Profiling with QEMU

Sometimes it is useful to get more information from the simulator than the one GDB has access to. There are a few ways to obtain more information.

Enhanced logging

To enable logging, it is necessary to provide the enabled log levels with the -d flag. Some of the more relevant ones are:

in_asm          show target assembly code for each compiled TB
nochain         do not chain compiled TBs so that "exec" and "cpu" show complete traces
exec            show trace before each executed TB (lots of logs)
cpu             show CPU registers before entering a TB (lots of logs)
fpu             include FPU registers in the 'cpu' logging
int             show interrupts/exceptions in short format
mmu             log MMU-related activities
unimp           log unimplemented functionality

To get a complete listing, run qemu-system-arc -d help Use -D <logfile> to dump the logs into a file instead of stdout.

Tracing

QEMU provides a tracing infrastructure which may help in debugging or analyzing what happens within a simulation cycle. At this moment, there are two tracers added into ARC backend, one for MMU operations, and the other for exceptions:

# mmu.c
mmu_command(uint32_t address, const char *command, uint32_t pd0, uint32_t pd1) "[MMU] at 0x%08x, CMD=%s, PD0=0x%08x, PD1=0x%08x"

# helper.c
excp_info(uint32_t address, const char *name) "[IRQ] at 0x08, Exception=%s"

To run this tracing:

1. Build with the --enable-trace-backends=simple configure parameter:
2. Create a file with the events you want to trace. For example:

$ cat > events.trc << 'EOF'
mmu_command
excp_info
EOF

3. Run the virtual machine to produce a trace file:

qemu-system-arc --trace events=events.trc ... # your normal QEMU invocation

4. Pretty-print the binary trace file:

$QEMU_SRC/scripts/simpletrace.py $QEMU_SRC/target/arc/trace-events trace-* # Override * with QEMU <pid>