| 1 | /* |
| 2 | * Copyright 2006 Sun Microsystems, Inc. All rights reserved. |
| 3 | * Use is subject to license terms. |
| 4 | */ |
| 5 | #pragma ident "@(#)README.coverage 1.3 06/10/25 SMI" |
| 6 | |
| 7 | ## |
| 8 | ## Code Coverage support in legion (coverage) |
| 9 | ## |
| 10 | ## This explains how to enable and use the coverage tool set. |
| 11 | ## |
| 12 | |
| 13 | [-] Enabling this Feature: |
| 14 | |
| 15 | See README.debug_hook for the overview of the debug_hook feature. |
| 16 | |
| 17 | [-] Coverage Analysis: |
| 18 | |
| 19 | Description: |
| 20 | This feature allows you to specify a range of %pc values for which you |
| 21 | want to gather coverage data (ie. count the number of times each %pc |
| 22 | is executed). |
| 23 | |
| 24 | Format: |
| 25 | * debug_hook [coverage] [start] [end]; |
| 26 | * |
| 27 | * [coverage] - we've already parsed this. That's how we got here. |
| 28 | * [datafile] - name of the file to mmap (will contain coverage data) |
| 29 | * [start] |
| 30 | * [end] - only trace when %pc is within [start]-[end] range |
| 31 | * |
| 32 | * All samples for %pc within the range supplied will be stored |
| 33 | * in a data file (using the name provided in the directive). The |
| 34 | * results of the coverage run can be viewed by running the |
| 35 | * coverage_dump tool (in the build directory) at any time during |
| 36 | * or after the run. |
| 37 | * NOTE: this feature expects to create the datafile and will not |
| 38 | * overwrite an existing one. |
| 39 | |
| 40 | Examples: |
| 41 | processor "niagara" { |
| 42 | clkfreq 5000000 ; |
| 43 | cores 1; |
| 44 | vthreads 1; |
| 45 | nglobals 4; |
| 46 | nwins 8; |
| 47 | rstv 0xfff0000020; |
| 48 | maxtl 7; |
| 49 | |
| 50 | // gather coverage for all hypervisor %pc ranges |
| 51 | // and store the data in a file called datafile. |
| 52 | debug_hook coverage datafile 0x100000 0x900000; |
| 53 | } |
| 54 | |
| 55 | Viewing Data: |
| 56 | All of the coverage data gets written to a datafile, the name of |
| 57 | which is passed in as part of the config file. This file will |
| 58 | contain the following format: |
| 59 | Index: %pc: Ref_Cnt: Raw_Instn: Decoded_Instn |
| 60 | |
| 61 | There is a tool called coverage_dump which is provided in the build |
| 62 | directory which can dump this datafile. |
| 63 | see coverage_dump -h for more information |
| 64 | |
| 65 | Getting coverage data for Hypervisor: |
| 66 | The coverage_dump tool will take the data that legion has written to |
| 67 | your datafile and dump out raw coverage statistics for that range of |
| 68 | %pc's. You can then use the coverage.pl script to analyze the raw |
| 69 | data and to map it the dis-assembly output of your hypervisor. To do |
| 70 | this you will need: |
| 71 | |
| 72 | 1) add the coverage debug_hook in your legion config file (as |
| 73 | shown above). Ensure that your range of addresses maps to the |
| 74 | range where hypervisor runs from. |
| 75 | |
| 76 | 2) boot legion and run whatever workload you are interested in using |
| 77 | to exercise hypervisor (boot 4vvs, boot Solaris, trigger some error |
| 78 | traps to exercise the error code paths) |
| 79 | |
| 80 | 3) When legion is finished, run the coverage_dump utility passing it |
| 81 | the name of your datafile eg: |
| 82 | ./coverage_dump -v datafile > coverage.log |
| 83 | |
| 84 | 4) get a dis-assembly of your current hypervisor (the q.bin is not |
| 85 | sufficient here, you will need the q binary that gets built in |
| 86 | the same binary as your q.bin. |
| 87 | eg: |
| 88 | /usr/ccs/bin/dis q > q.dis |
| 89 | If you have not built your own hypervisor, you can find the |
| 90 | appropriate q binary from the gates section of the snapshot |
| 91 | release directory. |
| 92 | (eg. /net/sunvx.sfbay/export/snapshot/sun4v_29/gates/hv-rock/src/rock/hypervisor/legion/q) |
| 93 | |
| 94 | 5) run the coverage.pl script provided with legion. It expects to |
| 95 | find a coverage.log and a q.dis file (as shown above) and it |
| 96 | will create output files with the names coverage.txt and |
| 97 | coverage.html. |
| 98 | You need to specify the processor type [n1|n2|rock] |
| 99 | eg: |
| 100 | ./coverage.pl rock |
| 101 | |
| 102 | 6) You can now examine either the coverage.txt or coverage.html |
| 103 | files to see which code paths in hypervisor were executed. |
| 104 | |
| 105 | Modifying Source: |
| 106 | The source for the coverage feature is contained in |
| 107 | src/procs/sunsparc/debug/coverage.c |
| 108 | src/procs/sunsparc/debug/tools/coverage_dump.c |
| 109 | src/procs/sunsparc/debug/tools/coverage.pl |
| 110 | |