Assembly Instruction Level Reverse Execution for Debugging

Size: px

Start display at page:

Download "Assembly Instruction Level Reverse Execution for Debugging"

Cori Fox
5 years ago
Views:

1 Assembly Instruction Level Reverse Execution for Debugging PhD Dissertation Defense by Tankut Akgul Advisor: Vincent J. Mooney School of Electrical and Computer Engineering Georgia Institute of Technology March 2004

2 Outline Background Reverse Execution Definition Previous Work Reverse Execution Methodology Program Slicing Definition Previous Work Program Slicing Methodology Experimental Results 2

3 Background Start the program Detect an error Determine the bug location(s) Restart the program Remove the bug(s) and recompile the program Errorfree program Debugging is a repetitive process! 3

4 Outline Background Reverse Execution Definition Previous Work Reverse Execution Methodology Program Slicing Definition Previous Work Program Slicing Methodology Experimental Results 4

5 Definition of Reverse Execution Reverse execution: Taking a program T from its current state S i to a previous state S j Source code level reverse execution: Reverse execution where S j can be as early as one source code statement before state S i Instruction level reverse execution: Reverse execution where S j can be as early as one assembly instruction before state S i 5

6 Previous Work Debugging Optimistic Simulations Database Applications Interactive Systems Editors Program development environments 6

7 Previous Work in Reverse Execution Restore earlier state Periodic checkpointing Incremental checkpointing Regenerate part of earlier state Source transformation Build a reversible processor with reversible circuit elements (Pendulum) 7

8 Previous Work in Reverse Execution Periodic checkpointing: Memory usage for state saving: 12KB + 12KB + 12KB + 12KB + 12KB = 60KB Incremental checkpointing: Memory usage for state saving: 4KB + 8KB + 4KB + 4KB + 4KB = 24KB = 4KB 8

9 Previous Work in Reverse Execution Source Transformation: Sample () { int x, y; y = 0; x += 10; if (x > 15) y++; else y; } Source code State saved for each destructive operation Sample () { int x, y; save y; y = 0; x += 10; if (x > 15) { b = 0; y++; } else { b = 1; y; } } Transformed code Sample_rev () { int x, y; if (b == 0) y; else y++; x = 10; restore y; } Reverse code Destructive operation: An operation whose target operand is different than its source operands C. Carothers, K. Perumalla and R. Fujimoto, Efficient Optimistic Parallel Simulations using Reverse Computation, in Proceedings of ACM/IEEE/SCS Workshop on Parallel and Distributed Simulation (PADS), Atlanta, USA, May

10 Previous Work in Reverse Execution Heavy use of state saving State saving = memory and time overheads during forward execution No direct instruction level reverse execution support 10

11 Outline Background Reverse Execution Definition Previous Work Reverse Execution Methodology Program Slicing Definition Previous Work Program Slicing Methodology Experimental Results 11

12 Reverse Execution Methodology Assumptions: State that cannot be modified directly does not include debugging information E.g., condition status register Physical memory is treated as a uniform entity Exact physical memory state is not preserved E.g., a value not in cache can be brought into cache after recovery Sequential execution model Indirect calls are made to welldefined target points 12

13 Reverse Execution Methodology We define the state of a processor as follows: S = ( PC, M', R' ) PC : program counter M' : directly modified memory values R' : directly modified register values In order to reverse execute a program, do the following: Construct a reverse program RT for an input program T Recover M' and R' by executing RT in place of T Recover the program counter value by using the correspondence between T and RT 13

14 Reverse Execution Methodology Reverse Code Generation (RCG) steps: 1. Divide the original program into program partitions 2. Generate the reverse of the instructions. The reverse of an instruction is called a Reverse Instruction Group (RIG) 3. Combine the RIGs 3.a Combine the RIGs to generate the reverse of each basic block (RBB) 3.b Combine the RBBs to generate the reverse of each partition 3.c Combine the reverse partitions to generate the reverse of whole program 14

15 Reverse Execution Methodology start Partition the input program while constructing a call graph Build a modified value graph for current partition Read an instruction α from current partition Generate a RIG for α N end of BB? Y Connect the RBB to reverse program Connect the reverse partition to reverse program, go to next partition N end of partition? Y end of program? Y end N 15

16 Step 1: Program Partitioning Partitions are regions of code delimited by function call or indirect branch instructions that may exist within the original code e.g., in PowerPC instruction set: bl : function call instruction blr : branch to link register instruction (indirect) 16

17 main: Step1: Program Partitioning li r 3,0x5 bl foo addi r 12, r 12, 1 blr foo: li r 11, 3 ori r 12, r 3, 15 divw r 10, r 3, r 11 cmpwi r 10, 100 bg L1 sub r 11, r 3, r 12 b L2 L1: addi r 12, r 10, 1 sub r 11, r 12, r 3 L2: mullw r 12, r 11, r 10 blr first partition of main second partition of main single partition of foo main: li r 3,0x5 bl foo addi r 12, r 12, 1 blr foo: li r 11, 3 ori r 12, r 3, 15 divw r 10, r 3, r 11 cmpwi r 10, 100 bg L1 sub r 11, r 3, r 12 b L2 L1: addi r 12, r 10, 1 sub r 11, r 12, r 3 L2: mullw r 12, r 11, r 10 blr 17

18 Methodology (Continued) Reverse Code Generation (RCG) steps: 1. Divide the program into program partitions (single entrysingle exit regions). 2. Generate the reverse of the instructions. The reverse of an instruction is called a Reverse Instruction Group (RIG) 3. Combine the RIGs 3.a Combine the RIGs to generate the reverse of each basic block (RBB) 3.b Combine the RBBs to generate the reverse of each partition 3.c Combine the reverse partitions to generate the reverse of whole program 18

19 Step 2: RIG Generation Three techniques to generate a RIG: 1. Redefine technique 2. Extractfromuse technique 3. State saving technique 19

20 Step 2: RIG Generation (Cont.) r 1 = r 2 + r 3 start r 2 < 0 false true r 1 = r 2 Find the definitions of r 1 reaching P Recover r 1 by selectively reexecuting the found definitions or by selectively extracting the found definitions out of later uses of those definitions r 4 = r 1 + r 3 r 1 = r 2 4 P α RIG for α : if r 2 < 0 r 1 = r 4 r 3 or r 1 = r 2 else r 1 = r 2 + r 3 exit Extractfromuse Redefine 20

21 Step2: RIG Generation (Cont.) r 1 1 Select operator r 1 = r 2 + r 3 r 1 3 = Φ(r 11,r 12 ) r 4 1 r 1 4 start r 2 < 0 false true r 1 2 r 4 = r 1 + r 3 r 1 = r 2 4 exit r 1 = r 2 P α P' Rename Values Generate a directed graph called modified value graph (MVG) Find the definition of r 1 reaching P Recover r 1 using available nodes at P' r 1 0 RIG for α : r 4 0 r 1 2 r 20 < 0 r 1 3 Φ r 1 4 r r r r 0 2 r 0 3 if r 2 < 0 r 1 = r 4 r 3 or r 1 = r 2 else r 1 = r 2 + r 3 21

22 Methodology (Continued) Three steps to generate a complete reverse program: 1. Divide the program into program partitions (single entrysingle exit regions). 2. Generate the reverse of the instructions. The reverse of an instruction is called a Reverse Instruction Group (RIG) 3. Combine the RIGs 3.a Combine the RIGs to generate the reverse of each basic block (RBB) 3.b Combine the RBBs to generate the reverse of each partition 3.c Combine the reverse partitions to generate the reverse of whole program 22

23 Step 3.a: Constructing the RBBs BB 1 i 1 i 2 RBB 1 RIG 2 RIG 1 BB 2 i 3 BB 3 i 5 i 4 i 6 i 7 RBB 2 RIG 4 RBB 3 RIG 7 RIG 3 RIG 6 RIG 5 BB 4 i 8 RBB 4 RIG 8 Bottomup placement order within BBs 23

24 Step 3.b: Combining the RBBs start? start BB 1 α 1 α 2 RBB 6 RIG 9 α 5 BB 2 BB 3 cb α 6 BB 4? α 8 α 7? α 3 α 4 BB 5 RBB 5 RBB RIG 4 7 RIG 8 RBB 3 cb RIG RBB 4 RIG 6 2 RIG 3 RIG 5 BB 6 α 9 exit BB: Basic Block RBB: Reverse of a BB cb: Conditional branch RBB 1 RIG 2 RIG 1 cb exit 24

25 Step 3.c: Combining the Reverse Partitions A 0 A 1 A 2 main: cmp r1, r2 bl g; blr g: mtlr r0 bclrl // call g // return m 1 m 2 g 1 // set a func. ptr. // call by the func. ptr. A 0 start m 1 g 1 m 2 A 2 A 2 A 2 A 0 A 1 A 3 A 2 g 2 A 2 A 4 h A 3 A 4 blr h: blr // return // return g 2 h end A 3 Push addresses on the dynamically taken edges into stack Pop the addresses from stack during reverse execution and branch to reverses of popped addresses 25

Recovering the Program Counter Input Program RCG algorithm Reverse Program Reverse of the input program Program being debugged Inversion Table Designates

26 Recovering the Program Counter Input Program RCG algorithm Reverse Program Reverse of the input program Program being debugged Inversion Table Designates the entry point into the reverse program for every instruction in the input program Input instruction address 0x0 0x4 0x8 RIG address 0x4000 0x3FFC 0x3FE0 26

27 Complexity Byte Recover (Node n) { if (n.available == true) return true; m children(n) do { stat = Recover(m); if stat!= available break; } m parents(n) do { stat = Recover(m); if (stat == available) { z siblings(n) do { stat = Recover(z); if (stat!= available) break; } } if (stat == available) break; } Write_RIG(); } N : number of nodes in an MVG # of assembly instructions in a code M : average degree of a node (# of neighbors) K : maximum number of repetitive applications of redefine and extractfromuse techniques allowed M is independent of total code size for fixed partition size Complexity = O(N M K ) On a 1 GHz CPU, 1 iteration 1 nsec N = 1,000,000, M = 10, K = 3 1 sec 27

28 Outline Background Reverse Execution Definition Previous Work Reverse Execution Methodology Program Slicing Definition Previous Work Program Slicing Methodology Experimental Results 28

29 Program Slicing Static Slice: A set of program statements that may influence a variable V at statement S. C = (V, S) is a static slicing criterion. Dynamic Slice: A set of program statements that influence a variable V at an execution instance q of statement S given a set of program inputs X. C = (X, V, S q ) is a dynamic slicing criterion. 29

30 Program Slicing Two ways to influence a variable: Data dependency y = z; x = y + 1; x is data dependent on y and z Control dependency if (y < 0) x = 1; x is control dependent on y A slice is a set of all statements that compute dependencies of a variable 30

31 Program Slicing Pass = 0 ; Fail = 0 ; Count = 0 ; while (!eof()) { TotalMarks=0; scanf("%d",marks); if (Marks >= 40) Pass = Pass + 1; if (Marks < 40) Fail = Fail + 1; Count = Count + 1; TotalMarks = TotalMarks+Marks ; } average = TotalMarks/Count; /* This is the point of interest */ printf("the average is %d\n",average) ; PassRate = Pass/Count*100 ; printf( Pass rate is %d\n",passrate) ; Original Program while (!eof()) { TotalMarks=0; scanf("%d",marks); Count = Count + 1; TotalMarks = TotalMarks+Marks; } average = TotalMarks/Count; printf("the average is %d\n",average) ; Slice w.r.t.. average average Example is taken from Prof. Mark Harman s webpage at 31

32 Previous Work in Program Slicing Static Slicing (Weiser) Control flow graph analysis No runtime information Static Slicing (Ottenstein et al.) Program dependency graph analysis No runtime information Dynamic Slicing (Korel and Laski) Control flow graph analysis Program execution trajectory Dynamic Slicing (Agrawal et al.) Dynamic dependence graph (DDG) analysis Program execution trajectory 32

33 Outline Background Reverse Execution Definition Previous Work Reverse Execution Methodology Program Slicing Definition Previous Work Program Slicing Methodology Experimental Results 33

34 RCG with Slicing (RCGS) Forward execution Input program Dynamic slicing table Fullscale reverse execution Reverse program local MVGs Global MVG Reduced reverse program Reverse execution along a dynamic slice Orange arrows indicate the base static analysis performed only once per program Blue arrows indicate the extended static analysis performed for each dynamic slice Green arrows indicate the actions performed by the debugger 34

35 Contributions of RCGS Reverse execution along a dynamic slice Faster reverse execution No complete execution trajectory is required Less runtime memory usage Not only reveals dynamic slice instructions but also obtains runtime values of variables More efficient debugging 35

36 Reverse Execution Along a Dynamic Slice stw li li ori li %r0,0x4(%r1) %r8,0x64 %r10,0x1 %r12,%r10,0x0 %r11,0x1 Determine data dependencies statically Determine control flow dynamically cmpw %r8,%r11 blt 0x1000c0 add %r9,%r12,%r10 ori %r10,%r12,0x0 ori %r12,%r9,0x0 addi %r11,%r11,0x1 b 0x1000a4 Merge static information with dynamic information to reverse execute along the dynamic slice bclr 0x14,0x0 36

37 Generation of a Reduced Reverse Program 37

38 Experimentation Platform Background Debug Mode (BDM) Interface PC Windows 2000 MBX860 MPC860 processor 4MB DRAM, 2MB Flash RTC, four 16bit timers, watchdog 38

39 Comparisons Reverse Execution with Incremental State Saving (ISS) Save state before each instruction Reverse Execution with Incremental State Saving for Destructive Instructions (ISSDI) Save state before each destructive instruction Reverse Execution with RCG 39

40 Benchmarks Benchmark Executable object size (bytes) Selection sort 3104 Matrix multiply 3308 ADPCM encoder 6908 LZW 4636 ADPCM: Adaptive Differential Pulse Code Modulation LZW: Lempel Ziv Welch 40

41 Benchmarks Benchmark Selection sort (100 inputs) Selection sort (1000 inputs) Selection sort (10000 inputs) Matrix multiply (4x4) Matrix multiply (40x40) Matrix multiply (400x400) ADPCM (32KB input data) ADPCM (64KB input data) ADPCM (128KB input data) LZW (1KB input data) LZW (4KB input data) LZW (16KB input data) 1 tick = 0.4 microseconds on MBX860 Raw Execution Time (decrementer ticks) 21,187 2,000, ,539, , ,183, , ,280 1,496,649 1,380,413 16,063, ,451,339 41

42 Experiment 1 Instrument each benchmark with state saving instructions at appropriate points for ISS, ISSDI and RCG Forward execute each instrumented benchmark from the beginning until the end Measure forward execution times 42

43 Instrumented Forward Execution Time Benchmark ISS ISSDI RCG ISS/ RCG ISSDI/ RCG Selection sort (100 inputs) X 1.24X Selection sort (1000 inputs) X 1.27X Selection sort (10000 inputs) X 1.27X Matrix multiply (4x4) X 1.70X Matrix multiply (40x40) X 1.88X Matrix multiply (400x400) X 1.90X ADPCM (32KB input data) X 1.20X ADPCM (64KB input data) X 1.20X ADPCM (128KB input data) X 1.20X LZW (1KB input data) X 1.31X LZW (4KB input data) X 1.34X LZW (16KB input data) X 1.31X ISS: Incremental State Saving, ISSDI: Incremental State Saving for Destructive Instructions 43

44 Forward Execution Time Overhead % Overhead ISS ISSDI RCG % Overhead ISS ISSDI RCG Selection Sort (100) Selection Sort (1000) Selection Sort (10000) Matrix Multiply (4x4) Matrix Multiply (40x40) Matrix Multiply (400x400) % Overhead LZW (1KB) LZW (4KB) LZW (16KB) ISS ISSDI RCG % Overhead ADPCM (32KB) ADPCM (64KB) ADPCM (128KB) ISS ISSDI RCG Overhead = instrumented execution time raw execution time raw execution time 44

45 Experiment 2 Reverse execute each benchmark from the end until the beginning (by executing the reverse versions) Measure reverse execution times 45

46 Reverse Execution Time Benchmark ISS ISSDI RCG ISS/ RCG ISSDI/ RCG Selection sort (100 inputs) X 0.74X Selection sort (1000 inputs) Selection sort (10000 inputs) Matrix multiply (4x4) X 0.60X Matrix multiply (40x40) X 0.53X Matrix multiply (400x400) ADPCM (32KB input data) X 0.82X ADPCM (64KB input data) X ADPCM (128KB input data) LZW (1KB input data) LZW (4KB input data) LZW (16KB input data)

47 Experiment 3 Forward execute each instrumented benchmark from the beginning until the end Measure memory usage for state saving 47

48 Memory Usage for State Saving ISS (KB) ISSDI (KB) RCG (KB) ISS / RCG ISSDI / RCG Selection sort (100 inputs) X 6.3X Selection sort (1000 inputs) X 27X Selection sort (10000 inputs) X 55X Matrix multiply (4x4) X 14X Matrix multiply (40x40) X 143X Matrix multiply (400x400) X 1404X ADPCM (32KB input data) X 2X ADPCM (64KB input data) X 2X ADPCM (128KB input data) X 2X LZW (1KB input data) X 35X LZW (4KB input data) X 112X LZW (16KB input data) X 354X 48

49 Experiment 4 Forward execute original 400x400 matrix multiply from the beginning to various intermediate points and measure the execution times Reverse execute 400x400 matrix multiply using RCG from the end to various intermediate points and measure reverse execution times 49

50 Program Reexecute Approach vs. RCG 500 Time (seconds) Outermost loop iteration count Forward execution Reverse execution via RCG starting point for forward execution 400x400 matrix multiply starting point for reverse execution 50

51 Experiment 5 Extract three slices for each benchmark Reverse execute each benchmark fully starting from end of each slice until beginning of each slice Reverse execute each benchmark along computed slices only Measure the reverse execution times 51

52 Fullscale Reverse Execution vs. Reverse Execution Along a Slice time (microseconds) time (seconds) slice1 slice2 slice3 Selection Sort (10 inputs) slice1 slice2 slice3 ADPCM Encoder (128KB input) full reverse execution time (microseconds) time (seconds) slice1 slice2 slice3 Matrix Multiply (4x4) slice1 slice2 slice3 LZW (128KB input) reverse execution along a dynamic slice 52

53 Fullscale Reverse Execution vs. Reverse Execution Along a Slice time (microseconds) 1.00E E E E E E E E E E E E E E E E+01 4x4 multiply 40x40 multiply 400x400 multiply Matrix Multiply time (microseconds) 1.00E E E E E E E E E E E E E E integers 100 integers 1000 integers Selection Sort full reverse execution reverse execution along the dynamic slice 53

54 Experiment 6 Extract three slices for each benchmark Measure average runtime memory requirement for reverse execution along three slices with RCGS Measure average runtime memory requirement for reverse execution along three slices with ISS plus execution trajectory (ET) approach 54

55 Runtime Memory Requirements bytes RCGS ISS+ET Selection Sort (10 inputs) bytes RCGS ISS+ET Matrix Multiply (4x4) kilobytes RCGS ISS+ET megabytes RCGS ISS+ET ADPCM Encoder (128KB input) LZW (128KB input) RCGS memory usage ISS memory usage ET memory usage RCGS: RCG with Slicing ET: Execution Trajectory 55

56 Reverse Debugger Execute forward Step forward Execute backward Step backward Source window Memory window Register window Breakpoint window 56

57 Reverse Debugger Reverse Debugger Code Specs Number of C lines ~7000 Number of files 19 57

58 Conclusion Reduced debugging time with localized reexecutions Very low time and memory overheads in forward execution by using reverse code Reverse execution up to an assembly instruction level granularity Dynamic slicing support to speed up reverse execution without execution trajectory requirement 58

59 Publications T. Akgul, V. J. Mooney and S. Pande, A Fast Assembly Level Reverse Execution Method via Dynamic Slicing, accepted for publication in Proceedings of the 26 th International Conference on Software Engineering (ICSE'04), May T. Akgul and V. J. Mooney, Assembly Instruction Level Reverse Execution for Debugging, submitted to Transactions on Software Engineering and Methodology (TOSEM) on December 2002, accepted with minor revision. T. Akgul and V. J. Mooney, Instructionlevel Reverse Execution for Debugging, Proceedings of the Workshop on Program Analysis for Software Tools and Engineering (PASTE'02), pp. 1825, November T. Akgul and V. J. Mooney, Instructionlevel Reverse Execution for Debugging, Technical Report GITCC0249, September T. Akgul, P. Kuacharoen, V. Mooney and V. Madisetti, "A Debugger RTOS for Embedded Systems," Proceedings of the 27th EUROMICRO Conference (EUROMICRO'01), pp , September P. Kuacharoen, T. Akgul, V. Mooney and V. Madisetti, "Adaptability, Extensibility, and Flexibility in RealTime Operating Systems," Proceedings of the EUROMICRO Symposium on Digital Systems Design (EUROMICRO'01), pp , September T. Akgul, P. Kuacharoen, V. J. Mooney and V. K. Madisetti, A Debugger Operating System for Embedded Systems,'' U.S. Patent Application, no , April 17, P. Kuacharoen, T. Akgul, V. J. Mooney and V. K. Madisetti, A Dynamic Operating System,'' U.S. Patent Application, no , April 17,

60 Thank you! 60

ASSEMBLY INSTRUCTION LEVEL REVERSE EXECUTION FOR DEBUGGING. Tankut Akgul

ASSEMBLY INSTRUCTION LEVEL REVERSE EXECUTION FOR DEBUGGING A Thesis Presented to The Academic Faculty by Tankut Akgul In Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy School