LLVM What is LLVM? How does ART utilize LLVM? 3 OAT File OAT File Structure oatdump 4 dex2oat Overview What’s in the code? Workflow boot.art & boot.oat 5 ART Runtime Booting ClassLinker Big Picture Hooking Experiment 6 DVM vs ART Benchmarks 7 Conclusion Bob (CUHK) Android ART Runtime October 30, 2014 2 / 45
in the 4.4 release. This is a preview of work in progress in KitKat that can be turned on in Settings > developer options. This is available for the purpose of obtaining early developer and partner feedback. —Android Developers Bob (CUHK) Android ART Runtime October 30, 2014 3 / 45
is compilation done by VM during execution of a program — at run time — rather than prior to execution. Cross-platform. ART utilizes LLVM to compile the bytecode. Ahead-of-Time (AOT) compilation to native code. AOT transforms the bytecode of an existing virtual machine into machine code. AOT compilers can perform complex and advanced code optimizations. Bob (CUHK) Android ART Runtime October 30, 2014 6 / 45
is a collection of modular and reusable compiler and toolchain technologies. Frontend: responsible for parsing, validating and diagnosing errors in the input code, then translating the parsed code into LLVM IR. LLVM IR (Intermediate Representation): the form it uses to represent code in the compiler. LLVM Optimizer: a series of analysis and optimization passes which improve the code. Backend: produce native machine code for different platform. [4] Bob (CUHK) Android ART Runtime October 30, 2014 7 / 45
of ART compiler 1 extract class/method in dex file: /art/compiler/dex/frontend.cc 2 compile method into middle level IR: /art/compiler/dex/frontend.cc 3 optimize IR: /art/compiler/dex/mir_optimization.cc 4 compile middle level into low level IR for ARM/x86/MIPS platform: /art/compiler/dex/mir_optimization.cc 5 generate ARM machine code: /art/compiler/llvm/compiler_llvm.cc 6 write/strip into oat file (ELF file): /art/compiler/elf_writer.cc Bob (CUHK) Android ART Runtime October 30, 2014 10 / 45
not an executable file. seems like a shared object (library). should be linked/executed in ART Runtime. Bob (CUHK) Android ART Runtime October 30, 2014 12 / 45
Header | +----------------------+ | Program Header Table | +----------------------+ | Text segment | +----------------------+ | Data segment | +----------------------+ | BSS segment | +----------------------+ | ". symtab" section | +----------------------+ | ". strtab" section | +----------------------+ | ". shstrtab" section | +----------------------+ | Debug sections | +----------------------+ | Section Header Table | +----------------------+ Note that the actual ordering of the file may be different from that shown, since only an ELF header has a fixed position in the file. All other parts of the file have a position defined by: the ELF header, the Program Header Table, item the Section Header Table. Sections .symtab: symbol table (e.g., function name and address) .strtab: string table (e.g., strings in the code) .shstrtab: string table of section names Segments Text: the code for the executable Data: initialized read-write data BSS: uninitialized data Bob (CUHK) Android ART Runtime October 30, 2014 13 / 45
$ readelf -h system@app@Email.apk@classes.dex readelf: Error: Unable to read in 0x28 bytes of section headers ELF Header: Magic: 7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement , little endian Version: 1 (current) OS/ABI: UNIX - GNU ABI Version: 0 Type: DYN (Shared object file) Machine: ARM Version: 0x1 Entry point address: 0x0 Start of program headers: 52 (bytes into file) Start of section headers: 10014832 (bytes into file) Flags: 0x5000000 , Version5 EABI Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 5 Size of section headers: 40 (bytes) Number of section headers: 8 Section header string table index: 7 readelf: Error: Unable to read in 0x140 bytes of section headers readelf: Error: Unable to read in 0x38 bytes of dynamic section Type: DYN/EXE Entry point address? Noting useful. Bob (CUHK) Android ART Runtime October 30, 2014 15 / 45
$ readelf -s system@framework@boot.oat Symbol table '.dynsym ' contains 4 entries: Num: Value Size Type Bind Vis Ndx Name 0: 00000000 0 NOTYPE LOCAL DEFAULT UND 1: 60 ac9000 0x1902000 OBJECT GLOBAL DEFAULT 4 oatdata 2: 623 cb000 0x22f9660 OBJECT GLOBAL DEFAULT 5 oatexec 3: 646 c465c 4 OBJECT GLOBAL DEFAULT 5 oatlastword Bob (CUHK) Android ART Runtime October 30, 2014 16 / 45
dex file to oat file (ELF file). Usage: dex2oat [options ]... --dex -file=: specifies a .dex file to compile. --oat -file=: specifies the oat output destination via a filename. --boot -image =: provide the image file for the boot class path. --compiler -backend =( Quick|QuickGBC|Portable ): select compiler backend ... Bob (CUHK) Android ART Runtime October 30, 2014 20 / 45
methods) pointing to boot.oat which contains machine code. memory layout image: loaded at an absolute address and contains Objects with absolute pointers within the image. image: absolute pointers from Methods in the image to their code in the oat. boot.oat: absolute pointers from the code in the oat to Methods. boot.oat: absolute pointers from code in the oat to other code. +--------------+ | image | | Objects | | Methods |<-| +--------------+ | | boot oat | | | Method 1 Code|<-| | Method 2 Code|<-| +--------------+ | alloc spaces | <--- Heap +--------------+ Bob (CUHK) Android ART Runtime October 30, 2014 23 / 45
scanDirLI() method of PackageManagerService (PKMS) will monitor /data/data/ directory. 2 In installation time, PKMS will copy apk file into /data/data/ directory. 3 PKMS will check whether to optimize this apk file. 4 PKMS will send command to installd daemon through socket to optimize this app. 5 installd will check current runtime (Dalvik or ART) and then perform dexopt (dexpot for Dalvik and dex2oat for ART). Bob (CUHK) Android ART Runtime October 30, 2014 24 / 45
VM? DvmGlobals gDvm; gDvm->loadedClasses; ART Runtime* runtime. Single instance. ART runtime is not a Virtual Machine. It seems like a JavaVM proxy (interface) for compatibility. Bob (CUHK) Android ART Runtime October 30, 2014 30 / 45
single instance member in ART Runtime* runtime. It is responsible for: finding class pointers FindClass() LookupClass() loading classes/methods/field LoadClass() LoadField() LoadMethod() linking classes/fields/methods LinkClass() LinkMethods() LinkVirtualMethods() registering/verifying/resolving classes/methods/fields Bob (CUHK) Android ART Runtime October 30, 2014 31 / 45
the number of loaded classes VisitClasses(): visit every class using a user-defined visitor() function Help classes: Class/Method/Field mirror: /art/runtime/mirror/ Class ArtMethod ArtField Bob (CUHK) Android ART Runtime October 30, 2014 32 / 45
of runtime memory: Zygote boot.art: class table for machine code in boot.oat boot.oat: pre-compiled machine code for Android SDK app.oat: compiled application oat file Bob (CUHK) Android ART Runtime October 30, 2014 33 / 45
of ART runtime: ClassLinker: classes/methods/fields manage class_table: pointers to each class Class: class mirror ArtMethod: method mirror class Code: ARM/MIPS/X86 instructions JavaVM: a proxy to use JNI call .so file Bob (CUHK) Android ART Runtime October 30, 2014 34 / 45
table basically an array of pointers to (virtual) methods will be set to point to the right function at runtime Bob (CUHK) Android ART Runtime October 30, 2014 39 / 45
hp = new HelloPrinter (); // Load and initalize HelloPrinter class WorldPrinter wp = new WorldPrinter (); // Load and initalize WorldPrinter class hp.print (); // Print "Hello" to the log NativeUtil.hook (); // Call native hook function in libhookart.so hp.print (); // "Hello" or "World" in the log? Objective: inject (load) an .so file in the memory modify the print() method pointer in the vtable of HelloPrinter change from HelloPrinter.print() to WorldPrinter.print() Expected result: first ”Hello” in the log then ”World” Bob (CUHK) Android ART Runtime October 30, 2014 40 / 45
Linpack for Android Dalvik ART Single Thread 135 149 10.93% Multi-Thread 336 383 13.82% Table: Real Pi Dalvik ART AGM+FFT Formula (2,000,000 digits) 21.48 20.76 3.49% Machin’s Formula (10,000 digits) 51.39 46.01 11.69% Bob (CUHK) Android ART Runtime October 30, 2014 42 / 45
Quadrant Standard Dalvik ART Quadrant Standard 8,435 11,980 42.03% CPU 19,751 38,548 95.17% Mem 13,371 12,269 -8.24% I/O 6,556 6,612 0.85% 2D 301 301 0.00% 3D 2,196 2,172 -1.09% Bob (CUHK) Android ART Runtime October 30, 2014 43 / 45
Runtime (booting, hooking) DVM vs ART ART is still an experimental runtime in Android system. There are still some uncompleted logics. But we believe that ART Runtime will finally replace Dalvik Runtime in the future due to better performance. Bob (CUHK) Android ART Runtime October 30, 2014 44 / 45
Blow You Away Today, But It Will Get Better. http://www.androidpolice.com/2013/11/12/meet-art- part-2-benchmarks-performance-wont-blow-away-today-will-get-better/. AndroidXref. http://androidxref.com/4.4_r1/. Google. Android Open Source Project. Chris Lattner. The Architecture of Open Source Applications. Bob (CUHK) Android ART Runtime October 30, 2014 45 / 45