DEV490.NET Framework: CLR – Under The Hood Jeffrey Richter Author / Consultant / Trainer Wintellect

DEV490

.NET Framework:CLR – Under The Hood

DEV490

.NET Framework:CLR – Under The Hood

Jeffrey RichterJeffrey RichterAuthor / Consultant / TrainerAuthor / Consultant / TrainerWintellectWintellect

Jeffrey RichterJeffrey Richter

Author of several .NET Framework/Win32 BooksAuthor of several .NET Framework/Win32 Books

Cofounder of Wintellect: a company dedicated to helping clients Cofounder of Wintellect: a company dedicated to helping clients ship better software fastership better software faster

Services: Consulting, Debugging, Security Reviews, TrainingServices: Consulting, Debugging, Security Reviews, Training

Consultant on Microsoft’s .NET Framework team since Consultant on Microsoft’s .NET Framework team since October 1999October 1999

MSDN Magazine Contributing Editor/.NET ColumnistMSDN Magazine Contributing Editor/.NET Columnist

TopicsTopics

Execution ModelExecution ModelIntermediate Language (IL), verification, Intermediate Language (IL), verification, JIT compilation, metadata, and assembly JIT compilation, metadata, and assembly loadingloading

How Things Relate at RuntimeHow Things Relate at RuntimeCode, Types, Objects, a thread’s stack, Code, Types, Objects, a thread’s stack, and the heapand the heap

Garbage CollectionGarbage CollectionHow a reference-tracking GC worksHow a reference-tracking GC works

TopicsTopics




C#Source Code

File(s)

Managed Assembly(IL and Metadata)

FortranSource Code

File(s)

C++Source Code

File(s)

BasicSource Code

File(s)

C#Compiler

BasicCompiler

C++Compiler

FortranCompiler

Compiling Source CodeInto AssembliesCompiling Source CodeInto Assemblies




An AssemblyAn Assembly

An Assembly is the managed equivalent of an An Assembly is the managed equivalent of an EXE/DLLEXE/DLL

Implements and optionally exports a collection of Implements and optionally exports a collection of typestypes

It is the unit of versioning, security, and deploymentIt is the unit of versioning, security, and deployment

Parts of an Assembly fileParts of an Assembly fileWindows PE headerWindows PE header

CLR header (Information interpreted by the CLR and utilities)CLR header (Information interpreted by the CLR and utilities)

Metadata (Type definition and reference tables)Metadata (Type definition and reference tables)

Intermediate Language (code emitted by compiler)Intermediate Language (code emitted by compiler)

ILDasm.exeILDasm.exe

Intermediate LanguageIntermediate Language

All .NET compilers produce IL codeAll .NET compilers produce IL code

IL is CPU-independent machine languageIL is CPU-independent machine languageCreated by Microsoft with input from external commercial Created by Microsoft with input from external commercial and academic language/compiler writersand academic language/compiler writers

IL is higher-level than most CPU machine languagesIL is higher-level than most CPU machine languages

Some sample IL instructionsSome sample IL instructionsCreate and initialize objects (including arrays)Create and initialize objects (including arrays)

Call virtual methodsCall virtual methods

Throw and catch exceptionsThrow and catch exceptions

Store/load values to/from fields, parameters, and local Store/load values to/from fields, parameters, and local variablesvariables

Developers can write in IL assembler (ILAsm.exe)Developers can write in IL assembler (ILAsm.exe)Many compilers produce IL source code and compile it by Many compilers produce IL source code and compile it by spawning ILAsm.exespawning ILAsm.exe

ILDasm.exeILDasm.exe

Benefits Of ILBenefits Of IL

IL is not tied to any specific CPUIL is not tied to any specific CPU

Managed modules can run on any CPU Managed modules can run on any CPU (x86, Itanium, Opteron, etc), as long as (x86, Itanium, Opteron, etc), as long as the OS on that CPU supports the CLRthe OS on that CPU supports the CLR

Many believe that “write once, run Many believe that “write once, run everywhere” is the biggest benefiteverywhere” is the biggest benefit

I disagree, security and verification of I disagree, security and verification of code is the really BIG win!code is the really BIG win!

Real Benefit Of IL: Security And VerificationReal Benefit Of IL: Security And Verification

When processing IL, CLR verifies it to When processing IL, CLR verifies it to ensure that everything it does is “safe”ensure that everything it does is “safe”

Every method is called with correct Every method is called with correct number and type of parametersnumber and type of parameters

Every method’s return value is used Every method’s return value is used properlyproperly

Every method has a return statementEvery method has a return statement

Metadata includes all the type/method Metadata includes all the type/method info used for verificationinfo used for verification

Benefits Of “Safe” CodeBenefits Of “Safe” Code

Multiple managed applications can run in 1 Multiple managed applications can run in 1 Windows’ processWindows’ process

Applications can’t corrupt each other (or themselves)Applications can’t corrupt each other (or themselves)

Reduces OS resource usage, improves Reduces OS resource usage, improves performanceperformance

Administrators can trust appsAdministrators can trust appsISPs forbidding ISAPI DLLsISPs forbidding ISAPI DLLs

SQL Server running IL for stored proceduresSQL Server running IL for stored procedures

Internet downloaded code (with Code Access Internet downloaded code (with Code Access Security)Security)

Note: Administrator can turn off verificationNote: Administrator can turn off verification

Executing Managed IL CodeExecuting Managed IL Code

When loaded, the runtime creates method When loaded, the runtime creates method stubsstubs

When a method is called, the stub jumps to When a method is called, the stub jumps to runtimeruntime

Runtime loads IL and compiles itRuntime loads IL and compiles itIL is compiled into native CPU codeIL is compiled into native CPU code

Just like compiler back-endJust like compiler back-end

Method stub is removed and points to Method stub is removed and points to compiled codecompiled code

Compiled code is executedCompiled code is executed

In future, when method is called, it just runsIn future, when method is called, it just runs

ConsoleConsoleManaged EXEManaged EXE

MSCorEE.dllMSCorEE.dll

JITCompiler

JITCompilerJITCompiler

……

JITCompiler function {JITCompiler function { 1. In the assembly that implements the type (Console), 1. In the assembly that implements the type (Console), look up the method (WriteLine) being called in the metadata. look up the method (WriteLine) being called in the metadata. 2. From the metadata, get the IL for this method and verify it.2. From the metadata, get the IL for this method and verify it. 3. Allocate a block of memory.3. Allocate a block of memory. 4. Compile the IL into native CPU instructions; the native code is saved 4. Compile the IL into native CPU instructions; the native code is saved in the memory allocated in step #3. in the memory allocated in step #3. 5. Modify the method’s entry in the Type’s table so that it now 5. Modify the method’s entry in the Type’s table so that it now points to the memory block allocated in step #3. points to the memory block allocated in step #3. 6. Jump to the native code contained inside the memory block.6. Jump to the native code contained inside the memory block.}}

static void WriteLine()static void WriteLine()

static void WriteLine(String)static void WriteLine(String)

(remaining members)(remaining members)

Native CPU InstructionsNative CPU Instructions

static void Main() {static void Main() {

Console.WriteLine(“Hello”);Console.WriteLine(“Hello”);

Console.WriteLine(“Goodbye”);Console.WriteLine(“Goodbye”);

}}

NativeMethod

All Types/Modules AreSelf-DescribingAll Types/Modules AreSelf-Describing

1 TypeDef entry for “App”1 TypeDef entry for “App”Entry refers to MethodDef entry for “Main”Entry refers to MethodDef entry for “Main”

2 TypeRef entries for “System.Object” and 2 TypeRef entries for “System.Object” and “System.Console”“System.Console”

Both entries refer to AssemblyRef entry for Both entries refer to AssemblyRef entry for MSCorLibMSCorLib

public class App { public static void Main() { System.Console.WriteLine("Hi"); }}

Metadata Definition Tables(Partial List)Metadata Definition Tables(Partial List)

TypeDef: 1 entry for each type definedTypeDef: 1 entry for each type definedType’s name, base type, flags (i.e. public, private, Type’s name, base type, flags (i.e. public, private, etc.) and index into MethodDef & FieldDef tablesetc.) and index into MethodDef & FieldDef tables

MethodDef: 1 entry for each method definedMethodDef: 1 entry for each method definedMethod’s name, flags (private, public, virtual, Method’s name, flags (private, public, virtual, static, etc), IL offset, and index to ParamDef tablestatic, etc), IL offset, and index to ParamDef table

FieldDef: 1 entry for each field definedFieldDef: 1 entry for each field definedName, flags (i.e. private, public, etc.), and typeName, flags (i.e. private, public, etc.), and type

ParamDef: 1 entry for each parameter def’dParamDef: 1 entry for each parameter def’dName, and flags (in, out, retval, etc.)Name, and flags (in, out, retval, etc.)

Metadata Reference Tables(Partial List)Metadata Reference Tables(Partial List)

AssemblyRef: 1 entry for each assembly ref’dAssemblyRef: 1 entry for each assembly ref’dName, version, culture, public key tokenName, version, culture, public key token

TypeRef: 1 entry for each type ref’dTypeRef: 1 entry for each type ref’dType’s name, and index into AssemblyRef tableType’s name, and index into AssemblyRef table

MemberRef: 1 entry for each member ref’dMemberRef: 1 entry for each member ref’dName, signature, and index into TypeRef tableName, signature, and index into TypeRef table

ILDasm.exeILDasm.exeMetadata And ILMetadata And IL

Code Attempts ToAccess A Type/MethodCode Attempts ToAccess A Type/Method

23000001: AssemblyRef entry for MSCorLib 23000001: AssemblyRef entry for MSCorLib

01000003: TypeRef entry to System.Console01000003: TypeRef entry to System.Console

06000001: MethodDef for Main (FYI)06000001: MethodDef for Main (FYI)

.method /*06000001*/ public hidebysig static void Main(class System.String[] args) il managed{ .entrypoint // Code size 11 (0xb) .maxstack 8 IL_0000: ldstr "Hi“ IL_0005: call void ['mscorlib'/* 23000001 */] System.Console/* 01000003 */::WriteLine(class System.String) IL_000a: ret} // end of method 'App::Main'

IL Call withIL Call withMetadata tokenMetadata token

How The CLR Resolves An Assembly ReferenceHow The CLR Resolves An Assembly Reference

MemberRefMemberRef

MethodDefMethodDef

MemberRef TypeRefTypeRef AssemblyRef

Create internaltype structure

LoadAssembly

Look-upTypeDef

MethodDef TypeDef

Emit Native CallEmit Native Call

TopicsTopics




Windows’ ProcessWindows’ Process

..

..

..

A Thread’s StackA Thread’s Stack

CLR (Thread Pool & Managed Heap)CLR (Thread Pool & Managed Heap)

name (String)name (String)

M2 ParamsM2 Paramss (String)s (String)

M2 LocalsM2 Localslength (Int32)length (Int32)

tally (Int32)tally (Int32)

[return address][return address]

void M1() {void M1() {

String name = “Joe”;String name = “Joe”;

M2(name);M2(name);

......

return;return;

}}

void M2(String s) {void M2(String s) {

Int32 length = s.Length;Int32 length = s.Length;

Int32 tally;Int32 tally;

......

return;return;

}}

M1 LocalsM1 Locals

Simple Class HierarchySimple Class Hierarchy

class Manager : Employee {

public override String GenProgressReport() { ... }

}

class Employee {

public Int32 GetYearsEmployed() { ... }

public virtual String GenProgressReport() { ... }

public static Employee Lookup(String name) { ... }

}

Instance Method Mapping Using thisInstance Method Mapping Using thispublic Int32 GetYearsEmployed();

public (static) Int32 GetYearsEmployed(Employee this);

public virtual String GenProgressReport();

public (static) String GenProgressReport(Employee this);

public static Employee Lookup(String name);

public static Employee Lookup(String name);

Employee e = new Employee();

e.GetYearsEmployed();

e.GenProgressReport();

Employee e = new Employee();

Employee.GetYearsEmployed(e);

Employee.GenProgressReport(e);

thisthis is what makes instance data is what makes instance data available to instance methodsavailable to instance methods

IL Instructions ToCall A MethodIL Instructions ToCall A Method

CallCallIs usable for static, instance, and virtual instance methodsIs usable for static, instance, and virtual instance methods

No null check for the No null check for the thisthis pointer (for instance methods) pointer (for instance methods)

Used to call virtual methods non-polymorphicallyUsed to call virtual methods non-polymorphicallybase.OnPaint();base.OnPaint();

CallvirtCallvirtUsable for instance and virtual methods onlyUsable for instance and virtual methods only

Slower perfSlower perf

Null check for all instance methodsNull check for all instance methods

Polymorphs for virtual methodsPolymorphs for virtual methodsNo polymorphic behavior for non-virtual methodsNo polymorphic behavior for non-virtual methods

C# and VB use C# and VB use callvirtcallvirt to perform a null check when calling to perform a null check when calling instance methodsinstance methods

.method private hidebysig static void Main() cil managed { .entrypoint // Code size 27 (0x1b) .maxstack 1 .locals init (object V_0) IL_0000: newobj instance void System.Object::.ctor() IL_0005: stloc.0 IL_0006: ldloc.0 IL_0007: callvirt instance int32 System.Object::GetHashCode() IL_000c: pop IL_000d: ldloc.0 IL_000e: callvirt instance class System.Type System.Object::GetType() IL_0013: pop IL_0014: ldc.i4.1 IL_0015: call void System.Console::WriteLine(int32) IL_001a: ret} // end of method App::Main

class App { static void Main() { Object o = new Object(); o.GetHashCode(); // Virtual o.GetType(); // Non-virtual instance Console.WriteLine(1); // Static }}

Windows’ ProcessWindows’ Process

..

..

..

HeapHeap

= 5= 5

Memory: Code, Types, ObjectsMemory: Code, Types, Objects

CLR (Thread Pool & Managed Heap)CLR (Thread Pool & Managed Heap)

..

..

..

JittedJittedCodeCode




StackStack

void M3() {void M3() { Employee e;Employee e; Int32 year;Int32 year; e = new Manager();e = new Manager(); e = Employee.Lookup(“Joe”);e = Employee.Lookup(“Joe”); year = e.GetYearsEmployed();year = e.GetYearsEmployed(); e.GenProgressReport();e.GenProgressReport();}}

e (Employee)e (Employee)

year (Int32)year (Int32) Mthd Tbl PtrMthd Tbl PtrSync Blk IndxSync Blk IndxInstance FieldsInstance Fields

Manager ObjectManager Object

Mthd Tbl PtrMthd Tbl PtrSync Blk IndxSync Blk IndxInstance FieldsInstance Fields

Manager ObjectManager Object

Method Table PtrMethod Table PtrSync Block IndexSync Block IndexStatic FieldsStatic FieldsGenProgressReportGenProgressReport

Manager Type Manager Type

Method Table PtrMethod Table PtrSync Block IndexSync Block IndexStatic FieldsStatic FieldsGetYearsEmployedGetYearsEmployedGenProgressReportGenProgressReportLookupLookup

Employee TypeEmployee Type

nullnull

= 0= 0

TopicsTopics




The Managed HeapThe Managed Heap

All reference types are allocated on the managed heapAll reference types are allocated on the managed heapYour code never frees an objectYour code never frees an object

The GC frees objects when they are no longer reachableThe GC frees objects when they are no longer reachable

Each process gets its own managed heapEach process gets its own managed heapVirtual address space region, sparsely allocatedVirtual address space region, sparsely allocated

The new operator always allocates objects at the endThe new operator always allocates objects at the end

If heap is full, a GC occursIf heap is full, a GC occursReality: GC occurs when generation 0 is fullReality: GC occurs when generation 0 is full

NextObjPtrNextObjPtr

AA BB CC

Roots And GC PreparationRoots And GC Preparation

Every application has a set of RootsEvery application has a set of Roots

A Root is a memory location that can refer to an objectA Root is a memory location that can refer to an objectOr, the memory location can contain nullOr, the memory location can contain null

Roots can be any of the followingRoots can be any of the followingGlobal & static fields, local parameters, local variables, CPU Global & static fields, local parameters, local variables, CPU registersregisters

When a method is JIT compiled, the JIT compiler When a method is JIT compiled, the JIT compiler creates a table indicating the method’s rootscreates a table indicating the method’s roots

The GC uses this tableThe GC uses this table

The table looks something like this...The table looks something like this...

Start OffsetStart Offset End OffsetEnd Offset RootsRoots________________________________

0x000000000x00000000 0x000000200x00000020 this, arg1, arg2, ECX, EDXthis, arg1, arg2, ECX, EDX

0x000000210x00000021 0x000001220x00000122 this, arg2, fs, EBXthis, arg2, fs, EBX

0x000001230x00000123 0x000001450x00000145 fsfs

When A GC Starts...When A GC Starts...

All objects in heap are considered garbageAll objects in heap are considered garbageThe GC assumes that no roots refer to objectsThe GC assumes that no roots refer to objects

GC examines roots and marks each reachable objectGC examines roots and marks each reachable objectIf a GC starts and the CPU’s IP is at 0x00000100, the objects pointed If a GC starts and the CPU’s IP is at 0x00000100, the objects pointed to by the this parameter, arg2 parameter, fs local variable, and the to by the this parameter, arg2 parameter, fs local variable, and the EBX register are roots; these objects are marked as “in use”EBX register are roots; these objects are marked as “in use”

As reachable objects are found, GC uses metadata to checks each object’s As reachable objects are found, GC uses metadata to checks each object’s fields for references to other objectsfields for references to other objects

These objects are marked “in use” too, and so onThese objects are marked “in use” too, and so on

GC walks up the thread’s call stack determining roots for the calling GC walks up the thread’s call stack determining roots for the calling methods by accessing each method’s tablemethods by accessing each method’s table

For objects already “in use”, fields aren’t checkedFor objects already “in use”, fields aren’t checkedImproves performanceImproves performance

Prevents infinite loops due to circular referencesPrevents infinite loops due to circular references

The GC uses other means to obtain the set of roots stored in The GC uses other means to obtain the set of roots stored in global and static variablesglobal and static variables

AA BB CC DD EE FF GG HH II JJ

ROOTSROOTS(strong (strong

references)references)

GlobalsGlobalsStaticsStaticsLocalsLocals

CPU RegistersCPU Registers






Before A CollectionBefore A CollectionManaged HeapManaged Heap

Compacting The HeapCompacting The Heap

After all roots have been checked and all objects After all roots have been checked and all objects have been marked “in use”...have been marked “in use”...

The GC walks linearly through heap for free gaps and shifts The GC walks linearly through heap for free gaps and shifts reachable objects down (simple memory copy)reachable objects down (simple memory copy)

As objects are shifted down in memory, roots are updated to As objects are shifted down in memory, roots are updated to point to the object’s new memory addresspoint to the object’s new memory address

After all objects have been shifted...After all objects have been shifted...The NextObjPtr pointer is positioned after last objectThe NextObjPtr pointer is positioned after last object

The ‘new’ operation that caused the GC is retriedThe ‘new’ operation that caused the GC is retriedThis time, there should be available memory in the heap and the This time, there should be available memory in the heap and the object construction should succeedobject construction should succeed

If not, an OutOfMemoryException is thrownIf not, an OutOfMemoryException is thrown

AA CC DD FF HH










After A CollectionAfter A CollectionManaged HeapManaged Heap

Root ExampleRoot Example

class App {class App { public static void Main() { public static void Main() { // ArrayList object created in heap, a is now a root // ArrayList object created in heap, a is now a root ArrayList a = new ArrayList(); ArrayList a = new ArrayList(); // Create 10000 objects in the heap // Create 10000 objects in the heap for (int x = 0; x < 10000; x++) { for (int x = 0; x < 10000; x++) { a.Add(new Object()); a.Add(new Object()); } }

// Local a is a root that refers to 10000 objects // Local a is a root that refers to 10000 objects Console.WriteLine(a.Length); Console.WriteLine(a.Length); // After line above, a is not a root and all 10001 // After line above, a is not a root and all 10001 // objects may be collected. // objects may be collected. // NOTE: Method doesn’t have to return // NOTE: Method doesn’t have to return Console.WriteLine(“End of method”); Console.WriteLine(“End of method”); } }}}

AssessmentsAssessments http://www.microsoft.com/assessment/http://www.microsoft.com/assessment/

CoursesCourses

2415: Programming with the Microsoft .NET Framework 2415: Programming with the Microsoft .NET Framework (Microsoft Visual Basic .NET)(Microsoft Visual Basic .NET)

2349: Programming with the Microsoft .NET Framework 2349: Programming with the Microsoft .NET Framework (Microsoft Visual C# .NET)(Microsoft Visual C# .NET)

BooksBooks

The Microsoft Platform Ahead, ISBN: 0-7356-2064-4The Microsoft Platform Ahead, ISBN: 0-7356-2064-4

Network Programming for the Microsoft .NET Framework, Network Programming for the Microsoft .NET Framework, ISBN: 0-7356-1959-XISBN: 0-7356-1959-X

Programming Microsoft .NET, ISBN: 0-7356-1376-1Programming Microsoft .NET, ISBN: 0-7356-1376-1

Applied Microsoft Windows .NET Framework Programming, Applied Microsoft Windows .NET Framework Programming, ISBN: 0-7356-1422-9ISBN: 0-7356-1422-9

Applied Microsoft Windows .NET Framework Programming in Microsoft Applied Microsoft Windows .NET Framework Programming in Microsoft Visual Basic .NET, ISBN: 0-7356-1787-2Visual Basic .NET, ISBN: 0-7356-1787-2

Microsoft Windows .NET Framework 1.1 Class Library ReferencesMicrosoft Windows .NET Framework 1.1 Class Library References

Performance Testing Microsoft .NET Web Applications, ISBN: 0-7356-1538-1Performance Testing Microsoft .NET Web Applications, ISBN: 0-7356-1538-1

Microsoft Products and Services for Lifelong LearningMicrosoft Products and Services for Lifelong Learning

Microsoft Products And Services For Lifelong Learningwww.microsoft.com/learningMicrosoft Products And Services For Lifelong Learningwww.microsoft.com/learning

Documents

DEV490.NET Framework: CLR – Under The Hood Jeffrey Richter Author / Consultant / Trainer Wintellect