[Qemu-devel] Question on implementatio of GETPC()

[Qemu-devel] Question on implementatio of GETPC()

[Jun Koi]

Hi,

In x86, GETPC() is implemented as below:

# define GETPC() ((void *)((unsigned long)__builtin_return_address(0) - 1))

As I understand, it gets the returned address on the stack, then
subtract 1 to get back to the above address.

Imagine we have code like this (pseudo asm code):

....
CALL <relative address>
<next-insn>
....

When we call GETPC, we get the address of <next-insn>, and subtract 1.
But the problem is that the CALL insn is more than 1 byte, so how can
GETPC() gives us the address of the CALL insn above?

I guess I must misunderstood something here ....

Many thanks,
Jun

[Qemu-devel] Re: Question on implementatio of GETPC()

[Jan Kiszka]

Jun Koi wrote:
> Hi,
> 
> In x86, GETPC() is implemented as below:
> 
> # define GETPC() ((void *)((unsigned long)__builtin_return_address(0) - 1))
> 
> As I understand, it gets the returned address on the stack, then
> subtract 1 to get back to the above address.
> 
> Imagine we have code like this (pseudo asm code):
> 
> ....
> CALL <relative address>
> <next-insn>
> ....
> 
> When we call GETPC, we get the address of <next-insn>, and subtract 1.
> But the problem is that the CALL insn is more than 1 byte, so how can
> GETPC() gives us the address of the CALL insn above?
> 
> I guess I must misunderstood something here ....

IIRC, the result of GETPC is used for a range check. So you just have to
ensure that it points somewhere into the translated code sequence of the
current target instruction.

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux

[Qemu-devel] Re: Question on implementatio of GETPC()

[Jun Koi]

On Wed, Apr 28, 2010 at 5:12 PM, Jan Kiszka <jan.kiszka@siemens.com> wrote:
> Jun Koi wrote:
>> Hi,
>>
>> In x86, GETPC() is implemented as below:
>>
>> # define GETPC() ((void *)((unsigned long)__builtin_return_address(0) - 1))
>>
>> As I understand, it gets the returned address on the stack, then
>> subtract 1 to get back to the above address.
>>
>> Imagine we have code like this (pseudo asm code):
>>
>> ....
>> CALL <relative address>
>> <next-insn>
>> ....
>>
>> When we call GETPC, we get the address of <next-insn>, and subtract 1.
>> But the problem is that the CALL insn is more than 1 byte, so how can
>> GETPC() gives us the address of the CALL insn above?
>>
>> I guess I must misunderstood something here ....
>
> IIRC, the result of GETPC is used for a range check. So you just have to
> ensure that it points somewhere into the translated code sequence of the
> current target instruction.
>

Hmm if I am not wrong, the GETPC address is really used as jump target
of some code (such as when handling page fault), so that must be
accurate.
This is so confused to me!

Thanks,
J

[Qemu-devel] Re: Question on implementatio of GETPC()

[Jan Kiszka]

Jun Koi wrote:
> On Wed, Apr 28, 2010 at 5:12 PM, Jan Kiszka <jan.kiszka@siemens.com> wrote:
>> Jun Koi wrote:
>>> Hi,
>>>
>>> In x86, GETPC() is implemented as below:
>>>
>>> # define GETPC() ((void *)((unsigned long)__builtin_return_address(0) - 1))
>>>
>>> As I understand, it gets the returned address on the stack, then
>>> subtract 1 to get back to the above address.
>>>
>>> Imagine we have code like this (pseudo asm code):
>>>
>>> ....
>>> CALL <relative address>
>>> <next-insn>
>>> ....
>>>
>>> When we call GETPC, we get the address of <next-insn>, and subtract 1.
>>> But the problem is that the CALL insn is more than 1 byte, so how can
>>> GETPC() gives us the address of the CALL insn above?
>>>
>>> I guess I must misunderstood something here ....
>> IIRC, the result of GETPC is used for a range check. So you just have to
>> ensure that it points somewhere into the translated code sequence of the
>> current target instruction.
>>
> 
> Hmm if I am not wrong, the GETPC address is really used as jump target
> of some code (such as when handling page fault), so that must be
> accurate.

That won't work. GETPC could - at best - point to a host instruction
that raised the fault. But for proper fault handling, we need the guest
instruction pointer. So QEMU does a reverse mapping of the host address,
often via re-translating the code block as it may contain more than one
guest instruction.

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux