Re: [Qemu-devel] icount and tb chaining

[James Greensky]

On Thu, Jan 19, 2012 at 2:32 AM, 陳韋任 <address@hidden> wrote:
>> What i mean here is that in gen-icount.h, the icount_decr.u32 field is
>> exhausted and jumps out to the cpu-exec loop. This is where you would
>> fall into tb_add_jump with the second argument being 2, and only if
>> icount_extra was greater than zero. This is what I meant, and
>> previously you showed me that the chaining is left intact by the check
>> in tb_add_jump. Hope this is clearer. -Jim
>
>  I am not familiar with icount stuff, so some dunmp questions here. In
> gen_icount_start (gen-icount.h), it loads icount_decr.u32 into count,
> then subtracts 0xdeadbeef from count, finally stores count back to
> icount_decr.u16.low.
>
>  1) Why subtract 0xdeadbeef from count? Does 0xdeadbeef have any meaning?
>
>  2) Why store count back to icount_decr.u16.low rather than icount_decr.u32?
>
> In cpu_exec (cpu-exec.c),
>
>  // Does insns_left means how many guest instructions left in tb and needed
>  // to be executed?
>  insns_left = env->icount_decr.u32;
>
>  // what the if-branch means, in particular icount_extra? I guess it has
>  // something to do with Qemu timer, but not sure.
>  if (env->icount_extra && insns_left >= 0) {
>
>    // I cannot figure out what's going on here. Could you shed light on it?
>
>  } else {
>  }
>
>
>  Many thanks! :)
>
> Regards,
> chenwj
>
> --
> Wei-Ren Chen (陳韋任)
> Computer Systems Lab, Institute of Information Science,
> Academia Sinica, Taiwan (R.O.C.)
> Tel:886-2-2788-3799 #1667
> Homepage: http://people.cs.nctu.edu.tw/~chenwj

1) 0xdeadbeef is the argument value that will be overwritten in
gen_icount_end with the real number of instruction translated in this
block, num_insns. If you notice, the argument is saved in icount_arg
and it value is replaced.

2) Only the low bits are used for the instruction counting, once the
low bits are exhausted, they will be refilled in the cpu_exec loop.
The high bits are used to indicate an interrupt has occurred, you can
see them set in cpu_interrup of exec.c. They indicate an interrupt is
waiting, and the test in the beginning of a translation block can jump
out of the loop with a simple check to see if the value is below zero,
as the count is a signed value.

>  // Does insns_left means how many guest instructions left in tb and needed
>  // to be executed?

No, insns_left are number of instruction left in qemu_icount over what
can be stored in the low bits of icount_decr. look at qemu_cpu_exec of
cpus.c

This is my understanding. -Jim