Linux Kernel Module Cheat

23.9.8. gem5 tracing

gem5 provides also provides a tracing mechanism documented at: http://www.gem5.org/Trace_Based_Debugging:

./run --arch aarch64 --eval 'm5 exit' --emulator gem5 --trace ExecAll
less "$(./getvar --arch aarch64 run_dir)/trace.txt"

Our wrapper just forwards the options to the --debug-flags gem5 option.

Keep in mind however that the disassembly is very broken in several places as of 2019q2, so you can’t always trust it.

Output the trace to stdout instead of a file:

./run \
  --arch aarch64 \
  --emulator gem5 \
  --eval 'm5 exit' \
  --trace ExecAll \
  --trace-stdout \
;

We also have a shortcut for --trace ExecAll -trace-stdout with --trace-insts-stdout

./run \
  --arch aarch64 \
  --emulator gem5 \
  --eval 'm5 exit' \
  --trace-insts-stdout \
;

Be warned, the trace is humongous, at 16Gb.

This would produce a lot of output however, so you will likely not want that when tracing a Linux kernel boot instructions. But it can be very convenient for smaller traces such as Baremetal.

List all available debug flags:

./run --arch aarch64 --gem5-exe-args='--debug-help' --emulator gem5

but to understand most of them you have to look at the source code:

less "$(./getvar gem5_source_dir)/src/cpu/SConscript"
less "$(./getvar gem5_source_dir)/src/cpu/exetrace.cc"

The most important trace flags to know about are:

ExecAll
Faults: CPU exceptions / interrupts, see an example at: ARM SVC instruction
Registers
SyscallBase, SyscallVerbose

Trace internals are discussed at: gem5 trace internals.

As can be seen on the Sconstruct, Exec is just an alias that enables a set of flags.

We can make the trace smaller by naming the trace file as trace.txt.gz, which enables GZIP compression, but that is not currently exposed on our scripts, since you usually just need something human readable to work on.

Enabling tracing made the runtime about 4x slower on the 2017 Lenovo ThinkPad P51, with or without .gz compression.

Trace the source lines just like for QEMU with:

./trace-boot --arch aarch64 --emulator gem5
./trace2line --arch aarch64 --emulator gem5
less "$(./getvar --arch aarch64 run_dir)/trace-lines.txt"

TODO: 7452d399290c9c1fc6366cdad129ef442f323564 ./trace2line this is too slow and takes hours. QEMU’s processing of 170k events takes 7 seconds. gem5’s processing is analogous, but there are 140M events, so it should take 7000 seconds ~ 2 hours which seems consistent with what I observe, so maybe there is no way to speed this up… The workaround is to just use gem5’s ExecSymbol to get function granularity, and then GDB individually if line detail is needed?