructions are placed in the history log.

info

Display information about the Instruction Set Simulator. The simulator version number, simulated processor, processor speed, and other useful information is displayed.

regs

Display processor specific registers.

stats

Display statistics.

stats_on
stats_off

Turn instruction statistics on or off. All the executed statistics are counted and sorted according to the instruction opcode. Statistics on the cache hits and misses are also displayed.

time

Display timing information since the last go or run command. The number of executed instructions and time to execute them are displayed.

Simulator Help Command

Information about the following debugger extensions is available when using the pass help command:

info	stats
history	stats_on
history_big	stats_off
history_on	time
history_off

Simulator Info Command

The pass info command prints the following information regarding the simulator. The example is from a PowerPC target, but the output is similar for any target.

>pass info
 PowerPC Instruction Set Simulator, Ver: 1.1b
 Rational Software Corporation
 Target Processor: POWERPC601 Clock:  50 MHz Bus clock:  50 MHz
 Memory Size:  4 Mbytes Cache Size: 32 Kb

From the example above, you can see that simulated processor has a clock speed of 50MHz, it is a PowerPC 601, has 4 megabytes of main memory, and 32 Kbytes of cache.

Simulator Time Command

The pass time command prints the time and clock cycles from the moment the go (or run) command is executed until it is stopped.

>pass time
cpu time:      583.5 mics.  elapsed:    0.7 mics. 
idle cycles:               0 elapsed:   0
cycles:                29177 elapsed:   36
wall time (elapsed):       6.4 msecs.
simulation speed:       5625.0 cycles per second

where

elapsed time/cycles	Time/cycles from the last go command.
cpu time/cycles	Time/cycles from the moment debugging started.
idle cycles	Number of cycles executed in the runtime idle loop.

See Simulator Special Traps for more information.

The pass time command remembers when it was last called. elapsed is the amount of time/cycles that have elapsed since the previous invocation of pass time. Think of a pass time command as setting a bookmark that tells you the amount of time since the last bookmark was set.

Here's an example:

41  begin
42  
43          put( "Enter 10 integers to be sorted");
44          new_line;
45          new_line ;
46          for i in data'range loop
47                  put( "Integer" & integer'image(i) & ": " ) ;
48                  get( data(i) ) ;
49                  copy(i) := data(i) ;
50          end loop ;
51  
52          quicksort ( int_inc.List( data ) ) ;    
              -- Sort in increasing sequence
53  
54           new_line ; put( "Sort results (default
              operator):" ) ;
55          print_list ( data ) ;
56  
57          quicksort ( int_dec.List( copy ) ) ;    
              -- Sort in decreasing sequence
58  
59<         new_line ; put( "Sort results 
               (> supplied for operator):" ) ;
>b 52
>b 54
>r
sort_ints.vox 
Enter 10 integers to be sorted

Integer 1: 100
Integer 2: 200
Integer 3: 10
Integer 4: 9 
Integer 5: 8 
Integer 6: 21
Integer 7: 25
Integer 8: 7
Integer 9: 5
Integer 10: 3
[1]  stopped at "/rc/people/install/mips/r4k/sort_ints.a":52 in 
sort_ints
  52          quicksort ( int_inc.List( data ) ) ;    
                -- Sort in increasing sequence

>pass time
cpu time:      309.2 mics.  elapsed:        309.2 mics. 
idle cycles:               0 elapsed:               0
cycles:                54111 elapsed:           54111
wall time (elapsed):      28.4 secs. 
simulation speed:       1908.4 cycles per second

>g
[2]  stopped at "/rc/people/install/mips/r4k/sort_ints.a":54 in 
sort_ints
  54          new_line ; put( "Sort results (default < operator):" ) ;

>pass time
cpu time:      321.3 mics.  elapsed:         12.0 mics. 
idle cycles:               0 elapsed:               0
cycles:                56219 elapsed:            2107
wall time (elapsed):      31.2 msecs.
simulation speed:      67532.1 cycles per second

The wall time is actual time used by the simulator program on the host. It is long in this example (28.4 secs), because it includes the time the simulated program waited for the user to type in 10 numbers.

When the second breakpoint at line 54 is hit, the simulator shows that only 12 microseconds had elapsed (the simulated processor is a 175Mhz R4000), or 2107 cycles. That is the simulated time taken to call quicksort, inclusive of the call parameter passing, and return copying, if any. The simulator took only 31 milliseconds to simulate the instructions in quicksort for a grand total of 67532 simulated cycles per second.

Simulator Regs Command

To display all processor specific registers, execute the pass regs command. The example is from a PowerPC target, but the output is similar for any target. This command shows registers that are not visible with debugger regs command.

       >pass regs
        CR:      40000000  FPSCR: 00000000  MSR:   00000000
        XER:     00000020  LR:    00068390  CTR:   000654A0
        TBU:     00000000  TBL:   0000061E
        DSISR:   00000000  DAR:   00000000  DEC:   FFFFD99E
        EAR:     00000000  PVR:   00030000
        HID0:    00000000
        IABR:    00000000  DABR:  00000000  HID15: 00000000

Simulator Stats Command

To gather statistical information, execute the command pass stats_on and start running the code.

Any time you have a debugger prompt, you can see the simulator statistics by executing pass stats. The example is from a PowerPC target, but the output is similar for any target.

>pass stats
Op code Frequency
CROR               4    14.3%
ADDIC              4    14.3%
ORI                3    10.7%
STW                3    10.7%
LWZ                2     7.1%
TWI                2     7.1%
B                  1     3.6%
BC                 1     3.6%
CMPI               1     3.6%
MFSPR              1     3.6%
ADDC               1     3.6%
BCLR               1     3.6%
RLWINM             1     3.6%
SRAWI              1     3.6%
STWU               1     3.6%
TW                 1     3.6%
------------------------------
TOTAL             28
Cache Performance
Cache  (32768) Unified Instruction/Data
       Hit             Miss          Total
Read   30 (  46.9%)    2 (   3.1%)   64 (  59.3%)
Write    3 (  37.5%)     1 (  12.5%)     8 (   7.4%)

The above example shows that 28 instructions were executed and 4 of them were CROR instructions. Some cache statistics are also given. Since this example is a PowerPC 601, the unified instruction/data cache is displayed.

Simulator History Command

The history command displays the history of executed instructions. All executed instructions are displayed with detail. To start tracing, execute one of the following commands.

>pass history_on 

or

>pass history_big

After running the code, display the history buffer by executing the pass history command. The example is from a PowerPC target, but the output is similar for any target.

>pass history
060098 81820098 lwz       r12, 098(r2) r2=621B0 DA=62248 r12:=62570
06009C 800C0000 lwz       r0, 0(r12) r12=62570 DA=62570 r0:=3E8E00
0600A0 3161FED8 addic     r11, r1, -0128 r1=3F86C0 DA=3F8598
0600A4 7D805808 twge      r0, r11 r0=3E8E00 r11=3F8598 r0=3E8E00
0600A8 4F7BDB82 cror      01b, 01b, 01b r34:=80000000
0600AC 9421FED8 stwu      r1, -0128(r1) r1=3F86C0 DA=3F8598 

The register contents and other information is displayed at the time the instruction is executed.

DA = derived address
CA = carry flag (part of XER register) 
OV = overflow flag
EQ = condition register eq bit
LT =                    lt bit
GT =                    gt bit
SO =                    so bit
FX,FEX,VX,OX = floating point condition fields

DA is a derived address. For example, if you have 123(r5), DA would have the actual address that would be used for memory reference. In the case above 0(r0) is transported to DA=0.

---

Simulator Special Traps

The Instruction Set Simulator defines several special instructions that are used to improve execution time. All of the special instructions are actually TW (trap) instructions with all five condition bits turned on. These instructions are used to trap inside the simulator and perform specific tasks which are unrelated to instruction execution. By default, these traps are used only in the program's V_Startup code.

The following instructions are defined in file io_conf.1.ada in the user configuration library.

This instruction clears the specified memory block. For the PowerPC, the following registers are used for the parameters:

GPR3	memory block address
GPR4	number of bytes to clear

This instruction compares two blocks of memory. For the PowerPC, the following registers are used for the parameters:

GPR3	address of the first memory block
GPR4	size of the first memory block (in bytes)
GPR5	address of the second memory block
GPR6	size of the second memory block (in bytes)

The returned value from the compare is placed in GPR3. The following results are possible:

GPR3 = 0	blocks are the same
GPR3 < 0	first block is bigger then the second one
GPR3 > 0	first block is smaller then the second one

This instruction moves a block of memory to another place which may or may not overlap with the original block. For the PowerPC, the following registers are used for parameters:

GPR3	address of the source memory block
GPR4	address of the destination memory block
GPR5	size of the block to move (in bytes)

This instruction initializes the RAM area during program boot time. It uses the Data_Init_Table information for block moves. For the PowerPC, the following registers are used for the parameters:

GPR3	address of Data_Init_Table

This instruction advances the real-time clock if the system is idle. When the system is idle (no task ready to run), an idle loop is executed. By executing this instruction, the real-time clock is advanced to 100 clock cycles before the decrementer interrupt is taken.

For example, if the Apex simulator executes 15K instructions per second, it would normally take the simulator around 3000 seconds to execute the statement delay 1.0. By using this trap, this wait is eliminated.

APEX_TARGET_NAME

Name of the host where the simulator runs.

APEX_TDM_SERVICE

Service for Network TDM communication. Default is tdm.

APEX_TARGET_NAME and APEX_TDM_SERVICE are set by target access tools when using the debugger, download, or run GUIs or when using commands based on the target selected in the Target Control dialog.

help 

Information on the available commands.

info	Information on the simulated processor
history	Dump instruction history trace
history_on	Start tracing instructions (last 100 instr)
history_big	Start tracing instructions (last 1000 instr)
history_off	Stop tracing instructions
regs	Display processor specific registers
stats	Dump execution statistics
stats_on	Start collecting execution statistics
stats_off	Stop collecting execution statistics
time	Print execution time