[Qemu-discuss] Imprecise instruction count when compared to real hardware

[Humberto \"SilverOne\" Carvalho]

Hi!
I'm looking to compute the exact number of executed instructions in Qemu
for userland arm binaries.

To do this, i added my own counter (an unsigned long) on the TCG translator
loop in accel/tcg/translator.c.
The counter is incremented in the translator_loop function on line 69 (next
to dv->num_insns++;)
At the end of program execution, the total number of instructions is
printed.

Next, i compile a set of benchmarks and execute them on qemu-arm and a
cortex A9 platform. I use perf to measure the number of cycles on the arm
A9 processor.

Using this method Qemu has an average absolute error of 3%, although the
maximum error on one test was -18%. Qemu will generally underestimate the
number of executed instructions but can sometimes overestimate by up to 3%.

My goal is to understand why the number of executed instructions is not
100% accurate.
I understand TCG performs a couple of optimizations. However, this does not
explain the cases where Qemu overestimates, leading me to believe there may
be other motives for the lack of accuracy.

Best Regards,
SilverOne