Specification-Driven Dynamic Binary Translation
Total Page:16
File Type:pdf, Size:1020Kb
Specification-Driven Dynamic Binary Translation Jens Tr¨oger December 2004 A dissertation submitted in partial fulfillment of the requirements for the degree Doctor of Philosophy in Computer Science OUT Programming Languages and Systems Research Group Faculty of Information Technology Queensland University of Technology Brisbane, Australia Copyright c Jens Tr¨oger, MMIV. All rights reserved. [email protected] http://savage.light-speed.de/ The author hereby grants permission to the Queensland University of Technology to reproduce and distribute publicly paper and electronic copies of this thesis document in whole or in part. “But I’ve come to see that as nothing can be made that isn’t flawed, the challenge is twofold: first, not to berate oneself for what is, after all, inevitable; and second, to see in our failed perfection a different thing; a truer thing, perhaps, because it contains both our ambition and the spoiling of that ambition; the exhaustion of order, and the discovery – in the midst of despair – that the beast dogging the heels of beauty has a beauty all of its own.” Clive Barker (Galilee) Keywords Machine emulation; formal specification of machine instructions; dynamic optimization; dynamic binary translation; specification-driven dynamic binary translation. Abstract Machine emulation allows for the simulation of a real or virtual machine, the source machine, on various host computers. A machine emulator interprets programs that are compiled for the emulated machine, but normally at a much reduced speed. Therefore, in order to increase the execution speed of such interpreted programs, a machine emulator may apply different dynamic optimization techniques. In our research we focus on emulators for real machines, i.e. existing computer archi- tectures, and in particular on dynamic binary translation as the optimization technique. With dynamic binary translation, the machine instructions of the interpreted source program are translated into machine instructions for the host machine during the inter- pretation of the program. Both, the machine emulator and its dynamic binary translator are source and host machine specific, respectively, and are therefore traditionally hand- written. In this thesis we introduce the Walkabout/Yirr-Ma framework. Walkabout, initially developed by Sun Microsystems, allows among other things for the generation of instru- mented machine emulators from a certain type of machine specification files. We ex- tended Walkabout with our generic dynamic optimization framework “Yirr-Ma” which defines an interface for the implementation of various dynamic optimizers: by instru- menting a Walkabout emulator’s instruction interpretation functions, Yirr-Ma observes and intercepts the interpretation of a source machine program, and applies dynamic optimizations to selected traces of interpreted instructions on demand. One instance of Yirr-Ma’s interface for dynamic optimizers implements our specification-driven dynamic binary translator, the major contribution of this thesis. At first we establish two things: a formal framework that describes the process of ma- chine emulation by abstracting from real machines, and different classes of applicable dynamic optimizations. We define dynamic optimizations by a set of functions over the abstracted machine, and dynamic binary translation as one particular optimization func- tion. Using this formalism, we then derive the upper bound for quality of dynamically translated machine instructions. Yirr-Ma’s dynamic binary translator implements the optimization functions of our formal framework by modules which are either generated from, or parameterized by, machine specification files. They thus allow for the adap- tation of the dynamic binary translator to different source and host machines without hand-writing machine dependent code. Our initial experimental results illustrate our techniques for different source and host machines, but provide as yet sparse actual performance measurements. However, we successfully demonstrate the portability of the Yirr-Ma framework and the feasibility of our proposed approach to specification-driven dynamic binary translation. Contents List of Figures xiii List of Tables xv List of Listings xvii Abbreviations xix Introduction 1 1 Machine Emulation 7 1.1 Introduction .................................. 7 1.2 Virtual Machines vs. Emulation of Real Machines ............. 8 1.3 Related Work ................................. 9 1.4 Implementation Issues with Machine Emulators .............. 14 1.5 Formal Principles of Machine Emulation .................. 15 1.6 Specification Languages for Machine Emulators .............. 18 1.6.1 Specifying the Syntax of Machine Instructions .......... 18 1.6.2 State Definition and Operational Semantic Specification ..... 19 1.6.3 An Introduction to the SSL Language ............... 20 1.6.4 Using Machine Specification Files .................. 22 1.7 The Walkabout Framework ......................... 22 1.7.1 Source Machine Dependent Implementation ............ 23 1.7.2 Machine Independent Core Functionality ............. 25 1.7.3 Instrumentation of Walkabout Emulators ............. 26 1.8 Summary ................................... 28 2 Dynamic Optimizations for Machine Emulators 29 2.1 Introduction .................................. 29 2.2 Formalization of Dynamic Optimization Techniques ........... 29 2.3 Related Work ................................. 31 2.4 Dynamic Binary Translation ......................... 36 2.5 Existing Dynamic Binary Translation Frameworks ............ 38 ix Contents 2.6 Summary and Outlook ............................ 44 3 The Yirr-Ma Framework 45 3.1 Introduction .................................. 45 3.2 An Extension to Walkabout: Yirr-Ma ................... 45 3.3 The Collector and Dynamic Semantic Information ............ 47 3.4 The Hot-Spot Detector ............................ 48 3.5 The Emitter Interface and Dynamic Functions .............. 50 3.6 The Code Cache ............................... 52 3.7 The Dispatcher ................................ 53 3.8 Implementation ................................ 54 3.9 Summary and Contribution ......................... 59 4 Dynamic Code Generation using Partial Inlining 63 4.1 Introduction .................................. 63 4.2 The Semantic Information .......................... 64 4.3 Instrumenting a Walkabout Emulator for Yirr-Ma’s Inliner ....... 66 4.4 Generation of Dynamic Functions ...................... 68 4.5 Implementation ................................ 70 4.6 Results ..................................... 72 4.7 Summary, Contribution and Outlook .................... 75 5 Specification-Driven Dynamic Binary Translation 77 5.1 Introduction .................................. 77 5.2 The Upper Bound for the Quality of Translated Machine Instructions . 78 5.2.1 An Experiment ............................ 79 5.2.2 Examination of the Generated Code ................ 82 5.2.3 On the Quality of Dynamically Translated Machine Instructions 84 5.2.4 Improving the Quality ........................ 86 5.3 Yirr-Ma’s Dynamic Binary Translator ................... 86 5.4 The Semantic Information .......................... 88 5.5 Instrumenting a Walkabout Emulator for Yirr-Ma’s DBT ........ 88 5.6 Incorporation of Specification Files ..................... 90 5.6.1 The Source Machine Dictionary ................... 90 5.6.2 The Host Machine Dictionary .................... 93 5.7 The Intermediate Representation ...................... 94 5.8 State Mapping ................................ 98 5.9 Dynamic Optimization of the Mapped IR ................. 102 5.9.1 Pseudo Constants .......................... 102 x Contents 5.9.2 Constant Propagation ........................ 103 5.9.3 Constant Folding ........................... 103 5.9.4 Dead Effect Elimination ....................... 105 5.9.5 Idiom Replacement .......................... 105 5.9.6 More Dynamic Optimizations .................... 106 5.10 Code Generation ............................... 107 5.10.1 Instruction Selection Using Tiling ................. 109 5.10.2 An Example ............................. 111 5.10.3 Additional Remarks ......................... 112 5.10.4 Translating System Calls ...................... 115 5.10.5 Instruction Emission ......................... 116 5.11 Generation of the Instruction Selector from a SSL Specification ..... 117 5.11.1 Extended Tiles ............................ 119 5.11.2 Rewriting of Extended Tiles ..................... 120 5.11.3 Construction of the Search Tree ................... 122 5.11.4 Generation of the Instruction Selector ............... 123 5.12 Implementation ................................ 125 5.12.1 The Dynamic Machine Dictionaries ................. 125 5.12.2 Intermediate Representation and Dynamic Optimizers ...... 128 5.13 Experimental Results ............................. 131 5.14 Summary and Contribution ......................... 133 6 Experiences and Future Work 135 6.1 Experiences With Walkabout and Yirr-Ma ................. 135 6.2 Future Work ................................. 137 7 Conclusions 143 A Additional Listings 145 A.1 Yirr-Ma’s FBD Code Cache on Pentium and PowerPC Host Machines . 145 A.2 Walkabout/Yirr-Ma and the Pentium Frontend .............. 146 A.3 Walkabout/Yirr-Ma and the ARM Frontend ................ 150 A.4 Walkabout/Yirr-Ma and the PowerPC Backend .............. 156 Bibliography 159 xi xii List of Figures I-1 Comparison of JIT compilation and dynamic binary translation ..... 2 I-2 Architecture of the entire Walkabout/Yirr-Ma-DBT