From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:47380) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T23dB-0008I1-S0 for qemu-devel@nongnu.org; Thu, 16 Aug 2012 13:13:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T23dA-0007Xz-EU for qemu-devel@nongnu.org; Thu, 16 Aug 2012 13:13:13 -0400 Received: from mail-gg0-f173.google.com ([209.85.161.173]:53522) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T23dA-0007Xo-9m for qemu-devel@nongnu.org; Thu, 16 Aug 2012 13:13:12 -0400 Received: by ggna5 with SMTP id a5so3127587ggn.4 for ; Thu, 16 Aug 2012 10:13:11 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <20120816080243.GA33123@cs.nctu.edu.tw> Date: Thu, 16 Aug 2012 13:13:11 -0400 Message-ID: From: Steven Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Qemu-devel] qemu log function to print out the registers of the guest List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell Cc: qemu-devel@nongnu.org, =?UTF-8?B?6Zmz6Z+L5Lu7IChXZWktUmVuIENoZW4p?= On Thu, Aug 16, 2012 at 12:54 PM, Peter Maydell wrote: > On 16 August 2012 17:36, Steven wrote: >> I would like to get a trace of guest memory access. So I can not use >> "info registers". >> What I want to do is that when tcg fetches a load instruction at >> disas_insns(), the guest memory address should be calculated. > > You cannot calculate the guest memory address at the point where > TCG is translating the load instruction. This is because that > address depends on the values of guest registers at runtime. > At translation time these values are not known. Also they may > be different for different runs through the same generated code. Thanks. Then what I thought is wrong. > > QEMU is a just-in-time translator (JIT). For a JIT it is > important to remember the difference between: > * translation time. Here we know what the guest code (instructions) > are, but we do not know what the guest CPU registers will be > * run time. This may be some time later, and we may execute > the same code several times. We don't have any access to > information about the guest code we are running unless > we specifically recorded it at translation time. Take this in_asm as example, mov 0x4(%ebx) %eax. I saw the translated host code for this single load instruction (using -d in_asm,out_asm) are OUT: [size=107] 0x4025d890: mov 0x28(%r14),%rbp 0x4025d894: add $0xc,%rbp 0x4025d898: mov %ebp,%ebp ... 0x4025d8e8: mov %rbp,0x8(%r14) 0x4025d8ec: xor %eax,%eax 0x4025d8ee: mov $0x7fc1a598d176,%r10 0x4025d8f8: jmpq *%r10 So the run time function should be tcg_out_qemu_ld, right? Could you provide some suggestion where I should add the record information to help translate the guest memory address? Thanks. > > When you are reading (or trying to change) QEMU source code > you need to know whether the QEMU code will be running at > translation or run time. The answer affects what information > you have access to, and what you can do to the guest. > > -- PMM