Real-time Multi-process Tracing Decoder Architecture

Tracing is a form of logging by recording the execution information of programs. Since a large amount of data must be created and decoded in real time, a tracer composed mainly of dedicated hardware is widely used. Intel® PT records all information related to software execution from each hardware thread. When the execution of the corresponding software is completed, the accurate program flow can be indicated through the recorded trace data. The hardware trace program can be integrated into the operating system, but in the case of the Windows system, the kernel is not disclosed so tight integration is not achieved. Also, in a Windows environment, it can only trace a single process and do not provide a way to trace multiple process streams. In this paper, we propose a way of extending the PT trace program in order to overcome this shortcoming by supporting multi-process stream tracing in Windows environment.