Binary Translation Using Peephole Superoptimizers. Sorav Bansal and Alex Aiken Stanford University

Transcription

1 Binary Translation Using Peephole Superoptimizers Sorav Bansal and Alex Aiken Stanford University 1

2 TALK OUTLINE What is Binary Translation? What are Peephole Superoptimizers? Why Binary Translation Using Peephole Superoptimizers? Challenges and Solutions Experiments and Results TALK OUTLINE 2

3 BINARY TRANSLATION The ability to run code written for one architecture on another without access to source code Applications Portability of Applications (eg. Apple) Backward/Forward Compatibility of Architecture Generations (eg. Intel) Virtualization (eg. IBM s PAVE) Get the Best-of-Both-Worlds (eg. itunes on x86/linux) Running Legacy Code Instrumentation (Machine X Machine X) BINARY TRANSLATION 3

4 BINARY TRANSLATION De-compile Intermediate Code Re-compile Machine X Binary Machine Y Binary BINARY TRANSLATION 4

5 PEEPHOLE SUPEROPTIMIZERS PEEPHOLE SUPEROPTIMIZERS 5

6 PEEPHOLE SUPEROPTIMIZERS Source Code Binary Code Harvest Binary Code to build Target Set of Instruction Sequences PEEPHOLE SUPEROPTIMIZERS 5-A

7 PEEPHOLE SUPEROPTIMIZERS Target Instruction Sequences Superoptimizer Table of Peephole Rules Input Peephole Rules Output ÑÓÚ ± Ô ± Ô ÑÓÚ ± Ô ± Ô ÑÓÚ ± Ô ± Ô PEEPHOLE SUPEROPTIMIZERS 6

8 PEEPHOLE SUPEROPTIMIZERS Source Code Intermediate Binary Code Optimized Code Apply Peephole Rules Input Peephole Rules Output ÑÓÚ ± Ô ± Ô ÑÓÚ ± Ô ± Ô ÑÓÚ ± Ô ± Ô PEEPHOLE SUPEROPTIMIZERS 7

9 PEEPHOLE TRANSLATORS Source Code Machine X Assembly Optimized Machine Y Assembly Apply Peephole Rules Peephole Rules Input Map Output Machine X Assembly rx 1 ry 1 rx 2 ry 2 Machine Y Assembly PEEPHOLE TRANSLATORS 8

10 PEEPHOLE TRANSLATORS Source Code Machine PowerPCX Assembly Optimized Machine x86 Y Assembly Peephole Rules Input Map Output Apply Peephole Rules Machine X Assembly ÑÖ Ö½ Ö¾ ÑÖ Ö¾ Ö½ r1 %ebp rx 1 ry 1 r2 %esp rx 2 ry 2 Machine Y ÑÓÚ ± Ô ± Ô Assembly PEEPHOLE TRANSLATORS 8-A

11 CHALLENGES CHALLENGES 9

12 CHALLENGES Register Mapping Dynamic/Static? CHALLENGES 9-A

13 CHALLENGES Register Mapping Dynamic/Static? Control Flow Transfers Direct/Indirect Jumps Function Call/Return CHALLENGES 9-B

14 CHALLENGES Register Mapping Dynamic/Static? Control Flow Transfers Direct/Indirect Jumps Function Call/Return Endian-ness CHALLENGES 9-C

15 REGISTER MAPPING PowerPC : 32 GPRs, 3 SPRs, 8 flag registers x86 : 8 GPRs and other SIMD-support registers REGISTER MAPPING 10

16 REGISTER MAPPING Dynamic Register Mapping Use dynamic programming considering all possible register maps. Account for Switching cost Cost of the peephole rule Make decisions at function return points REGISTER MAPPING 11

17 EXPERIMENTAL SETUP gcc <options> -arch=ppc.c source file gcc <options> -arch=x86 PowerPC Executable x86 Executable Peephole Binary Translation Compare x86 Executable EXPERIMENTAL SETUP 12

18 EXPERIMENTAL SETUP gcc <options> -arch=ppc.c source file gcc <options> -arch=x86 PowerPC Executable x86 Executable Peephole Binary Translation Compare x86 Executable Qemu (Freely available) : 10-20% Apple Rosetta (Commercial) : 70-80% (claim) Transitive (Commercial) : 70-80% (claim) EXPERIMENTAL SETUP 12-A

19 BENCHMARKS Name Description fibo64 Compute the first n fibonacci numbers bubsort64 Bubble-sort a large array of 64-bit integers hanoi1 Kolar s Hanoi Tower algorithm no. 1 hanoi2 Er s LLHanoi Hanoi Tower loop less algorithm hanoi3 Kolar s Hanoi Tower algorithm no. 3 BENCHMARKS 13

20 RESULTS fibo64 bubsort64 hanoi1 hanoi2 hanoi3 RESULTS 14

21 RESULTS O0 fibo64 110% bubsort64 84% hanoi1 97% hanoi2 103% hanoi3 90% RESULTS 14-A

22 RESULTS O0 O2 fibo64 110% 311% bubsort64 84% 55% hanoi1 97% 59% hanoi2 103% 159% hanoi3 90% 90.5% RESULTS 14-B

23 RESULTS O0 O2 O2+ fibo64 110% 311% 121% bubsort64 84% 55% 61.4% hanoi1 97% 59% 59% hanoi2 103% 159% 158% hanoi3 90% 90.5% 67.2% O2+ = -O2 -fomit-frame-pointer RESULTS 14-C

24 RESULTS O0 O2 O2+ fibo64 110% 311% 121% bubsort64 84% 55% 61.4% hanoi1 97% 59% 59% hanoi2 103% 159% 158% hanoi3 90% 90.5% 67.2% O2+ = -O2 -fomit-frame-pointer RESULTS 14-D

25 RESULTS O0 O2 O2+ fibo64 110% 311% 121% bubsort64 84% 55% 61.4% hanoi1 97% 59% 59% hanoi2 103% 159% 158% hanoi3 90% 90.5% 67.2% O2+ = -O2 -fomit-frame-pointer RESULTS 14-E

26 CONCLUSIONS AND FUTURE WORK Conclusions Peephole Superoptimization is a good fit for the problem of Binary Translation Ongoing Work Improve performance Support all system calls (run larger benchmarks) Look at other source-target architecture pairs CONCLUSIONS AND FUTURE WORK 15