(TL;DR: rr from git can record and replay 64-bit programs. Try it for yourself!)

Over the last several months, I’ve been devoting an ever-increasing amount of my time to making rr able to trace x86-64 programs. I’ve learned a lot along the way and thought I’d lay out all the major pieces of work that needed to be done to make this happen.

Before explaining the major pieces, it will be helpful to define some terms: the host architecture is the architecture that the rr binary itself is compiled for. The target architecture is the architecture of the binary that rr is tracing. These are often equivalent, but not necessarily so: you could be tracing a 64-bit binary with a 64-bit rr (host == target), but then the program starts to run a 32-bit subprocess, which rr also begins to trace (host != target). And you have to handle both cases in a single rr session, with a single rr binary. (64-bit rr doesn’t handle the host != target case quite yet, but all the infrastructure is there.)

All of the pieces described below are not new ideas: the major programs you use for development (compiler, linker, debugger, etc.) all have done some variation of what I describe below. However, it’s not every day that one takes a program written without any awareness of host/target distinctions and endows it with the necessary awareness.

Quite often, a program written exclusively for 32-bit hosts has issues when trying to compile for 64-bit hosts, and rr was no exception in this regard. Making the code 64-bit clean by fixing all the places that triggered compiler warnings on x86-64, but not on i386, was probably the easiest part of the whole porting effort. Format strings were a big part of this: writing %llx when you wanted to print a uint64_t , for instance, which assumes that uint64_t is implemented as unsigned long long (not necessarily true on 64-bit hosts). There were several places where long was used instead of uint32_t . And there were even places that triggered signed/unsigned comparison warnings on 64-bit platforms only. (Exercise for the reader: construct code where this happens before looking at the solution.)

Once all the host issues are dealt with, removing all the places where rr assumed semantics or conventions of the x86 architecture was the next step. In short, all of the code assumed host == target: we were compiled on x86, so that must be the architecture of the program we’re debugging. How many places actually assumed this, though? Consider what the very simplified pseudo-code of the rr main recording loop looks like:

while (true) { wait for the tracee to make a syscall grab the registers at the point of the syscall extract the syscall number from the registers (1) switch (syscall_number) { case SYS_read: (2) extract pointer to the data read from the registers (3) record contents of data break; case SYS_clock_gettime: extract pointers for argument structures from the registers record contents of those argument structures (4) break; case SYS_mmap: (5) ... case SYS_mmap2: (6) ... case SYS_clone: (7) ... ... default: complain about an unhandled syscall } let the tracee resume }

Every line marked with a number at the end indicates a different instance where host and target differences come into play and/or the code might have assumed x86 semantics. (And the numbering above is not exhaustive!) Taking them in order:

You can obtain the registers of your target with a single ptrace call, but the layout of those registers depends on your target. ptrace returns the registers as a struct user_regs , which differs between targets; the syscall number location obviously differs between different layouts of struct user_regs . The constant SYS_read refers to the syscall number for read on the host. If you want to identify the syscall number for the target, you’ll need to do something different. This instance is a continuation of #1: syscall arguments are passed in different registers for each target, and the locations of those registers differ in size and location between different layouts of struct user_regs . SYS_clock_gettime takes a pointer to a struct timespec . How much data should we read from that pointer for recording purposes? We can’t just use sizeof(struct timespec) , since that’s the size for the host, not the target. Like SYS_read , SYS_mmap refers to the syscall number for mmap on the host, so we need to do something similar to SYS_read here. But just because two different architectures have a SYS_mmap , it doesn’t mean that the calling conventions for those syscalls at the kernel level are identical. (This distinction applies to several other syscalls as well.) SYS_mmap on x86 takes a single pointer argument, pointing to a structure that contains the syscall’s arguments. The x86-64 version takes its arguments in registers. We have to extract arguments appropriately for each calling convention. SYS_mmap2 only exists on x86; x86-64 has no such syscall. So we have to handle host-only syscalls or target-only syscalls in addition to things like SYS_read . SYS_clone has four (!) different argument orderings at the kernel level, depending on the architecture, and x86 and x86-64 of course use different argument orderings. You must take these target differences into account when extracting arguments. SYS_clone implementations also differ in how they treat the tls parameter, and those differences have to be handled as well.

So, depending on the architecture of our target, we want to use different constants, different structures, and do different things depending on calling conventions or other semantic differences.

The approach rr uses is that the Registers of every rr Task (rr’s name for an operating system thread) has an architecture, along with a few other things like recorded events. Every structure for which the host/target distinction matters has an arch() accessor. Additionally, we define some per-architecture classes. Each class contains definitions for important kernel types and structures, along with enumerations for syscalls and various constants.

Then we try to let C++ templates do most of the heavy lifting. In code, it looks something like this:

enum SupportedArch { x86, x86_64, }; class X86Arch { /* many typedefs, structures, enums, and constants defined... */ }; class X64Arch { /* many typedefs, structures, enums, and constants defined... */ }; #define RR_ARCH_FUNCTION(f, arch, args...) \ switch (arch) { \ default: \ assert(0 && "Unknown architecture"); \ case x86: \ return f<X86Arch>(args); \ case x86_64: \ return f<X64Arch>(args); \ } class Registers { public: SupportedArch arch() const { ... } intptr_t syscallno() const { switch (arch()) { case x86: return u.x86.eax; case x86_64: return u.x64.rax; } } // And so on for argN accessors and so forth... private: union RegisterUnion { X86Arch::user_regs x86; X64Arch::user_regs x64; } u. }; template <typename Arch> static void process_syscall_arch(Task* t, int syscall_number) { switch (syscall_number) { case Arch::read: remote_ptr buf = t->regs().arg2(); // do stuff with buf break; case Arch::clock_gettime: // We ensure Arch::timespec is defined with the appropriate types so it // is exactly the size |struct timespec| would be on the target arch. remote_ptr tp = t->regs().arg2(); // do stuff with tp break; case Arch::mmap: switch (Arch::mmap_argument_semantics) { case Arch::MmapRegisterArguments: // x86-64 break; case Arch::MmapStructArguments: // x86 break; } break; case Arch::mmap2: // Arch::mmap2 is always defined, but is a negative number on architectures // where SYS_mmap2 isn't defined. // do stuff break; case Arch::clone: switch (Arch::clone_argument_ordering) { case Arch::FlagsStackParentTLSChild: // x86 break; case Arch::FlagsStackParentChildTLS: // x86-64 break; } break; ... } } void process_syscall(Task* t, int syscall_number) { int syscall_number = t->regs().syscallno(); RR_ARCH_FUNCTION(process_syscall_arch, t->arch(), t, syscall_number); }

The definitions of X86Arch and X64Arch also contain static_assert s to try and ensure that we’ve defined structures correctly for at least the host architecture. And even now the definitions of the structures aren’t completely bulletproof; I don’t think the X86Arch definitions of some structures are robust on a 64-bit host because of differences in structure field alignment between 32-bit and 64-bit, for instance. So that’s still something to fix in rr.

Templates handle the bulk of target-specific code in rr. There are a couple of places where we need to care about how the target implements mmap and other syscalls which aren’t amenable to templates (or, at least, we didn’t use them; it’s probably possible to (ab)use templates for these purposes), and so we have code like:

Task* t = ... if (has_mmap2_syscall(t->arch())) { // do something specifically for mmap2 } else { // do something with mmap }

Finally, various bits of rr’s main binary and its testsuite are written in assembly, so of course those needed to be carefully ported over.

That’s all the major source-code related work that needed to be done. I’ll leave the target-specific runtime work required for a future post.

x86-64 support for rr hasn’t been formally released, but the x86-64 support in the github repository is functional: x86-64 rr passes all the tests in rr’s test suite and is able to record and replay Firefox mochitests. I will note that it’s not nearly as fast as the x86 version; progress is being made in improving performance, but we’re not quite there yet.

If you’re interested in trying 64-bit rr out, you’ll find the build and installation instructions helpful, with one small modification: you need to add the command-line option -Dforce64bit=ON to any cmake invocations. Therefore, to build with Makefiles, one needs to do:

git clone https://github.com/mozilla/rr.git mkdir obj64 cd obj64 cmake -Dforce64bit=ON ../rr make -j4 make check

Once you’ve done that, the usage instructions will likely be helpful. Please try it out and report bugs if you find any!

Tags: rr, x86-64