[Qemu-devel] How is address of helper function for slow path calculated ?

[Qemu-devel] How is address of helper function for slow path calculated ?

[Gaurav Sharma]

[-- Attachment #1: Type: text/plain, Size: 1245 bytes --]

Hi,
I have been trying to trace the for how address translation is done for any
load/store instructions. I was trying to emulate arm on an x86-64 machine.
However, i need some clarifications :
1. During the slow path, qemu uses helper functions to translate address.
2. This is done by calling the function itself during the execution.
3. The host instrn for the slow path is added at the end of the TB block. I
tried a sample code and got the following host instrn :
0x2aaade72d120:  mov    %r14,%rdi
0x2aaade72d123:  xor    %edx,%edx
0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea
0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
0x2aaade72d136:  callq  *%r10         // Call helper function
0x2aaade72d139:  mov    %eax,%ebp
0x2aaade72d13b:  jmpq   0x2aaade72d0ea

3. How does it gets the address of the helper function :
    call instruction is added by ' tcg_out_calli(s,
(uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches the
address of the helper function.
However from the assembly generated, the address is calculated before :
tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
                     (uintptr_t)l->raddr)

How is the address for the helper function calculated ?

Thanks,
Gaurav

[-- Attachment #2: Type: text/html, Size: 1541 bytes --]

Re: [Qemu-devel] How is address of helper function for slow path calculated ?

[Peter Maydell]

On 26 February 2014 13:04, Gaurav Sharma <gauravs.2010@gmail.com> wrote:
> Hi,
> I have been trying to trace the for how address translation is done for any
> load/store instructions. I was trying to emulate arm on an x86-64 machine.
> However, i need some clarifications :
> 1. During the slow path, qemu uses helper functions to translate address.
> 2. This is done by calling the function itself during the execution.
> 3. The host instrn for the slow path is added at the end of the TB block. I
> tried a sample code and got the following host instrn :
> 0x2aaade72d120:  mov    %r14,%rdi
> 0x2aaade72d123:  xor    %edx,%edx
> 0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea
> 0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
> 0x2aaade72d136:  callq  *%r10         // Call helper function
> 0x2aaade72d139:  mov    %eax,%ebp
> 0x2aaade72d13b:  jmpq   0x2aaade72d0ea
>
> 3. How does it gets the address of the helper function :
>     call instruction is added by ' tcg_out_calli(s,
> (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches the
> address of the helper function.
> However from the assembly generated, the address is calculated before :
> tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
>                      (uintptr_t)l->raddr)

This is just loading the 4th argument for the helper function into ECX
(which is the return address in generated code which corresponds to
the load we're going to do). It's not related to the address of the
helper function at all.

> How is the address for the helper function calculated ?

You've just quoted the code that does it:
tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' ...)

tcg_out_calli spots that the displacement is too big for a call insn
and emits the
  0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
  0x2aaade72d136:  callq  *%r10         // Call helper function

thanks
-- PMM

Re: [Qemu-devel] How is address of helper function for slow path calculated ?

[Gaurav Sharma]

[-- Attachment #1: Type: text/plain, Size: 2317 bytes --]

Thanks Peter,
So, the following instruction only make up the call stack for the function
call :
0x2aaade72d120:  mov    %r14,%rdi
0x2aaade72d123:  xor    %edx,%edx
0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea

Thanks,
Gaurav


On Wed, Feb 26, 2014 at 6:44 PM, Peter Maydell <peter.maydell@linaro.org>wrote:

> On 26 February 2014 13:04, Gaurav Sharma <gauravs.2010@gmail.com> wrote:
> > Hi,
> > I have been trying to trace the for how address translation is done for
> any
> > load/store instructions. I was trying to emulate arm on an x86-64
> machine.
> > However, i need some clarifications :
> > 1. During the slow path, qemu uses helper functions to translate address.
> > 2. This is done by calling the function itself during the execution.
> > 3. The host instrn for the slow path is added at the end of the TB
> block. I
> > tried a sample code and got the following host instrn :
> > 0x2aaade72d120:  mov    %r14,%rdi
> > 0x2aaade72d123:  xor    %edx,%edx
> > 0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea
> > 0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
> > 0x2aaade72d136:  callq  *%r10         // Call helper function
> > 0x2aaade72d139:  mov    %eax,%ebp
> > 0x2aaade72d13b:  jmpq   0x2aaade72d0ea
> >
> > 3. How does it gets the address of the helper function :
> >     call instruction is added by ' tcg_out_calli(s,
> > (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches
> the
> > address of the helper function.
> > However from the assembly generated, the address is calculated before :
> > tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
> >                      (uintptr_t)l->raddr)
>
> This is just loading the 4th argument for the helper function into ECX
> (which is the return address in generated code which corresponds to
> the load we're going to do). It's not related to the address of the
> helper function at all.
>
> > How is the address for the helper function calculated ?
>
> You've just quoted the code that does it:
> tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' ...)
>
> tcg_out_calli spots that the displacement is too big for a call insn
> and emits the
>   0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
>   0x2aaade72d136:  callq  *%r10         // Call helper function
>
> thanks
> -- PMM
>

[-- Attachment #2: Type: text/html, Size: 3120 bytes --]

Re: [Qemu-devel] How is address of helper function for slow path calculated ?

[Peter Maydell]

On 26 February 2014 13:46, Gaurav Sharma <gauravs.2010@gmail.com> wrote:
> Thanks Peter,
> So, the following instruction only make up the call stack for the function
> call :
>
> 0x2aaade72d120:  mov    %r14,%rdi
> 0x2aaade72d123:  xor    %edx,%edx
> 0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea

This is nothing to do with the stack -- it's just setting up the arguments
for the function call. You probably want to find a reference to the x86_64
Linux calling convention which might make the code we're generating
make more sense to you.

-- PMM

Re: [Qemu-devel] How is address of helper function for slow path calculated ?

[Xuebing wang]

Somebody may concisely refer tcg as a disassembler + a compiler (assembler).

I guess your question is how to calculate the value of i386 register 
(%r10 in your case, the address for the helper function).

I might be wrong, my understanding is that it is calculated by the 
assembler (to generate the "generated code"), specifically functions 
tcg_gen_helper32() or tcg_gen_helper64(). Hope this helps.


On 02/26/2014 09:14 PM, Peter Maydell wrote:
> On 26 February 2014 13:04, Gaurav Sharma <gauravs.2010@gmail.com> wrote:
>> Hi,
>> I have been trying to trace the for how address translation is done for any
>> load/store instructions. I was trying to emulate arm on an x86-64 machine.
>> However, i need some clarifications :
>> 1. During the slow path, qemu uses helper functions to translate address.
>> 2. This is done by calling the function itself during the execution.
>> 3. The host instrn for the slow path is added at the end of the TB block. I
>> tried a sample code and got the following host instrn :
>> 0x2aaade72d120:  mov    %r14,%rdi
>> 0x2aaade72d123:  xor    %edx,%edx
>> 0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea
>> 0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
>> 0x2aaade72d136:  callq  *%r10         // Call helper function
>> 0x2aaade72d139:  mov    %eax,%ebp
>> 0x2aaade72d13b:  jmpq   0x2aaade72d0ea
>>
>> 3. How does it gets the address of the helper function :
>>      call instruction is added by ' tcg_out_calli(s,
>> (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches the
>> address of the helper function.
>> However from the assembly generated, the address is calculated before :
>> tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
>>                       (uintptr_t)l->raddr)
> This is just loading the 4th argument for the helper function into ECX
> (which is the return address in generated code which corresponds to
> the load we're going to do). It's not related to the address of the
> helper function at all.
>
>> How is the address for the helper function calculated ?
> You've just quoted the code that does it:
> tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' ...)
>
> tcg_out_calli spots that the displacement is too big for a call insn
> and emits the
>    0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
>    0x2aaade72d136:  callq  *%r10         // Call helper function
>
> thanks
> -- PMM
>
>

-- 
Thanks,
Xuebing Wang