From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46976) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WIe9d-0004db-Sy for qemu-devel@nongnu.org; Wed, 26 Feb 2014 08:04:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WIe9c-0007Ny-Pe for qemu-devel@nongnu.org; Wed, 26 Feb 2014 08:04:05 -0500 Received: from mail-vc0-x236.google.com ([2607:f8b0:400c:c03::236]:49453) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WIe9c-0007Mc-Ks for qemu-devel@nongnu.org; Wed, 26 Feb 2014 08:04:04 -0500 Received: by mail-vc0-f182.google.com with SMTP id id10so877058vcb.13 for ; Wed, 26 Feb 2014 05:04:03 -0800 (PST) MIME-Version: 1.0 Date: Wed, 26 Feb 2014 18:34:03 +0530 Message-ID: From: Gaurav Sharma Content-Type: multipart/alternative; boundary=001a1136b262d1394a04f34ed6d8 Subject: [Qemu-devel] How is address of helper function for slow path calculated ? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org --001a1136b262d1394a04f34ed6d8 Content-Type: text/plain; charset=UTF-8 Hi, I have been trying to trace the for how address translation is done for any load/store instructions. I was trying to emulate arm on an x86-64 machine. However, i need some clarifications : 1. During the slow path, qemu uses helper functions to translate address. 2. This is done by calling the function itself during the execution. 3. The host instrn for the slow path is added at the end of the TB block. I tried a sample code and got the following host instrn : 0x2aaade72d120: mov %r14,%rdi 0x2aaade72d123: xor %edx,%edx 0x2aaade72d125: lea -0x42(%rip),%rcx # 0x2aaade72d0ea 0x2aaade72d12c: mov $0x2afd98602c10,%r10 0x2aaade72d136: callq *%r10 // Call helper function 0x2aaade72d139: mov %eax,%ebp 0x2aaade72d13b: jmpq 0x2aaade72d0ea 3. How does it gets the address of the helper function : call instruction is added by ' tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches the address of the helper function. However from the assembly generated, the address is calculated before : tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3], (uintptr_t)l->raddr) How is the address for the helper function calculated ? Thanks, Gaurav --001a1136b262d1394a04f34ed6d8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi,
I hav= e been trying to trace the for how address translation is done for any load= /store instructions. I was trying to emulate arm on an x86-64 machine.
However, i need some clarifications :
1. During the slow pa= th, qemu uses helper functions to translate address.
2. This is do= ne by calling the function itself during the execution.
3. Th= e host instrn for the slow path is added at the end of the TB block. I trie= d a sample code and got the following host instrn :
0x2aaade72d120:=C2=A0 mov=C2=A0=C2=A0=C2=A0 %r14,%rdi
0x2aaade72d123:=C2= =A0 xor=C2=A0=C2=A0=C2=A0 %edx,%edx
0x2aaade72d125:=C2=A0 lea=C2=A0=C2= =A0=C2=A0 -0x42(%rip),%rcx=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 # 0x2a= aade72d0ea
0x2aaade72d12c:=C2=A0 mov=C2=A0=C2=A0=C2=A0 $0x2afd98602c10,%= r10
0x2aaade72d136:=C2=A0 callq=C2=A0 *%r10=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 // Call helper function
0x2aaade72d139:=C2=A0 mov=C2=A0=C2=A0=C2=A0 %eax,%ebp
0x2aaade72d13b:=C2= =A0 jmpq=C2=A0=C2=A0 0x2aaade72d0ea

3. How does it gets the ad= dress of the helper function :
=C2=A0=C2=A0=C2=A0 call instruction= is added by ' tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~M= O_SIGN]' line of code which fetches the address of the helper function.=
However from the assembly generated, the address is calculated before= :
tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (uintptr_t)l->raddr)

How is the address for the helper function calculated ?

Thanks,
Gaurav
--001a1136b262d1394a04f34ed6d8--