BUG? In tcg_out_qemu_ld
tcg_out_ld(s, TCG_TYPE_I64, r1, r1, offsetof(CPUTLBEntry, addend) - offsetof(CPUTLBEntry, addr_read)); should be modified to tcg_out_ld(s, TCG_TYPE_I64, r1, r1, offsetof(CPUTLBEntry, addend)); since the when calling tcg_out_ld, the R1's value is (cpu_env + TLB_entry_offset), which was computed in tcg_out_tlb_cmp() And the save problem in tcg_out_qemu_ld() another BUG? At the end of tcg_out_tlb_cmp(), R0's value is (page# | low bit of VA), if the branch is taken, i.e., TLB miss, R0 will be passed as an argument to helper functions, is it currently holding the correct value? I think at this time R0 should equal to addr_reg. I'm currently testing your code in my free time. Dong Weiyu. ___________________________________________________________ 好玩贺卡等你发,邮箱贺卡全新上线! http://card.mail.cn.yahoo.com/