Generalized Code Relocation for Instrumentation and Efficiency

Andrew R. Bernat
University of Wisconsin bernat@cs.wisc.edu

2006 Andrew R. Bernat

March 2006

Generalized Code Relocation

Design Objectives
Whole-program instrumentation
Instrument every instruction in the program and all control flow edges as well

Efficient instrumentation
No traps! Minimize extraneous jumps Restrict register save/restores

Flexible, extensible instrumentation system

Laying the groundwork for binary rewriting
2006 Andrew R. Bernat 2 Generalized Code Relocation

Multitramps
Whole-program instrumentation
All instructions, including neighbors All control flow edges

One trampoline per basic block

Reduces number of extra branches

Hierarchical code generation

Extensible Allows for a variety of optimizations

2006 Andrew R. Bernat

Generalized Code Relocation

Function Relocation
Efficient instrumentation
Blocks too small for branch to instrumentation Instrumentation too far away No traps!

Shared functions
Copy to remove sharing

Function rewriting
Undo optimizations
2006 Andrew R. Bernat 4 Generalized Code Relocation

Old Instrumentation Overview

Application Program Function foo instr1 instr2 instr3 Base Trampoline Save Regs Restore Regs instr2 Save Regs Restore Regs
Instrumentation Code

Mini Trampolines
Instrumentation Code

2006 Andrew R. Bernat

Generalized Code Relocation

Old Instrumentation - Consecutive

Application Program Function foo instr1 instr2 instr3 instr1 Multiple Base Trampolines Mini Trampolines

instr2

2006 Andrew R. Bernat

Generalized Code Relocation

Application Program

Old Instrumentation Uninstrumentable Neighbors

Base Trampoline instr1 Save Regs Restore Regs instr2 Save Regs Restore Regs instr3
Instrumentation Code

Mini Trampolines
Instrumentation Code

Function foo instr1 instr2 instr3

2006 Andrew R. Bernat

Generalized Code Relocation

Edge instrumentation
Application Program Function foo Edge Trampoline pre-branch branch branch fallthrough jump taken Base Trampolines

save/restore save/restore save/restore

Instrument edges via another level of indirection (plus extra branches)

2006 Andrew R. Bernat 8 Generalized Code Relocation

Limitations of Old Instrumentation

Incomplete instrumentation coverage
Often could not instrument near-by instructions

Inefficient instrumentation
Edges, consecutive instructions require extra branches

Platform specific implementation

Inextensible and bug-prone

2006 Andrew R. Bernat

Generalized Code Relocation

Multitramp Principles
Basic-block instrumentation
One jump to/from per block Efficient instrumentation of neighbor instructions

Logical view: a control flow graph

Relocated instructions + instrumentation Apply compiler techniques to dynamic instrumentation

2006 Andrew R. Bernat

10

Generalized Code Relocation

Multitramps
Application Program Function foo Multitramp Base Tramp Instruction Instruction Basic Block Base Tramp Branch Fallthrough
2006 Andrew R. Bernat 11

Target
Generalized Code Relocation

Multitramp Implementation
A multitramp is a tree of code objects Code objects provide the following:
Maximum space required (worst case) Generate, install, and link callbacks Map relocated to original address

Single mechanism for both instruction and edge instrumentation

2006 Andrew R. Bernat 12 Generalized Code Relocation

Multitramp Example
Base Tramp 1 Instruction Branch Base Tramp 2 Base Tramp 3
2006 Andrew R. Bernat

Mini Tramp 1 Mini Tramp 2

Mini Tramp 3 Mini Tramp 4

13

save ; BT 1 <branch <MT 1 restore ; BT 1 <relocated instr< <branch <BT 3 save ; BT 2 <branch <MT 3 restore ; BT 2 return save ; BT 3 <branch <MT 4 restore ; BT 3 return
Generalized Code Relocation

In-Line Instrumentation
Current out-of-line model is based on the requirements of Paradyn
Frequent insertion/removal of instrumentation

Limited opportunity for optimization

Particularly register saves and restores

What about long-lived instrumentation?

2006 Andrew R. Bernat

14

Generalized Code Relocation

In-Line Instrumentation
In-line instrumentation into a single code sequence:
Relocated instructions Save/restore code Instrumentation

Replace entire sequence when something changes! BPatch::setMergeTramp(true)

2006 Andrew R. Bernat 15 Generalized Code Relocation

Multitramp Status
Extensible implementation
Can add new code objects to multitramp CFG:
Raw binary sections. Control flow-altering code

In-line instrumentation
POWER, x86-64

Platform-independent design
Encapsulated platform-dependent sections Included with all platforms in Dyninst 5.0

2006 Andrew R. Bernat

16

Generalized Code Relocation

Multitramp Results
Whole-program instrumentation
Instrument every instruction in the program and all control flow edges as well

Efficient instrumentation
No traps! Minimize extraneous jumps Restrict register save/restores

Flexible, extensible instrumentation system

Laying the groundwork for binary rewriting
2006 Andrew R. Bernat 17 Generalized Code Relocation

Function Relocation
The basic block may be too small to contain a branch to instrumentation
IA-32, x86-64

We may not have the available registers to construct a long branch

POWER, SPARC

Solution: relocate on a function level

Sufficient space to fit large branches Dead registers that can be used to branch

2006 Andrew R. Bernat

18

Generalized Code Relocation

Old Approach
One-time relocation
Preemptively expand possible instrumentation sites:
Function entry, exit, call sites; loop entry, exits But what about everything else?

Linear scan of the function, ignoring control flow.

Dangerous with in-lined data

2006 Andrew R. Bernat

19

Generalized Code Relocation

Incremental Function Relocation

A function is a list of basic blocks Accumulate modifications to each block
Ex: block must be 5 bytes long

Generate relocated versions on-the-fly

Only modify what is necessary

Add instrumentation to the new function

2006 Andrew R. Bernat 20 Generalized Code Relocation

Function Relocation - Example

block 1 block 2

Block 2 is too small to patch in a jump

block 3

block 1

block 3

Add modification
block 4

block 2 block 2

block 4

block 5

block 5

1. Copy the function 2. Enlarge block 2 3. Replace

Generalized Code Relocation

2006 Andrew R. Bernat

21

Other Uses for Relocation

Overlapping functions
Relocation disambiguates code Instrument unique per-function copy

Undo optimizations
Rewrite the function during relocation Example: unwinding a tail call

2006 Andrew R. Bernat

22

Generalized Code Relocation

Function Relocation Status

Platform-independent function relocation engine
IA-32, x86-64, POWER, SPARC

Support for multiple relocated versions

On-the-fly code relocation

Extensible modification interface

Block must be 5 bytes long Modify the instructions in the block

2006 Andrew R. Bernat

23

Generalized Code Relocation

Design Objectives
Whole-program instrumentation
Instrument every instruction in the program and all control flow edges as well

Efficient instrumentation
No traps! Minimize extraneous jumps Restrict register save/restores

Flexible, extensible instrumentation system

Laying the groundwork for binary rewriting
2006 Andrew R. Bernat 24 Generalized Code Relocation

Conclusion
Multitramps
Whole-program instrumentation approach

Function relocation
Instrument everywhere (without traps)

People
Drew Bernat Multitramps Nate Rosenblum Function relocation Nick Rutar Register optimizations

2006 Andrew R. Bernat

25

Generalized Code Relocation