[Qemu-devel] BBL execution hooking

["felix.matenaar@rwth-aachen" <felix.matenaar@rwth-aachen.de>]

Hello everyone,

I started implementing BBL execution hooking. Requirements were that two
callbacks (bbl_start and bbl_stop) are called when a BBL is executed.
Since bbl_start is called through a gen_helper in
gen_intermediate_code_internal, that is not a problem.

But I saw that modifying gen_eob() so that gen_helper_bbl_stop() is
called does not trigger all ends of a BBL.

Some sample output:

BBL start at 0x1002a12
BBL stop with 5 instructions
BBL start at 0x1002a1b
BBL start at 0x10029b3
BBL start at 0x10029cc
BBL start at 0x10029e4
BBL stop with 4 instructions


here you see that on the first and the last BBL the stop callback is
called properly but not for the other three.
Disassembly:

 1002a1b:   85 c0                   test   %eax,%eax
 1002a1d:   75 94                   jne    0x10029b3

 10029b3:   83 7d e4 50         cmpl   $0x50,-0x1c(%ebp)
 10029b7:   75 13                   jne    0x10029cc

 10029cc:   a1 3c 98 00 01     mov    0x100983c,%eax
 10029d1:   3b c6                   cmp    %esi,%eax
 10029d3:   74 0f                    je     0x10029e4

The two working BBLs end up in a call instruction. Is gen_eob() not used
on conditional jump instructions? Since I were not able to find how you
handle je/jne my question is where you handle that.

Regards,
    Felix