Abstract
Deterministic record-replay has many useful applications, ranging from fault tolerance and forensics to reproducing and diagnosing bugs. When choosing a record-replay solution, the system administrator must choose a priori how comprehensively to record the execution and at what abstraction level to record it. Unfortunately, these choices may not match well with how the recording is eventually used. A recording may contain too little information to support the end use of replay, or it may contain more sensitive information than is allowed to be shown to the end user of replay. Similarly, fixing the abstraction level at the time of recording often leads to a semantic mismatch with the end use of replay.
This paper describes how to remedy these problems by adding customizable replay stages to create special-purpose logs for the end users of replay. Our system, called Crosscut, allows replay logs to be "sliced" along time and abstraction boundaries. Using this approach, users can create slices that include only the processes, applications, or components of interest, excluding parts that handle sensitive data. Users can also retarget the abstraction level of the replay log to higher-level platforms, such as Perl or Valgrind. Execution can then be augmented with additional analysis code at replay time, without disturbing the replayed components in the slice. Crosscut thus uses replay itself to transform logs into a more efficient, secure, and usable form for replay-based applications.
Our current Crosscut prototype builds on VMware Workstation's record-replay capabilities, and supports a variety of different replay environments. We show how Crosscut can create slices of only the parts of the computation of interest and thereby avoid leaking sensitive information, and we show how to retarget the abstraction level of the log to enable more convenient use during replay debugging.
- Bacon, D. F., and Goldstein, S. C. Hardware-Assisted Replay of Multiprocessor Programs. In Proceedings of the ACM/ONR Workshop on Parallel and Distributed Debugging (May 1991). Google Scholar
Digital Library
- Bressoud, T. C., and Schneider, F. B. Hypervisor-based fault tolerance. ACM Transactions on Computer Systems 14, 1 (February 1996), 80--107. Google Scholar
Digital Library
- Castro, M., Costa, M., and Martin, J.-P. Better Bug Reporting With Better Privacy. In Proceedings of the 2008 International Conference on Architectural Support for Programming Languages and Operating Systemst (ASPLOS) (March 2008), pp. 319--328. Google Scholar
Digital Library
- Chow, J., Garfinkel, T., and Chen, P. M. Decoupling dynamic program analysis from execution in virtual environments. In Proceedings of the 2008 USENIX Technical Conference (June 2008), pp. 1--14. Google Scholar
Digital Library
- Dunlap, G. W., King, S. T., Cinar, S., Basrai, M., and Chen, P. M. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation (December 2002), pp. 211--224. Google Scholar
Digital Library
- Garfinkel, T., and Rosenblum, M. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the 2003 Network and Distributed System Security Symposium (NDSS) (February 2003).Google Scholar
- Guo, Z., Wang, X., Tang, J., Liu, X., Xu, Z., Wu, M., Kaashoek, M. F., and Zhang, Z. R2: An ApplicationLevel Kernel for Record and Replay. In Proceedings of the 2008 Symposium on Operating Systems Design and Implementation (December 2008), pp. 193--208. Google Scholar
Digital Library
- Hower, D. R., and Hill, M. D. Rerun: Exploiting Episodes for Lightweight memory Race Recording. In Proceedings of the 2008 International Symposium on Computer Architecture (June 2008), pp. 265--276. Google Scholar
Digital Library
- Jiang, X., Wang, X., and Xu, D. Stealthy Malware Detection Through VMM-Based Out-of-the-Box Semantic View Reconstruction. In Proceedings of the 2007 ACM Conference on Computer and Communications Security (CCS) (November 2007), pp. 128--138. Google Scholar
Digital Library
- Joshi, A., King, S. T., Dunlap, G. W., and Chen, P. M. Detecting past and present intrusions through vulnerability-specific predicates. In Proceedings of the 2005 Symposium on Operating Systems Principles (October 2005), pp. 91--104. Google Scholar
Digital Library
- King, S. T., Dunlap, G. W., and Chen, P. M. Debugging operating systems with time-traveling virtual machines. In Proceedings of the 2005 USENIX Technical Conference (April 2005), pp. 1--15. Google Scholar
Digital Library
- Lewis, B. Debugging backwards in time. In Proceedings of the 2003 Workshop on Automated and Algorithmic Debugging (September 2003).Google Scholar
- Litzkow, M., and Solomon, M. Supporting Checkpointing and Process Migration outside the Unix Kernel. In Proceedings of the Winter 1992 USENIX Conference (January 1992).Google Scholar
- Mellor-Crummey, J. M., and LeBlanc, T. J. A Software Instruction Counter. In Proceedings of the 1989 International Conference on Architectural Support for Programming Languages and Operating Systems (1989), pp. 78--86. Google Scholar
Digital Library
- Montesinos, P., Ceze, L., and Torrellas, J. DeLorean: Recording and Deterministically Replaying Shared-Memory Multiprocessor Execution Efficiently. In Proceedings of the 2008 International Symposium on Computer Architecture (June 2008), pp. 289--300. Google Scholar
Digital Library
- Napper, J., Alvisi, L., and Vin, H. A Fault-Tolerant Java Virtual Machine. In Proceedings of the 2003 International Conference on Dependable Systems and Networks (DSN) (June 2003).Google Scholar
Cross Ref
- Nethercote, N., and Seward, J. How to shadow every byte of memory used by a program. In Proceedings of the 2007 Conference on Virtual Execution Environments (June 2007). Google Scholar
Digital Library
- Nethercote, N., and Seward, J. Valgrind: A framework for heavyweight dynamic binary instrumentation. In Proceedings of the 2007 Programming Language Design and Implementation Conference (June 2007). Google Scholar
Digital Library
- Nightingale, E. B., Peek, D., Chen, P. M., and Flinn, J. Parallelizing security checks on commodity hardware. In Proceedings of the 2008 International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) (March 2008), pp. 308--318. Google Scholar
Digital Library
- O'Callahan, R. Efficient collection and storage of indexed program traces. http://www.ocallahan.org/Amber.pdf, December 2006.Google Scholar
- O'Callahan, R. Announcing chronomancer. http://weblogs.mozillazine.org/roc/archives/2007/08/announcing_chro.html, August 2007.Google Scholar
- Seward, J., and Nethercote, N. Using Valgrind to detect undefined value errors with bit-precision. In Proceedings of the 2005 USENIX Technical Conference (April 2005). Google Scholar
Digital Library
- Srinivasan, S., Kandula, S., Andrews, C., and Zhou, Y. Flashback: A light-weight rollback and deterministic replay extension for software debugging. In Proceedings of the 2004 USENIX Technical Conference (June 2004). Google Scholar
Digital Library
- Tucek, J., Lu, S., Huang, C., Xanthos, S., and Zhou, Y. Triage: Diagnosing Production Run Failures at the User's Site. In Proceedings of the 2007 Symposium on Operating Systems Principles (October 2007), pp. 131--144. Google Scholar
Digital Library
- Wallace, S., and Hazelwood, K. SuperPin: Parallelizing Dynamic Instrumentation for Real-Time Performance. In Proceedings of the 2007 International Symposium on Code Generation and Optimization (CGO) (March 2007), pp. 209--217. Google Scholar
Digital Library
- Weiser, M. Programmers use slices when debugging. Communications of the ACM 25, 7 (July 1982), 446--452. Google Scholar
Digital Library
- Xu, M., Bodik, R., and Hill, M. D. A Flight Data Recorder for Enabling Full-system Multiprocessor Deterministic Replay. In Proceedings of the 2003 International Symposium on Computer Architecture (June 2003). Google Scholar
Digital Library
- Xu, M., Malyugin, V., Sheldon, J., Venkitachalam, G., and Weissman, B. ReTrace: Collecting Execution Trace with Virtual Machine Deterministic Replay. In Proceedings of the 2007 Workshop on Modeling, Benchmarking and Simulation (MoBS) (June 2007).Google Scholar
Index Terms
Multi-stage replay with crosscut
Recommendations
Multi-stage replay with crosscut
VEE '10: Proceedings of the 6th ACM SIGPLAN/SIGOPS international conference on Virtual execution environmentsDeterministic record-replay has many useful applications, ranging from fault tolerance and forensics to reproducing and diagnosing bugs. When choosing a record-replay solution, the system administrator must choose a priori how comprehensively to record ...
Software-only system-level record and replay in wireless sensor networks
IPSN '15: Proceedings of the 14th International Conference on Information Processing in Sensor NetworksWireless sensor networks (WSNs) are plagued by the possibility of bugs manifesting only at deployment. However, debugging deployed WSNs is challenging for several reasons---the remote location of deployed sensor nodes, the non- determinism of execution ...
Execution replay of multiprocessor virtual machines
VEE '08: Proceedings of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environmentsExecution replay of virtual machines is a technique which has many important applications, including debugging, fault-tolerance, and security. Execution replay for single processor virtual machines is well-understood, and available commercially. With ...







Comments