[Qemu-devel] [RFC PATCH 00/12] Reverse execution.

[fred.konrad@greensocs.com]

From: KONRAD Frederic <fred.konrad@greensocs.com>

Hi everybody,

Those are the two first patch-set we have been worked on for reverse execution.

The first series:
  icount: put icount variables into TimerState.
  migration: migrate icount fields.
  migration: make qemu_savevm_state public.
  icount: introduce icount timer.
  icount: check for icount clock deadline when cpu loop exits.
  icount: make icount extra computed on icount clock as well.
  timer: add cpu_icount_to_ns function.

are various preparation patches for reverse execution.

The last patches:
  introduce reverse execution mechanism.
  gdbstub: allow reverse execution in gdb stub.
  cpu-exec: trigger a debug request when rexec stops.
  cexe: synchronize icount on the next event.
  cexe: allow to enable reverse execution.

are reverse execution introduction.

They can be clone at: git://git.greensocs.com/qemu_cexe.git:cexe_2_3

The third series will be sent as soon as possible and have some issues with
QEMU's thread as it use fork.

This implementation of reverse execution works with instruction counting:

A new clock is implemented which is icount clock. It grows each time an
instruction is executed and is totally independant of host clock.

Snapshots are taken regularly (based on icount clock) with help of migration
code and written on the disk.

When user wants to use reverse-stepi:
 * Last snapshot is reloaded.
 * A stop callback is created to be triggered at the previous instruction.

This stop callback generates a debug exception so QEMU stops in debug mode.

Command line:
 * -cexe option is added to enable reverse execution, it needs icount 1.

About non determinism in QEMU:
 * This implementation doesn't take IO in account so any IO will cause non
   determinism and break reverse execution.

 * The icount warp mechanism have been disabled when reverse execution is
   enabled so the time grow differently inside the VM.

Testing:
 * It has been tested on ARM without any IO such as network or asynchronous file
   access to keep the deterministic behaviour of icount.

Known issues:
 * On ARM stepi seems to do some additional steps which are added to icount
   counter so reverse-stepi just after stepi is broken.

 * The IO replay explained above.

KONRAD Frederic (12):
  icount: put icount variables into TimerState.
  migration: migrate icount fields.
  migration: make qemu_savevm_state public.
  icount: introduce icount timer.
  icount: check for icount clock deadline when cpu loop exits.
  icount: make icount extra computed on icount clock as well.
  timer: add cpu_icount_to_ns function.
  introduce reverse execution mechanism.
  gdbstub: allow reverse execution in gdb stub.
  cpu-exec: trigger a debug request when rexec stops.
  cexe: synchronize icount on the next event.
  cexe: allow to enable reverse execution.

 Makefile.target             |   1 +
 cpu-exec.c                  |  13 ++
 cpus.c                      | 121 +++++++++++++---
 gdbstub.c                   |  31 ++++-
 include/qemu/timer.h        |  17 +++
 include/reverse-execution.h |  43 ++++++
 include/sysemu/sysemu.h     |   1 +
 main-loop.c                 |  10 ++
 qemu-options.hx             |   9 ++
 qemu-timer.c                |   6 +
 reverse-execution.c         | 326 ++++++++++++++++++++++++++++++++++++++++++++
 savevm.c                    |   2 +-
 stubs/Makefile.objs         |   1 +
 stubs/cexe-stub.c           |  32 +++++
 stubs/cpu-get-icount.c      |  13 ++
 vl.c                        |  23 +++-
 16 files changed, 627 insertions(+), 22 deletions(-)
 create mode 100644 include/reverse-execution.h
 create mode 100644 reverse-execution.c
 create mode 100644 stubs/cexe-stub.c

-- 
1.8.1.4