i386 Linux 内核使用 qemu 的地址空间标识符
朋友们，我正在开发一个内部架构模拟器，它用于模拟在不同架构参数（如核心、内存层次结构和互连）上运行的代码的时序效果。
我正在开发一个模块，它从“PinTool”和“qemu-linux-user”等模拟器中获取正在运行的程序的实际跟踪，并将该跟踪提供给模拟器。
到目前为止我的方法是这样的： 1) 获取二进制可执行文件的 objdump 并解析此信息。 2）现在模拟器必须只向我提供指令指针和其他信息，例如加载地址/存储地址。
仅当程序内容已知时，此类方法才有效。
但现在我一直在尝试跟踪在标准 Linux 内核上运行的可执行文件。现在的问题是基础内核映像不包含 LKM（可加载内核模块）的代码。启动内核时，守护进程也是未知的。
所以，我的解决方案的方法是： 1）使用qemu来模拟机器。 2）当第一次遇到指令时，我将解析它并保存该信息。供以后使用。 3) 创建一个辅助函数，在执行指令时发送 ip、加载/存储地址。
我陷入了步骤2。我如何区分 qemu 中的不同进程，qemu 只是一个模拟器，对来宾操作系统一无所知？
我可以修改来宾操作系统的调度程序，但我真的无法弄清楚前进的方向。
抱歉，如果问题很长。我知道我可以抽象出某些部分，但觉得其中的某些部分解释了问题的背景。
Friends, I am working on an in-house architectural simulator which is used to simulate the timing-effect of a code running on different architectural parameters like core, memory hierarchy and interconnects.
I am working on a module takes the actual trace of a running program from an emulator like "PinTool" and "qemu-linux-user" and feed this trace to the simulator.
Till now my approach was like this :
1) take objdump of a binary executable and parse this information.
2) Now the emulator has to just feed me an instruction-pointer and other info like load-address/store-address.
Such approaches work only if the program content is known.
But now I have been trying to take traces of an executable running on top of a standard linux-kernel. The problem now is that the base kernel image does not contain the code for LKM(Loadable Kernel Modules). Also the daemons are not known when starting a kernel.
So, my approach to this solution is :
1) use qemu to emulate a machine.
2) When an instruction is encountered for the first time, I will parse it and save this info. for later.
3) create a helper function which sends the ip, load/store address when an instruction is executed.
i am stuck in step2. how do i differentiate between different processes from qemu which is just an emulator and does not know anything about the guest OS ??
I can modify the scheduler of the guest OS but I am really not able to figure out the way forward.
Sorry if the question is very lengthy. I know I could have abstracted some part but felt that some part of it gives an explanation of the context of the problem.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
第一种情况，使用 qemu-linux-user 执行单个程序的用户模式仿真，任务非常简单，因为内存是线性的，并且仿真器不涉及虚拟内存。整个系统模拟的第二种情况要复杂得多，因为您基本上必须从内核结构中解析地址。
如果您可以直接从 QEmu 中获取虚拟地址，那么您的工作会更容易一些；那么你只需要识别进程，其他一切功能就像在单进程情况下一样。您也许可以通过伪造对
get_pid()的系统调用来获取 PID。否则，这一切似乎与从物理内存转储中调试系统非常相似。有一些工具可以完成此任务。不过，它们可能太慢而无法运行每条指令，但您可以在那里寻找提示。
In the first case, using qemu-linux-user to perform user mode emulation of a single program, the task is quite easy because the memory is linear and there is no virtual memory involved in the emulator. The second case of whole system emulation is a lot more complex, because you basically have to parse the addresses out of the kernel structures.
If you can get the virtual addresses directly out of QEmu, your job is a bit easier; then you just need to identify the process and everything else functions just like in the single-process case. You might be able to get the PID by faking a system call to
get_pid().Otherwise, this all seems quite a bit similar to debugging a system from a physical memory dump. There are some tools for this task. They are probably too slow to run for every instruction, though, but you can look for hints there.