Re: [Qemu-discuss] Overload system function through LD_PRELOAD / Stracing a program in a virtual machine

[Jakob Bohm]

On 1/10/2014 4:39 PM, Alexandre LAURENT wrote:
> Hello everyone,
>
> I have a library overloading system functions (like connect/open ...) 
> that I am loading with qemu using LD_PRELOAD :
>     LD_PRELOAD=./mylibofoverload.so qemu $qemu_params
>
> Would my overloads be used in the program runned in the virtual machine ?
No, but you should see the system calls made by qemu to access the
files and data on the host system (where the LD_PRELOAD is done).

You might not see calls that are optimized inside the kvm kernel module
to not go through the qemu user mode code, the workaround for that is to
tell qemu not to use kvm for that particular invocation (see man qemu for
the correct option to do that).

> The second part of the question, which I guess is related is : does 
> strace can see and trace the function runned in the virtual machine 
> programs ?
No, same situation, an strace of qemu will show you what qemu does to the
host system inorder to simulate whatever is happening inside the guest
system.

> Actually, I am not able to do that. I think that is because everything 
> is runned through kvm, but is there a trick/hack allowing me to strace 
> inner programs ?

If you want to see the system or library callshappening inside the VM,
you need to run LD_PRELOAD / strace inside the VM too.

For system calls you might also get away by using the "user space" as
opposed to "system" variant of qemu to run a program with the emulated
CPU but the system calls and kernel of the host, that should make the
system calls made by the program inside qemu appear as nearly identical
system calls in an strace of qemu.

Because the current documentation link from http://wiki.qemu.org/Manual
is dead, I had to base this answer on the copy of the ancient qemu 0.12
documentation which is still online.

Enjoy

Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S.  http://www.wisemo.com
Transformervej 29, 2730 Herlev, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded