Skip to content
Memory access tracing QEMU
C C++ Haxe Python Perl Assembly Other
Branch: mtrace
Clone or download
Austin Clements
Austin Clements README: Add config for testing with disk-based file systems
This adds CONFIG_DEVTMPFS=y and CONFIG_BLK_DEV_RAM=y to the
configuration suggested by the README, which make it possible to
easily mount and use ramdisks on an mtrace kernel.

This is used by Commuter's par-mtrace.py script to analyze sharing in
disk-based file systems.
Latest commit 3e66d0b Aug 14, 2014
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
QMP spice: connection events. Dec 9, 2010
audio pulseaudio: tweak config Jan 25, 2011
block qed: Fix consistency check on 32-bit hosts May 3, 2011
bsd-user bsd-user: Fix possible memory leaks and wrong realloc call Jan 17, 2011
darwin-user darwin-user: Use GCC_FMT_ATTR (format checking) Dec 4, 2010
default-configs config: add ahci for pci capable machines Dec 17, 2010
docs Add boot index documentation. Feb 1, 2011
fpu softfloat: fix floatx80_is_{quiet,signaling}_nan() Jan 20, 2011
fsdev Delete useless 'extern' qualifiers for functions Jan 23, 2011
gdb-xml gdb-xml: fix hacks in powerpc register numbering Jul 12, 2009
hw virtio-blk: fail unaligned requests May 3, 2011
linux-user linux-user: Fix possible realloc memory leak Feb 9, 2011
mtrace-tools mscan: More permissive parsing for addr2line May 10, 2014
net vhost: force vhost off for non-MSI guests Feb 1, 2011
pc-bios Update SeaBIOS to 0.6.1.2 Feb 1, 2011
roms Update SeaBIOS to 0.6.1.2 Feb 1, 2011
scripts New trace-event backend: stderr Jan 29, 2011
slirp Fix build from previous commit Feb 14, 2011
sysconfigs/target Add cpu model configuration support.. Feb 22, 2010
target-alpha softfloat: Rename float*_is_nan() functions to float*_is_quiet_nan() Jan 2, 2011
target-arm Set the right overflow bit for neon 32 and 64 bit saturating add/sub. Feb 4, 2011
target-cris cris: Replace tcg branch sequence with setcond Jan 25, 2011
target-i386 target-i386: Make pause yield the current vcpu. Apr 26, 2012
target-m68k softfloat: Rename float*_is_nan() functions to float*_is_quiet_nan() Jan 2, 2011
target-microblaze microblaze: cleanup helper_addkc Jan 23, 2011
target-mips target-mips: fix save_cpu_state() calls Jan 24, 2011
target-ppc Merge remote branch 'qemu-kvm/uq/master' into staging Feb 1, 2011
target-s390x Merge remote branch 'qemu-kvm/uq/master' into staging Feb 1, 2011
target-sh4 target-sh4: fix negc Feb 4, 2011
target-sparc SPARC: Fix Leon3 cache control Feb 1, 2011
tcg Record byte size of every memory access Apr 17, 2012
tests Delete useless 'extern' qualifiers for functions Jan 23, 2011
ui vnc: tight: Fix crash after 2GB of output Apr 9, 2011
.gitignore Add a DTrace tracing backend targetted for SystemTAP compatability Nov 21, 2010
.gitmodules use absolute URLs for .gitmodules Mar 6, 2010
CODING_STYLE checkpatch: adjust to QEMUisms Jan 20, 2011
COPYING
COPYING.LIB Update FSF address in GPL/LGPL boilerplate Jan 4, 2009
Changelog Update version and changelog to sync with stable branch Dec 19, 2009
HACKING HACKING: add rules for printf-like functions Sep 10, 2010
LICENSE Add missing newline at the end of file Dec 14, 2008
MAINTAINERS spice: MAINTAINERS update Jan 24, 2011
Makefile Add scripts directory Jan 20, 2011
Makefile.dis Compile disassemblers only once Mar 21, 2010
Makefile.hw Clean libhw subdirs as well May 22, 2010
Makefile.objs ahci: split ICH9 from core Feb 7, 2011
Makefile.target need -lrt to build on recent ubuntu Jul 27, 2013
Makefile.user Use vpath directive Jan 8, 2010
README Add missing newline at the end of file Dec 14, 2008
README.md README: Add config for testing with disk-based file systems Aug 13, 2014
README.mosbench Shuffle around READMEs Oct 8, 2013
TODO Update Dec 4, 2008
VERSION Version 0.14.1 May 4, 2011
a.out.h Remove unnecessary trailing newlines Dec 13, 2008
acl.c Fix sys-queue.h conflict for good Sep 12, 2009
acl.h Fix sys-queue.h conflict for good Sep 12, 2009
aes.c Include assert.h from qemu-common.h May 13, 2009
aes.h AES crypto support Aug 1, 2004
aio.c block: fix aio_flush segfaults for read-only protocols (e.g. curl) May 21, 2010
alpha-dis.c *-dis: Replace fprintf_ftype by fprintf_function (format checking) Dec 4, 2010
alpha.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
arch_init.c audio: consolidate audio_init() Jan 25, 2011
arch_init.h audio: consolidate audio_init() Jan 25, 2011
arm-dis.c arm-dis: Include opcode hex when doing disassembly Jan 12, 2011
arm-semi.c Fix commandline handling for ARM semihosted executables Jan 7, 2011
arm.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
async.c Introduce contexts for asynchronous callbacks Oct 27, 2009
balloon.c trace: Trace entry point of balloon request handler Sep 9, 2010
balloon.h move balloon handling to balloon.c Apr 9, 2010
block-migration.c block: enable in_use flag Feb 7, 2011
block-migration.h block migration: Report progress also via info migration Dec 3, 2009
block.c Do not delete BlockDriverState when deleting the drive May 3, 2011
block.h Do not delete BlockDriverState when deleting the drive May 3, 2011
block_int.h Add flag to indicate external users to block device Feb 7, 2011
blockdev.c Do not delete BlockDriverState when deleting the drive May 3, 2011
blockdev.h blockdev: add refcount to DriveInfo Feb 7, 2011
bswap.h bswap.h: add cpu_to_be64wu() Jan 10, 2011
bt-host.c bt: remove dead assignments, spotted by clang analyzer Apr 25, 2010
bt-host.h Clean build: Add bt-host.h Mar 10, 2009
bt-vhci.c Update to a hopefully more future proof FSF address Jul 16, 2009
buffered_file.c migration: allow rate > 4g Dec 2, 2010
buffered_file.h Introduce a buffered file wrapper for QEMUFile Oct 13, 2008
cache-utils.c Remove trailing whitespace Oct 31, 2010
cache-utils.h Delete useless 'extern' qualifiers for functions Jan 23, 2011
check-qdict.c check-qdict: Introduce test for the new iteration API Jul 1, 2010
check-qfloat.c Fix qtypes' licenses May 19, 2010
check-qint.c Fix qtypes' licenses May 19, 2010
check-qjson.c Silence compiler warning in json test case Oct 22, 2010
check-qlist.c Fix qtypes' licenses May 19, 2010
check-qstring.c Fix qtypes' licenses May 19, 2010
cmd.c qemu-io: check registered fds in command_loop() Jun 22, 2010
cmd.h Delete useless 'extern' qualifiers for functions Jan 23, 2011
compatfd.c signalfd compatibility Oct 20, 2010
compatfd.h signalfd compatibility Oct 20, 2010
config.h Makefile dependencies for device configs Nov 22, 2009
configure rbd: don't link with -lcrypto Mar 29, 2011
console.c remove text_console_opts Feb 1, 2011
console.h vnc: Fix password expiration through 'change vnc ""' (v2) Feb 1, 2011
cpu-all.h Record byte size of every memory access Apr 17, 2012
cpu-common.h exec: introduce endianness swapped mmio Dec 11, 2010
cpu-defs.h move stop/stopped CPU_COMMON fields after area zeroed by reset May 11, 2010
cpu-exec.c New mtrace timing code. Jul 13, 2011
cpus.c New mtrace timing code. Jul 13, 2011
cpus.h target-xxx: Use fprintf_function (format checking) Oct 30, 2010
cris-dis.c cris: Support disassembly of crisv10 Jan 10, 2011
cursor.c cursor: add cursor functions. May 24, 2010
cursor_hidden.xpm cursor: add cursor functions. May 24, 2010
cursor_left_ptr.xpm cursor: add cursor functions. May 24, 2010
cutils.c QCOW2: bug fix - read base image beyond its size Feb 11, 2011
def-helper.h tcg: Optionally sign-extend 32-bit arguments for 64-bit hosts. Jun 16, 2010
device_tree.c Fix device tree compile broken by ca20cf3 Sep 23, 2009
device_tree.h Wean device tree code off phys_ram_base. Apr 10, 2009
dis-asm.h Delete useless 'extern' qualifiers for functions Jan 23, 2011
disas.c disas: remove opcode printing on ARM hosts Jan 12, 2011
disas.h Remove special handling of system include files (no longer needed) Oct 22, 2010
dma-helpers.c Revert "Get rid of _t suffix" Oct 1, 2009
dma.h Revert "Get rid of _t suffix" Oct 1, 2009
dyngen-exec.h Remove special handling of system include files (no longer needed) Oct 22, 2010
elf.h Add more DT_* and AT_* constants to qemu's copy of elf.h. Jul 29, 2010
envlist.c Fix sys-queue.h conflict for good Sep 12, 2009
envlist.h Delete useless 'extern' qualifiers for functions Jan 23, 2011
exec-all.h Delete useless 'extern' qualifiers for functions Jan 23, 2011
exec.c Lazily allocate cache line tracking buffers when recording gets enabled Mar 29, 2012
gdbstub.c gdbstub: Close connection in gdb_exit Jan 16, 2011
gdbstub.h Add scripts directory Jan 20, 2011
gen-icount.h Compile qemu-timer only once Mar 29, 2010
hmp-commands.hx Change snapshot_blkdev hmp to use correct argument type for device Feb 11, 2011
host-utils.c user: compile host-utils.c only once Aug 16, 2009
host-utils.h target-alpha: Fix generic ctz64. Dec 17, 2009
hpet.h Add a local copy of hpet.h. Sep 16, 2007
hppa-dis.c tcg-hppa: Fix const errors in hppa-dis.c Mar 23, 2010
hppa.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
i386-dis.c i386-dis: Fix unused return value, spotted by clang Apr 18, 2010
i386.ld Fix missing symbols in .rel/.rela.plt sections Feb 6, 2010
ia64-dis.c Fix %lld or %llx printf format use May 22, 2010
ia64.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
input.c un-register kbd driver in case of USB kbd unplug. Jun 14, 2010
ioport-user.c Revert "Get rid of _t suffix" Oct 1, 2009
ioport.c Type-safe ioport callbacks Nov 21, 2010
ioport.h Type-safe ioport callbacks Nov 21, 2010
iorange.h Type-safe ioport callbacks Nov 21, 2010
iov.c iov: Move from hw/ to topdir May 10, 2010
iov.h iov: Move from hw/ to topdir May 10, 2010
json-lexer.c remove unnecessary lookaheads Jun 11, 2010
json-lexer.h Add a lexer for JSON Nov 17, 2009
json-parser.c Use GCC_FMT_ATTR (format checking) Oct 3, 2010
json-parser.h Add a JSON parser Nov 17, 2009
json-streamer.c json-streamer: Don't use qdict_put_obj() Jun 11, 2010
json-streamer.h Add a JSON message boundary identifier Nov 17, 2009
kvm-all.c Merge remote branch 'qemu-kvm/uq/master' into staging Feb 1, 2011
kvm-stub.c kvm: Drop smp_cpus argument from init functions Jan 23, 2011
kvm.h kvm: Consolidate must-have capability checks Jan 23, 2011
libfdt_env.h Update to a hopefully more future proof FSF address Jul 16, 2009
linux-aio.c linux-aio: Fix typo in read() EINTR check Apr 23, 2010
m68k-dis.c *-dis: Replace fprintf_ftype by fprintf_function (format checking) Dec 4, 2010
m68k-semi.c Move qemu_gettimeofday() to OS specific files Oct 30, 2010
m68k.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
microblaze-dis.c *-dis: Replace fprintf_ftype by fprintf_function (format checking) Dec 4, 2010
migration-exec.c Factorize common migration incoming code Jun 22, 2010
migration-fd.c Factorize common migration incoming code Jun 22, 2010
migration-tcp.c Close socket file descriptor when qemu_accept fails Jul 25, 2010
migration-unix.c Factorize common migration incoming code Jun 22, 2010
migration.c add migration state change notifiers Jan 24, 2011
migration.h add migration state change notifiers Jan 24, 2011
mips-dis.c *-dis: Replace fprintf_ftype by fprintf_function (format checking) Dec 4, 2010
mips.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
module.c Fix sys-queue.h conflict for good Sep 12, 2009
module.h Convert machine registration to use module init functions May 21, 2009
monitor.c add qemu_chr_set_echo Feb 1, 2011
monitor.h spice: connection events. Dec 9, 2010
mtrace-magic.h simple checker for missing RCU read epochs Feb 24, 2013
mtrace.c Fix warnings about some pointer<->integer casts on 32-bit Apr 16, 2014
mtrace.h another macosx fix Mar 31, 2012
nbd.c nbd: Haiku has _IO() in its BSD compatibility layer Oct 3, 2010
nbd.h Merge remote branch 'kwolf/for-anthony' into staging Sep 8, 2010
net-checksum.c Update to a hopefully more future proof FSF address Jul 16, 2009
net.c net: Add the missing option declaration of "vhostforce" Mar 6, 2011
net.h Add bootindex parameter to net/block/fd device Dec 11, 2010
notify.c Add support for generic notifier lists Mar 19, 2010
notify.h Add support for generic notifier lists Mar 19, 2010
os-posix.c Separate qemu_pidfile() into OS specific versions Oct 30, 2010
os-win32.c Separate qemu_pidfile() into OS specific versions Oct 30, 2010
osdep.c Remove unncessary includes Oct 30, 2010
osdep.h Move qemu_gettimeofday() to OS specific files Oct 30, 2010
oslib-posix.c virtio-9p: fix build on !CONFIG_UTIMENSAT Dec 3, 2010
oslib-win32.c Consolidate oom_check() functions Oct 30, 2010
path.c path.c fix warning with _FORTIFY_SOURCE Dec 25, 2009
pci-ids.txt List virtio console device in pci-ids.txt Jan 24, 2009
pflib.c add pflib: PixelFormat conversion library. Sep 21, 2010
pflib.h add pflib: PixelFormat conversion library. Sep 21, 2010
poison.h move targphys.h and hw/poison.h inclusion to cpu-common.h Apr 9, 2010
posix-aio-compat.c Move qemu_gettimeofday() to OS specific files Oct 30, 2010
ppc-dis.c Work around OpenSolaris sys/regset.h namespace pollution Sep 12, 2009
ppc.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
ppc64.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
qbool.c Fix qtypes' licenses May 19, 2010
qbool.h Add a QBool type Nov 17, 2009
qdict-test-data.txt Introduce QDict test data file Sep 4, 2009
qdict.c QDict: Introduce qdict_get_try_bool() Jul 1, 2010
qdict.h QDict: Introduce qdict_get_try_bool() Jul 1, 2010
qemu-aio.h Add qemu_aio_process_queue() Oct 27, 2009
qemu-barrier.h Introduce proper compiler barrier Jul 22, 2010
qemu-char.c qemu-char: Check for missing backend name Feb 20, 2011
qemu-char.h add qemu_chr_set_echo Feb 1, 2011
qemu-common.h QCOW2: bug fix - read base image beyond its size Feb 11, 2011
qemu-config.c spice: add chardev (v5) Jan 24, 2011
qemu-config.h spice: core bits Sep 21, 2010
qemu-doc.texi Documentation: add Sheepdog disk images Feb 7, 2011
qemu-error.c error: Move qerror_report() from qemu-error.[ch] to qerror.[ch] Mar 27, 2010
qemu-error.h Use GCC_FMT_ATTR (format checking) Oct 3, 2010
qemu-img-cmds.hx Copy snapshots out of QCOW2 disk Oct 22, 2010
qemu-img.c qemu-img: Improve error messages for failed bdrv_open Feb 11, 2011
qemu-img.texi Documentation: Add qemu-img check/rebase Jan 24, 2011
qemu-io.c qemu-io: Fix discard command Jan 31, 2011
qemu-lock.h Remove unused spin_trylock() function Dec 4, 2010
qemu-log.h Define macros that will become the new logging API (Eduardo Habkost) Jan 15, 2009
qemu-malloc.c Add missing tracing to qemu_mallocz() Dec 14, 2010
qemu-nbd.c Remove NULL checks for bdrv_new return value Dec 17, 2010
qemu-nbd.texi qemu-nbd: Fix wrong description in qemu-nbd.texi Mar 6, 2010
qemu-objects.h Fix qtypes' licenses May 19, 2010
qemu-option.c qemu-option: Fix parse_option_parameters() documentation typo Dec 14, 2010
qemu-option.h error: New qemu_opts_loc_restore() Jul 6, 2010
qemu-options.h Introduce OS specific cmdline argument handling and move SMB arg to o… Jun 12, 2010
qemu-options.hx Fix spacing Jun 2, 2011
qemu-os-posix.h virtio-9p: fix build on !CONFIG_UTIMENSAT Dec 3, 2010
qemu-os-win32.h Move qemu_gettimeofday() to OS specific files Oct 30, 2010
qemu-queue.h Import a simple queue implementation from NetBSD Dec 3, 2009
qemu-sockets.c qemu-sockets: avoid strlen of NULL pointer May 18, 2010
qemu-tech.texi qemu-tech: Spelling fixes Jan 9, 2011
qemu-thread.c qemu-thread: add qemu_mutex/cond_destroy and qemu_mutex_exit Jul 26, 2010
qemu-thread.h qemu-thread: add qemu_mutex/cond_destroy and qemu_mutex_exit Jul 26, 2010
qemu-timer-common.c Add OpenBSD to ifdef list since it has CLOCK_MONOTONIC. Dec 21, 2010
qemu-timer.c qemu-timer: Fix compilation of new timer code for w32, w64 Feb 8, 2011
qemu-timer.h Mov muldiv64 to qemu-common.h (Thus unbreaking gus) Oct 29, 2010
qemu-tool.c Move qemu_gettimeofday() to OS specific files Oct 30, 2010
qemu-x509.h move x509 file name defines to qemu-x509.h Mar 8, 2010
qemu.sasl Add SASL authentication support ("Daniel P. Berrange") Mar 6, 2009
qemu_socket.h Fix OpenBSD build Sep 22, 2010
qerror.c qerror: Add QERR_UNKNOWN_BLOCK_FORMAT_FEATURE Feb 11, 2011
qerror.h qerror: Add QERR_UNKNOWN_BLOCK_FORMAT_FEATURE Feb 11, 2011
qfloat.c Fix qtypes' licenses May 19, 2010
qfloat.h Add a QFloat datatype Nov 17, 2009
qint.c Fix qtypes' licenses May 19, 2010
qint.h Fix qtypes' licenses May 19, 2010
qjson.c Add support for JSON pretty printing Oct 1, 2010
qjson.h Merge remote branch 'qmp/for-anthony' into staging Oct 5, 2010
qlist.c Fix qtypes' licenses May 19, 2010
qlist.h Fix qtypes' licenses May 19, 2010
qmp-commands.hx Merge remote branch 'spice/spice.v29.pull' into staging Feb 1, 2011
qobject.h Fix qtypes' licenses May 19, 2010
qstring.c Fix qtypes' licenses May 19, 2010
qstring.h Fix qtypes' licenses May 19, 2010
range.h Introduce range.h Sep 18, 2010
readline.c cope with printf macro definition in readline.c Feb 8, 2010
readline.h monitor: Improve mux'ed console experience (Jan Kiszka) Mar 5, 2009
rules.mak Add scripts directory Jan 20, 2011
rwhandler.c Make simple io mem handler endian aware Dec 11, 2010
rwhandler.h Make simple io mem handler endian aware Dec 11, 2010
s390-dis.c s390: Disassemble some general-instruction-extension insns. Jun 9, 2010
s390.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
savevm.c savevm: fix corruption in vmstate_subsection_load(). Feb 4, 2011
sh4-dis.c *-dis: Replace fprintf_ftype by fprintf_function (format checking) Dec 4, 2010
simpletrace.c qemu-timer: move commonly used timer code to qemu-timer-common Oct 23, 2010
simpletrace.h trace: Use fprintf_function (format checking) Nov 21, 2010
softmmu-semi.h Suppress gcc 4.x -Wpointer-sign (included in -Wall) warnings Sep 20, 2008
softmmu_defs.h [trace] do a more thorough job of logging stores, even the funny Oct 14, 2010
softmmu_exec.h sparc64: handle asi referencing nucleus and secondary MMU contexts May 6, 2010
softmmu_header.h sparc64: fix 32bit load sign extension Jun 2, 2010
softmmu_template.h Record byte size of every memory access Apr 17, 2012
sparc-dis.c sparc64: more ultrasparc asi extensions for disassembler May 6, 2010
sparc.ld Fix sparc.ld Sep 13, 2009
sparc64.ld set SEARCH_PATH for the linker script from output of ld --verbose -v Jul 27, 2009
spice-qemu-char.c spice: add chardev (v5) Jan 24, 2011
sysemu.h audio: consolidate audio_init() Jan 25, 2011
targphys.h Split TLB addend and target_phys_addr_t Apr 4, 2010
tcg-runtime.c tcg: add div/rem 32-bit helpers Mar 14, 2010
thunk.c Update to a hopefully more future proof FSF address Jul 16, 2009
thunk.h Update to a hopefully more future proof FSF address Jul 16, 2009
trace-events Merge remote branch 'spice/spice.v29.pull' into staging Feb 1, 2011
translate-all.c tcg: get rid of copy_size in TCGOpDef Jun 9, 2010
uboot_image.h Revert "Get rid of _t suffix" Oct 1, 2009
usb-bsd.c usb-bsd: fix a file descriptor leak Jan 9, 2011
usb-linux.c usb-linux: Get the active configuration from sysfs rather then asking… Nov 16, 2010
usb-stub.c monitor: Rework API (Jan Kiszka) Mar 5, 2009
version.rc mingw: add version information to the executables Sep 26, 2010
vgafont.h Some little fixes on QEMU Sep 6, 2008
vl.c Merge branch 'master' into mtrace May 26, 2011
x86_64.ld Fix missing symbols in .rel/.rela.plt sections Feb 6, 2010

README.md

mtrace is a version of QEMU modified to log memory accesses and other system events to help analyze and understand the memory access patterns and cache line behavior of operating system-level code.

mtrace includes mscan (in mtrace-tools/), which processes these log files and implements a suite of analyses.

N.B.: Don't confuse QEMU's 'trace' features with mtrace.

Dependencies

mscan depends on libelfin, which can be found at

git clone https://github.com/aclements/libelfin.git

We recommend cloning and building libelfin next to the mtrace repository, as mtrace will find it automatically. Alternatively, you can make install libelfin to install it system-wide.

Building

Building mtrace is just like building QEMU. We recommend a minimal configuration, optimized for testing OS code:

./configure --prefix=PREFIX \
            --target-list="x86_64-softmmu" \
            --disable-kvm \
            --audio-card-list="" \
            --disable-vnc-jpeg \
            --disable-vnc-png \
            --disable-strip
make

Then, to build mscan

cd mtrace-tools && make

It's not necessary to make install either mtrace or mscan, though it may be a good idea to add x86_64-softmmu/ and mtrace-tools/ to your $PATH:

PATH=$PWD/x86_64-softmmu:$PWD/mtrace-tools:$PATH

Running a Linux kernel in mtrace

Our mtrace-enabled version of Linux can be found at

git clone https://github.com/aclements/linux-mtrace.git

We recommend configuring and building the kernel as follows. The first three configuration options are required to run the kernel in mtrace. The rest just disables large features that are likely to be unnecessary.

make defconfig
# Enable DWARF info for mscan
echo CONFIG_DEBUG_INFO=y >> .config
# Reduce number of CPUs
echo CONFIG_NR_CPUS=16 >> .config
# Avoid live-lock with timer interrupts
echo CONFIG_HZ_100=y >> .config
# Enable devtmpfs
echo CONFIG_DEVTMPFS=y >> .config
# Enable RAM disk (for testing fsync, etc)
echo CONFIG_BLK_DEV_RAM=y >> .config
# Shrink the kernel
echo CONFIG_PARTITION_ADVANCED=n >> .config
echo CONFIG_SUSPEND=n >> .config
echo CONFIG_HIBERNATION=n >> .config
echo CONFIG_CPU_FREQ=n >> .config
echo CONFIG_YENTA=n >> .config
echo CONFIG_IPV6=n >> .config
echo CONFIG_NETFILTER=n >> .config
echo CONFIG_NET_SCHED=n >> .config
echo CONFIG_ETHERNET=n >> .config
echo CONFIG_HAMRADIO=n >> .config
echo CONFIG_CFG80211=n >> .config
echo CONFIG_AGP=n >> .config
echo CONFIG_DRM=n >> .config
echo CONFIG_FB=n >> .config
echo CONFIG_SOUND=n >> .config
echo CONFIG_USB=n >> .config
echo CONFIG_I2C=n >> .config
echo CONFIG_HID=n >> .config
echo CONFIG_SECURITY_SELINUX=n >> .config
make olddefconfig

make

At this point, you can run this kernel in mtrace with

qemu-system-x86_64 -mtrace-enable -mtrace-file mtrace.out \
  -kernel arch/x86_64/boot/bzImage -nographic -append console=ttyS0

It won't get very far without a disk or an initramfs to boot from, but you should get an mtrace.out with some basic log records in it. Try m2text mtrace.out to get a feel for the log file.

See qemu-system-x86_64 -help for additional options that control mtrace.

Running MOSBENCH in mtrace

See README.mosbench.

QEMU calls

Guest code can call into qemu to turn mtracing on or off, communicate object instances and types, etc. See mtrace-magic.h for the current API and the linux-mtrace repository for example usage. There are also some examples in MOSBENCH under micro/.

Cache line tracking

When cache line tracking is enabled via a hypercall, memory accesses are reported only when an access might cause inter-core traffic. Specifically:

  • mtrace records a read if its cache line was written to by another core since that last read from the reading core.
  • mtrace records a write if its cache line that was read from or written to by another core since the last write from the writing core.

There is no other cache simulation (i.e. caches are fully associative and have infinite capacity).

Implementation choices

If we don't want the virtual address, we could modify the macros in cpu-all.h (stl_p, ...). We would still need the changes to the x86 code gen in tcg/i386/tcg_target.c.

To do

Minor things

  • Move all mtrace* decls. to mtrace.h
  • Report progress in mscan
  • Connect user-space and syscall stacks so we can backtrace across the user/kernel boundary
  • Many analyses could take a granularity option to control whether sharing is byte-level or line-level

mtrace is huge, full of cruft, and built on an ancient version of QEMU. We should lift out the parts we still use into a new version of mtrace. mtrace could be a great platform, but it's too much of a mess right now.

Have a single library for reading mtrace logs. Currently we have separate log decoders at least in mscan and m2text, which means m2text is consistently unable to dump recent logs. This separation also means we don't have a way to print log entries in mscan. m2text should be a trivial shell around printers in the common log library.

We currently hard-code several memory filtering policies, but it seems like every new analysis needs a new filtering policy. Make them loadable .so's that can be specified on the QEMU command line.

Instead of having one giant mscan binary that we have to expand for each new analysis, make each analysis its own binary and put common code (like context tracking) in a libmscan.

Make mtrace require fewer or no kernel hooks:

  • Eliminate stack-switching hypercalls. We can detect stack switches automatically based on CR3 and current stack pointer, plus starting a new call stack when an interrupt occurs and terminating that call stack when its stack pointer goes above where the interrupt frame was pushed (while remaining in the same stack region). These hypercalls are also really hard to add to all of the right places.

  • Move allocation labeling into an honest-to-goodness module that's more easily portable across Linux versions. This module could also help report information about stacks (e.g., when a new process stack is created, it could report its extend and information like process name).

    • Alternatively, mtrace could use kernel debug info to set QEMU breakpoints on the allocation function we care about. This would require a little kernel-specific information, but would be less cumbersome than code modification and would support a wide range of kernels and kernel versions. (Compared to stack-switching hypercalls, these are pretty easy to add, so this may be less valuable.)
You can’t perform that action at this time.