Experimental QEMU Non intrusive code coverage

Tools
1

I worked with the bots a bit and worked on a QEMU code coverage tool.

I have not reviewed this, but its a non intrusive qemu plugin that I was able to aggregate the code coverage from the rtems test suite.

This allows me to use the flight binary that would get linked, and the current the tests.

This should be general purpose for any processor.

When running QEMU you would add this extra line

PLUGIN=$QEMU_SRC/contrib/plugins/libqemu_rtems_cov.so
COV=./coverage
mkdir -p "$COV/raw"

ELF=/abs/path/to/mytest.exe
NAME=mytest

When calling QEMU you would add the plugin line. Each test would get its own NAME / elf file.

  -plugin "$PLUGIN,out=$COV/raw/$NAME.cov,mode=tb-insn,counts=1,test_id=$NAME,elf=$ELF" \
  -kernel "$ELF"

Once you have all your test coverage files you can combine them all together.

PATH="/path/to/toolchain/bin:$PATH" \      # dir with <prefix>addr2line / <prefix>objdump
  "$TOOLS/rtqcov_report.sh" \
    --raw-dir     "$COV/raw" \
    --source-root "$RTEMS_SRC" \
    --out-dir     "$COV" \
    --toolchain-prefix <prefix> \
    --arch <label>

I have generated full coverage reports for the microblaze test suite.
I would be interested in comparing against the full version.
Also I have only looked at branch coverage.

This was more of an idea experiment. I have not tried to cleanup the LLM output.

A more detailed guide for this is provided here.
code-coverage-guide.txt (14.8 KB)