JIT Instrumentation A Novel Approach To Dynamically Instrument Operating Systems

1. JIT InstrumentationA Novel Approach To Dynamically Instrument Operating Systems 2007. 10. 18. In-Bon Kuh GNU OS Lab.

2. Contents • Abstract • Operating system instrumentation • Dynamic instrumentation • Design of the JIFL prototype • Evaluation • Example plugins • Future work

3. Abstract • [OMCB07] Olszewski, Mierle, Czajkowski, and Angela Demke Brown, “JIT Instrumentation - A Novel Approach To Dynamically Instrument Operating Systems,” Proceedings of the 2007 conference on EuroSys, pp. 3-16, ACM, Lisboa, Portugal, March 2007. • To efficiently instrument operating systems on-the-fly, the probe-based techniques are extremely expensive on variable-length ISA so that Olszewski et al. propose using just-in-time instrumentation and show feasibility and desirability.

4. Operating System Instrumentation +sophisticated control - slow compiler optimization - need reboot Static Instrumentation +load and unload on demand + convenient optimization Dynamic Instrumentation KernInst • overwrite kernel code with branch instructions • fixed-length ISA (RISC UltraSparc) only • probe-based instrumentation

5. Dynamic Instrumentation • Probe-based instrumentation - overwriting binary • fixed-length ISA • trampoline • variable-length ISA • trap

6. Just-in-time instrumentation - rewriting binary < Step 1 > < Step 2 >

7. < Step 3 > < Step 4 >

8. Runtime System JIT Compiler Dispatcher Memory Manager Design of the JIFL Prototype User Space JIFL Plugin Starter Kernel Space JIFL Plugin (Loadable Kernel Module) Linux Kernel System Call Code JIFL (Loadable Kernel Module) JIFL Instrumentation API Heap Code Cache

11. Gaining and releasing control • to gain control • patching the system call table to redirect execution to system call stub • time to release control • at the end of system call • at any calls to schedule() • rewrite jifl_schedule() to return to current thread once again

12. Optimizing instrumented codes • register and Eflags liveness analysis • instrumentation inlining • Memory allocator • using a custom memory allocator for code cache and instrumentation area • SMP consideration • handling migration and scheduling • rewriting jifl_schedule()

13. JIFL plugins void plugin_start() { syscall_init(&syscall, __NR_clone); syscall_add_bb_instrumentation(&syscall, bb_inst, NULL); syscall_start_instrumenting(&syscall); } void plugin_stop() { syscall_stop_instrumenting(&syscall); } void bb_inst(bb_t *bb, void *arg) { bb_insert_call(bb, add_count, ARG_VOID_PTR, &count, ARG_INT32, bb_size, ARG_END); } void add_count(long long *counter_ptr, long size) { *counter_ptr += size; } < An example of JIFL plugin >

14. Monitoring Lock Contention • Counting the number of times the atomic exchange fails mov counter, %eax 1: mov %eax, %edx add %0x1, %edx lock cmpxchg %edx, counter jne 1 < Atomic increment assembly code >

15. Evaluation • Testing environment • 4-way Intel Pentium 4 Xeon • kernel 2.6.17.13 patched for boosting Kprobes • Three types of instrumentation • coarse-grained: system call monitoring • medium-grained: call tracing • fine-grained: basic block counting

17. Future Work • Kernel thread migration in SMP • need to treating private code cache • Instrumentation of kernel thread • without unit of basic blocks

18. So What? • OMCB07 applies catching system call • duplicating a unit of basic block  watch point