Deterministic replay specifics in case of minimal device set
The deterministic replay technique can be used for debugging, improving reliability and robustness, software development and incident investigation (including reverse engineering of malware). The paper describes the implementation of deterministic replay of IA-32 based boards in QEMU. Another implem...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ivannikov Institute for System Programming of the Russian Academy of Sciences
2018-10-01
|
| Series: | Труды Института системного программирования РАН |
| Subjects: | |
| Online Access: | https://ispranproceedings.elpub.ru/jour/article/view/1091 |
| _version_ | 1811321690113703936 |
|---|---|
| author | V. Y. Efimov K. A. Batuzov V. A. Padaryan |
| author_facet | V. Y. Efimov K. A. Batuzov V. A. Padaryan |
| author_sort | V. Y. Efimov |
| collection | DOAJ |
| description | The deterministic replay technique can be used for debugging, improving reliability and robustness, software development and incident investigation (including reverse engineering of malware). The paper describes the implementation of deterministic replay of IA-32 based boards in QEMU. Another implementation of this technique in QEMU had been previously published, but it uses a significantly different approach. Deterministic replay implementation details and features substantially depend on deterministic area - the part of virtual machine which execution is being replayed. For replay to be deterministic the implementation must ensure that (1) all information flows across deterministic area borders should be logged and then replayed, and (2) there is no non-determinism inside deterministic area. The proposed approach is called «Min VM» because it’s based on the minimal deterministic area while the former one should be called «Max VM» as it attempts to stretch deterministic area to cover whole virtual machine. The proposed approach shows the advantages of lower time overhead for logging phase and easier support (because it is much easier to ensure determinism of small deterministic area). On the other side the shortcoming is larger log size mostly because deterministic area doesn’t include hard disks so all data flows from disks are being logged. It makes the self-sufficient replay log: image of the original HDD is not needed to replay the execution. The implementation has been tested on popular operating systems: Windows XP, Windows 7 and GNU/Linux 3.12. The current implementation shows 6 - 42% slowdown depending on application code that exceeds previous approach slowdown (17 - 79%). |
| first_indexed | 2024-04-13T13:22:08Z |
| format | Article |
| id | doaj.art-c767918ab11b4857a622fcfd8beef044 |
| institution | Directory Open Access Journal |
| issn | 2079-8156 2220-6426 |
| language | English |
| last_indexed | 2024-04-13T13:22:08Z |
| publishDate | 2018-10-01 |
| publisher | Ivannikov Institute for System Programming of the Russian Academy of Sciences |
| record_format | Article |
| series | Труды Института системного программирования РАН |
| spelling | doaj.art-c767918ab11b4857a622fcfd8beef0442022-12-22T02:45:18ZengIvannikov Institute for System Programming of the Russian Academy of SciencesТруды Института системного программирования РАН2079-81562220-64262018-10-01272659210.15514/ISPRAS-2015-27(2)-51091Deterministic replay specifics in case of minimal device setV. Y. Efimov0K. A. Batuzov1V. A. Padaryan2ИСП РАНИСП РАНИСП РАНThe deterministic replay technique can be used for debugging, improving reliability and robustness, software development and incident investigation (including reverse engineering of malware). The paper describes the implementation of deterministic replay of IA-32 based boards in QEMU. Another implementation of this technique in QEMU had been previously published, but it uses a significantly different approach. Deterministic replay implementation details and features substantially depend on deterministic area - the part of virtual machine which execution is being replayed. For replay to be deterministic the implementation must ensure that (1) all information flows across deterministic area borders should be logged and then replayed, and (2) there is no non-determinism inside deterministic area. The proposed approach is called «Min VM» because it’s based on the minimal deterministic area while the former one should be called «Max VM» as it attempts to stretch deterministic area to cover whole virtual machine. The proposed approach shows the advantages of lower time overhead for logging phase and easier support (because it is much easier to ensure determinism of small deterministic area). On the other side the shortcoming is larger log size mostly because deterministic area doesn’t include hard disks so all data flows from disks are being logged. It makes the self-sufficient replay log: image of the original HDD is not needed to replay the execution. The implementation has been tested on popular operating systems: Windows XP, Windows 7 and GNU/Linux 3.12. The current implementation shows 6 - 42% slowdown depending on application code that exceeds previous approach slowdown (17 - 79%).https://ispranproceedings.elpub.ru/jour/article/view/1091виртуальная машинадетерминированное воспроизведениеэмуляторqemu |
| spellingShingle | V. Y. Efimov K. A. Batuzov V. A. Padaryan Deterministic replay specifics in case of minimal device set Труды Института системного программирования РАН виртуальная машина детерминированное воспроизведение эмулятор qemu |
| title | Deterministic replay specifics in case of minimal device set |
| title_full | Deterministic replay specifics in case of minimal device set |
| title_fullStr | Deterministic replay specifics in case of minimal device set |
| title_full_unstemmed | Deterministic replay specifics in case of minimal device set |
| title_short | Deterministic replay specifics in case of minimal device set |
| title_sort | deterministic replay specifics in case of minimal device set |
| topic | виртуальная машина детерминированное воспроизведение эмулятор qemu |
| url | https://ispranproceedings.elpub.ru/jour/article/view/1091 |
| work_keys_str_mv | AT vyefimov deterministicreplayspecificsincaseofminimaldeviceset AT kabatuzov deterministicreplayspecificsincaseofminimaldeviceset AT vapadaryan deterministicreplayspecificsincaseofminimaldeviceset |