21.01.2013 Views

Lecture Notes in Computer Science 4917

Lecture Notes in Computer Science 4917

Lecture Notes in Computer Science 4917

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Us<strong>in</strong>g Dynamic B<strong>in</strong>ary Instrumentation 309<br />

P<strong>in</strong> Valgr<strong>in</strong>d<br />

itanium<br />

arm<br />

x86<br />

x86_64<br />

ppc<br />

alpha sh4<br />

m68k sparc<br />

mips<br />

cris<br />

hppa<br />

Qemu<br />

Fig. 4. Architectures supported by P<strong>in</strong>, Qemu, and Valgr<strong>in</strong>d: IA32 is the ideal platform<br />

for comparison, as it is supported by all of three tools<br />

2.2 P<strong>in</strong><br />

P<strong>in</strong> [7] is a dynamic b<strong>in</strong>ary <strong>in</strong>strumentation tool that runs on Intel architectures<br />

(<strong>in</strong>clud<strong>in</strong>g IA32, Intel 64, Itanium, and Xscale), and it supports L<strong>in</strong>ux, W<strong>in</strong>dows,<br />

and Mac<strong>in</strong>tosh OSX operat<strong>in</strong>g systems. We use the P<strong>in</strong>Po<strong>in</strong>t [10] BBV generation<br />

tool bundled with version p<strong>in</strong>-2.0-10520-gcc.4.0.0-ia32-l<strong>in</strong>ux. P<strong>in</strong> analysis<br />

rout<strong>in</strong>es are written <strong>in</strong> C++, and the <strong>in</strong>strumentation happens just-<strong>in</strong>-time, with<br />

the result<strong>in</strong>g <strong>in</strong>strumented code cached for performance. The core of P<strong>in</strong> is proprietary,<br />

so <strong>in</strong>ternals must be treated as a black box. P<strong>in</strong>Po<strong>in</strong>t analyses run from<br />

1.5 (swim) to20(vortex) times slower than the b<strong>in</strong>ary run on native hardware.<br />

2.3 Qemu<br />

Qemu [2] is a portable dynamic translator. It is commonly used to run a full operat<strong>in</strong>g<br />

system under hardware emulation, but it also has a L<strong>in</strong>ux user-space emulator<br />

that runs stand-alone L<strong>in</strong>ux b<strong>in</strong>aries us<strong>in</strong>g system-call translation. Qemu<br />

supports the Alpha, SPARC, PowerPC, sh4, IA32, AMD64, MIPS, m68k, and<br />

ARM architectures. The user-mode translation we use is currently supported on<br />

L<strong>in</strong>ux. Ongo<strong>in</strong>g work will support more operat<strong>in</strong>g systems. Qemu uses gcc to<br />

compile code correspond<strong>in</strong>g to each <strong>in</strong>termediate language micro-operation. At<br />

translation time, these pre-compiled micro-operations are cha<strong>in</strong>ed together to<br />

create translated basic blocks that are cached.<br />

Qemu is not designed for DBI. Us<strong>in</strong>g it for our purposes requires <strong>in</strong>trusive<br />

changes to Qemu source. Our code is a patch applied on top of the Qemu 0.9.0<br />

release. We add a unique identifier field to the <strong>in</strong>ternal TargetBlock basic block<br />

structure, which is set the first time a BB is translated. At translation time, we<br />

<strong>in</strong>strument every <strong>in</strong>struction to call our BBV track<strong>in</strong>g rout<strong>in</strong>e to update BBV<br />

counts and total <strong>in</strong>struction count. Once the <strong>in</strong>terval size is reached, the BBV<br />

file is updated, and all counters are reset. Qemu runs from between 4 (art) to<br />

40 (vortex) times slower than native execution. This makes it slower than P<strong>in</strong><br />

but faster than our Valgr<strong>in</strong>d implementation.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!