Hi Antti,
Thanks for the reply. Honestly, I am new to QEMU, hence I just tried following the steps you had mentioned to extract PCs without actually knowing what each of those mean.
As you had said,
- I defined DEBUG_EXEC in
cpu-exec.c
- I disabled USE_DIRECT_JUMP in exec-all.h
- I disabled USE_CODE_COPY in target-i386/cpu.h
- I hardcoded force_dc->jmp_opt to equal zero in target-i386/translate.c (force_dc->jmp_opt = 0;)
However, when I try to make the qemu-0.9.0 that I have, I get the following error -
##########################################################
$ make
....
/qemu-0.9.0-trial/target-i386/translate.c
/qemu-
0.9.0-trial/target-i386/translate.c: In function `gen_goto _tb':
/qemu-0.9.0-trial/target-i386/translate.c:1766: error: too many arguments to function `gen_op_goto_tb0'
/qemu-0.9.0-trial/target-i386/translate.c:1768: error: too many arguments to function `gen_op_goto_tb1'
make[1]: *** [translate.o] Error 1
make[1]: Leaving directory `/qemu-0.9.0-trial/i386-linux-user'
make: *** [subdir-i386-linux-user] Error 2
######################################################
"Shashidhar Mysore" <shashimc@gmail.com> writes:
> I intend to extract program counter streams from QEMU as a program executes.
> Can you please point me to the hooks that I may have to insert into the QEMU
> source code in order to extract the PC values?
I used to do that with qemu 0.7. I did not dig into this deep enough
to find the minimal changes but at least the following was enough:
- define DEBUG_EXEC in cpu-exec.c
- disable USE_DIRECT_JUMP in exec-all.h
- disable USE_CODE_COPY in target-i386/cpu.h
- force dc->jmp_opt to zero in target-i386/translate.c
Would be nice if enabling PC traces were possible with e.g. command
line (maybe requiring config time enable would be good too :-)
--
http://www.iki.fi/~ananaza/