Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
  • G06F12/14—Protection against unauthorised use of memory or access to memory
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
  • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
  • G06F9/3802—Instruction prefetching
  • G06F9/3812—Instruction prefetching with instruction modification, e.g. store into instruction stream
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
  • G06F12/14—Protection against unauthorised use of memory or access to memory
  • G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
  • G06F12/145—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/44—Arrangements for executing specific programs
  • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
  • G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators

Definitions

• This invention relates to computer systems and, more particularly, to methods and apparatus for preventing the misuse of instructions which have been translated from instructions of a first instruction set into another instruction set when instructions of the first instruction set are to be overwritten in memory.
• a microprocessor In order to be successful, a microprocessor must be able to run all of the programs (including operating systems and legacy programs) designed for that family of processors as fast as existing processors without costing more than existing processors. In addition, to be economically successful, a new microprocessor must do at least one of these things better than existing processors to give buyers a reason to choose the new processor over existing proven processors.
• processors carry out instructions through primitive operations such as loading, shifting, adding, storing, and similar low level operations and respond only to such primitive instructions in executing any instruction furnished by an application program.
• a processor designed to run the instructions of a complicated instruction set computer (CISC) such as a X86 in which instructions may designate the process to be carried out at a relatively high level have historically included read only memory (ROM) which stores so-called micro-instructions.
• CISC complicated instruction set computer
• ROM read only memory
• Each micro- instruction includes a sequence of primitive instructions which when run in succession bring about the result commanded by the high level CISC instruction.
• an "add A to B" CISC instruction is decoded to cause a look up of an address in ROM at which a micro-instruction for carrying out the functions of the "add A to B” instruction is stored.
• the micro-instruction is loaded, and its primitive instructions are run in sequence to cause the "add A to B" instruction to be carried out.
• the primitive operations within a micro-instruction can never be changed during program execution.
• Each CISC instruction can only be run by decoding the instruction, addressing and fetching the micro-instruction, and running the sequence of primitive operations in the order provided in the micro-instruction. Each time the micro-instruction is run, the same sequence must be followed.
• processors for running X86 applications utilize a number of techniques to provide the fastest processing possible at a price which is still economically reasonable. Any new processor which implements known hardware techniques for accelerating the speed at which a processor may run must increase the sophistication of the processing hardware. This requires increasing the cost of the hardware.
• a superscalar microprocessor which uses a plurality of processing channels in order to execute two or more operations at once has a number of additional requirements.
• a simple superscalar microprocessor might decode each application instruction into the micro-instructions which carry out the function of the application instruction. Then, the simple superscalar microprocessor schedules two micro-instructions to run together if the two micro-instructions do not require the same hardware resources and the execution of a micro-instruction does not depend on the results of other micro-instructions being processed.
• a more advanced superscalar microprocessor typically decodes each application instruction into a series of primitive instructions so that those primitive instructions may be reordered and scheduled into the most efficient execution order. This requires that each individual primitive operation be addressed and fetched. To accomplish reordering, the processor must be able to ensure that a primitive instruction which requires data resulting from another primitive instruction is run after that other primitive instruction produces the needed data. Such a superscalar microprocessor must assure that two primitive instructions being run together do not both require the same hardware resources. Such a processor must also resolve conditional branches before the effects of branch operations can be completed.
• superscalar microprocessors require extensive hardware to compare the relationships of the primitive instructions to one another and to reorder and schedule the sequence of the primitive instructions to carry out any instruction.
• the amount and cost of the hardware to accomplish these superscalar acceleration techniques increases approximately quadratically. All of these hardware requirements increase the complexity and cost of the circuitry involved.
• a superscalar microprocessor must use its relatively complicated addressing and fetching hardware to fetch each of these primitive instructions, must reorder and reschedule these primitive instructions based on the other primitive instructions and hardware usage, and then must execute all of the rescheduled primitive instructions.
• the need to run each application instruction through the entire hardware sequence each time it is executed limits the speed at which a superscalar processor is capable of executing its instructions.
• target application programs designed for a particular family of microprocessors
• host microprocessor another faster microprocessor
• the emulator software changes the target instructions of an application program written for the target processor family into host instructions capable of execution by the host microprocessor. These changed instructions are then run under control of the operating system on the faster host microprocessor.
• RISC reduced instruction set
• emulator software are often capable of running X86 (or other) programs, they usually do so at a rate which is substantially slower than the rate at which state of the art X86 computer systems run the same programs. Moreover, often these emulator programs are not able to run all or a large number of the target programs available.
• Figure 1 includes a series of diagrams representing the different ways in which a plurality of different types of microprocessors execute target application programs.
• a typical CISC microprocessor such as an Intel X86 microprocessor is shown running a target application program which is designed to be run on that target processor.
• the application is run on the CISC processor using a CISC operating system (such as MS DOS, Windows 3.1 , Windows NT, and OS/2 which are used with X86 computers) designed to provide interfaces by which access to the hardware of the computer may be gained.
• CISC operating system such as MS DOS, Windows 3.1 , Windows NT, and OS/2 which are used with X86 computers
• the instructions of the application program are selected to utilize the devices of the computer only through the access provided by the operating system.
• the operating system handles the manipulations which allow applications access to memory and to the various input/ output devices of the computer.
• the target computer includes memory and hardware which the operating system recognizes, and a call to the operating system from a target application causes an operating system device driver to cause an expected operation to occur with a defined device of the target computer.
• the instructions of the application execute on the processor where they are changed into operations (embodied in microcode or the more primitive operations from which microcode is assembled) which the processor is capable of executing. As has been described above, each time a complicated target instruction is executed, the instruction calls the same subroutine stored as microcode (or as the same set of primitive operations). The same subroutine is always executed.
• these primitive operations for carrying out a target instruction can often be reordered by the processor, rescheduled, and executed using the various processing channels in the manner described above; however, the subroutine is still fetched and executed.
• a typical RISC microprocessor such as a PowerPC microprocessor used in an Apple Macintosh computer is represented running the same target application program which is designed to be run on the CISC processor of Figure 1 (a).
• the target application is run on the host processor using at least a partial target operating system to respond to a portion of the calls which the target application generates.
• these are calls to the application-like portions of the target operating system used to provide graphical interfaces on the display and short utility programs which are generally application-like.
• the target application and these portions of the target operating system are changed by a software emulator such as Soft PC ® which breaks the instructions furnished by the target application program and the application-like target operating system programs into instructions which the host processor and its host operating system are capable of executing.
• the host operating system provides the interfaces through which access to the memory and input/ output hardware of the RISC computer may be gained.
• the host RISC processor and the hardware devices associated with it in a host RISC computer are usually quite different than are the devices associated with the processor for which the target application was designed; and the various instructions provided by the target application program are designed to cooperate with the device drivers of the target operating system in accessing the various portions of the target computer. Consequently, the emulation program, which changes the instructions of the target application program to primitive host instructions which the host operating system is capable of utilizing, must somehow link the operations designed to operate hardware devices in the target computer to operations which hardware devices of the host system are capable of implementing. Often this requires the emulator software to create virtual devices which respond to the instructions of the target application to carry out operations which the host system is incapable of carrying out because the target devices are not those of the host computer. Sometimes the emulator is required to create links from these virtual devices through the host operating system to host hardware devices which are present but are addressed in a different manner by the host operating system.
• Target programs when executed in this manner run relatively slowly for a number of reasons.
• each target instruction from a target application program and from the target operating system must be changed by the emulator into the host primitive functions used by the host processor.
• the target application is designed for a CISC machine such as an X86
• the target instructions are of varying lengths and quite complicated so that changing them to host primitive instructions is quite involved.
• the original target instructions are first decoded, and the sequence of primitive host instructions which make up the target instructions are determined. Then the address (or addresses) of each sequence of primitive host instructions is determined, each sequence of the primitive host instructions is fetched, and these primitive host instructions are executed in or out of order.
• the large number of extra steps required by an emulator to change the target application and operating system instructions into host instructions understood by the host processor must be conducted each time an instruction is executed and slows the process of emulation.
• the hardware and software of the target computer required to accomplish these operations must somehow be provided in the process of emulation. Because the correct target state must be available at the time of any such exception for proper execution, the emulator is forced to keep accurate track of this state at all times so that it is able to correctly respond to these exceptions. In the prior art, this has required executing each instruction in the order provided by the target application because only in this way could correct target state be maintained.
• Target instructions can be of two types, ones which affect memory or ones which affect a memory mapped input/ output (I/O) device.
• I/O memory mapped input/ output
• instructions operate on memory, optimizing and reordering is possible and greatly aids in speeding the operation of a system.
• operations affecting I/O devices often must be practiced in the precise order in which those operations are programmed without the elimination of any steps or they may have some adverse effect on the operation of the I/O device. For example, a particular I/O operation may have the effect of clearing an I/O register.
• Another problem which limits the ability of prior art emulators to optimize the host code is caused by self-modifying code. If a target instruction has been changed to a sequence of host instructions which in turn write back to change the original target instruction, then the host instructions are no longer valid. Consequently, the emulator must constantly check to determine whether a store is to the target code area. All of these problems make this type of emulation much slower than running a target application on a target processor.
• FIG. 1 (b) Another example of the type of emulation software shown in figure 1 (b) is described in an article entitled, "Talisman: Fast and Accurate Multicomputer Simulation," R. C. Bedichek, Laboratory for Computer Sciences, Massachusetts Institute of Technology. This is a more complete example of translation in that it can emulate a complete research system and run the research target operating system. Talisman uses a host UNIX operating system. In Figure 1(c), another example of emulation is shown.
• a PowerPC microprocessor used in an Apple Macintosh computer is represented running a target application program which was designed to be run on the Motorola 68000 family CISC processors used in the original Macintosh computers; this type of arrangement has been required in order to allow Apple legacy programs to run on the Macintosh computers with RISC processors.
• the target application is run on the host processor using at least a partial target operating system to respond to the application-like portions of the target operating system.
• a software emulator breaks the instructions furnished by the target application program and the application-like target operating system programs into instructions which the host processor and its host operating system are capable of executing.
• the host operating system provides the interfaces through which access to the memory and input/ output hardware of the host computer may be gained.
• the host RISC processor and the devices associated with it in the host RISC computer are quite different than are the devices associated with the Motorola CISC processor; and the various target instructions are designed to cooperate with the target CISC operating system in accessing the various portions of the target computer. Consequently, the emulation program must link the operations designed to operate hardware devices in the target computer to operations which hardware devices of the host system are capable of implementing. This requires the emulator to create software virtual devices which respond to the instructions of the target application and to create links from these virtual devices through the host operating system to host hardware devices which are present but are addressed in a different manner by the host operating system.
• each target instruction from the target application and from the target operating system must be changed by fetching the instruction; and all of the host primitive functions derived from that instruction must be run in sequence each time the instruction is executed.
• the emulation software must generate virtual devices for each of the target application calls to the host operating system; and each of these virtual devices must provide calls to the actual host devices.
• the emulator must treat all instructions as conservatively as it treats instructions which are directed to memory mapped I/O devices or risk generating exceptions from which it cannot recover.
• the emulator must maintain the correct target state at all times and store operations must always check ahead to determine whether a store is to the target code area.
• FIG. 1 (d) a particular method of emulating a target application program on a host processor which provides relatively good performance for a very limited series of target applications is illustrated.
• the target application furnishes instructions to an emulator which changes those instructions into instructions for the host processor and the host operating system.
• the host processor is a Digital Equipment Corporation Alpha RISC processor, and the host operating system is Microsoft NT.
• the only target applications which may be run by this system are 32 bit applications designed to be executed by a target X86 processor with a Windows WIN32S compliant operating system. Since the host and target operating systems are almost identical, being designed to handle these same instructions, the emulator software may change the instructions very easily. Moreover, the host operating system is already designed to respond to the same calls that the target application generates so that the generation of virtual devices is considerably reduced.
• FIG. 1 Another method of emulation by which software may be used to run portions of applications written for a first instruction set on a computer which recognizes a different instruction set is illustrated in Figure 1 (e) .
• This form of emulation software is typically utilized by a programmer who may be porting an application from one computer system to another.
• the target application is being designed for some target computer other than the host machine on which the emulator is being run.
• the emulator software analyzes the target instructions, translates those instructions into instructions which may be run on the host machine, and caches those host instructions so that they may be reused. This dynamic translation and caching allows portions of applications to be run very rapidly.
• This form of emulator is normally used with software tracing tools to provide detailed information about the behavior of a target program being run. The output of a tracing tool may, in turn, be used to drive an analyzer program which analyzes the trace information.
• an emulator of this type runs with the host operating system on the host machine, furnishes the virtual hardware which the host operating system does not provide, and otherwise maps the operations of the computer for which the application was designed to the hardware resources of the host machine in order to carry out the operations of the program being run.
• This software virtualizing of hardware and mapping to the host computer can be very slow and incomplete.
• a host processor having circuitry for enhancing the speed of operation and compatibility of such a processor.
• an object of the present invention to provide a host processor with apparatus for enhancing the operation of a microprocessor which is less expensive than conventional state of the art microprocessors yet is compatible with and capable of running application programs and operating systems designed for other microprocessors at a faster rate than those other microprocessors.
• apparatus for and a method of responding to an attempt to write a memory address including a target instruction which has been translated to a host instruction for execution by a host processor including the steps of marking a memory address including a target instruction which has been translated to a host instruction, detecting a memory address which has been marked when an attempt is made to write to the memory address, and responding to the detection of a memory address which has been marked by protecting a target instruction at the memory address until it has been assured that translations associated with the memory address will not be utilized before being updated.
• Figures l(a)-(e) are diagrams illustrating the manner of operation of microprocessors designed in accordance with the prior art.
• FIG. 2 is a block diagram of a microprocessor designed in accordance with the present invention running an application designed for a different microprocessor.
• Figure 3 is a diagram illustrating a portion of the microprocessor shown in Figure 2.
• Figure 4 is a block diagram illustrating a register file used in a microprocessor designed in accordance with the present invention.
• FIG. 5 is a block diagram illustrating a gated store buffer designed in accordance with the present invention.
• Figure 6(a)-(c) illustrate instructions used in various microprocessors of the prior art and in a microprocessor designed in accordance with the present invention.
• Figure 7 illustrates a method practiced by a software portion of a microprocessor designed in accordance with the present invention.
• Figure 8 illustrates another method practiced by a software portion of a microprocessor designed in accordance with the present invention.
• Figure 9 is a block diagram illustrating an improved computer system including the present invention.
• Figure 10 is a block diagram illustrating a portion of the microprocessor shown in Figure 3.
• Figure 1 1 is a block diagram illustrating in more detail a translation look aside buffer shown in the microprocessor of Figure 3.
• the manipulations performed are often referred to in terms, such as adding or comparing, which are commonly associated with mental operations performed by a human operator. No such capability of a human operator is necessary or desirable in most cases in any of the operations described herein which form part of the present invention; the operations are machine operations.
• Useful machines for performing the operations of the present invention include general purpose digital computers or other similar devices. In all cases the distinction between the method operations in operating a computer and the method of computation itself should be borne in mind.
• the present invention relates to a method and apparatus for operating a computer in processing electrical or other (e.g. mechanical, chemical) physical signals to generate other desired physical signals.
• the target program is referred to as a program which is designed to be executed on an X86 microprocessor in order to provide exemplary details of operation because the majority of emulators run X86 applications.
• the target program may be one designed to run on any family of target computers. This includes target virtual computers, such as Pcode machines, Postscript machines, or Java virtual machines.
• the present invention helps overcome the problems of the prior art and provide a microprocessor which is faster than microprocessors of the prior art, is capable of running all of the software for all of the operating systems which may be run by a large number of families of prior art microprocessors, yet is less expensive than prior art microprocessors.
• the present invention is a part of a combination including an enhanced hardware processing portion (referred to as a "morph host” in this specification) which is much simpler than state of the art microprocessors and an emulating software portion (referred to as "code morphing software” in this specification) in a manner that the two portions function together as a microprocessor with more capabilities than any known competitive microprocessor.
• a morph host an enhanced hardware processing portion
• code morphing software emulating software
• a morph host is a processor which includes hardware enhancements to assist in having state of a target computer immediately at hand when an exception or error occurs
• code morphing software is software which translates the instructions of a target program to morph host instructions for the morph host and responds to exceptions and errors by replacing working state with correct target state when necessary so that correct retranslations occur.
• Code morphing software may also include various processes for enhancing the speed of processing. Rather than providing hardware to enhance the speed of processing as do all of the very fast prior art microprocessors, the improved microprocessor allows a large number of acceleration enhancement techniques to be carried out in selectable stages by the code morphing software.
• Providing the speed enhancement techniques in the code morphing software allows the morph host to be implemented using much less complicated hardware which is faster and substantially less expensive than the hardware of prior art microprocessors.
• one embodiment including the present invention designed to run all available X86 applications is implemented by a morph host including approximately one-quarter of the number of gates of the Pentium Pro microprocessor yet runs X86 applications substantially faster than does the Pentium Pro microprocessor or any other known microprocessor capable of processing these applications.
• the code morphing software utilizes certain techniques which have previously been used only by programmers designing new software or emulating new hardware.
• the morph host includes hardware enhancements especially adapted to allow the acceleration techniques provided by the code morphing software to be utilized efficiently. These hardware enhancements allow the code morphing software to implement acceleration techniques over a broader range of instructions. These hardware enhancements also permit additional acceleration techniques to be practiced by the code morphing software which are unavailable in hardware processors and could not be implemented in those processors except at exorbitant cost. These techniques significantly increase the speed of the microprocessor which includes the present invention compared to the speeds of prior art microprocessors practicing the execution of native instruction sets.
• the code morphing software combined with the enhanced morph host allows the use of techniques which allow the reordering and rescheduling of primitive instructions generated by a sequence of target instructions without requiring the addition of significant circuitry.
• other optimization techniques can be used to reduce the number of processor steps which are necessary to carry out a group of target instructions to fewer than those required by any other microprocessors which will run the target applications.
• the code morphing software combined with the enhanced morph host translates target instructions into instructions for the morph host on the fly and caches those host instructions in a memory data structure (referred to in this specification as a "translation buffer”) .
• translation buffer to hold translated instructions allows instructions to be recalled without rerunning the lengthy process of determining which primitive instructions are required to implement each target instruction, addressing each primitive instruction, fetching each primitive instruction, optimizing the sequence of primitive instructions, allocating assets to each primitive instruction, reordering the primitive instructions, and executing each step of each sequence of primitive instructions involved each time each target instruction is executed. Once a target instruction has been translated, it may be recalled from the translation buffer and executed without the need for any of these myriad of steps.
• a primary problem of prior art emulation techniques has been the inability of these techniques to handle with good performance exceptions generated during the execution of a target program. This is especially true of exceptions generated in running the target application which are directed to the target operating system where the correct target state must be available at the time of any such exception for proper execution of the exception and the instructions which follow. Consequently, the emulator is forced to keep accurate track of the target state at all times and must constantly check to determine whether a store is to the target code area.
• Other exceptions create similar problems. For example, exceptions can be generated by the emulator to detect particular target operations which have been replaced by some particular host function. In particular, various hardware operations of a target processor may be replaced by software operations provided by the emulator software.
• the host processor executing the host instructions derived from the target instructions can also generate exceptions. All of these exceptions can occur either during the attempt to change target instructions into host instructions by the emulator, or when the host translations are executed on the host processor. An efficient emulation must provide some manner of recovering from these exceptions efficiently and in a manner that the exception may be correctly handled. None of the prior art does this for all software which might be emulated.
• a number of hardware improvements are included in the enhanced morph host. These improvements include a gated store buffer and a large plurality of additional processor registers. Some of the additional registers allow the use of register renaming to lessen the problem of instructions needing the same hardware resources. The additional registers also allow the maintenance of a set of host or working registers for processing the host instructions and a set of target registers to hold the official state of the target processor for which the target application was created.
• the target (or shadow) registers are connected to their working register equivalents through a dedicated interface that allows an operation called “commit” to quickly transfer the content of all working registers to official target registers and allows an operation called “rollback” to quickly transfer the content of all official target registers back to their working register equivalents.
• the gated store buffer stores working memory state changes on an "uncommitted” side of a hardware “gate” and official memory state changes on a "committed” side of the hardware gate where these committed stores “drain” to main memory.
• a commit operation transfers stores from the uncommitted side of the gate to the committed side of the gate.
• the additional official registers and the gated store buffer allow the state of memory and the state of the target registers to be updated together once one or a group of target instructions have been translated and run without error.
• the target instructions causing the target exception may be retranslated one at a time and executed in serial sequence as they would be executed by a target microprocessor.
• the state of the target registers may be updated; and the data in the store buffer gated to memory.
• the correct state of the target computer is held by the target registers of the morph host and memory; and the operation may be correctly handled without delay.
• Each new translation generated by this corrective translating may be cached for future use as it is translated or alternatively dumped for a one time or rare occurrence such as a page fault. This allows the microprocessor created by the combination of the code morphing software and the morph host to execute the instructions more rapidly than processors for which the software was originally written.
• exceptions can occur which are handled in different manners.
• some exceptions are caused by the target software generating an exception which utilizes a target operating system exception handler.
• the use of such an exception handler requires that the code morphing software include routines for emulating the entire exception handling process including any hardware provided by the target computer for handling the process. This requires that the code morphing software provide for saving the state of the target processor so that it may proceed correctly after the exception has been handled.
• Some exceptions like a page fault, which requires fetching data in a new page of memory before the process being translated may be implemented, require a return to the beginning of the process being translated after the exception has been handled.
• exceptions are generated by host hardware and detect a variety of host and target conditions. Some exceptions behave like exceptions on a conventional microprocessor, but others are used by the code morphing software to detect failure of various speculations. In these cases, the code morphing software, using the state saving and restoring mechanisms described above, causes the target state to be restored to its most recent official version and generates and saves a new translation (or re-uses a previously generated safe translation) which avoids the failed speculation. This translation is then executed.
• the morph host includes additional hardware exception detection mechanisms that in conjunction with the rollback and retranslate method described above allow further optimization. Examples are a means to distinguish memory from memory mapped I/O and a means to eliminate memory references by protecting addresses or address ranges thus allowing target variables to be kept in registers.
• FIG 2 is a diagram of morph host hardware represented running the same application program which is being run on the CISC processor of Figure 1 (a) .
• the microprocessor includes the code morphing software portion and the enhanced hardware morph host portion described above.
• the target application furnishes the target instructions to the code morphing software for translation into host instructions which the morph host is capable of executing.
• the target operating system receives calls from the target application program and transfers these to the code morphing software.
• the morph host is a very long instruction word (VLIW) processor which is designed with a plurality of processing channels. The overall operation of such a processor is further illustrated in Figure 6(c).
• VLIW very long instruction word
• the CISC instructions are of varied lengths and may include a plurality of more primitive operations (e.g., load and add).
• the RISC instructions are of equal length and are essentially primitive operations.
• the single very long instruction for the VLIW processor illustrated includes each of the more primitive operations (i.e., load, store, integer add, compare, floating point multiply, and branch) of the CISC and RISC instructions.
• each of the primitive instructions which together make up a single very long instruction word is furnished in parallel with the other primitive instructions either to one of a plurality of separate processing channels of the VLIW processor or to memory to be dealt with in parallel by the processing channels and memory.
• the results of all of these parallel operations are transferred into a multiported register file.
• a VLIW processor which may be the basis of the morph host is a much simpler processor than the other processors described above . It does not include circuitry to detect issue dependencies or to reorder, optimize, and reschedule primitive instructions. This, in turn, allows faster processing at higher clock rates than is possible with either the processors for which the target application programs were originally designed or other processors using emulation programs to run target application programs.
• the processor is not limited to VLIW processors and may function as well with any type of processor such as a RISC processor.
• the code morphing software of the microprocessor shown in Figure 2 includes a translator portion which decodes the instructions of the target application, converts those target instructions to the primitive host instructions capable of execution by the morph host, optimizes the operations required by the target instructions, reorders and schedules the primitive instructions into VLIW instructions (a translation) for the morph host, and executes the host VLIW instructions.
• the operations of the translator are illustrated in Figure 7 which illustrates the operation of the main loop of the code morphing software.
• the code morphing software includes a translation buffer as is illustrated in Figure 2.
• the translation buffer of one embodiment is a software data structure which may be stored in memory; a hardware cache might also be utilized in a particular embodiment.
• the translation buffer is used to store the host instructions which embody each completed translation of the target instructions. As may be seen, once the individual target instructions have been translated and the resulting host instructions have been optimized, reordered, and rescheduled, the resulting host translation is stored in the translation buffer. The host instructions which make up the translation are then executed by the morph host.
• the translation may thereafter be recalled whenever the operations required by the target instruction or instructions are required.
• a typical operation of the code morphing software of the microprocessor when furnished the address of a target instruction by the application program is to first determine whether the target instruction at the target address has been translated. If the target instruction has not been translated, it and subsequent target instructions are fetched, decoded, translated, and then (possibly) optimized, reordered, and rescheduled into a new host translation, and stored in the translation buffer by the translator. As will be seen later, there are various degrees of optimization which are possible.
• the term "optimization" is often used generically in this specification to refer to those techniques by which processing is accelerated.
• reordering is one form of optimization which allows faster processing and which is included within the term.
• Many of the optimizations which are possible have been described within the prior art of compiler optimizations, and some optimizations which were difficult to perform within the prior art like "super- blocks" come from VLIW research. Control is then transferred to the translation to cause execution by the enhanced morph host hardware to resume.
• the host translation When the particular target instruction sequence is next encountered in running the application, the host translation will then be found in the translation buffer and immediately executed without the necessity of translating, optimizing, reordering, or rescheduling.
• the translation for a target instruction once completely translated will be found in the translation buffer all but once for each one million or so executions of the translation. Consequently, after a first translation, all of the steps required for translation such as decoding, fetching primitive instructions, optimizing the primitive instructions, rescheduling into a host translation, and storing in the translation buffer may be eliminated from the processing required. Since the processor for which the target instructions were written must decode, fetch, reorder, and reschedule each instruction each time the instruction is executed, this drastically reduces the work required for executing the target instructions and increases the speed of the microprocessor of the improved processor.
• the microprocessor including the present invention overcomes problems of the prior art which made such operations impossible at any reasonable speed.
• some of the techniques of the improved microprocessor were used in the emulators described above used for porting applications to other systems.
• some of these emulators had no way of running more than short portions of applications because in processing translated instructions, exceptions which generate calls to various system exception handlers were generated at points in the operation at which the state of the host processor had no relation to the state of a target processor processing the same instructions. Because of this, the state of the target processor at the point at which such an exception was generated was not known. Thus, correct state of the target machine could not be determined; and the operation would have to be stopped, restarted, and the correct state ascertained before the exception could be serviced and execution continued. This made running an application program at host speed impossible.
• the morph host hardware includes a number of enhancements which overcome this problem. These enhancements are each illustrated in Figures 3, 4, and 5.
• a set of official target registers is provided by the enhanced hardware to hold the state of the registers of the target processor for which the original application was designed. These target registers may be included in each of the floating point units, any integer units, and any other execution units. These official registers have been added to the morph host along with an increased number of normal working registers so that a number of optimizations including register renaming may be practiced.
• One embodiment of the enhanced hardware includes sixty-four working registers in the integer unit and thirty-two working registers in the floating point unit.
• the embodiment also includes an enhanced set of target registers which include all of the frequently changed registers of the target processor necessary to provide the state of that processor ; these include condition control registers and other registers necessary for control of the simulated system.
• a translated instruction sequence may include primitive operations which constitute a plurality of target instructions from the original application.
• a VLIW microprocessor may be capable of running a plurality of either CISC or RISC instructions at once as is illustrated in Figure 6(a)-(c).
• the state of the target registers of the morph host hardware is not changed except at an integral target instruction boundary; and then all target registers are updated.
• the microprocessor when the processor begins executing the translated instruction sequence, the official target registers hold the values which would be held by the registers of the target processor for which the application was designed when the first target instruction was addressed.
• the working registers hold values determined by the primitive operations of the translated instructions executed to that point.
• some of these working registers may hold values which are identical to those in the official target registers, others of the working registers hold values which are meaningless to the target processor.
• the values in the working registers are whatever those translated host instructions determine the condition of those registers to be. If a set of translated host instructions is executed without generating an exception, then the new working register values determined at the end of the set of instructions are transferred together to the official target registers (possibly including a target instruction pointer register). In the present embodiment of the processor, this transfer occurs outside of the execution of the host instructions in an additional pipeline stage so it does not slow operation of the morph host.
• a gated store buffer such as that illustrated in Figure 5 is utilized in the hardware of the improved microprocessor to control the transfer of data to memory.
• the gated store buffer includes a number of elements each of which may hold the address and data for a memory store operation. These elements may be implemented by any of a number of different hardware arrangements (e.g., first-in first-out buffers); the embodiment illustrated is implemented utilizing random access memory and three dedicated working registers.
• the three registers store, respectively, a pointer to the head of the queue of memory stores, a pointer to the gate, and a pointer to the tail of the queue of the memory stores.
• Memory stores positioned between the head of the queue and the gate are already committed to memory, while those positioned between the gate of the queue and the tail are not yet committed to memory.
• Memory stores generated during execution of host translations are placed in the store buffer by the integer unit in the order generated during the execution of the host instructions by the morph host but are not allowed to be written to memory until a commit operation is encountered in a host instruction.
• the store operations are placed in the queue. Assuming these are the first stores so that no other stores are in the gated store buffer, both the head and gate pointers will point to the same position. As each store is executed, it is placed in the next position in the queue and the tail point is incremented to the next position (upward in the figure). This continues until a commit command is executed.
• the microprocessor may recover from target exceptions which occur during execution by the enhanced morph host without any significant delay. If a target exception is generated during the running of any translated instruction or instructions, that exception is detected by the morph host hardware or software.
• the code morphing software may cause the values retained in the official registers to be placed back into the working registers and any non-committed memory stores in the gated store buffer to be dumped (an operation referred to as "rollback").
• the memory stores in the gated store buffer of Figure 5 may be dumped by copying the value in the register holding the gate pointer to the register holding the tail pointer.
• Placing the values from the target registers into the working registers may place the address of the first of the target instructions which were running when the exception occurred in the working instruction pointer register. Beginning with this official state of the target processor in the working registers, the target instructions which were running when the exception occurred are retranslated in serial order without any reordering or other optimizing. After each target instruction is newly decoded and translated into a new host translation, the translated host instruction representing the target instructions is executed by the morph host and causes or does not cause an exception to occur. (If the morph host is other than a VLIW processor, then each of the primitive operations of the host translation is executed in sequence.
• the target instruction pointer points to the next of the target instructions.
• This second target instruction is decoded and retranslated without optimizing or reordering in the same manner as the first.
• any exception generated will occur when the state of the target registers and memory is identical to the state which would occur in the target computer. Consequently, the exception may be immediately and correctly handled.
• These new translations may be stored in the translation buffer as the correct translations for that sequence of instructions in the target application and recalled whenever the instructions are rerun.
• FIG. 5 Other embodiments for accomplishing the same result as the gated store buffer of Figure 5 might include arrangements for transferring stores directly to memory while recording data sufficient to recover state of the target computer in case the execution of a translation results in an exception or an error necessitating rollback. In such a case, the effect of any memory stores which occurred during translation and execution would have to be reversed and the memory state existing at the beginning of the translation restored; while working registers would have to receive data held in the official target registers in the manner discussed above.
• One embodiment for accomplishing this maintains a separate target memory to hold the original memory state which is then utilized to replace overwritten memory if a rollback occurs.
• Another embodiment for accomplishing memory rollback logs each store and the memory data replaced as they occur, and then reverses the store process if rollback is required.
• the code morphing software provides an additional operation which greatly enhances the speed of processing programs which are being translated.
• the translator In addition to simply translating the instructions, optimizing, reordering, rescheduling, caching, and executing each translation so that it may be rerun whenever that set of instructions needs to be executed, the translator also links the different translations to eliminate in almost all cases a return to the main loop of the translation process.
• Figure 8 illustrates the steps carried out by the translator portion of the code morphing software in accomplishing this linking process. It will be understood by those skilled in the art that this linking operation essentially eliminates the return to the main loop for most translations of instructions, which eliminates this overhead.
• the target program being run consists of X86 instructions.
• two primitive instructions may occur at the end of each host translation.
• the first is a primitive instruction which updates the value of the instruction pointer for the target processor (or its equivalent); this instruction is used to place the correct address of the next target instruction in the target instruction pointer register.
• a branch instruction which contains the address of each of two possible targets for the branch.
• the manner in which the primitive instruction which precedes the branch instruction may update the value of the instruction pointer for the target processor is to test the condition code for the branch in the condition code registers and then determine whether one of the two branch addresses indicated by the condition controlling the branch is stored in the translation buffer.
• the first time the sequence of target instructions is translated the two branch targets of the host instruction both hold the same host processor address for the main loop of the translator software.
• the instruction pointer is updated in the target instruction pointer register (as are the rest of the target registers); and the operation branches back to the main loop.
• the translator software looks up the instruction pointer to the next target instruction in the target instruction pointer register. Then the next target instruction sequence is addressed. Presuming that this sequence of target instructions has not yet been translated and therefore a translation does not reside in the translation buffer, the next set of target instructions is fetched from memory, decoded, translated, optimized, reordered, rescheduled, cached in the translation buffer, and executed. Since the second set of target instructions follows the first set of target instructions, the primitive branch instruction at the end of the host translation of the first set of target instructions is automatically updated to substitute the address of the host translation of the second set of target instructions as the branch address for the particular condition controlling the branch.
• the branch operation at the end of the second translation would include the main loop address and the X86 address of the first translation as the two possible targets for the branch.
• the update- instruction-pointer primitive operation preceding the branch tests the condition and determines that the loop back to the first translation is to be taken and updates the target instruction pointer to the X86 address of the first translation. This causes the translator to look in the translation buffer to see if the X86 address being sought appears there. The address of the first translation is found, and its value in host memory space is substituted for the X86 address in the branch at the end of the second host translated instruction. Then, the second host translated instruction is cached and executed.
• microprocessor requires a large translation buffer since each set of instructions which is translated is cached in order that it need not be translated again.
• Translators designed to function with applications programmed for different systems will vary in their need for supporting buffer memory.
• one embodiment of the microprocessor designed to run X86 programs utilizes a translation buffer of two megabytes of random access memory.
• Two additional hardware enhancements help to increase the speed at which applications can be processed by the microprocessor which includes the present invention. The first of these is an abnormal/ normal (A/N) protection bit stored with each address translation in a translation look-aside buffer (TLB) (see Figure 3) where lookup of the physical address of target instructions is first accomplished.
• Target memory operations within translations can be of two types, ones which operate on memory (normal) or ones which operate on a memory mapped I/O device (abnormal).
• a normal access which affects memory completes normally.
• the optimizing and reordering of those instructions is appropriate and greatly aids in speeding the operation of any system using the microprocessor which includes the present invention.
• the operations of an abnormal access which affects an I/O device often must be practiced in the precise order in which those operations are programmed without the elimination of any steps or they may have some adverse affect at the I/O device. For example, a particular I/O operation may have the effect of clearing an I/O register; if the primitive operations take place out of order, then the result of the operations may be different than the operation commanded by the target instruction.
• the A/N bit is a bit which may be set in the translation look-aside buffer to indicate either a memory page or memory-mapped I/O.
• the translation look-aside buffer stores page table entries for memory accesses. Each such entry includes a virtual address being accessed and the physical address at which the data sought may be accessed as well as other information regarding the entry.
• the A/N bit is part of that other information and indicates whether the physical address is a memory address or a memory- mapped I/O address.
• a translation of an operation which affects memory as though it were a memory operation is actually a speculation that the operation is one affecting memory.
• the code morphing software when the code morphing software first attempts to execute a translation which requires an access of either memory or a memory-mapped I/O device, it is actually presuming that the access is a memory access.
• the software might presume the target command requires an I/O access. Presuming an access of that address has not previously been accomplished, there will be no entry in the translation look-aside buffer; and the access will fail in the translation look-aside buffer. This failure causes the software to do a page table lookup and fill a storage location of the translation look-aside buffer with the page table entry to provide the correct physical address translation for the virtual address. In accomplishing this, the software causes the A/N bit for the physical address to be entered in the translation look-aside buffer.
• the target memory reference is checked by comparing the access type presumed (normal or abnormal) against the A/N protection bit now in the TLB page table entry. When the access type does not match the A/N protection, an exception occurs. If the operation in fact affects memory, then the optimizing, reordering, and rescheduling techniques described above were correctly applied during translation. If the comparison with the A/N bit in the TLB shows that the operation, however, affects an I/O device, then execution causes an exception to be taken; and the translator produces a new translation one target instruction at a time without optimizing, reordering, or rescheduling of any sort.
• target exceptions will not occur within a translation. This allows significant optimization over the prior art.
• target state does not have to be updated on each target instruction boundary, but only on target instruction boundaries which occur on translation boundaries. This eliminates instructions necessary to save target state on each target instruction boundary. Optimizations that would previously have been impossible in scheduling and removing redundant operations are also made possible.
• the improved microprocessor is admirably adapted to select the appropriate process of translation.
• a set of instructions may first be translated as though it were to affect memory.
• the address may be found to refer to an I/O device by the condition of the A/N bit provided in the translation look-aside buffer.
• the comparison of the A/N bit and the translated instruction address which shows that an operation is an I/O operation generates an error exception which causes a software initiated rollback procedure to occur, causing any uncommitted memory stores to be dumped and the values in the target registers to be placed back into the working registers.
• the translation starts over, one target instruction at a time without optimization, reordering, or rescheduling. This re-translation is the appropriate host translation for an I/O device.
• a memory operation may be incorrectly translated as an I/O operation.
• the error generated may be used to cause its correct re-translation where it may be optimized, reordered, and rescheduled to provide faster operation.
• a translation bit (T bit) which may also be stored in the translation look-aside buffer is used to indicate target memory pages for which translations exist.
• the T bit thus possibly indicates that particular pages of target memory contain target instructions for which host translations exist which would become stale if those target instructions were to be overwritten. If an attempt is made to write to the protected pages in memory, the presence of the translation bit will cause an exception which when handled by the code morphing software can cause the appropriate translation (s) to be invalidated or removed from the translation buffer.
• the T bit can also be used to mark other target pages that translation may rely upon not being written e.g., target page tables.
• Figure 3 illustrates in block diagram form the general functional elements of the microprocessor which includes the invention.
• the morph host executes a target program, it actually runs the translator portion of the code morphing software which includes the only original untranslated host instructions which effectively run on the morph host.
• memory divided into a host portion including essentially the translator and the translation buffer and a target portion including the target instructions and data, including the target operating system.
• the morph host hardware begins executing the translator by fetching host instructions from memory and placing those instructions in an instruction cache.
• the translator instructions generate a fetch of the first target instructions stored in the target portion of memory.
• Carrying out a target fetch causes the integer unit to look to the official target instruction pointer register for a first address of a target instruction. The first address is then accessed in the translation look-aside buffer of the memory management unit.
• the memory management unit includes hardware for paging and provides memory mapping facilities for the TLB. Presuming that the TLB is correctly mapped so that it holds lookup data for the correct page of target memory, the target instruction pointer value is translated to the physical address of the target instruction. At this point, the condition of the bit (T bit) indicating whether a translation has been accomplished for the target instruction is detected; but the access is a read operation, and no T bit exception will occur. The condition of the A/N bit indicating whether the access is to memory or memory mapped I/O is also detected.
• the target instruction is accessed in target memory since no translation exists.
• the target instruction and subsequent target instructions are transferred as data to the morph host computing units and translated under control of the translator instructions stored in the instruction cache.
• the translator instructions utilize reordering, optimizing, and rescheduling techniques as though the target instruction affected memory.
• the resulting translation containing a sequence of host instructions is then stored in the translation buffer in host memory.
• the translation is transferred directly to the translation buffer in host memory via the gated store buffer. Once the translation has been stored in host memory, the translator branches to the translation which then executes. The execution (and subsequent executions) will determine if the translation has made correct assumptions concerning exceptions and memory.
• the T bit for the target page(s) containing the target instructions that have been translated is set. This indication warns that the instruction has been translated; and, if an attempt to write to the target address occurs, the attempt generates an exception which causes the translation to possibly be invalidated or removed.
• Figure 1 1 illustrates one embodiment of a translation look-aside buffer including storage positions with each entry for holding a T bit indication.
• An additional hardware enhancement to the morph host is a circuit utilized to allow data which is normally stored in memory but is used quite often in the execution of an operation to be replicated (or “aliased") in an execution unit register in order to eliminate the time required to fetch the data from memory on each use.
• the morph host is designed to respond to a "load and protect" command which copies the memory data to a working register 1 11 in an execution unit 110 shown in Figure 10 and places the memory address in a register 1 12 in that unit.
• a comparator 113 Associated with the address register. The comparator receives the addresses of loads and stores to the gated store buffer directed to memory during translations.
• a memory address for either a load or a store compares with an address in the register 1 12 (or additional registers depending on the implementation), an exception is generated.
• the code morphing software responds to the exception by assuring that the memory address and the register hold the same correct data. In one embodiment, this is accomplished by rolling back the translation and reexecuting it without any "aliased" data in an execution register. Other possible methods of correcting the problem are to update the register with the latest memory data or memory with the latest load data.
• the microprocessor may be connected in circuit with typical computer elements to form a computer such as that illustrated in Figure 9.
• the microprocessor when used in a modern X86 computer the microprocessor is joined by a processor bus to memory and bus control circuitry.
• the memory and bus control circuitry is arranged to provide access to main memory as well as to cache memory which may be utilized with the microprocessor.
• the memory and bus control circuitry also provides access to a bus such as a PCI or other local bus through which I/O devices may be accessed.
• the particular computer system will depend upon the circuitry utilized with a typical microprocessor which the present microprocessor replaces.
• Win32 x86 instructions produced by a compiler compiling this C code mov %ecx, [%ebp+0xc] // load c from memory address into the %ecx mov %eax, [%ebp+0x8] // load s from memory address into the %eax mov [%eax] , %ecx // store c into memory address s held in %eax add %eax, #4 // increment s by 4.
• %ebp+0x8 mov [ %ebp+0x8]
• %eax // store (s + 4) back into memory mov %eax, [ %ebp+0xl0] // load n from memory address into the %eax lea %ecx, [%eax- l] // decrement n and store the result in %ecx mov [%ebp+0xl0] , %ecx // store (n-1) into memory and %eax, %eax // test n to set the condition codes jg . - Oxlb // branch to the top of this section if "n>0"
• each of the individual X86 assembly language instructions for carrying out the execution of the operation defined by the C language statement is listed by the assembly language mnemonic for the operation followed by the parameters involved in the particular primitive operation. An explanation of the operation is also provided in a comment for each instruction. Even though the order of execution may be varied by the target processor from that shown, each of these assembly language instructions must be executed each time the loop is executed in carrying out the target C language instructions. Thus, if the loop is executed one hundred times, each instruction shown above must be carried out one hundred times.
• the next sample illustrates the same target primitive instructions which carry out the C language instructions.
• primitive host instructions required to accomplish the same operation in one particular embodiment of the microprocessor in which the morph host is a VLIW processor designed in the manner described herein.
• the host registers which are shadowed by official target registers are designated by an "R" followed by the X86 register designation so that, for example, Reax is the working register associated with the EAX official target register.
• the next sample illustrates for each of the primitive target instructions the addition of host primitive instructions by which addresses needed for the target operation may be generated by the code morphing software.
• host address generation instructions are only required in an embodiment of a microprocessor in which code morphing software is used for address generation rather than address generation hardware.
• code morphing software is used for address generation rather than address generation hardware.
• addresses are generated using address generation hardware. Whenever address generation occurs in such an embodiment, the calculation is accomplished; and host primitive instructions are also added to check the address values to determine that the calculated addresses are within the appropriate X86 segment limits.
• Reip commit commits working state to official state mov %eax, [%ebp+0x8] // load s add R2 , Rebp , 0x8 chkl R2,Rss__limit chku R2 , R_FFFFFF add R3,R2,Rss_base
• Reip commit - commits working state to official state mov [%eax], %ecx // store c into [s] chku Reax, , Rds limit add R4,Reax,Rds base st [R4] , ,Recx add Reip, , Reip, 2 ; add X86 instruction length to eip in
• Reip commit commits working state to official state add %eax, #4 // increment s by 4 addcc Reax, Reax, 4 add Reip, Reip, 5 ; add X86 instruction length to eip in Reip commit ; commits working state to official state mov [%ebp+0x8], %eax // store (s + 4) add R5,Rebp, 0x8 chkl R5,Rss_limit chku R5 , R_FFFFFF add R6 , R5 , Rss_base st [R6] ,Reax add Reip, Reip, 3 ; add X86 instruction length to eip in
• Reip commit commits working state to official state mov %eax, [%ebp+0x10] // load n add R7,Rebp, 0x10 chkl R7,Rss_limit chku R7 , _FFFFFF add R8 ,R7,Rss_base
• Reip commit commits working state to official state lea %ecx, [%eax-1] // decrement n sub Recx, Reax, 1 add Reip, eip, 3 ; add X86 instruction length to eip in Reip commit ; commits working state to official state mov [%ebp+0x10], %ecx // store (n - 1) add R9, Rebp, 0x10 chkl R9,Rss_limit chku R9 , R_FFFFFF add R10,R9,Rss_base st [R10] ,Recx add Reip, Reip, 3 add X86 instruction length to eip in Reip commit ; commits working state to official state and %eax, %eax // test n andcc Rll, Reax, Reax add Reip, Reip, 3 commit ; commits working state to official state
• J9 .-0x1 b // branch "n>0" add Rseq, Reip, Length (jg) ldc Rtarg, EIP (target) selcc Reip, Rseq, Rtarg commit commits working state to official state jg mainloop, ainloop
• This sample illustrates the addition of two steps to each set of primitive host instructions to update the official target registers after the execution of the host instructions necessary to carry out each primitive target instruction and to commit the uncommitted values in the gated store buffer to memory.
• the length of the target instruction is added to the value in the working instruction pointer register (Reip) .
• a commit instruction is executed.
• the commit instruction copies the current value of each working register which is shadowed into its associated official target register and moves a pointer value designating the position of the gate of the gated store buffer from immediately in front of the uncommitted stores to immediately behind those stores so that they will be placed in memory.
• microprocessor ceases the translation at this point, stores the translation, then executes it to determine whether exception or errors occur.
• steps of reordering and other optimization only occur if it is determined that the particular translation will be run a number times or otherwise should be optimized. This may be accomplished, for example by placing host instructions in each translation which count the number of times a translation is executed and generate an exception (or branch) when a certain value is reached.
• the exception transfers the operation to the code morphing software which then implements some or all of the following optimizations and any additional optimizations determined useful for that translation.
• a second method of determining translations being run a number of times and requiring optimization is to interrupt the execution of translations at some frequency or on some statistical basis and optimize any translation running at that time. This would ultimately provide that the instructions most often run would be optimized.
• Another solution would be to optimize each of certain particular types of host instructions such as those which create loops or are otherwise likely to be run most often.
• This sample illustrates a first stage of optimization which may be practiced utilizing the improved microprocessor.
• This stage of optimization like many of the other operations of the code morphing software, assumes an optimistic result.
• the particular optimization assumes that a target application program which has begun as a 32 bit program written for a flat memory model provided by the X86 family of processors will continue as such a program. It will be noted that such an assumption is particular to the X86 family and would not necessarily be assumed with other families of processors being emulated.
• the above sample illustrates a next stage of optimization in which a speculative translation eliminates the upper memory boundary check which is only necessary for unaligned page crossing memory references at the top of the memory address space. Failure of this assumption is detected by either hardware or software alignment fix up. This reduces the translation by another host primitive instruction for each target primitive instruction requiring addressing.
• This optimization requires both the assumption noted before that the application utilizes a 32 bit flat memory model and the speculation that the instruction is aligned. If these are not both true, then the translation will fail when it is executed; and a new translation will be necessary. Detect and eliminate redundant address calculations. The example shows the code after eliminating the redundant operations.
• the above sample illustrates an optimization which speculates that the translation of the primitive target instructions making up the entire translation may be accomplished without generating an exception. If this is true, then there is no need to update the official target registers or to commit the uncommitted stores in the store buffer at the end of each sequence of host primitive instructions which carries out an individual target primitive instruction. If the speculation holds true, the official target registers need only be updated and the stores need only be committed once, at the end of the sequence of target primitive instructions. This allows the elimination of two primitive host instructions for carrying out each primitive target instruction. These are replaced by a single host primitive instruction which updates the official target registers and commits the uncommitted stores to memory. As will be understood, this is another speculative operation which is also highly likely to involve a correct speculation.
• This step offers a very great advantage over all prior art emulation techniques if the speculation holds true. It allows all of the primitive host instructions which carry out the entire sequence of target primitive instructions to be grouped in a sequence in which all of the individual host primitives may be optimized together. This has the advantage of allowing a great number of operations to be run in parallel on a morph host which takes advantage of the very long instruction word techniques. It also allows a greater number of other optimizations to be made because more choices for such optimizations exist. Once again, however, if the speculation proves untrue and an exception is taken when the loop is executed, the official target registers and memory hold the official target state which existed at the beginning of the sequence of target primitive instructions since a commit does not occur until the sequence of host instructions is actually executed.
• Live Out refers to the need to actually maintain Reax and Recx correctly prior to the commit. Otherwise further optimization might be possible .
• This sample illustrates a next step of optimization, normally called register renaming, in which operations requiring working registers used for more than one operation in the sequence of host primitive instructions are changed to utilize a different unused working register to eliminate the possibility that two host instructions will require the same hardware.
• the second host primitive instruction in two samples above uses working register Recx which represents an official target register ECX.
• the tenth host primitive instruction also uses the working register Recx.
• the fourth, fifth, and sixth host primitive instructions all utilize the working register Reax in the earlier sample; by changing the fourth host primitive instruction to utilize the previously unused working register R3 instead the working register Reax and the sixth host primitive instruction to utilize the previously unused working register R4 instead of the register Reax, these hardware dependencies are eliminated.
• the above sample illustrates the scheduling of host primitive instructions for execution on the morph host.
• the morph host is presumed to be a VLIW processor which in addition to the hardware enhancements provided for cooperating with the code morphing software also includes, among other processing units, two arithmetic and logic (ALU) units.
• the first line illustrates two individual add instructions which have been scheduled to run together on the morph host. As may be seen, these are the third and the eight primitive host instructions in the sample just before the summary above.
• the second line includes a NOP instruction (no operation but go to next instruction) and another add instruction.
• the NOP instruction illustrates that there are not always two instructions which can be run together even after some scheduling optimizing has taken place.
• this sample illustrates that only nine sets of primitive host instructions are left at this point to execute the original ten target instructions.
• Resolve host branch targets and chain stored translations add R2 , Rebp, 0x8 & add R0,Rebp,0xc nop & add R7, Rebp, 0x10
• This sample illustrates essentially the same set of host primitive instructions except that the instructions have by now been stored in the translation buffer and executed one or more times because the last jump (jg) instruction now points to a jump address furnished by chaining to another sequence of translated instructions.
• the chaining process takes the sequence of instructions out of the translator main loop so that translation of the sequence has been completed.
• This and subsequent examples start with the code prior to scheduling .
• This optimization first depends on detecting that the code is a loop . Then invariant operations can be moved out of the loop body and executed once before entering the loop body. entry : add R0,Rebp, Oxc add R2 , Rebp , 0x8 add R7,Rebp, 0x10 add Rseq, Reip, Length (block) ldc Rtarg, EIP (target)
• the above sample illustrates an advanced optimization step which is usually only utilized with sequences which are to be repeated a large number of times.
• the process first detects translations that form loops, and reviews the individual primitives host instructions to determine which instructions produce constant results within the loop body. These instructions are removed from the loop and executed only once to place a value in a register; from that point on, the value stored in the register is used rather than rerunning the instruction.
• the steps which have been removed from the loop are address generation steps.
• address generation only need be done once per loop invocation in the improved microprocessor; that is, the address generation need only be done one time.
• the address generation hardware of the X86 target processor must generate these addresses each time the loop is executed. If a loop is executed one hundred times, the improved microprocessor generates the addresses only once while a target processor would generate each address one hundred times.
• Target add R0,Rebp, Oxc add R2,Rebp, 0x8 add R7,Rebp, 0x10 add Rseq, Reip, ength (block) ldc Rtarg, EIP (target)
• Loop st [Rs] ,Rc add Rs,Rs, 4 st [R2] ,Rs,NoAliasCheck copy Reax, Recx //Live out sub Recx, Reax, 1 //Live out st [R7] ,Recx,NoAliasCheck andcc Rll, Reax, Reax selcc Reip, Rseq, Rtarg commit jg Epilog, Loop
• This sample illustrates the next stage of optimization in which it is recognized that most of the copy instructions which replaced the load instructions in the optimization illustrated in the last sample are unnecessary and may be eliminated. That is, if a register-to-register copy operation takes place, then the data existed before the operation in the register from which the data was copied. If so, the data can be accessed in the first register rather than the register to which it is being copied and the copy operation eliminated. As may be seen, this eliminates the first, second, fifth, and ninth primitive host instructions shown in the loop of the last sample. In addition, the registers used in others of the host primitive instructions are also changed to reflect the correct registers for the data.
• the third store instruction when the first and second copy instructions are eliminated, the third store instruction must copy the data from the working register Re where it exists (rather than register RI) and place the data at the address indicated in working register Rs where the address exists (rather than register R3).
• Loop st [Rs] ,Rc, & add Rs,Rs,4 & copy Reax, Recx st [R2] ,Rs,NAC & sub Recx, Reax, 1 st [R7] ,Recx,NAC & andcc Rll, Reax, Reax selcc Reip , Rseq, Rtarg & jg Epilog, Loop & commit
• Loop st [Rs] ,Rc, & add Rs,Rs,4 & copy Reax, Recx sub Recx, Reax, 1 & andcc Rll, Reax, Reax selcc Reip, seq, Rtarg & jg Epilog, Loop & commit
• the final optimization shown in this sample is the use of the alias hardware to eliminate stores. This eliminates the stores from within the loop body, and performs them only in the loop epilog. This reduces the number of host instructions within the loop body to three compared to the original ten target instructions.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Computer Security & Cryptography (AREA)
• Executing Machine-Instructions (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (1)

Publications (2)

Family

ID=22261430

Family Applications (1)

Country Status (5)

Families Citing this family (11)

Family Cites Families (7)

• 1997
  • 1997-08-11 KR KR10-1999-7012140A patent/KR100421687B1/ko not_active IP Right Cessation
  • 1997-08-11 EP EP97939380A patent/EP1004075A4/de not_active Withdrawn
  • 1997-08-11 CA CA002283560A patent/CA2283560C/en not_active Expired - Fee Related
  • 1997-08-11 JP JP51207299A patent/JP3621116B2/ja not_active Expired - Fee Related
  • 1997-08-11 WO PCT/US1997/014117 patent/WO1999008191A1/en not_active Application Discontinuation

Non-Patent Citations (4)

Also Published As

Similar Documents

Legal Events