From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:51613) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UZmbq-0005Gk-OJ for qemu-devel@nongnu.org; Tue, 07 May 2013 14:27:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UZmbp-0006ia-C1 for qemu-devel@nongnu.org; Tue, 07 May 2013 14:27:30 -0400 Received: from greensocs.com ([87.106.252.221]:33475 helo=s15328186.onlinehome-server.info) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UZmbp-0006iN-6O for qemu-devel@nongnu.org; Tue, 07 May 2013 14:27:29 -0400 Received: from localhost (unknown [127.0.0.1]) by s15328186.onlinehome-server.info (Postfix) with ESMTP id 8E7C240EC69 for ; Tue, 7 May 2013 18:27:27 +0000 (UTC) Message-ID: <5189478C.8090405@greensocs.com> Date: Tue, 07 May 2013 20:27:24 +0200 From: =?ISO-8859-1?Q?KONRAD_Fr=E9d=E9ric?= MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [RFC] reverse execution. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel Cc: Mark Burton , fred.konrad@greensocs.com Hi, We are trying to find a way to do reverse execution happen with QEMU. Actually, it is possible to debug the guest through the gdbstub, we want to make the reverse execution possible with GDB as well. How we are trying to make that working (basically without optimisation): -QEMU takes regular snapshot of the VM: that can be done with the save vm code without optimisation first. -When the VM is stopped and GDB requests a reverse-step: load the last snapshot and replay to one instruction before the current PC. There are one issue with that for now (for a basic running reverse execution): -How to stop one instruction before the actual PC. We though that using "-icount" and stop the guest a little time before the actual position would give us the right behavior (We use a qemu_timer with vm_clock to stop the vm at the good time), but it seems that it is not deterministic, and not reproducable. Is that normal? We don't make any input during the replay, and we though that it can be caused by some timer interruption but "-icount" is using a virtual timer as I understand? We have two other ideas: -Using TCI and count each instruction executed by the processor, then stop one instruction before the actual position. This seems slower. -Using single-step to count each instruction, then stop one instruction before the actual position. Would that be better? For now we can restore the VM from the last snapshot, when we do a reverse-step but we can't stop at the exact position. Thanks, Fred