[Qemu-devel] Memory Traces for System Simulation

[Luis Useche <luis@cs.fiu.edu>]

Hi Guys,

I have been trying the last two days to find the correct places in the
qemu code to trace the memory accesses in the running system. The qemu
code is somewhat confusing and there are plenty of places that look like
the correct trace point.

I know that there exist plenty of threads about this matter in the list
but non of them solve my problem.

Some people suggested to use Argos (http://www.few.vu.nl/argos/) to get
this information. There are two problems with this: (1) There is no clear
documentation on how to do this in Argos (2) The code seems outdated and
does not compile in systems with gcc>=4.

There is also a patch for qemu 0.8 but it does not apply anymore.
http://www.csl.cornell.edu/~vince/projects/qemu-trace/old/.

At the moment, I am instrumenting several functions in exec.c as my trace
points:
	ldl_phys
	ldq_phys
	ldup_phys
	lduw_phys
	stl_phys_notdirty
	stq_phys_notdirty
	stl_phys
	stb_phys
	stw_phys
	stq_phys

I would really appreciate any suggestion you have in order to solve my
problem. If you have any insights in the solutions I explained above I
would be very thankful.

Given that many people seems to be having the same problem than I, it
would be nice to have an actual framework that add this functionality to
qemu. I can offer myself to do that as long as I have enough help.

As a parallel question: Does qemu simulate CPU cache? i.e. There is always
memory access even when this would not happen in a real system due to CPU
cache?

Thanks in advance,
-- 
Luis Useche <luis@cs.fiu.edu>
Ph.D. Student
Florida International University