search

rr-debugger / rr

Record and Replay Framework
http://rr-project.org/
Other
8.87k stars 567 forks source link

Virtual Machine Introspection (of QEMU) with rr #3389

Open deliciouslytyped opened 1 year ago

deliciouslytyped commented 1 year ago

VMI (Virtual Machine Introspection) is a term (among other things) for inspecting the state of virtual machines meaningfully from an external point of view. (see e.g. https://libvmi.com , https://drakvuf.com/ , https://en.wikipedia.org/wiki/Virtual_machine_introspection)

Given that rr enables reversible debugging of QEMU, it would be very Cool and Good (TM) if there was a way to use it to directly inspect guest state without forcing the user to handle stepping through the QEMU layer as well. It has really been bothering me for a while that this does not seem to be a thing, because it sounds so good. :)

What would it take to do something like this?

I'm (edit:) NOT well versed in these things, however:

I imagine the minimum intuitive requirements for this, depending on the information desired (several levels could be supported) are

backend:

frontend:

If this was possible, it might also be reasonably generalized to other situations where a general reverse execution framework is useful to implement a more domain specific debugger.

rocallahan commented 1 year ago

This sounds doable. Would be an interesting framework for someone.

https://pernos.co/about/javascript/ is a little bit related (different kind of "VM" though).

deliciouslytyped commented 1 year ago

Bonus?: If you can rr a QEMU VM, and you can debug processes as if you were debugging them natively, you can rr anything? :)

stsquad commented 1 year ago

Why do all this spooky action at a distance? If you want to debug guests running in QEMU use it's own record/replay facility and reverse debugging to do it.

hygoni commented 1 year ago

Why do all this spooky action at a distance? If you want to debug guests running in QEMU use it's own record/replay facility and reverse debugging to do it.

QEMU only supports record/replay on single CPU. It'd be helpful when the bug is reproduced only on SMP.