Re:Another related question Re: [Qemu-devel] Question about softmmu

[Olivier Cozette]

  Hello Ye,

First, I will describe the memory access. All access to memory from the CPU,
data access or load instruction access cross the TLB (Translation Look aside
Buffer), the TLB convert the virtual address to the real address (it's a
cache of the page mapping), so only the real address go to the memory
subsystem or the cache. Note that the TLB are only flushed when you change
CR3 value or if you use INVLPG instruction.

               
-------       
| Proc|
------->=====>-------------
              |  TLB      |
              ------------->=======\/
                                                --------------
                                   | Cache/Memory|
                                   ---------------

With i386, the only to get the pc (eip register) is to use the CALL
instruction, this instruction store the virtual next PC (eip) and so if the
mapping change, the next PC change.

With Qemu in target-i386/translate.c you have this code :

    case 2: /* call Ev */
            /* XXX: optimize if memory (no 'and' is necessary) */
            if (s->dflag == 0)
                gen_op_andl_T0_ffff();
            next_eip = s->pc - s->cs_base;
            gen_op_movl_T1_im(next_eip);
            gen_push_T1(s);
            gen_op_jmp_T0();
            gen_eob(s);
            break;

              


Olivier