JP2591418B2 - CPU simulator - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a technique for simulating the operation of a target CPU on a host CPU.

[0002]

2. Description of the Related Art Before a target machine including a target CPU is completed, or before debugging and performance evaluation on the target machine, a program developed for the target CPU (referred to as a target program) is debugged and performance is evaluated. As a method of performing the target CP, the target CP according to the target program is executed on a CPU simulator including a host CPU which is a CPU different from the target CPU.
There is a way to simulate the behavior of U,
An interpreter method for sequentially interpreting and executing a source program for a target CPU and an object simulation method for sequentially interpreting and executing a machine language code for a target CPU (for example, edited by the Handbook Committee of the Institute of Electronics, Information and Communication Engineers, Ohmsha Co., Ltd., published on March 30, 1988, 1st edition, "Electronic Information and Communication Handbook Second Volume," p. 1857, 5.3, "Simulator".

Here, the interpreter system simulates a source program for a target CPU while directly interpreting the source program.
In the object simulation method, a source program of a target program is compiled or assembled and converted into an instruction code at a machine language level of a target CPU prior to simulation.
This instruction code is simulated.

In the object simulation method, it takes time to generate a machine-language-level instruction of the target CPU. However, the simulation execution time is faster than in the interpreter method, so that a short simulation time is required. Uses an object simulation method. If the target program already exists at the machine language level, it goes without saying that compilation or assembling is unnecessary.

In a CPU simulator of the object simulation system, for example, Japanese Patent Laid-Open No.
No. 250122, the target CP
The simulation has been performed while interpreting the instruction code of U one instruction at a time when executed on the host CPU.

As described above, the object simulation type CPU simulator is superior to the interpreter type in terms of simulation speed. However, unlike the conventional one, the instruction code of the target CPU is stored in the host CPU.
In the above configuration in which instructions are interpreted one by one at the time of execution, the time required for the interpretation becomes an overhead during simulation.

Therefore, the present inventor has proposed a new CPU simulator (hereinafter referred to as a proposed CPU simulator) which enables high-speed simulation by eliminating the interpretation of the instruction code of the target CPU at the time of executing the simulation. This was proposed in a patent application (reference number N0002S, title of invention (CPU simulation method and CPU simulator)) filed on December 29, 4th.

This proposed CPU simulator is a CPU simulator that simulates the operation of a target CPU on a host CPU, interprets instruction codes at the machine language level of the target program in advance, and interprets them in advance.
A simulation program expressed by a combination of instruction codes at an assembler language level or a machine language level of a host CPU that simulates each instruction code is generated, and the generated simulation program is executed by the host CPU. Since it is not necessary to interpret the instruction code of the target CPU in (1), a high-speed simulation can be performed accordingly.

[0009]

By the way, the number of instruction codes of the host CPU for simulating one instruction code of the target CPU is basically limited when the host CPU has an instruction which performs the same operation as the target CPU. Need only one, but if there is no instruction that performs the same operation, a plurality of instructions are required. For this reason, when the target program is converted into a simulation program which is a set of instruction codes of the host CPU itself, the code amount after the conversion generally increases.

[0010] When the code amount after conversion increases, various problems are caused. For example, if the main storage capacity of the host CPU is small, it may not be possible to execute the simulation program. Also, the host CPU using the virtual memory management mechanism by paging increases the number of page-outs. Further, the cache hit rate is reduced in the host CPU having the cache mechanism. All of these factors increase the execution time of the simulation.

An object of the present invention is to further improve the already proposed CPU simulator so that the converted code amount can be minimized.

[0012]

In order to achieve the above object, a CPU simulator of the present invention simulates the operation of a target CPU to be simulated on a host CPU. Simulation function storage means for storing as many simulation functions as can be executed by the host CPU for simulating each instruction code of the target CPU, for the number of machine language level instruction codes of the target CPU; Conversion means for interpreting a machine language level instruction code of the target program and converting the target program into a simulation function call sequence which is a set of simulation function calls for calling the simulation function. By the simulation function call string generated by said converting means and said host CPU executes, and has a configuration for simulating the operation of the target CPU according to the target program.

Further, the present invention provides the following (A) or (B) in order to simulate an instruction code whose branch destination address is not known until execution, such as register indirect branch, register indirect subroutine call, and the like. Configuration is adopted.

Configuration (A): The conversion means converts each instruction code at a machine language level of the target program into a simulation function call composed of a constant number of bytes of the instruction code. Prepared,
Corresponding to the machine language level instruction code of the target program whose branch destination address is not known until execution time,
A simulation function for calculating an address in a simulation function call sequence to be branched from the branch destination address on the target CPU obtained as a result of the simulation of the register and the magnification of the constant multiple and returning the return value as a return value, Generating a simulation function call that branches to an address indicated by the return value when the called simulation function ends.

Configuration (B): The conversion means comprises an address on the target CPU of each instruction code at a machine language level of the target program, and the host CP of the simulation function call after the conversion of the instruction code.
A configuration for generating an address conversion table indicating a correspondence with an address on the U, and a next execution on a target CPU obtained as a result of register simulation in accordance with a machine language level instruction code of the target program From the address to be executed and the contents of the address conversion table, a simulation function to be executed is obtained as an address in a simulation function call sequence to be executed next, and a simulation function to be returned as a return value is called. A configuration for generating a simulation function call that branches to the indicated address.

Further, according to the present invention, in order to enable efficient debugging and the like, in the CPU simulator having the configuration of the above (B), the CPU simulator in the address conversion table is provided on the target CPU set by the conversion means. A configuration in which an address of another function such as a breakpoint processing function is set in accordance with an address, or a different function such as an illegal address execution function at an address where no instruction other than the address on the target CPU set by the conversion means exists. The function address is set.

[0017]

In the CPU simulator according to the present invention, the conversion means interprets the instruction codes at the machine language level of the target program before executing the simulation, and simulates the target program with each instruction code. A simulation function call sequence, which is a set of simulation function calls for calling a simulation function executable by the CPU,
The host CPU simulates the operation of the target CPU according to the target program by executing the generated simulation function call sequence, that is, by executing the corresponding simulation function held in the simulation function storage means.

[0018]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, embodiments of the present invention will be described in detail with reference to the drawings.

First, a CPU simulation to which the present invention is applied
1 and 2 for the basic configuration of the
explain. Referring to FIG. 1, a CPU to which the present invention is applied
The basic configuration of the simulator 1 is the target program 2
Converting means 10 into a simulation function calling sequence 13 and a memory 11 storing the simulation function calling sequence 13 and the simulation function group 14
And a host CPU 12 that executes a simulation function calling sequence 13 and a simulation function group 14.

The target program 2 includes a target C
This is a program developed for a PU (not shown; the same applies hereinafter), and is composed of instruction codes 2-1 to 2-n at the machine language level of the target CPU.

The simulation function group 14 is a set of simulation functions 14-1 to 14-m. Each simulation function 14-1 to 14-m is a target CP
The instruction codes correspond to the instruction codes at the machine language level of U on a one-to-one basis, and simulate the instruction codes of the corresponding target CPU. Each simulation function 14-1 to 14-
m can be described in any language, and in this example , the C language is used.

When simulating the operation of the target CPU according to the target program 2, the CPU simulator 1 activates the conversion means 10 before executing the simulation.

The conversion means 10 converts the target program 2
Of the instruction codes 2-1 to 2-n are sequentially read and interpreted, and the instruction codes 2-1 to 2-n are simulated by calling simulation functions 14-1 to 14-m for simulating the instruction codes 2-1 to 2-n. -1 to 13-n
Convert to Simulation function call 13-1
As the description language of 13-n, assembler language or machine language is used.

For example, when the simulation function for simulating the instruction code 2-1 is 14-1, the conversion means 10 converts the instruction code 2-1 into the simulation function 14-1.
Simulation function call 13-1 to call -1
If the simulation function for simulating the instruction code 2-2 is 14-m, the instruction code 2
-2 is converted into a simulation function call 13-2 for calling the simulation function 14-m. Further, when the instruction code 2-n is the same instruction code as the instruction code 2-1, the instruction code 2-n is converted into the simulation function call 1 that calls the simulation function 14-1.
Convert to 3-n.

The conversion means 10 stores the converted simulation function calls 13-1 to 13-n as the simulation function call sequence 13 in the memory 11 or an external storage device (not shown).

When the simulation function call sequence 13 is generated on the memory 11 by the conversion means 10, the CPU simulator 1 transmits the simulation function call sequence 13 to the host CPU 12 when the simulation function call sequence 13 is generated at the machine language level. Is executed.

The host CPU 12 first executes a simulation function call corresponding to the execution start address of the target program. Therefore, if the simulation function call 13-1 is a simulation function call corresponding to the execution start address of the target program, the host CPU 12 first executes the simulation function call 13-1. Thus, in the above-described example, the simulation function 14-1 is called and executed, and the instruction code 2-1 is simulated.

When the execution of the simulation function 14-1 is completed, the host CPU 12 executes the next simulation function call 14-2. Thus, in the above-described example, the simulation function 14-m is called and executed, and the instruction code 2 is simulated.

Subsequently, the corresponding simulation functions 14-1 to 14-m in the simulation function group 14 are called by repetition of the above-described operation, whereby the operation of the target CPU according to the target program 2 is simulated on the host CPU 12. Is done.

The simulation function call sequence 1
3 is generated at the assembler language level, C
The PU simulator 1 assembles this to generate a simulation function call sequence at a machine language level, and executes it on the host CPU 12 to execute a simulation. When the simulation function call sequence 13 output by the conversion means 10 is stored in the external storage device, the CPU simulator 1 starts execution after reading the simulation function call sequence from the external storage device into the memory 11. .

FIG. 2 is a functional block diagram showing an example of the configuration of the conversion means 10, which comprises an instruction code reading unit 101, an instruction interpretation unit 102, an instruction conversion unit 103, and an output unit 104.

The instruction code reading unit 101 sequentially reads the target program 2 of FIG. 1 stored in a memory, a file, or the like (not shown) one instruction code at a time from the beginning, and transmits the instruction code to the instruction interpretation unit 102.

The instruction interpreter 102 receives the instruction code transmitted from the instruction code reader 101, that is, the target CP.
It interprets what type of instruction code is at the machine language level for U, determines the type of instruction, registers, memory addresses, constants, etc. used for the instruction, and transmits the determination result to the instruction conversion unit 103. I do.

The instruction conversion unit 103 determines the target CPU based on the determination result transmitted from the instruction interpretation unit 102.
A simulation function call for calling a simulation function for simulating a machine language level instruction code is generated at the assembler language level or the machine language level of the host CPU 12.

For example, the target CPU is an Intel 16-bit processor 8086, and the host CPU 1
If 2 is a MIPS 32-bit processor R3000, the instruction conversion unit 103 generates a simulation function call that calls a simulation function that can execute the instruction code of 8086 in R3000.

The following is an example of an instruction of 8086, a call of a simulation function executed by R3000, and a simulation function. Note that the 8086 instruction and R300
The simulation function call of 0 is expressed in assembler notation, and the simulation function of R3000 is expressed in C language and assembler language.

８０ Instruction of 8086 MOV AX, 0x1000 / * 3 byte instruction * / シ ミ ュ レ ー シ ョ ン Simulation function call lia0, AX / * Argument preparation (AX is a constant value) * / li1, 0x1000 / * Argument preparation * / jal F_MOV / * Call function * / ○ Simulation function In C language F_MOV (reg, imm) int reg; short imm; ｛Reg [reg] = imm; / * Reg [] is a variable that holds register information * /｝ In assembler language .glob F_MOV .ent F_MOV F_MOV: sl a0,2 / * a0 register contains register number * / lit0, Reg / * Reg is an array that holds register information * / add t0, a0 sw a1, (t0) / * a1 Values that are stored * / j ra .end F_MOV

The instruction of 8086 ADD AX, BX The simulation function call lia0, AX / * Preparation of arguments (AX is a constant value) * / lia1, BX / * Preparation of arguments * / jarF_ADD / * Function call * / ○ Simulation function In case of C language F_ADD (reg1, reg2) int reg1, reg2; ｛Reg [reg1] + = Reg [reg2]; if (Reg [reg1] == 0) ０PSW | = PSW_Z; / * PSW is a variable that holds status register information * PSW_Z is a constant representing the Z flag * / {if (Reg [reg1] & 0x8000)} if (Reg [reg1] == 0)} PSW | = PSW_S; / * PSW_S Is a constant indicating the S flag * /｝｝ 場合｝ In the assembler language .g obl F_ADD .ent F_ADD F_ADD: sl a0,2 sl a1,2 / * a0, a1 have register number * / lit0, Reg / * Reg is array holding register information * / add t0, a0 lit1 , Reg add t1, a1 lw t2, (t0) lw t3, (t1) add t2, t3 sw t2, (t0) lit 4, PSW / * PSW processing * / lw t5, (t4) beqz t2, L1 ori t5, PSW_Z L1: andi t6, t2, 0x8000 bne t6, 0, L2 ori t5, PSW_S L2:... end F_ADD

As can be seen from the specific example described above, the instruction conversion unit 103 determines
A simulation function call including an instruction for preparing parameters (arguments) and a function call that actually calls the simulation function is generated.

When the instruction conversion unit 103 generates a simulation function call, the instruction conversion unit 103 transmits the generated simulation function call to the output unit 104, and outputs the simulation function call to the output unit 104.
4 sequentially stores them in the memory 11 of FIG. 1 or an external storage device (not shown).

At this time, the instruction conversion unit 103 stores the address of the current instruction code of the target CPU on the target CPU and the address of the currently generated simulation function call of the host CPU 12 on the host CPU 12 (consisting of a plurality of instruction codes). In the case of a simulation function call, the address of the first instruction code is registered in the internal address correspondence table 103-1.

This address correspondence table 103-1 is referred to at the time of conversion of a branch instruction code whose branch destination is determined before execution. That is, when the instruction code of the target CPU is a branch instruction code that branches to the address X, the instruction conversion unit 103 determines which address the address X corresponds to on the converted host CPU 12 in the address correspondence table 103-1.
To generate a simulation function call that transfers the obtained branch destination address to the simulation function as an argument. It is also possible to convert to a branch instruction of the host CPU 12 without calling the simulation function.

However, if the current branch instruction code is an instruction that branches to a subsequent instruction code that has not yet been processed, the address correspondence of that part has not been registered in the address correspondence table 103-1. In this case, the simulation function call in which the dummy branch destination address is set is stored in the internal conversion result temporary storage means 103-2, and the address correspondence between the current branch instruction code and the simulation function call is stored in the address correspondence table 103-1. And then converts the instruction code of the subsequent target CPU into a simulation function call, stores the conversion result in the conversion result temporary storage means 103-2 until an instruction code that can determine the branch destination address appears, and The address relation is registered in the address correspondence table 103-1. When the branch destination address is determined, the dummy branch destination address is changed to a correct address, and the simulation function call after the correction and the subsequent conversion result are converted. Subsequent systems stored in the temporary storage 103-2. Together with Interview configuration function call sent to the output unit 104 outputs to the memory 11 or the external storage device (not shown).

FIG. 3 is a functional block diagram of a CPU simulator according to one embodiment of the present invention. The CPU simulator 3 of this embodiment includes a conversion means 30 for converting the target program 4 into a simulation function call sequence 33, a memory 31 for storing the simulation function call sequence 33, the simulation function group 34 and the register simulator 35, and a simulation function call sequence. Host CP executing the column 33 and the simulation function group 34
U32.

The target program 4 includes a target C
It is a program developed for PU and target CP
It is composed of U machine language level instruction codes 4-1 to 4-n. Here, the size of the first instruction code 4-1 is 1 byte, and the address 0 on the target CPU.
At the address, the size of the next instruction code 4-2 is 2 bytes, and it is located at address 1 on the target CPU, and the last instruction code 4-n is 1 byte at the address n on the target CPU. positioned.

The simulation function calling sequence 33 is
The conversion means 30 is generated by processing the target program 4 and includes simulation function calls 33-1 to 33-n expressed at the assembler language level or the machine language level of the host CPU 32. Here, the first simulation function call 33-1 is 1
The size of the instruction code 4-1 is converted to N (N is a positive integer) bytes.
In the address space of No. 2, it is located at a position starting from address A. Next simulation function call 33-
2 is a 2-byte instruction code 4-2 converted and has a size of 2N bytes, which is stored in the area of the memory 31 following the immediately preceding simulation function call 33-1.
The last simulation function call 33-n is obtained by converting a 1-byte instruction code 4-n, has a size of N bytes, and is stored in an area of the memory 31 following the immediately preceding simulation function call (not shown). ing.

That is, in this embodiment, the conversion means 30
Is a simulation function call 33-1 in which each instruction code 4-1 to 4-n at the machine language level of the target program 4 is constituted by a number of bytes that is a constant multiple (N times) of the number of bytes of the conversion source instruction code. ~ 33-n.

The simulation function group 34 is a set of simulation functions 34-1 to 34-m, and is described in, for example, the C language. Each simulation function 34
-1 to 34-m correspond one-to-one to each instruction code at the machine language level of the target CPU, and simulate the corresponding instruction code of the target CPU.

The register simulator 35 is a set of registers associated with the registers to be simulated on the target CPU on a one-to-one basis.
32 simulates a register on the target CPU by referring to and updating this register simulator 35.

In the embodiment of FIG. 3, the CPU simulator 3 executes the target C
When performing the simulation of the operation of the PU, the conversion unit 30 is activated prior to the execution of the simulation.

The conversion means 30 comprises an instruction code reading unit 301, an instruction interpretation unit 302, an instruction conversion unit 303, and an output unit 304, as shown in FIG. 4, for example.
When activated, first, the instruction code reading unit 301 sequentially reads the target program 4 of FIG. 3 stored in a memory or a file (not shown) one instruction code at a time from the beginning, and transmits the instruction program to the instruction interpretation unit 302.

The instruction interpreting unit 302 interprets what kind of instruction the instruction code transmitted from the instruction code reading unit 301 is, and determines the type of instruction, a register used for the instruction, a memory address, a constant, and the like. , And transmits the determination result to the instruction conversion unit 303.

The instruction conversion unit 303 determines the target CPU based on the determination result transmitted from the instruction interpretation unit 302.
A simulation function call for calling a simulation function for simulating a machine language level instruction code is generated in an assembler language of the host CPU 32 or a machine language level.

For example, the target CPU is an Intel 16-bit processor 8086, and the host CPU 3
In the case where 2 is a MIPS 32-bit processor R3000, the instruction conversion unit 303 generates a simulation function call for calling the instruction function of 8086 with a simulation function executable by R3000.

At this time, the instruction conversion unit 303 adjusts the converted simulation function call so that the number of bytes is N times the number of the conversion source instruction code. That is, as described above, the 1-byte instruction codes 4-1 and 4-n are converted into N-byte simulation function calls 33-1 and 33-n.
The 2-byte instruction code 4-2 converts an i-byte instruction into an iN-byte simulation function call, such as a 2N-byte simulation function call 33-2. This is because an optimum value of N is determined in advance, and if the number of bytes of the generated simulation function call matches N times the number of bytes of the original instruction code,
As a result, the generated simulation function call itself is used as a result.
This is realized by adding an instruction such as an instruction that does not perform any processing.

Hereinafter, when the above N is 16,
86 shows an example of an instruction 86, a simulation function call executable by R3000, and a simulation function. The instruction of 8086 and the simulation function call of R3000 are expressed in assembler notation, and the simulation function of R3000 is expressed in C language.

８０ Instruction of 8086 MOV AX, 0x1000 / * 3 byte instruction * / シ ミ ュ レ ー シ ョ ン Simulation function call lia0, AX / * Preparation of arguments (AX is a constant representing a register) * / lia1, 0x1000 / * Preparation of arguments * / Jar F_MOV / * Call of simulation function * / nop / * nop instruction for multiplying by a constant * / nop nop nop nop nop nop nop o Simulation function F_MOV (reg, imm) int reg; = 3; Reg [reg] = imm; / * Reg [reg] is a variable that holds register information * /｝

When the instruction code of the conversion source is an instruction code whose branch destination address is not known until execution of a register indirect branch, a register indirect subroutine call, or the like, the instruction conversion unit 303 executes a branch on the target CPU in the register simulator 35. From the contents of the register holding the destination address (referred to as address X) and the magnification N, the address in the simulation function call sequence to be branched is calculated as the start address of the simulation function call sequence 33 +
(N × X) is converted into a simulation function call that calls a simulation function including an instruction sequence that transfers control to that address. Below, an example of the register indirect branch instruction of 8086, an example of the simulation function call of the R3000 after the conversion, and an example of the simulation function of the R3000 called by this are shown.

Instruction of 8086 JMP [BX] / * 2 byte instruction * / Simulation function call lia0, BX / * BX is a constant representing a register * / jar F_JMP_R / * Call simulation function * / nop / * Branch Nop * / jv0 / * v0 for filling the delay slot is the return value of F_JMP_R () * / nop nop nop nop Simulation function F_JMP_R (reg) int reg; ｛unsigned long addr; PC = Regreg; = ((Reg [CS] << 4) + PC) * 16 + START_SDDRESS; / * 16 is the value of a constant multiple N, START_SDDRESS is the start address of the converted code * / return (addr)｝

That is, in the case of the register indirect branch of 8086 in which the value held in the BX register is recognized as an address and branch is made to the address, a simulation function call for calling the simulation function F_JMP_R with a constant representing the register BX as an argument is generated. I do. In the simulation function F_JMP_R, the value of the register (Reg [reg]) holding the address of the branch destination on the 8086 is referred to from the register simulator 35 by PC = Reg [reg]; And then execute addr = ((Reg [CS] << 4) + PC) * 16 + START_SDDRESS; Since the address of the instruction to be executed in the 8086 is specified by the segment register (here, CS) and the PC, the address on the 8086 is calculated by (Reg [CS] << 4) + PC. By adding the head address of the simulation function calling sequence 33 to the product of the constant 16 and the host C to be branched,
Find the address on PU32. Then, the obtained address is returned as a return value by return (addr). Since this return value is stored in the V0 register in the case of R3000, the simulation function call branches to the simulation function call sequence 33 corresponding to the instruction to be simulated next by executing j v0.

The instruction conversion unit 303 also converts a branch instruction code whose branch destination has been determined before execution. In this embodiment, the instruction conversion unit 303 corresponds to the address of the instruction code of the target CPU on the target CPU. Since the address of the simulation function call on the host CPU 32 is obtained by calculation, the address correspondence table 1 shown in FIG.
03-1 and the conversion result temporary storage means 103-2 are basically unnecessary.

When the instruction conversion unit 303 generates a simulation function call, the instruction conversion unit 303 transmits the generated simulation function call to the output unit 304, and outputs the simulation function call to the output unit 30.
4 sequentially stores them in the memory 31 of FIG. 3 or an external storage device (not shown).

When the simulation function calling sequence 33 is generated on the memory 31 by the conversion means 30, the CPU simulator 3 transmits the simulation function calling sequence 33 to the host CPU 32 when the simulation function calling sequence 33 is generated at the machine language level. Is executed.

The host CPU 32 first executes a simulation function call corresponding to the execution start address of the target program. Accordingly, if the simulation function call 33-1 is a simulation function call corresponding to the execution start address of the target program, the host CPU 32 first executes the simulation function call 33-1. Thus, in the above-described example, the simulation function 34-1 is called and executed, and the instruction code 4-1 is simulated while referring to and updating the value of the register in the register simulator 35.

When the execution of the simulation function 34-1 ends, the host CPU 32 executes the next simulation function call 33-2. Thus, in the above-described example, the simulation function 34-m is called and executed, and the instruction code 4-2 is simulated while referring to and updating the value of the register in the register simulator 35.

Subsequently, the corresponding simulation functions 34-1 to 34-m in the simulation function group 34 are called by repetition of the above-described operation, whereby the operation of the target CPU according to the target program 4 is simulated on the host CPU 32. Is done.

The simulation function calling sequence 3
3 is generated at the assembler language level, C
The PU simulator 3 assembles this to generate a simulation function call sequence at a machine language level, and executes this on the host CPU 32 to execute a simulation. Further, when the simulation function calling sequence 33 output by the conversion means 30 is stored in the external storage device, the CPU simulator 3 starts executing after reading the simulation function calling sequence from the external storage device into the memory 31. .

FIG. 5 is a functional block diagram of a CPU simulator according to another embodiment of the present invention. The CPU simulator 5 of this embodiment converts a target program 6 into a simulation function calling sequence 53 and generates an address conversion table 56, a simulation function calling sequence 53, and a simulation function group 5.
4, a memory 51 for storing a register simulator 55, an address conversion table 56, and a debugging means 57;
And a host CPU 52 that executes a simulation function calling sequence 53 and the like.

The target program 6 includes a target C
It is a program developed for PU and target CP
It is composed of U machine language level instruction codes 6-1 to 6-n. Here, the first instruction code 6-1 is located at address 0 on the target CPU, the next instruction code 6-2 is located at address 1 and the last instruction code 6-n is located at address n. doing.

The simulation function calling sequence 53 is
The conversion means 50 is generated by processing the target program 6 and includes simulation function calls 53-1 to 53-n expressed at the assembler language level or the machine language level of the host CPU 52. Here, the first simulation function call 53-1 is obtained by converting the instruction code 6-1, the next simulation function call 53-2 is obtained by converting the instruction code 6-2, and the last simulation function call 53-n is obtained by The instruction code 6-n is converted, and the host CPU 5
2, the addresses A, B,
.., N. In this embodiment, unlike the embodiment of FIG. 3, the basic structure of FIG.
Each simulation function calls in the same way as adult 53-1～
53-n is not restricted by N times the number of bytes of the original instruction code, and is generated so that the code amount is as small as possible.

The address conversion table 56 is stored in the
0 is generated by processing the target program 6. For example, as shown in FIG.
, 6-2,..., Machine code level instruction codes
6-n addresses 0, 1,..., N on the target CPU
Is used as an index, and the host C of the converted simulation function calls 53-1, 53-2,..., 53-n
The addresses A, B,..., N in the address space of the PU 52 are held. As will be described later, at the time of debugging, addresses of various functions constituting the debugging means 57 are stored in the address conversion table 56.

The simulation function group 54 is a set of simulation functions 54-1 to 54-m. Each simulation function 54-1 to 54-m is a target CP
The instruction codes correspond to the instruction codes at the machine language level of U on a one-to-one basis, and simulate the instruction codes of the corresponding target CPU. Simulation functions 54-1 to 54-m
Is described, for example, in the C language.

The register simulator 55 is a set of registers associated with the registers to be simulated on the target CPU in one-to-one correspondence.
52 simulates a register on the target CPU by referring to and updating this register simulator 55.

The debugging means 57 supports debugging of the target program 6, and includes a breakpoint setting function 57-1 and a breakpoint processing function 57-
2 and an illegal address execution time processing function 57-3.

The breakpoint setting function 57-1 is a function executed by the host CPU 52 in accordance with an instruction from an input means such as a keyboard (not shown), and performs a breakpoint processing on an address corresponding to an arbitrary index in the address conversion table 56. Address Brk_ of function 57-2
Perform processing to change to point.

The breakpoint processing function 57-2 is executed by the host CPU 52 to execute
52 is a function to wait for input. After that, the user can input various commands to refer to the memory 51 and the register. When the continuation of the process is designated, the process returns from the breakpoint processing function 57-2 and the process is continued.

The illegal address execution time processing function 57-3 is
By being called and executed by the host CPU 52, processing such as the fact that an incorrect address has been executed from an output unit such as a CRT (not shown) and the output of the address are performed. The address of the illegal address execution processing function 57-3 is Addr_err.

In the embodiment shown in FIG. 5, the CPU simulator 5
When performing the simulation of the operation of the PU, the conversion unit 50 is activated prior to the execution of the simulation.

As shown in FIG. 7, for example, the conversion means 50 comprises an instruction code reading section 501, an instruction interpretation section 502, an instruction conversion section 503, and output sections 504 and 505. Instruction code reading unit 50
Reference numeral 1 sequentially reads the target program 6 shown in FIG.

The instruction interpreting unit 502 interprets what kind of instruction the instruction code transmitted from the instruction code reading unit 501 is, and determines the type of instruction, a register used for the instruction, a memory address, a constant, and the like. , And transmits the determination result to the instruction conversion unit 503.

The instruction conversion unit 503 determines the target CPU based on the determination result transmitted from the instruction interpretation unit 502.
A simulation function call for calling a simulation function for simulating a machine language level instruction code is generated in the assembler language of the host CPU 52 or the machine language level.

For example, the target CPU is an Intel 16-bit processor 8086, and the host CPU 3
If 2 is a MIPS 32-bit processor R3000, the instruction conversion unit 503 generates a simulation function call that calls a simulation function that can execute the instruction code of 8086 in R3000.

The following is an example of the instruction of 8086, the call of the simulation function of R3000, and the simulation function. Note that the instruction of 8086 and the simulation function call of R3000 are expressed in assembler notation, and R30
The simulation function of 00 is shown in C language.

Instruction of 8086 (example of normal instruction) MOV AX, 0x1000 / * 3-byte instruction * / Simulation function call lia0, AX / * AX is a constant representing a register * / lia1, 0x1000 jar F_MOV / * Call of simulation function * / nop / * nop to fill branch delay slot * / j v0 nop / * nop to fill branch delay slot * / ○ Simulation function F_MOV (reg, imm) int reg; short imm; ＰＣ PC + = 3; Reg [reg] = imm; / * Reg [] is a variable that holds register information * / return (AddrTbl [(Reg [CS] << 4) + PC]); / * AddrTbl [] Is the address conversion table 56 * /｝

In the above simulation function, return (AddrTbl [(Reg [CS] <<<<
4) + PC]); is the address (Reg [C
S] << 4) Using the + PC as an index, refer to the address conversion table 56, obtain the address on the host CPU 52 corresponding to the index, and return it as a return value. The simulation function caller executes j v0 As a result, the process branches to the part of the simulation function call sequence 53 corresponding to the instruction to be simulated next. The reason for this is to enable debugging using the address conversion table 56 as described later. However, even when debugging is not taken into account, it is necessary to simulate interrupt processing. .

If the instruction code of the conversion source is an instruction code whose branch destination address is not known until execution of a register indirect branch, a register indirect subroutine call, or the like, the instruction conversion unit 503 executes the simulation on the target CPU. Based on the branch destination address and the contents of the address conversion table 56, an address in the simulation function call sequence 53 to be branched is obtained, and is converted into a simulation function call that calls a simulation function including an instruction sequence that transfers control to the address. Below, an example of the register indirect branch instruction of 8086, an example of the simulation function call of the R3000 after the conversion, and an example of the simulation function of the R3000 called by this are shown.

Instruction of 8086 JMP [BX] / * 2 byte instruction * / ○ Simulation function call lia0, BX / * BX is a constant representing a register * / jar F_JMP_R / * Call of simulation function * / nop / * branch Nop * / jv0 / * v0 for filling the delay slot is the return value of F_JMP_R () * / nop / * nop * / for filling the branch delay slot Simulation function F_JMP_R (reg) int reg; ｛PC = Reg [Reg]; return (AddrTbl [(Reg [CS] << 4) + PC]); / * AddrTbl [] is an address conversion table 56 * / {

That is, in the case of JMP [BX], the simulation function F
Generate a simulation function call that calls _JMP_R. In the simulation function F_JMP_R, the value of the register (Reg [reg]) holding the address of the branch destination on the 8086 is referred to from the register simulator 55 by PC = Reg [reg]; , And then return (AddrTbl [(Reg [CS] <<
4) + PC]); Since the address of the instruction to be executed in the 8086 is specified by the segment register (here, CS) and the PC, the address on the 8086 is calculated by (Reg [CS] << 4) + PC, and The address conversion table 56 is referred to as an index, and the obtained address is returned as a return value. By executing j v0, the simulation function call side branches to the simulation function call sequence 53 corresponding to the instruction to be simulated next.

Note that the instruction conversion unit 503 also converts a branch instruction code whose branch destination has been determined before execution. In this embodiment, the instruction conversion unit 503 corresponds to the address of the instruction code of the target CPU on the target CPU. Since the address of the simulation function call on the host CPU can be obtained from the address conversion table 56, the address correspondence table 103-1 and the conversion result temporary storage means 103-2 as shown in FIG. 2 are basically unnecessary. It is. less than,
An example of a branch instruction of 8086, an example of a simulation function call of R3000 after the conversion, and an example of a simulation function of R3000 called by this are shown.

Instruction of 8086 JMP 0x2000 / * 2-byte instruction * / O Simulation function call lia0,0x2000 jar F_JMP / * Call of simulation function * / nop / * nop * / jv0 / to fill branch delay slot * V0 is the return value of F_JMP () * / nop / * nop for filling the branch delay slot * / ○ Simulation function F_JMP (addr) unsigned short reg; ＰＣ PC = addr; return (AddrTbl [(Reg [CS] < <4) + PC]); / * AddrTbl [] is an address conversion table 56 * / {

When the instruction conversion unit 503 generates the simulation function call, the instruction conversion unit 503 transmits the generated simulation function call to the output unit 504, and outputs the simulation function call.
4 sequentially stores them in the memory 51 of FIG. 5 or an external storage device (not shown).

The instruction conversion unit 503 outputs the output unit 505 every time one instruction in the target program 6 is converted.
And outputs one entry of the address conversion table to the memory 51 or an external storage device (not shown). Thus, when the conversion of all the instructions of the target program 6 is completed, the addresses 0, 1 on the target CPU of the instruction codes 6-1, 6-2,. ,..., N as indexes, the converted simulation function call 53-1,
., N in the address space of the host CPU 52 of 53-2,..., 53-n are generated in the memory 51 or an external storage device (not shown) as shown in FIG. . When the address conversion table 56 is generated in the external storage device, the memory 5 is stored in the external storage device before starting the simulation.
It is necessary to read the address conversion table 56 onto the address 1.

When the instruction to debug is given, the instruction conversion unit 503 sends the instruction
The address Addr_err of the illegal address execution time processing function 57-3 is set in the address conversion table 56 by using an address other than the head address of the instruction codes 6-1 to 6-n as an index. For example, when a 2-byte instruction code starts from address 1, address 2 is in the middle of a 2-byte instruction code, and the instruction code does not start from that address.
_Err is set.

Next, the operation of the embodiment of FIG. 5 when executing a simulation will be described. First, the operation when the debug function is not used will be described.

When receiving an instruction to start execution of a simulation from an input unit (not shown), the CPU simulator 5 calls the simulation function call sequence on the memory 51 to the host CPU 52 when the simulation function call sequence 53 is generated at the machine language level. The column 53 is executed.

The host CPU 52 first executes the simulation function call 53-1 at the head of the simulation function call sequence 53. Thus, in the above-described example, the simulation function 54-1 is called and executed, and the instruction code 6-1 is simulated. In this function, the following processing is generally performed. (A) Update the value of PC in the register simulator 55. (B) Refer to and update the contents of the register and memory specified by the argument and perform necessary processing. (C) If necessary, change the PSW. (D) In the case of a branch instruction, a branch destination address on the host CPU is obtained. (E) Return the return value.

When the execution of the simulation function 54-1 is completed, in this embodiment, the control temporarily returns to the call of the simulation function call 53-1 of the caller, and branches to the address indicated by the return value. As a result, control is transferred to the simulation function calling sequence 53 corresponding to the instruction to be simulated next.

Thereafter, the corresponding simulation functions 54-1 to 54-m in the simulation function group 54 are called by repetition of the above-described operation, whereby the operation of the target CPU according to the target program 6 is simulated on the host CPU 52. Is done.

Next, the operation when the debug function is used will be described.

When the CPU simulator 5 receives an instruction to start execution of a simulation involving debugging from an input means (not shown), it waits for an input.

In this state, the user activates the break point setting function 57-1 of the debugging means 57 from the input means (not shown), so that the break point processing function is set to the address corresponding to an arbitrary index in the address conversion table 56. 57-2 can be set. If a breakpoint is to be set in the instruction code 6-2 at the address 1 of the target program 6, the address to be set is specified and the program is started. The breakpoint setting function 57-1 stores the address shown in FIG. Breakpoint processing function 57
-2 address Brk_point is set.

When the instruction to perform debugging is given, the instruction conversion unit 503 generates the address conversion table 56 as described above.
An illegal address execution time processing function 57-
The address Addr_err of No. 3 is set in the address conversion table 56 as illustrated in FIG.

When the start of execution is instructed thereafter by an input means (not shown), the CPU simulator 5 sends the memory 51 to the host CPU 52 when the simulation function calling sequence 53 is generated at the machine language level.
The above simulation function calling sequence 53 is executed,
The host CPU 52 starts execution from the first simulation function call 53-1 of the simulation function call sequence 53.

Then, the target program 6
Is executed, the address conversion table 56
, There is a breakpoint processing function 57
−2 is set, the host CPU 5
2 calls the breakpoint processing function 57-2. As a result, the host CPU 52 waits for an input from the user.

In this state, when the user inputs various commands related to debugging, the host CPU 52 executes them. Thus, the contents of the memory 51 and the register can be displayed on a CRT (not shown). Then, when the continuation of the processing is designated, the host CPU 5
2 returns from the breakpoint processing function 57-2, and the processing is continued.

In the execution of the simulation,
When an address other than the head address of the instruction code, for example, address 2 is executed in the target program 6,
Referring to the address conversion table 56, the address of the illegal address execution time processing function 57-3 is set therein. Therefore, since the host CPU 52 calls and executes the illegal address execution time processing function 57-3, an abnormality can be detected.

The above-described breakpoint and illegal address execution detection only change the contents in the address conversion table 56, and do not lower the simulation execution speed.

The embodiments of the present invention have been described above.
The present invention is not limited to the above embodiments, and various other additions and changes are possible. For example, in each of the above embodiments, the conversion means is provided separately from the host CPU, but the conversion means may be realized by the function of the host CPU.

[0109]

As described above, according to the present invention,
The following effects can be obtained.

As in the case of the already proposed CPU simulator, each instruction code at the machine language level of the target CPU is
Instead of converting to a combination of PU instruction codes,
Since the conversion into a simulation function call that calls a simulation function prepared in advance, the amount of code after the conversion can be minimized. In particular, in the case of a target program including many instruction codes such that one instruction code is converted into many instruction codes of the host CPU,
The amount of code can be significantly reduced.

If the target program contains many instruction codes of the same type and the instruction codes are converted into a large number of instruction codes of the host CPU, the proposed CPU simulator uses each of them. Is converted into a large number of instruction codes of the host CPU, the converted code amount becomes enormous. However, in the present invention, the converted simulation function call for each of the above-mentioned instruction codes of the same kind and the call by the simulation function call are executed. Since only a common simulation function is required, the overall code amount can be reduced even when the code amount of the simulation function is taken into account.

Since the code amount can be reduced in this way, for example, a simulation can be performed even with a host CPU having a small main storage capacity, and the number of page-outs can be reduced with a host CPU using a virtual memory management mechanism by paging. In addition, the host CPU having the cache mechanism can be expected to improve the cache hit ratio, and the simulation can be sped up as compared with the proposed CPU simulator.

Further, in the present invention, the instruction codes of the target CPU are interpreted at the previous stage as in the case of the already proposed CPU simulator, so that the instruction codes of the target CPU are interpreted one by one when executed on the host CPU. Simulations faster than conventional CPU simulators are possible.

In a configuration in which each instruction code at the machine language level of the target program is converted into a simulation function call composed of a number of bytes that is a constant multiple of the number of bytes of the instruction code, an instruction whose branch destination is known before execution is executed. There is an advantage that the branch destination of the code can be obtained by calculation, and the address in the simulation function call sequence to be branched from the branch destination address on the target CPU obtained as a result of register simulation and the constant multiple magnification. Can be obtained by calculation. By adopting a configuration that includes an instruction sequence that transfers control to the obtained address, it is possible to obtain a target program whose branch destination address is not known until execution, such as register indirect branch or register indirect subroutine call. Simulate machine language level instruction codes It can be down.

The address on the target CPU of each instruction code at the machine language level of the target program, and the host CPU of the simulation function after the conversion of the instruction code
The configuration for generating the address conversion table indicating the correspondence with the above address has an advantage that by modifying the address conversion table, another function for debugging or the like can be called and executed during the simulation, and Since the address in the simulation function call sequence to be branched is obtained from the branch destination address on the target CPU obtained as a result of the register simulation and the contents of the address conversion table, an instruction sequence for transferring control to the obtained address is included. By adopting this configuration, it is not possible to know the branch destination address until execution such as register indirect branch, register indirect subroutine call, etc. without aligning the number of bytes of the simulation function call to a constant multiple of the number of bytes of the conversion source instruction code. Target program machine The simulation instruction code level can be achieved while suppressing the expansion of code size.

[Brief description of the drawings]

FIG. 1 shows the basic structure of a CPU simulator to which the present invention is applied.
It is a functional block diagram of the formation.

FIG. 2 is a functional block diagram showing a configuration example of a conversion unit 10 of FIG.

FIG. 3 is a functional block diagram of a CPU simulator according to an embodiment of the present invention;

FIG. 4 is a functional block diagram showing a configuration example of a conversion unit 30 in FIG. 3;

FIG. 5 is a functional block diagram of another embodiment of a CPU simulator to which the present invention is applied.

FIG. 6 is a diagram showing an example of contents of an address conversion table 56 of FIG. 5;

FIG. 7 is a functional block diagram showing a configuration example of a conversion unit 50 of FIG.

FIG. 8 is a diagram showing another example of the contents of the address conversion table 56 of FIG. 5;

[Explanation of symbols]

1, 3, 5 ... CPU simulator 10, 30, 50 ... conversion means 11, 31, 51 ... memory 12, 32, 52 ... host CPU 13, 33, 53 ... simulation function call sequence 13-1 to 13-n, 33 -1-33-n, 53-1
53-n: Call of simulation function 14, 34, 54: Simulation function group 14-1 to 14-m, 34-1 to 34-m, 54-1
54-m: Simulation function 2, 4, 6 ... Target program 2-1 to 2-n, 4-1 to 4-n, 6-1 to 6-n: Instruction code of machine language of target CPU 35, 55 ... Register simulator 56 ... Address conversion table 57 ... Debugging means

Claims (4)

(57) [Claims] 1. A target to be simulated
CP simulating CPU operation on host CPU
In the U simulator, each instruction code at the machine language level of the target CPU
Simulates a system executable by the host CPU.
The simulation function is transferred to the machine of the target CPU.
Simulation for storing the number of word-level instruction codes
Means function storage means, and a target program developed for the target CPU.
Interprets the instruction code at the machine language level of
Target program is called by the simulation function.
Is a set of simulation function calls
Conversion means for converting the
Te, each instruction code of the machine language level of the target program, and a converting means for converting the constructed simulation function call in bytes of constant multiple of bytes of the instruction code, generated by the conversion means Simulation function call
The execution sequence is executed by the host CPU,
Of the target CPU according to the target program
A CPU simulator having a configuration for simulating an operation . 2. The CPU simulator according to claim 1 , wherein the conversion unit obtains a result of register simulation corresponding to a machine language level instruction code of the target program whose branch destination address is not known until execution. A simulation function for calculating an address in a simulation function call sequence to be branched from the branch destination address on the target CPU and the magnification of the constant multiple, and calling a simulation function to return as a return value,
A CPU simulator for generating a simulation function call that branches to an address indicated by the return value when the called simulation function ends. 3. A target to be simulated.
CP simulating CPU operation on host CPU
In the U simulator, each instruction code at the machine language level of the target CPU
Simulates a system executable by the host CPU.
The simulation function is transferred to the machine of the target CPU.
Simulation for storing the number of word-level instruction codes
Means function storage means, and a target program developed for the target CPU.
Interprets the instruction code at the machine language level of
Target program is called by the simulation function.
Is a set of simulation function calls
Conversion means for converting the
Each instruction at the machine language level of the target program
Instruction code address on the target CPU;
Of the simulation function call after the
An address indicating the correspondence with the address on the host CPU
A translation table is generated, and a next address to be executed on the target CPU obtained as a result of register simulation is obtained from the contents of the address translation table in accordance with the instruction code at the machine language level of the target program. converting means for seeking an address in the simulation function call sequence to be performed with calling the simulation function to return as a return value, to generate a simulation function calls to branch to the address indicated by the return value at the end of the simulation function that called the in And a simulation function call generated by the conversion means.
The execution sequence is executed by the host CPU,
Of the target CPU according to the target program
A CPU simulator having a configuration for simulating an operation . 4. The CPU simulator according to claim 3 , wherein, other than the call for the simulation function, the address conversion table corresponds to an address on the target CPU set by the conversion unit or another address. A CPU simulator, wherein an address of a function is set.