Comprehensive kernel instrumentation via dynamic binary translation

ABSTRACT

Dynamic binary translation (DBT) is a powerful technique that enables fine-grained monitoring and manipulation of an existing program binary. At the user level, it has been employed extensively to develop various analysis, bug-finding, and security tools. Such tools are currently not available for operating system (OS) binaries since no comprehensive DBT framework exists for the OS kernel. To address this problem, we have developed a DBT framework that runs as a Linux kernel module, based on the user-level DynamoRIO framework. Our approach is unique in that it controls all kernel execution, including interrupt and exception handlers and device drivers, enabling comprehensive instrumentation of the OS without imposing any overhead on user-level code. In this paper, we discuss the key challenges in designing and building an in-kernel DBT framework and how the design differs from user-space. We use our framework to build several sample instrumentations, including simple instruction counting as well as an implementation of shadow memory for the kernel. Using the shadow memory, we build a kernel stack overflow protection tool and a memory addressability checking tool. Qualitatively, the system is fast enough and stable enough to run the normal desktop workload of one of the authors for several weeks.

References

1. Keith Adams and Ole Agesen. A comparison of software and hardware techniques for x86 virtualization. In ASPLOS, pages 2--13, San Jose, CA, 2006. ACM.
2. Advanced Micro Devices. AMD64 Architecture Programmer's Manual Volume 2: System Programming. 3.15 edition, 2009.
3. Vasanth Bala, Evelyn Duesterwald, and Sanjeev Banerjia. Dynamo: A Transparent Dynamic Optimization System. PLDI, pages 1--12, 2000.
4. Daniel P. Bovet and Marco Cesati. Understanding the Linux Kernel. O'Reilly, Sebastopol, CA, 3rd edition, 2005.
5. Derek Bruening. Efficient, Transparent, and Comprehensive Runtime Code Manipulation. Ph.d. thesis, Massachusetts Institute of Technology, 2004.
6. Derek Bruening, Vladimir Kiriansky, Timothy Garnett, and Sanjeev Banerji. Thread-shared software code caches. In CGO, New York, NY, 2006. ACM.
7. Derek. Bruening and Qin Zhao. Practical memory checking with dr. memory. In CGO, pages 213--223, April 2011.
8. P. P. Bungale and C. K. Luk. PinOS: A programmable framework for whole-system dynamic instrumentation. In VEE, pages 137--147, San Diego, CA, 2007. ACM.
9. T. W. Burger. Intel Virtualization Technology for Directed I/O (VT-d): Enhancing Intel platforms for efficient virtualization of I/O devices. http://software.intel.com/en-us/articles/intel-virtualization-technology-for-directed-io-vt-d-enhancing-intel-platforms-for-efficient-virtualization-of-io%-devices/. Last accessed July 25, 2011. 2009.
10. Bryan M. Cantrill, Michael W. Shapiro, Adam H. Leventhal, and Sun Microsystems. Dynamic instrumentation of production systems. In USENIX ATC, pages 15--28. USENIX Association, 2004.
11. Andy Chou, Junfeng Yang, Benjamin Chelf, Seth Hallem, and Dawson Engler. An empirical study of operating systems errors. In SOSP, pages 73--88, Banff, Canada, 2001. ACM.
12. Bryan Ford and Russ Cox. Vx32: Lightweight user-level sandboxing on the x86. In USENIX ATC, Boston, MA, 2008. USENIX Association.
13. Vladimir Kiriansky, Derek Bruening, and Saman P. Amarasinghe. Secure Execution via Program Shepherding. In USENIX Security, pages 191--206, San Francisco, CA, 2002. USENIX Association.
14. Andi Kleen. Linux Kernel Documentation: Virtual memory map with 4 level page tables. http://www.kernel.org/doc/Documentation/x86/x86_64/mm.txt. Last accessed July 24th, 2011. 2004.
15. Linux Technology Center. KProbes. http://sourceware.org/systemtap/kprobes/. Last accessed May 2nd, 2010.
16. C. K. Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, V. J. Reddi, and K. Hazelwood. Pin: building customized program analysis tools with dynamic instrumentation. In PLDI, pages 190--200, Chicago, IL, 2005. ACM.
17. Nicholas Nethercote and Julian Seward. Valgrind: a framework for heavyweight dynamic binary instrumentation. In PLDI, pages 89--100, San Diego, CA, 2007. ACM.
18. Vegard Nossum. kmemcheck: trap uses of uninitialized memory. http://lwn.net/Articles/259974/. Last accessed July 25th, 2011. 2007.
19. Marek Olszewski, Keir Mierle, Adam Czajkowski, and Angela Demke Brown. JIT Instrumentation: a Novel Approach to Dynamically Instrument Operating Systems. In EUROSYS, pages 3--16, Lisbon, Portugal, 2007. ACM.
20. Nicolas Palix, Gael Thomas, Suman Saha, Christophe Calvès, Julia Lawall, and Gilles Muller. Faults in linux: ten years later. In ASPLOS, ASPLOS '11, pages 305--318, New York, NY, USA, 2011. ACM.
21. Arvind Seshadri, Mark Luk, Ning Qu, and Adrian Perrig. SecVisor : A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes. In SOSP, pages 335--350, Stevenson, WA, 2007. ACM.
22. Julian Seward and Nicholas Nethercote. Using Valgrind to Detect Undefined Value Errors with Bit-Precision. In USENIX ATC, pages 17--30, Anaheim, CA, 2005. USENIX Association.
23. Dawn Song, David Brumley, Heng Yin, Juean Caballero, Ivan Jager, Min Gyung Kang, Zhenkai Liang, James Newsome, Pongsin Poosankam, and Prateek Saxena. BitBlaze: A New Approach to Computer Security via Binary Analysis. In ISS. Keynote invited paper, Hyderabad, India, 2008.
24. Ariel Tamches and Barton P. Miller. Fine-grained dynamic instrumentation of commodity operating system kernels. In OSDI, pages 117--130, Berkeley, CA, USA, 1999. USENIX Association.
25. Qin Zhao, Derek Bruening, and Saman Amarasinghe. Umbra: Efficient and Scalable Memory Shadowing. In ASPLOS, Toronto, Canada, 2010. ACM.

Index Terms

• Software and its engineering

  • Software creation and management

    • Software verification and validation

      • Software defect analysis

        • Software testing and debugging

  • Software notations and tools

    • Compilers

      • Incremental compilers