Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2724 Thanks!
[Music]
[Applause]
hi so can switch to the slide
directly so uh here's a few things about
my
background uh is that uh I I have a
software H background without computer
science degree but with a industrial
system and electronic degree so that LE
to explain you the perspective I came
from and so this talk um will be based
on risk 5 which is a project which
started two years ago where the idea was
to develop SBJ softcore risk 5 one which
has a few not the common feature
features for fpj softcore like uh out of
order execution out of order memory load
and store multiple issues or multiple
restriction each cycle executed uh
memory currency multic support so really
a lot of features the idea was to push
that forward and also to experiment with
other ways to describe hardware and so
yeah this talk uh will share my
experience on that and give you some tip
keywords so that if one day you are in a
situation where you have kind of similar
problem
it may help
you so yeah sometime it will take some
time to switch the slid because that's
only a dual car soft car running at 200
MHz in Dean showing the slides and so it
it all starts with Hardware description
so when I learned Hardware design 12 or
13 years ago it was
VXL eventually very L but basically the
way things were T to me is that there is
no alternative to to to to industry
standard but now with time things really
moved forward a bit um there is a set of
Open Source alternative tools you can
use to describe your hardware and what
they often have in common is that they
are based on on the same Paradigm which
is using a general purpose programming
language and a software IPI to
explicitly Define your Hardware so for
instance there is some in Scala like Tel
and SP
there is some python based one like M
HDL and it it it can be quite slim and
pretty though it's just to give a simple
example I will not go that deep uh but
like for instance to Define some simple
Hardware with a input increment you say
Okay I want input Boolean Hardware
signal I want a regist nam counter so
okay I want a reg of the U 8bit type
with a reset value zero I want a Comal
signals which has always this value and
so on so it give you the same level of
control and V can very log in
practice uh but it can go much much much
further for instance like if you have a
e statement in your software programming
language like scalar python you could
add or not add some Hardware unit list
if you have a for
Loop uh you may add some Hardware
multiple times in the net list but it
can go much further with uh data
structure and G algorithms for instance
you can use software Dynamic
arrays in a CPU design in a c design you
may have multiple flash interface and
you may want to store all those flash
interface into a dynamic array so simple
example and then you can go to things
which are evolved like ash map ash map
can be really useful to elaborate your
Hardware so here is an example also
applied to CPU design CPU design you
have multiple stage like fet decode
execute and basically you can model to
Stage as being some ash map between some
Hardware data type like program counter
as a hardware data type of un 32 bits so
it makes a relationship between the hard
type and the hardware signal in the net
list which instantiate that Hardware
type in the given stage then you can
access those Hardware type in the stages
that you want
and finally you can ask some software
algorithm to automatically pipeline
things between to the ash map so you can
go really really deep and if you are
more interested in do that uh you can
check for instance here some
documentation how nus 5 was made how he
push this ways you can uh elaborate your
Hardware
so then you have the instruction set
assembly architecture sorry um there is
a few which are open source free to use
out there there is open risk there is
more recently risk five and um for
instance for risk five I have to say now
the tool chain is really usable it's uh
quite
stable I remember at the beginning there
were often breaking changes between fan
clinic and open SBI but now really
things work well and it's maybe still
not that easy to buy some risk five
chips that you can program yourself um
but uh in many ways uh many companies
are embedded some risk five in their uh
silicon to implement some
functionalities without even telling us
so it's really quite common you get out
all the tool chain GCC lvm qmu lenux
deand Port all of those
things which then lead you to designing
your CPU so this is I I will not go that
much in depth in it I will just zoom on
some part of it so that's how next t
five uh architecture is you have some
okay fet stage uh decode allocate rename
registers track dependencies uh out of
order isq then you have some execution
units and for instance for the execution
unit there is really two World there is
the one which have a fixed latency with
really good response time and the one
with viable latency it's really two
World apart and what I will focus on
during the next slide is C to Branch
prediction like here you can see for
instance there is a branch Target buffer
there is a j prediction a return advice
T prediction we we kind of named that
Branch prediction but that is much more
than this so it doesn't need to be done
exactly as I will show you now but
that's to give an example and this is
not even exactly how ncri does it but
it's quite close and basically Branch
prediction is more about predicting what
will be the next PR counter that you
need to fetch really really early in the
pipeline so early that you don't even
know what instruction you are fetching
yet and so you have to predict a lot of
things like you have to predict if uh
there is a branch or a jump instruction
in the bites that you are still fetching
you have to predict if there is a jump
or jump or Branch you have to predict
where TOS predicted jump and branch
would go toward if they taken you have
then to finally predict for the branch
if they should be taken or not so there
is really a lot of Branch prediction
happening early on and everything which
goes below is only about correcting
those branch prodiction made really
early for instance in the decode stage
you know exactly which instruction you
are executing so you may correct a few
things and in the execute stage it's not
really about executing uh the jump and
branch it's really more again being sure
that everything went right before with a
prediction else corrects uh the CPU
execution pass and it's not shown INR
here but it's also about generating the
data which will allow the CPU to learn
how to
predict uh the
next
instructions to make the bur can learn
about the inst the the
program and so
next slide it's loading oh yeah so um
because we are in an open source design
we can simulate World CPU we can
simulate really everything cycle by
cycle in uh desktop and this is a graph
uh which shows like which instruction
are being executed by the CPU when the
CPU is fetching what instruction when
the instructions are being renamed and
the code when they are waiting the out
of order dispatch C that all the
dependencies are solved when the
instruction is being executed and when
they are waiting for commit so um this
graph is generated using konot Kata tool
which is Al open source tool and this
specific Trace is showing a spect attack
done on the nisk 5 CPU where for
instance we can see here we generate a
very long chain of uh dependencies
using some load and star which work on
the same address multiple
times to create some load to store
hazard in order to generate a very late
branch misprediction that will allow us
to execute a lot of badly speculative uh
code um allowing us to
attack um some memory protected by the
mmu then how to generate some side
effects out of it uh I took the wrong
direction and it take a lot of time to
load
pages and so yeah like one interesting
things of that is that some people then
can really try some attacks and really
see the behavior of the CPU out of it
but I don't try to imagine that often
when I had to program some
microcontroller I had isue I had some
bugs in my software I would like I
wanted to to figure out how to
interconnect with the dma or for
instance I want to improve the
performance of my software like having
full access of the hardware design and
being able to simulate those things is
is really can be really
helpful and so then you go about
multicar requirements if you want to run
risk 5 Linux and there is not that many
Hardware requirements um you just need
two things you need Hardware cash
currency and you need inter CPU software
interrupt so inter CPU software interupt
is is really trivial so I talk about it
but I will really focus on Hardware cash
currency because with mic background I
already come from a world where have
microcontroller eventually a really
lowend processor and software FP often
work like this what they do is software
cash
currency where for instance if a CPU
want to write memory you would have to
flush with explicitly with a software
instruction H data cache to make it
visible to others and when a CPU want to
read the memory and he may he knows that
it may have been written by somebody
else he need other to invalidate
explicitly it's own data cache before
reading it that's that's really old
school and some software are less and
less compatible with those things like
for instance a risk five uh Linux port
and what you need is so Hardware uh cash
currency loading yeah and so that's one
example of it that's used to give some
idea of that world there many other ways
to do it more or less look like how TI
Link Works not exactly but it's close
where basically the idea is that if your
CPU data cach want to do a memory
operation he will have to acquire a copy
of the memory block he want to work on
but Al permissions to do operations in
it like he may ask read only permission
on a given copy of a memory block or may
ask read write
permissions and here is an example for
instance same uh case and before
assuming all the caches are empty cpu0
will want to write the memory then the
data cache need to acquire the copy and
acquire redrive permission so he do an
acquire request to the interconnect uh
that knowing that no other cach in
system has a copy of that memory block
will directly Grant the memory block and
the permission to cpu0 and then when
cpu1 want to uh read the memory he ask a
read permission with a copy and then the
interconnect will trigger a probe to to
cpu0 to ask cpu0 to go back to downgrade
its permission and to provide a clean
copy of the memory block
back
so the the funny thing about that is
that you can really observe this kind of
memory currency schem happening in very
Modern Hardware in very simple ways for
instance if you run this C code um where
you have two thread one incrementing the
first element of array the second thread
incrementing the second element of the
array you may end up in two very
different performance cases either the
Two element of the array end up in the
same memory block and you will have
absolutely disgusting performances
because basically between the two CPU
data cache uh it's ping ponging the read
write permission and the memory the copy
of the memory block all the
time and if it end up that two elements
of the array are in different memory
blocks there is no interference between
the two data cache and things go 20
times faster and that's on a 2 years old
desktop CPU so it really something which
is
observable and so yeah if you are more
interested in do that you can for
instance take a look at the tiling uh
specification and um one thing is
because I had to implement the L2 cache
to to work uh with this stting uh
specification um it it Al exposed some
trick which are not necessarily that
obvious at the first look so those
tricks are not necessarily true for all
L2 caches but for the one which uh I
implemented to give you some example U
the al2 cache will only support one
bending transaction per 64 by block so
if you have two requests on the same
memory block at the same time one will
have to wait a quite long time so it
other mean that you should avoid to
split your memory access into smaller
things than 6 by if you know you want to
read 64 by and for instance L2 data
cache will only support memory
transactions up to 64 by uh getting a
very long burst for your video dma uh to
be efficient will not help quite through
R so going above 64 by access will may
have negative effect there is notion
that keeping memory burst align is
really
important up to a given point you can
have alignment which Al I mean there is
a lot of of um little Nuance can appear
with this kind of
design which then lead you when
everything all of that work lead you to
deploying your s with some periperal
with inside
fpg and I have to say the fpg and
vendors are King when it is about
locking customer in by providing easy to
use tool that they can't use on other FP
so there is ways to avoid that there is
some open source tool to design full so
with pereral like for instance litex uh
which is in Python uh with uh M
midan and it had quite uh some pereral
like DDR 4 and three controllers open
source uh SD card internet support USB
host SATA PCI many things and one
interesting aspect of litex is that it
it provide a template uh so template
that you can modify VI sping a common
Lin so really easy to customize a little
bit and you can deploy it on many
different fpg dev kit already and for
instance using this command line plus a
few modification to get USB o support
and gtag you get a full SS which can run
Debian so that's the S which is running
now on this
board so one thing is that one per which
was kind of really missing was USB
support um USB is kind of scary because
it's a very big
specification uh implementing a Linux
driver is something with Al sces me but
it gives so many connectivity like yeah
like keyboard mouse audio flash drive SD
card U ethernet Bluetooth Wi-Fi
so one interesting thing about usb is
that there is also some open source
specification about how you could
Implement a USB host uh controller
inside the so which is for instance name
orci maybe you already hear the oci key
word it's it's it is the specification
of it and so if you implement this
specification you get a lot of things
for free like there is already a Linux
driver for it there is already a UT
driver driver for it and there is even a
net BSD driver for it so I implemented
this uh USB driver and and something
funny happened somebody with a old spark
station uh running net
BSD uh ported this uh USB core in ifpg
connected it on a very old Asus and got
USB support on his platform as well so
yeah if you're interested there is some
documentation about this per contr there
as
[Music]
well and yeah synes is place and Route
so at this point you only have a bunch
of very log code maybe vdl code so you
need to translate it into a bitstream to
load into your fpj you can use the fpj
vend tools like vivado quartus and so on
but there is also some open source tool
you can use for that uh not necessarily
for all fpks but for quite a few like
for the exing 7 uh ltis
I40 np5 those the tools like yis next p
I'm just not a good person to talk about
it I'm not really updated about the
statues of those tool but know they
exist so
then I don't remember what is the next
one I have to
wait oh yeah running Linux so yeah that
that pict was from somebody uh some
people which Eng are SC and made the
system run on it running Linux and doom
on it and basically running Linux is
carry and here are the requirements you
need okay if you want to R mle CPU and
dma you need Hardware cash
currency you need machine mode
supervisor mode user mode a privilege
mode like the x86 ring level uh here is
a specification which is really hard to
read so if it's hard to read for you
don't worry it's not your fault
you need mmu support not really but I
would I would say you need it Atomic
support the same uh you need it not
really but I would say you can of really
need it and you need SBI so SBI mean
supervisor binary interface it's kind of
abuse so it is a software specification
of a system call that the supervisor is
allowed to do towards the machine mode
to get some feature so one you run Linux
this BOS is still
running and for instance Linux can say
okay please put AAL character on the
terminal or maybe Linux can ask please
uh set a software interrupt in 10 Mill
for me so there is really a bunch of
functionalities which are implemented in
this machine mode B which is really
still running while L run and you have a
specification for it here and a open
source implementation here named open
SBI and funny thing is that itl it
Implement enough functionalities that
Linux can run without any hardware
specific driver you you will not get a
block device driver but enough to run
distribution like build and Z on okay
then the EV most caring is running
Debian I really knew kind of nothing
about Debian before trying it but it's
not that bad once you get some
documentation about it generating um um
image for Dean is quite simple and the
requirements are the following like you
need risk five 6bit support with integer
multiply divide Atomic extension floting
Point extension double point floting
point extension and compress instuction
set so unfortunately you need a lot of
risk five extension for that I was
hoping we will get at least a 32bit
version for fpj softcore to keep things
small but I I lost that hope it I guess
it will not happen so you need as Linux
canel compiled with quite a few
additional flags and some storage like
SD card for the image itself and so yeah
if you're interested in do that there is
some documentation here about it and a
video to document at what speed you can
boot uh Debian uh run Doom run open TD
on it on uh dual coris 5 r at
MHz um then I don't remember the next
one yeah yeah here all the fun begin
with all the package of the world like
from uh uh embedded Hardware
engineer accessing to this kind of
software libraries
is it it feel kind of weird like when
you are used to build rout with its
limited set of packages and now you have
access to a full Dean desktop
environment on nfpk yeah it it's
something weird it's not necessarily the
most fluent EXP you will get but it turn
Doom just
fine okay so now it's kind of the
reality check um I I may I may have had
quite some dark words here but I I will
try to communicate to you my my pain and
suffering during those times um I don't
know if you have seen uh the Breaking
Bad last episode where there is Jessie
running away in his car screaming crazy
because he's finally free
and that's really how I feel a few times
in my life including the day the S was
finally walking and I had Dean running
everything seems stable until yeah
something happened like yeah a bad can
of message it is really scary it's
really a a roller coaster because you
you have to understand this kind of
project is years of work and you only
see the lights of yeah is you you seem
so close from the light and then it run
away yeah two for me um and so here is a
real example of what
happened I had to do a car running B for
1 hour and then you had I had ancu
freeze that mean that one of the car was
freezing and 1 hour of run time to get a
hard buug is really scary because it
mean had to wait 360 billion cycle
before triggering the bug while it was
running Dean which is really running a
lot of software I had a lot of software
running around in the CPU and I had to
wait that long for the bug to happen so
it's impossible to run it simulation
because it will be 40 days of simulation
waiting for eventually a bug to
happen and so yeah Al Another very scary
thing is that maybe the bug happened 10
minutes ago and by some cascading effect
finally showed up show its
symptoms so you hope you get some clue
you hope it will not take you weeks you
hope you will one day fix it and in that
case I was kind of Lucky um the score
was still alive on V I can still proit
statues on open
city um I could see the program Conta
which was stuck in the best function for
a uh thread to get stuck in so the rose
spin lock
which
is already a good thing it's not in some
random function that get wrong really R
spin lock and forcing that lock to
unlock using open CD writing the
memories tracking things around got the
CPU back on
track and yeah it was this bad CPU uh
bad memory currency made by the CPU data
cache so yeah it it's really the hard
part of all of this debugging is scary
uh once you get a working design you
will not like to modify it at all you
will have a lot of resistance about
modifying something which works
especially when you reach so CPU level
things and so I think then it's the last
slide it is about
simulation so when I learned AO desire
in school we were obviously on the
industry standard tools you had mod Sim
uh there is also VC s and this kind of
industry tools which will cost you too
much money as an individual to to get
you may get some free version which are
locked down in term of that it's
unusable for this kind of big
design and the thing is there is really
open source alternative to those big
industry uh tools like vhdl for vhdl
simulation in cares very log for very L
ones um those work great except for
Speed so if you need speed which C what
you need to simulate
CPUs uh is verilator so verilator is a
really important tools in the open
source tool chain I would say
because you can simulate the CPU at this
kind of rate on a modern CPU it's about
times faster than what those tool will
do so and basically what it does it
translate your very log into a simp
model that you can then
simulate and Al uh if you have one day
to develop CPU and stuff this um you
need to running the simulation alone is
not enough you need to run your CPU in a
lock step manner with our reference
model to check every cycle what the CPU
is doing to catch the error as soon as
possible that's one of the big mistake I
did for a long time I didn't have that
but this will save your sanity and yeah
those con traces here
um you you can easily detect uh bugs
with this lock step things uh uh but
finding performance bug is really hard
and having these kind of traces is not
only really interesting but is also
really helpful to find out performance
bug and so that's it uh I hope you had a
good time and one thing so if you have
some open projects which bring something
in the world which feel a gap uh take a
look at the anet foundation they help me
a lot and they may help you as
well thank
[Applause]
you
thank you very much but the good times
are not over yet you have the
possibility to ask a question out there
on the internet uh from fedas also
Matrix and IRC but also here in the room
we have four microphones so please queue
up behind them and then we'll take some
uh some questions both from the room and
also from the internet
so we have the first question on the
microphone here in the front to the left
hello yeah first of all thanks for the
nice work and um you know there has been
a lot of problem with working with build
rout you know with getting packages and
all so getting deian is very good thing
but again yeah the 64 Port um 64 Port is
only possible right so the question I
have is that um how do you see this
project growing in the LX ecosystem will
we have an official Debian Port that so
Debian already has a RI 64 uh build that
gets generated is it possible to put it
directly on an um generate the let's say
the U image and uh root uh the file
system there and directly Port it on on
my fpga after I built it I built a built
bit stream how do you see that working
so I was surprised how little how little
ification I have to do on the Deon image
itself it's it's it's so simple I don't
think we need anything specific just
providing the the uh R me I think is
good enough because it's it's really
trivial there is nothing specific to the
devb itself I had to do nothing specific
all van only the Linux canel had to have
the LX drivers but that's Linux side not
Dean side so I don't think we need as
specific Dean port for this okay so just
the bit the bit stream uh needs to be
provided with the 64 port and Linux
kernel has to be built with 64 Port yes
and then I can take a Debian rout FS
from the official Debian packages and
all yeah yeah right
thanks excellent we have one more
question over here from the left hello
thank you very much for for the talk so
I have a question about the prefetching
and the the branch prediction and
such so that can as you showed right it
can cause uh security problems
[Music]
and so what I've been asking myself is
whether it's like feasible or realistic
to have a CPU completely
without Branch prediction and and still
have it be usable with at least some
software right or if it's if it's really
we have to give up on that and
so for instance there is v five that you
can configure to not have a branch
prediction yeah um and you can run just
fine it's it's not that bad uh I would
say uh you you you have between yeah you
half the performance into at least like
and for out of f CPU it's even worse
because the pipeline being longer uh
correcting uh but execution take double
the Cycles so yeah yes it is feasible to
have
a CPU running Linux without PR
prediction you can run doom on Vex at
about 35 frames per second in Linux so
it's it's not that bad all right so so
the the performance hit is is still
within the same order of
magnetude or or the performance is that
is that half between Vex without punch
prediction and KNX with everything in
yeah there is about double all right
that's really good that's actually
really good okay only good we need to uh
use the microphones because otherwise
the internet can't uh can't uh hear it
we have a before that we have a question
over here from the right oh just one no
it's not Al it's three times three
times and now now the question to the
microphone to the right in the room
thank you for the talk um so I'm working
with the cva6 and there's a bunch of
depending on which simulator you use
verog or model Sim or whatever there's
different bugs that they actual
simulator had I just wanted to ask if
you had any similar experience no I
didn't have that uh
for two reasons I only use very letter
because that's the only tool I can
access which is fast
enough but Al I would say I can't prove
it but I'm using spdl which generate
some uh VAR code which is really made to
be accepted by all tools there is no
human creativity in the generated vog
anymore okay thank you good and then we
have one more question over here from
the left yeah hi first thank you uh do
you happen to know Boom the the out of
order CPU developer
Berkeley uh if I know him no like do you
know the CPU is it possible to use all
the peripherals with it and is it like
usable compared to next risk five so I I
never tried boom myself uh I I just say
a bit more but um and it the boom
documentation was quite useful to get in
the out of order CPU design uh that that
was great but I have no experience at
all with it I don't know how is it it is
to deploy it I don't even know if there
is a lightex port of it I don't know I
don't either I think yes I think there
is a boom port on we have to verify yeah
and then you can use all the pereral FL
exas if it's done okay thank you we have
one question from the internet and while
we wait for the signal Angel to read
that out please don't hesitate to go
behind one of the microphones if you're
in the room and have a question that you
want to ask don't wait until after the
talk and go up on the side please ask it
so that everybody else can hear it and
get the benefit of the answer so signal
angel from the
internet the internet is asking theel
why the simulation is so slow on the
fpga uh especially in a cycle accurate
manner is a question is why the
simulation is so slow in a
fpga yes H I mean it's not really a
simulation anymore I mean okay so I
understand the language um from somebody
from my field fpj are not simulation
device are really something we can
deploy in in proper industrial device
but for the iic people the fpg has seen
like a simulation platform and so from
that perspective this fpj is 13 years
old it's a midr so yeah it's it could
run at least two to three times faster
with a modern fpj highend one but I
didn't hear the full question did I
answer the question already
or signal Angel could you repeat the
question I'll ask the internet for if
they are happy with the answer good
while we wait for an answer from the
internet then we have a question in the
room over the microphone left
front all all right so this is about the
lock step experiment that you did do you
see some potential there for running two
cores in in lock step it is done it is
done lvls I specifically developed lvls
for that MH so lvls uh is a tool I had
to develop because I didn't wanted to
run a simulation of a dual C system
without having everything checked
because I know the hell it is uh and it
does that and the the tricky things is
about handling memory currency in a luck
step fashion and so there is some
additional communication between the CPU
probes and VLS to generate the trace to
feed him with CPU traces which is like
to tell when the EXE the load was
executed so he know the timing at which
the global memory ordering should be
looked at to know the value to read uh
there is when the load is committed I
don't remember why and the star to there
is when you commit the star and when you
broadcast when you and you have to S
when the star value is broadcasted I
mean written back into the L1 data
C okay more
specifically do you see also some
opportunity or possibility to run
different implementations yes step I I
mean what do you mean different CPUs or
different core implementations yeah it
work out of the box so the way hows is
intered there is multiple front end uh
and basically the front end is are all
CPU specific
agnostic and you have one front end
where you directly Drive airls via C
call so you really have high performance
for live checking of the CPU or you can
also you also have a file frontend when
you fill common lines which documents
all the traces and then you fill that
you fit that file into vs and it will
tell you if it's good or not thank you
very much I think we have our final
question on the microphone to the left
again
yeah uh what do you actually use for
tracing because there's this uh for what
for tracing uh there's this for example
this uh simple risk five Trace uh which
is meant for implementation in
A6 tracing at run time yeah in Hardware
I use nothing except that gtag with just
GDB open CD I have nothing for real
tricing where you can extract execution
graph is if it's what you mean yeah so
no I have nothing for that I just have
the regular risk five specification for
G the Bing implemented but nothing else
okay thank you and we have some feedback
from the
internet um there's another question
from the internet it seems the previous
question is answered the new question is
how is instruction fragmentation in
general handled um especially with with
new CPUs have vendor specific
optimization how's the CPU prefet is
done instru instruction fragmentation in
general the instruction
fragmentation yes yes yes yes I don't
understand that and then the second part
was if there was something specific
about the FPA vendor itself
right I'm trying to understand I think
this is uh where your email from before
comes in handy so we'll ask the internet
to send you an email with a question
because I think we're out of time so
please give a warm Round of Applause for
the
[Music]
talk