Formal and Practical Techniques for the Complex System Design Process using Virtual Prototypes: Better Early than Never

Preface
Acknowledgments
Contents
Acronyms
List of Figures
List of Tables
Listings
1 Introduction
	1.1 Design Flow with Virtual Prototypes
	1.2 Book Outline
2 Preliminaries
	2.1 Embedded Devices
	2.2 SystemC/TLM
	2.3 RISC-V Instruction Set Architecture
3 Hardware and Environment Modeling
	3.1 RISC-V Based Virtual Prototype: An Extensible and Configurable Platform for the System Level
		3.1.1 Introduction
		3.1.2 Related Work
		3.1.3 Preliminaries
			3.1.3.1 RISC-V: Atomic Instruction Set Extension
		3.1.4 RISC-V Based VP Architecture
			3.1.4.1 RV32/64 (Multi-)Core
			3.1.4.2 TLM-2.0 Bus
			3.1.4.3 Traps and Interrupts
			3.1.4.4 System Calls
			3.1.4.5 VP Initialization
			3.1.4.6 Timing Model
		3.1.5 VP Interaction with SW and Environment
			3.1.5.1 Interrupt Handling and HW/SW Interaction
			3.1.5.2 Environment Interaction: Syscall Emulation and C/C++ Library
		3.1.6 VP Performance Optimizations
			3.1.6.1 Direct Memory Interface (DMI)
			3.1.6.2 Local Time Quanta
		3.1.7 Simulation of Multi-core Platforms
			3.1.7.1 Example Bare-Metal Multi-core SW
			3.1.7.2 Implementation of the Aps: [/Artifact <> /BDC pdfmark ps: [/EMC pdfmark tomic ISA Extension
		3.1.8 VP Extension and Configuration
			3.1.8.1 Extending the VP with a Sensor Peripheral
			3.1.8.2 SW Debugging Support Extension
			3.1.8.3 HiFive1 Board Configuration
		3.1.9 VP Evaluation
			3.1.9.1 Testing
			3.1.9.2 Performance Evaluation
		3.1.10 Discussion and Future Work
		3.1.11 Conclusion
	3.2 Virtual Breadboard—Advanced Environment Modeling GUI
		3.2.1 Introduction
		3.2.2 Related Work
		3.2.3 Embedded Systems: Components and Interfaces
		3.2.4 VP-Driven Environment Modeling
			3.2.4.1 Architecture Overview
			3.2.4.2 VP Peripheral Interfaces
			3.2.4.3 SystemC Peripheral Interface
			3.2.4.4 GPIO Protocol
			3.2.4.5 VP Environment Model
			3.2.4.6 Drag and Drop
		3.2.5 Rapid Prototyping Using Lua Scripting
			3.2.5.1 Configuration
			3.2.5.2 Scoping Layers
			3.2.5.3 Example Devices
		3.2.6 Evaluation
			3.2.6.1 Modeling Case-Studies
			3.2.6.2 Performance Evaluation
			3.2.6.3 Educational Tool for Teaching
		3.2.7 Discussion and Future Work
		3.2.8 Conclusion
	3.3 Minimally Invasive SW/HW Co-debug Live Visualization on Architecture Level
		3.3.1 Introduction
		3.3.2 Related Work
		3.3.3 Preliminaries
		3.3.4 Implementation
			3.3.4.1 Symbols and Connections
			3.3.4.2 Visualization Interface
			3.3.4.3 Debugging GUI
		3.3.5 Case-Study
			3.3.5.1 Display HW Model
			3.3.5.2 Display SW Driver
			3.3.5.3 Debugging
			3.3.5.4 Evaluation
		3.3.6 Conclusion and Future Work
	3.4 Hardware-in-the-Loop Framework to Bridge the *vp/*rtl Design Gap
		3.4.1 Introduction
		3.4.2 Related Work
		3.4.3 Approach Overview
			3.4.3.1 Protocol
			3.4.3.2 Peripheral Bridge
			3.4.3.3 FPGA Implementation
		3.4.4 Evaluation/Case-Study
			3.4.4.1 GPIO Bank
			3.4.4.2 GPIO Bit-Banging SPI
			3.4.4.3 GCD Calculation
			3.4.4.4 Synthesis Results
		3.4.5 Discussion
		3.4.6 Conclusion and Future Work
4 Verification
	4.1 Verifying SystemC TLM Peripherals Using Modern C++ Symbolic Execution Tools
		4.1.1 Introduction
		4.1.2 Related Work
		4.1.3 Preliminaries: PLIC
		4.1.4 TLM Peripheral Verification via Symbolic Execution
			4.1.4.1 Thread to Function Translation
			4.1.4.2 Peripheral Kernel
			4.1.4.3 Symbolic Execution
		4.1.5 Experiments
			4.1.5.1 Tests
			4.1.5.2 Test Results: Original PLIC
			4.1.5.3 Test Results: PLIC with Injected Faults
			4.1.5.4 Test Appendix: Simple-Sensor Peripheral
		4.1.6 Conclusion
	4.2 Toward Cross-Level Equivalence Testing of Peripherals Using Symbolic Execution Tools
		4.2.1 Introduction
		4.2.2 RTL Peripheral Verification via Symbolic Execution
			4.2.2.1 Peripheral Kernel
		4.2.3 Experimental Setup
		4.2.4 Conclusion and Future Work
	4.3 Dynamic Information Flow Tracking for Early Security Policy Validation
		4.3.1 Introduction
		4.3.2 Related Work
		4.3.3 Preliminaries: Security Policies and Threat Model
			4.3.3.1 Security Policy
			4.3.3.2 Declassification
			4.3.3.3 Threat Model
		4.3.4 DIFT for Embedded Binaries Using VPs
			4.3.4.1 Approach Overview
			4.3.4.2 DIFT Engine
			4.3.4.3 Execution Clearance
			4.3.4.4 Example Scenario: System Description and Security Policy
			4.3.4.5 Branches with Confidential Conditions
		4.3.5 SystemC TLM-2.0 Compatible Tainting Engine for Virtual Prototypes
		4.3.6 Experimental Evaluation
			4.3.6.1 Security Policy Evaluation: Car Engine Immobilizer
			4.3.6.2 Code Injection Protection
			4.3.6.3 Performance Overhead Evaluation
		4.3.7 Conclusion and Future Work
5 Conclusion
References
Index