JIFL JIT Instrumentation Framework for Linux Marek Olszewski

JIFL: JIT Instrumentation Framework for Linux Marek Olszewski Adam Czajkowski Keir Mierle University of Toronto 1

Instrumenting Operating Systems o Operating systems are growing in complexity n o Kernel instrumentation is a well know method of combating this problem n o Becoming harder to understand Used for: debugging, profiling, monitoring, coverage testing, security auditing. . . Dynamic instrumentation is especially useful n No recompilation & no reboot n Good for debugging systemic problems n Feasible in production settings 2

Dynamic Instrumentation o All dynamic instrumentation tools for operating systems are probe based n Overwrite existing code with jump/trap instructions o Efficient on fixed length architectures o Slow on variable length architectures n o Must use trap instruction (and hash table lookup) JIT-based instrumentation can be more efficient n Proven itself for user space (Pin, Valgrind) n Probe-based instrumentation is seldom used in userspace 3

Probe-based Instrumentation OS Code Trap Handler 1. 2. 3. Look up which instrumentation to call Call instrumentation Emulate overwritten instruction Instrumentation Code 4

JIT Instrumentation o o JIT instrumentation rewrites the OS code with calls to instrumentation code n Creates a duplicate instrumented copy of the OS n Called the code-cache Since instrumentation is dynamic, it is not feasible to rewrite the entire operating system up-front n o Instrumentation is performed just-in-time, basic block by basic block, right before each new basic block is executed. The resulting code is fast n No hash table lookup required n Though there is some cost in executing in the codecache 5

JIT Instrumentation OS Code Duplicate Copy of OS Instrumentation Code 6

Software Architecture 7

Performance Evaluation Apache Web Server Throughput 10

Conclusions o o JIT instrumentation viable for operating systems Fine grained instrumentation now possible for kernel space on variable length architectures n Intel’s x 86 n AMD’s AMD 64 o Great performance n Though it comes with a fixed cost 11