JIT InstrumentationJIT InstrumentationA Novel Approach To Dynamically Instrument A Novel Approach To Dynamically Instrument

Operating SystemsOperating Systems

2007. 10. 18.2007. 10. 18.

In-Bon KuhIn-Bon Kuh

GNU OS Lab.GNU OS Lab.

OMCB07 22

ContentsContents

1.1. AbstractAbstract

2.2. Operating system instrumentationOperating system instrumentation

3.3. Dynamic instrumentationDynamic instrumentation

4.4. Design of the JIFL prototypeDesign of the JIFL prototype

5.5. EvaluationEvaluation

6.6. Example pluginsExample plugins

7.7. Future workFuture work

OMCB07 33

AbstractAbstract

[OMCB07] Olszewski, Mierle, Czajkowski, and Angela Demk[OMCB07] Olszewski, Mierle, Czajkowski, and Angela Demke Brown, “JIT Instrumentation - A Novel Approach To Dyname Brown, “JIT Instrumentation - A Novel Approach To Dynamically Instrument Operating Systems,” ically Instrument Operating Systems,” Proceedings of the 200Proceedings of the 2007 conference on EuroSys7 conference on EuroSys, pp. 3-16, ACM, Lisboa, Portugal, M, pp. 3-16, ACM, Lisboa, Portugal, March 2007.arch 2007.

To efficiently instrument operating systems on-the-fly, the proTo efficiently instrument operating systems on-the-fly, the probe-based techniques are extremely expensive on variable-lengtbe-based techniques are extremely expensive on variable-length ISA so that Olszewski et al. propose using just-in-time instruh ISA so that Olszewski et al. propose using just-in-time instrumentation and show feasibility and desirability.mentation and show feasibility and desirability.

OMCB07 44

Operating System InstrumentationOperating System Instrumentation

Static InstrumentationStatic Instrumentation

Dynamic InstrumentationDynamic Instrumentation

+ sophisticated control- slow compiler optimization- need reboot

+ load and unload on demand+ convenient optimization

KernInst• overwrite kernel code with branch instructions• fixed-length ISA (RISC UltraSparc) only• probe-based instrumentation

OMCB07 55

Dynamic InstrumentationDynamic Instrumentation

Probe-based instrumentation - overwriting binaryProbe-based instrumentation - overwriting binary

– fixed-length ISA trampoline

– variable-length ISA trap

OMCB07 66

Just-in-time instrumentation - rewriting binaryJust-in-time instrumentation - rewriting binary

< Step 1 > < Step 2 >

OMCB07 77

< Step 3 > < Step 4 >

OMCB07 88

User Space

Kernel Space

Design of the JIFL PrototypeDesign of the JIFL Prototype

JIFL Plugin StarterJIFL Plugin Starter

JIFL Plugin(Loadable Kernel Module)

JIFL Plugin(Loadable Kernel Module)

Linux Kernel System Call

Code

Linux Kernel System Call

Code

JIFL (Loadable Kernel Module)JIFL (Loadable Kernel Module)

JIFL Instrumentation APIJIFL Instrumentation API

Runtime SystemRuntime System

JIT Compiler

Dispatcher

Memory Manager

HeapHeap

CodeCache

CodeCache

OMCB07 99

OMCB07 1010

OMCB07 1111

Gaining and releasing controlGaining and releasing control

– to gain control patching the system call table to redirect execution to s

ystem call stub

– time to release control at the end of system call at any calls to schedule()

– rewrite jifl_schedule() to return to current thread once again

OMCB07 1212

Optimizing instrumented codesOptimizing instrumented codes

– register and Eflags liveness analysis

– instrumentation inlining

Memory allocatorMemory allocator

– using a custom memory allocator for code cache and instrumentation area

SMP considerationSMP consideration

– handling migration and scheduling rewriting jifl_schedule()

OMCB07 1313

JIFL pluginsJIFL plugins

void plugin_start() { syscall_init(&syscall, __NR_clone); syscall_add_bb_instrumentation(&syscall, bb_inst, NULL); syscall_start_instrumenting(&syscall);}

void plugin_stop() { syscall_stop_instrumenting(&syscall);}

void bb_inst(bb_t *bb, void *arg) { bb_insert_call(bb, add_count, ARG_VOID_PTR, &count, ARG_INT32, bb_size, ARG_END);}

void add_count(long long *counter_ptr, long size) { *counter_ptr += size;}

< An example ofJIFL plugin >

OMCB07 1414

Monitoring Lock ContentionMonitoring Lock Contention

Counting the number of times the atomic exchange failsCounting the number of times the atomic exchange fails

mov counter, %eax1: mov %eax, %edx add %0x1, %edx lock cmpxchg %edx, counter jne 1

< Atomic increment assembly code >

OMCB07 1515

EvaluationEvaluation

Testing environmentTesting environment

– 4-way Intel Pentium 4 Xeon

– kernel 2.6.17.13 patched for boosting Kprobes

Three types of instrumentationThree types of instrumentation

1. coarse-grained: system call monitoring

2. medium-grained: call tracing

3. fine-grained: basic block counting

OMCB07 1616

OMCB07 1717

Future WorkFuture Work

Kernel thread migration in SMP Kernel thread migration in SMP

– need to treating private code cache

Instrumentation of kernel threadInstrumentation of kernel thread

– without unit of basic blocks

OMCB07 1818

So What?So What?

OMCB07 applies catching system callOMCB07 applies catching system call

– duplicating a unit of basic block

watch point