Optimising Dynamic Binary Modification Across ARM Microarchitectures

Abstract

Dynamic Binary Modification (DBM) is a technique for modifying applications transparently while they are executed, working at the level of native code. However, DBM introduces a performance overhead, which in some cases can dominate execution time, making many uses impractical. The ARM hardware ecosystem poses unique challenges for high performance DBM systems because of the large number and wide range of capabilities of the commercially available implementations: from single issue, in order cores up to 6-issue out-of-order cores and including less traditional implementations. These variations raise the question of whether it is possible to develop DBM optimisations which either improve or, at the very least, do not affect performance on all available systems and microarchitectures. To answer this question, the performance of three new optimisations for the MAMBO DBM system has been evaluated on five systems using different microarchitectures. For comparison, the overhead of DynamoRIO, a high performance DBM system which was recently ported to the ARM architecture, is also evaluated.

Optimising dynamic binary modification across 64-bit Arm microarchitectures

“…MAMBO uses thread-private code caches, which minimises synchronisation when modified applications use multiple threads. The baseline implementation and optimisation of MAMBO were presented by Gorgovan et al [15] [16].…”

“…In MAMBO, the existing implemented profiling scheme is a modified version of NET. A full description of the selection algorithm is described by Gorgovan et al [16]. This comprises two main differences.…”

“…Previously, the implementations of the prediction mechanism have been done in two ways: using instruction immediate values to create the predicted targets [6]; or storing the predicted and the translated targets in memory [16] [12]. The first option avoids data memory access instructions, however it adds conditional branches and changing a prediction must flush the instruction cache, which is an expensive operation.…”

“…• Contiguous Traces generation MAMBO with the modified traces layout; • RAIBI, a modified scheme of the state-of-the-art IBI for Arm, AIBI, proposed by Gorgovan et al [16]; and • TRIBI X, where X represents the number of targets inlined. AIBI, Adaptive Indirect Branch Inlining, works by always predicting the last taken target of a branch.…”

“…The predictor is called Trace Restricted IBI (TRIBI). Previous approaches have applied IBI either to all indirect branches, or have not discriminated and used as predictions any target [16] [8].…”