1. Programming Technologies, MIPT, April 7th, 2012 Introduction to Binary Translation Technology Roman Sokolov SMWare roman.a.sokolov@gmail.com

2. Elbrus Binary Translation Technology for IA-32 Compatibility Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012 Binary translation is a process of conversion of source (guest) architecture executable binary codes into executable codes of target (native) architecture. Motivations: binary compatibility w/o source codes recompilation (new archs enabling – more efficient, less complicated, etc.) dynamic optimization JIT security instrumentation and analysis of binaries virtualization simulation …

3. Guest Applications Guest BIOS, OS & Libraries GuestApplications App level BT NativeApplications Native BIOS, OS & Libraries OS & Libraries HW Full System BT HW Application-level DBTS Full system DBTS Elbrus Binary Translation Technology for IA-32 Compatibility BT systems classes StaticDynamic Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

4. Elbrus Binary Translation Technology for IA-32 Compatibility x86 native x86 native x86 x86 guest New native applications applications x86 x86 Transmeta’s Approach x86 native x86applications Intel’s Approach Example: How to use MS Windows on x86-incompatible computer Elbrus’s Approach (mode choice at boot time) Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

5. Adaptive binary translation (1/2) Adaptive dynamic binary translation (1/2) Optimizing region translation Guest binaries Interpretation (and profiling of traces) Non-optimizing trace translation Translations cache: execution and profiling of regions Adaptive retranslation Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

6. Adaptive dynamic binary translation (2/2): profile of execution Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

7. Adaptive binary translation (1/2) BTS layout Guest Memory Space Space BT System (native) Memory Space  System Code  System Data  Compiler Heap  Code Caches  AddrMap Table BT System (native) Memory Space  System Code  System Data  Compiler Heap  Code Caches  AddrMap Table Code Base Invisible for guest programs Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

8. Adaptive binary translation (1/2) Guest control transfer (AddrMap+Cache, GRAS, Native linking) Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012 Translations cache Transl. AddrMap (S/W) AddrMap Cache (H/W) Transl. Translate g. brn n. brn found not found Transl. GRAS (H/W) Transl. g. rtn (pop) push on g. call g.rtn (pop) g. call

9. Adaptive binary translation (1/2) Security Self-modifying code Interrupts and precise exceptions Difference in legacy and host ops semantics Binary Translation Problems Memory mapped I/O devices Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012 Robust performance required!

10. Adaptive binary translation (1/2) Hardware support FunctionalityPerformance Compatible TLB, MMU, guest memory space support Compatible global registers, FP stack Guest code modification protection (SMC/DMA) Instruction equivalents BTS ROMGuest-to-native address translation cache, Guest return address stack Recovery support Asynchronous interrupts support Memory mapped I/O pages protection H/W thread/core for dynamic opt. MLT, DAM, … Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

11. Adaptive binary translation (1/2) Optimized code Compensation code code computes & restores context for Current RP Non-optimized code code Set Recovery Point instruction Exception Handler Handler Guest Exception Handler Program execution Speculative instruction bringing exception returns diagnostic value Real exception on the same guest instr. Check instr. causes exception exception Back to Current RP Recovery model Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

12. 0 1 1 0 0 Binary Translated Code Guest code Translation Physical SpaceBitmap Native VM Space Guest VM Space Physical memory space is represented via a bitmap Bitmap entry represents 4K in physical space Translator tags guest code memory locations in the bitmap Physical memory protection (1/2): translation Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

13. Adaptive binary translation (1/2) 0 1 1 0 0 Binary Translated Code Guest code TLB Physical SpaceBitmap Chipset HDD DMA Native VM Space Guest VM Space Exception Writes to the tagged memory locations result in exceptions TLB protects tagged memory locations from CPU memory writes Chipset protects tagged memory locations from DMA memory writes Bitmap entries are cached internally in hardware Exact memory address reported for each violation attempted Physical memory protection (2/2): execution Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

14. Dynamic optimization vs. Latency Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

15. Background optimization Approach Optimizing translation is separated in a different thread (optimization thread), that can run simultaneously with the main execution thread. Hot regions are detected by the execution thread and are then scheduled to be optimized in background by the optimization thread. Dual(many)-core Optimization is moved onto underutilized processor core Benefits Improves application’s execution latency Removes overhead from the application’s execution Enables the application of more aggressive optimizations. Single-core Optimization is interleaved with execution Benefits Improves application’s execution latency Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

16. Single-core background optimization (1/3) Time-sliced optimization Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

17. Dual-core background optimization (1/2) Offloaded optimization Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

18. Future works Guest architecture multiprocessor system emulation Guest Applications Guest BIOS, OS & Libraries Full System BT HW Guest Applications Guest BIOS, OS & Libraries Full System BT Core0: Exec Core1: Opt Full System BT Core0: Exec Core1: Opt Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

19. Adaptive binary translation (1/2) Dynamic Binary Translation: summary Key paradigm for resolving compatibility/performance tension is speculation, recovery, and adaptive retranslation The devil is in the details: a successful solution must deal with unpleasant architectural details Precise exceptions Interrupts and DMA Memory-mapped I/O Self-modifying code All techniques developed for real performance problems Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

20. Adaptive binary translation (1/2) Dynamic Binary Translation: summary Proc Enables transparent transition to new architectures Allows to transparently improve underlying hardware Optimization of legacy codes with no sources available Provides run-time optimization opportunities (as compared to static native compilers) Hardware bugs masking Cons Translation overhead degrades runtime performance BTS consumes RAM to store internal structures and translated codes High-performance BT requires hardware support Full-system BTS are hard to debug Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012

21. Q&A Further reading: Virtual Machines: Versatile Platforms for Systems and Processes by: Jim Smith, Ravi Nair; Morgan Kaufmann Publishers Introduction to Binary Translation Technology, Programming Technologies, MIPT, April 7th, 2012