读取trace，制作访存时序图

addr_filter.py

#!/usr/bin/env python
#-*- encoding:utf-8 -*-


def addr_filter(pc, addr, collect_stack=False):
    if pc is not None and pc <= 0x4fffff:
        if (addr > 0x7fff00000000 and collect_stack) \
            or (addr <= 0x7fff00000000 and not collect_stack):
            return True
    return False

memory_access_plot.py

#!/usr/bin/env python
#-*- encoding:utf-8 -*-

import sys
import matplotlib.pyplot as plt

from addr_filter import addr_filter

SEG_LINENUM = 10000
MAXLINE = 20000000
MAX_OUTPUT_PNG = 100
pngname = "default"


def read_file(filename, trace_list, collect_stack=False):
    """
    read trace plain file, collect all access address stack or heap
    当前trace文件格式：每行: "$memory:$pc"
    Parameter:
    `filename`: string, filename
        `collect_stack`: boolean, default is False
    Return Values:
        collected line number
    """
    linum = 0
    totallinum = 0
    print "reading..."
    with open(filename) as fobj:
        for line in fobj:
            totallinum += 1
            if line != '\n':
                addr_str = line.split(":")[0]
                if len(line.split(":")) > 1:
                    pc_str = line.split(":")[1]
                    pc = long(pc_str, 16)
                else:
                    pc_str = None
                    pc = None
                addr = long(addr_str, 16)
                if addr_filter(pc, addr):
                    trace_list.append(addr)
                    linum += 1
                if linum > MAXLINE:
                    break
            else:
                print 'find blank line! linum: ', totallinum
                continue
    print "total line: ", totallinum
    print "collected: ", linum
    return linum

def draw(trace_list, linum=-1, figprefix="default"):
    if linum <= 0:
        linum = len(trace_list)

    if linum <= 0:
        print "Error: trace empty"
        return
    
    if linum < SEG_LINENUM:
        fig = plt.figure()
        make_plot(fig, trace_list, figprefix)
    else:
        #print range(0, int(linum/SEG_LINENUM))
        cnt = MAX_OUTPUT_PNG
        if int(linum/SEG_LINENUM) < cnt:
            cnt = int(linum/SEG_LINENUM)
        for i in range(0, cnt + 1):
            fig = plt.figure()
            if i < cnt \
                or (i == cnt and len(trace_list[i * SEG_LINENUM:(i + 1) * SEG_LINENUM]) > 0):
                make_plot(fig, trace_list[i * SEG_LINENUM:(i + 1) * SEG_LINENUM], figprefix, idx=i)
                #plt.show()


def make_plot(fig, trace_list, figprefix, idx=0):
    name = figprefix + "-" + str(idx) + ".png"
    print 'making plot: ',name
    x = [i for i in range(0,len(trace_list))]
    ax = fig.add_subplot(111)
    ax.scatter(x, trace_list, color='green')
    fig.savefig(name)
    
if __name__ == '__main__':
    if len(sys.argv) < 3:
        print 'pls specify mem trace file and png prefix'
        exit(-1)
    heap_access_list = []
    linum = read_file(sys.argv[1], heap_access_list)
    # 可以连同输出路径一起给出
    figprefix = sys.argv[2]
    draw(heap_access_list, figprefix=figprefix)

pin_mem_trace.cpp

/*BEGIN_LEGAL 
Intel Open Source License 

Copyright (c) 2002-2012 Intel Corporation. All rights reserved.
 
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.  Redistributions
in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or
other materials provided with the distribution.  Neither the name of
the Intel Corporation nor the names of its contributors may be used to
endorse or promote products derived from this software without
specific prior written permission.
 
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE INTEL OR
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
END_LEGAL */
/*
 *  This file contains an ISA-portable PIN tool for tracing memory accesses.
 */

#include <stdio.h>
#include "pin.H"

KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE,    "pintool",
    "o", "pin_mem_trace.out", "specify trace file name");

#define PAGEINDEX(x) (~0x0 << 5) & (x)
FILE * trace;
PIN_MUTEX lock;
ADDRINT lastPage;

// Print a memory read record
VOID RecordMemRead(VOID * ip, VOID * addr)
{

    //fprintf(trace,"%p\n",PAGEINDEX(addr));
	ADDRINT curPage = PAGEINDEX((ADDRINT)addr);
    if (curPage != lastPage)
    {
        PIN_MutexLock(&lock);
        fprintf(trace, "%lx\n", curPage);
        PIN_MutexUnlock(&lock);
        lastPage = curPage;
    }


}

// Print a memory write record
VOID RecordMemWrite(VOID * ip, VOID * addr)
{
    // fprintf(trace,"%p: W %p\n", ip, addr);
    //fprintf(trace,"%p\n", PAGEINDEX(addr));
    ADDRINT curPage = PAGEINDEX((ADDRINT)addr);
    if (curPage != lastPage)
    {
        PIN_MutexLock(&lock);
        fprintf(trace, "%lx\n", curPage);
        PIN_MutexUnlock(&lock);
        lastPage = curPage;
    }
    
}

// Is called for every instruction and instruments reads and writes
VOID Instruction(INS ins, VOID *v)
{
    // Instruments memory accesses using a predicated call, i.e.
    // the instrumentation is called iff the instruction will actually be executed.
    //
    // The IA-64 architecture has explicitly predicated instructions. 
    // On the IA-32 and Intel(R) 64 architectures conditional moves and REP 
    // prefixed instructions appear as predicated instructions in Pin.
    UINT32 memOperands = INS_MemoryOperandCount(ins);

    // Iterate over each memory operand of the instruction.
    for (UINT32 memOp = 0; memOp < memOperands; memOp++)
    {
        if (INS_MemoryOperandIsRead(ins, memOp))
        {
            INS_InsertPredicatedCall(
                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead,
                IARG_INST_PTR,
                IARG_MEMORYOP_EA, memOp,
                IARG_END);
        }
        // Note that in some architectures a single memory operand can be 
        // both read and written (for instance incl (%eax) on IA-32)
        // In that case we instrument it once for read and once for write.
        if (INS_MemoryOperandIsWritten(ins, memOp))
        {
            INS_InsertPredicatedCall(
                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite,
                IARG_INST_PTR,
                IARG_MEMORYOP_EA, memOp,
                IARG_END);
        }
    }
}

VOID Fini(INT32 code, VOID *v)
{
    //fprintf(trace, "#eof\n");
    fclose(trace);
    PIN_MutexFini(&lock);
}

/* ===================================================================== */
/* Print Help Message                                                    */
/* ===================================================================== */
   
INT32 Usage()
{
    PIN_ERROR( "This Pintool prints a trace of memory addresses\n" 
              + KNOB_BASE::StringKnobSummary() + "\n");
    return -1;
}

/* ===================================================================== */
/* Main                                                                  */
/* ===================================================================== */

int main(int argc, char *argv[])
{
    if (PIN_Init(argc, argv)) return Usage();
    PIN_MutexInit(&lock);
    trace = fopen(KnobOutputFile.Value().c_str(), "w");

    INS_AddInstrumentFunction(Instruction, 0);
    PIN_AddFiniFunction(Fini, 0);

    // Never returns
    PIN_StartProgram();
    
    return 0;
}

pin_mem_trace.sh

#!/bin/bash

usage() {
	echo "$0 [outputfile] [prog] [paras]"
}	

if [ "$#" -lt 1 ];then
	usage
	exit 1
elif [ "$1" == "-h" ] || [ "$1" == "--help" ];then
	usage
	exit 0
fi

dir=$(dirname $(readlink -f "$BASH_SOURCE"))
output=$1
shift
$dir/pin -t $dir/memtrace/pinatrace.so -o $output -- $*