Mambo

Abstract

As the ARM architecture expands beyond its traditional embedded domain, there is a growing interest in dynamic binary modification (DBM) tools for general-purpose multicore processors that are part of the ARM family. Existing DBM tools for ARM suffer from introducing large overheads in the execution of applications. The specific questions that this article addresses are (i) how to develop such DBM tools for the ARM architecture and (ii) whether new optimisations are plausible and needed. We describe the general design of MAMBO, a new DBM tool for ARM, which we release together with this publication, and introduce novel optimisations to handle indirect branches. In addition, we explore scenarios in which it may be possible to relax the transparency offered by DBM tools to allow extra optimisations to be applied. These scenarios arise from analysing the most typical usages: for example, application binaries without handcrafted assembly. The performance evaluation shows that MAMBO introduces small overheads for SPEC CPU2006 and PARSEC 3.0 when comparing with the execution times of the unmodified programs: a geometric mean overhead of 28% on a Cortex-A9 and of 34% on a Cortex-A15 for CPU2006, and between 27% and 32%, depending on the number of threads, for PARSEC on a Cortex-A15.

Optimising Dynamic Binary Modification Across ARM Microarchitectures

“…The baseline MAMBO system was described by Gorgovan et al [17]. MAMBO, like most other DBM tools, runs in the same process with the application it modifies and controls its execution by scanning, translating and optionally modifying all code before execution.…”

“…• function returns, for which we introduce hardware-assisted return address prediction in Section 4.1; and • generic indirect branches, handled in MAMBO using inline hash table lookups, for which we introduce the optional adaptive inlining -Section 4.2; and • table branches, handled in MAMBO using the space-efficient shadow branch table linking [17]. Figure 3 shows the steps involved in an inline hash table lookup, which is the mechanism used for handling indirect branches in the baseline MAMBO: 1) first, if required and depending on the type of indirect branch, the values of up to three registers are pushed onto the stack to enable their use as scratch registers; then, 2) the SPC is copied or generated in one of the scratch registers; 3) the hash table lookup is performed, with the TPC being loaded; and 4) finally the values of the scratch registers are restored and a branch to the TPC is performed.…”

“…The configuration with an empty set of optional optimisations enabled is called the baseline configuration. This is similar to the MAMBO configuration used by Gorgovan et al [17], with the exception that the low overhead return address prediction, which is a return address prediction scheme based on a software RAS, has been disabled because it is incompatible with traces and therefore it is never used in this evaluation. Hardware-assisted return address prediction, introduced in this publication, serves a similar role while maintaining full transparency.…”

“…MAMBO [17] is an open source [16], DBM framework for the ARM architecture. To further reduce its overhead, three optimisations are proposed and evaluated in this paper.…”

“…The overhead of the baseline MAMBO system is partly caused by microarchitectural inefficiencies, for example by a high number of instruction cache misses [17]. Therefore, the optimisations presented in this paper aim to address this limitation by improving performance at the microarchitectural level (e.g.…”