Hi *, i am currently trying to trace guest memory access (i386-softmmu). tcg README says tcg_gen_(st|ld)X_Y functions are responsible for memory access. Now I've got the following code snippets in tcg-op.h:
/* representing all tcg_gen_st and tcg_gen_ld functions in README*/ static inline void tcg_gen_ld8s_i32(TCGv_i32 ret, TCGv_ptr arg2, tcg_target_long offset) { tcg_gen_ldst_op_i32(INDEX_op_ld8s_i32, ret, arg2, offset); int sizemask = 0; sizemask |= tcg_gen_sizemask(0, 0, 0); sizemask |= tcg_gen_sizemask(1, 0, 0); sizemask |= tcg_gen_sizemask(2, 0, 0); tcg_gen_helper3(tcg_flx_debug, sizemask, ret, ret, arg2, tcg_const_i32(offset)); } static inline void tcg_gen_helper3(void *func, int sizemask, TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b, TCGv_i32 c) { TCGv_ptr fn; TCGArg args[3]; fn = tcg_const_ptr((tcg_target_long)func); args[0] = GET_TCGV_I32(a); args[1] = GET_TCGV_I32(b); args[2] = GET_TCGV_I32(c); tcg_gen_callN(&tcg_ctx, fn, TCG_CALL_CONST | TCG_CALL_PURE, sizemask, GET_TCGV_I32(ret), 3, args); tcg_temp_free_ptr(fn); } static inline int32_t tcg_flx_debug(int32_t arg1, int32_t arg2, int32_t arg3){ printf("reading 0x%x from 0x%x\n",arg1,arg2+arg3); return arg1; } tcg_flx_debug produces output which does not seem to look like what I want. What confuses me is that e.g. tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,ldt.selector)) in translate.c ends up in one of the functions I am trying to hook but the second and the third argument obviously are not directly valid base+offset addresses in the guest memory. So how is this part working? What I would like to build is that on each read/write to guest memory, an analysis function is triggered with address and value. Regards, Felix Matenaar