Qemu memory operations

Question

I intend to use Qemu to create a memory trace to run the x86 guest operating system.

According to the tcg wiki page, Qemu uses several helpers to create downloads / stores in the target (guest) memory. This list of instructions is tcg_gen_qemu_ld8s/u , tcg_gen_qemu_ld16s/u , tcg_gen_qemu_ld32s/u , tcg_gen_qemu_ld64 . (We have a similar kit for store instructions). I catch all the calls to the above functions in the target-i386 / translate.c file

However, I still do not have enough loading / storing specific instructions, for example

 cmp ecx, [r12+0x4] mov r10b, [r13+0x0] mov byte [rax+0xf0000], 0x0 mov byte [rax+rdx], 0x0 

Questions:

• Can someone point out other loading / storage points (direct or indirect) that I am missing?
• Does qemu provide a single entry point for accessing guest memory (e.g. guest_read() ), which can be used to track all downloads from guest memory ???
• Can someone point out some good documentation where I can understand how qemu maintains guest memory state?

Sorry friends for the misleading instructions in the previous post.

 cmp ecx, [r12+0x4] mov r10b, [r13+0x0] mov byte [rax+0xf0000], 0x0 mov byte [rax+rdx], 0x0 

It seems that all of the above instructions are covered by tcg_gen_ld/st helpers.

But now I came across another problem:
Initially, I thought that all interactions with guest memory occur through auxiliary instructions in the translate.c file. However, I found that the helper functions for some instructions like cmpxcgh8b and cmpxchg16b actually access guest memory.

So, does this mean that there are several entry points for reading guest memory. Can someone explain how the ldq and stq instructions are translated to access guest memory?

Answer 1

Other functions that load data are called cpu_ld*_data and cpu_st*_data , or cpu_ld*_data_ra and cpu_st*_data_ra . The _ra version has an additional argument, which is the address of the caller in the generated code. It is used to calculate the address of the failure command in case the load or storage creates a page error.

For example, grepping for cmpxchg8b gives

 target/i386/mem_helper.c:void helper_cmpxchg8b(CPUX86State *env, target_ulong a0) 

and inside this function:

 uintptr_t ra = GETPC(); ... oldv = cpu_ldq_data_ra(env, a0, ra); newv = (cmpv == oldv ? newv : oldv); /* always do the store */ cpu_stq_data_ra(env, a0, newv, ra);