Re: [Qemu-devel] How is address of helper function for slow path calculated ?

[Xuebing wang]

Somebody may concisely refer tcg as a disassembler + a compiler (assembler).

I guess your question is how to calculate the value of i386 register 
(%r10 in your case, the address for the helper function).

I might be wrong, my understanding is that it is calculated by the 
assembler (to generate the "generated code"), specifically functions 
tcg_gen_helper32() or tcg_gen_helper64(). Hope this helps.


On 02/26/2014 09:14 PM, Peter Maydell wrote:
> On 26 February 2014 13:04, Gaurav Sharma <address@hidden> wrote:
> > Hi,
> > I have been trying to trace the for how address translation is done for any
> > load/store instructions. I was trying to emulate arm on an x86-64 machine.
> > However, i need some clarifications :
> > 1. During the slow path, qemu uses helper functions to translate address.
> > 2. This is done by calling the function itself during the execution.
> > 3. The host instrn for the slow path is added at the end of the TB block. I
> > tried a sample code and got the following host instrn :
> > 0x2aaade72d120:  mov    %r14,%rdi
> > 0x2aaade72d123:  xor    %edx,%edx
> > 0x2aaade72d125:  lea    -0x42(%rip),%rcx        # 0x2aaade72d0ea
> > 0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
> > 0x2aaade72d136:  callq  *%r10         // Call helper function
> > 0x2aaade72d139:  mov    %eax,%ebp
> > 0x2aaade72d13b:  jmpq   0x2aaade72d0ea
> >
> > 3. How does it gets the address of the helper function :
> >      call instruction is added by ' tcg_out_calli(s,
> > (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' line of code which fetches the
> > address of the helper function.
> > However from the assembly generated, the address is calculated before :
> > tcg_out_movi(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[3],
> >                       (uintptr_t)l->raddr)
> This is just loading the 4th argument for the helper function into ECX
> (which is the return address in generated code which corresponds to
> the load we're going to do). It's not related to the address of the
> helper function at all.
>
> > How is the address for the helper function calculated ?
> You've just quoted the code that does it:
> tcg_out_calli(s, (uintptr_t)qemu_ld_helpers[opc & ~MO_SIGN]' ...)
>
> tcg_out_calli spots that the displacement is too big for a call insn
> and emits the
>    0x2aaade72d12c:  mov    $0x2afd98602c10,%r10
>    0x2aaade72d136:  callq  *%r10         // Call helper function
>
> thanks
> -- PMM

--
Thanks,
Xuebing Wang