Re: [Qemu-devel] TCG flow vs dyngen

[Peter Maydell]

2011/1/23 Rob Landley <address@hidden>:
> Keep in mind I'm a bit rusty and not an expert, but I'll give a stab at
> answering:

...here's a couple of clarifications:

>> 2. "how can I check the number of target cpu cycles or target
>> instructions executed inside qemu-user (i.e. qemu-ppc)?

> You can't, because QEMU doesn't work that way. QEMU isn't an
> instruction level emulator, it's closer to a Java JIT.

Being a JIT doesn't prohibit counting target instructions executed.
It just means that counting them generally requires generating
code to do the counting at runtime, so it's a more complicated
change to make than it would be in a non-JIT emulator.

The major reason for not counting cycles is that for an emulation
of a modern CPU this is pretty nearly impossible: the number
of cycles an instruction takes can depend on whether it causes
a cache miss, which CPU internal pipeline it uses, whether it
needs to stall waiting for a result from an earlier insn, whether
the CPU correctly predicted the branch leading up to it or not,
and on and on. You would need to precisely model all the
internals of each variant of each CPU, which would be a
mammoth undertaking requiring probably unpublished internal
data, and if you ever managed to finish it then it would run
incredibly slowly and would probably contain enough bugs you
couldn't trust the data it gave you anyway.

> This means that QEMU can
> no longer run on a type of host it can't execute target code for

This isn't correct; for instance there's hppa support in TCG for hppa
hosts but no hppa target support, and there's sh4 target support
but no TCG backend for it. The two ends are cleanly separated in
qemu and don't generally depend on each other.

-- PMM