Paradyn Project Paradyn / Dyninst Week Madison, Wisconsin May 2-4, 2011 ProcControlAPI and StackwalkerAPI Integration into Dyninst Todd Frederick and Dan McNulty

AST Binary Process Stackwalker API Stackwalker API Patch API Patch API Symtab API Symtab API DataFlow API DataFlow API Instruction API Parse API Parse API Code Gen Code Gen ProcControl API Binary = Existing Component = New Component = Proposed Dyninst and the Components Stackwalker API Stackwalker API ProcControl API

Process Control and Stackwalking in Dyninst o Process control: o Modify processes’ memory during instrumentation o Capture events such as exit, fork, library load o Start and stop processes and threads o Stackwalking: o Analysis during instrumentation o Provide stackwalks to users Stackwalking needs process control to access memory and registers 3 ProcControlAPI and StackwalkerAPI Integration

ProcControlAPI and StackwalkerAPI o Already released o Who is using these components now? o Who is not using these components now? o Dyninst gains new features and stability when integrated with these components 4 ProcControlAPI and StackwalkerAPI Integration ProcControlAPI o proc++ Filesystem o StackwalkerAPI o Dyninst StackwalkerAPI o STAT o Libra o PnMPI o ATP o …and more o Dyninst

Ideal Componentization Process o New components should separate existing functionality out of Dyninst o Keeping Dyninst in mind ensures the components work together correctly 5 ProcControlAPI and StackwalkerAPI Integration Dyninst Process Control Functionality Process Control Component

Actual Componentization Process o We developed ProcControlAPI and StackwalkerAPI separately from Dyninst o Interfaces to these components do not exactly match Dyninst’s requirements 6 ProcControlAPI and StackwalkerAPI Integration Dyninst Process Control Functionality Process Control Component

Why Separate ProcControlAPI? o Clean interface to complex, notoriously buggy, OS-dependent debugger interfaces 7 ProcControlAPI and StackwalkerAPI Integration Your Code/ Stackwalker/ Dyninst ProcControlAPI Linux Debugger Interface Breakpoints Thread events FreeBSD Debugger Interface Windows Debugger Interface BlueGene Debugger Interface VxWorks Debugger Interface Read memory Stop process Low Level Commands Low Level Events System Interface

Threading inside Dyninst/ProcControlAPI 8 ProcControlAPI and StackwalkerAPI Integration o Integrating ProcControlAPI into Dyninst introduces a new threading model o Leverage threads to handle multiple inputs o User API calls o System debug interface o Internal event handling o Types of threads o Event decoders o Event handlers

Dyninst 7.0 Threading Model o 2 threads per mutatee process 9 ProcControlAPI and StackwalkerAPI Integration Mutator Process Model Target Process RT Lib Target Process RT Lib Mutatee Process Runtime Library Event Decoders Runtime Library Event Handler Event Handlers Event notifications User Thread Execute callbacks Update data structures Abstract events OS events Asynchronous events Update data structures Event notifications DyninstAPI Dyninst+ProcControlAPI

Dyninst+ProcControlAPI Threading Model o 1 event decoder, 2 event handlers 10 ProcControlAPI and StackwalkerAPI Integration Mutator Target Process RT Lib Target Process RT Lib Mutatee Process Event Decoder Event Handler Abstract events Update data structures Execute callbacks OS events Event notifications Process Model Event notifications Process Model No longer update data structures DyninstAPI ProcControlAPI User Thread Runtime Library

New functionality with ProcControlAPI o Synchronous events for mutatee thread creation and destruction o No more “Dead On Arrival” threads o Possible new DyninstAPI features o Separate kernel-level and user-level thread events o Real breakpoints and single-stepping 11 ProcControlAPI and StackwalkerAPI Integration

Target Process New Feature – Detach-on-the-fly o Useful when multiple target processes generate many events that require no Dyninst action o e.g., profiling timers generating signals o Temporarily detach from mutatee process 12 ProcControlAPI and StackwalkerAPI Integration Old Mutatee Process Mutator Process DyninstAPI Library Temporary Detach Events Re-attach Events Forward Events Events

StackwalkerAPI and Dyninst o Many tools already use StackwalkerAPI o Dyninst still uses separate, older code for walking stacks 13 ProcControlAPI and StackwalkerAPI Integration Dyninst Old Stackwalking Functionality StackwalkerAPI ATP STAT Libra PnMPI

Why Separate StackwalkerAPI? o Dyninst currently has separate stackwalking functionality for each platform o StackwalkerAPI abstracts common stackwalking patterns across platforms 14 ProcControlAPI and StackwalkerAPI Integration Stackwalking Interface Platform-Specific Support Debug Information Instrumentation Signal Handlers Frame Functions Heuristics Platform-Specific Stackwalking Frame Functions Debug Information Signal Handlers Instrumentation Heuristics

Why Separate StackwalkerAPI? o Stack frames on different architectures have different binary layouts o StackwalkerAPI Frame objects are a cross-architecture representation 15 ProcControlAPI and StackwalkerAPI Integration StackwalkerAPI Frame Return Address Frame Pointer Stack Pointer StackwalkerAPI Frame Return Address Frame Pointer Stack Pointer x86 Stack Frame Stack Pointer Frame Pointer Previous Stack Pointer Return Address Previous Frame Pointer Previous Return Address POWER Stack Frame Frame Pointer Previous Frame Pointer Return Address Previous Return Address Previous Stack Pointer

New Functionality with StackwalkerAPI o Extensible with frame steppers o Users can tell Dyninst how to walk through non- standard frames o Dyninst uses this feature to handle its own instrumentation o Binary analysis-based frame stepper o Determines how binary code creates stack frames o More robust than existing heuristics o Uses ProcControlAPI for third-party walks o Improved stability by sharing Dyninst’s view of a process 16 ProcControlAPI and StackwalkerAPI Integration

Extending StackwalkerAPI with Steppers o Frame stepper objects encapsulate the logic to walk different kinds of stack frames o Users can add new Frame teppers, as Dyninst does to walk through instrumentation 17 ProcControlAPI and StackwalkerAPI Integration main() { signal(SIGALRM, signal_handler); alarm(1); } signal_handler() { // Instrument // with foo } foo() { walkStack(); } Stack Frame foo _start __libc_start_main main __restore_rt signal_handler [Dyninst Tramp] Debug Information Stepper Signal Handler Stepper Instrumentation Stepper

Analysis-Based Stackwalking o Our analysis tracks how each instruction changes the height of the stack 18 ProcControlAPI and StackwalkerAPI Integration Analysis: Stack Heights Stack Frame Stack Pointer 0x4:-16 0x0: -8 0x4: SUB 40, RBP 0x1: MOV RSP, RBP 0x0: PUSH RBP 0x1: -16 0x8:-56 0x8:...

Analysis-Based Stackwalking o Using the stack height at an instruction, we determine how to find the next stack frame 19 ProcControlAPI and StackwalkerAPI Integration Analysis: Stack Heights Stack Frame 0x8:-56 0x1: -16 0x0: -8 0x4: SUB 40, RBP 0x1: MOV RSP, RBP 0x0: PUSH RBP 0x8:... 0x4:-16 Frame Object Stack Pointer Frame Object Stack Pointer 0x8:-56

Where we are o In-development version of Dyninst fully integrated with ProcControlAPI and StackwalkerAPI o Stable on Linux o Incomplete platform support for ProcControlAPI and StackwalkerAPI 20 ProcControlAPI and StackwalkerAPI Integration LinuxWindowsFreeBSDVxWorksBG/P ProcControlAPI StackwalkerAPI

Dyninst 8.0 o Complete support of ProcControlAPI and StackwalkerAPI on all missing platforms o Dynamic instrumentation on new platforms o BlueGene/P, FreeBSD o New features from integration effort o Detach-on-the-fly o Binary analysis-based frame stepper 21 ProcControlAPI and StackwalkerAPI Integration

Questions 22 ProcControlAPI and StackwalkerAPI Integration