ARMSim: An Instruction-Set Simulator for the ARM processor Alpa Shah [[email protected]] - Columbia University Abstract the ARMSim system. Hereafter, the A hardware simulator is a piece of software that machines that are simulated will be referred emulates specific hardware devices, enabling to as target machines, and the system on execution of software that is written and which the simulator is actually run is compiled for those devices, on alternate systems. referred to as the host machine. This paper describes a simulator for the ARM processor, which is widely used in embedded The remainder of the paper is organized as devices like PDAs, cellular phones etc. ARMSim follows: Section 2 discusses different is a lightweight ISA (Instruction Set simulation strategies, and then discusses ISS Architecture) level simulator and a trace strategies in detail. Existing related work on generator too. It has some optimizations at the simulators is discussed in Section 3. It also decoder level to improve performance. describes the ideas and design principles behind ARMSim. The structure and 1. Introduction architecture of ARMSim is presented in Simulator or Virtual machine technology is Section 4. Section 5 describes the realization an integral part of many computing systems of the design, and Section 6 discusses some today. This technology is incredibly useful possible extensions and concludes the since it makes it possible for users and paper. analyzers to test and execute software well before the actual hardware is available, or in 2. Simulation Strategies absence of the actual hardware. Some The best simulation method depends on the benefits of using simulators are: application of the simulation results. This section outlines several simulation strategies • Simulators are flexible and thus new and their applications. features or components can easily be added. • Architectural level Simulation: • It is possible to model anything, including Logic designers build Architectural something that might not be possible to simulators to express and test new designs. do on the hardware. These allow emulation of the different • It allows stress testing of programs like parts of a processor, using either the operating systems by simulating complex simple core, or the core and the data interrupt and exception conditions. caches and other components. These are • Since simulators are built in software, they generally not intended for executing are more deterministic. The deterministic target system binaries on an alternate behavior of simulators makes programs platform, but rather to allow research into execution reproducible, and thus helps in the modification of the internal datapaths locating problems. of the processor. Primary applications of simulators consist of • Direct Execution: computer architecture studies and Target machine binaries can be executed performance tuning of compiled software, natively on the simulator host processor and the compilation process itself. Various by encasing the program in an types of simulators exist, each addressing environment that makes it execute as different aspects like clock cycle rate, though it were on the simulated system. modeling the microprocessor chip logic, This technique requires that either the modeling the program execution host system have the same instruction set environment, etc. This paper concentrates as the target, or that the program be on an instruction set simulator [ISS] recompiled for the host architecture. implementation for the ARM processor[1], Instructions that cannot execute directly on the host are replaced with procedure ideas. These simulators are written to test calls to simulator code. This method is concepts and processor design tradeoffs; also known as Dynamic Recompilation flexibility is important and speed is not of [Dynarecs]. Native execution of the primary importance. They often gather recompiled code leads to a much faster statistics, and this constrains and slows execution of the simulated software, but down the simulator. ISS are also referred they have lengthy context switching, i.e. as “complete system instruction set when the host processor has to switch to simulator,” as well as “completer system target processes. This can make the simulator.” Furthermore, complete system simulation slower. Most direct execution simulators can be designed to be fully simulators statically inspect and translate deterministic. They effectively address all instructions before simulation begins. two major problems in real-time analysis: viz. difficulty in reproducing the effects of • Threaded Code[13]: program execution, and time distortion This is a simulation technique where each resulting from intrusion. Since simulators op-code in the target machine instruction are implemented fully in software, they set is mapped to the address of some can be fully tailored for specific uses. ISS (lower level) code in the simulator system, may not address issues like the delays to perform the appropriate operation. This from devices such as disk subsystems, and can be implemented efficiently in machine the memory hierarchy, including the code on most processors by simply memory management unit, caches and performing an indirect jump to the data-buses. Timing accuracy in ISS is of address, which is the next instruction. less importance than predictability This method does not suffer from lengthy preciseness, and determinism. An artificial context switching. system has few unpredictable factors. Thus, a simulated system starting • Instruction set simulators: execution in a known state will always Instruction set simulators [ISS] execute proceed along the same path. This is target machine programs by simulating useful for experiments and debugging the effects of each instruction on a target purposes. A user can detect misbehaving machine, one instruction at a time. blocks of code that take more than Instruction set simulators are attractive for expected time, and thus restart the process their flexibility: they can in principle, to examine the offending blocks in greater model any computer, gather any statistics, detail and thus trace the execution. and run any program that the target architecture would run. They easily serve Several techniques can improve the as backend systems for traditional performance of Instruction set simulators. debuggers as well as architecture design Instead of decoding the operation fields tools such as cache simulators. A lot of each time an instruction is executed, the temporal debuggers have recently started instruction is translated once into a form using ISS. An ISS can dispatch instructions that is faster to execute. This idea has been by fetching from a simulated memory, used in a variety of simulators for a isolating the operation code fields, and number of applications. Several efficient also branching, based on the values of memory models have also been proposed. these fields. Once dispatched, reading and manipulation of variables that represent 3. Existing Work the target system’s state are used to There has been a lot of research work on simulate the instruction’s semantics. software simulation of processors. These generally employ the above-mentioned When CPU architects design a new strategies in addition to some new methods. machine they typically write an This section describes some popular instruction-level simulator to test their simulators for different architectures, and also specific ones for ARM. The ARMSim co-processor instructions that vary widely system is compared with existing ARM- from system to system depending on the specific simulators. actual co-processor module available on the chip. ARMSim is used to execute ARM • SimOS[9]: SimOS takes a promising binaries on a different target machine, and approach that handles both user and gather some statistics based on the execution kernel code by dynamically translating of the binaries. It executes one instruction at target instructions into short sequences of a time and updates the processor state host-native code. Unlike most direct accordingly. execution simulators, SimOS keeps only a small part of the target machine’s state in 4. Structure of ARMSim host registers and so is able to multiplex ARMSim is a simulator of the 32-bit between target processors quickly. ARM RISC processor[1]. ARMSim simulates • Shade[2]: Shade simulates SPARC the entire instruction set except for those processor by using dynamic compilation. requiring use of the co-processor unit. The • Talisman[8]: Talisman is a simulator for co-processor is not a functional unit multicomputers based on the threaded- standard across all ARM processors, and it code strategy. was not possible to come up with a common • Mint[10]: Mint is a simulator for MIPS subset of operations that all co-processors R3000. would support. Figure (a) illustrates the processor of the ARM as simulated by The following are existing simulators ARMSim. The following are specific developed for the ARM processor, using functional features of ARMSim: some of the above-mentioned techniques: • System binaries: ARMSim takes in binaries • ARMPhetmaine[12]: this simulator is based for ARM processor for simulation, instead on the direct compilation technique. of assembly code. Thus, code compiled for • tARMac: also based on the same method. the target processor can be directly • SWARM[11]: initially designed as an ARM executed. module to plug into the SimOS system • Binary data representation: ARMSim treats developed at Stanford University. It is data