Function replay_bench

hail-fuzz/src/debugging/replay.rs:144–215

(mut vm: Vm, mut target: CortexmMultiStream, trials: u64)

}

fn replay_bench(mut vm: Vm, mut target: CortexmMultiStream, trials: u64) -> anyhow::Result<()> {
    let core_ids = core_affinity::get_core_ids().unwrap_or(vec![]);
    if let Some(core_id) = core_ids.first() {
        eprintln!("pinning active thread to core: {core_id:?}");
        core_affinity::set_for_current(*core_id);
    }

    let mut snapshot = vm.snapshot();
    let mut cursor_snapshot = target.get_mmio_handler(&mut vm).unwrap().source.snapshot_cursors();

    // Perform a dry run of the input to warm up the VM.
    let exit = target.run(&mut vm);
    vm.recompile();

    // Dump JIT function ID -> guest address mapping for analysis.
    if let Err(e) = vm.jit.dump_jit_mapping("jit_table.txt".as_ref(), vm.env.debug_info().unwrap())
    {
        tracing::warn!("Failed to dump JIT table: {e}")
    }

    let mut expected_icount = vm.cpu.icount();
    eprintln!("[icicle] exited with: {exit:?} (icount = {expected_icount})");

    // We allow replaying from part way through the input if provided from an environment variable.
    if let Some(bp) =
        std::env::var("REPLAY_FROM").ok().and_then(|addr| parse_addr_or_symbol(&addr, &mut vm))
    {
        vm.restore(&snapshot);
        target.get_mmio_handler(&mut vm).unwrap().source.restore_cursors(&cursor_snapshot);

        vm.add_breakpoint(bp);
        let exit = target.run(&mut vm);
        let pc = vm.cpu.read_pc();
        anyhow::ensure!(
            matches!(exit, Ok(VmExit::Breakpoint)) && pc == bp,
            "Failed to hit breakpoint at: {bp:#x} when `REPLAY_FROM` is set (exited with: {exit:?} at: {pc:#x})",
        );
        vm.remove_breakpoint(bp);

        eprintln!("[icicle] hit break: pc={pc:#x} {exit:?} (icount = {})", vm.cpu.icount());
        expected_icount += 1;

        snapshot = vm.snapshot();
        cursor_snapshot = target.get_mmio_handler(&mut vm).unwrap().source.snapshot_cursors();
    }

    let start = std::time::Instant::now();

    for _ in 0..trials {
        vm.restore(&snapshot);
        // Restoring currently triggers a lookup flush, but we know the code will not change between
        // execs so we can skip it here.
        vm.cpu.mem.mapping_changed = false;
        target.get_mmio_handler(&mut vm).unwrap().source.restore_cursors(&cursor_snapshot);
        let _ = target.run(&mut vm);

        // Ensure execution doesn't diverge.
        let icount = vm.cpu.icount();