Recently it occurred to me that a lot of emulators are slow because they have to simulate not just the CPU but also the memory of the emulated device. When the device has memory-mapped I/O, virtual memory, or just unused address space, then every memory access has to be simulated in software.
I feel like it might be a lot faster if the OS did this for us, by means of virtual memory. I'll use Game Boy emulation as an example for simplicity's sake but obviously this method would be better for newer, more powerful machines.
The Game Boy memory map is roughly:
- 0x0000 - 0x7FFF: Mapped to cartridge ROM
- Most cartridges have 0x0000 - 0x3FFF fixed and 0x4000 - 0x7FFF bank-switchable by writing to 0x2000
- 0x8000 - 0x9FFF: Video RAM (only accessible when not currently rendering)
- 0xA000 - 0xBFFF: Mapped to cartridge (usually battery-backed RAM)
- 0xC000 - 0xDFFF: Internal RAM (0xD000 - 0xDFFF is bankswitched on GB Color)
- 0xE000 - 0xFDFF: Mirror of internal RAM
- 0xFE00 - 0xFE9F: Object Attribute Memory (sprite RAM)
- 0xFEA0 - 0xFEFF: Unmapped (open bus or something, unsure)
- 0xFF00 - 0xFF7F: Memory-mapped I/O (sound system, video control, etc)
- 0xFE80 - 0xFFFF: Internal RAM
So a traditional emulator has to translate every memory access something like:
if(addr < 0x4000) return rom[addr];
else if(addr < 0x8000) return rom[(addr - 0x4000) + (0x4000 * cur_rom_bank)];
else if(addr < 0xA000) {
if(vram_accessible) return vram[addr - 0x8000];
else return 0xFF;
}
else if(addr < 0xC000) return saveram[addr - 0xA000];
else if(addr < 0xE000) return ram[addr - 0xC000];
else if(addr < 0xFE00) return ram[addr - 0xE000];
else if(addr < 0xFE9F) return oam[addr - 0xFE00];
else if(addr < 0xFF00) return 0xFF; //or whatever should be here
else if(addr < 0xFF80) return handle_io_read(addr);
else return hram[addr - 0xFF80];
Obviously that can be optimized by using a switch or table, but still it's a lot of code to run for every memory access. We could potentially improve the emulation speed quite a bit by mapping some pages to those addresses in our process's memory map:
- 0x0000 - 0x3FFF: R-- (no Exec flag because native CPU doesn't execute it)
- 0x4000 - 0x7FFF: R--
- 0x8000 - 0x9FFF: ---
- 0xA000 - 0xBFFF: ---
- 0xC000 - 0xDFFF: RW-
- 0xE000 - 0xFDFF: RW- (and mapped to same physical page as 0xC000 - 0xDFFF)
- 0xFE00 - 0xFE9F: ---
- 0xFEA0 - 0xFEFF: ---
- 0xFF00 - 0xFF7F: ---
- 0xFF80 - 0xFFFF: RW-
Then handle the SIGSEGV (or whatever signal would be generated) we get when accessing those pages. So a read from ROM or a write to RAM can just be performed directly, and a write to ROM will raise an exception which we can handle. We can change the permissions of VRAM (0x8000 - 0x9FFF) to be RW- when it should be accessible and --- when it shouldn't. In theory it could be much faster since it doesn't require the emulator to manually map every memory access in software.
I know that I can use mmap()
to map pages at fixed addresses with various permissions. What I don't know is:
- Can the mappings overlap, with different permissions?
- Can I map pages to arbitrary addresses like this, regardless of the system's page size? Can I map to address 0?
- How to change which memory a mapping points to? (eg when ROM bank is changed, we can just switch what memory is mapped at 0x4000 - 0x7FFF, but how do I do that?)
- In a real-world case where the emulated system has a 32- or 64-bit CPU, can I map the entire first 4GB, or potentially the entire memory space? How would I avoid conflicting with whatever is already mapped (eg libraries, my stack, the kernel)?
- Would this really be any faster? Or does throwing and catching a SIGSEGV generate more overhead than doing it the traditional way?
- If it's not possible to do this in userspace, does Linux maybe provide a way to "take over" the kernel and do it there? So I could at least create an "emulator OS" which runs bare-metal while still having some Linux kernel facilities (such as video and filesystem drivers) available?