A method for identifying a pointer chasing memory access pattern

Abstract

The embodiment of the application discloses a kind of identification methods of pointer chasing memory access mode, the execution trajectory of binary instruction generated when target program runs is obtained by binary instrumentation, the execution trajectory of binary instruction is statically analyzed to obtain five-level consistency query result, address dependency relationship category and context stability category are obtained by dynamic analysis, on this basis, value flow causality verification is executed, address dependency relationship category, five-level consistency query result, value flow verification causality result and context stability category are successively combined to carry out multilevel determination, the final determination result of each binary instruction is generated, and whether the binary instruction is pointer chasing memory access mode is confirmed according to the final determination result, without source code, pointer chasing memory access mode can be accurately identified, and multi-level confidence determination is provided, which can be directly applied to commercial software, third-party library and legacy system etc. Source code unavailable scene.

Description

Technical Field

[0001] This invention relates to a computer system performance analysis method, and more particularly to a method for identifying pointer-chasing memory access patterns. Background Technology

[0002] In modern computer systems, the speed gap between the processor and main memory continues to widen, and cache misses have become a key bottleneck restricting program performance. Pointer chasing is a common memory access pattern characterized by a program loading a value from memory, which is then used as the address for the next memory load. This serialized memory access pattern prevents the processor's hardware prefetcher from obtaining data in advance, and each memory access must wait for the previous access to complete, resulting in a severe cumulative latency effect. Common data structure operations such as linked list traversal, tree structure search, and hash table lookup all exhibit typical pointer chasing patterns.

[0003] Existing performance analysis tools, such as Intel VTune Profiler and Linux perf, primarily rely on hardware performance counters (PMUs) for statistical sampling. While they can report the hotspots and frequency of cache misses, they cannot identify whether the root cause of a cache miss is pointer chasing. Developers need to manually review the source code or assembly code, analyzing the data dependencies between load instructions line by line. However, in many real-world scenarios (such as commercial software, third-party libraries, and legacy systems), the target program's source code is unavailable, rendering existing methods inapplicable due to their reliance on the source code. Even when the source code is available, this process remains time-consuming and error-prone, especially when facing compiler optimizations (such as register overflows and reloading, instruction reordering) and complex control flows (such as cross-function calls and conditional execution), making manual analysis almost impractical. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method for identifying pointer chasing memory access patterns. This method can automatically and accurately identify pointer chasing memory access patterns based solely on the binary instruction execution trajectory without obtaining the source code of the target program, and provides multi-level confidence level determination.

[0005] The technical solution adopted by this invention to solve the above-mentioned technical problem is: a method for identifying pointer-chasing memory access patterns, comprising the following steps: Step S1: Obtain the execution trajectory of binary instructions generated during the runtime of the target program through binary instrumentation; Step S2: Static analysis is performed on the execution trajectory of the binary instruction. By constructing a control flow graph, a dominance tree is constructed and natural loop attribution information is identified based on back edges. The memory source information of the values ​​of each general-purpose register at each program point is extracted. This information is used as input to obtain the dual-path data flow analysis results of possible paths and inevitable paths. The dual-path data flow analysis results are then combined with the base address register and index register information of the memory addressing expression in the binary instruction to output the five-level consistency query results. Step S3: Perform dynamic analysis on the execution trajectory of binary instructions, perform pointer chasing detection on binary instructions to obtain address dependency categories, and perform step size detection on the continuous small constant arithmetic accumulation on the base address register. Then, repair the interruption chasing chain through store-load forwarding recovery and shadow memory recovery. Finally, based on the natural loop ownership information and the branch and call information in the binary instructions, obtain the context stability category of each binary instruction. Step S4: The offset of the virtual address of the actual memory access of the binary instruction is compared with the current record value of the base address register in the pointer chase detection result to obtain the value flow causality verification result. Then, the address dependency category, the five-level consistency query result, the value flow causality verification result and the context stability category are combined in sequence to generate the final judgment result of each binary instruction in a hierarchical manner. The final judgment result is used to confirm whether the binary instruction is in pointer chase memory access mode.

[0006] Compared with the prior art, the advantages of the present invention are: (1) No source code required: This method is based entirely on the analysis of binary instruction execution traces. It does not require obtaining the source code, debugging symbols or intermediate compilation representation of the target program. It can be directly applied to scenarios where the source code is unavailable, such as commercial software, third-party libraries and legacy systems.

[0007] (2) Accurate identification: By combining static control flow graph analysis with dynamic instruction-level tracing, the accurate identification of pointer chasing patterns in the execution trajectory of binary programs is achieved, overcoming the limitation of existing tools that can only count cache misses but cannot identify the root cause.

[0008] (3) Multi-level judgment: A multi-level confidence judgment system was established, including confirmed, highly probable, observationally stable, and dynamic evidence only. It integrates evidence from four dimensions: dynamic detection, static analysis, value flow causal verification, and contextual stability, providing refined guidance for performance optimization.

[0009] (4) Chain recovery capability: Through a two-layer recovery mechanism of store-load forwarding recovery and shadow memory recovery, the chasing chain interrupted by compiler register overflow and reload operation and cross function call is effectively repaired, significantly improving the completeness and recall of the identification.

[0010] (5) Adaptive analysis: Adaptive pointer heuristic method is adopted to dynamically collect the actual address distribution range at runtime, replacing the hard-coded address range determination, so that the system can adapt to different programs and runtime environments.

[0011] In one feasible implementation, the execution trajectory of the binary instruction in step S1 consists of sequentially recorded instruction entries and memory access annotation entries. Each instruction entry contains at least the program counter address of the executed instruction, the instruction mnemonic, the operand, and branch and call information. The program counter addresses of each instruction entry form a program counter address sequence according to the recording time. Each memory access annotation entry contains at least a read / write direction identifier and the virtual address of the memory access, and is attached to its adjacent instruction entry. The specific methods for step S2 include: Step S2-1: Based on the program counter address sequence and branch and call information in the execution trajectory, the binary instructions are divided into multiple basic blocks and a control flow graph is constructed according to their jump relationships. Then, a dominance tree is constructed and the natural loop ownership information is identified based on the back edges. Step S2-2: Based on the control flow graph, dominance tree, and natural loop, extract the memory source information of each general-purpose register value at each program point from the instruction mnemonic and operand of the instruction entry; Step S2-3: Using the memory source information as input, calculate the transfer function summary for each basic block, and then solve it synchronously along possible and necessary paths using the worksheet iterative method until a fixed point is reached, thus obtaining the dual-path data flow analysis results. Step S2-4: For each binary instruction, decompose the memory addressing expression containing the base address register and the index register from the operands of each instruction entry, and output the five-level consistency query result by combining the base address register and index register information in the memory addressing expression with the dual-channel data stream analysis results. The specific methods for step S3 include: Step S3-1: Scan each binary instruction sequentially according to the instruction timing of the execution trajectory, update the load-derive state of the general-purpose register, further decompose the memory addressing mode of the scanned binary instructions, and classify them into one of the address dependency categories based on the load-derive state to obtain the pointer tracing detection result of the scanned binary instructions. Step S3-2: While performing pointer chasing detection, step size detection is performed on the continuous small constant arithmetic accumulation on the base address register. When the number of continuous small constant arithmetic accumulations reaches the preset step size threshold, the binary instruction with the base address register as the base address is changed to step size traversal mode. Step S3-3: Maintain storage-load forwarding table and shadow memory. In short-distance overflow reload scenario and long-distance and cross-function call scenario, restore the interrupted memory source information to the current register and write the result back to the pointer chasing detection result. Steps S3-4: For each register value with memory source information, create a source node in the source directed acyclic graph and maintain its most recently loaded ancestor identifier; at the same time, based on the natural loop attribution information and the branch and call information in the instruction entry, update the three-dimensional execution context hash, accumulate the frequency of pointer chasing for each program counter address in its context observation table, and finally output the context stability category of each binary instruction. The specific methods for step S4 include: Step S4-1: The offset of the virtual address of the actual memory access recorded in the memory access annotation entry is compared with the current recorded value of the base address register in the pointer tracing detection result, and the value stream causal verification result is output. Step S4-2: Combining the address dependency category, the five-level consistency query result, the value flow causality verification result, and the context stability category, the final judgment result of each binary instruction is generated hierarchically, and the final judgment result is used to confirm whether the binary instruction is a pointer chase memory access mode.

[0012] In one feasible implementation, the five-level consistency query results in step S2-4 include five types: necessary base address support, possible base address support, index-only support, dual-source dependency, and no support. The address dependency relationship categories in step S3-1 include six types: strict base address chasing, index-only lookup, dual-source dependency, direct stack access, instruction pointer relative addressing, and overflow reload recovery. The three-dimensional execution context hash in step S3-4 consists of branch history signature, call stack signature, and loop phase signature. The context stability categories include three types: stable, unstable, and contradictory. The final judgment result in step S4-2 includes nine results: confirmed, highly probable, observed stable, dynamic evidence only, index access, dual-source ambiguity, stack access, rejected, and no chasing. When the final judgment result is one of the four results: confirmed, highly probable, observed stable, or dynamic evidence only, the binary instruction is a pointer chasing memory access mode. When the final judgment result is one of the five results: index access, dual-source ambiguity, stack access, rejected, or no chasing, the binary instruction is a non-pointer chasing memory access case.

[0013] In one feasible implementation, the control flow graph in step S2-1 consists of basic blocks and their jump relationships. A basic block is a continuous sequence of instructions with a unique entry point, a unique exit point, and no internal branches. The entry instruction of a basic block is the first instruction, the first jump target instruction, or the instruction immediately following the branch instruction. The jump relationship of a basic block is determined by the program counter address mapping relationship of two instructions executed successively in the execution trajectory of binary instructions, and is divided into three edge types: sequential edge, jump edge, and back edge. The dominator tree is constructed with the control flow graph as input, and the natural loop attribution information includes the back edge identified by the dominator tree as the entry loop head and backtracking upwards to collect all basic blocks in the loop body.

[0014] In one feasible implementation, step S2-3 can be implemented in the following specific way: Step S2-3-1: Represent the memory source information of each register value as structured data, whose fields include at least: memory source type, chain depth, stack source flag, program counter address where the definition is located, basic block identifier where the definition is located, and natural loop dependency flag; classify the memory source type into five types: ① Unknown source, i.e., the value does not come from any known binary instruction; ② Normal load, i.e., the value is generated by a normal binary instruction and its base address does not carry the memory source; ③ Direct chase load, i.e., the value is generated by a binary instruction and the base address of that binary instruction itself carries the memory source; ④ Pointer hold derivation, i.e., the value is obtained by direct chase load or pointer hold derivation value through pointer hold arithmetic operations, which include addition, subtraction, and effective address calculation; ⑤ Indeterminate derivation, i.e. the value is obtained through conditional shift or ambiguous bitwise AND operation; Step S2-3-2: For each basic block, starting from the instruction entries belonging to that basic block in the execution trajectory, scan the mnemonic and operands of each instruction to obtain the transfer function summary of that basic block. The transfer function summary includes at least: a generation set, a deletion set, and register dependency information. The generation set records the set of registers whose memory source information will be rewritten after the execution of that basic block, along with the corresponding memory source information. The deletion set records the set of registers whose memory source information will be erased after the execution of that basic block. The register dependency information describes which input register's memory source information and the chain depth increment depend on the value of each register in the generation set. Step S2-3-3: Based on the transfer function summary of step S2-3-2, the worksheet is iterated synchronously along the reverse order of the control flow graph, according to both possible path semantics and necessary path semantics. Under possible path semantics, a register is considered to have that source if at least one predecessor path carries the same memory source information. Under necessary path semantics, all predecessor paths must carry the same memory source information simultaneously for a register to be considered to have that source. The iteration continues until both paths reach a fixed point. For the chain depth located within a natural loop, a chain depth widening strategy is adopted: when the chain depth increment exceeds a preset upper limit, the increment stops and the upper limit is maintained to ensure iteration convergence and obtain the dual-path data flow analysis results. Step S2-4 can be implemented using the following specific method: For each binary instruction, decompose the memory addressing expression composed of the base address register, index register, scaling factor, and displacement from the operands of each instruction entry. Using the base address register and index register as indices, query the memory source information in the solution results of possible paths and necessary paths, respectively, and summarize them all at once according to the following rules to output the five-level consistency query result of the binary instruction: ① When the base address register carries the memory source in the necessary path, output "Necessary base address supported"; ② When the base address register carries the memory source only in the possible path, output "Possible base address supported"; ③ When the base address register does not carry the memory source in either path, but the index register carries the memory source in the possible path, output "Index supported only"; ④ When both the base address register and the index register carry the memory source in the possible path, output "Dual source dependency"; ⑤ In other cases, output "No support".

[0015] By simultaneously maintaining two independent data stream tracks—possible analysis and inevitable analysis—and performing different merging operations at the merging point, it is possible to accurately distinguish between two different strengths of memory source evidence: "all paths support" and "at least one path supports," providing a differentiated confidence basis for subsequent multi-level judgments.

[0016] In one feasible implementation, obtaining the pointer tracing detection result of the scanned binary instruction in step S3-1 can be achieved through the following specific method: Step S3-1-1, maintain a load-derive state for each general-purpose register. The load-derive state includes at least: whether it comes directly from a load, whether it is a load-derived state, whether it comes from a stack frame load, chain depth, function range chain depth, iteration range chain depth, reuse count used as base address, the most recent small constant accumulation value, and the number of consecutive small constant accumulations; update the load-derive state according to the instruction mnemonic and operands along the instruction sequence of the binary instruction execution trajectory. Step S3-1-2: For each binary instruction, decompose its operands into a memory addressing expression consisting of a base register, an index register, a scaling factor, and a displacement. Query the load-derivation status of the base register and the index register respectively, and classify the binary instruction into one of the address dependency categories according to the following rules: ① The base register has load derivation but the index register does not, classified as strict base chase; ② The base register does not have load derivation but the index register does, classified as index-only lookup; ③ Both the base register and the index register have load derivation, classified as dual-source dependency; ④ The base register is a stack pointer register or a stack base register, classified as direct stack access; ⑤ The memory addressing expression uses the instruction pointer register as its base, classified as instruction pointer relative addressing; ⑥ The base register originally did not carry load derivation but was recovered through a store-load forwarding table, classified as overflow reload recovery; When it does not belong to any of the above six cases, it is judged as non-address-dependent loading, and the pointer chase detection result of the scanned binary instruction is finally obtained.

[0017] In one feasible implementation, step S3-2 can be the following specific method: while performing pointer chasing detection, step size detection is performed on each binary instruction that modifies the base address register: the small constant accumulation of the current binary instruction on the base address register is compared with the most recent small constant accumulation value stored in the load-derive state. If the two are consistent, the consecutive small constant accumulation count is incremented; otherwise, the most recent small constant accumulation value is updated and the consecutive small constant accumulation count of the base address register is reset to one. When the consecutive small constant accumulation count reaches the preset step size threshold, the base address register is marked as being in step size traversal mode, and the next binary instruction with the base address register as the base is reclassified as step size traversal mode. At the same time, its strict base address chasing classification is canceled. The preset step size threshold is ±2n, n∈0,1,2,3.

[0018] By accurately distinguishing the different roles of the base register and index register in memory addressing in the x86-64 architecture, fine-grained classification of address-dependent types is achieved, effectively distinguishing different memory access modes such as true pointer chasing and array index lookup. The step size detection mechanism can automatically exclude step size traversal modes that can be processed by the hardware prefetcher, reducing false alarms.

[0019] In one feasible implementation, step S3-3 can be the following specific method: Step S3-3-1, set the store-load forwarding table as an associative hash structure of multiple groups, each associative hash structure of a group contains several path entries, each path entry records at least: the virtual address of the storage target, the chain depth stored when writing, the chain depth of the function range, the definition number, the program counter address where the definition is located, the stack source flag, the identifier of whether the storage target is a stack frame address, and the instruction number when the storage occurs; when the source value register of a storage instruction has a load derivation, write the load-derivation state into the entry that matches the storage target address; When a binary instruction is executed, the corresponding group in the store-load forwarding table is retrieved at the target address of the binary instruction and matched according to the virtual address. If a match is found, an age check and a call boundary check are performed: the age check requires that the instruction number of the entry is within a preset recent window, and the call boundary check requires that the instruction number of the entry is later than the instruction number of the most recent function call; if both checks pass, the chain depth, function range chain depth, definition number, program counter address where the definition is located, and stack source flag of the entry are written back to the target register of the binary instruction, and the binary instruction is classified into the overflow reload recovery category. Step S3-3-2: Set the shadow memory as a mapping table from virtual addresses to trace tags based on open address hashing. Each entry in the mapping table records at least: the virtual address key, the trace node identifier corresponding to the value register when writing to the address, and the write sequence number. When the source value register of a storage instruction is associated with a trace node identifier, write the trace node identifier to the entry corresponding to the storage target virtual address. When a binary instruction performs a load-derived state update and a store-load forwarding table search, and its destination register still does not carry any memory source information, search the shadow memory at the target address of the binary instruction. If a match is found, write the trace node identifier in the entry back to the destination register. Step S3-3-3: Write back the results of steps S3-3-1 and S3-3-2 to the pointer chasing detection results.

[0020] When the compiler experiences high register pressure, it overflows register values ​​onto the stack and reloads them when needed, which interrupts register-level chain tracing. A two-layer recovery mechanism repairs chains for both short-distance overflows and long-distance cross-function call scenarios, significantly improving the completeness and recall of chain tracing.

[0021] In one feasible implementation, step S3-4 can be the following specific method: Step S3-4-1, create a source node in the source directed acyclic graph for each register value with a memory source. The node type of the source node is selected from one of the following seven subtypes: constant, normal load, store, arithmetic operation, move, conditional move, and call return. When it cannot be determined, an unknown placeholder type is used. Each source node records at least: node identifier, node type, subtype of arithmetic operation node, first parent node identifier, second parent node identifier, identifier of the most recently loaded ancestor node, chain depth, and definition sequence number. The subtype of arithmetic operation node includes pointer holding class, indeterminate class, computation derived class, and zeroing class. The first parent node identifier points to the source node corresponding to the data source of the value, and the second parent node identifier points to the source node corresponding to the address source of the value. Step S3-4-2: When creating a tracing node, the identifier of the most recently loaded ancestor node is assigned synchronously according to the following rules: if this node is a normal loaded node, its most recently loaded ancestor node identifier is itself; otherwise, it inherits the most recently loaded ancestor node identifier from its first parent node. Step S3-4-3: Maintain a three-dimensional execution context hash. The first dimension is the branch history signature, which is accumulated from the execution results of the most recent conditional branches in the form of a shift register. The second dimension is the call stack signature, which is calculated from a fixed-depth circular buffer composed of the return addresses of the most recent function calls. The third dimension is the loop stage signature, which is determined by the identifier of the current natural loop and the iteration stage buckets divided by the number of iterations. The three-dimensional execution context hash is updated at each instruction based on the branch and call information in the execution trajectory of the binary instruction. Step S3-4-4: Maintain a context observation table for each program counter address. The context observation table contains several buckets. Each bucket records the cumulative observation information under a certain execution context hash value. The cumulative observation information includes at least: the number of times the instruction was identified as a pointer chase, the number of times it was identified as a close chase, and the total number of observations. When a binary instruction is detected under a certain execution context hash value, its pointer chase detection result is accumulated into the bucket corresponding to that execution context hash value. When the number of buckets exceeds the upper limit, the upper limit discard policy is applied, that is, contexts exceeding the upper limit are no longer allocated new buckets and the overflow count is incremented. Step S3-4-5: For each program counter address, based on the cumulative observation information of each bucket in the context observation table, output one of the context stability categories according to the following rules: output "stable" when all buckets are consistent in the pointer chasing detection results at the program counter address, output "unstable" when the results between different buckets are inconsistent; output "contradictory" when at least one bucket simultaneously satisfies: ① pointer chasing percentage > 0.5; ② pointer chasing count > 10; ③ close chasing percentage < 0.3.

[0022] The source-oriented directed acyclic graph establishes a complete value source chain for each memory-derived value, supports constant-time loading ancestor queries, and provides necessary structural evidence for upgrading the "observational stability" level in the judgment system; the three-dimensional context stability analysis can detect the consistency of chasing behavior under different branch, call and loop contexts, and effectively filter out false chasing detections caused by changes in control flow.

[0023] In one feasible implementation, step S4-1 can be the following specific method: Step S4-1-1, the base address value is sourced from the base address register and its currently readable register record value recorded in the pointer chasing detection result, and the virtual address in the memory access annotation entry attached to this instruction entry in the execution trajectory of the binary instruction is used as the actual memory access address for this time. Step S4-1-2: When there is no memory access annotation entry for this instruction entry, output "Unverified - No annotation"; when the current record value of the base address register is unreadable, output "Unverified - Base address value unknown"; otherwise, proceed to step S4-1-3. Step S4-1-3: Calculate the absolute value of the unsigned difference between the actual memory access address and the base address value, and classify them according to the following rules: ① If the absolute value is not greater than the first threshold, output "Closely Following"; ② If the absolute value is greater than the first threshold but not greater than the second threshold, output "Structure Field Access"; ③ If the absolute value is greater than the second threshold but not greater than the third threshold, output "Long-Distance Field Access"; ④ If the absolute value is greater than the third threshold, further check the base address value according to the preset pointer valid range discrimination rule. If the base address value falls outside the observed legal virtual address range, output "Rejected"; otherwise, output "Unverified - Offset Out of Bounds". The first threshold is a positive integer number of bytes greater than 0, used to distinguish direct pointer dereferencing; the second threshold is a positive integer number of bytes greater than the first threshold, used to distinguish structure field access; and the third threshold is a positive integer number of bytes greater than the second threshold, used to distinguish long-distance field access. Step S4-2 can be implemented using the following specific methods: Step S4-2-1, Input sources: The first layer of input is the address dependency category, the second layer of input is the five-level consistency query result, the third layer of input is the value flow causal verification result, and the fourth layer of input is the most recently loaded ancestor node identifier, chain depth and context stability category. Step S4-2-2 generates the final decision result of this binary instruction according to the following hierarchical decision rules: ① When the first-level input is strict base address chase: 1) If the third-level input is "rejected", output "rejected" directly; 2) If the third-level input is "close chase" and the second-level input is "necessarily base address supported", output "confirmed"; 3) If the third-level input is "close chase" and the second-level input is "possibly base address supported" or "dual-source dependency", output "highly likely"; 4) In other cases, temporarily output "only". The first layer input is "Dynamic Evidence", and proceeds to step S4-2-3 to determine whether to upgrade. ② When the first layer input is only index lookup, output "Index Access". ③ When the first layer input is dual-source dependency, output "Dual-source Fuzzy". ④ When the first layer input is direct stack access, output "Stack Access". ⑤ When the first layer input is overflow reload recovery, temporarily output "Dynamic Evidence Only" and proceed to step S4-2-3 to determine whether to upgrade. ⑥ When the first layer input is instruction pointer relative addressing or non-address-dependent loading, output "No Chase". Step S4-2-3: When the temporary output is "Dynamic Evidence Only" and all of the following conditions are met simultaneously, upgrade the output to "Observation Stable": ① The first-level input is strict base address chasing; ② The third-level input is "Close Chasing"; ③ The identifier of the most recently loaded ancestor node in the fourth-level input is not empty; ④ The chain depth in the fourth-level input is not less than the preset stable chain depth threshold; ⑤ The context stability category in the fourth-level input is "Stable"; ⑥ The cumulative number of observations in the context observation table at the address of the program counter where this binary instruction is located is not less than the preset stable observation count threshold. If all of the above conditions are not met simultaneously, keep the temporary output "Dynamic Evidence Only" as the final judgment result. The preset stable chain depth threshold is a positive integer greater than or equal to 2, and the preset stable observation count threshold is a positive integer greater than or equal to the upper limit of the number of buckets in the context observation table. The upper limit of the number of buckets in the context observation table is 8. Attached Figure Description

[0024] Figure 1 A flowchart illustrating the overall process of identifying a pointer-chasing memory access mode according to an embodiment of the present invention; Figure 2 A flowchart of static analysis provided for embodiments of the present invention; Figure 3 This is a schematic diagram of the source-tracing directed acyclic graph constructed during the dynamic analysis process provided in this embodiment of the invention; Figure 4This is a flowchart illustrating the multi-level determination process provided in an embodiment of the present invention. Detailed Implementation

[0025] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely intended to explain the present invention and not to limit the present invention. For those skilled in the art, the present invention can be practiced without some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present invention by illustrating examples of the invention.

[0026] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0027] To address the problems in the prior art, embodiments of the present invention provide a method for identifying pointer-chasing memory access patterns.

[0028] The following describes the pointer chasing memory access mode identification method provided by the embodiments of the present invention.

[0029] Figure 1 A flowchart illustrating a pointer-tracking memory access mode identification method according to an embodiment of the present invention is shown. Figure 1 As shown, the pointer tracking and recognition method provided in this embodiment of the invention includes four stages: trajectory acquisition, static analysis process, dynamic instruction-level analysis, and value flow causal verification and multi-level judgment. It may include the following steps: First, the execution trajectory of binary instructions generated during the runtime of the target program is obtained through binary instrumentation. The execution trajectory of binary instructions consists of sequentially recorded instruction entries and memory access annotation entries. Each instruction entry contains at least the program counter address of the executed instruction, the instruction mnemonic, operands, and branch and call information. The program counter addresses of each instruction entry form a program counter address sequence according to the recording time. Each memory access annotation entry contains at least the read / write direction identifier and the virtual address of the memory access, and is attached to its adjacent instruction entry. Then, static analysis is performed on the execution trajectory of the binary instructions. By constructing a control flow graph, a dominance tree is built, and natural loop attribution information is identified based on back edges. This extracts the memory source information of the general-purpose register values ​​at each program point. Using this as input, dual-path data flow analysis results for possible and inevitable paths are obtained. Finally, the dual-path data flow analysis results are combined with the base and index register information of the memory addressing expression in the binary instructions to output a five-level consistency query result. For example... Figure 2 As shown, the static analysis process maintains two independent data flow tracks, one possible and one certain, and organizes the instruction-by-instruction value flow relationship into a traceable directed acyclic graph. The specific method is as follows: Step S2-1: Based on the program counter address sequence and branch and call information in the execution trajectory, the binary instructions are divided into multiple basic blocks, and a control flow graph is constructed according to their jump relationships. Then, a dominator tree is constructed, and the natural loop ownership information is identified based on the back edges. The control flow graph can be composed of basic blocks and their jump relationships. A basic block refers to a continuous instruction sequence with a unique entry point, a unique exit point, and no internal branches. The entry instruction of a basic block is the first instruction, the first jump target instruction, or the instruction immediately following the branch instruction. The jump relationship of a basic block is determined by the program counter address mapping relationship of two instructions executed successively in the execution trajectory of the binary instructions, and is divided into three edge types: sequential edge, jump edge, and back edge. The dominator tree is constructed with the control flow graph as input. The natural loop ownership information includes the back edge identified by the dominator tree as the entry loop head and backtracking upwards to collect all basic blocks in the loop body.

[0030] Step S2-2: Based on the control flow graph, dominance tree, and natural loop, extract the memory source information of each general-purpose register value at each program point from the instruction mnemonic and operand of the instruction entry; Steps S2-3 involve using memory source information as input to calculate the transfer function summary for each basic block, then iteratively solving along both possible and necessary paths until a fixed point is reached, yielding dual-stream data analysis results. This method, by simultaneously maintaining two independent data stream tracks (possible and necessary analyses) and performing different merging operations at the merging point, can accurately distinguish between two different strengths of memory source evidence: "all paths support" and "at least one path supports," providing a differentiated confidence basis for subsequent multi-level judgments. The specific method is as follows: Step S2-3-1: Represent the memory source information of each register value as structured data, whose fields include at least: memory source type, chain depth, stack source flag, program counter address where the definition is located, basic block identifier where the definition is located, and natural loop dependency flag; classify the memory source type into five types: ① Unknown source, i.e., the value does not come from any known binary instruction; ② Normal load, i.e., the value is generated by a normal binary instruction and its base address does not carry the memory source; ③ Direct chase load, i.e., the value is generated by a binary instruction and the base address of that binary instruction itself carries the memory source; ④ Pointer hold derivation, i.e., the value is obtained by direct chase load or pointer hold derivation value through pointer hold arithmetic operations, which include addition, subtraction, and effective address calculation; ⑤ Indeterminate derivation, i.e. the value is obtained through conditional shift or ambiguous bitwise AND operation; Step S2-3-2: For each basic block, starting from the instruction entries belonging to that basic block in the execution trajectory, scan the mnemonic and operands of each instruction to obtain the transfer function summary of that basic block. The transfer function summary includes at least: a generation set, a deletion set, and register dependency information. The generation set records the set of registers whose memory source information will be rewritten after the execution of that basic block, along with the corresponding memory source information. The deletion set records the set of registers whose memory source information will be erased after the execution of that basic block. The register dependency information describes which input register's memory source information and the chain depth increment depend on the value of each register in the generation set. Step S2-3-3: Based on the transfer function summary of step S2-3-2, the worksheet is iterated synchronously along the reverse order of the control flow graph, according to both possible path semantics and necessary path semantics. Under possible path semantics, a register is considered to have that source if at least one predecessor path carries the same memory source information. Under necessary path semantics, all predecessor paths must carry the same memory source information simultaneously for a register to be considered to have that source. The iteration continues until both paths reach a fixed point. For the chain depth located within a natural loop, a chain depth widening strategy is adopted: when the chain depth increment exceeds a preset upper limit, the increment stops and the upper limit is maintained to ensure iteration convergence and obtain the dual-path data flow analysis results. Step S2-4: For each binary instruction, decompose the memory addressing expression containing the base address register and index register from the operands of each instruction entry. Combine the base address register and index register information in the memory addressing expression with the results of dual-stream data analysis to output a five-level consistency query result for five cases: mandatory base address support, possible base address support, index-only support, dual-source dependency, and no support. Specifically, for each binary instruction, decompose the memory addressing expression consisting of the base address register, index register, scaling factor, and displacement from the operands of each instruction entry. Using the base address register and index register as indices, decompose the expression in the possible base address support, index register, scaling factor, and displacement. The memory source information is queried from the solution results of the path and the necessary path, and summarized at once according to the following rules, and the five-level consistency query result of the binary instruction is output: ① When the base address register carries the memory source in the necessary path, output "Necessary base address supported"; ② When the base address register carries the memory source only in the possible path, output "Possible base address supported"; ③ When the base address register does not carry the memory source in either path, but the index register carries the memory source in the possible path, output "Index supported only"; ④ When both the base address register and the index register carry the memory source in the possible path, output "Dual source dependency"; ⑤ In other cases, output "No support".

[0031] Then, dynamic analysis is performed on the execution trajectory of the binary instructions. Pointer chasing detection is performed on the binary instructions to obtain the address dependency category. At the same time, step size detection is performed on the continuous small constant arithmetic accumulation on the base address register. Then, the interrupt chasing chain is repaired through store-load forwarding recovery and shadow memory recovery. Finally, based on the natural loop ownership information and the branch and call information in the binary instructions, the context stability category of each binary instruction is obtained. The specific method is as follows: Step S3-1: Scan each binary instruction sequentially according to the instruction timing of the execution trajectory, update the load-derivation state of the general-purpose registers, further decompose the memory addressing mode of the scanned binary instructions, and classify them into one of six address dependency categories, including strict base address tracing, index-only lookup, dual-source dependency, direct stack access, instruction pointer relative addressing, and overflow reload recovery, based on the load-derivation state, to obtain the pointer tracing detection result of the scanned binary instructions. The specific method is as follows: Step S3-1-1: Maintain a load-derive state for each general-purpose register. The load-derive state includes at least: whether it comes directly from a load, whether it is a load-derived state, whether it comes from a stack frame load, chain depth, function range chain depth, iteration range chain depth, reuse count used as base address, most recent small constant accumulation value, and consecutive small constant accumulation counts. Update the load-derive state according to the instruction mnemonic and operands along the instruction sequence of the binary instruction execution trajectory. Step S3-1-2: For each binary instruction, decompose its operands into a memory addressing expression consisting of a base register, an index register, a scaling factor, and a displacement. Query the load-derivation status of the base register and the index register respectively, and classify the binary instruction into one of the address dependency categories according to the following rules: ① The base register has load derivation but the index register does not, classified as strict base chase; ② The base register does not have load derivation but the index register does, classified as index-only lookup; ③ Both the base register and the index register have load derivation, classified as dual-source dependency; ④ The base register is a stack pointer register or a stack base register, classified as direct stack access; ⑤ The memory addressing expression uses the instruction pointer register as its base, classified as instruction pointer relative addressing; ⑥ The base register originally did not carry load derivation but was recovered through a store-load forwarding table, classified as overflow reload recovery; When it does not belong to any of the above six cases, it is judged as non-address-dependent loading, and the pointer chase detection result of the scanned binary instruction is finally obtained.

[0032] By precisely distinguishing the different roles of base registers and index registers in memory addressing, fine-grained classification of address-dependent types is achieved, effectively differentiating between true pointer chasing and array index lookup modes. It must be noted that this technology is not limited to the x86 architecture and can be extended to other architectures such as ARM, RISC-V, LoongArch, SPARC, MIPS, and accelerators such as GPUs, TPUs, and NPUs, etc.

[0033] To automatically exclude step-size traversal patterns that can be processed by the hardware prefetcher and reduce false alarms, step-size detection is performed on the continuous small constant arithmetic accumulation in the base address register while performing pointer chase detection. When the number of continuous small constant arithmetic accumulations reaches a preset step-size threshold, the binary instruction with that base address register as the base address is reclassified as a step-size traversal pattern. Specifically, while performing pointer chase detection, step-size detection is performed on each binary instruction that modifies the base address register: the small constant accumulation amount of this binary instruction on the base address register is compared with the load... - Compare the most recent small constant accumulation value stored in the derived state. If they match, increment the consecutive small constant accumulation count. Otherwise, update the most recent small constant accumulation value and reset the consecutive small constant accumulation count of the base address register to one. When the consecutive small constant accumulation count reaches the preset step size threshold, mark the base address register as being in step size traversal mode, and change the next binary instruction with the base address register as the base address to step size traversal mode. At the same time, cancel its strict base address chasing classification. The preset step size threshold is ±2n, n∈0,1,2,3.

[0034] When register pressure is high, the compiler overflows register values ​​onto the stack and reloads them when needed, which interrupts register-level chain tracing. To improve the completeness and recall of chain tracing, a two-layer recovery mechanism can be used to repair chains in short-distance overflow and long-distance cross-function call scenarios. By maintaining a store-load forwarding table and shadow memory, the interrupted memory source information is restored to the current register in both short-distance overflow reload and long-distance and cross-function call scenarios. The two mechanisms complement each other, and the results are written back to the pointer tracing detection results. The specific method is as follows: Step S3-3-1: Configure the store-load forwarding table as an associative hash structure with multiple groups. Each associative hash structure contains several entries, and each entry records at least: the virtual address of the storage target, the chain depth at which it is written, the chain depth of the function range, the definition number, the program counter address where the definition is located, the stack source flag, an identifier indicating whether the storage target is a stack frame address, and the instruction number at the time of the storage. When the source value register of a storage instruction has a load derivation, write the load-derivation state into the entry matching the storage target address. When a binary instruction is executed, the binary instruction is used to... The target address of the binary instruction is retrieved, stored, and loaded into the corresponding group of the forwarding table, and matched according to the virtual address. If a match is found, an age check and a call boundary check are performed: the age check requires that the instruction number of the entry is within a preset recent window, and the call boundary check requires that the instruction number of the entry is later than the instruction number of the most recent function call; if both checks pass, the chain depth, function range chain depth, definition number, program counter address where the definition is located, and stack source flag of the entry are written back to the target register of the binary instruction, and the binary instruction is classified into the overflow reload recovery category. Step S3-3-2: Set the shadow memory as a mapping table from virtual addresses to trace tags based on open address hashing. Each entry in the mapping table records at least: the virtual address key, the trace node identifier corresponding to the value register when writing to the address, and the write sequence number. When the source value register of a storage instruction is associated with a trace node identifier, write the trace node identifier to the entry corresponding to the storage target virtual address. When a binary instruction performs a load-derived state update and a store-load forwarding table search, and its destination register still does not carry any memory source information, search the shadow memory at the target address of the binary instruction. If a match is found, write the trace node identifier in the entry back to the destination register. Step S3-3-3: Write back the results of steps S3-3-1 and S3-3-2 to the pointer tracing detection results. The result of step S3-3-1 includes the chain depth, function range chain depth, definition number, program counter address where the definition is located, and stack source flag stored when writing back to the destination register of the binary instruction, as well as setting the address dependency category of the binary instruction to overflow reload recovery. The result of step S3-3-2 includes the trace node identifier written back to the destination register.

[0035] To establish a complete value source chain for each memory-derived value, support constant-time ancestor lookup, and provide necessary structural evidence for upgrading the "observational stability" level in the judgment system, a tracing node can be created in the tracing directed acyclic graph for each register value with memory source information, and its most recently loaded ancestor identifier can be maintained. Simultaneously, to effectively filter false chase detections caused by control flow changes, a three-dimensional execution context hash composed of branch history signatures, call stack signatures, and loop phase signatures can be updated based on natural loop attribution information and branch and call information in instruction entries. The frequency of pointer chase occurrences is accumulated for each program counter address in its context observation table, and finally, the context stability category of each binary instruction is output, including stable, unstable, and contradictory categories. The specific method is as follows: Step S3-4-1: Create a source node in the source directed acyclic graph for each register value with a memory source. The node type of the source node is selected from one of the following seven subtypes: constant, normal load, store, arithmetic operation, move, conditional move, and call return. When it cannot be determined, use the unknown placeholder type. Each source node records at least: node identifier, node type, subtype of arithmetic operation node, first parent node identifier, second parent node identifier, identifier of the most recently loaded ancestor node, chain depth, and definition sequence number. The subtypes of arithmetic operation node include pointer holding class, indeterminate class, computation derived class, and zeroing class. The first parent node identifier points to the source node corresponding to the data source of the value, and the second parent node identifier points to the source node corresponding to the address source of the value. In step S3-4-2, when creating a source node, the identifier of the most recently loaded ancestor node is synchronously assigned according to the following rules: if the node is a normal loaded node, its most recently loaded ancestor node identifier is itself; otherwise, it inherits the most recently loaded ancestor node identifier from its first parent node. This assignment method enables the query of whether any source node has a loaded ancestor and its most recently loaded ancestor to be completed in constant time, independent of the node chain depth. Step S3-4-3: Maintain a three-dimensional execution context hash. The first dimension is the branch history signature, which is accumulated from the execution results of the most recent conditional branches in the form of a shift register. The second dimension is the call stack signature, which is calculated from a fixed-depth circular buffer composed of the return addresses of the most recent function calls. The third dimension is the loop stage signature, which is determined by the identifier of the current natural loop and the iteration stage buckets divided by the number of iterations. The three-dimensional execution context hash is updated at each instruction based on the branch and call information in the execution trajectory of the binary instruction. Step S3-4-4: Maintain a context observation table for each program counter address. The context observation table contains several buckets. Each bucket records the cumulative observation information under a certain execution context hash value. The cumulative observation information includes at least: the number of times the instruction was identified as a pointer chase, the number of times it was identified as a close chase, and the total number of observations. When a binary instruction is detected under a certain execution context hash value, its pointer chase detection result is accumulated into the bucket corresponding to that execution context hash value. When the number of buckets exceeds the upper limit, the upper limit discard policy is applied, that is, contexts exceeding the upper limit are no longer allocated new buckets and the overflow count is incremented. Step S3-4-5: For each program counter address, based on the cumulative observation information of each bucket in the context observation table, output one of the context stability categories according to the following rules: output "stable" when all buckets are consistent in the pointer chasing detection results at the program counter address, output "unstable" when the results between different buckets are inconsistent; output "contradictory" when at least one bucket simultaneously satisfies: ① pointer chasing percentage > 0.5; ② pointer chasing count > 10; ③ close chasing percentage < 0.3.

[0036] Finally, the offset of the virtual address of the actual memory access of the binary instruction is compared with the current record value of the base register in the pointer chase detection result to obtain the value flow causality verification result. Then, the final judgment result for each binary instruction is generated hierarchically by combining the address dependency category, the five-level consistency query result, the value flow causality verification result, and the context stability category. Based on the final judgment result, it is confirmed whether the binary instruction is in pointer chase memory access mode. The specific method is as follows: Step S4-1, Value Flow Causality Verification: The virtual address of the actual memory access recorded in the memory access annotation entry is offset and compared with the current recorded value of the base address register in the pointer tracing detection result. The value flow causality verification result is output. The specific method is as follows: Step S4-1-1: The base address is obtained by using the base address register and the currently readable register record value recorded in the pointer tracing detection result as the base address source, and the virtual address in the memory access annotation entry attached to this instruction entry in the execution trace of the binary instruction as the actual memory access address for this operation. Step S4-1-2: When there is no memory access annotation entry for this instruction entry, output "Unverified - No annotation"; when the current record value of the base address register is unreadable, output "Unverified - Base address value unknown"; otherwise, proceed to step S4-1-3. Step S4-1-3: Calculate the absolute value of the unsigned difference between the actual memory access address and the base address value, and classify them according to the following rules: ① If the absolute value is not greater than the first threshold, output "Closely Following"; ② If the absolute value is greater than the first threshold but not greater than the second threshold, output "Structure Field Access"; ③ If the absolute value is greater than the second threshold but not greater than the third threshold, output "Long-Distance Field Access"; ④ If the absolute value is greater than the third threshold, further check the base address value according to the preset pointer valid range discrimination rule. If the base address value falls outside the observed legal virtual address range, output "Rejected"; otherwise, output "Unverified - Offset Out of Bounds". The first threshold is a positive integer number of bytes greater than 0, used to distinguish direct pointer dereferencing; the second threshold is a positive integer number of bytes greater than the first threshold, used to distinguish structure field access; and the third threshold is a positive integer number of bytes greater than the second threshold, used to distinguish long-distance field access.

[0037] Step S4-2, as follows Figure 4 The multi-level determination shown is as follows: It sequentially combines address dependency category, level 5 consistency query result, value flow causality verification result, and context stability category to generate the final determination result for each binary instruction level. Based on the final determination result, it is confirmed whether the binary instruction is a pointer-chase memory access mode. The specific method is as follows: Step S4-2-1: The address dependency category is used as the first layer input, the five-level consistency query result is used as the second layer input, the value flow causal verification result is used as the third layer input, and the most recently loaded ancestor node identifier, chain depth and context stability category are used as the fourth layer input. Step S4-2-2 generates the final decision result of this binary instruction according to the following hierarchical decision rules: ① When the first-level input is strict base address chase: 1) If the third-level input is "rejected", output "rejected" directly; 2) If the third-level input is "close chase" and the second-level input is "necessarily base address supported", output "confirmed"; 3) If the third-level input is "close chase" and the second-level input is "possibly base address supported" or "dual-source dependency", output "highly likely"; 4) In other cases, temporarily output "only". The first layer input is "Dynamic Evidence", and proceeds to step S4-2-3 to determine whether to upgrade. ② When the first layer input is only index lookup, output "Index Access". ③ When the first layer input is dual-source dependency, output "Dual-source Fuzzy". ④ When the first layer input is direct stack access, output "Stack Access". ⑤ When the first layer input is overflow reload recovery, temporarily output "Dynamic Evidence Only" and proceed to step S4-2-3 to determine whether to upgrade. ⑥ When the first layer input is instruction pointer relative addressing or non-address-dependent loading, output "No Chase". Step S4-2-3: When the temporary output is "Dynamic Evidence Only" and all of the following conditions are met simultaneously, upgrade the output to "Observation Stable": ① The first layer input is strict base address chasing; ② The third layer input is "Close Chasing"; ③ The identifier of the most recently loaded ancestor node in the fourth layer input is not empty; ④ The chain depth in the fourth layer input is not less than the preset stable chain depth threshold; ⑤ The context stability category in the fourth layer input is "Stable"; ⑥ The cumulative number of observations in the context observation table at the address of the program counter where this binary instruction is located is not less than the preset stable observation number threshold. If all of the above conditions are not met simultaneously, keep the temporary output "Dynamic Evidence Only" as the final judgment result. The preset stable chain depth threshold is a positive integer greater than or equal to 2, and the preset stable observation number threshold is a positive integer greater than or equal to the upper limit of the number of buckets in the context observation table. The upper limit of the number of buckets in the context observation table is 8. When the final determination result is one of four outcomes: confirmed, highly probable, stable observation, or only dynamic evidence, the binary instruction is a pointer-chasing memory access mode; when the final determination result is one of five outcomes: index access, dual-source ambiguity, stack access, rejected, or no chasing, the binary instruction is a non-pointer-chasing memory access scenario.

[0038] The following is a specific example to further help understand the pointer chasing memory access mode identification method of the present invention.

[0039] I. Experimental Environment 1.1 Hardware Platform

[0040] 1.2 Software Platform

[0041] II. Testing the workload

[0042] III. Appendix: Precise Pointer Tracing Identification in the Core Stage of 505.mcf_r The following demonstrates how the method of the present invention identifies a pointer chasing pattern on the reduced-cost computation path in primal_bea_mpp from the actual binary execution trace of SPEC CPU 2017 505.mcf_r, and performs closed-loop verification with structural semantics and source code semantics.

[0043] 3.1 Core Instruction Chain Extracted from Binary Trajectory The following is a core instruction sequence directly extracted from the actual acquisition trajectory:

[0044] The following dynamic facts can be directly confirmed from this sequence of instructions: rax is used consecutively as the base address of the same object and accesses fixed offsets +0x08, +0x10, and +0x18; 0x404dd7 retrieves the value 7fffded9fbf8 from M[7fffdd24e020] and writes it to rsi; 0x404ddf then accesses M[7fffded9fbf8] with rsi=7fffded9fbf8 as the base address; 0x404de2 and 0x404de6 perform the same pattern of access to another symmetric pointer chain.

[0045] Therefore, the above sequence exhibits a chained memory access behavior: "first retrieve the pointer field from object A, then jump to the starting position of object B to read the field value." For the critical PC 0x404ddf, its memory access address [rsi] cannot be predetermined before the previous jump execution, but must depend on the loading result of mov rsi, [rax+0x10]. This dynamic characteristic conforms to the basic definition of pointer tracing.

[0046] 3.2 Reconstructing the Layout from Memory Access Patterns Based on the offset access pattern in this instruction chain, the layout of the relevant objects can be reconstructed as follows:

[0047] The reconstruction of the structure is not based on isolated guesses of a single instruction, but is constrained by multiple offsets in the same local computation chain.

[0048] First, the fact that `rax` consistently appears as the base address of the same object, and that accesses are concentrated at fixed offsets +0x08, +0x10, and +0x18, indicates that it corresponds to a fixed-layout structure object, rather than an array step traversal. Second, after `0x404dd7` reads `rax+0x10`, the return value is immediately consumed by `0x404ddf` as the new base address `rsi`, indicating that memory access has switched from the original object to the starting position of another object. Combined with the symmetrical background instructions `0x404de2` / `0x404de6`, it can be further confirmed that this object contains two node pointer fields, each leading to the reading of the starting field of another object.

[0049] Therefore, the access pattern can be reconstructed as follows: first read the tail pointer in the arc object, then enter the node object to read the potential field, i.e., arc → tail → potential. This pattern is not a continuous address traversal, but a short-chain pointer chase with clear object boundary switching.

[0050] 3.3 Precise correspondence between binary traces and source code semantics Based on the reconstructed access chain, this instruction sequence corresponds to the source code location pbeampp.c:135:

[0051] The instruction-by-instruction correspondence is as follows:

[0052] The above correspondence shows that 0x404ddf is not an isolated indirect load, but rather resides within a semantically complete reduced-cost computation chain. `mov rsi, [rax+0x10]` first generates the unique valid address required for subsequent accesses, and then `sub rcx, [rsi]` immediately reads the node potential value at that address and subtracts it. Therefore, the critical PC 0x404ddf semantically corresponds precisely to the subexpression `arc->tail->potential` in pbeampp.c:135.

[0053] 3.4 Detection Results of the Recognition Method The identification method produces the following detection results for the key PC 0x404ddf:

[0054] The above results indicate that this PC is not a sporadic sample, but a pointer chasing hotspot that stably and repeatedly appears in the real trajectory. The number of loadings is exactly equal to the number of confirmed loadings, indicating that this PC satisfies the high-confidence pointer chasing condition in all observations.

[0055] 3.5 Multi-layered evidence analysis First layer: Dynamic address dependency For the critical PC 0x404ddf, the base address rsi of its memory access address [rsi] comes directly from the load result of the previous movrsi, [rax+0x10], rather than from a constant address, fixed-step update, or stack slot reloading. Therefore, this PC satisfies the strict dynamic definition of "load the pointer first, then address with that pointer", corresponding to STRICT.

[0056] This can be verified line by line from the actual trajectory: `mov rsi, [rax+0x10]` loads address 7fffded9fbf8 into `rsi`; immediately following `sub rcx, [rsi]` accesses `M[7fffded9fbf8]`. The address of each subsequent hop is exactly the same as the value loaded in the previous hop, with no additional arithmetic transformations, fixed stride accumulations, or other address generation paths in between. Therefore, it can be determined that this PC satisfies a strict dynamic address dependency relationship.

[0057] Second layer: Structural offset and static semantic support This hotspot load is not a semantically meaningless indirect address access, but can be interpreted as a dereference to the real structure by multiple fixed offsets in the same local chain. [rax+0x8], [rax+0x10], [rax+0x18] and [rsi] together define that the current object contains fields such as cost, tail, and head, and tail / head respectively point to the starting field potential of another object.

[0058] Based on this, the pattern can be stably reconstructed as an object hierarchy access of arc → tail → potential. Therefore, it can be determined that the critical PC 0x404ddf not only dynamically depends on the previous hop's loading result, but also corresponds to a real object dereference in terms of structural semantics.

[0059] Third layer: Value flow morphology verification The pointer chasing example in this example belongs to the tight pattern. Here, tight pattern means that the previous hop returns a pointer to a node that will be consumed immediately, and the next hop immediately reads the potential at the object's starting offset + 0x00. Its characteristics are short chains, small offsets, adjacent nodes, and direct consumption.

[0060] In other words, as soon as `mov rsi, [rax+0x10]` retrieves the node pointer, `sub rcx, [rsi]` immediately uses that value to form the next address. The return value of the previous jump acts as an object reference at runtime, not a regular integer; and the next jump consumption location happens to fall on a key field in the header of the target object. Therefore, this PC can be classified as a typical short-chained pointer chase.

[0061] Fourth layer: Context stability and final decision The 0x404ddf test case has a 100% verification rate, indicating that this PC does not exhibit pointer chasing only sporadically on individual paths, but rather consistently reproduces the same address dependency and object jump pattern within the primal_bea_mpp core loop. Therefore, this PC is ultimately determined to be a verified pointer chasing test.

[0062] The number of loads (1,430,550) further confirms that this is not a small-sample phenomenon occurring only a few dozen or a few hundred times, but rather a stable behavior that has been repeated millions of times in large-scale dynamic execution of real workloads. Therefore, the proposed identification method can reliably identify this type of structured pointer chasing pattern in real-world trajectories.

[0063] 3.6 Verification of accurate identification In summary, the identification method described herein performs the following closed-loop verification for this example: The critical load instruction 0x404ddf was located in the actual binary trace; Based on the offset access pattern in the same local instruction chain, it is reconstructed into a short-chain dereference of arc -> tail -> potential; Placing this instruction back into the context of the reduced-cost expression will correspond precisely to the computational term - arc->tail->potential in pbeampp.c:135; Furthermore, the evidence is corroborated by four layers of evidence: dynamic address dependency, structural semantics, value flow morphology, and context stability.

[0064] Therefore, it can be determined that the critical PC 0x404ddf is a true pointer chase access in the core computation path of 505.mcf_r. This demonstrates that the identification method can identify and verify the chained dereference pattern in the SPEC core algorithm from the actual binary execution trajectory.

[0065] 3.7 Preferred values ​​of key parameters in the embodiments The preferred values ​​for the main thresholds in this example are shown in the table below: First threshold (closely following offset threshold): 32 bytes; Second threshold (structure field access offset threshold): 256 bytes; Third threshold (far-distance field access offset threshold): 4096 bytes; Upper limit of the amplitude of the small constant for step size detection: 8; Preset step size threshold: 2; Widen the policy chain depth truncation threshold: 32; Chain depth limit: 64; Stable observation count threshold: 32; Stable chain depth threshold: 2; Storage-load forwarding table size: 4-way group associativity × 16384 groups; Shadow memory hash table size: 1,048,576 slots; Branch history signature width: 8 bits; Call stack circular buffer depth: 4 levels; Number of buckets in the iterative cycle: 4.

Claims

1. A method for identifying pointer-chasing memory access patterns, characterized in that, Includes the following steps: Step S1: Obtain the execution trajectory of binary instructions generated during the runtime of the target program through binary instrumentation; Step S2: Static analysis is performed on the execution trajectory of the binary instruction. By constructing a control flow graph, a dominance tree is constructed and natural loop attribution information is identified based on back edges. The memory source information of the values ​​of each general-purpose register at each program point is extracted. This information is used as input to obtain the dual-path data flow analysis results of possible paths and inevitable paths. The dual-path data flow analysis results are then combined with the base address register and index register information of the memory addressing expression in the binary instruction to output the five-level consistency query results. Step S3: Perform dynamic analysis on the execution trajectory of binary instructions, perform pointer chasing detection on binary instructions to obtain address dependency categories, and perform step size detection on the continuous small constant arithmetic accumulation on the base address register. Then, repair the interruption chasing chain through store-load forwarding recovery and shadow memory recovery. Finally, based on the natural loop ownership information and the branch and call information in the binary instructions, obtain the context stability category of each binary instruction. Step S4: The offset of the virtual address of the actual memory access of the binary instruction is compared with the current record value of the base address register in the pointer chase detection result to obtain the value flow causality verification result. Then, the address dependency category, the five-level consistency query result, the value flow causality verification result and the context stability category are combined in sequence to generate the final judgment result of each binary instruction in a hierarchical manner. The final judgment result is used to confirm whether the binary instruction is in pointer chase memory access mode.

2. The method for identifying pointer-chasing memory access patterns as described in claim 1, characterized in that, The execution trajectory of the binary instruction in step S1 consists of sequentially recorded instruction entries and memory access annotation entries. Each instruction entry contains at least the program counter address of the executed instruction, the instruction mnemonic, the operand, and branch and call information. The program counter addresses of each instruction entry form a program counter address sequence according to the recording time. Each memory access annotation entry contains at least the read / write direction identifier and the virtual address of the memory access, and is attached to its adjacent instruction entry. The specific methods for step S2 include: Step S2-1: Based on the program counter address sequence and branch and call information in the execution trajectory, the binary instructions are divided into multiple basic blocks and a control flow graph is constructed according to their jump relationships. Then, a dominance tree is constructed and the natural loop ownership information is identified based on the back edges. Step S2-2: Based on the control flow graph, dominance tree, and natural loop, extract the memory source information of each general-purpose register value at each program point from the instruction mnemonic and operand of the instruction entry; Step S2-3: Using the memory source information as input, calculate the transfer function summary for each basic block, and then solve it synchronously along possible and necessary paths using the worksheet iterative method until a fixed point is reached, thus obtaining the dual-path data flow analysis results. Step S2-4: For each binary instruction, decompose the memory addressing expression containing the base address register and the index register from the operands of each instruction entry, and output the five-level consistency query result by combining the base address register and index register information in the memory addressing expression with the dual-channel data stream analysis results. The specific methods for step S3 include: Step S3-1: Scan each binary instruction sequentially according to the instruction timing of the execution trajectory, update the load-derive state of the general-purpose register, further decompose the memory addressing mode of the scanned binary instructions, and classify them into one of the address dependency categories based on the load-derive state to obtain the pointer tracing detection result of the scanned binary instructions. Step S3-2: While performing pointer chasing detection, step size detection is performed on the continuous small constant arithmetic accumulation on the base address register. When the number of continuous small constant arithmetic accumulations reaches the preset step size threshold, the binary instruction with the base address register as the base address is changed to step size traversal mode. Step S3-3: Maintain storage-load forwarding table and shadow memory. In short-distance overflow reload scenario and long-distance and cross-function call scenario, restore the interrupted memory source information to the current register and write the result back to the pointer chasing detection result. Steps S3-4: For each register value with memory source information, create a source node in the source directed acyclic graph and maintain its most recently loaded ancestor identifier; at the same time, based on the natural loop attribution information and the branch and call information in the instruction entry, update the three-dimensional execution context hash, accumulate the frequency of pointer chasing for each program counter address in its context observation table, and finally output the context stability category of each binary instruction. The specific methods for step S4 include: Step S4-1: The offset of the virtual address of the actual memory access recorded in the memory access annotation entry is compared with the current recorded value of the base address register in the pointer tracing detection result, and the value stream causal verification result is output. Step S4-2: Combining the address dependency category, the five-level consistency query result, the value flow causality verification result, and the context stability category, the final judgment result of each binary instruction is generated hierarchically, and the final judgment result is used to confirm whether the binary instruction is a pointer chase memory access mode.

3. The method for identifying pointer-chasing memory access patterns according to claim 2, characterized in that, The five-level consistency query results in step S2-4 include five types: necessary base address support, possible base address support, index-only support, dual-source dependency, and no support. The address dependency relationship categories in step S3-1 include six types: strict base address chasing, index-only lookup, dual-source dependency, direct stack access, instruction pointer relative addressing, and overflow reload recovery. The three-dimensional execution context hash in step S3-4 consists of branch history signature, call stack signature, and loop phase signature. The context stability categories include three types: stable, unstable, and contradictory. The final judgment result in step S4-2 includes nine results: confirmed, highly probable, observed stable, dynamic evidence only, index access, dual-source ambiguity, stack access, rejected, and no chasing. When the final judgment result is one of the four results: confirmed, highly probable, observed stable, or dynamic evidence only, the binary instruction is a pointer chasing memory access mode. When the final judgment result is one of the five results: index access, dual-source ambiguity, stack access, rejected, or no chasing, the binary instruction is a non-pointer chasing memory access case.

4. The method for identifying pointer-chasing memory access patterns according to claim 3, characterized in that, The control flow graph in step S2-1 consists of basic blocks and their jump relationships. A basic block is a continuous sequence of instructions with a unique entry point, a unique exit point, and no internal branches. The entry instruction of a basic block is the first instruction, the first jump target instruction, or the instruction immediately following the branch instruction. The jump relationship of a basic block is determined by the program counter address mapping relationship of two instructions executed successively in the execution trajectory of binary instructions, and is divided into three edge types: sequential edge, jump edge, and back edge. The dominator tree is constructed with the control flow graph as input. The natural loop ownership information includes the back edge identified by the dominator tree as the entry loop head and backtracking upwards to collect all basic blocks in the loop body.

5. The method for identifying pointer-chasing memory access patterns according to claim 4, characterized in that, The specific method for step S2-3 is as follows: Step S2-3-1: Represent the memory source information of each register value as structured data, whose fields include at least: memory source type, chain depth, stack source flag, program counter address where the definition is located, basic block identifier where the definition is located, and natural loop dependency flag; classify the memory source type into five types: ① Unknown source, i.e., the value does not come from any known binary instruction; ② Normal load, i.e., the value is generated by a normal binary instruction and its base address does not carry the memory source; ③ Direct chase load, i.e., the value is generated by a binary instruction and the base address of that binary instruction itself carries the memory source; ④ Pointer hold derivation, i.e., the value is obtained by direct chase load or pointer hold derivation value through pointer hold arithmetic operations, which include addition, subtraction, and effective address calculation; ⑤ Indeterminate derivation, i.e. the value is obtained through conditional shift or ambiguous bitwise AND operation; Step S2-3-2: For each basic block, starting from the instruction entries belonging to that basic block in the execution trajectory, scan the mnemonic and operands of each instruction to obtain the transfer function summary of that basic block. The transfer function summary includes at least: a generation set, a deletion set, and register dependency information. The generation set records the set of registers whose memory source information will be rewritten after the execution of that basic block, along with the corresponding memory source information. The deletion set records the set of registers whose memory source information will be erased after the execution of that basic block. The register dependency information describes which input register's memory source information and the chain depth increment depend on the value of each register in the generation set. Step S2-3-3: Based on the transfer function summary of step S2-3-2, the worksheet is iterated synchronously along the reverse order of the control flow graph, according to both possible path semantics and necessary path semantics. Under possible path semantics, a register is considered to have that source if at least one predecessor path carries the same memory source information. Under necessary path semantics, all predecessor paths must carry the same memory source information simultaneously for a register to be considered to have that source. The iteration continues until both paths reach a fixed point. For the chain depth located within a natural loop, a chain depth widening strategy is adopted: when the chain depth increment exceeds a preset upper limit, the increment stops and the upper limit is maintained to ensure iteration convergence and obtain the dual-path data flow analysis results. The specific method for step S2-4 is as follows: For each binary instruction, decompose the memory addressing expression composed of the base address register, index register, scaling factor, and displacement from the operands of each instruction entry. Using the base address register and index register as indices, query the memory source information in the solution results of possible paths and necessary paths respectively, and summarize them all at once according to the following rules to output the five-level consistency query result of the binary instruction: ① When the base address register carries the memory source in the necessary path, output "Necessary base address supported"; ② When the base address register carries the memory source only in the possible path, output "Possible base address supported"; ③ When the base address register does not carry the memory source in either path, but the index register carries the memory source in the possible path, output "Index supported only"; ④ When both the base address register and the index register carry the memory source in the possible path, output "Dual source dependency"; ⑤ In other cases, output "No support".

6. The method for identifying pointer-chasing memory access patterns according to claim 5, characterized in that, The specific method for obtaining the pointer tracing detection result of the scanned binary instructions in step S3-1 is as follows: Step S3-1-1: Maintain a load-derive state for each general-purpose register. The load-derive state includes at least: whether it comes directly from a load, whether it is a load-derived state, whether it comes from a stack frame load, chain depth, function range chain depth, iteration range chain depth, reuse count used as base address, most recent small constant accumulation value, and consecutive small constant accumulation counts. Update the load-derive state according to the instruction mnemonic and operands along the instruction sequence of the binary instruction execution trajectory. Step S3-1-2: For each binary instruction, decompose its operands into a memory addressing expression consisting of a base register, an index register, a scaling factor, and a displacement. Query the load-derivation status of the base register and the index register respectively, and classify the binary instruction into one of the address dependency categories according to the following rules: ① The base register has load derivation but the index register does not, classified as strict base chase; ② The base register does not have load derivation but the index register does, classified as index-only lookup; ③ Both the base register and the index register have load derivation, classified as dual-source dependency; ④ The base register is a stack pointer register or a stack base register, classified as direct stack access; ⑤ The memory addressing expression uses the instruction pointer register as its base, classified as instruction pointer relative addressing; ⑥ The base register originally did not carry load derivation but was recovered through a store-load forwarding table, classified as overflow reload recovery; When it does not belong to any of the above six cases, it is judged as non-address-dependent loading, and the pointer chase detection result of the scanned binary instruction is finally obtained.

7. The method for identifying pointer-chasing memory access patterns according to claim 6, characterized in that, The specific method of step S3-2 is as follows: While performing pointer chasing detection, step size detection is performed on each binary instruction that modifies the base address register: the small constant accumulation value of the current binary instruction in the base address register is compared with the most recent small constant accumulation value stored in the load-derive state. If they match, the consecutive small constant accumulation count is incremented; otherwise, the most recent small constant accumulation value is updated and the consecutive small constant accumulation count of the base address register is reset to one. When the consecutive small constant accumulation count reaches the preset step size threshold, the base address register is marked as being in step size traversal mode, and the next binary instruction with the base address register as the base is reclassified as being in step size traversal mode. At the same time, its strict base address chasing classification is canceled. The preset step size threshold is ±2. n , n∈0,1,2,3.

8. The method for identifying pointer-chasing memory access patterns according to claim 7, characterized in that, The specific method for step S3-3 is as follows: Step S3-3-1: Configure the store-load forwarding table as an associative hash structure with multiple groups. Each associative hash structure contains several entries, and each entry records at least: the virtual address of the storage target, the chain depth at which it is written, the chain depth of the function range, the definition number, the program counter address where the definition is located, the stack source flag, an identifier indicating whether the storage target is a stack frame address, and the instruction number at the time of the storage. When the source value register of a storage instruction has a load derivation, write the load-derivation state into the entry matching the storage target address. When a binary instruction is executed, the binary instruction is used to... The target address of the binary instruction is retrieved, stored, and loaded into the corresponding group of the forwarding table, and matched according to the virtual address. If a match is found, an age check and a call boundary check are performed: the age check requires that the instruction number of the entry is within a preset recent window, and the call boundary check requires that the instruction number of the entry is later than the instruction number of the most recent function call; if both checks pass, the chain depth, function range chain depth, definition number, program counter address where the definition is located, and stack source flag of the entry are written back to the target register of the binary instruction, and the binary instruction is classified into the overflow reload recovery category. Step S3-3-2: Set the shadow memory as a mapping table from virtual addresses to trace tags based on open address hashing. Each entry in the mapping table records at least: the virtual address key, the trace node identifier corresponding to the value register when writing to the address, and the write sequence number. When the source value register of a storage instruction is associated with a trace node identifier, write the trace node identifier to the entry corresponding to the storage target virtual address. When a binary instruction performs a load-derived state update and a store-load forwarding table search, and its destination register still does not carry any memory source information, search the shadow memory at the target address of the binary instruction. If a match is found, write the trace node identifier in the entry back to the destination register. Step S3-3-3: Write back the results of steps S3-3-1 and S3-3-2 to the pointer chasing detection results.

9. The method for identifying pointer-chasing memory access patterns according to claim 8, characterized in that, The specific method for step S3-4 is as follows: Step S3-4-1: Create a source node in the source directed acyclic graph for each register value with a memory source. The node type of the source node is selected from one of the following seven subtypes: constant, normal load, store, arithmetic operation, move, conditional move, and call return. When it cannot be determined, use the unknown placeholder type. Each source node records at least: node identifier, node type, subtype of arithmetic operation node, first parent node identifier, second parent node identifier, identifier of the most recently loaded ancestor node, chain depth, and definition sequence number. The subtypes of arithmetic operation node include pointer holding class, indeterminate class, computation derived class, and zeroing class. The first parent node identifier points to the source node corresponding to the data source of the value, and the second parent node identifier points to the source node corresponding to the address source of the value. Step S3-4-2: When creating a tracing node, the identifier of the most recently loaded ancestor node is assigned synchronously according to the following rules: if this node is a normal loaded node, its most recently loaded ancestor node identifier is itself; otherwise, it inherits the most recently loaded ancestor node identifier from its first parent node. Step S3-4-3: Maintain a three-dimensional execution context hash. The first dimension is the branch history signature, which is accumulated from the execution results of the most recent conditional branches in the form of a shift register. The second dimension is the call stack signature, which is calculated from a fixed-depth circular buffer composed of the return addresses of the most recent function calls. The third dimension is the loop stage signature, which is determined by the identifier of the current natural loop and the iteration stage buckets divided by the number of iterations. The three-dimensional execution context hash is updated at each instruction based on the branch and call information in the execution trajectory of the binary instruction. Step S3-4-4: Maintain a context observation table for each program counter address. The context observation table contains several buckets. Each bucket records the cumulative observation information under a certain execution context hash value. The cumulative observation information includes at least: the number of times the instruction was identified as a pointer chase, the number of times it was identified as a close chase, and the total number of observations. When a binary instruction is detected under a certain execution context hash value, its pointer chase detection result is accumulated into the bucket corresponding to that execution context hash value. When the number of buckets exceeds the upper limit, the upper limit discard policy is applied, that is, contexts exceeding the upper limit are no longer allocated new buckets and the overflow count is incremented. Step S3-4-5: For each program counter address, based on the cumulative observation information of each bucket in the context observation table, output one of the context stability categories according to the following rules: output "stable" when all buckets are consistent in the pointer chasing detection results at the program counter address, output "unstable" when the results between different buckets are inconsistent; output "contradictory" when at least one bucket simultaneously satisfies: ① pointer chasing percentage > 0.5; ② pointer chasing count > 10; ③ close chasing percentage < 0.

3.

10. The method for identifying pointer-chasing memory access patterns according to claim 9, characterized in that, The specific method of step S4-1 is as follows: Step S4-1-1, the base address value is sourced from the base address register and the currently readable register record value recorded in the pointer chasing detection result, and the virtual address in the memory access annotation entry attached to this instruction entry in the execution trajectory of the binary instruction is used as the actual memory access address for this time. Step S4-1-2: When there is no memory access annotation entry for this instruction entry, output "Unverified - No annotation"; when the current record value of the base address register is unreadable, output "Unverified - Base address value unknown"; otherwise, proceed to step S4-1-3. Step S4-1-3: Calculate the absolute value of the unsigned difference between the actual memory access address and the base address value, and classify them according to the following rules: ① If the absolute value is not greater than the first threshold, output "Closely Following"; ② If the absolute value is greater than the first threshold but not greater than the second threshold, output "Structure Field Access"; ③ If the absolute value is greater than the second threshold but not greater than the third threshold, output "Long-Distance Field Access"; ④ If the absolute value is greater than the third threshold, further check the base address value according to the preset pointer valid range discrimination rule. If the base address value falls outside the observed legal virtual address range, output "Rejected"; otherwise, output "Unverified - Offset Out of Bounds". The first threshold is a positive integer number of bytes greater than 0, used to distinguish direct pointer dereferencing; the second threshold is a positive integer number of bytes greater than the first threshold, used to distinguish structure field access; and the third threshold is a positive integer number of bytes greater than the second threshold, used to distinguish long-distance field access. The specific method for step S4-2 is as follows: Step S4-2-1: The address dependency category is used as the first layer input, the five-level consistency query result is used as the second layer input, the value flow causal verification result is used as the third layer input, and the most recently loaded ancestor node identifier, chain depth and context stability category are used as the fourth layer input. Step S4-2-2 generates the final decision result of this binary instruction according to the following hierarchical decision rules: ① When the first-level input is strict base address chase: 1) If the third-level input is "rejected", output "rejected" directly; 2) If the third-level input is "close chase" and the second-level input is "must support base address", output "confirmed"; 3) If the third-level input is "close chase" and the second-level input is "possibly support base address" or "dual-source dependency", output "highly likely"; 4) In other cases, temporarily output "only". The first layer input is "Dynamic Evidence", and proceeds to step S4-2-3 to determine whether to upgrade. ② When the first layer input is only index lookup, output "Index Access". ③ When the first layer input is dual-source dependency, output "Dual-source Fuzzy". ④ When the first layer input is direct stack access, output "Stack Access". ⑤ When the first layer input is overflow reload recovery, temporarily output "Dynamic Evidence Only" and proceed to step S4-2-3 to determine whether to upgrade. ⑥ When the first layer input is instruction pointer relative addressing or non-address-dependent loading, output "No Chase". Step S4-2-3: When the temporary output is "Dynamic Evidence Only" and all of the following conditions are met simultaneously, upgrade the output to "Observation Stable": ① The first-level input is strict base address chasing; ② The third-level input is "Close Chasing"; ③ The identifier of the most recently loaded ancestor node in the fourth-level input is not empty; ④ The chain depth in the fourth-level input is not less than the preset stable chain depth threshold; ⑤ The context stability category in the fourth-level input is "Stable"; ⑥ The cumulative number of observations in the context observation table at the address of the program counter where this binary instruction is located is not less than the preset stable observation count threshold. If all of the above conditions are not met simultaneously, keep the temporary output "Dynamic Evidence Only" as the final judgment result. The preset stable chain depth threshold is a positive integer greater than or equal to 2, and the preset stable observation count threshold is a positive integer greater than or equal to the upper limit of the number of buckets in the context observation table. The upper limit of the number of buckets in the context observation table is 8.

Images