JP2012159936A - Target code prior conversion method and emulation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a target code prior conversion method enabling efficient prior prediction of a jump destination address upon prior conversion.SOLUTION: A target code is divided into basic blocks, a command of the target code is parsed for each basic block, a dependency graph having a node and a side corresponding to the command and representing dependency relationship between a value to be loaded on a register and another register, an immediate value, or memory content is created when a read command from a register, a write command to a register, a read command from a memory, a write command to the memory, or an arithmetic logical command is detected, a memory reference table to be used upon a read/write access for the memory and associating memory read content or memory write content with an address value is created, the dependency graph and the memory reference table are linked, and a list is created with all address values having possibility of being a jump destination address being entry points upon prior conversion of a branch command.

Description

  Embodiments described herein relate generally to a target code pre-conversion method and an emulation method.

There is a need to continue to use software assets that have been used for a long time without modification, mainly in the social systems business. However, with the aging of hardware and the end of production, hardware that runs software is disappearing. Also, software assets are difficult to port due to diversification, such as customization of functions on a customer basis.
On the other hand, there is a possibility that software assets can be extended by software emulation of many architecture machines using virtualization technology.

  A virtualization emulator represented by QEMU converts target code into host code while executing it (dynamic conversion), has poor real-time performance, and is difficult to predict response performance and startup time. Is not suitable.

  Proposals have been made regarding static pre-translation and dynamic pre-conversion performed as part of the acceleration of virtualization technology.

  For example, in a multi-core environment, it has been proposed to use a combination of static analysis results and dynamic analysis results, pre-compile program blocks of high importance with high accuracy, and speed up the program (for example, patents). Reference 1).

  Further, in target code conversion, proposals have been made to increase the speed performance at the time of branching of static execution or dynamic execution (see, for example, Patent Document 2).

  However, when the target code conversion is performed in advance in order to stabilize the response performance / startup time, there are the following problems. That is, in the current virtual machine emulator on the premise of dynamic conversion of the target code, the entry point of the basic block may not be known. In addition, in branch / subroutine calls using indirect addressing and branch / subroutine calls using values written in memory, it may be difficult to identify the jump destination address when a branch occurs.

JP 2007-334643 A JP 2008-107913 A

  The problem to be solved by the present invention is to provide a target code pre-conversion method and an emulation method that can efficiently perform a pre-prediction of a jump address when performing pre-conversion.

  In the target code pre-conversion method of the embodiment, the target code is divided into basic blocks that are the minimum units of a branch instruction or a group of instructions that do not flow in from a branch instruction, and the instructions of the target code are divided for each basic block. When a read instruction from a register, a write instruction to a register, a read instruction from a memory, a write instruction to a memory, and an arithmetic logic instruction are detected, the node and the edge corresponding to the instruction are detected. Creates a dependency graph that expresses the dependency of a value loaded into a register with another register, direct value, or memory contents, and is used when there is read / write access to the memory. Create a memory reference table that correlates the contents and address values, and the dependency graph The memory lookup table to cooperate, upon Pretranslation branch instruction, creates a list of all the address values that may as a jump address as an entry point.

It is a figure which shows the structural example of the target code conversion apparatus with which the target code prior conversion method which concerns on this embodiment is applied. It is a figure explaining preparation of a dependence graph. It is a figure explaining search of a dependence graph. It is a figure explaining the case where access to a memory influences specification of the address of a jump destination. It is a figure explaining creation of a memory reference table. It is a figure explaining cooperation of a dependence graph and a memory reference table. It is a figure explaining cooperation of a dependence graph and a memory reference table. It is a figure explaining cooperation of a dependence graph and a memory reference table. It is the figure which modeled a series of flows of the target code conversion method which concerns on this embodiment.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the drawings, the same portions are denoted by the same reference numerals, and redundant description is omitted.

(First embodiment)
First, main terms used in the present embodiment will be described.

  “QEMU” refers to an emulator that can simulate different computer architectures in software.

  The “target code” refers to a code to be converted that is operated on the QEMU.

  “Host code” refers to code that can be interpreted and executed by the CPU on which QEMU is operating.

  A “basic block” is a minimum unit of a branch instruction or an instruction group that does not flow in from a branch instruction in a target code to be operated in a virtual environment. You can jump from other code to the start of the basic block. The end point of the basic block is a jump instruction to another code or an instruction immediately before the jump.

  “Entry point” refers to an address at which execution of a basic block is started. The jump destination of the branch instruction is an entry point.

  In the target code pre-conversion method according to the present embodiment, all address values that can be jump destination addresses are listed as entry points when branch instructions are pre-translated.

  FIG. 1 is a diagram illustrating a configuration example of a target code conversion apparatus to which the target code pre-conversion method according to the present embodiment is applied.

  The target code conversion device 100 is a device for reading, converting and executing a target code to be converted. The target code conversion apparatus 100 is connected to the target code storage unit 200 and the host code storage unit 300. The target code conversion apparatus 100 includes, for example, a target code load unit 10, an entry point load unit 11, a target code parse unit 12, an intermediate code generation unit 13, a basic block division unit 14, a dependency graph creation unit 15, and an intermediate code storage unit 16. , Host code generation unit 17, dependency graph evaluation unit 18, memory reference table read access registration unit 19, write value evaluation unit 20, memory reference table write access registration unit 21, dependency graph re-evaluation unit 22, dependency graph storage unit 23, It comprises a memory reference table storage unit 24, an entry point determination unit 25, and an entry point storage unit 26. Among these, the target code load unit 10, the entry point load unit 11, the target code parsing unit 12, the intermediate code generation unit 13, the basic block division unit 14, the dependency graph generation unit 15, the host code generation unit 17, and the dependency graph evaluation unit 18 The memory reference table read access registration unit 19, the write value evaluation unit 20, the memory reference table write access registration unit 21, the dependency graph reevaluation unit 22, and the entry point determination unit 25 are constructed in the form of, for example, each processing program. be able to.

  First, each part will be briefly described. The target code loading unit 10 reads an execution format image file of a target code into the target code conversion apparatus 100 and develops it on a memory.

  The entry point loading unit 11 loads the start position (entry point) of the basic block to be converted next in the target code. Load entry points sequentially until there are no more entry points.

  The target code parsing unit 12 parses the target code starting from the entry point loaded from the entry point loading unit 11 one instruction at a time (converted into a data aggregate by syntax analysis or the like), and analyzes the meaning of the instruction.

  The intermediate code generation unit 13 generates an architecture-independent code (intermediate code) that can be used only within the target code conversion apparatus 100 for the instruction analyzed by the target code parsing unit 12.

  The basic block dividing unit 14 checks the presence or absence of a branch instruction or a special register value for the target code analyzed by the target code parsing unit 12 and divides the target code into basic blocks.

  When a register / memory load / store instruction and an arithmetic logic instruction are found for an instruction analyzed by the target code parsing unit 12, the dependency graph creating unit 15 selects a node of a dependency graph corresponding to one instruction, Create an edge. Details of the dependency graph will be described later.

  The intermediate code storage unit 16 temporarily stores the intermediate code generated by the intermediate code generation unit 13.

  The host code generator 17 converts the intermediate code corresponding to the target code divided by the basic block divider 14 into a host code.

  The dependency graph evaluation unit 18 searches the dependency graph generated by the dependency graph creation unit 15 in units of basic blocks in order to obtain the entry point of the target code that should be the next candidate for conversion to the host code. To do.

  The memory reference table read access registration unit 19 registers the read and corresponding dependency graph in the memory reference table when the dependency graph creation unit 15 finds a read access from the memory (load from the memory). is there. The memory reference table is a table that correlates memory read / write contents and address values that are used when there is a read / write access (load / store from memory) to the memory.

  The write value evaluation unit 20 evaluates the dependency graph on the read access side for the values registered as write access in the memory reference table.

  The memory reference table write access registration unit 21 registers the write in the memory reference table when the dependency graph creation unit 15 finds a write access to the memory (store instruction to the memory).

  The dependency graph re-evaluation unit 22 re-evaluates the dependency graph registered in the memory reference table in the memory reference table read access registration unit 19.

  The dependency graph storage unit 23 stores a dependency graph.

  The memory reference table storage unit 24 stores a memory reference table.

  The entry point determination unit 25 determines a jump destination address determined as a candidate value by the dependency graph evaluation unit 18, the dependency graph re-evaluation unit 22, and the write value evaluation unit 20 as an entry point.

  The entry point storage unit 26 stores a confirmed entry point.

  Next, a target code conversion method performed by the target code conversion apparatus 100 configured as described above will be described. The target code pre-conversion method according to this embodiment performs three processes: (1) creation of a dependency graph, (2) creation of a memory reference table, and (3) cooperation between the dependency graph and the memory reference table. The destination address estimation and destination of the preliminary conversion in advance are stored in advance. Specifically, processing that involves loading into registers, memory load instructions, and store instructions are monitored, and by creating a new data structure to register, values that may have been written to the target register or memory Be able to remove all.

(Create dependency graph)
Next, creation of a dependency graph will be described. FIG. 2 is a diagram for explaining the creation of the dependency graph. Here, the dependency graph refers to a graph expressing a dependency relationship between a value loaded into a certain register and another register, a direct value, or memory contents. The dependency relationship is a relationship in which the execution result may change depending on the execution order. A dependency graph is created for each basic block. The basic block is divided by the basic block dividing unit 14 depending on the presence or absence of a branch instruction or a special register value. The dependency graph creates a node every time a value is loaded into a register, that is, every time a load instruction, a store instruction, or an arithmetic logic instruction is executed. In the dependency graph, a directed edge toward a register and a direct node depending on loading of values is created.

In FIG. 2, the target code is
mov ax, 0x4000
mov cx, 2
add ax, cx
Shows the case.

  First, since the direct value “0x4000” is brought to the ax register as the mov instruction, a directed side from the node of the ax register to the node of the direct value list for managing the direct value is drawn. That is, the arrow (→) represents the relationship in which the ax register depends on the direct value “0x4000”. Similarly, since the direct value “2” is brought to the cx register as the mov instruction, the directed side from the node of the cx register to the node of the direct value list managing the direct value is drawn.

  Next, as the add instruction, the sum of the value of the ax register and the value of the cx register is used as a new value of the ax register. Therefore, from the node of the new ax register to the node of the previous ax register and the node of the cx register The directed side to be drawn is drawn. That is, the new ax register represents a relationship that depends on the value of the previous ax register and the value of the cx register.

  The graph node management list is a list for managing a group of each register, for grasping what value each register took in the dependency graph creation process. According to the graph node management list, the latest register value is immediately known.

Regarding the creation of the dependency graph, instructions for creating nodes or edges are load instructions, store instructions (mov instructions), and arithmetic / logical operation instructions (add instruction, sub instruction, and instruction, or instruction, xor instruction, etc.). On the other hand, an instruction that does not create a node or an edge is an instruction that uses a register value, or a branch instruction itself, and is a control instruction such as a condition determination statement (cmp instruction, jcc instruction), a ret instruction, an iret instruction, or an hlt instruction. is there. This is because in the case of a control instruction, the return address is known by the caller.
(Search dependency graph)
Next, the specification of the jump destination address by searching the dependency graph will be described. FIG. 3 is a diagram for explaining the search for the dependency graph.

To specify the jump destination address, when indirect addressing appears in the basic block, attention is paid to the latest node for the register used for the addressing. That is, the directed graph is traced with the focused node as the starting point of the dependency graph. On the target code, instructions will run backwards. In the search, a depth-first search is performed, and a finally remaining value is set as a jump destination address.
In the example shown in FIG. 3, the target code is
jmp ax
Shows the case.

  The latest ax register is a register that determines the next jump destination address, but it can be seen from the dependency graph that it depends on the previous ax register and cx register. Further, the previous ax register value can be specified by following the directed graph. In this example, the direct value is 0x4000. Similarly, the value of the cx register value can be specified by following the directed graph. In this example, the direct value is 2. Therefore, the latest ax register value can be specified as 0x4002.

  By searching the dependency graph in this way, the next jump destination address is specified, but there are cases where the next jump destination address cannot be specified only by the dependency graph. This is a case where access to the memory affects the specification of the jump destination address. FIG. 4 is a diagram illustrating a case where access to the memory affects the specification of the jump destination address.

In FIG. 4, the target code is
mov ax, [0x4000]
mov cx, 2
add ax, cx
jmp ax
Shows the case.

In the example shown in FIG.
The latest ax register is a register (start point) for determining the next jump destination address, and it can be seen from the dependency graph that it depends on the previous ax register and cx register. The value of the cx register value can be specified by following the directed graph. In this example, the direct value 2 is determined. On the other hand, the previous ax register value is specified by tracing the directed graph, but it is [0x4000] as the address value that is managed as a direct value. Therefore, the address of the next jump destination cannot be determined only by searching the dependency graph.

(Create memory reference table)
Next, creation of a memory reference table will be described. FIG. 5 is a diagram for explaining the creation of the memory reference table.

  As described above, when the access to the memory affects the specification of the jump destination address, the memory reference table is used. The memory reference table is created in order to record when a memory reference (access to the memory) is performed in the basic block. Specifically, when the target code parsing unit 12 finds the next instruction set during the creation of the dependency graph, the dependency graph creation unit 15 creates it.

Load instruction from memory (example: mov ax, [0xXXXX])
Store instruction to memory (Example: mov [0xXXXX], ax)
When there is a write from the target code to the memory, the memory reference table records an access to the memory in the memory write list. The elements of the memory writing list are “written value” and “data length”. FIG. 5 shows that “written value” and “data length” are added to the memory writing list as one set. Similarly, when the target code is read from the memory, the access to the memory is recorded in the memory read list. The elements of the memory read list are “data length” and “start point and target vertex of dependency graph”. FIG. 5 shows that “data length” and “start point and target vertex of dependency graph” are added to the memory read list as one set.

  In the example shown in FIG. 5, with respect to the memory address, the memory address is managed in a structure similar to a page table that points to a table element according to the access destination address of the target code. It is preferable that the memory address is divided into upper bits and lower bits so that the maximum data length that can be handled by the target code is the same table element.

(Linkage of dependency graph and memory reference table)
Next, cooperation between the dependency graph and the memory reference table will be described. 6 to 8 are diagrams for explaining the cooperation between the dependency graph and the memory reference table. FIG. 6 illustrates that the dependency graph and the memory reference table are linked when it is determined during parsing that reading from the memory is involved. When reading from the memory is accompanied, a pair of the start point node and the target node (vertex) of the dependency graph is created as a new part in the reading list of the memory reference table together with the data length.

  In FIG. 6, [0x4000] is registered as a memory address value in the memory reference table, and the data length, the start node and the target node (vertex of the dependency graph) are displayed in the memory read list of the memory reference table as elements corresponding to [0x4000]. ) Represents recording. With the recording in the memory reference table, evaluation of the dependency graph is once completed.

  FIG. 7 illustrates that the dependency graph and the memory reference table are linked when writing to the memory is found mainly during instruction parsing in another basic block. When writing to the memory is accompanied, a set of the written value and data length is created as a new part in the write list of the memory reference table. Re-evaluate the dependency graph, taking into account all elements of the read list.

In the example shown in FIG. 7, the target code is
mov ax, 0x2000
mov [0x4000], ax
in the case of,
Register [0x4000] as the memory address value in the memory reference table, and record the address [0x4000], the value 0x2000, and the data length in the memory write list of the memory reference table as elements corresponding to [0x4000]. It represents.

In the example shown in FIG. 8, the target code is
mov ax, [0x4000]
mov cx, 2
add ax, cx
jmp ax
Shows the case. Re-evaluate the dependency graph by following the nodes, taking into account all elements of the read list.

  In the example illustrated in FIG. 8, the memory address value [0x4000] that has not been determined is determined as the value added to the memory write list = 0x2000. Therefore, a result of 0x2002 is obtained as the starting point node. The obtained jump destination address is recorded as a new entry point in addition to the entry point list.

  FIG. 9 is a diagram schematically showing a series of flows of the target code conversion method according to the present embodiment. First, the target code is loaded from the target code storage unit 200 by the target code loading unit 10. Subsequently, the entry point loading unit 11 loads the entry point from the entry point storage unit 26. In the initial stage of target code conversion, only a predetermined initial address value is stored in the entry point storage unit 26 for each machine. Subsequently, the target code parsing unit 12 interprets the instruction. Next, the target code is divided into basic blocks by the basic block dividing unit 14. After the division, intermediate code generation by the intermediate code generation unit 13 and dependency graph generation by the dependency graph generation unit 15 are performed in parallel. The generated intermediate code is temporarily stored in the intermediate code storage unit 16. The intermediate code stored in the intermediate code storage unit 16 is sent to the host code generation unit 17 to generate a host code.

  The created dependency graph is temporarily stored in the dependency graph storage unit 23. When the dependency graph is created, if there is read access from the memory, the memory reference table read access registration unit 19 registers the read and corresponding dependency graph in the memory reference table storage unit 24. In the memory reference table, a table for associating the memory read contents with the address values is recorded, so the write value evaluation unit 20 evaluates the dependency graph on the read access side for the values registered as write access in the memory reference table. To do. The evaluation by the write value evaluation unit 20 is newly registered in the entry point storage unit 26 as an entry point by being confirmed by the entry point determination unit 25 as a candidate value of the jump destination address.

  On the other hand, if there is a write to the memory, the memory reference table write access registration unit 21 registers the write in the memory reference table storage unit 24. Subsequently, the dependency graph re-evaluation unit 22 re-evaluates the dependency graph registered in the memory reference table in the memory reference table read access registration unit 19. The evaluation by the dependency graph re-evaluation unit 22 is newly registered as an entry point in the entry point storage unit 26 by being confirmed by the entry point determination unit 25 as a jump destination address candidate value.

  Furthermore, when the dependency graph has indirect addressing, the dependency graph evaluation unit 18 searches for a node of the dependency graph in order to obtain an entry point of the target code that should be the next candidate for conversion to the host code. The search result is newly registered in the entry point storage unit 26 as an entry point by being confirmed by the entry point determination unit 25 as a candidate value of the jump destination address.

  In this way, by converting the target code in advance, a basic block and a list of all entry points are obtained in association with each other.

  According to this embodiment, it is possible to realize CPU emulation with improved stable response performance and real-time performance, so that it is possible to obtain quality assurance of execution performance even for processes and products that have restrictions on execution time such as embedded devices. Be able to.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

100 ... Target code conversion device,
10 ... Target code loading section,
11 Entry point load section,
12 ... Target code parsing part,
13: Intermediate code generator,
14: Basic block division unit,
15 ... dependency graph creation unit,
16: Intermediate code storage unit,
17: Host code generator,
18 ... dependency graph evaluation unit,
19: Memory reference table read access registration unit,
20: Write value evaluation unit,
21: Memory reference table write access registration unit,
22 ... dependency graph re-evaluation part,
23 ... dependency graph storage unit,
24: Memory reference table storage unit,
25... Entry point determination section,
26 Entry point storage unit,
200: Target code storage unit,
300: Host code storage unit.

Claims (8)

A target code pre-conversion method for converting target code into host code before execution,
The target code is divided into basic instructions that are the smallest unit of a branch instruction or an instruction group that does not flow in from a branch instruction,
For each basic block, the instruction of the target code is analyzed, and when a read instruction from the register, a write instruction to the register, a read instruction from the memory, a write instruction to the memory, and an arithmetic logic instruction are detected, Create a dependency graph that expresses the dependency of the value loaded into a register with another register, direct value, or memory contents, as well as the node or edge corresponding to the instruction.
Create a memory reference table that correlates memory read contents and memory write contents with address values, used when there is read / write access to the memory,
Linking the dependency graph and the memory reference table;
A target code pre-conversion method that lists all possible address values as jump destination addresses as entry points when branch instructions are pre-translated.   2. The target code pre-conversion method according to claim 1, wherein the target code is converted into an aggregate of data one instruction at a time and the instruction is analyzed, and then an architecture-independent intermediate code is generated.   The target code pre-conversion method according to claim 1, wherein the intermediate code corresponding to the target code is converted into a host code.   The target code prior conversion method according to claim 1, wherein the dependency relationship in the dependency graph is a relationship in which an execution result may change depending on an instruction execution order.   2. The target code pre-conversion method according to claim 1, wherein, in creating the dependency graph, a node or an edge is not created by any one of an instruction using a register value, a branch instruction, a condition determination instruction, or a control instruction. The memory reference table is
When there is a write from the target code to the memory, the access to the memory is recorded in the memory write list composed of the “written value” and the “data length”,
2. The target code according to claim 1, wherein when the target code is read from the memory, access to the memory is recorded in a memory read list including “data length” and “start point and target vertex of dependency graph”. Pre-conversion method. Cooperation between the dependency graph and the memory reference table is as follows.
When there is a write or read access to the memory during the instruction analysis of the target, when writing to the memory reference table, the write or read access to all the memory already recorded in the memory reference table is scanned. The target code pre-conversion method according to claim 1, wherein if the dependency graph is included, the dependency graph is searched again.   4. An emulation method for loading and using the host code obtained by the target code pre-conversion method according to claim 3.

Images