| tcg-plugins.rst (8b6269c8ec14b9213dd22200c1c05aaecd6cbb9d) | tcg-plugins.rst (c17a386b6afe608086aa4d260e29662865680b7f) |
|---|---|
| 1.. 2 Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 3 Copyright (c) 2019, Linaro Limited 4 Written by Emilio Cota and Alex Bennée 5 6================ 7QEMU TCG Plugins 8================ --- 120 unchanged lines hidden (view full) --- 129RCU is great for this. 130 131We support the uninstallation of a plugin at any time (e.g. from 132plugin callbacks). This allows plugins to remove themselves if they no 133longer want to instrument the code. This operation is asynchronous 134which means callbacks may still occur after the uninstall operation is 135requested. The plugin isn't completely uninstalled until the safe work 136has executed while all vCPUs are quiescent. | 1.. 2 Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 3 Copyright (c) 2019, Linaro Limited 4 Written by Emilio Cota and Alex Bennée 5 6================ 7QEMU TCG Plugins 8================ --- 120 unchanged lines hidden (view full) --- 129RCU is great for this. 130 131We support the uninstallation of a plugin at any time (e.g. from 132plugin callbacks). This allows plugins to remove themselves if they no 133longer want to instrument the code. This operation is asynchronous 134which means callbacks may still occur after the uninstall operation is 135requested. The plugin isn't completely uninstalled until the safe work 136has executed while all vCPUs are quiescent. |
| 137 138Example Plugins 139=============== 140 141There are a number of plugins included with QEMU and you are 142encouraged to contribute your own plugins plugins upstream. There is a 143`contrib/plugins` directory where they can go. 144 145- tests/plugins 146 147These are some basic plugins that are used to test and exercise the 148API during the `make check-tcg` target. 149 150- contrib/plugins/hotblocks.c 151 152The hotblocks plugin allows you to examine the where hot paths of 153execution are in your program. Once the program has finished you will 154get a sorted list of blocks reporting the starting PC, translation 155count, number of instructions and execution count. This will work best 156with linux-user execution as system emulation tends to generate 157re-translations as blocks from different programs get swapped in and 158out of system memory. 159 160If your program is single-threaded you can use the `inline` option for 161slightly faster (but not thread safe) counters. 162 163Example:: 164 165 ./aarch64-linux-user/qemu-aarch64 \ 166 -plugin contrib/plugins/libhotblocks.so -d plugin \ 167 ./tests/tcg/aarch64-linux-user/sha1 168 SHA1=15dd99a1991e0b3826fede3deffc1feba42278e6 169 collected 903 entries in the hash table 170 pc, tcount, icount, ecount 171 0x0000000041ed10, 1, 5, 66087 172 0x000000004002b0, 1, 4, 66087 173 ... 174 175- contrib/plugins/hotpages.c 176 177Similar to hotblocks but this time tracks memory accesses:: 178 179 ./aarch64-linux-user/qemu-aarch64 \ 180 -plugin contrib/plugins/libhotpages.so -d plugin \ 181 ./tests/tcg/aarch64-linux-user/sha1 182 SHA1=15dd99a1991e0b3826fede3deffc1feba42278e6 183 Addr, RCPUs, Reads, WCPUs, Writes 184 0x000055007fe000, 0x0001, 31747952, 0x0001, 8835161 185 0x000055007ff000, 0x0001, 29001054, 0x0001, 8780625 186 0x00005500800000, 0x0001, 687465, 0x0001, 335857 187 0x0000000048b000, 0x0001, 130594, 0x0001, 355 188 0x0000000048a000, 0x0001, 1826, 0x0001, 11 189 190- contrib/plugins/howvec.c 191 192This is an instruction classifier so can be used to count different 193types of instructions. It has a number of options to refine which get 194counted. You can give an argument for a class of instructions to break 195it down fully, so for example to see all the system registers 196accesses:: 197 198 ./aarch64-softmmu/qemu-system-aarch64 $(QEMU_ARGS) \ 199 -append "root=/dev/sda2 systemd.unit=benchmark.service" \ 200 -smp 4 -plugin ./contrib/plugins/libhowvec.so,arg=sreg -d plugin 201 202which will lead to a sorted list after the class breakdown:: 203 204 Instruction Classes: 205 Class: UDEF not counted 206 Class: SVE (68 hits) 207 Class: PCrel addr (47789483 hits) 208 Class: Add/Sub (imm) (192817388 hits) 209 Class: Logical (imm) (93852565 hits) 210 Class: Move Wide (imm) (76398116 hits) 211 Class: Bitfield (44706084 hits) 212 Class: Extract (5499257 hits) 213 Class: Cond Branch (imm) (147202932 hits) 214 Class: Exception Gen (193581 hits) 215 Class: NOP not counted 216 Class: Hints (6652291 hits) 217 Class: Barriers (8001661 hits) 218 Class: PSTATE (1801695 hits) 219 Class: System Insn (6385349 hits) 220 Class: System Reg counted individually 221 Class: Branch (reg) (69497127 hits) 222 Class: Branch (imm) (84393665 hits) 223 Class: Cmp & Branch (110929659 hits) 224 Class: Tst & Branch (44681442 hits) 225 Class: AdvSimd ldstmult (736 hits) 226 Class: ldst excl (9098783 hits) 227 Class: Load Reg (lit) (87189424 hits) 228 Class: ldst noalloc pair (3264433 hits) 229 Class: ldst pair (412526434 hits) 230 Class: ldst reg (imm) (314734576 hits) 231 Class: Loads & Stores (2117774 hits) 232 Class: Data Proc Reg (223519077 hits) 233 Class: Scalar FP (31657954 hits) 234 Individual Instructions: 235 Instr: mrs x0, sp_el0 (2682661 hits) (op=0xd5384100/ System Reg) 236 Instr: mrs x1, tpidr_el2 (1789339 hits) (op=0xd53cd041/ System Reg) 237 Instr: mrs x2, tpidr_el2 (1513494 hits) (op=0xd53cd042/ System Reg) 238 Instr: mrs x0, tpidr_el2 (1490823 hits) (op=0xd53cd040/ System Reg) 239 Instr: mrs x1, sp_el0 (933793 hits) (op=0xd5384101/ System Reg) 240 Instr: mrs x2, sp_el0 (699516 hits) (op=0xd5384102/ System Reg) 241 Instr: mrs x4, tpidr_el2 (528437 hits) (op=0xd53cd044/ System Reg) 242 Instr: mrs x30, ttbr1_el1 (480776 hits) (op=0xd538203e/ System Reg) 243 Instr: msr ttbr1_el1, x30 (480713 hits) (op=0xd518203e/ System Reg) 244 Instr: msr vbar_el1, x30 (480671 hits) (op=0xd518c01e/ System Reg) 245 ... 246 247To find the argument shorthand for the class you need to examine the 248source code of the plugin at the moment, specifically the `*opt` 249argument in the InsnClassExecCount tables. 250 251- contrib/plugins/lockstep.c 252 253This is a debugging tool for developers who want to find out when and 254where execution diverges after a subtle change to TCG code generation. 255It is not an exact science and results are likely to be mixed once 256asynchronous events are introduced. While the use of -icount can 257introduce determinism to the execution flow it doesn't always follow 258the translation sequence will be exactly the same. Typically this is 259caused by a timer firing to service the GUI causing a block to end 260early. However in some cases it has proved to be useful in pointing 261people at roughly where execution diverges. The only argument you need 262for the plugin is a path for the socket the two instances will 263communicate over:: 264 265 266 ./sparc-softmmu/qemu-system-sparc -monitor none -parallel none \ 267 -net none -M SS-20 -m 256 -kernel day11/zImage.elf \ 268 -plugin ./contrib/plugins/liblockstep.so,arg=lockstep-sparc.sock \ 269 -d plugin,nochain 270 271which will eventually report:: 272 273 qemu-system-sparc: warning: nic lance.0 has no peer 274 @ 0x000000ffd06678 vs 0x000000ffd001e0 (2/1 since last) 275 @ 0x000000ffd07d9c vs 0x000000ffd06678 (3/1 since last) 276 Δ insn_count @ 0x000000ffd07d9c (809900609) vs 0x000000ffd06678 (809900612) 277 previously @ 0x000000ffd06678/10 (809900609 insns) 278 previously @ 0x000000ffd001e0/4 (809900599 insns) 279 previously @ 0x000000ffd080ac/2 (809900595 insns) 280 previously @ 0x000000ffd08098/5 (809900593 insns) 281 previously @ 0x000000ffd080c0/1 (809900588 insns) 282 |
|