Instrument IL while doing AOT compilation

[m-carrasco]

Hi,

I'd like to ask for some hints about the following.

I want to modify the building process when <PublishAot>true</PublishAot> is enabled. In particular, I want to modify every IL method before it is lowered into native code. This includes the IL in the current project and transitive IL dependencies (other referenced projects, the libraries shipped with the runtime, etc.).

So far, I understand that no API can register an IL transformation when native code is generated. Where could I start looking to hack this? Finding a place where I could hook this is more than enough for my purpose. To provide more context, I want to do a simple CFG analysis and add a few instructions before control-flow instructions on all lowered IL methods.

Any help or advice is appreciated!

Best,
Manuel

[huoyaoyuan]

There are two possible approaches: after the IL is produced, or before the IL was processed to JIT.

IL in assembly files are compiled in the IlcCompile msbuild target. Insert a msbuild target before it can get all referenced assembly files, and transform all of them. There are some special methods provided by the execution engine, like methods of array and delegates, but generally they can be considered as trusted.

Another approach is to hook everything passed into JIT. The entry point of compiling method in ILCompiler is at RyuJitCompilation.CompileSingleMethod:

runtime/src/coreclr/tools/aot/ILCompiler.RyuJit/Compiler/RyuJitCompilation.cs

Lines 179 to 183 in 4addcaa

	private void CompileSingleMethod(MethodCodeNode methodCodeNodeNeedingCode)
	{
	CorInfoImpl corInfo = _corinfos.GetValue(Thread.CurrentThread, thread => new CorInfoImpl(this));
	CompileSingleMethod(corInfo, methodCodeNodeNeedingCode);
	}

You can insert some hook here and try to do transformations on the IL.

Anyway, there's no direct interface provided and may require custom built toolchains. It should be OK for research projects.

/cc @dotnet/ilc-contrib

[m-carrasco]

Hi @huoyaoyuan. Thanks a lot for your answer.

I've tried your first suggestion. I wasn't aware of the IlcCompile build target. This approach seems more convenient for now. Unfortunately, my attempt is not working. I'm sharing the details in case it helps others and you could spot my mistake.

1. First, I modified my project's csproj to hook my ILTransformer, and modify the .dll files (in place).
   I've verified it, and this step gets executed and processes the project dll and the other dependencies (i.e. System.Console.dll). The paths of the DLLs are as follows: bin/Release/net8.0/linux-x64/*.dll

  <Target Name="CustomILTransformation" BeforeTargets="IlcCompile">
    <Message Text="Starting IL transformation..." Importance="high" />
    <ItemGroup>
      <ReferencedAssemblies Include="$(OutputPath)/**/*.dll" />
    </ItemGroup>
    <Exec Command="/path/to/ILTransformer %(ReferencedAssemblies.FullPath)" />
    <Message Text="Finished IL transformation." Importance="high" />
  </Target>

3. I wrote the ILTransformer using Mono.Cecil, I'm appending an integer division by zero at the beginning of each method just for testing. The ILTransformer requires processing mixed-mode assemblies, and when this happens the modified assembly is saved in ILOnly mode (ModuleAttributes.ILOnly) — otherwise, Mono.Cecil cannot save mixed-mode assemblies.

4. I compiled the target project and checked the intermediate DLLs and the final native assembly (bin/Release/net8.0/linux-x64/native/console).
   The intermediate assemblies generated in bin/Release/net8.0/linux-x64/ are modified as expected. However, the final native binary does not crash as expected, and neither does the assembly code contain the division by zero.
   I suspect that even though the ILTransformer is executed, the AOT compilation is not consuming those modified DLL assemblies (in place).

[jkotas]

IlcCompile does not read the assemblies from bin/Release/net8.0/linux-x64/*.dll. It explains why the compilation is not picking up your rewritten assemblies.

You can check the inputs of the IlcCompile by looking at *.ilc.rsp file. Make sure that .ilc.rsp has paths to the rewritten assemblies.

[m-carrasco]

Thanks! Now, it seems to be working.

  <Target Name="CustomILTransformation" BeforeTargets="IlcCompile" AfterTargets="WriteIlcRspFileForCompilation">
    <Message Text="Starting IL transformation..." Importance="high" />
    <!--TODO: Parse the ilc.rsp file and transform the listed DLLs -->
    <Exec Command="file $(IntermediateOutputPath)/native/console.ilc.rsp" />
    <Message Text="Finished IL transformation." Importance="high" />
  </Target>

In case it helps others, use a verbose mode to get a better sense of the compilation process (dotnet publish -v d).

[huoyaoyuan]

use a verbose mode to get a better sense of the compilation process (dotnet publish -v d).

You can also use binlog to get a more completed, structured view of msbuild: https://msbuildlog.com