skip to main content
research-article

Multi-stage replay with crosscut

Published:17 March 2010Publication History
Skip Abstract Section

Abstract

Deterministic record-replay has many useful applications, ranging from fault tolerance and forensics to reproducing and diagnosing bugs. When choosing a record-replay solution, the system administrator must choose a priori how comprehensively to record the execution and at what abstraction level to record it. Unfortunately, these choices may not match well with how the recording is eventually used. A recording may contain too little information to support the end use of replay, or it may contain more sensitive information than is allowed to be shown to the end user of replay. Similarly, fixing the abstraction level at the time of recording often leads to a semantic mismatch with the end use of replay.

This paper describes how to remedy these problems by adding customizable replay stages to create special-purpose logs for the end users of replay. Our system, called Crosscut, allows replay logs to be "sliced" along time and abstraction boundaries. Using this approach, users can create slices that include only the processes, applications, or components of interest, excluding parts that handle sensitive data. Users can also retarget the abstraction level of the replay log to higher-level platforms, such as Perl or Valgrind. Execution can then be augmented with additional analysis code at replay time, without disturbing the replayed components in the slice. Crosscut thus uses replay itself to transform logs into a more efficient, secure, and usable form for replay-based applications.

Our current Crosscut prototype builds on VMware Workstation's record-replay capabilities, and supports a variety of different replay environments. We show how Crosscut can create slices of only the parts of the computation of interest and thereby avoid leaking sensitive information, and we show how to retarget the abstraction level of the log to enable more convenient use during replay debugging.

References

  1. Bacon, D. F., and Goldstein, S. C. Hardware-Assisted Replay of Multiprocessor Programs. In Proceedings of the ACM/ONR Workshop on Parallel and Distributed Debugging (May 1991). Google ScholarGoogle ScholarDigital LibraryDigital Library
  2. Bressoud, T. C., and Schneider, F. B. Hypervisor-based fault tolerance. ACM Transactions on Computer Systems 14, 1 (February 1996), 80--107. Google ScholarGoogle ScholarDigital LibraryDigital Library
  3. Castro, M., Costa, M., and Martin, J.-P. Better Bug Reporting With Better Privacy. In Proceedings of the 2008 International Conference on Architectural Support for Programming Languages and Operating Systemst (ASPLOS) (March 2008), pp. 319--328. Google ScholarGoogle ScholarDigital LibraryDigital Library
  4. Chow, J., Garfinkel, T., and Chen, P. M. Decoupling dynamic program analysis from execution in virtual environments. In Proceedings of the 2008 USENIX Technical Conference (June 2008), pp. 1--14. Google ScholarGoogle ScholarDigital LibraryDigital Library
  5. Dunlap, G. W., King, S. T., Cinar, S., Basrai, M., and Chen, P. M. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation (December 2002), pp. 211--224. Google ScholarGoogle ScholarDigital LibraryDigital Library
  6. Garfinkel, T., and Rosenblum, M. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the 2003 Network and Distributed System Security Symposium (NDSS) (February 2003).Google ScholarGoogle Scholar
  7. Guo, Z., Wang, X., Tang, J., Liu, X., Xu, Z., Wu, M., Kaashoek, M. F., and Zhang, Z. R2: An ApplicationLevel Kernel for Record and Replay. In Proceedings of the 2008 Symposium on Operating Systems Design and Implementation (December 2008), pp. 193--208. Google ScholarGoogle ScholarDigital LibraryDigital Library
  8. Hower, D. R., and Hill, M. D. Rerun: Exploiting Episodes for Lightweight memory Race Recording. In Proceedings of the 2008 International Symposium on Computer Architecture (June 2008), pp. 265--276. Google ScholarGoogle ScholarDigital LibraryDigital Library
  9. Jiang, X., Wang, X., and Xu, D. Stealthy Malware Detection Through VMM-Based Out-of-the-Box Semantic View Reconstruction. In Proceedings of the 2007 ACM Conference on Computer and Communications Security (CCS) (November 2007), pp. 128--138. Google ScholarGoogle ScholarDigital LibraryDigital Library
  10. Joshi, A., King, S. T., Dunlap, G. W., and Chen, P. M. Detecting past and present intrusions through vulnerability-specific predicates. In Proceedings of the 2005 Symposium on Operating Systems Principles (October 2005), pp. 91--104. Google ScholarGoogle ScholarDigital LibraryDigital Library
  11. King, S. T., Dunlap, G. W., and Chen, P. M. Debugging operating systems with time-traveling virtual machines. In Proceedings of the 2005 USENIX Technical Conference (April 2005), pp. 1--15. Google ScholarGoogle ScholarDigital LibraryDigital Library
  12. Lewis, B. Debugging backwards in time. In Proceedings of the 2003 Workshop on Automated and Algorithmic Debugging (September 2003).Google ScholarGoogle Scholar
  13. Litzkow, M., and Solomon, M. Supporting Checkpointing and Process Migration outside the Unix Kernel. In Proceedings of the Winter 1992 USENIX Conference (January 1992).Google ScholarGoogle Scholar
  14. Mellor-Crummey, J. M., and LeBlanc, T. J. A Software Instruction Counter. In Proceedings of the 1989 International Conference on Architectural Support for Programming Languages and Operating Systems (1989), pp. 78--86. Google ScholarGoogle ScholarDigital LibraryDigital Library
  15. Montesinos, P., Ceze, L., and Torrellas, J. DeLorean: Recording and Deterministically Replaying Shared-Memory Multiprocessor Execution Efficiently. In Proceedings of the 2008 International Symposium on Computer Architecture (June 2008), pp. 289--300. Google ScholarGoogle ScholarDigital LibraryDigital Library
  16. Napper, J., Alvisi, L., and Vin, H. A Fault-Tolerant Java Virtual Machine. In Proceedings of the 2003 International Conference on Dependable Systems and Networks (DSN) (June 2003).Google ScholarGoogle ScholarCross RefCross Ref
  17. Nethercote, N., and Seward, J. How to shadow every byte of memory used by a program. In Proceedings of the 2007 Conference on Virtual Execution Environments (June 2007). Google ScholarGoogle ScholarDigital LibraryDigital Library
  18. Nethercote, N., and Seward, J. Valgrind: A framework for heavyweight dynamic binary instrumentation. In Proceedings of the 2007 Programming Language Design and Implementation Conference (June 2007). Google ScholarGoogle ScholarDigital LibraryDigital Library
  19. Nightingale, E. B., Peek, D., Chen, P. M., and Flinn, J. Parallelizing security checks on commodity hardware. In Proceedings of the 2008 International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) (March 2008), pp. 308--318. Google ScholarGoogle ScholarDigital LibraryDigital Library
  20. O'Callahan, R. Efficient collection and storage of indexed program traces. http://www.ocallahan.org/Amber.pdf, December 2006.Google ScholarGoogle Scholar
  21. O'Callahan, R. Announcing chronomancer. http://weblogs.mozillazine.org/roc/archives/2007/08/announcing_chro.html, August 2007.Google ScholarGoogle Scholar
  22. Seward, J., and Nethercote, N. Using Valgrind to detect undefined value errors with bit-precision. In Proceedings of the 2005 USENIX Technical Conference (April 2005). Google ScholarGoogle ScholarDigital LibraryDigital Library
  23. Srinivasan, S., Kandula, S., Andrews, C., and Zhou, Y. Flashback: A light-weight rollback and deterministic replay extension for software debugging. In Proceedings of the 2004 USENIX Technical Conference (June 2004). Google ScholarGoogle ScholarDigital LibraryDigital Library
  24. Tucek, J., Lu, S., Huang, C., Xanthos, S., and Zhou, Y. Triage: Diagnosing Production Run Failures at the User's Site. In Proceedings of the 2007 Symposium on Operating Systems Principles (October 2007), pp. 131--144. Google ScholarGoogle ScholarDigital LibraryDigital Library
  25. Wallace, S., and Hazelwood, K. SuperPin: Parallelizing Dynamic Instrumentation for Real-Time Performance. In Proceedings of the 2007 International Symposium on Code Generation and Optimization (CGO) (March 2007), pp. 209--217. Google ScholarGoogle ScholarDigital LibraryDigital Library
  26. Weiser, M. Programmers use slices when debugging. Communications of the ACM 25, 7 (July 1982), 446--452. Google ScholarGoogle ScholarDigital LibraryDigital Library
  27. Xu, M., Bodik, R., and Hill, M. D. A Flight Data Recorder for Enabling Full-system Multiprocessor Deterministic Replay. In Proceedings of the 2003 International Symposium on Computer Architecture (June 2003). Google ScholarGoogle ScholarDigital LibraryDigital Library
  28. Xu, M., Malyugin, V., Sheldon, J., Venkitachalam, G., and Weissman, B. ReTrace: Collecting Execution Trace with Virtual Machine Deterministic Replay. In Proceedings of the 2007 Workshop on Modeling, Benchmarking and Simulation (MoBS) (June 2007).Google ScholarGoogle Scholar

Index Terms

  1. Multi-stage replay with crosscut

    Recommendations

    Comments

    Login options

    Check if you have access through your login credentials or your institution to get full access on this article.

    Sign in

    Full Access

    • Published in

      cover image ACM SIGPLAN Notices
      ACM SIGPLAN Notices  Volume 45, Issue 7
      VEE '10
      July 2010
      161 pages
      ISSN:0362-1340
      EISSN:1558-1160
      DOI:10.1145/1837854
      Issue’s Table of Contents
      • cover image ACM Conferences
        VEE '10: Proceedings of the 6th ACM SIGPLAN/SIGOPS international conference on Virtual execution environments
        March 2010
        176 pages
        ISBN:9781605589107
        DOI:10.1145/1735997

      Copyright © 2010 ACM

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      • Published: 17 March 2010

      Check for updates

      Qualifiers

      • research-article

    PDF Format

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader
    About Cookies On This Site

    We use cookies to ensure that we give you the best experience on our website.

    Learn more

    Got it!