一個為Thumb-2可執行檔以LLVM為基準的靜態二元轉譯系統

Abstract

Thumb-2是一個16位元和32位元共存的指令長度可變指令集架構，跟ARM架構相比，他有更高的指令密度，但是效能又很接近ARM。對靜態二元轉譯系統來說，如何區分指令和資料，以及找到轉譯前後程式計數器的對應是非常困難的，因此設計一個靜態二元轉譯系統不是一件簡單的事情。在這篇論文中，我們介紹一個對於Thumb-2可執行檔的靜態二元轉譯系統，它利用了LLVM的各項功能去轉譯輸入的檔案、對他做最佳化、編譯，並且產生輸出的二進位檔。我們的系統利用一些方式找到那些被GCC所產生出來的二進位檔中，被安插在指令間的資料，而且建立了一個轉譯前後程式計數器的對應表並利用一些方法減少此表的空間。我們亦提供了一些方法改善我們轉譯後的檔案，使得LLVM優化器和編譯器可以更快的完成他們的工作。我們的系統最終產生x86架構的可執行檔以便於比較效能，並使用SPEC2006 CINT配合具參考價值的輸入資料來做為比較的依據，就平均的結果來看，我們轉譯後的可執行檔比使用QEMU的結果快了大約5.6倍；而跟x86原生的可執行檔比較起來，速度大約慢了2.1倍，且檔案大了2.5倍。而最後我們提出的一個減少工作時間的方式雖然執行時間多花了三成，可是轉譯的時間卻快了13倍。

Thumb-2 is a 16-bit and 32-bit mixed instruction set architecture (ISA), with higher code density compared with ARM, and the performance is close to ARM. The code discovery problem and the code location problem caused by indirect branches make static binary translation (SBT) system hard to develop. In this thesis, we present a SBT system for Thumb-2, which leverage the LLVM infrastructure to translate the source binary into LLVM IR, optimize and compile the LLVM bitcode file, and then generate the target binary. Our system solves the code discovery problem for the binaries, which are generated by GCC, by finding all kinds of data that are interspersed in the code. The code location problem is also solved by creating an address mapping table with relatively smaller size. We also introduce an approach to reduce the optimization and compilation time of translated LLVM bitcode files. Our system finally generates x86 executable for performance comparison. In our experiments which use SPEC2006 CINT with reference data to be the benchmark, the execution time is about 5.6 times faster than QEMU, while about 2.1 times slower with 2.5 times code expansion when compared with the x86 native binaries. Furthermore, with our saving-time approach, the execution time will be increased by 30% while the translation time could be 13X better.