Adding a function to dump the Nth hottest TBs.
The block PC, execution count and ops is dump to the log.

Signed-off-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
---
 accel/tcg/translate-all.c | 45 +++++++++++++++++++++++++++++++++++++++
 include/exec/exec-all.h   |  2 ++
 2 files changed, 47 insertions(+)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index f7e99f90e0..c3d9ecb2c4 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -1240,6 +1240,27 @@ static gboolean tb_host_size_iter(gpointer key, gpointer value, gpointer data)
     return false;
 }
 
+static void tb_dump_statistics(TBStatistics *tbs)
+{
+    uint32_t cflags = curr_cflags() | CF_NOCACHE;
+    int old_log_flags = qemu_loglevel;
+
+    qemu_set_log(CPU_LOG_TB_OP_OPT);
+
+    qemu_log("\n------------------------------\n");
+    qemu_log("Translation Block PC: \t0x"TARGET_FMT_lx "\n", tbs->pc);
+    qemu_log("Execution Count: \t%lu\n\n", (uint64_t) (tbs->exec_count + tbs->exec_count_overflows*0xFFFFFFFF));
+
+    mmap_lock();
+    TranslationBlock *tb = tb_gen_code(current_cpu, tbs->pc, tbs->cs_base, tbs->flags, cflags);
+    tb_phys_invalidate(tb, -1);
+    mmap_unlock();
+
+    qemu_set_log(old_log_flags);
+
+    tcg_tb_remove(tb);
+}
+
 /* flush all the translation blocks */
 static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
 {
@@ -1276,6 +1297,30 @@ done:
     mmap_unlock();
 }
 
+static gint inverse_sort_tbs(gconstpointer p1, gconstpointer p2) 
+{
+    const TBStatistics *tbs1 = (TBStatistics *) p1;
+    const TBStatistics *tbs2 = (TBStatistics *) p2;
+    uint64_t p1_count = (uint64_t) (tbs1->exec_count + tbs1->exec_count_overflows*0xFFFFFFFF);
+    uint64_t p2_count = (uint64_t) (tbs2->exec_count + tbs2->exec_count_overflows*0xFFFFFFFF);
+
+    return p1_count < p2_count ? 1 : p1_count == p2_count ? 0 : -1;
+}
+
+void tb_dump_exec_freq(uint32_t max_tbs_to_print)
+{
+    tb_ctx.tb_statistics = g_list_sort(tb_ctx.tb_statistics, inverse_sort_tbs);
+
+    uint32_t tbs_printed = 0;
+    for (GList *i = tb_ctx.tb_statistics; i != NULL; i = i->next) {
+        tbs_printed++;
+	    tb_dump_statistics((TBStatistics *) i->data);
+        if (max_tbs_to_print != 0 && tbs_printed >= max_tbs_to_print) {
+            break;
+        }
+    }
+}
+
 void tb_flush(CPUState *cpu)
 {
     if (tcg_enabled()) {
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 359100ef3b..0547db0271 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -533,4 +533,6 @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
 /* vl.c */
 extern int singlestep;
 
+void tb_dump_exec_freq(uint32_t);
+
 #endif
-- 
2.22.0

vandersonmr <vandersonmr2@gmail.com> writes:

> Adding a function to dump the Nth hottest TBs.
> The block PC, execution count and ops is dump to the log.
>
> Signed-off-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
> ---
>  accel/tcg/translate-all.c | 45 +++++++++++++++++++++++++++++++++++++++
>  include/exec/exec-all.h   |  2 ++
>  2 files changed, 47 insertions(+)
>
> diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
> index f7e99f90e0..c3d9ecb2c4 100644
> --- a/accel/tcg/translate-all.c
> +++ b/accel/tcg/translate-all.c
> @@ -1240,6 +1240,27 @@ static gboolean tb_host_size_iter(gpointer key, gpointer value, gpointer data)
>      return false;
>  }
>
> +static void tb_dump_statistics(TBStatistics *tbs)
> +{
> +    uint32_t cflags = curr_cflags() | CF_NOCACHE;
> +    int old_log_flags = qemu_loglevel;
> +
> +    qemu_set_log(CPU_LOG_TB_OP_OPT);

I think you need to split your approach here. Once you are dealing with
interactive exploration you'll want to dump a given block with whatever
flags you want (in_asm,op,op_opt,out_asm are all relevant). So maybe
something like:

 (qemu) info tb 0xffff07ff7ee in_asm,out_asm


> +
> +    qemu_log("\n------------------------------\n");
> +    qemu_log("Translation Block PC: \t0x"TARGET_FMT_lx "\n", tbs->pc);
> +    qemu_log("Execution Count: \t%lu\n\n", (uint64_t)
> (tbs->exec_count + tbs->exec_count_overflows*0xFFFFFFFF));

For the monitor qemu_printf() would be the right output. Given they are
the same prototype you can pass a function pointer to the lowest level
function depending on if you are coming from the logging path or the
HMP. However redirecting the qemu_log output is the tricky bit.

> +
> +    mmap_lock();
> +    TranslationBlock *tb = tb_gen_code(current_cpu, tbs->pc, tbs->cs_base, tbs->flags, cflags);
> +    tb_phys_invalidate(tb, -1);
> +    mmap_unlock();
> +
> +    qemu_set_log(old_log_flags);

As we are manipulating the flags we'll want to make sure the rest of the
system isn't doing anything at this point. Currently that is the case on
exit() from a linux-user program but again for interactive use we'll
need to ensure we are running as safe_work (like tb_flush does).

> +
> +    tcg_tb_remove(tb);
> +}
> +
>  /* flush all the translation blocks */
>  static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
>  {
> @@ -1276,6 +1297,30 @@ done:
>      mmap_unlock();
>  }
>
> +static gint inverse_sort_tbs(gconstpointer p1, gconstpointer p2)
> +{
> +    const TBStatistics *tbs1 = (TBStatistics *) p1;
> +    const TBStatistics *tbs2 = (TBStatistics *) p2;
> +    uint64_t p1_count = (uint64_t) (tbs1->exec_count + tbs1->exec_count_overflows*0xFFFFFFFF);
> +    uint64_t p2_count = (uint64_t) (tbs2->exec_count + tbs2->exec_count_overflows*0xFFFFFFFF);
> +
> +    return p1_count < p2_count ? 1 : p1_count == p2_count ? 0 : -1;
> +}
> +
> +void tb_dump_exec_freq(uint32_t max_tbs_to_print)
> +{
> +    tb_ctx.tb_statistics = g_list_sort(tb_ctx.tb_statistics, inverse_sort_tbs);
> +
> +    uint32_t tbs_printed = 0;
> +    for (GList *i = tb_ctx.tb_statistics; i != NULL; i = i->next) {
> +        tbs_printed++;
> +	    tb_dump_statistics((TBStatistics *) i->data);
> +        if (max_tbs_to_print != 0 && tbs_printed >= max_tbs_to_print) {
> +            break;
> +        }
> +    }
> +}
> +
>  void tb_flush(CPUState *cpu)
>  {
>      if (tcg_enabled()) {
> diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
> index 359100ef3b..0547db0271 100644
> --- a/include/exec/exec-all.h
> +++ b/include/exec/exec-all.h
> @@ -533,4 +533,6 @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
>  /* vl.c */
>  extern int singlestep;
>
> +void tb_dump_exec_freq(uint32_t);
> +
>  #endif


--
Alex Bennée