Harmonia

Abstract

Dynamic binary translation (DBT) has been widely used as a means to run applications created for one instruction-set architecture (ISA) on top of processors with a different ISA. Given the great amount of legacy software developed for PCs, based on the Intel R Architecture (IA) ISA, a lot of attention has been given to translating IA to other ISAs. The recent trends in industry for both smaller ultra-mobile PCs and more powerful embedded and mobile internet devices (e.g. smartphones) are blurring the frontiers between these distinct markets. As a result, this market convergence is creating great interest in DBT from ISAs that currently dominate the embedded and mobile-internet-device markets (e.g. ARM, MIPS, and PowerPC) to IA. This paper investigates the main challenges that arise when targeting IA in a DBT. We identify the two key issues in efficiently translating from other ISAs to IA: IA's small number of registers, and its condition-code handling mechanism. To address these issues, we propose a combination of software and hardware solutions. Although motivated by IA, these techniques are not IA-specific, and they can be applied to other architectures with similar limitations to make them better DBT-targets. We have prototyped these techniques in Harmonia, an ARM-to-IA DBT tool based on open-source QEMU. Our experiments show that Harmonia achieves an average of 55% (up to 164%) of the performance of highly optimized native binaries, and an average speedup of 2.2× on top of the baseline QEMU.

A Retargetable System-level DBT Hypervisor

“…architecture pairs and differ in supported features, which prohibit meaningful relative performance comparisons. For example, Harmonia [31] achieves a similar speedup of 2.2 over Qemu, but this is for user-level DBT of a 32-bit guest on a 64-bit host system whereas we achieve a speedup of 2.2 over Qemu for the harder problem of system-level DBT of a 64-bit guest onto a 64-bit host system. For this reason we evaluate Captive against the widely used Qemu DBT as a baseline, supported by targeted micro-benchmarks and comparisons to physical platforms.…”

“…Qemu [4] HQEMU [21] PQEMU [18] Walkabout [12] Yirr-Ma [44] ISAMAP [38] Transmeta CMS [17] Harmonia [31] QuickTransit [26] HyperMAMBO-x64 [15] Captive (2016) [40] MagiXen [10] Captive…”

Performance Improvements via Peephole Optimization in Dynamic Binary Translation

“…Li et al [16] indicated that emulating an ARM condition code instruction costs up to 16 RISC-V instructions on average. To alleviate this overhead, QEMU [14] and Harmonia [17] adopt a lazy computation approach until the results are needed. This strategy effectively reduces redundant evaluations and improves performance.…”

Context-Sensitive Fencing

“…Prior work has established that instruction customization is an effective means to instrument the dynamic execution stream with security checks, and thereby mitigate several attack vectors at a relatively low performance overhead. Instruction stream customization has been proposed and evaluated in various forms and levels, ranging from secure virtual architectures at the ISA and compiler level [23,88,90] to full-blown processor binary translation at the microcode level [9,25,71,89]. Corliss, et al [18][19][20] propose dynamic instruction stream editing (DISE), a macro-engine that customizes the dynamic instruction stream at the decoder level, by pattern-matching userdefined production rules pushed into the decoder.…”