Documentation/Debugging

Using valgrind

You can use valgrind to detect memory corruption and leaks within QEMU. valgrind really doesn't function well when using KVM so it's advised to use TCG. Additionally, you will need to use the --smc-check=all option to instruct valgrind to detect self-modifying code which TCG makes extensive use of.

Using gdb

You can use gdb in a range of ways.

If you invoke qemu from within gdb, you'll probably want to skip SIGUSR1 ("handle SIGUSR1 noprint").

You can also invoke qemu with the -gdb option (or -s shortcut) which provides a gdb stub. You can then connect from any machine on the network (start up gdb, then use "target remote <ip>:<portnum>"). See the man page for more information.

Depending on what you are trying to debug, it may help to use the -S option to qemu (which freezes the CPU on startup), so you can get qemu up, attach gdb and get it set up, then continue.

On some architectures, using hardware breakpoints (gdb hbreak command) may work better than software breakpoints (gdb break command)