[Qemu-devel] QEMU 3.1 - Getting Instruction Traces

[Dhruv Agarwal <dhruv.agarwal_ug19@ashoka.edu.in>]

Dear Developers,

I am an undergraduate student trying to generate *a trace of all
instructions executed by the QEMU ARM emulator when it runs a given binary*.

I have been using the* following command* (from an out-of-tree build from
source code):
arm-linux-user/qemu-arm -d in_asm ~/Desktop/hello
(hello is the name of my binary cross-compiled for ARM
using gcc-arm-none-eabi on an x86 host machine).

By doing this, I do get a list of translation blocks that are executed by
the emulator, however I was told by a colleague that this trace/log is
incomplete because of the following reason: the translation blocks already
in the translation cache are not translated again, and hence are not logged
to the screen by QEMU.

Hence, I am now stuck and r*equire a way to generate a complete instruction
trace of all instructions that are executed by the ARM emulator for a given
binary*. Has anyone done the same earlier and can guide me on how to get
this trace?

Thank you and best regards,
Dhruv