How QEMU maintains the translation from guest virtual address to guest physical address?

Question

I've been trying to understand the process of address translation inside QEMU, but I got stuck in GVA->GPA.

I've known that QEMU uses a two level description table 'PhysPageDesc' to maintain the translation between GPA & HVA(host virtual address), but I couldn't find out where QEMU translates GVA to GPA to go to that table to find HVA when a TLB missed occured.

I've traced the internal codes and there are something may be able to solve my problems but I can't figure it out, could anyone help me?

There is a function get_level1_table_address() called by get_phys_addr() in target-arm/helper.c, and it seems like start translating the GVA to GPA. But I don't understand the env->cp15.c2_base_mask variable which claimed to be the MMU translation table base selection mask means. Where is the description of MMU translation table?

Any suggestions would be helpful to me. Thanks in advance.

Answer 1

The code you are looking at (get_phys_addr() and the functions it calls) is implementing the page table walk algorithm for ARM. This (and the data structures in guest memory which it reads) is defined in the architecture reference manual (the "ARM ARM"). To understand the code you need to read the relevant sections of the architecture specification so you know what we're trying to emulate.

(For instance, the c2_base_mask is precalculated based on the value in the 'N' field of the translation table base control register (TTBCR) and is part of the calculation of the translation table base address.)