Improving dynamic binary optimization through early-exit guided code region formation

Abstract

Most dynamic binary translators (DBT) and optimizers (DBO) target binary traces, i.e. frequently executed paths, as code regions to be translated and optimized. Code region formation is the most important first step in all DBTs and DBOs. The quality of the dynamically formed code regions determines the extent and the types of optimization opportunities that can be exposed to DBTs and DBOs, and thus, determines the ultimate quality of the final optimized code. The Next-Executing-Tail (NET) trace formation method used in HP Dynamo is an early example of such techniques. Many existing trace formation schemes are variants of NET. They work very well for most binary traces, but they also suffer a major problem: the formed traces may contain a large number of early exits that could be branched out during the execution. If this happens frequently, the program execution will spend more time in the slow binary interpreter or in the unoptimized code regions than in the optimized traces in code cache. The benefit of the trace optimization is thus lost. Traces/regions with frequently taken early-exits are called delinquent traces/regions. Our empirical study shows that at least 8 of the 12 SPEC CPU2006 integer benchmarks have delinquent traces.In this paper, we propose a light-weight region formation technique called Early-Exit Guided Region Formation (EEG) to improve the quality of the formed traces/regions. It iteratively identifies and merges delinquent regions into larger code regions. We have implemented our EEG algorithm in two LLVM-based multithreaded DBTs targeting ARM and IA32 instruction set architecture (ISA), respectively. Using SPEC CPU2006 benchmark suite with reference inputs, our results show that compared to an NETvariant currently used in QEMU, a state-of-the-art retargetable DBT, EEG can achieve a significant performance improvement of Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee.

Employing Simulation to Facilitate the Design of Dynamic Code Generators

“…Many decisions such as the shape and size of the regions affect the quality of the code generated. For instance, regions with a more substantial number of instructions may expose many more optimization opportunities to the compiler, but regions with more branches are more susceptible to early exits due to phase changing [31], leading to region fragmentation [21], code duplication [32], and infrequently executed region tails [33]. Another problem with large regions comes from exception handling: given the difficulty to map exceptions during native execution, the DTE may need to roll the execution back and reinterpret the entire region every time an exception occurs and regions with frequent exceptions may become a performance issue [34].…”

Improving Dynamically-Generated Code Performance on Dynamic Binary Translators

“…There are also several schemes to optimize DBT systems in previous research work [16,22,35,37,39]. In general, our approach can leverage those optimizations to further improve the emulation performance.…”

Optimizing Control Transfer and Memory Virtualization in Full System Emulators

“…Control transfer optimizations refer to optimizations that can transfer execution directly from one translation block to another without interference from the runtime system. Existing control transfer optimizations and superblock optimizations in dynamic binary translation (e.g., block chaining [Cmelik and Keppel 1994;Witchel and Rosenblum 1996;Smith and Nair 2005], trace optimization [Bala et al 2000;Bruening et al 2003;Luk et al 2005;Hsu et al 2013;Hong et al 2012], and indirect branch target caching [Scott et al 2004]) have been shown to be effective and have been widely adapted to high-level language VMs [Inoue et al 2011], or dynamic scripting languages [Gal et al 2009;Bebenita et al 2010].…”