Quick Strata Tutorial

Getting Strata

There are a couple of ways to get Strata. If you are in the research group, you can get "read-only" access via the cvs repository:

cvs -d /home/zephyr/zephyr-cvs co strata

To do this, you must be in the zephyr group. If your not in the zephyr group, email root (and copy Jack) asking to be added.

If you're sure that you are going to commit your changes, you have to check out the version from the real repository, hosted from zephyr-software.com:

CVS_RSH=ssh cvs -d $USER@zephyr-software.com:/home/zephyr/zephyr-cvs co strata

For this you need an account on this machine (which can be obtained from Jack). If you're not in the research group, email Jack or another researcher, and they will send you a tarball.

Configuring, Building, and Running

Now that strata is checked out you can build it. Strata is built using a configure script, and the common configure options are the following

  1. --enable-debugging: This compiles strata with -g, which is very useful when debugging (Since the program's debugging info is useless when running under strata.)
  2. --enable-stats: This turns on statistics collection.

Once you run configure, simply run make to build strata. Summary:

./configure --enable-stats --enable-debugging


The tests are automatically built when make is invoked. Most tests are located in the tests/common directory. All the test use the source-code interface to strata (ie, the explicitly call strata_init and strata_start).


There are a number of run-time options that affect Strata behavior. These options can either be set through the environment, or through a config file (which is, in turn set through the environment). Useful env options:

Set STRATA_IBTC to 1, to use Strata's indirect branch translation cache. If neither STRATA_IBTC nor STRATA_SIEVE are set, then control will return to Strata after every indirect branch, which causes major performance degradation.
If this option is set, it turns on the "Fast return" mechanism, which puts fragment cache addresses on the stack (allowing strata to emit return instructions directly).
Causes strata to print debugging information. (Causes lots of output.)
Set this env. variable to a file that specifies the desired options. See the files in the tests/configs/ directory for examples.

For a full list of options, look at the files strata_opts.c and options.c

Strata Structure

Strata's high-level structure is shown below. Strata identifies code to be executed, translates that code into the fragment cache, until reaching a stopping point, and then the translated code is executed from the fragment cache.


Data structures

The most basic data structure is the bookkeeping information about code fragments: strata_fragment defined in include/strata.h. strata_fragment contains many fields (differing based on which version of strata you have), however, the most important fields are briefly described here:

The application PC address that corresponds with the start of the fragment.
The fragment cache address that is the start of the fragment in the code cache.
The address that is at the end of the fragment in the code cache.
The fragment type, the type is an enum, which is (usually) determined by how fragment was terminated.

The second important data structure to be aware of is the insn_t which contains the data for a single machine instruction. On a RISC machine this is often typedef'd to be simply an unsigned int. On x86, however, it is a struct which contains the prefix, opcode and length.


There are many important details of the internal workings of Strata.

  • Context Switches.
  • Important functions: strata_build_main and build_single_fragment.
  • The target interface.
  • Memory model -- arenas.
  • Fragment Cache management.
  • Misc: signals, function/syscall watching, threading, dynamic linking.

Taking Control

There are a number of ways that Strata can "gain control" of a program. The most common is to simply invoke strata_init() and strata_start() at the beginning of the program. This technique has the advantage of being very straightforward, unfortunately it requires source code (and source code alterations), and it does not take control at the very beginning of the program. Other techniques have been used, however, none of the others are "offically" supported on CVS-head version. If you're interested in using any of the following techniques, talk to Dan.

  • ptrace
  • custom crt0.o
  • Binary Rewriting


Debugging programs running under Strata present unique difficulties. Since all application code is executed in the fragment cache, you cannot set breakpoint in application code. In fact, Strata might copy the "hidden" interupt instruction, causing gdb to get confused when there is a break at a fragment cache address. You can set break points in Strata's code; I recommend strata_build_main or targ_exec. targ_exec returns into the fragment cache, and so you can istep through the fragment cache.

Specific Techniques

Finding addresses:

Author:Dan Williams (dan_williams(AT)cs.virginia.edu)
Last Update:Sept. 2007