Abstract
In the paper we evaluate two approaches to full-system deterministic replay. Both of them allow replaying guest OS and applications without modifications. Deterministic replay is intended for debugging and dynamic analysis of system core, multithreaded and non-deterministic applications, cross-platform applications, and devices’ drivers. Presented approaches differ by boundary line dividing non-deterministic “outer world” and deterministic part of the simulator. All inputs from the “outer world” are written into the log to allow latter replaying of deterministic part. The common thing in both approaches is that deterministic part includes CPU, RAM, and video adapter. This allows debugging, tracing, and analyzing of the replayed code. In the first approach “outer world” is presented by inputs – keyboard input, USB devices, mouse, network adapter, and microphone. All virtual peripheral devices should be deterministic in this approach. In the second approach all emulator parts except CPU, RAM, and video adapter are considered external. This means that all interactions between CPU and virtual peripheral devices (including IO, MMIO and DMA transactions) are written into the replay log. The first approach has the following pros: one can replay whole virtual machine for devices’ drivers debugging; relatively low number of changes within the simulator; low usage of storage for replay log. The drawback of this approach is the need to support for all external interfaces of the virtual machine. The second approach is completely opposite – it requires changes only in the several interfaces, but every virtual device with DMA interface should be modified. It also generates bigger replay logs. We evaluated time and space overheads for the first approach. Slowdown is very low – it is lower than 1% in loading Windows XP scenario and is about 25% for network operations. Replay log growth speed for basic guest OS execution is about 50kb per second.
Highlights
PQEMU: A Parallel System Emulator Based on QEMU. // IEEE 17th International Conference on Parallel and Distributed Systems, 2011
In the paper we evaluate two approaches to full-system deterministic replay
Presented approaches differ by boundary line dividing non-deterministic “outer world” and deterministic part of the simulator
Summary
За последнее десятилетие виртуальные машины получили широкое распространение среди пользователей, как Linux, так и Windows. Ведущие производители предлагают разработчикам набор программных инструментов, в состав которых обязательно входит виртуальная машина, используемая для отладки. Еще одним востребованным сценарием использования виртуальных машин является расследование инцидентов нарушения информационной безопасности и криминалистическая экспертиза. Виртуальные машины могут применяться как для ограничения действий, так и для фиксации происходящего в информационной системе с целью последующего анализа. Данная статья посвящена вопросу организации детерминированного воспроизведения работы программного симулятора В статье рассматриваются два подхода к реализации детерминированного воспроизведения в симуляторе QEMU, оцениваются перспективы их развития. В разделе 2 приводится сравнение известных механизмов детерминированного воспроизведения в программных симуляторах (виртуальных машинах). В разделе 4 описываются различные подходы, реализующие детерминированное воспроизведение в рамках симулятора QEMU. В разделе 5 рассматриваются детали реализации этих подходов в QEMU.
Sign-in/Register to view highlights & summary Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callMore From: Proceedings of the Institute for System Programming of RAS
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
