Automated Debugging for Arbitrarily Long Executions Cristian - - PowerPoint PPT Presentation

▶
automated debugging for arbitrarily long executions
SMART_READER_LITE
LIVE PREVIEW

Automated Debugging for Arbitrarily Long Executions Cristian - - PowerPoint PPT Presentation

Jun 29, 2023 306 likes •946 views

Automated Debugging for Arbitrarily Long Executions Cristian Zamfir, Baris Kasikci, Johannes Kinder, Edouard Bugnion, George Candea Debugging is Hard Debugging = diagnose + fix the root cause May take days-months to diagnose bugs in the

slide-1
SLIDE 1

Automated Debugging for Arbitrarily Long Executions

Cristian Zamfir, Baris Kasikci, Johannes Kinder, Edouard Bugnion, George Candea

slide-2
SLIDE 2

Debugging is Hard

  • Debugging = diagnose + fix the root cause
  • May take days-months to diagnose bugs

in the real world1

1 Concurrency at Microsoft – An Exploratory Survey, CAV workshop 2008

slide-3
SLIDE 3

Real World Debugging

Debugging during development

slide-4
SLIDE 4

Real World Debugging

Debugging during development

$ gdb ./program

slide-5
SLIDE 5

Real World Debugging

Debugging during development

$ gdb ./program (gdb) record

slide-6
SLIDE 6

Real World Debugging

Debugging during development

$ gdb ./program (gdb) record (gdb) run

slide-7
SLIDE 7

Real World Debugging

Debugging during development

$ gdb ./program (gdb) record (gdb) run Segmentation fault

slide-8
SLIDE 8

Real World Debugging

Debugging during development

$ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-9
SLIDE 9

Real World Debugging

Debugging during development

$ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-10
SLIDE 10

Real World Debugging

Debugging during development Debugging in the real world

$ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-11
SLIDE 11

Real World Debugging

Debugging during development

$ ./program

Debugging in the real world

$ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-12
SLIDE 12

Real World Debugging

Debugging during development

$ ./program Segmentation fault

Debugging in the real world

$ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-13
SLIDE 13

Real World Debugging

Debugging during development

$ ./program Segmentation fault (core dumped)

Debugging in the real world

$ gdb ./program core $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-14
SLIDE 14

Real World Debugging

Debugging during development

$ ./program Segmentation fault (core dumped)

Debugging in the real world

$ gdb ./program core (gdb) reverse-step $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-15
SLIDE 15

Real World Debugging

Debugging during development

$ ./program Segmentation fault (core dumped)

Debugging in the real world

$ gdb ./program core (gdb) reverse-step Target core command unsupported $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

slide-16
SLIDE 16

Debug Without Recording

slide-17
SLIDE 17

Debug Without Recording

What are the classes of information necessary for debugging?

slide-18
SLIDE 18

Debug Without Recording

10101010 10101011 Coredump

+

11101011 10001001 Program

What are the classes of information necessary for debugging?

slide-19
SLIDE 19

Debug Without Recording

Synthesize

program inputs thread schedule 10101010 10101011 Coredump

+

11101011 10001001 Program

What are the classes of information necessary for debugging?

slide-20
SLIDE 20

Debug Without Recording

Replay Library Original Program Binary

Debugger

Synthesize

program inputs thread schedule 10101010 10101011 Coredump

+

11101011 10001001 Program

What are the classes of information necessary for debugging?

slide-21
SLIDE 21

Debug Without Recording

Synthesize

program inputs thread schedule

slide-22
SLIDE 22

Debug Without Recording

Synthesize

program inputs thread schedule

slide-23
SLIDE 23

Debug Without Recording

Synthesize

program inputs thread schedule

slide-24
SLIDE 24

Debug Without Recording

Synthesize

program inputs thread schedule

slide-25
SLIDE 25

Debug Without Recording

Synthesize

program inputs thread schedule

slide-26
SLIDE 26

Debug Without Recording

Synthesize

program inputs thread schedule

slide-27
SLIDE 27

Debug Without Recording

Synthesize

program inputs thread schedule

Exact same execution is not necessary 


ODR, PRES (SOSP’09) and ESD (EuroSys’10)

slide-28
SLIDE 28

Debug Without Recording

Synthesize

program inputs thread schedule

Reproduce the root cause and the failure 


Debug Determinism (HotOS’11)

Exact same execution is not necessary 


ODR, PRES (SOSP’09) and ESD (EuroSys’10)

slide-29
SLIDE 29

Debug Without Recording

Synthesize

program inputs thread schedule

Reproduce the root cause and the failure 


Debug Determinism (HotOS’11)

Exact same execution is not necessary 


ODR, PRES (SOSP’09) and ESD (EuroSys’10)

slide-30
SLIDE 30

Reverse Execution Synthesis

Synthesize

program inputs thread schedule

slide-31
SLIDE 31

Reverse Execution Synthesis

Synthesize

program inputs thread schedule

The root cause is close to the failure 


85% of the time (Conseq, ASPLOS’11)

slide-32
SLIDE 32

Reverse Execution Synthesis

Synthesize

program inputs thread schedule

The root cause is close to the failure 


85% of the time (Conseq, ASPLOS’11)

slide-33
SLIDE 33

Reverse Execution Synthesis

Synthesize

program inputs thread schedule

The root cause is close to the failure 


85% of the time (Conseq, ASPLOS’11)

slide-34
SLIDE 34

Reverse Execution Synthesis

Synthesize

program inputs thread schedule

The root cause is close to the failure 


85% of the time (Conseq, ASPLOS’11)

slide-35
SLIDE 35

Reverse Execution Synthesis

slide-36
SLIDE 36

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

slide-37
SLIDE 37

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: x 1 y 10

slide-38
SLIDE 38

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x 1 y 10

slide-39
SLIDE 39

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) True x 1 y 10

slide-40
SLIDE 40

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True True x 1 y 10

slide-41
SLIDE 41

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10

slide-42
SLIDE 42

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y

slide-43
SLIDE 43

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y x y

slide-44
SLIDE 44

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y x y

slide-45
SLIDE 45

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y x 2 y

slide-46
SLIDE 46

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y x 2 y 10

slide-47
SLIDE 47

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x 2 y 10

slide-48
SLIDE 48

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x 2 y 10

slide-49
SLIDE 49

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y

no match

g(2) != 10 x ? y 10 x 2 y 10

slide-50
SLIDE 50

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x 2 y 10

slide-51
SLIDE 51

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x y x 2 y 10

slide-52
SLIDE 52

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x y x 2 y 10

slide-53
SLIDE 53

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x 2 y 10 x 1 y

slide-54
SLIDE 54

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x 2 y 10 x 1 y

slide-55
SLIDE 55

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x 2 y 10 x 1 y 10

slide-56
SLIDE 56

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 f(1) == 10 x 2 y 10 x 1 y 10

slide-57
SLIDE 57

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x ? y 10 f(1) == 10 x 2 y 10 x 1 y 10

slide-58
SLIDE 58

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 x ? y 10 f(1) == 10

match

x 2 y 10 x 1 y 10

slide-59
SLIDE 59

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 Execution suffix x ? y 10 f(1) == 10

match

x 2 y 10 x 1 y 10

slide-60
SLIDE 60

x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

Reverse Execution Synthesis

Coredump: (buffer overflow) buffer[y] = 1; x = 1; if (f(x) == y) x = 2; if (g(x) == y) True False True False x 1 y 10 x y x y g(2) != 10 x ? y 10 Execution suffix (gdb) reverse-step x ? y 10 f(1) == 10

match

x 2 y 10 x 1 y 10

slide-61
SLIDE 61

Reverse Execution Synthesis

  • Coredump + program → execution suffix
  • Debug arbitrarily long executions
  • No runtime recording
slide-62
SLIDE 62

Use Cases

  • Automated debugging
  • identify the root cause of a failure
  • Automated bug triaging
  • triage based on the execution suffix
  • Identify likely hardware errors
  • when no execution suffix explains the coredump

Baris Ed George