From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=53688 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1PM3d8-0007gr-Qs
	for qemu-devel@nongnu.org; Fri, 26 Nov 2010 14:06:47 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paul@codesourcery.com>) id 1PM3d7-0006QD-I3
	for qemu-devel@nongnu.org; Fri, 26 Nov 2010 14:06:46 -0500
Received: from mail.codesourcery.com ([38.113.113.100]:52139)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paul@codesourcery.com>) id 1PM3d7-0006Q0-9o
	for qemu-devel@nongnu.org; Fri, 26 Nov 2010 14:06:45 -0500
From: Paul Brook <paul@codesourcery.com>
Subject: Re: [Qemu-devel] [RFC] Static instrumentation (aka guest code tracing)
Date: Fri, 26 Nov 2010 19:06:31 +0000
References: <86ocdj74qd.wl%lluis@ginnungagap.pc.ac.upc.edu>
In-Reply-To: <86ocdj74qd.wl%lluis@ginnungagap.pc.ac.upc.edu>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201011261906.32380.paul@codesourcery.com>
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Stefan Hajnoczi <stefanha@gmail.com>, Yufei Chen <cyfdecyf@gmail.com>, =?iso-8859-1?q?Llu=EDs?= <xscript@gmx.net>, Eduardo Cruz <eduardohmdacruz@gmail.com>, Jun Koi <junkoi2004@gmail.com>

> 2) instrumenting i386 is extremely time-consuming (for the developer)
> 
> As my work is not tied to a specific target architecture, I was thinking of
> shifting into PPC, as the ISA is pretty regular and that would certainly
> make the process easier by just patching a small set of places in the
> code.
> 
>... 
> The current example points are:
> 
> FETCH(vaddress, size, used_registers, defined_registers)

Duplicating the insn decoder to determine which registers are accessed is not 
a maintainable solution. Likewise requiring separate tracing hooks be added to 
the existing decoders is extremely unlikely to be a feasible long-term 
solution. Anything solution that tries to separate CPU instrumentation/tracing 
from code generation is IMO fundamentally flawed and will rapidly bitrot 
beyond usefulness.

I'd also posit that instrumenting changes in sate is of very limited use if 
you don't know what the new value is.

You almost certainly want to do this using the equivalent of a memory 
watchpoint on the CPUState structure.

Paul