# Linux Kernel Module Cheat

#### 23.9.8. gem5 tracing

gem5 provides also provides a tracing mechanism documented at: http://www.gem5.org/Trace_Based_Debugging:

    ./run --arch aarch64 --eval 'm5 exit' --emulator gem5 --trace ExecAll
    less "$(./getvar --arch aarch64 run_dir)/trace.txt"

Our wrapper just forwards the options to the `--debug-flags` gem5 option.

Keep in mind however that the disassembly is very broken in several places as of 2019q2, so you can’t always trust it.

Output the trace to stdout instead of a file:

    ./run \
      --arch aarch64 \
      --emulator gem5 \
      --eval 'm5 exit' \
      --trace ExecAll \
      --trace-stdout \
    ;

We also have a shortcut for `--trace ExecAll -trace-stdout` with `--trace-insts-stdout`

    ./run \
      --arch aarch64 \
      --emulator gem5 \
      --eval 'm5 exit' \
      --trace-insts-stdout \
    ;

Be warned, the trace is humongous, at 16Gb.

This would produce a lot of output however, so you will likely not want that when tracing a Linux kernel boot instructions. But it can be very convenient for smaller traces such as Baremetal.

List all available debug flags:

    ./run --arch aarch64 --gem5-exe-args='--debug-help' --emulator gem5

but to understand most of them you have to look at the source code:

    less "$(./getvar gem5_source_dir)/src/cpu/SConscript"
    less "$(./getvar gem5_source_dir)/src/cpu/exetrace.cc"

The most important trace flags to know about are:

- `ExecAll`

- `Faults`: CPU exceptions / interrupts, see an example at: ARM SVC instruction

- `Registers`

- `SyscallBase`, `SyscallVerbose`

Trace internals are discussed at: gem5 trace internals.

As can be seen on the `Sconstruct`, `Exec` is just an alias that enables a set of flags.

We can make the trace smaller by naming the trace file as `trace.txt.gz`, which enables GZIP compression, but that is not currently exposed on our scripts, since you usually just need something human readable to work on.

Enabling tracing made the runtime about 4x slower on the 2017 Lenovo ThinkPad P51, with or without `.gz` compression.

Trace the source lines just like for QEMU with:

    ./trace-boot --arch aarch64 --emulator gem5
    ./trace2line --arch aarch64 --emulator gem5
    less "$(./getvar --arch aarch64 run_dir)/trace-lines.txt"

TODO: 7452d399290c9c1fc6366cdad129ef442f323564 `./trace2line` this is too slow and takes hours. QEMU’s processing of 170k events takes 7 seconds. gem5’s processing is analogous, but there are 140M events, so it should take 7000 seconds ~ 2 hours which seems consistent with what I observe, so maybe there is no way to speed this up…​ The workaround is to just use gem5’s `ExecSymbol` to get function granularity, and then GDB individually if line detail is needed?

- gem5 trace internals

- gem5 ExecAll trace format

- gem5 Registers trace format

- gem5 TARMAC traces

- gem5 tracing internals