[Qemu-devel] Counting Instructions and Looking for Conditional Branches

[Qemu-devel] Counting Instructions and Looking for Conditional Branches

[Shane Brennan]

[-- Attachment #1: Type: text/plain, Size: 695 bytes --]

I am wondering if anyone knows where in the QEMU source code I can create a
counter to count the number of executed instructions? In addition, where I
can place an IF statement to see if a conditional branch instruction is
about to execute.

I need to do this to create a basic block vector for SimPoint. I have found
that the function cpu-exec in cpu-exec.c is probably going to be involved,
but I would appreciate any help in narrowing things down. Basically, all I
need to do is at every instruction I increase a counter. Then, I see if that
instruction is a conditional branch. If it is, I print some characters to a
file, and reset the counter. I would greatly appreciate any help.

~Shane

[-- Attachment #2: Type: text/html, Size: 744 bytes --]

RE: [Qemu-devel] Counting Instructions and Looking for ConditionalBranches

[Torbjorn.K.Andersson]

Hello Shane.
 
I have successfully added instruction counters to QEMU with a low run-time overhead. I cannot give you the code but I can tell you how I did it.
 
1: Make sure that QEMU knows which block is the current_tb. What I did was to update the goto_tb block to update the current_tb pointer.
2: Add an epilogue to the basic blocks that uses the current_tb pointer and increase the instruction counter with the information stored in the current_tb. In my test system it was a one to one mapping with the size of the TB.
 
The files you will need to update are: exec.c and translate.c together with op.c for your target. Maybe more..

/Regards
Torbjörn Andersson
________________________________

From: qemu-devel-bounces+torbjorn.k.andersson=tietoenator.com@nongnu.org [mailto:qemu-devel-bounces+torbjorn.k.andersson=tietoenator.com@nongnu.org] On Behalf Of Shane Brennan
Sent: den 18 februari 2007 03:08
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] Counting Instructions and Looking for ConditionalBranches
	
	
I am wondering if anyone knows where in the QEMU source code I can create a counter to count the number of executed instructions? In addition, where I can place an IF statement to see if a conditional branch instruction is about to execute. 
	
I need to do this to create a basic block vector for SimPoint. I have found that the function cpu-exec in cpu-exec.c is probably going to be involved, but I would appreciate any help in narrowing things down. Basically, all I need to do is at every instruction I increase a counter. Then, I see if that instruction is a conditional branch. If it is, I print some characters to a file, and reset the counter. I would greatly appreciate any help. 
	
	~Shane 

RE: [Qemu-devel] Counting Instructions and Looking for ConditionalBranches

[Torbjorn.K.Andersson]

[-- Attachment #1: Type: text/plain, Size: 1479 bytes --]

I'm not sure if your solution is a complete solution for counting instructions is enough. If I understand QEMU correct, it links TBs together, removing the need to go through the tb_find_fast in many but not all situations.
 
However, you could disable the TB linking, done in tb_find_fast I think..., and then your solution should be enough.
 
For detecting contidional and uncondiftional branches, you could alter the code in translate.c to add information about the reason for why the TB was ended in the TB struct. 
 
Torbjörn

________________________________

	From: loopuniverse@gmail.com [mailto:loopuniverse@gmail.com] On Behalf Of Shane Brennan
	Sent: den 20 februari 2007 02:35
	To: Andersson Torbjorn
	Subject: RE: [Qemu-devel] Counting Instructions and Looking for ConditionalBranches
	
	
	Hi Torbjorn,
	
	Thank you for the advice. I am currently counting instructions by placing a counter in the cpu_exec function in cpu_exec.c
	
	Everytime a new tb is grabbed from the tb_find_fast() function I update the instruction counter. This seems to be an accurate instruction count. I am also able to detect when branches and jumps occur by comparing the PCs of consecutive tb's. However, I am currently unable to tell which of the branch/jumps are conditional, and which are unconditional. Do you have any advice on monitoring for unconditional branches? 
	
	Any advice you can provide me with would be greatly appreciate!
	~Shane Brennan
	
	


[-- Attachment #2: Type: text/html, Size: 3121 bytes --]