[Qemu-devel] Configuring QEMU to translate x86 instructions to native ARM instructions

[Qemu-devel] Configuring QEMU to translate x86 instructions to native ARM instructions

[Roger Tagged]

[-- Attachment #1: Type: text/plain, Size: 1595 bytes --]

Hello dear developers,

I want to use the CPU emulation component of QEMU (user mode) and I'm
running into a bit of a problem that I hope you can help me with or point
me to the right list.

On my x86 Linux VM, I have configured QEMU with:

'--target-list=i386-linux-user' '--cc=/bin/arm-none-linux-gnueabi-gcc

I then issue the make command which cross-compiles the source code to run
on an ARM CPU to emulate an x86 CPU.  When I debug the resulting ARM code,
I can see that QEMU successfully turns an x86 instruction into the
intermediate micro operations.  When the first call is reach, the
translation ends and it then attempts to executed the micro operations as
host (should be ARM) code which crashes with an illegal instruction

Program received signal SIGILL, Illegal instruction.
0x402a4360 in code_gen_prologue

When I disassemble code_gen_prologue, I expected to see ARM instructions,
but I am not.

(gdb) disassem code_gen_prologue
Dump of assembler code for function code_gen_prologue:
=> 0x402a4360 <+0>:   ; <UNDEFINED> instruction: 0x57565355
   0x402a4364 <+4>: ldc2l 4, cr12, [r4, #-516]! ; 0xfffffdfc
   0x402a4368 <+8>: stm r11, {r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10,
r11, r12, sp, lr, pc}
   0x402a436c <+12>: strgt lr, [r1], #767 ; 0x2ff
Why don't I see ARM instructions here?  Is the prologue being generated for
x86 instead of ARM?  One thing that I know for certain is that the code
that initializes the TCGContext tcg_target_qemu_prologue() is from the file
tcg/i386/tcg-target.c and not from tcg/arm/tcg-target.c.  Is this the right?

Thanks in advance,
Roger

[-- Attachment #2: Type: text/html, Size: 1916 bytes --]

Re: [Qemu-devel] Configuring QEMU to translate x86 instructions to native ARM instructions

[Peter Maydell]

On 6 March 2012 05:11, Roger Tagged <roger.junk.email@gmail.com> wrote:
> I want to use the CPU emulation component of QEMU (user mode) and I'm
> running into a bit of a problem that I hope you can help me with or point me
> to the right list.

Which version of QEMU are you using?

> On my x86 Linux VM, I have configured QEMU with:
>
> '--target-list=i386-linux-user' '--cc=/bin/arm-none-linux-gnueabi-gcc

You should use '--cross-prefix=arm-none-linux-gnueabi-' instead of
specifying --cc, so qemu uses the whole cross toolchain rather than
just the gcc...

> I then issue the make command which cross-compiles the source code to run on
> an ARM CPU to emulate an x86 CPU.  When I debug the resulting ARM code, I
> can see that QEMU successfully turns an x86 instruction into the
> intermediate micro operations.  When the first call is reach, the
> translation ends and it then attempts to executed the micro operations as
> host (should be ARM) code which crashes with an illegal instruction
>
> Program received signal SIGILL, Illegal instruction.
> 0x402a4360 in code_gen_prologue
>
> When I disassemble code_gen_prologue, I expected to see ARM instructions,
> but I am not.
>
> (gdb) disassem code_gen_prologue
> Dump of assembler code for function code_gen_prologue:
> => 0x402a4360 <+0>:   ; <UNDEFINED> instruction: 0x57565355
>    0x402a4364 <+4>: ldc2l 4, cr12, [r4, #-516]! ; 0xfffffdfc
>    0x402a4368 <+8>: stm r11, {r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10,
> r11, r12, sp, lr, pc}
>    0x402a436c <+12>: strgt lr, [r1], #767 ; 0x2ff
> Why don't I see ARM instructions here?  Is the prologue being generated for
> x86 instead of ARM?  One thing that I know for certain is that the code that
> initializes the TCGContext tcg_target_qemu_prologue() is from the file
> tcg/i386/tcg-target.c and not from tcg/arm/tcg-target.c.  Is this the right?

How do you know this for certain?

The prologue code is written by tcg_prologue_init(), which calls
tcg_target_qemu_prologue(), which is a function provided by the TCG
backend. In this case it should be the one in tcg/arm/tcg-target.c.

-- PMM

Re: [Qemu-devel] Configuring QEMU to translate x86 instructions to native ARM instructions

[Roger]

I'm using the QEMU sources from 0.15.1.

I will try the --cross-prefix option.  I have a feeling this will do it.  I know that the prologue is being initialized with the i386 target backend because the debugger shows me the name of the file and it is tcg/i386/tcg-target.c.  Further more, the code being inserted into the prologue array are x86 push instructions.  

I'll also try the --cpu option recommended by the previous poster.

Thanks both for your help.  I'll reply with the results.

Roger



On Mar 6, 2012, at 10:54 AM, Peter Maydell <peter.maydell@linaro.org> wrote:

> On 6 March 2012 05:11, Roger Tagged <roger.junk.email@gmail.com> wrote:
>> I want to use the CPU emulation component of QEMU (user mode) and I'm
>> running into a bit of a problem that I hope you can help me with or point me
>> to the right list.
> 
> Which version of QEMU are you using?
> 
>> On my x86 Linux VM, I have configured QEMU with:
>> 
>> '--target-list=i386-linux-user' '--cc=/bin/arm-none-linux-gnueabi-gcc
> 
> You should use '--cross-prefix=arm-none-linux-gnueabi-' instead of
> specifying --cc, so qemu uses the whole cross toolchain rather than
> just the gcc...
> 
>> I then issue the make command which cross-compiles the source code to run on
>> an ARM CPU to emulate an x86 CPU.  When I debug the resulting ARM code, I
>> can see that QEMU successfully turns an x86 instruction into the
>> intermediate micro operations.  When the first call is reach, the
>> translation ends and it then attempts to executed the micro operations as
>> host (should be ARM) code which crashes with an illegal instruction
>> 
>> Program received signal SIGILL, Illegal instruction.
>> 0x402a4360 in code_gen_prologue
>> 
>> When I disassemble code_gen_prologue, I expected to see ARM instructions,
>> but I am not.
>> 
>> (gdb) disassem code_gen_prologue
>> Dump of assembler code for function code_gen_prologue:
>> => 0x402a4360 <+0>:   ; <UNDEFINED> instruction: 0x57565355
>>    0x402a4364 <+4>: ldc2l 4, cr12, [r4, #-516]! ; 0xfffffdfc
>>    0x402a4368 <+8>: stm r11, {r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10,
>> r11, r12, sp, lr, pc}
>>    0x402a436c <+12>: strgt lr, [r1], #767 ; 0x2ff
>> Why don't I see ARM instructions here?  Is the prologue being generated for
>> x86 instead of ARM?  One thing that I know for certain is that the code that
>> initializes the TCGContext tcg_target_qemu_prologue() is from the file
>> tcg/i386/tcg-target.c and not from tcg/arm/tcg-target.c.  Is this the right?
> 
> How do you know this for certain?
> 
> The prologue code is written by tcg_prologue_init(), which calls
> tcg_target_qemu_prologue(), which is a function provided by the TCG
> backend. In this case it should be the one in tcg/arm/tcg-target.c.
> 
> -- PMM

Re: [Qemu-devel] Configuring QEMU to translate x86 instructions to native ARM instructions

[Peter Maydell]

On 6 March 2012 16:09, Roger <roger.junk.email@gmail.com> wrote:
> I will try the --cross-prefix option.  I have a feeling this
> will do it.  I know that the prologue is being initialized with
> the i386 target backend

> I'll also try the --cpu option recommended by the previous poster.

Yes, this should force the host CPU detection correctly, but
really it ought to be able to autodetect it, at least in current
versions of QEMU. This might possibly have been broken in 0.15,
I suppose.

-- PMM

Re: [Qemu-devel] Configuring QEMU to translate x86 instructions to native ARM instructions

[Roger]

Thank you both.  The --CPU option worked like a charm.

Roger 



On Mar 6, 2012, at 11:14 AM, Peter Maydell <peter.maydell@linaro.org> wrote:

> On 6 March 2012 16:09, Roger <roger.junk.email@gmail.com> wrote:
>> I will try the --cross-prefix option.  I have a feeling this
>> will do it.  I know that the prologue is being initialized with
>> the i386 target backend
> 
>> I'll also try the --cpu option recommended by the previous poster.
> 
> Yes, this should force the host CPU detection correctly, but
> really it ought to be able to autodetect it, at least in current
> versions of QEMU. This might possibly have been broken in 0.15,
> I suppose.
> 
> -- PMM