Re: [Qemu-devel] GSoC mentor summit QEMU users session

[Fabien Chouteau <chouteau@adacore.com>]

On 03/11/2011 08:44, Stefan Hajnoczi wrote:
> On Wed, Nov 2, 2011 at 5:39 PM, Fabien Chouteau <chouteau@adacore.com> wrote:
>> On 29/10/2011 15:52, Alexander Graf wrote:
>>> The RTEMS guys use QEMU to do coverage testing of their kernel code.
>>> They run their test-cases and see if all of their code and branches
>>> have been hit. Adacore seems to have a patches version of QEMU to
>>> provide an easily parsable log file for that sort of thing. Might be a
>>> good idea to consolidate upstream. Patches welcome :)
>>
>> That's right we do have a coverage analysis solution based on Qemu.
>> Execution traces generated by Qemu are analyzed by the GNATcoverage
>> tool to provide object, statement, decision or Modified
>> Condition/Decision coverage analysis.
>>
>> The main interest of Qemu is to provide execution traces without
>> code instrumentation.
>>
>> Alex, it is of course in our plans to submit patches to the upstream Qemu ;)
>>
>> I give you some pointers if you want to find more on GNATcoverage (technical stuff :)
>>
>>  * GNATcoverage is hosted on forge.open-do.org. You can checkout the
>>   repository with:
>>
>>     $ svn checkout svn://scm.forge.open-do.org/scmrepos/svn/couverture/trunk/couverture
>>
>>   From there, you have
>>     * the tool source tree in "tools"
>>     * a synthesis article in "publications" : 201005-erts2.pdf
>>
>>  * GNATcov's documentation attached to this email
>
> Thanks for mentioning Couverture.  Just yesterday I talked to neo_1987
> on IRC who is trying to get QEMU /w couverture to work for him.

Great, good to know!

>  We ran into a little bit of confusion because the -trace command-line
>  option is also used in upstream QEMU but for a different purpose
>  (http://wiki.qemu.org/Features/Tracing).
>

We had the same problem, the option is now -exec-trace. Checkout the
qemu-head branch of https://forge.open-do.org/anonscm/git/couverture-qemu/couverture-qemu.git

> I took a quick peak at the qemu-trace.[ch] from couverture and it
> looks along the lines of the instrumentation that others have been
> doing too.  I hope you have time to propose the coverage
> instrumentation for upstream QEMU.
>

I don't know much about other instrumentations in Qemu (pointers are
welcome :), but what we have in couverture-qemu is not trivial,
especially when it comes to MC/DC analysis. You should take a look at
201005-erts2.pdf if you want technical details.

-- 
Fabien Chouteau