PROVIDING DYNAMIC INSTRUMENTATION USING DOMAIN-SPECIFIC MONITORING-LANGUAGE-TO-KERNEL-BYTECODE COMPILATION

• US 20180196648A1
• Filed: 01/10/2017
• Published: 07/12/2018
• Est. Priority Date: 01/10/2017
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Henderson, Richard T., Eigler, Frank Ch.
• Granted Patent: US 10,810,100 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3624 by performing operations on the source code, e.g. via a compiler
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 8/52 Binary to binary

Abstract

Providing dynamic instrumentation using domain-specific monitoring-language-to-kernel-bytecode compilation is disclosed. An instrumentation program file is converted by a compilation engine into multiple bytecode sections. A load and execute engine identifies which sections can be executed in kernel space and which can be executed in user space. The sections to be executed in kernel space are then loaded into a kernel space bytecode interpreter for execution, while the sections to be executed in user space are concurrently executed by a user space bytecode interpreter of the load and execute engine. In some examples, the load and execute engine may provide global variables that are accessible by both the kernel space and the user space, and that facilitate data exchange between the kernel space bytecode interpreter and the user space bytecode interpreter.

Claims

1. A method for providing dynamic instrumentation of executing processes, comprising:

receiving, by a compilation engine executing on a computing device comprising a processor device, an instrumentation program file;

translating, by the compilation engine, the instrumentation program file into an executable and linkable file (ELF), the ELF comprising one or more sections of bytecode;

identifying, by a load and execute engine executing on the computing device, a first section and a second section of the one or more sections of bytecode, wherein the first section is to be executed in a kernel space of the computing device and the second section is to be executed in a user space of the computing device;

loading the first section into the kernel space for execution by a kernel space bytecode interpreter of an executing kernel of the computing device; and

concurrently executing the second section using a user space bytecode interpreter of the load and execute engine.

2. The method of claim 1, further comprising:

providing, by the load and execute engine, one or more global variables accessible from both the kernel space and the user space;

receiving, from one of the first section and the second section, a value to be stored in a global variable of the one or more global variables; and

providing the value stored in the global variable to another of the first section and the second section.

3. The method of claim 1, further comprising:

detecting, by the load and execute engine, a termination condition; and

responsive to detecting the termination condition;

unloading the first section from the kernel space; and

terminating execution of the second section.

4. The method of claim 3, wherein the termination condition comprises one of a received user input and a termination command from one of the first section and the second section.

5. The method of claim 1, wherein the kernel space bytecode interpreter comprises an extended Berkeley Packet Filter (eBPF) interpreter.

6. The method of claim 1, wherein the instrumentation program file comprises a SystemTap program file.

7. The method of claim 1, wherein identifying the first section to be executed in the kernel space of the computing device and the second section to be executed in the user space of the computing device is based on functionality specified by the first section and the second section.

8. A computing device, comprising:

a memory; and

a processor device coupled to the memory to;

receive, using a compilation engine, an instrumentation program file;

translate, using the compilation engine, the instrumentation program file into an executable and linkable file (ELF), the ELF comprising one or more sections of bytecode;

identify, using a load and execute engine, a first section and a second section of the one or more sections of bytecode, wherein the first section is to be executed in a kernel space of the computing device and the second section is to be executed in a user space of the computing device;

load the first section into the kernel space for execution by a kernel space bytecode interpreter of an executing kernel of the computing device; and

concurrently execute the second section using a user space bytecode interpreter of the load and execute engine.

9. The computing device of claim 8, wherein the processor device is further to:

provide, using the load and execute engine, one or more global variables accessible from both the kernel space and the user space;

receive, from one of the first section and the second section, a value to be stored in a global variable of the one or more global variables; and

provide the value stored in the global variable to another of the first section and the second section.

10. The computing device of claim 8, wherein the processor device is further to:

detect, using the load and execute engine, a termination condition; and

responsive to detecting the termination condition;

unload the first section from the kernel space; and

terminate execution of the second section.

11. The computing device of claim 10, wherein the termination condition comprises one of a received user input and a termination command from one of the first section and the second section.

12. The computing device of claim 8, wherein the kernel space bytecode interpreter comprises an extended Berkeley Packet Filter (eBPF) interpreter.

13. The computing device of claim 8, wherein the instrumentation program file comprises a SystemTap program file.

14. The computing device of claim 8, wherein the processor device is further to identify the first section to be executed in the kernel space of the computing device and the second section to be executed in the user space of the computing device based on functionality specified by the first section and the second section.

15. A computer program product for providing dynamic instrumentation of executing processes, the computer program product stored on a non-transitory computer-readable storage medium and including instructions to cause a processor device to:

receive an instrumentation program file;

translate the instrumentation program file into an executable and linkable file (ELF), the ELF comprising one or more sections of bytecode;

identify a first section and a second section of the one or more sections of bytecode, wherein the first section is to be executed in a kernel space of a computing device and the second section is to be executed in a user space of the computing device;

load the first section into the kernel space for execution by a kernel space bytecode interpreter of an executing kernel of the computing device; and

concurrently execute the second section using a user space bytecode interpreter of the load and execute engine.

16. The computer program product of claim 15, including instructions to cause the processor device further to:

provide one or more global variables accessible from both the kernel space and the user space;

receive a value to be stored in a global variable of the one or more global variables; and

provide the value stored in the global variable to another of the first section and the second section.

17. The computer program product of claim 15, including instructions to cause the processor device further to:

detect a termination condition; and

responsive to detecting the termination condition;

unload the first section from the kernel space; and

terminate execution of the second section.

18. The computer program product of claim 16, wherein the termination condition comprises one of a received user input and a termination command from one of the first section and the second section.

19. The computer program product of claim 15, wherein the kernel space bytecode interpreter comprises an extended Berkeley Packet Filter (eBPF) interpreter.

20. The computer program product of claim 15, wherein the instrumentation program file comprises a SystemTap program file.