Dynamically Instrumenting the QEMU Emulator for Linux Process Trace Generation with the GDB Debugger

Abstract

In software debugging, trace generation techniques are used to resolve highly complex bugs. However, the emulators increasingly used for embedded software development do not yet offer the types of trace generation infrastructure available in hardware. In this article, we make changes to the ARM ISA emulation of the QEMU emulator to allow for continuous instruction-level trace generation. Using a standard GDB client, tracepoints can be inserted to dynamically log registers and memory addresses without altering executing code. The ability to run trace experiments in five different modes allows the scope of trace generation to be narrowed as needed, down to the level of a single Linux process. Our scheme collects the execution traces of a Linux process on average between 9.6x--0.7x the speed of existing QEMU trace capabilities, with 96.7% less trace data volume. Compared to a software-instrumented tracing scheme, our method is both unobtrusive and performs on average between 3--4 orders of magnitude faster.