To trace assembly instruction execution patterns

[darshantank]

Sir,

We would like to trace assembly instruction execution patterns ( RDTSC - CLFLUSH - RDTSC ) running on our guest VM from our host OS.

Is it possible to accomplish this task by using "simple-pt"?

May we pass process id of our VM to "sptcmd" command to collect trace from our VM?

[andikleen]

The process filter in sptcmd will not work for VMs because it would filter on the page tables in the guest. But you can trace globally or per CPU.

Also decoding would need access to the binaries and tracing metadata inside the guest.

[darshantank]

@ andikleen Sir, Thanks for your concern and response.

Can you assist me with the following?

I'm trying to capture Intel PT traces for my guest OS using the below command on my host. I'm getting the following error when running this command on my terminal.

" guest-kallsyms and guest-modules are the kallsyms and module files I copied from the guest onto my host. " I'm able to "cat /proc/kallsyms"

perf kvm --guest --guestkallsyms=guest-kallsyms --guestmodules=guest-modules record -e intel_pt// Couldn't record guest kernel [0]'s reference relocation symbol.

Following is the output of "sysctl -p" command on my machine. kernel.kptr_restrict = 0 kernel.perf_event_paranoid = -1

Operating System: Ubuntu 16.04.6 LTS Kernel: Linux 4.15.0-66-generic Architecture: x86-64

I would greatly appreciate it if you kindly give us some feedback and share your views.

[andikleen]

On Thu, Dec 19, 2019 at 11:24:24PM -0800, Darshan Tank wrote:

@ andikleen Sir, Thanks for your concern and response.

Can you assist me with the following?

I'm trying to capture Intel PT traces for my guest OS using the below command on my host. I'm getting the following error when running this command on my terminal.

" guest-kallsyms and guest-modules are the kallsyms and module files I copied from the guest onto my host. " I'm able to "cat /proc/kallsyms"

perf kvm --guest --guestkallsyms=guest-kallsyms --guestmodules=guest-modules record -e intel_pt// Couldn't record guest kernel [0]'s reference relocation symbol.

I don't think perf kvm supports intel_pt. Recording should work with normal perf record, but decoding may need some hacks.

Anyways, this is off topic here (not simple-pt). Try asking on [email protected]