Record dynamic instruction trace or histogram in QEMU?

Question

1. I've written and compiled a RISC-V Linux application.

2. I want to dump all the instructions that get executed at run-time (which cannot be achieved by static analysis).

Is it possible to get a dynamic assembly instruction execution historgram from QEMU (or other tools)?

Answer 1

For instruction tracing, I go with -singlestep -d nochain,cpu, combined with some awk. This can become painfully slow and large depending on the code you run.

Regarding the statistics you'd like to obtain, delegate it to R/numpy/pandas/whatever after extracting the program counter.

The presentation or video of user "yvr18" on that topic, might cover some aspects of QEMU tracing at various levels (as well as some interesting heatmap visualization).

Answer 2

QEMU doesn't currently support that sort of trace of all instructions executed.

1. The closest we have today is that there are various bits of debug logging under the -d switch, and you can combine the tracing of "instructions translated from guest to native" with the "blocks of translated code executed" translation to work out what was executed, but this is pretty awkward.

2. Alternatively you could try scripting the gdbstub interface to do something like "disassemble instruction at PC; singlestep" which will (slowly!) give you all the instructions executed.

Note: There ongoing work to improve QEMU's ability to introspect guest execution so that you can write a simple 'plugin' with functions that are called back on events like guest instruction execution; with that it would be fairly easy to write a dump of guest instructions executed (or do more interesting processing), but this is still work-in-progress, so not available yet.

Answer 3

It seems you can do something similar with rv8 (https://github.com/rv8-io/rv8), using the command:

rv-jit -l