VMware Communities : All Content - VProbes

image1

navadavuluri — Mon, 12 Oct 2009 14:26:20 GMT

image

navadavuluri — Mon, 12 Oct 2009 14:25:24 GMT

vprobes status

fixitchris — Wed, 23 Sep 2009 18:06:01 GMT

Has there been any advancements in vprobes? Any cool, new things to show us?

Technology Exchange Developer Day - Vprobes -Observing the software stack from top to bottom

fixitchris — Tue, 15 Sep 2009 18:46:50 GMT

Has anyone filmed this?

should getsystemtime work under Workstation 6.5 for a linux guest?

visbrero — Thu, 30 Jul 2009 04:23:02 GMT

In the documentation, getsystemtime takes an integer output variable as an argument and returns an integer indicating success (so: int getsystemtime(int)). In practice, it would appear to have a signature of void getsystemtime(int) and do nothing whatsoever. Should it work? Are there platform limitations?

What I want is a way to retrieve the current time (from the perspective of the guest) for a guest that is being replayed. I was hoping getsystemtime would be my solution. My current solution (for a 32-bit Ubuntu 9.04 linux guest using 2.6.28-13) is to retrieve the 8-byte xtime value having looked up the offset via kallsyms. The deficiency is that time only advances when the kernel updates it.

Does VMware maintain a better internal time-clock (or at least a monotonically increasing counter) during replay that is relatively immune to the time cost of running vprobes (and does not increment when suspended)? My overall use-case is to record the execution of a program with no vprobes active. Once I have the recording, I want to replay it with (potentially expensive, at least in aggregate) vprobes in place while also having an idea of what the original timeline was.

If xtime is my best option, I won't complain if you tell me how to turn up the resolution and what would be a reasonable setting to avoid making the execution less realistic because the VM spends all its time handling timer interrupts.

VProbes in PowerShell

fixitchris — Fri, 29 May 2009 20:16:38 GMT

Same with this one, it loads, but no output:

"(defaggr agr 0 0);(vprobe VMM1Hz ( do  ( setint str    (sprintf \"%s:%d\"  \"barf\"  12 ))( aggr  agr () () 3)))"

Which is understandable since it is sprintf.

Using WinDbg symbol files

fixitchris — Fri, 29 May 2009 19:13:38 GMT

Modifying this:

808e5d9a nt!IopFreeDCB = <no type information>

to this:

0`808e5d9a nt!IopFreeDCB = <no type information>

does list the probe names correctly.

Configuration Parameters

robgbenson — Fri, 29 May 2009 18:28:56 GMT

fixitchris wrote:Rob?

Hi Chris.

vpFile is an option to specify a VP script to be loaded at VM power on.

syscall is an option to specify a file containing a list equating Linux syscall numbers with names. Note that this option is being deprecated in the next release.

Fix for linux26-32-process.emt

ecollins — Tue, 05 May 2009 02:18:05 GMT

Hi Nitin,

Thanks for the bug fix, checked it into the vprobe toolkit.

Apologies for the limited documetation of offat*, there should be more thorough vp docs in the next release. These functions are used to fish out the offset of a struct member from the guest. e.g. offatret("sys_getpid") resolves the function address for sys_getpid (using the mapping provided by the vprobe.guestSyms vmx option), looks for the last instruction in the function that did a mov to RAX (where the return value is placed) and returns the offset used in the mov. eg in "movslq 0x108(%rax),%rax" it would return 0x108, this is the offset of the member we're looking for (RAX points to the struct and 0x108 is the offset of the member in that struct). We can then read the value of the member by using getguest and using this offset and the pointer to a struct (eg the current thread pointer). The offat* functions work similarly.

Thanks,
Eli

Memory accesses of OS processes

fixitchris — Mon, 27 Apr 2009 13:31:57 GMT

I see what you are looking for... When I was first introduced to Vprobes, I was also under the impression that I could somehow use vprobes as a 'passive debugger'. This would have been awesome. Plus, the 32probe limit is another issue.

Have you verified that wildcards are not supported in linear addresses?

GUEST_READ GUEST_WRITE address ranges?

moussaba — Thu, 23 Apr 2009 17:32:52 GMT

I could deal with just logging page accesses rather than a specific
linear address.

Moussa

vprobe and Fusion

robgbenson — Thu, 23 Apr 2009 16:53:39 GMT

Hi Moussaba,

moussaba wrote:I was able to confirm that vprobe does indeed work in Fusion 2.0. I am only getting 42 probes for Ubuntu 8.10 virtual machine. I was expecting to see many more probes available, am I missing something?

The probe listing you are seeing represents the list of static
probes provided by our software stack (e..g, Guest_PF, Guest_IRQ, etc). My
assumption is that you are looking for the dynamic guest probes which
are only available if you provide a guest symbol file to the VM before
boot. You can find the full details about loading guest symbol files
in the "Getting Started with VProbes" section of the Workstation 6.5 VProbes
Programming Manual (see
http://www.vmware.com/pdf/ws65_vprobes_reference.pdf). For
posterity's sake here are the brief set of steps to get things working for Linux guests:

Create a guest symbol file by running 'cat /proc/kallsyms > <symbolFileName>' within the Linux guest.
Copy this guest symbol file from the guest to the host.
Add the following line to the
VM configuration (.vmx) file before booting the VM: vprobe.guestSyms =
"<path_to_symbolFileName>".

Let us know if you hit any road blocks when trying these steps.

Thanks!

Vprobe-toolkit in Windows

nitingupta — Fri, 27 Mar 2009 01:01:17 GMT

looks like this error is harmless (though I'm still not sure what it means).
Sample vp script:
vmrun vprobeLoad Fedora10.vmx '(vprobe VMM1Hz (printf "hworld!\n"))'
keeps printing this message in vprobe.out (in VM directory) until you issue:
vmrun vprobeReset Fedora10.vmx

Shortcut Keys to Get out of Full Screen in WinXP (Vmware Fusion 1.1.1)

Rob95814 — Fri, 27 Feb 2009 22:46:05 GMT

What is the key combination to get Vmware to revert to the non-fullscreen display of WinXP (very basic question but I did not see the answer when it flashed past)

Vprobes w/o vmrun

fixitchris — Thu, 26 Feb 2009 00:28:16 GMT

I have been browsing through vix.dll 1.6.2 and I have noticed a couple of interesting functions:

VixVM_GetVProbes
VixVM_GetVProbesVersion
VixVM_VProbeGetGlobalVars
VixVM_VProbeLoad
VixVM_VProbeReset
etc...

Would it be possible to get their signatures?

Trying this out...

fixitchris — Wed, 25 Feb 2009 16:47:48 GMT

Sounds pretty cool. Keep us updated.

VProbes: a stethoscope for your VM (blog, video)

wila — Thu, 19 Feb 2009 16:19:37 GMT

So cool... now what parameter do I need to adjust for more as 24 hours in a day?

--
Wil
_____________________________________________________
Visit the new VMware developers wiki at http://www.vi-toolkit.com

Community Sample Code Repository for VProbes ?

heyitspablo — Thu, 19 Feb 2009 00:32:48 GMT

Folks - If you have any interesting, and useful VProbes sample code you would like to share with our community please consider using our Community Sample Code repository: http://communities.vmware.com/community/developer/utilities?view=documents

If you do contribute please tag it by language and product so it makes it easier to search..

Many thanks

Pablo

existing examples/support code for probing user-level code?

kma — Wed, 18 Feb 2009 16:55:31 GMT

User-level is a bit rough, but still possible.

dwarffrob.py is, tragically, a work in progress, but it's more aimed at finding structure offsets than symbol names. If you are looking for a particular user-level binary, you can harvest symbols in the guest (either via windbg.exe or /usr/bin/nm), and append the symbols in the binary to the file specified in vprobe.guestSyms.

Next, you need to make sure that you're hitting the right process. This is best achieved by setting up one of the preloads for your guest and manually checking curprocname; e.g.:

GUEST:UserLevelSym
   if (!strcmp(curprocname(), "targetBinary")) {...}

You can also test curpid() if you like, etc. Unfortunately, this is all very manual. It would be nice both to automate the symbol harvesting, and to provide nicer notation for probing particular processes. There is also some difficulty with accessing linear addresses that the guest happens to have paged out: since VProbes is nervous about perturbing the state of the guest, we don't inject page faults on such accesses. So the probe fire will simply fail, leaving a warning in your vmware.log.

Thanks,
Keith

VProbes on ESX

oreeh — Wed, 18 Feb 2009 16:02:43 GMT

It is not possible with ESX 3.5.

Regarding ESX 4 I'd ask your colleagues as those who know are bound by a NDA.

Welcome VProbes Developers to our shiny new community

fixitchris — Wed, 18 Feb 2009 03:11:37 GMT

I would love to see more real life examples too...

Think about this, when you re debugging C# code using Visual Studio, you re only stepping through your code. What if your code is good, but the CLR is JITTING it all wrong! In this case you will need to go lower and debug the CLRs interaction with the operating system. The way I understand it, is that you could launch a debugger like softIce in the guest and everything might look OK, but until you launch a debugger a lower layer and point it at the hypervisor , you will never find out that the way the hypervisor is handling Intels and AMDs virtual helper instructions differently, possibly causing the awry behavior.