DTT: program structure-aware indirect branch optimization via direct-TPC-table in DBT system

Indirect branch handling is a major source of performance overhead in Dynamic Binary Translation (DBT) systems. Most existing solutions for indirect branches involve a run-time address translation from Source Program Counter (SPC) of the branch target to Translated Program Counter (TPC) at every execution of the indirect branches. This paper analyzes the program structures that cause indirect branches, and finds out that most of the branch targets are prestored in the program's memory as some kind of address tables. In other words, the branch target of an indirect branch is not obtained by "calculating", but by "selecting" from the memory. Based on this observation, we propose a program structure-aware indirect branch handling mechanism called Direct TPC Table (DTT). Our DTT approach probes the target address table of an indirect branch by a passive exception-based scheme, and generates a TPC table from the probed SPC address table at the translation time. Thus, the translated program can load the TPC of a branch target from the TPC table directly, which avoids performing an expensive SPC-to-TPC translation at every execution. In many cases, only 2 instructions are need to handle an indirect branch execution. We implemented the DTT mechanism on a public x86 DBT system. The experiment shows that, DTT improves the system performance by 19.0% compared with hash lookup on a set of indirect intensive benchmarks. Furthermore, DTT does not depend on the underlying architecture or special hardware, so that it can be deployed on various platforms. Meanwhile, DTT can cooperate with other optimization technique of different DBT systems to enhance the performance.