Features/record-replay

Overview

Record/replay feature is implementation of deterministic replay for system-level simulation (softmmu mode).

Record/replay functions are used for the reverse execution and deterministic replay of qemu execution. Determinitsic replay is used to record volatile system execution once and replay it for multiple times for the sake of analysis, debugging, logging, etc. This implementation of deterministic replay can be used for deterministic and reverse debugging of guest code through a gdb remote interface.

One of the aims of deterministic/reverse debugging is eliminating Heisenbugs. Stopping the program in the debugger may cause timeout in data processing or data transfer. The behavior of the connected device may change and the bug will disappear. Each program run can expose different behavior of the program without giving a chance to examine the bugs.

Limitations

Record/replay reuses icount to implement deterministic execution. Therefore rr inherits icount limitations:

Works only in single CPU TCG mode.
Some platforms have incomplete icount implementation

Using record/replay

Record/replay feature is tested for i386, x86_64, ARM, and MIPS platforms.

Current version does not support replaying of block devices, serial ports, passthrough USB, and network devices. Therefore record/replay may be used with the following or similar command line options:

qemu-system-arm -M integratorcp -kernel zImage.integrator -initrd arm_root.img -net none

Execution recording may be enabled through icount command line option: -icount shift=7,rr=record,rrfile=replay.bin

To enable replaying icount option should look like this: -icount shift=7,rr=replay,rrfile=replay.bin

Supported inputs

Mouse input
Keyboard input
Host real time clock

Features to add

Full version of record/replay will include support of:

Automatic VM snapshotting
Reverse debugging through GDB

How to get involved

First version of patches of record/replay feature is prepared by ISP RAS

You can mail Pavel Dovgalyuk to get information about patches that were not upstreamed yet.

Links

Papers with description of deterministic replay implementation:

Prior QEMU version with block patches added: https://github.com/Dovgalyuk/qemu/tree/rr-15