Hi All, Thanks for all the good advice! I do not have the HW and so I need an emulator. Also the target arch is not x86, it has to be some RISC (ARM, PPC). I would like to run an OS, say Linux, and take a sample for a small period of time (seconds) while some app(s) are running and get a list of opcode names and how many times they were executed. I'm not interested in CPI at the moment. Vince, I briefly read your paper and went through the patch . It is very interesting and maybe i can use it for what i need. Questions: - Is there a 1-1 correspondence between a BBV and a target CPU opcode? - If i use the QEMU to generate BBVs, and the other tools you mentioned that gets BBV as input, will i be able to see the opcode name (and not just a uniqe ID that goes with BBV) - Paul mentioned "With either alternative you'll still have issues with exceptions. MMU faults abort a TB early, so will screw up your statistics. One possibility is to terminate a TB on every memory access, like we do for watchpoints." - is this an issue addressed by your patch? Thanks, Chief - - On 5/22/08, Glauber > > > >> is compiled JIT and runs natively). > > > > Is an actual emulator necessary, or could you use something like an > > instrumented UML kernel? I'd think that would be a much simpler approach. > > > Since he claims to need opcode statistics, and UML won't trap any > instruction but the privileged ones, does not seem feasible. > > > -- > Glauber Costa. > "Free as in Freedom" > http://glommer.net > > "The less confident you are, the more serious you have to act." > > >