From: KONRAD Frederic <fred.kon...@greensocs.com>
This introduces the basic reverse-execution mechanism.
Signed-off-by: KONRAD Frederic <fred.kon...@greensocs.com>
---
Makefile.target | 1 +
cpus.c | 6 +
include/reverse-execution.h | 41 ++++++
reverse-execution.c | 308 ++++++++++++++++++++++++++++++++++++++++++++
vl.c | 7 +-
5 files changed, 362 insertions(+), 1 deletion(-)
create mode 100644 include/reverse-execution.h
create mode 100644 reverse-execution.c
diff --git a/Makefile.target b/Makefile.target
index 137d0b0..a2cb224 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -120,6 +120,7 @@ endif #CONFIG_BSD_USER
# System emulator target
ifdef CONFIG_SOFTMMU
obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o numa.o
+obj-y += reverse-execution.o
obj-y += qtest.o
obj-y += hw/
obj-$(CONFIG_FDT) += device_tree.o
diff --git a/cpus.c b/cpus.c
index 9519711..f812564 100644
--- a/cpus.c
+++ b/cpus.c
@@ -63,6 +63,8 @@
#endif /* CONFIG_LINUX */
+#include "reverse-execution.h"
+
static CPUState *next_cpu;
bool cpu_is_stopped(CPUState *cpu)
@@ -600,7 +602,11 @@ static bool cpu_can_run(CPUState *cpu)
static void cpu_handle_guest_debug(CPUState *cpu)
{
+ if (rexec_is_continuing_backward()) {
+ rexec_step_done();
+ }
gdb_set_stop_cpu(cpu);
+ rexec_stop_stepping_back_mode();
qemu_system_debug_request();
cpu->stopped = true;
}
diff --git a/include/reverse-execution.h b/include/reverse-execution.h
new file mode 100644
index 0000000..9951549
--- /dev/null
+++ b/include/reverse-execution.h
@@ -0,0 +1,41 @@
+/*
+ * reverse execution.
+ *
+ * Copyright (C) 2014 : GreenSocs Ltd
+ * http://www.greensocs.com/ , email: i...@greensocs.com
+ *
+ * Developed by :
+ * Frederic Konrad <fred.kon...@greensocs.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#ifndef REVERSE_EXECUTION
+#define REVERSE_EXECUTION
+
+void rexec_setup(void);
+void rexec_step_backward(CPUState *cpu, uint64_t steps);
+void rexec_stop_stepping_back_mode(void);
+void rexec_continue_backward(CPUState *cpu);
+int rexec_is_continuing_backward(void);
+void rexec_next_reverse_continue_step(void);
+void rexec_stop_reverse_continue(void);
+void rexec_step_done(void);
+bool rexec_is_step_done(void);
+bool rexec_is_enabled(void);
+void rexec_cleanup(void);
+bool rexec_dbg_requested(void);
+
+#endif /* REVERSE_EXECUTION */
diff --git a/reverse-execution.c b/reverse-execution.c
new file mode 100644
index 0000000..4c97f39
--- /dev/null
+++ b/reverse-execution.c
@@ -0,0 +1,308 @@
+/*
+ * reverse execution.
+ *
+ * Copyright (C) 2014 : GreenSocs Ltd
+ * http://www.greensocs.com/ , email: i...@greensocs.com
+ *
+ * Developed by :
+ * Frederic Konrad <fred.kon...@greensocs.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "qemu/timer.h"
+#include "sysemu/sysemu.h"
+#include "migration/qemu-file.h"
+
+#include "reverse-execution.h"
+
+#include "trace.h" /* needed for trace event prototype */
+
+#define SNAPSHOT_FILENAME "snapshot-step"
+
+typedef struct snapshot_entry {
+ uint32_t id;
+ int64_t time;
+ QLIST_ENTRY(snapshot_entry) next;
+} snapshot_entry;
+
+static QLIST_HEAD(, snapshot_entry) snapshot =
QLIST_HEAD_INITIALIZER(snapshot);
+
+QEMUTimer *snapshot_timer;
+QEMUTimer *stop_timer;
+
+struct rexec_state {
+ bool stepping_back;
+ bool continue_backward_mode;
+ bool singlestep_was_enabled;
+ bool step_done;
+ bool stop_requested;
+};
+
+static bool rexec_enabled;
+struct rexec_state rexec_state;
+
+static snapshot_entry *new_snapshot(void)
+{
+ snapshot_entry *snap = NULL;
+ snap = g_malloc(sizeof(snapshot_entry));
+ assert(snap);
+
+ if (QLIST_FIRST(&snapshot) != NULL) {
+ snap->id = QLIST_FIRST(&snapshot)->id + 1;
+ } else {
+ snap->id = 0;
+ }
+
+ QLIST_INSERT_HEAD(&snapshot, snap, next);
+ return snap;
+}
+
+/*
+ * Timer callback called when a snapshot must be done.
+ */
+static void snap_callback(void *opaque)
+{
+ QEMUFile *file = NULL;
+ int saved_vm_running;
+ snapshot_entry *snap = NULL;
+ CPUArchState *cpu = NULL;
+ char filename[20];
+
+ cpu = qemu_get_cpu(0)->env_ptr;
+ assert(cpu != NULL);
+
+ if (!rexec_state.stepping_back) {
+ snap = new_snapshot();
+
+ saved_vm_running = runstate_is_running();
+ vm_stop(RUN_STATE_SAVE_VM);
+ snap->time = qemu_clock_get_ns(QEMU_CLOCK_ICOUNT);
+ sprintf(filename, "%s%04u", SNAPSHOT_FILENAME, snap->id);
+
+ trace_snap_callback(snap->time, filename);
+
+ file = qemu_fopen(filename, "wb");
+ qemu_savevm_state(file);
+ qemu_fclose(file);
+
+ if (saved_vm_running) {
+ vm_start();
+ }
+ timer_mod_ns(snapshot_timer, snap->time + 100000000);
+ }
+}
+
+/*
+ * Timer callback called when the VM have to stop.
+ */
+static void stop_callback(void *opaque)
+{
+ trace_stop_callback(qemu_clock_get_ns(QEMU_CLOCK_ICOUNT));
+ rexec_state.stop_requested = true;
+}
+
+void rexec_setup(void)
+{
+ snapshot_timer = timer_new_ns(QEMU_CLOCK_ICOUNT, snap_callback, NULL);
+ stop_timer = timer_new_ns(QEMU_CLOCK_ICOUNT, stop_callback, NULL);
+
+ timer_mod_ns(snapshot_timer, qemu_clock_get_ns(QEMU_CLOCK_ICOUNT));
+ rexec_enabled = true;
+ rexec_state.stepping_back = false;
+ rexec_state.continue_backward_mode = false;
+ rexec_state.stop_requested = false;
+}
+
+void rexec_stop_stepping_back_mode(void)
+{
+ if (rexec_state.stepping_back) {
+ singlestep = rexec_state.singlestep_was_enabled;
+ rexec_state.stepping_back = false;
+ }
+ rexec_state.stop_requested = false;
+}
+
+static void rexec_start_stepping_back_mode(CPUState *cpu)
+{
+ assert(!rexec_state.stepping_back);
+ /*
+ * Flushing tb.
+ * FIXME: might not be necessary with counter.
+ */
+ tb_flush(cpu->env_ptr);
+
+ /*
+ * Single step to the right PC.
+ */
+ rexec_state.singlestep_was_enabled = singlestep;
+ singlestep = 1;
+
+ rexec_state.stepping_back = true;
+}
+
+/**
+ * \func rexec_step_backward
+ * \param cpu GDBStub's cpu.
+ * \param steps Number of steps to step back.
+ * \brief Steps backward: "reverse-step" in GDB.
+ *
+ */
+void rexec_step_backward(CPUState *cpu, uint64_t steps)
+{
+ QEMUFile *file = NULL;
+ char filename[256];
+ snapshot_entry *snap = QLIST_FIRST(&snapshot);
+
+ int64_t stop_time = qemu_clock_get_ns(QEMU_CLOCK_ICOUNT)
+ - cpu_icount_to_ns(steps);
+
+ /*
+ * FIXME: Remove the file?
+ */
+ while ((stop_time > 0) && ((snap = QLIST_FIRST(&snapshot)) != NULL)
+ && (snap->time >= stop_time)) {
+ /*
+ * Remove the snapshot from the list and mod the snapshot timer to its
+ * time. This will cause the snapshot to be taken at the same value in
+ * case of a forward execution.
+ */
+ QLIST_REMOVE(snap, next);
+ timer_mod_ns(snapshot_timer, snap->time);
+ g_free(snap);
+ }
+
+ if ((stop_time <= 0) || (snap == NULL)) {
+ /*
+ * This happens when an instruction behind the first snapshot is asked.
+ * Just trigger a debug event so it won't move.
+ */
+ rexec_state.stop_requested = true;
+ vm_start();
+ return;
+ }
+
+ sprintf(filename, "%s%04u", SNAPSHOT_FILENAME, snap->id);
+
+ /*
+ * Load the previous state.
+ */
+ vm_stop(RUN_STATE_RESTORE_VM);
+
+ trace_rexec_step_backward(qemu_clock_get_ns(QEMU_CLOCK_ICOUNT), stop_time);
+
+ file = qemu_fopen(filename, "rb");
+ qemu_loadvm_state(file);
+ qemu_fclose(file);
+
+ /*
+ * Mod the timer so it will stop at the exact instruction.
+ */
+ timer_mod_ns(stop_timer, stop_time);
+
+ rexec_start_stepping_back_mode(cpu);
+ /*
+ * Restart the vm.
+ */
+ vm_start();
+}
+
+/**
+ * \func rexec_continue_backward
+ * \brief Continue execution backward.
+ * \param cpu GDB's stub cpu.
+ *
+ */
+void rexec_continue_backward(CPUState *cpu)
+{
+ rexec_state.continue_backward_mode = true;
+ rexec_state.step_done = false;
+ rexec_step_backward(cpu, 1);
+}
+
+/**
+ * \func rexec_is_continuing_backward
+ * \brief Check if we are continuing backward.
+ * \return Return true if we are continuing backward.
+ *
+ */
+int rexec_is_continuing_backward(void)
+{
+ return rexec_state.continue_backward_mode;
+}
+
+void rexec_next_reverse_continue_step(void)
+{
+ CPUState *cpu = qemu_get_cpu(0);
+
+ assert(cpu != NULL);
+ rexec_state.step_done = false;
+
+ /*
+ * FIXME:
+ * - Stop at breakpoint in reverse order.
+ * - The reverse execution speed is not constant as the snapshot
+ * replay is not constant.
+ */
+ rexec_step_backward(cpu, 10000000);
+}
+
+void rexec_stop_reverse_continue(void)
+{
+ if (rexec_state.continue_backward_mode) {
+ trace_rexec_stop_reverse_continue();
+ rexec_state.continue_backward_mode = false;
+ rexec_state.step_done = false;
+ rexec_stop_stepping_back_mode();
+ }
+}
+
+void rexec_step_done(void)
+{
+ rexec_state.step_done = true;
+}
+
+bool rexec_is_step_done(void)
+{
+ return rexec_state.step_done;
+}
+
+bool rexec_is_enabled(void)
+{
+ return rexec_enabled;
+}
+
+void rexec_cleanup(void)
+{
+ snapshot_entry *snap = QLIST_FIRST(&snapshot);
+
+ /*
+ * FIXME: Remove the file?
+ */
+ while ((snap = QLIST_FIRST(&snapshot)) != NULL) {
+ /*
+ * Remove the snapshot from the list and mod the snapshot timer to its
+ * time. This will cause the snapshot to be taken at the same value in
+ * case of a forward execution.
+ */
+ QLIST_REMOVE(snap, next);
+ g_free(snap);
+ }
+}
+
+bool rexec_dbg_requested(void)
+{
+ return rexec_state.stop_requested;
+}
diff --git a/vl.c b/vl.c
index 4fa732b..18df07c 100644
--- a/vl.c
+++ b/vl.c
@@ -119,6 +119,8 @@ int main(int argc, char **argv)
#include "qom/object_interfaces.h"
#include "qapi-event.h"
+#include "reverse-execution.h"
+
#define DEFAULT_RAM_SIZE 128
#define MAX_VIRTIO_CONSOLES 1
@@ -1967,7 +1969,7 @@ void qemu_system_debug_request(void)
static bool main_loop_should_exit(void)
{
RunState r;
- if (qemu_debug_requested()) {
+ if (qemu_debug_requested() && !rexec_is_continuing_backward()) {
vm_stop(RUN_STATE_DEBUG);
}
if (qemu_suspend_requested()) {
@@ -2017,6 +2019,9 @@ static void main_loop(void)
int64_t ti;
#endif
do {
+ if (rexec_is_continuing_backward() && rexec_is_step_done()) {
+ rexec_next_reverse_continue_step();
+ }
nonblocking = !kvm_enabled() && !xen_enabled() && last_io > 0;
#ifdef CONFIG_PROFILER
ti = profile_getclock();
--
1.9.0
