]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - src/patches/qemu-0.9.1-gcc4.patch
projects / people / pmueller / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Applied "check on BER decoding" security fix
[people/pmueller/ipfire-2.x.git] / src / patches / qemu-0.9.1-gcc4.patch
CommitLineData
bc38ecd0
MT		 12008-01-12 Mike Kronenberg <mike.kronenberg@kronenberg.org>
2
3 * dyngen-exec.h: Fix for QEMU 0.9.1.
4 * dyngen-c.h: Fix for QEMU 0.9.1.
5
62007-02-01 Mike Kronenberg <mike.kronenberg@kronenberg.org>
7
8 * target-ppc/exec.h: Fix for QEMU 0.9.0.
9 * dyngen-exec.h: Fix for QEMU 0.9.0.
10
112005-06-02 Gwenole Beauchesne <gbeauchesne@mandriva.com>
12
13 * dyngen.c (trace_i386_insn): Fix push/imul case with 8-bit
14 immediate.
15
162005-05-11 Paul Brook <paul@codesourcery.com>
17
18 * gcc4 host support.
19
20--- qemu-0.7.0/target-ppc/exec.h.gcc4 2005-04-27 22:52:05.000000000 +0200
21+++ qemu-0.7.0/target-ppc/exec.h 2005-06-02 21:41:51.000000000 +0200
22@@ -64,11 +64,7 @@ #define FT0 (env->ft0)
23 #define FT1 (env->ft1)
24 #define FT2 (env->ft2)
25
26-#if defined (DEBUG_OP)
27-# define RETURN() __asm__ __volatile__("nop" : : : "memory");
28-#else
29-# define RETURN() __asm__ __volatile__("" : : : "memory");
30-#endif
31+#define RETURN() FORCE_RET()
32
33 #include "cpu.h"
34 #include "exec-all.h"
35--- qemu-0.7.0/dyngen-exec.h.gcc4 2005-04-27 22:52:05.000000000 +0200
36+++ qemu-0.7.0/dyngen-exec.h 2005-06-02 21:41:51.000000000 +0200
37@@ -194,7 +194,12 @@ extern int printf(const char *, ...);
38 #endif
39
40 /* force GCC to generate only one epilog at the end of the function */
41+#if defined(__i386__) || defined(__x86_64__)
42+/* Also add 4 bytes of padding so that we can replace the ret with a jmp. */
43+#define FORCE_RET() asm volatile ("nop;nop;nop;nop");
44+#else
45 #define FORCE_RET() __asm__ __volatile__("" : : : "memory");
46+#endif
47
48 #ifndef OPPROTO
49 #define OPPROTO
50@@ -251,10 +256,17 @@ extern int __op_jmp0, __op_jmp1, __op_jm
51 #endif
52
53 #if defined(__i386__)
54-#define EXIT_TB() asm volatile ("ret")
55-#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
56+/* Dyngen will replace hlt instructions with a ret instruction. Inserting a
57+ ret directly would confuse dyngen. */
58+#define EXIT_TB() asm volatile ("hlt")
59+/* Dyngen will replace cli with 0x9e (jmp).
60+ We generate the offset manually. */
61+#define GOTO_LABEL_PARAM(n) \
62+ asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
63 #elif defined(__x86_64__)
64-#define EXIT_TB() asm volatile ("ret")
65-#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
66+/* The same as i386. */
67+#define EXIT_TB() asm volatile ("hlt")
68+#define GOTO_LABEL_PARAM(n) \
69+ asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
70 #elif defined(__powerpc__)
71 #define EXIT_TB() asm volatile ("blr")
72--- qemu-0.7.0/dyngen.c.gcc4 2005-04-27 22:52:05.000000000 +0200
73+++ qemu-0.7.0/dyngen.c 2005-06-02 22:25:06.000000000 +0200
74@@ -32,6 +32,8 @@
75
76 #include "config-host.h"
77
78+//#define DEBUG_OP
79+
80 /* NOTE: we test CONFIG_WIN32 instead of _WIN32 to enabled cross
81 compilation */
82 #if defined(CONFIG_WIN32)
83@@ -1343,6 +1345,644 @@ int arm_emit_ldr_info(const char *name,
84 #endif
85
86
87+#if defined(HOST_I386) || defined(HOST_X86_64)
88+
89+/* This byte is the first byte of an instruction. */
90+#define FLAG_INSN (1 << 0)
91+/* This byte has been processed as part of an instruction. */
92+#define FLAG_SCANNED (1 << 1)
93+/* This instruction is a return instruction. Gcc cometimes generates prefix
94+ bytes, so may be more than one byte long. */
95+#define FLAG_RET (1 << 2)
96+/* This is either the target of a jump, or the preceeding instruction uses
97+ a pc-relative offset. */
98+#define FLAG_TARGET (1 << 3)
99+/* This is a magic instruction that needs fixing up. */
100+#define FLAG_EXIT (1 << 4)
101+#define MAX_EXITS 5
102+
103+static void
104+bad_opcode(const char *name, uint32_t op)
105+{
106+ error("Unsupported opcode %0*x in %s", (op > 0xff) ? 4 : 2, op, name);
107+}
108+
109+/* Mark len bytes as scanned, Returns insn_size + len. Reports an error
110+ if these bytes have already been scanned. */
111+static int
112+eat_bytes(const char *name, char *flags, int insn, int insn_size, int len)
113+{
114+ while (len > 0) {
115+ /* This should never occur in sane code. */
116+ if (flags[insn + insn_size] & FLAG_SCANNED)
117+ error ("Overlapping instructions in %s", name);
118+ flags[insn + insn_size] |= FLAG_SCANNED;
119+ insn_size++;
120+ len--;
121+ }
122+ return insn_size;
123+}
124+
125+static void
126+trace_i386_insn (const char *name, uint8_t *start_p, char *flags, int insn,
127+ int len)
128+{
129+ uint8_t *ptr;
130+ uint8_t op;
131+ int modrm;
132+ int is_prefix;
133+ int op_size;
134+ int addr_size;
135+ int insn_size;
136+ int is_ret;
137+ int is_condjmp;
138+ int is_jmp;
139+ int is_exit;
140+ int is_pcrel;
141+ int immed;
142+ int seen_rexw;
143+ int32_t disp;
144+
145+ ptr = start_p + insn;
146+ /* nonzero if this insn has a ModR/M byte. */
147+ modrm = 1;
148+ /* The size of the immediate value in this instruction. */
149+ immed = 0;
150+ /* The operand size. */
151+ op_size = 4;
152+ /* The address size */
153+ addr_size = 4;
154+ /* The total length of this instruction. */
155+ insn_size = 0;
156+ is_prefix = 1;
157+ is_ret = 0;
158+ is_condjmp = 0;
159+ is_jmp = 0;
160+ is_exit = 0;
161+ seen_rexw = 0;
162+ is_pcrel = 0;
163+
164+ while (is_prefix) {
165+ op = ptr[insn_size];
166+ insn_size = eat_bytes(name, flags, insn, insn_size, 1);
167+ is_prefix = 0;
168+ switch (op >> 4) {
169+ case 0:
170+ case 1:
171+ case 2:
172+ case 3:
173+ if (op == 0x0f) {
174+ /* two-byte opcode. */
175+ op = ptr[insn_size];
176+ insn_size = eat_bytes(name, flags, insn, insn_size, 1);
177+ switch (op >> 4) {
178+ case 0:
179+ if ((op & 0xf) > 3)
180+ modrm = 0;
181+ break;
182+ case 1: /* vector move or prefetch */
183+ case 2: /* various moves and vector compares. */
184+ case 4: /* cmov */
185+ case 5: /* vector instructions */
186+ case 6:
187+ case 13:
188+ case 14:
189+ case 15:
190+ break;
191+ case 7: /* mmx */
192+ if (op & 0x77) /* emms */
193+ modrm = 0;
194+ break;
195+ case 3: /* wrmsr, rdtsc, rdmsr, rdpmc, sysenter, sysexit */
196+ modrm = 0;
197+ break;
198+ case 8: /* long conditional jump */
199+ is_condjmp = 1;
200+ immed = op_size;
201+ modrm = 0;
202+ break;
203+ case 9: /* setcc */
204+ break;
205+ case 10:
206+ switch (op & 0x7) {
207+ case 0: /* push fs/gs */
208+ case 1: /* pop fs/gs */
209+ case 2: /* cpuid/rsm */
210+ modrm = 0;
211+ break;
212+ case 4: /* shld/shrd immediate */
213+ immed = 1;
214+ break;
215+ default: /* Normal instructions with a ModR/M byte. */
216+ break;
217+ }
218+ break;
219+ case 11:
220+ switch (op & 0xf) {
221+ case 10: /* bt, bts, btr, btc */
222+ immed = 1;
223+ break;
224+ default:
225+ /* cmpxchg, lss, btr, lfs, lgs, movzx, btc, bsf, bsr
226+ undefined, and movsx */
227+ break;
228+ }
229+ break;
230+ case 12:
231+ if (op & 8) {
232+ /* bswap */
233+ modrm = 0;
234+ } else {
235+ switch (op & 0x7) {
236+ case 2:
237+ case 4:
238+ case 5:
239+ case 6:
240+ immed = 1;
241+ break;
242+ default:
243+ break;
244+ }
245+ }
246+ break;
247+ }
248+ } else if ((op & 0x07) <= 0x3) {
249+ /* General arithmentic ax. */
250+ } else if ((op & 0x07) <= 0x5) {
251+ /* General arithmetic ax, immediate. */
252+ if (op & 0x01)
253+ immed = op_size;
254+ else
255+ immed = 1;
256+ modrm = 0;
257+ } else if ((op & 0x23) == 0x22) {
258+ /* Segment prefix. */
259+ is_prefix = 1;
260+ } else {
261+ /* Segment register push/pop or DAA/AAA/DAS/AAS. */
262+ modrm = 0;
263+ }
264+ break;
265+
266+#if defined(HOST_X86_64)
267+ case 4: /* rex prefix. */
268+ is_prefix = 1;
269+ /* The address/operand size is actually 64-bit, but the immediate
270+ values in the instruction are still 32-bit. */
271+ op_size = 4;
272+ addr_size = 4;
273+ if (op & 8)
274+ seen_rexw = 1;
275+ break;
276+#else
277+ case 4: /* inc/dec register. */
278+#endif
279+ case 5: /* push/pop general register. */
280+ modrm = 0;
281+ break;
282+
283+ case 6:
284+ switch (op & 0x0f) {
285+ case 0: /* pusha */
286+ case 1: /* popa */
287+ modrm = 0;
288+ break;
289+ case 2: /* bound */
290+ case 3: /* arpl */
291+ break;
292+ case 4: /* FS */
293+ case 5: /* GS */
294+ is_prefix = 1;
295+ break;
296+ case 6: /* opcode size prefix. */
297+ op_size = 2;
298+ is_prefix = 1;
299+ break;
300+ case 7: /* Address size prefix. */
301+ addr_size = 2;
302+ is_prefix = 1;
303+ break;
304+ case 8: /* push immediate */
305+ immed = op_size;
306+ modrm = 0;
307+ break;
308+ case 10: /* push 8-bit immediate */
309+ immed = 1;
310+ modrm = 0;
311+ break;
312+ case 9: /* imul immediate */
313+ immed = op_size;
314+ break;
315+ case 11: /* imul 8-bit immediate */
316+ immed = 1;
317+ break;
318+ case 12: /* insb */
319+ case 13: /* insw */
320+ case 14: /* outsb */
321+ case 15: /* outsw */
322+ modrm = 0;
323+ break;
324+ }
325+ break;
326+
327+ case 7: /* Short conditional jump. */
328+ is_condjmp = 1;
329+ immed = 1;
330+ modrm = 0;
331+ break;
332+
333+ case 8:
334+ if ((op & 0xf) <= 3) {
335+ /* arithmetic immediate. */
336+ if ((op & 3) == 1)
337+ immed = op_size;
338+ else
339+ immed = 1;
340+ }
341+ /* else test, xchg, mov, lea or pop general. */
342+ break;
343+
344+ case 9:
345+ /* Various single-byte opcodes with no modrm byte. */
346+ modrm = 0;
347+ if (op == 10) {
348+ /* Call */
349+ immed = 4;
350+ }
351+ break;
352+
353+ case 10:
354+ switch ((op & 0xe) >> 1) {
355+ case 0: /* mov absoliute immediate. */
356+ case 1:
357+ if (seen_rexw)
358+ immed = 8;
359+ else
360+ immed = addr_size;
361+ break;
362+ case 4: /* test immediate. */
363+ if (op & 1)
364+ immed = op_size;
365+ else
366+ immed = 1;
367+ break;
368+ default: /* Various string ops. */
369+ break;
370+ }
371+ modrm = 0;
372+ break;
373+
374+ case 11: /* move immediate to register */
375+ if (op & 8) {
376+ if (seen_rexw)
377+ immed = 8;
378+ else
379+ immed = op_size;
380+ } else {
381+ immed = 1;
382+ }
383+ modrm = 0;
384+ break;
385+
386+ case 12:
387+ switch (op & 0xf) {
388+ case 0: /* shift immediate */
389+ case 1:
390+ immed = 1;
391+ break;
392+ case 2: /* ret immediate */
393+ immed = 2;
394+ modrm = 0;
395+ bad_opcode(name, op);
396+ break;
397+ case 3: /* ret */
398+ modrm = 0;
399+ is_ret = 1;
400+ case 4: /* les */
401+ case 5: /* lds */
402+ break;
403+ case 6: /* mov immediate byte */
404+ immed = 1;
405+ break;
406+ case 7: /* mov immediate */
407+ immed = op_size;
408+ break;
409+ case 8: /* enter */
410+ /* TODO: Is this right? */
411+ immed = 3;
412+ modrm = 0;
413+ break;
414+ case 10: /* retf immediate */
415+ immed = 2;
416+ modrm = 0;
417+ bad_opcode(name, op);
418+ break;
419+ case 13: /* int */
420+ immed = 1;
421+ modrm = 0;
422+ break;
423+ case 11: /* retf */
424+ case 15: /* iret */
425+ modrm = 0;
426+ bad_opcode(name, op);
427+ break;
428+ default: /* leave, int3 or into */
429+ modrm = 0;
430+ break;
431+ }
432+ break;
433+
434+ case 13:
435+ if ((op & 0xf) >= 8) {
436+ /* Coprocessor escape. For our purposes this is just a normal
437+ instruction with a ModR/M byte. */
438+ } else if ((op & 0xf) >= 4) {
439+ /* AAM, AAD or XLAT */
440+ modrm = 0;
441+ }
442+ /* else shift instruction */
443+ break;
444+
445+ case 14:
446+ switch ((op & 0xc) >> 2) {
447+ case 0: /* loop or jcxz */
448+ is_condjmp = 1;
449+ immed = 1;
450+ break;
451+ case 1: /* in/out immed */
452+ immed = 1;
453+ break;
454+ case 2: /* call or jmp */
455+ switch (op & 3) {
456+ case 0: /* call */
457+ immed = op_size;
458+ break;
459+ case 1: /* long jump */
460+ immed = 4;
461+ is_jmp = 1;
462+ break;
463+ case 2: /* far jmp */
464+ bad_opcode(name, op);
465+ break;
466+ case 3: /* short jmp */
467+ immed = 1;
468+ is_jmp = 1;
469+ break;
470+ }
471+ break;
472+ case 3: /* in/out register */
473+ break;
474+ }
475+ modrm = 0;
476+ break;
477+
478+ case 15:
479+ switch ((op & 0xe) >> 1) {
480+ case 0:
481+ case 1:
482+ is_prefix = 1;
483+ break;
484+ case 2:
485+ case 4:
486+ case 5:
487+ case 6:
488+ modrm = 0;
489+ /* Some privileged insns are used as markers. */
490+ switch (op) {
491+ case 0xf4: /* hlt: Exit translation block. */
492+ is_exit = 1;
493+ break;
494+ case 0xfa: /* cli: Jump to label. */
495+ is_exit = 1;
496+ immed = 4;
497+ break;
498+ case 0xfb: /* sti: TB patch jump. */
499+ /* Mark the insn for patching, but continue sscanning. */
500+ flags[insn] |= FLAG_EXIT;
501+ immed = 4;
502+ break;
503+ }
504+ break;
505+ case 3: /* unary grp3 */
506+ if ((ptr[insn_size] & 0x38) == 0) {
507+ if (op == 0xf7)
508+ immed = op_size;
509+ else
510+ immed = 1; /* test immediate */
511+ }
512+ break;
513+ case 7: /* inc/dec grp4/5 */
514+ /* TODO: This includes indirect jumps. We should fail if we
515+ encounter one of these. */
516+ break;
517+ }
518+ break;
519+ }
520+ }
521+
522+ if (modrm) {
523+ if (addr_size != 4)
524+ error("16-bit addressing mode used in %s", name);
525+
526+ disp = 0;
527+ modrm = ptr[insn_size];
528+ insn_size = eat_bytes(name, flags, insn, insn_size, 1);
529+ modrm &= 0xc7;
530+ switch ((modrm & 0xc0) >> 6) {
531+ case 0:
532+ if (modrm == 5)
533+ disp = 4;
534+ break;
535+ case 1:
536+ disp = 1;
537+ break;
538+ case 2:
539+ disp = 4;
540+ break;
541+ }
542+ if ((modrm & 0xc0) != 0xc0 && (modrm & 0x7) == 4) {
543+ /* SIB byte */
544+ if (modrm == 4 && (ptr[insn_size] & 0x7) == 5) {
545+ disp = 4;
546+ is_pcrel = 1;
547+ }
548+ insn_size = eat_bytes(name, flags, insn, insn_size, 1);
549+ }
550+ insn_size = eat_bytes(name, flags, insn, insn_size, disp);
551+ }
552+ insn_size = eat_bytes(name, flags, insn, insn_size, immed);
553+ if (is_condjmp || is_jmp) {
554+ if (immed == 1) {
555+ disp = (int8_t)*(ptr + insn_size - 1);
556+ } else {
557+ disp = (((int32_t)*(ptr + insn_size - 1)) << 24)
558+ | (((int32_t)*(ptr + insn_size - 2)) << 16)
559+ | (((int32_t)*(ptr + insn_size - 3)) << 8)
560+ | *(ptr + insn_size - 4);
561+ }
562+ disp += insn_size;
563+ /* Jumps to external symbols point to the address of the offset
564+ before relocation. */
565+ /* ??? These are probably a tailcall. We could fix them up by
566+ replacing them with jmp to EOB + call, but it's easier to just
567+ prevent the compiler generating them. */
568+ if (disp == 1)
569+ error("Unconditional jump (sibcall?) in %s", name);
570+ disp += insn;
571+ if (disp < 0 || disp > len)
572+ error("Jump outside instruction in %s", name);
573+
574+ if ((flags[disp] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_SCANNED)
575+ error("Overlapping instructions in %s", name);
576+
577+ flags[disp] |= (FLAG_INSN | FLAG_TARGET);
578+ is_pcrel = 1;
579+ }
580+ if (is_pcrel) {
581+ /* Mark the following insn as a jump target. This will stop
582+ this instruction being moved. */
583+ flags[insn + insn_size] |= FLAG_TARGET;
584+ }
585+ if (is_ret)
586+ flags[insn] |= FLAG_RET;
587+
588+ if (is_exit)
589+ flags[insn] |= FLAG_EXIT;
590+
591+ if (!(is_jmp || is_ret || is_exit))
592+ flags[insn + insn_size] |= FLAG_INSN;
593+}
594+
595+/* Scan a function body. Returns the position of the return sequence.
596+ Sets *patch_bytes to the number of bytes that need to be copied from that
597+ location. If no patching is required (ie. the return is the last insn)
598+ *patch_bytes will be set to -1. *plen is the number of code bytes to copy.
599+ */
600+static int trace_i386_op(const char * name, uint8_t *start_p, int *plen,
601+ int *patch_bytes, int *exit_addrs)
602+{
603+ char *flags;
604+ int more;
605+ int insn;
606+ int retpos;
607+ int bytes;
608+ int num_exits;
609+ int len;
610+ int last_insn;
611+
612+ len = *plen;
613+ flags = malloc(len + 1);
614+ memset(flags, 0, len + 1);
615+ flags[0] |= FLAG_INSN;
616+ more = 1;
617+ while (more) {
618+ more = 0;
619+ for (insn = 0; insn < len; insn++) {
620+ if ((flags[insn] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_INSN) {
621+ trace_i386_insn(name, start_p, flags, insn, len);
622+ more = 1;
623+ }
624+ }
625+ }
626+
627+ /* Strip any unused code at the end of the function. */
628+ while (len > 0 && flags[len - 1] == 0)
629+ len--;
630+
631+ retpos = -1;
632+ num_exits = 0;
633+ last_insn = 0;
634+ for (insn = 0; insn < len; insn++) {
635+ if (flags[insn] & FLAG_RET) {
636+ /* ??? In theory it should be possible to handle multiple return
637+ points. In practice it's not worth the effort. */
638+ if (retpos != -1)
639+ error("Multiple return instructions in %s", name);
640+ retpos = insn;
641+ }
642+ if (flags[insn] & FLAG_EXIT) {
643+ if (num_exits == MAX_EXITS)
644+ error("Too many block exits in %s", name);
645+ exit_addrs[num_exits] = insn;
646+ num_exits++;
647+ }
648+ if (flags[insn] & FLAG_INSN)
649+ last_insn = insn;
650+ }
651+
652+ exit_addrs[num_exits] = -1;
653+ if (retpos == -1) {
654+ if (num_exits == 0) {
655+ error ("No return instruction found in %s", name);
656+ } else {
657+ retpos = len;
658+ last_insn = len;
659+ }
660+ }
661+
662+ /* If the return instruction is the last instruction we can just
663+ remove it. */
664+ if (retpos == last_insn)
665+ *patch_bytes = -1;
666+ else
667+ *patch_bytes = 0;
668+
669+ /* Back up over any nop instructions. */
670+ while (retpos > 0
671+ && (flags[retpos] & FLAG_TARGET) == 0
672+ && (flags[retpos - 1] & FLAG_INSN) != 0
673+ && start_p[retpos - 1] == 0x90) {
674+ retpos--;
675+ }
676+
677+ if (*patch_bytes == -1) {
678+ *plen = retpos;
679+ free (flags);
680+ return retpos;
681+ }
682+ *plen = len;
683+
684+ /* The ret is in the middle of the function. Find four more bytes that
685+ so the ret can be replaced by a jmp. */
686+ /* ??? Use a short jump where possible. */
687+ bytes = 4;
688+ insn = retpos + 1;
689+ /* We can clobber everything up to the next jump target. */
690+ while (insn < len && bytes > 0 && (flags[insn] & FLAG_TARGET) == 0) {
691+ insn++;
692+ bytes--;
693+ }
694+ if (bytes > 0) {
695+ /* ???: Strip out nop blocks. */
696+ /* We can't do the replacement without clobbering anything important.
697+ Copy preceeding instructions(s) to give us some space. */
698+ while (retpos > 0) {
699+ /* If this byte is the target of a jmp we can't move it. */
700+ if (flags[retpos] & FLAG_TARGET)
701+ break;
702+
703+ (*patch_bytes)++;
704+ bytes--;
705+ retpos--;
706+
707+ /* Break out of the loop if we have enough space and this is either
708+ the first byte of an instruction or a pad byte. */
709+ if ((flags[retpos] & (FLAG_INSN | FLAG_SCANNED)) != FLAG_SCANNED
710+ && bytes <= 0) {
711+ break;
712+ }
713+ }
714+ }
715+
716+ if (bytes > 0)
717+ error("Unable to replace ret with jmp in %s\n", name);
718+
719+ free(flags);
720+ return retpos;
721+}
722+
723+#endif
724+
725 #define MAX_ARGS 3
726
727 /* generate op code */
728@@ -1356,6 +1996,11 @@ void gen_code(const char *name, host_ulo
729 uint8_t args_present[MAX_ARGS];
730 const char *sym_name, *p;
731 EXE_RELOC *rel;
732+#if defined(HOST_I386) || defined(HOST_X86_64)
733+ int patch_bytes;
734+ int retpos;
735+ int exit_addrs[MAX_EXITS];
736+#endif
737
738 /* Compute exact size excluding prologue and epilogue instructions.
739 * Increment start_offset to skip epilogue instructions, then compute
740@@ -1366,33 +2011,12 @@ void gen_code(const char *name, host_ulo
741 p_end = p_start + size;
742 start_offset = offset;
743 #if defined(HOST_I386) || defined(HOST_X86_64)
744-#ifdef CONFIG_FORMAT_COFF
745- {
746- uint8_t *p;
747- p = p_end - 1;
748- if (p == p_start)
749- error("empty code for %s", name);
750- while (*p != 0xc3) {
751- p--;
752- if (p <= p_start)
753- error("ret or jmp expected at the end of %s", name);
754- }
755- copy_size = p - p_start;
756- }
757-#else
758 {
759 int len;
760 len = p_end - p_start;
761- if (len == 0)
762- error("empty code for %s", name);
763- if (p_end[-1] == 0xc3) {
764- len--;
765- } else {
766- error("ret or jmp expected at the end of %s", name);
767- }
768+ retpos = trace_i386_op(name, p_start, &len, &patch_bytes, exit_addrs);
769 copy_size = len;
770 }
771-#endif
772 #elif defined(HOST_PPC)
773 {
774 uint8_t *p;
775@@ -1559,6 +2183,13 @@ void gen_code(const char *name, host_ulo
776 }
777
778 if (gen_switch == 2) {
779+#if defined(HOST_I386) || defined(HOST_X86_64)
780+ if (patch_bytes != -1)
781+ copy_size += patch_bytes;
782+#ifdef DEBUG_OP
783+ copy_size += 2;
784+#endif
785+#endif
786 fprintf(outfile, "DEF(%s, %d, %d)\n", name + 3, nb_args, copy_size);
787 } else if (gen_switch == 1) {
788
789@@ -1761,7 +2392,43 @@ void gen_code(const char *name, host_ulo
790 #error unsupport object format
791 #endif
792 }
793+ }
794+ /* Replace the marker instructions with the actual opcodes. */
795+ for (i = 0; exit_addrs[i] != -1; i++) {
796+ int op;
797+ switch (p_start[exit_addrs[i]])
798+ {
799+ case 0xf4: op = 0xc3; break; /* hlt -> ret */
800+ case 0xfa: op = 0xe9; break; /* cli -> jmp */
801+ case 0xfb: op = 0xe9; break; /* sti -> jmp */
802+ default: error("Internal error");
803+ }
804+ fprintf(outfile,
805+ " *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
806+ exit_addrs[i], op);
807 }
808+ /* Fix up the return instruction. */
809+ if (patch_bytes != -1) {
810+ if (patch_bytes) {
811+ fprintf(outfile, " memcpy(gen_code_ptr + %d,"
812+ "gen_code_ptr + %d, %d);\n",
813+ copy_size, retpos, patch_bytes);
814+ }
815+ fprintf(outfile,
816+ " *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
817+ retpos);
818+ fprintf(outfile,
819+ " *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
820+ retpos + 1, copy_size - (retpos + 5));
821+
822+ copy_size += patch_bytes;
823+ }
824+#ifdef DEBUG_OP
825+ fprintf(outfile,
826+ " *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
827+ copy_size);
828+ copy_size += 2;
829+#endif
830 }
831 #elif defined(HOST_X86_64)
832 {
833@@ -1793,6 +2460,42 @@ void gen_code(const char *name, host_ulo
834 }
835 }
836 }
837+ /* Replace the marker instructions with the actual opcodes. */
838+ for (i = 0; exit_addrs[i] != -1; i++) {
839+ int op;
840+ switch (p_start[exit_addrs[i]])
841+ {
842+ case 0xf4: op = 0xc3; break; /* hlt -> ret */
843+ case 0xfa: op = 0xe9; break; /* cli -> jmp */
844+ case 0xfb: op = 0xe9; break; /* sti -> jmp */
845+ default: error("Internal error");
846+ }
847+ fprintf(outfile,
848+ " *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
849+ exit_addrs[i], op);
850+ }
851+ /* Fix up the return instruction. */
852+ if (patch_bytes != -1) {
853+ if (patch_bytes) {
854+ fprintf(outfile, " memcpy(gen_code_ptr + %d,"
855+ "gen_code_ptr + %d, %d);\n",
856+ copy_size, retpos, patch_bytes);
857+ }
858+ fprintf(outfile,
859+ " *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
860+ retpos);
861+ fprintf(outfile,
862+ " *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
863+ retpos + 1, copy_size - (retpos + 5));
864+
865+ copy_size += patch_bytes;
866+ }
867+#ifdef DEBUG_OP
868+ fprintf(outfile,
869+ " *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
870+ copy_size);
871+ copy_size += 2;
872+#endif
873 }
874 #elif defined(HOST_PPC)
875 {
876--- qemu-0.7.0/exec-all.h.gcc4 2005-04-27 22:52:05.000000000 +0200
877+++ qemu-0.7.0/exec-all.h 2005-06-02 21:41:51.000000000 +0200
878@@ -335,14 +335,15 @@ do {\
879
880 #elif defined(__i386__) && defined(USE_DIRECT_JUMP)
881
882-/* we patch the jump instruction directly */
883+/* we patch the jump instruction directly. Use sti in place of the actual
884+ jmp instruction so that dyngen can patch in the correct result. */
885 #define GOTO_TB(opname, tbparam, n)\
886 do {\
887 asm volatile (".section .data\n"\
888 ASM_OP_LABEL_NAME(n, opname) ":\n"\
889 ".long 1f\n"\
890 ASM_PREVIOUS_SECTION \
891- "jmp " ASM_NAME(__op_jmp) #n "\n"\
892+ "sti;.long " ASM_NAME(__op_jmp) #n " - 1f\n"\
893 "1:\n");\
894 } while (0)
895
Peter's tree of IPFire 2.x