Re: [Qemu-devel] Question about io_writex()

[Peter Maydell <peter.maydell@linaro.org>]

On 15 May 2018 at 02:26, Eva Chen <debby83729@gmail.com> wrote:
> Hello,
>
> I want to know the flow of how devices read/write function be called by
> code_gen_buffer().
> Take pl110_write() for example, I set a breakpoint in  pl110_write(), and
> the backtrace shows bellow.

Hi. This code flow is a bit complicated. You'll probably find
your backtraces give you better information if you build QEMU
without optimization (pass --enable-debug to configure). Then
you won't get all those <optimized out> things for parameters
in the backtrace, and the compiler will also be less likely to
confusingly inline functions.

> This backtrace shows that pl110_write() is called by io_wrtex(), but I
> can't find who call the io_writex().

io_writex() is called by functions in accel/tcg/softmmu_template.h.
These are a bit tricky because we include this header file multiple
times and use the C preprocessor to construct function names, like:

static inline void glue(io_write, SUFFIX)(CPUArchState *env,
                                          size_t mmu_idx, size_t index,
                                          DATA_TYPE val,
                                          target_ulong addr,
                                          uintptr_t retaddr)
{
[...]
}

The header is included multiple times, with SUFFIX being 'q', 'l',
'w', and so on, so this one line gives us functions io_writeq,
io_writel, io_writew.

> code_gen_buffer() is the part that QEMU execute the TB, I think maybe
> io_writex() is called by the helper function but I only find io_writex() in
> softmmu_template.h (*static inline void glue(io_write, SUFFIX)), *which is
> not related to the helper function.

It is related. io_writel and friends are called from
the functions defined in softmmu_template.h which look like
they're called 'helper_le_st_name' and 'helper_be_st_name', but
note that those are #defines defined earlier in the file, and
the actual function names are therefore a family of functions
with names like 'helper_le_ldul_mmu'. (A non-optimized build
will probably show you this function in the gdb backtrace.)
Those helper functions are called directly from generated TCG
code.

thanks
-- PMM