collect memory trace (physical address) with DynamoRio

[Florian Longnos]

Hello Everyone,

I am new to dynamoRio, and dynamic binary instrumentation in general, and would like to use this tool to collect the memory trace of benchmarks I run on x86 machine.

So far I have successfully created my own client to generate traces of memory accesses, including issual cycle for load/store instructions, write/read type, and virtual address.

I would like to generate a memory trace with physical addresses, and finally have a memory trace similar to what the memory controller gets after the cache hierarchy.

For this, as specified in dynamoRio documentation, I translated virtual addresses to physical addresses using /proc/self/pagemap binary, and the function provided as attachment (virt2phys-function.c).

This function is inserted in my client, so you may not be able to run it by itself.

Anyway, when I run the client with the embedded translation function, for a simple 'ls' command, I get:

1/ the trace as attachment: instrace.ls.12229.0000.log

2/ the console output as attachment: console-output.txt

Problem 1: there are some page frame number which are not present in the pagemap file (as shown in the console output), and so i can only get the swap file number.

Question 1: How can I get the PFN for these pages as well?

Problem 2:  as you can see in the trace file provided, the lower bits of the virtual and physical addresses do not correspond...

Question 2: did I mess something up in the flow described above?

Problem 3: Besides, I would like to use the cache simulator to actually get the post cache memory trace, but it needs some work to write the 3 levels of cache.

And I am not sure where to provide the option values, as I always find a [option-name].getvalue() which seem to look for the host system's own configuration. Or am I mistaken?

Problem 4: Finally, the load/store trace is not memory access trace, so how to group accesses to have 64B memory accesses?

Thank you a lot for your help.

Florian

[Derek Bruening]

On Fri, Nov 18, 2016 at 11:09 PM, Florian Longnos <florian...@gmail.com> wrote:

Hello Everyone,

I am new to dynamoRio, and dynamic binary instrumentation in general, and would like to use this tool to collect the memory trace of benchmarks I run on x86 machine.

So far I have successfully created my own client to generate traces of memory accesses, including issual cycle for load/store instructions, write/read type, and virtual address.

I would like to generate a memory trace with physical addresses, and finally have a memory trace similar to what the memory controller gets after the cache hierarchy.

For this, as specified in dynamoRio documentation, I translated virtual addresses to physical addresses using /proc/self/pagemap binary, and the function provided as attachment (virt2phys-function.c).

This function is inserted in my client, so you may not be able to run it by itself.

Anyway, when I run the client with the embedded translation function, for a simple 'ls' command, I get:

1/ the trace as attachment: instrace.ls.12229.0000.log

2/ the console output as attachment: console-output.txt

Problem 1: there are some page frame number which are not present in the pagemap file (as shown in the console output), and so i can only get the swap file number.

Question 1: How can I get the PFN for these pages as well?

Problem 2:  as you can see in the trace file provided, the lower bits of the virtual and physical addresses do not correspond...

Question 2: did I mess something up in the flow described above?

The drcachesim provided tool already contains a virtual-to-physical feature using the pagemap file.  I do not recall any problems like you're describing.

 

Problem 3: Besides, I would like to use the cache simulator to actually get the post cache memory trace, but it needs some work to write the 3 levels of cache.

And I am not sure where to provide the option values, as I always find a [option-name].getvalue() which seem to look for the host system's own configuration. Or am I mistaken?

I'm not sure why you would think that involves the host.  It does not.  That is how a droption templated parameter value is accessed.

Problem 4: Finally, the load/store trace is not memory access trace, so how to group accesses to have 64B memory accesses?

Please rephrase: as written this question does not make sense to me. 

[Florian Longnos]

Thank you Derek for your reply.

I indeed saw that drchacesim is using the same virtual-to-physical feature, and my code is very similar, except i have no cache for the moment. I still the issue, but will update as soon as i solve it.

For my question 2, actually I made a mistake in my code, instead of printing the physical address, I was printing the value of pointer phy.

I can not find where the options for the cache simulator are specified. Maybe I need to look closer.

For problem 4, I meant: in the CPU trace, I get memory accesses at 1B, 4B or 8B granularity, but I want to collect a post cache trace where all memory accesses are at 64B granularity.

Different levels of cache also have a data granularity of 64B in general.

So do we just assume that every single load/store accesses will generate a 64B request to caches and memory? or do load/store accesses can be combined to generate a request to a same 64B cacheline?

[Florian Longnos]

Dear all,

I have worked on my client since then, and I have tried again using virtual to physical translation in it.

1/I have added a cache, for the translation, allowing to reduce accesses to the pagemap file. Since the clients are in C, I did something different from drcachesim, basically using an array of struct.

2/ After that I get the following error, while running the application and instrumenting it with dynamoRIO:

<Application /home/mainsd/wangkanwen/florian/mcf/exe/mcf_base.i386-m32-gcc42-nn (12517).  DynamoRIO Sample Client 'instrace' internal crash at PC 0x0000000072002ff4.  Please report this at http://dynamorio.org/issues.  Program aborted.
Received SIGSEGV at client library pc 0x0000000072002ff4 in thread 12517
Base: 0x0000000071000000
Registers:eax=0x0000000000001000 ebx=0x00007fec86a13420 ecx=0x0000000073148010 edx=0x00000000000f42ce
 esi=0x000000005261f8b8 edi=0x00000000000f42cf esp=0x00000000525f2c90 ebp=0x000000005261f8b8
 r8 =0x000000007fffffff r9 =0x00007fec87170fd0 r10=0x00007fec8781d6a0 r11=0x0000000000000029
 r12=0x000000005261f8b8 r13=0x0000000000001000 r14=0x00007fec8720a240 r15=0x0000000072003ad6
 eflags=0x0000000000010202
version 6.2.0, custom build
-no_dynamic_options -client_lib '/home/mainsd/wangkanwen/florian/dynamorio-master/build/api/bin/libinstrace_full_phy.so;0;' -code_api -stack_size 56K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct
0x000000005261f8b8 0x0000000000322e36
/home/mainsd/wangkanwen/florian/dynamorio-master/build/api/bin/libinstrace_full_phy.so=0x0000000072000000
/lib/x86_64-linux-gnu/libc.so.6=0x00007fec87460000
/lib64/ld-linux-x86-64.so.2=0x00007fec8723a000
/home/mainsd/wangkanwen/florian/dynamorio-master/build/ext/lib64/release/libdrutil.so=0x0000000075000000
/home/mainsd/wangkanwen/florian/dynamorio-master/build/ext/lib64/release/libdrx.so=0x0000000077000000

How to debug this error?

Thank you

[Qin Zhao]

the segfault seems happening in the client.

You can just debug it as normal program, i.e. use debug build and debugger to see the fault point.

xref wiki about how to attach the process and debug.

--
You received this message because you are subscribed to the Google Groups "DynamoRIO Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dynamorio-users+unsubscribe@googlegroups.com.
To post to this group, send email to dynamorio-users@googlegroups.com.
Visit this group at https://groups.google.com/group/dynamorio-users.
For more options, visit https://groups.google.com/d/optout.

[Derek Bruening]

On Wed, Dec 7, 2016 at 10:55 PM, Florian Longnos <florian...@gmail.com> wrote:

I can not find where the options for the cache simulator are specified. Maybe I need to look closer.

E.g.:

% bin64/drrun -t drcachesim -use_physical -L1I_size 64K -- ls