1 2008-01-12 Mike Kronenberg <mike.kronenberg@kronenberg.org>
3 * dyngen-exec.h: Fix for QEMU 0.9.1.
4 * dyngen-c.h: Fix for QEMU 0.9.1.
6 2007-02-01 Mike Kronenberg <mike.kronenberg@kronenberg.org>
8 * target-ppc/exec.h: Fix for QEMU 0.9.0.
9 * dyngen-exec.h: Fix for QEMU 0.9.0.
11 2005-06-02 Gwenole Beauchesne <gbeauchesne@mandriva.com>
13 * dyngen.c (trace_i386_insn): Fix push/imul case with 8-bit
16 2005-05-11 Paul Brook <paul@codesourcery.com>
20 --- qemu-0.7.0/target-ppc/exec.h.gcc4 2005-04-27 22:52:05.000000000 +0200
21 +++ qemu-0.7.0/target-ppc/exec.h 2005-06-02 21:41:51.000000000 +0200
22 @@ -64,11 +64,7 @@ #define FT0 (env->ft0)
23 #define FT1 (env->ft1)
24 #define FT2 (env->ft2)
26 -#if defined (DEBUG_OP)
27 -# define RETURN() __asm__ __volatile__("nop" : : : "memory");
29 -# define RETURN() __asm__ __volatile__("" : : : "memory");
31 +#define RETURN() FORCE_RET()
35 --- qemu-0.7.0/dyngen-exec.h.gcc4 2005-04-27 22:52:05.000000000 +0200
36 +++ qemu-0.7.0/dyngen-exec.h 2005-06-02 21:41:51.000000000 +0200
37 @@ -194,7 +194,12 @@ extern int printf(const char *, ...);
40 /* force GCC to generate only one epilog at the end of the function */
41 +#if defined(__i386__) || defined(__x86_64__)
42 +/* Also add 4 bytes of padding so that we can replace the ret with a jmp. */
43 +#define FORCE_RET() asm volatile ("nop;nop;nop;nop");
45 #define FORCE_RET() __asm__ __volatile__("" : : : "memory");
50 @@ -251,10 +256,17 @@ extern int __op_jmp0, __op_jmp1, __op_jm
54 -#define EXIT_TB() asm volatile ("ret")
55 -#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
56 +/* Dyngen will replace hlt instructions with a ret instruction. Inserting a
57 + ret directly would confuse dyngen. */
58 +#define EXIT_TB() asm volatile ("hlt")
59 +/* Dyngen will replace cli with 0x9e (jmp).
60 + We generate the offset manually. */
61 +#define GOTO_LABEL_PARAM(n) \
62 + asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
63 #elif defined(__x86_64__)
64 -#define EXIT_TB() asm volatile ("ret")
65 -#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
66 +/* The same as i386. */
67 +#define EXIT_TB() asm volatile ("hlt")
68 +#define GOTO_LABEL_PARAM(n) \
69 + asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
70 #elif defined(__powerpc__)
71 #define EXIT_TB() asm volatile ("blr")
72 --- qemu-0.7.0/dyngen.c.gcc4 2005-04-27 22:52:05.000000000 +0200
73 +++ qemu-0.7.0/dyngen.c 2005-06-02 22:25:06.000000000 +0200
76 #include "config-host.h"
80 /* NOTE: we test CONFIG_WIN32 instead of _WIN32 to enabled cross
82 #if defined(CONFIG_WIN32)
83 @@ -1343,6 +1345,644 @@ int arm_emit_ldr_info(const char *name,
87 +#if defined(HOST_I386) || defined(HOST_X86_64)
89 +/* This byte is the first byte of an instruction. */
90 +#define FLAG_INSN (1 << 0)
91 +/* This byte has been processed as part of an instruction. */
92 +#define FLAG_SCANNED (1 << 1)
93 +/* This instruction is a return instruction. Gcc cometimes generates prefix
94 + bytes, so may be more than one byte long. */
95 +#define FLAG_RET (1 << 2)
96 +/* This is either the target of a jump, or the preceeding instruction uses
97 + a pc-relative offset. */
98 +#define FLAG_TARGET (1 << 3)
99 +/* This is a magic instruction that needs fixing up. */
100 +#define FLAG_EXIT (1 << 4)
104 +bad_opcode(const char *name, uint32_t op)
106 + error("Unsupported opcode %0*x in %s", (op > 0xff) ? 4 : 2, op, name);
109 +/* Mark len bytes as scanned, Returns insn_size + len. Reports an error
110 + if these bytes have already been scanned. */
112 +eat_bytes(const char *name, char *flags, int insn, int insn_size, int len)
115 + /* This should never occur in sane code. */
116 + if (flags[insn + insn_size] & FLAG_SCANNED)
117 + error ("Overlapping instructions in %s", name);
118 + flags[insn + insn_size] |= FLAG_SCANNED;
126 +trace_i386_insn (const char *name, uint8_t *start_p, char *flags, int insn,
145 + ptr = start_p + insn;
146 + /* nonzero if this insn has a ModR/M byte. */
148 + /* The size of the immediate value in this instruction. */
150 + /* The operand size. */
152 + /* The address size */
154 + /* The total length of this instruction. */
164 + while (is_prefix) {
165 + op = ptr[insn_size];
166 + insn_size = eat_bytes(name, flags, insn, insn_size, 1);
174 + /* two-byte opcode. */
175 + op = ptr[insn_size];
176 + insn_size = eat_bytes(name, flags, insn, insn_size, 1);
179 + if ((op & 0xf) > 3)
182 + case 1: /* vector move or prefetch */
183 + case 2: /* various moves and vector compares. */
185 + case 5: /* vector instructions */
192 + if (op & 0x77) /* emms */
195 + case 3: /* wrmsr, rdtsc, rdmsr, rdpmc, sysenter, sysexit */
198 + case 8: /* long conditional jump */
203 + case 9: /* setcc */
206 + switch (op & 0x7) {
207 + case 0: /* push fs/gs */
208 + case 1: /* pop fs/gs */
209 + case 2: /* cpuid/rsm */
212 + case 4: /* shld/shrd immediate */
215 + default: /* Normal instructions with a ModR/M byte. */
220 + switch (op & 0xf) {
221 + case 10: /* bt, bts, btr, btc */
225 + /* cmpxchg, lss, btr, lfs, lgs, movzx, btc, bsf, bsr
226 + undefined, and movsx */
235 + switch (op & 0x7) {
248 + } else if ((op & 0x07) <= 0x3) {
249 + /* General arithmentic ax. */
250 + } else if ((op & 0x07) <= 0x5) {
251 + /* General arithmetic ax, immediate. */
257 + } else if ((op & 0x23) == 0x22) {
258 + /* Segment prefix. */
261 + /* Segment register push/pop or DAA/AAA/DAS/AAS. */
266 +#if defined(HOST_X86_64)
267 + case 4: /* rex prefix. */
269 + /* The address/operand size is actually 64-bit, but the immediate
270 + values in the instruction are still 32-bit. */
277 + case 4: /* inc/dec register. */
279 + case 5: /* push/pop general register. */
284 + switch (op & 0x0f) {
285 + case 0: /* pusha */
289 + case 2: /* bound */
296 + case 6: /* opcode size prefix. */
300 + case 7: /* Address size prefix. */
304 + case 8: /* push immediate */
308 + case 10: /* push 8-bit immediate */
312 + case 9: /* imul immediate */
315 + case 11: /* imul 8-bit immediate */
318 + case 12: /* insb */
319 + case 13: /* insw */
320 + case 14: /* outsb */
321 + case 15: /* outsw */
327 + case 7: /* Short conditional jump. */
334 + if ((op & 0xf) <= 3) {
335 + /* arithmetic immediate. */
341 + /* else test, xchg, mov, lea or pop general. */
345 + /* Various single-byte opcodes with no modrm byte. */
354 + switch ((op & 0xe) >> 1) {
355 + case 0: /* mov absoliute immediate. */
362 + case 4: /* test immediate. */
368 + default: /* Various string ops. */
374 + case 11: /* move immediate to register */
387 + switch (op & 0xf) {
388 + case 0: /* shift immediate */
392 + case 2: /* ret immediate */
395 + bad_opcode(name, op);
403 + case 6: /* mov immediate byte */
406 + case 7: /* mov immediate */
409 + case 8: /* enter */
410 + /* TODO: Is this right? */
414 + case 10: /* retf immediate */
417 + bad_opcode(name, op);
423 + case 11: /* retf */
424 + case 15: /* iret */
426 + bad_opcode(name, op);
428 + default: /* leave, int3 or into */
435 + if ((op & 0xf) >= 8) {
436 + /* Coprocessor escape. For our purposes this is just a normal
437 + instruction with a ModR/M byte. */
438 + } else if ((op & 0xf) >= 4) {
439 + /* AAM, AAD or XLAT */
442 + /* else shift instruction */
446 + switch ((op & 0xc) >> 2) {
447 + case 0: /* loop or jcxz */
451 + case 1: /* in/out immed */
454 + case 2: /* call or jmp */
459 + case 1: /* long jump */
463 + case 2: /* far jmp */
464 + bad_opcode(name, op);
466 + case 3: /* short jmp */
472 + case 3: /* in/out register */
479 + switch ((op & 0xe) >> 1) {
489 + /* Some privileged insns are used as markers. */
491 + case 0xf4: /* hlt: Exit translation block. */
494 + case 0xfa: /* cli: Jump to label. */
498 + case 0xfb: /* sti: TB patch jump. */
499 + /* Mark the insn for patching, but continue sscanning. */
500 + flags[insn] |= FLAG_EXIT;
505 + case 3: /* unary grp3 */
506 + if ((ptr[insn_size] & 0x38) == 0) {
510 + immed = 1; /* test immediate */
513 + case 7: /* inc/dec grp4/5 */
514 + /* TODO: This includes indirect jumps. We should fail if we
515 + encounter one of these. */
523 + if (addr_size != 4)
524 + error("16-bit addressing mode used in %s", name);
527 + modrm = ptr[insn_size];
528 + insn_size = eat_bytes(name, flags, insn, insn_size, 1);
530 + switch ((modrm & 0xc0) >> 6) {
542 + if ((modrm & 0xc0) != 0xc0 && (modrm & 0x7) == 4) {
544 + if (modrm == 4 && (ptr[insn_size] & 0x7) == 5) {
548 + insn_size = eat_bytes(name, flags, insn, insn_size, 1);
550 + insn_size = eat_bytes(name, flags, insn, insn_size, disp);
552 + insn_size = eat_bytes(name, flags, insn, insn_size, immed);
553 + if (is_condjmp || is_jmp) {
555 + disp = (int8_t)*(ptr + insn_size - 1);
557 + disp = (((int32_t)*(ptr + insn_size - 1)) << 24)
558 + | (((int32_t)*(ptr + insn_size - 2)) << 16)
559 + | (((int32_t)*(ptr + insn_size - 3)) << 8)
560 + | *(ptr + insn_size - 4);
563 + /* Jumps to external symbols point to the address of the offset
564 + before relocation. */
565 + /* ??? These are probably a tailcall. We could fix them up by
566 + replacing them with jmp to EOB + call, but it's easier to just
567 + prevent the compiler generating them. */
569 + error("Unconditional jump (sibcall?) in %s", name);
571 + if (disp < 0 || disp > len)
572 + error("Jump outside instruction in %s", name);
574 + if ((flags[disp] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_SCANNED)
575 + error("Overlapping instructions in %s", name);
577 + flags[disp] |= (FLAG_INSN | FLAG_TARGET);
581 + /* Mark the following insn as a jump target. This will stop
582 + this instruction being moved. */
583 + flags[insn + insn_size] |= FLAG_TARGET;
586 + flags[insn] |= FLAG_RET;
589 + flags[insn] |= FLAG_EXIT;
591 + if (!(is_jmp || is_ret || is_exit))
592 + flags[insn + insn_size] |= FLAG_INSN;
595 +/* Scan a function body. Returns the position of the return sequence.
596 + Sets *patch_bytes to the number of bytes that need to be copied from that
597 + location. If no patching is required (ie. the return is the last insn)
598 + *patch_bytes will be set to -1. *plen is the number of code bytes to copy.
600 +static int trace_i386_op(const char * name, uint8_t *start_p, int *plen,
601 + int *patch_bytes, int *exit_addrs)
613 + flags = malloc(len + 1);
614 + memset(flags, 0, len + 1);
615 + flags[0] |= FLAG_INSN;
619 + for (insn = 0; insn < len; insn++) {
620 + if ((flags[insn] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_INSN) {
621 + trace_i386_insn(name, start_p, flags, insn, len);
627 + /* Strip any unused code at the end of the function. */
628 + while (len > 0 && flags[len - 1] == 0)
634 + for (insn = 0; insn < len; insn++) {
635 + if (flags[insn] & FLAG_RET) {
636 + /* ??? In theory it should be possible to handle multiple return
637 + points. In practice it's not worth the effort. */
639 + error("Multiple return instructions in %s", name);
642 + if (flags[insn] & FLAG_EXIT) {
643 + if (num_exits == MAX_EXITS)
644 + error("Too many block exits in %s", name);
645 + exit_addrs[num_exits] = insn;
648 + if (flags[insn] & FLAG_INSN)
652 + exit_addrs[num_exits] = -1;
653 + if (retpos == -1) {
654 + if (num_exits == 0) {
655 + error ("No return instruction found in %s", name);
662 + /* If the return instruction is the last instruction we can just
664 + if (retpos == last_insn)
669 + /* Back up over any nop instructions. */
671 + && (flags[retpos] & FLAG_TARGET) == 0
672 + && (flags[retpos - 1] & FLAG_INSN) != 0
673 + && start_p[retpos - 1] == 0x90) {
677 + if (*patch_bytes == -1) {
684 + /* The ret is in the middle of the function. Find four more bytes that
685 + so the ret can be replaced by a jmp. */
686 + /* ??? Use a short jump where possible. */
689 + /* We can clobber everything up to the next jump target. */
690 + while (insn < len && bytes > 0 && (flags[insn] & FLAG_TARGET) == 0) {
695 + /* ???: Strip out nop blocks. */
696 + /* We can't do the replacement without clobbering anything important.
697 + Copy preceeding instructions(s) to give us some space. */
698 + while (retpos > 0) {
699 + /* If this byte is the target of a jmp we can't move it. */
700 + if (flags[retpos] & FLAG_TARGET)
707 + /* Break out of the loop if we have enough space and this is either
708 + the first byte of an instruction or a pad byte. */
709 + if ((flags[retpos] & (FLAG_INSN | FLAG_SCANNED)) != FLAG_SCANNED
717 + error("Unable to replace ret with jmp in %s\n", name);
727 /* generate op code */
728 @@ -1356,6 +1996,11 @@ void gen_code(const char *name, host_ulo
729 uint8_t args_present[MAX_ARGS];
730 const char *sym_name, *p;
732 +#if defined(HOST_I386) || defined(HOST_X86_64)
735 + int exit_addrs[MAX_EXITS];
738 /* Compute exact size excluding prologue and epilogue instructions.
739 * Increment start_offset to skip epilogue instructions, then compute
740 @@ -1366,33 +2011,12 @@ void gen_code(const char *name, host_ulo
741 p_end = p_start + size;
742 start_offset = offset;
743 #if defined(HOST_I386) || defined(HOST_X86_64)
744 -#ifdef CONFIG_FORMAT_COFF
749 - error("empty code for %s", name);
750 - while (*p != 0xc3) {
753 - error("ret or jmp expected at the end of %s", name);
755 - copy_size = p - p_start;
760 len = p_end - p_start;
762 - error("empty code for %s", name);
763 - if (p_end[-1] == 0xc3) {
766 - error("ret or jmp expected at the end of %s", name);
768 + retpos = trace_i386_op(name, p_start, &len, &patch_bytes, exit_addrs);
772 #elif defined(HOST_PPC)
775 @@ -1559,6 +2183,13 @@ void gen_code(const char *name, host_ulo
778 if (gen_switch == 2) {
779 +#if defined(HOST_I386) || defined(HOST_X86_64)
780 + if (patch_bytes != -1)
781 + copy_size += patch_bytes;
786 fprintf(outfile, "DEF(%s, %d, %d)\n", name + 3, nb_args, copy_size);
787 } else if (gen_switch == 1) {
789 @@ -1761,7 +2392,43 @@ void gen_code(const char *name, host_ulo
790 #error unsupport object format
794 + /* Replace the marker instructions with the actual opcodes. */
795 + for (i = 0; exit_addrs[i] != -1; i++) {
797 + switch (p_start[exit_addrs[i]])
799 + case 0xf4: op = 0xc3; break; /* hlt -> ret */
800 + case 0xfa: op = 0xe9; break; /* cli -> jmp */
801 + case 0xfb: op = 0xe9; break; /* sti -> jmp */
802 + default: error("Internal error");
805 + " *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
806 + exit_addrs[i], op);
808 + /* Fix up the return instruction. */
809 + if (patch_bytes != -1) {
811 + fprintf(outfile, " memcpy(gen_code_ptr + %d,"
812 + "gen_code_ptr + %d, %d);\n",
813 + copy_size, retpos, patch_bytes);
816 + " *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
819 + " *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
820 + retpos + 1, copy_size - (retpos + 5));
822 + copy_size += patch_bytes;
826 + " *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
831 #elif defined(HOST_X86_64)
833 @@ -1793,6 +2460,42 @@ void gen_code(const char *name, host_ulo
837 + /* Replace the marker instructions with the actual opcodes. */
838 + for (i = 0; exit_addrs[i] != -1; i++) {
840 + switch (p_start[exit_addrs[i]])
842 + case 0xf4: op = 0xc3; break; /* hlt -> ret */
843 + case 0xfa: op = 0xe9; break; /* cli -> jmp */
844 + case 0xfb: op = 0xe9; break; /* sti -> jmp */
845 + default: error("Internal error");
848 + " *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
849 + exit_addrs[i], op);
851 + /* Fix up the return instruction. */
852 + if (patch_bytes != -1) {
854 + fprintf(outfile, " memcpy(gen_code_ptr + %d,"
855 + "gen_code_ptr + %d, %d);\n",
856 + copy_size, retpos, patch_bytes);
859 + " *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
862 + " *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
863 + retpos + 1, copy_size - (retpos + 5));
865 + copy_size += patch_bytes;
869 + " *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
874 #elif defined(HOST_PPC)
876 --- qemu-0.7.0/exec-all.h.gcc4 2005-04-27 22:52:05.000000000 +0200
877 +++ qemu-0.7.0/exec-all.h 2005-06-02 21:41:51.000000000 +0200
878 @@ -335,14 +335,15 @@ do {\
880 #elif defined(__i386__) && defined(USE_DIRECT_JUMP)
882 -/* we patch the jump instruction directly */
883 +/* we patch the jump instruction directly. Use sti in place of the actual
884 + jmp instruction so that dyngen can patch in the correct result. */
885 #define GOTO_TB(opname, tbparam, n)\
887 asm volatile (".section .data\n"\
888 ASM_OP_LABEL_NAME(n, opname) ":\n"\
890 ASM_PREVIOUS_SECTION \
891 - "jmp " ASM_NAME(__op_jmp) #n "\n"\
892 + "sti;.long " ASM_NAME(__op_jmp) #n " - 1f\n"\