|
From: | Gaurav Sharma |
Subject: | Re: [Qemu-devel] How is address of helper function for slow path calculated ? |
Date: | Wed, 26 Feb 2014 19:16:36 +0530 |
This is just loading the 4th argument for the helper function into ECXOn 26 February 2014 13:04, Gaurav Sharma <address@hidden> wrote:
> Hi,
> I have been trying to trace the for how address translation is done for any
> load/store instructions. I was trying to emulate arm on an x86-64 machine.
> However, i need some clarifications :
> 1. During the slow path, qemu uses helper functions to translate address.
> 2. This is done by calling the function itself during the execution.
> 3. The host instrn for the slow path is added at the end of the TB block. I
> tried a sample code and got the following host instrn :
> 0x2aaade72d120: mov %r14,%rdi
> 0x2aaade72d123: xor %edx,%edx
> 0x2aaade72d125: lea -0x42(%rip),%rcx # 0x2aaade72d0ea
> 0x2aaade72d12c: mov $0x2afd98602c10,%r10
> 0x2aaade72d136: callq *%r10 // Call helper function
> 0x2aaade72d139: mov %eax,%ebp
> 0x2aaade72d13b: jmpq 0x2aaade72d0ea
>
> 3. How does it gets the address of the helper function :
> call instruction is added by ' tcg_out_calli(s,
> (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches the
> address of the helper function.
> However from the assembly generated, the address is calculated before :
> tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
> (uintptr_t)l->raddr)
(which is the return address in generated code which corresponds to
the load we're going to do). It's not related to the address of the
helper function at all.
You've just quoted the code that does it:
> How is the address for the helper function calculated ?
tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' ...)
tcg_out_calli spots that the displacement is too big for a call insn
and emits the
0x2aaade72d12c: mov $0x2afd98602c10,%r10thanks
0x2aaade72d136: callq *%r10 // Call helper function
-- PMM
[Prev in Thread] | Current Thread | [Next in Thread] |