From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1HYV7W-00078l-TS for qemu-devel@nongnu.org; Mon, 02 Apr 2007 18:35:26 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1HYV7V-00078I-Lq for qemu-devel@nongnu.org; Mon, 02 Apr 2007 18:35:26 -0400 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1HYV7V-00078B-HA for qemu-devel@nongnu.org; Mon, 02 Apr 2007 18:35:25 -0400 Received: from wx-out-0506.google.com ([66.249.82.236]) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1HYV4Q-00016h-2F for qemu-devel@nongnu.org; Mon, 02 Apr 2007 18:32:14 -0400 Received: by wx-out-0506.google.com with SMTP id i30so2257343wxd for ; Mon, 02 Apr 2007 15:32:12 -0700 (PDT) Message-ID: <12835c8f0704021532y4c78c78btd26d9526726951db@mail.gmail.com> Date: Mon, 2 Apr 2007 15:32:12 -0700 From: "Shashidhar Mysore" Subject: Re: [Qemu-devel] Re: PC traces from QEMU In-Reply-To: <20070330111016.GA8305@miranda.arrow> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_85338_22720946.1175553132545" References: <12835c8f0703261313j45f7e23cx1773a20845370a4e@mail.gmail.com> <87ejn80xi8.fsf@brigitte.dna.fi> <20070329203736.GA7024@miranda.arrow> <12835c8f0703291828y31e5b962i7a52527b8db63a98@mail.gmail.com> <20070330111016.GA8305@miranda.arrow> Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stuart Brady Cc: qemu-devel@nongnu.org ------=_Part_85338_22720946.1175553132545 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Hi Stuart, Thanks for the patch. It works well for me, except that the log file grows so huge and qemu slows down quite a lot. Did you have problems with this? I was wondering if there was a way to actually begin the PC trace collection after completely booting QEMU and also restrict it to a particular process ID? Just a clarification, does the log now have all retired PCs? Thanks, -Shashi. On 3/30/07, Stuart Brady wrote: > > On Thu, Mar 29, 2007 at 06:28:14PM -0700, Shashidhar Mysore wrote: > > Hi Stuart, > > > > Thanks for the reply, but since I'm a little new to qemu, can you please > > elaborate on how to insert the op_dump_pc function to extract the PC > values? > > Well, here's a patch that does it: > > Index: target-i386/exec.h > =================================================================== > RCS file: /sources/qemu/qemu/target-i386/exec.h,v > retrieving revision 1.31 > diff -u -r1.31 exec.h > --- target-i386/exec.h 24 Sep 2006 18:40:46 -0000 1.31 > +++ target-i386/exec.h 30 Mar 2007 11:02:08 -0000 > @@ -146,6 +146,8 @@ > > extern CCTable cc_table[]; > > +void helper_dump_pc(target_ulong PC); > + > void load_seg(int seg_reg, int selector); > void helper_ljmp_protected_T0_T1(int next_eip); > void helper_lcall_real_T0_T1(int shift, int next_eip); > Index: target-i386/helper.c > =================================================================== > RCS file: /sources/qemu/qemu/target-i386/helper.c,v > retrieving revision 1.74 > diff -u -r1.74 helper.c > --- target-i386/helper.c 1 Feb 2007 22:12:19 -0000 1.74 > +++ target-i386/helper.c 30 Mar 2007 11:02:09 -0000 > @@ -30,6 +30,16 @@ > } while (0) > #endif > > +void helper_dump_pc(target_ulong pc) > +{ > + if (logfile) > +#ifdef TARGET_X86_64 > + fprintf(logfile, "PC = %016" PRIx64 "\n", pc); > +#else > + fprintf(logfile, "PC = %08x\n", pc); > +#endif > +} > + > const uint8_t parity_table[256] = { > CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0, > 0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P, > Index: target-i386/op.c > =================================================================== > RCS file: /sources/qemu/qemu/target-i386/op.c,v > retrieving revision 1.47 > diff -u -r1.47 op.c > --- target-i386/op.c 1 Feb 2007 22:11:07 -0000 1.47 > +++ target-i386/op.c 30 Mar 2007 11:02:09 -0000 > @@ -132,6 +132,11 @@ > > #endif > > +void OPPROTO op_dump_pc(void) > +{ > + helper_dump_pc(PARAM1); > +} > + > /* operations with flags */ > > /* update flags with T0 and T1 (add/sub case) */ > Index: target-i386/translate.c > =================================================================== > RCS file: /sources/qemu/qemu/target-i386/translate.c,v > retrieving revision 1.62 > diff -u -r1.62 translate.c > --- target-i386/translate.c 16 Jan 2007 19:28:58 -0000 1.62 > +++ target-i386/translate.c 30 Mar 2007 11:02:10 -0000 > @@ -3155,6 +3155,7 @@ > int rex_w, rex_r; > > s->pc = pc_start; > + gen_op_dump_pc(s->pc); > prefixes = 0; > aflag = s->code32; > dflag = s->code32; > > It's probably not the best way to do this, but it worked well enough for > my purposes. (target-z80 -- where there is only one address space! :-) > -- > Stuart Brady > ------=_Part_85338_22720946.1175553132545 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Hi Stuart,

Thanks for the patch. It works well for me, except that the log file grows so huge and qemu slows down quite a lot. Did you have problems with this? I was wondering if there was a way to actually begin the PC trace collection after completely booting QEMU and also restrict it to a particular process ID?

Just a clarification, does the log now have all retired PCs?

Thanks,
-Shashi.

On 3/30/07, Stuart Brady < sdbrady@ntlworld.com> wrote:
On Thu, Mar 29, 2007 at 06:28:14PM -0700, Shashidhar Mysore wrote:
> Hi Stuart,
>
> Thanks for the reply, but since I'm a little new to qemu, can you please
> elaborate on how to insert the op_dump_pc function to extract the PC values?

Well, here's a patch that does it:

Index: target-i386/exec.h
===================================================================
RCS file: /sources/qemu/qemu/target-i386/exec.h,v
retrieving revision 1.31
diff -u -r1.31 exec.h
--- target-i386/exec.h  24 Sep 2006 18:40:46 -0000       1.31
+++ target-i386/exec.h  30 Mar 2007 11:02:08 -0000
@@ -146,6 +146,8 @@

extern CCTable cc_table[];

+void helper_dump_pc(target_ulong PC);
+
void load_seg(int seg_reg, int selector);
void helper_ljmp_protected_T0_T1(int next_eip);
void helper_lcall_real_T0_T1(int shift, int next_eip);
Index: target-i386/helper.c
===================================================================
RCS file: /sources/qemu/qemu/target-i386/helper.c,v
retrieving revision 1.74
diff -u -r1.74 helper.c
--- target-i386/helper.c        1 Feb 2007 22:12:19 -0000       1.74
+++ target-i386/helper.c        30 Mar 2007 11:02:09 -0000
@@ -30,6 +30,16 @@
} while (0)
#endif

+void helper_dump_pc(target_ulong pc)
+{
+    if (logfile)
+#ifdef TARGET_X86_64
+        fprintf(logfile, "PC = %016" PRIx64 "\n", pc);
+#else
+        fprintf(logfile, "PC = %08x\n", pc);
+#endif
+}
+
const uint8_t parity_table[256] = {
     CC_P, 0, 0, CC_P, 0, CC_P, CC_P, 0,
     0, CC_P, CC_P, 0, CC_P, 0, 0, CC_P,
Index: target-i386/op.c
===================================================================
RCS file: /sources/qemu/qemu/target-i386/op.c,v
retrieving revision 1.47
diff -u -r1.47 op.c
--- target-i386/op.c    1 Feb 2007 22:11:07 -0000       1.47
+++ target-i386/op.c    30 Mar 2007 11:02:09 -0000
@@ -132,6 +132,11 @@

#endif

+void OPPROTO op_dump_pc(void)
+{
+    helper_dump_pc(PARAM1);
+}
+
/* operations with flags */

/* update flags with T0 and T1 (add/sub case) */
Index: target-i386/translate.c
===================================================================
RCS file: /sources/qemu/qemu/target-i386/translate.c,v
retrieving revision 1.62
diff -u -r1.62 translate.c
--- target-i386/translate.c     16 Jan 2007 19:28:58 -0000       1.62
+++ target-i386/translate.c     30 Mar 2007 11:02:10 -0000
@@ -3155,6 +3155,7 @@
     int rex_w, rex_r;

     s->pc = pc_start;
+    gen_op_dump_pc(s->pc);
     prefixes = 0;
     aflag = s->code32;
     dflag = s->code32;

It's probably not the best way to do this, but it worked well enough for
my purposes.  (target-z80 -- where there is only one address space! :-)
--
Stuart Brady

------=_Part_85338_22720946.1175553132545--