Re: [Qemu-devel] Instruction counting instrumentation for ARM + initial patch

[Vince Weaver <vince@csl.cornell.edu>]

I wonder if a simplistic stats gathering frame work could be added to 
Qemu.

The problem is there currently are at least 3 users of Qemu:
   1.  People who want fast simulation
   2.  People who are doing virtualization
   3.  People trying to do instrumentation/research

Unfortunately those three groups have conflicting interests.

The main problem is that adding instrumentation infrastructure will either 
slow down the common case, or else introduce lots of #ifdefs all over the 
code.  Neither is very attractive.

It would be nice if maybe a limited instrumentation architecture could
be put into qemu, that could be configured out.  It would save the various 
researchers the problem of everyone re-implementing it differently.

It would be nice to have:
   1. A way to dump an instruction trace (address, length (for CISC),
      and opcode, CPU# for multi-thread)
   2. A way to dump memory traces (address, length, possibly the value
      loaded/stored, CPU# for multi-thread)
   3. A way to dump basic-block entry/exit

Many of the various research metrics can be gained from these stats.
   #1 and #2 are enough for cache simulators.
   #1 (if post-processed) is enough to get a frequency plot for instruction
      count and type.
   #1 can be used to extrapolate branch-taken statistics for branch
      predictors
   #3 Can be used for basic block vectors, or to get faster instruction
      counts

I'm not sure if it's possible to do this in a non-intrusive way that would 
be acceptable to the other users of Qemu though.

Pin manages to have their null plugin run very fast; at least one
of the Spec2k binaries runs faster translated than it does natively.

Vince