LnQ: Building High Performance Dynamic Binary Translators with Existing Compiler Backends

Hsu, Chun-Chen; Liu, Pangfeng; Wang, Chien‐Min; Wu, Jan‐Jan; Hong, Ding-Yong; Yew, Pen-Chung; Hsu, Wei-Chung

doi:10.1109/icpp.2011.57

Cited by 13 publications

(6 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The machine has 12 GB main memory and the operating system is 64-bit Gentoo Linux with kernel version 2.6.30. We use the LnQ [14] dynamic binary translation framework to build two translators which translate IA32 and ARM guest ISAs to x86 64 host ISA. For CFP2006 benchmarks, we only compile them into IA32 binaries because most CFP2006 benchmarks are written in Fortran and the ARM tool chain we use does not provide cross-compilation for Fortran.…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Improving dynamic binary optimization through early-exit guided code region formation

et al. 2013

Self Cite

View full text Add to dashboard Cite

Most dynamic binary translators (DBT) and optimizers (DBO) target binary traces, i.e. frequently executed paths, as code regions to be translated and optimized. Code region formation is the most important first step in all DBTs and DBOs. The quality of the dynamically formed code regions determines the extent and the types of optimization opportunities that can be exposed to DBTs and DBOs, and thus, determines the ultimate quality of the final optimized code. The Next-Executing-Tail (NET) trace formation method used in HP Dynamo is an early example of such techniques. Many existing trace formation schemes are variants of NET. They work very well for most binary traces, but they also suffer a major problem: the formed traces may contain a large number of early exits that could be branched out during the execution. If this happens frequently, the program execution will spend more time in the slow binary interpreter or in the unoptimized code regions than in the optimized traces in code cache. The benefit of the trace optimization is thus lost. Traces/regions with frequently taken early-exits are called delinquent traces/regions. Our empirical study shows that at least 8 of the 12 SPEC CPU2006 integer benchmarks have delinquent traces.In this paper, we propose a light-weight region formation technique called Early-Exit Guided Region Formation (EEG) to improve the quality of the formed traces/regions. It iteratively identifies and merges delinquent regions into larger code regions. We have implemented our EEG algorithm in two LLVM-based multithreaded DBTs targeting ARM and IA32 instruction set architecture (ISA), respectively. Using SPEC CPU2006 benchmark suite with reference inputs, our results show that compared to an NETvariant currently used in QEMU, a state-of-the-art retargetable DBT, EEG can achieve a significant performance improvement of Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. . . . $15.00 up to 72% (27% on average), and to 49% (23% on average) for IA32 and ARM, respectively.

show abstract

Section: Methodsmentioning

confidence: 99%

“…In this section, we describe the design of our region-based multithreaded dynamic binary translator, called LnQ [14]. We have implemented the EEG scheme in LnQ.…”

Section: Region-based Multi-threaded Dynamic Binary Translatormentioning

confidence: 99%

Improving dynamic binary optimization through early-exit guided code region formation

et al. 2013

Self Cite

View full text Add to dashboard Cite

show abstract

“…However, QEMU does not optimize their generated code. Some LLVM-based dynamic binary translators [14], [15], [16], [17] utilize existing emulation tools. They replace the code-generation layer with LLVM components and let the emulator do the remaining jobs.…”

Section: B Dynamic Binary Translatormentioning

confidence: 99%

An LLVM-based hybrid binary translation system

Shen

You

Yang

et al. 2012

7th IEEE International Symposium on Industrial Embedded Systems (SIES'12)

Self Cite

View full text Add to dashboard Cite

Static binary translation (SBT) systems and dynamic binary translation (DBT) systems have their own merits and disadvantages. SBT can perform whole-program optimizations and do not incur run-time overheads. However, the code discovery and the code location problems caused by indirect branches make SBT systems hard to develop. On the other hand, DBT can perform optimizations based on program's runtime behaviors and can handle indirect branches easily. However, because the translation time accounts for a part of the execution time, DBT systems cannot perform aggressive optimizations. Therefore, quality of the code generated by DBT is not as good as that by SBT. In this paper, we present a hybrid binary translation (HBT) system which combines the merits of both SBT and DBT. It leverages the LLVM infrastructure to translate source binary code, optimize, and generate target binary code. It first translates binary statically. If a run-time exception happens, the HBT system switches to dynamic translation. On the EEMBC benchmark suite, our experimental result shows that the HBT system can run about 4 to 20 times faster than a LLVM-based DBT system.

show abstract

“…The paper discusses a particular region selection scheme and parallel JIT compilation, but provides no details of the actual code generation approach used. LNQ [16] extends QEMU with an LLVM based JIT compiler, but does not consider code regions for translation. It uses linear traces instead.…”

Section: Dbt Systems Using Llvm For Jit Compilationmentioning

confidence: 99%

Efficient code generation in a region-based dynamic binary translator

et al. 2014

View full text Add to dashboard Cite

Region-based JIT compilation operates on translation units comprising multiple basic blocks and, possibly cyclic or conditional, control flow between these. It promises to reconcile aggressive code optimisation and low compilation latency in performancecritical dynamic binary translators. Whilst various region selection schemes and isolated code optimisation techniques have been investigated it remains unclear how to best exploit such regions for efficient code generation. Complex interactions with indirect branch tables and translation caches can have adverse effects on performance if not considered carefully. In this paper we present a complete code generation strategy for a region-based dynamic binary translator, which exploits branch type and control flow profiling information to improve code quality for the common case. We demonstrate that using our code generation strategy a competitive region-based dynamic compiler can be built on top of the LLVM JIT compilation framework. For the ARM V5T target ISA and SPEC CPU 2006 benchmarks we achieve execution rates of, on average, 867 MIPS and up to 1323 MIPS on a standard X86 host machine, outperforming state-of-the-art QEMU-ARM by delivering a speedup of 264%.

show abstract

LnQ: Building High Performance Dynamic Binary Translators with Existing Compiler Backends

Cited by 13 publications

References 16 publications

Improving dynamic binary optimization through early-exit guided code region formation

Improving dynamic binary optimization through early-exit guided code region formation

An LLVM-based hybrid binary translation system

Efficient code generation in a region-based dynamic binary translator

Contact Info

Product

Resources

About