[Qemu-devel] classic emulator Vs QEMU-TCG

[Stefano Bonifazi]

Hi all!
    I am a student, trying to understand QEMU, specifically TCG 
translation/execution.
After spending much time on the code I still have big doubts. I think my 
doubts are due to the classic idea I have of an emulator.
Actually as a student, I've never developed even a simple classic 
emulator myself, but in my idea it should follow this flow:
1) Fetch target instruction
 i.e. PC(0x532652) : 0x104265 (I am just inventing)
2) Decode
 Opcode 0x10 :  ADD,  R1: 0x42, R2: 0x65
3) Look up instruction function table:
 switch(opcode)
  case add :
   add(R1, R2)
  break;
4) Execution
 void add(int R1, int R2)
 { env->reg[R1] = env->reg[R1] + env[R2];}

Now all of that would be compiled offline for the host machine and at 
runtime the host macine would just execute the binary host code for the 
instruction  "env->reg[R1] = env->reg[R1] + env[R2];" (its host binary 
translation)

In QEMU/TCG, thanks to the help of Mr. Blue Swirl, I understood there is 
a runtime creation of host binary, starting from the loaded target binary..
My big doubt is, how can I execute that new binary? .. Shall TCG put it 
in some memory location, and then make the process branch to that 
address (and then back) ?
I really can't see how that happens in the code :(

in cpu-exec.c : cpu_exec_nocache i find:

> /* execute the generated code */
>     next_tb = tcg_qemu_tb_exec(tb->tc_ptr);
and in cpu-exec.c : cpu_exec

> /* execute the generated code */
>
>                     next_tb = tcg_qemu_tb_exec(tc_ptr);
so I thought tcg_qemu_tb_exec "function" should do the work of executing 
the translated binary in the host.
But then I found out it is just a define in tcg.h:

> #define tcg_qemu_tb_exec(tb_ptr) ((long REGPARM (*)(void 
> *))code_gen_prologue)(tb_ptr)
and again in exec.c

> uint8_t code_gen_prologue[1024] code_gen_section;
Maybe I have some problems with that C syntax, but I really don't 
understand what happens there.. how the execution happens!

I think for all of you working for so long on QEMU, with a long 
successful experience in this field should be very easy.. but atm I 
really can't figure it out alone.. I can't find good documents 
explaining it, and I can't understand myself from the code!
Thank you very very much for any help! :)
Stefano B.