Hardware Emulation and Virtual Machines

Size: px

Start display at page:

Download "Hardware Emulation and Virtual Machines"

Randolph Hamilton
5 years ago
Views:

1 Hardware Emulation and Virtual Machines

2 Overview Review of How Programs Run: Registers Execution Cycle Processor Emulation Types: Pure Translation Static Recompilation Dynamic Recompilation Direct Bytecode Execution Hardware Mapping: Bus Addressing Memory Mapped Registers Memory Page Swapping Clock Synchronization Interrupts Techniques and Pitfalls: Mapping Memory Efficiently Static Allocations

3 Registers Located on Processor Memory that can be directly manipulated by processor May or may not be addressable Types: Program Counter Result Status Control Stack Offset General Purpose

4 Fetch: Read from the address in memory stored in the program counter Execution Cycle Decode: Determine instruction from opcode Read Operands: Fetch number of operands from memory based on instruction Execute: Carry out the instruction holding result in processor Write Back: Put the result of the instruction to a register or memory location

5 Use variables or native registers to hold values of emulated registers Perform the software execution cycle directly in software. Pure Translation Easily implemented as for/while loop

6 Decoding and execution of operands can be easily implemented as switch-case or array of function pointers. Pure Translation Cont.

7 Advantages: Accurate Emulation Emulation Statistics Pure Translation Cont. Disadvantages: Slow-MOS6502 Emulator runs at about 330MHz on 2GHz Processor

8 Recompiler traces through program generating native code based on the instructions encountered. Static Recompilation Recompilation Process: Read in source executable/parse binary format Create a Stack of Queues Create a List of Queues Create a Map of integer pairs Determine entry point of program WHILE(stack is not empty) Read each instruction placing it in current queue on stack When branch/jump is encountered trace all paths Keep special track of JSR/RTS instructions using stack IF (JSR is encountered and address is not in map) push new queue on stack and continue processing at new location IF( RTS is encountered) pop a queue off the stack an add it to the list. Then add a new map entry with address of last JMP and the List index of associated queue.

9 Recompiler traces through program generating native code based on the instructions encountered. Static Recompilation Recompilation Process: Read in source executable/parse binary format Create a Stack of Queues Create a List of Queues Create a Map of integer pairs Determine entry point of program WHILE(stack is not empty) Read each instruction placing it in current queue on stack When branch/jump is encountered trace all paths Keep special track of JSR/RTS instructions using stack IF (JSR is encountered and address is not in map) push new queue on stack and continue processing at new location IF( RTS is encountered) pop a queue off the stack an add it to the list. Then add a new map entry with address of last JMP and the List index of associated queue.

10 After the loop, the recompiler has a full list of subroutines used by the program and a map of the expected jump addresses. Static Recompilation Next, it iterates through the list of queues generating native instructions equivalent to the original machine instruction. Native jump addresses can be determined using using the address map. The final step is to output the native binary. Advantages: Fast Disadvantages: Fails if program uses dynamically generated functions or non standard subroutine formats(e.g. JMP instead of JSR) Little control over runtime environment

11 Scans the target code at runtime building native code on-the-fly. Dynamic Recompilation Uses similar method to static recompilation but generates native code after each subroutine. Instead of at the end. Generated subroutine is cached Stores addresses of cached routine in hashmap paired with the JSR address that was used to create it. If writes occur to memory location inside of precompiled function, deletes the cached version of the function and removes the entry in the hashmap for it.(forcing it to be recompiled next time.)

12 Dynamic Recompilation Cont. Main Loop for Dynamic Recompilation WHILE(running) IF(Next JSR Address not in cache) generate native code add native code to cache ENDIF run cached code until next JSR Advantages: Combines some of the compatibility of interpretation with some of the speed of static compilation. Disadvantages: Can still fail if code in a subroutine modifies itself

13 This technique is essentially the same as pure interpreted, except that the interpretation is done in hardware instead of software. A VM using this method creates the implementation of each opcode as a separate function, then writes the addresses of those functions into a reserved memory location(usually just before the interrupt vector) Direct Bytecode Execution During execution of the nonnative code the VM simply sets a flag that indicates the processor should use the user defined instruction set instead of the native instruction set. the processor directly executes the functions defined in the opcode vector based on the current nonnative instruction Advantages: Fastest running VM type Just as accurate as pure interpretation. Disadvantages: Only known implementation is Jazelle for ARM CPUs Sparse documentation on actual implementation Requires access to kernel space to set opcode vectors Geared toward JVM implementation, not all VMs can be implemented

14 Processors access more than just memory Bus assigns addresses to hardware components such as: -Registers on other processors -IO Lines -Digital Sensors -Etc. Bus Addressing Emulator's need to simulate responses from these devices. Reads/Writes to memory need to compare address ranges with the hardware's known addressable components(memory Map) In some cases, the writes may need to trigger interrupts in a separate emulated core. Example: In NES console, MOS6502 writes image data to the RP2A03 PPU(a primitive GPU) via memory mapped PPU registers This can be easily handled in an emulator by abstracting reads and writes on the bus, and implementing them on the devices that those memory mapped addresses affect

15 Memory Page Swapping Swaps a segment of bus' address space with another block of memory Used to extend available memory without increasing the size of address bus Usually controlled by memory mapped register The value written to the register denotes the page of memory that should be loaded into the predefined address range To implement on an emulator simply change the source of future read calls in the implementation of the write function for the register On dynamic recompilers either the cached funtions at those addresses have to be deleted, or the value of the memory control register must be appended to the memory address in the hashmap Very hacky to implement on static recompilers. Not typically done

16 Multiple processors can share one clock Clock Synchronization Assume two processors A and B share same clock. Let A's frequency be 6MHz, and B's be 2MHz Then during each cycle of processor A, exactly 3 cycles of processor B occur. Many programs depend on this type of hardware detail for realtime functionality Example: NES' MOS6502 and RP2A03 have this exact relationship. RP2A03 writes 1 pixel to screen every cycle. NES programmers depend on writing to the graphics card once after each three pixels it renders to cause various visual effects This can only be implemented in translated emulators Cycles of processors sharing the same bus must be interleaved in the correct speed ratio

17 Interrupts Interrupts are triggered by specific hardware events or by the software BRK instruction. When an interrupt is triggered the processor finishes executing its current instruction then begins processing the interrupt. There are several types of interrupts including but not limited to: -Reset Interrupts -Nonmaskable Interrupts -Maskable Interrupts The reset interrupt is triggered when the computer(or VM) is powered on. Initializes registers and memory. Nonmaskable interrupts are triggered as a result of another device on the same bus requesting that the interrupted processor perform a time sensitive task. As the Name implies they cannot be disabled. Maskable interrupts are triggered when a device such as a sensor has new information available and needs to notify the CPU. Can usually be disabled by setting a bit in one of the processor's control registers The code that gets executed by each interrupt is defined in the interrupt vector. The interrupt vector holds the address of a userdefined function called an interrupt handler.

18 Efficient Memory Mapping Every read/write must be memory mapped to the proper implementation in an emulator. Range checking using if-else can be very expensive for large memory maps Hashmaps can be used to speed up reads and writes by associating a list of reserved addresses with the components they represent. Additionally, if address range is small enough, an array the length of the address bus can be used to quickly fetch the target implementation for the read/write

19 Many functions dynamically allocate memory to return a result or during the computation. Static Allocations Acceptable if this occurs during creation of components Unacceptable during execution of an instruction Several MHz of emulated speed means several million reallocations per second. Allocations are expensive, and grow more expensive the more you do. Also creates more of a chance for memory leak.

20 Questions?

Chapter 12. CPU Structure and Function. Yonsei University

Chapter 12. CPU Structure and Function. Yonsei University Chapter 12 CPU Structure and Function Contents Processor organization Register organization Instruction cycle Instruction pipelining The Pentium processor The PowerPC processor 12-2 CPU Structures Processor