Re-organize the variants of `libtcg-helpers-*.bc` as such:
* `libtcg-helpers-full-$ARCH.bc`: unchanged, contains all helper
function with their bodies and all CSVs.
* `libtcg-helpers-declarations-only-$ARCH.bc`: all helper
functions have been turned to declarations. All CSVs (except a couple
of special ones) have been dropped.
* `libtcg-helpers-to-inline-$ARCH.bc`: only functions with the
`revng_inline` section retain their body. Only CSVs that are used by
these functions are present.
Lift now loads only the `declarations-only` variant of helpers, as
their body is not required until `inline-helpers`. In `inline-helpers`
the `to-inline` variant is loaded and linked, which then allows the
helpers to be inlined.
Add the `SimplePassManager` and `SimpleFunctionPassManager` classes
which add wrappers around the new LLVM pass manager. Change all the
applicable uses of the legacy pass manager with the wrapper.
Sometimes QEMU will emit code that reads a local temporary *before* it
is assigned in the `TranslationBlock`. This usually happens when lifting
non-code, but it's still a problem since it leads to phis around the
dispatcher, which we don't want.
For example, consider the following x86-64 code:
```
0000000140002000 <.text>:
140002000: f0 lock
140002001: 38 00 cmpb %al, (%rax)
```
It leads to:
```
[libtcg] Translation starting from 0x140002000:Generic64
[libtcg] ---- 0000000040002000
[libtcg] mov_i64 loc2,rax
[libtcg] mov_i64 loc1,rax
[libtcg] mov_i64 cc_src,loc1
[libtcg] mov_i64 loc8,loc0
[libtcg] sub_i64 cc_dst,loc0,loc1
[libtcg] discard cc_src2
[libtcg] discard cc_op
```
Note how `loc0` is read before being initialized.
Currently we zero-initialize all the temporaries. It would be in
princple possible to detect those that need the initialization, which
would also enable us to emit a warning.
LLVM purges loads from `nullptr` in functions not marked with
`null_pointer_is_valid`. This can lead to uninitialized accesses to tiny
code variables, which in turn lead to cross-`TranslationBlock` phis
which can prevent argumentless outlining.
Adding to the `root` function the `null_pointer_is_valid` attribute
fixes this problem.
This commit drops libptc in favor of its new form libtcg.
It brings several improvements, among which:
* The QEMU version we work on has been upgraded.
* CPUStateAccessAnalysis has been reimplemented in a way that makes it
easier to debug and solves some limitations (e.g., tracking leaking
pointers).
* Identification of pieces of the CPU state that are read by each helper
and fixing access to the CPU state is now performed at build-time.
* We no longer mmap the code we need to translate, dropping all the
issues related to code that needed to be mapped where something is
already present.
* We now have two distinct flavors of helper modules: the full one and
the "slim" one. The latter contains the definition only of functions
we intend to inline. It is used in most of the pipeline, a good thing
since we spend less time optimizing code we don't really care about.
The full module is only used on the re-compilation branch of the
pipeline.
* We no longer split the `cpu_loop` function.
* We change MetaAddress to rely on architectures from `model::` as
opposed to the LLVM ones.
* We no longer attach debug info to LLVM IR containing the original
assembly.
* We now verify that the lifted code only contains code we expect.
* Make the following private headers public:
* Lift/CPUStateAccessAnalysisPass.h
* Lift/CSVOffsets.h
* Lift/PTCDump.h
* Lift/VariableManager.h
* Move from revngSupport to revngLift:
* IRAnnotators.{h,cpp}
* SelfReferencingDbgAnnotationWriter.{h,cpp}
* Move from revngSupport to revngModel:
* FunctionTags.{h,cpp}
* ProgramCounterHandler.{h,cpp}
* Move from revngSupport to revngRecompile:
* OriginalAssemblyAnnotationWriter.{h,cpp}
This commit introduces `BasicBlockID` as the unique identifier for a
`efa::BasicBlock` into the CFG. A `BasicBlockID` is defined by a
`MetaAddress` plus an incremental integer. This enables us to have
multiple instances of the same block in a single function, which is
particularly useful when inlining multiple times the same function.
Apart from this, the commit also does the following:
* It drops representing `MetaAddress`es a `structs` in the IR. This created
several issues related to ABI. We now represent them as strings.
* It defines more functions in `support.h`, instead of defining prototypes
by hand in `CodeGenerator.cpp` and the like. Specifically, `unknownPC`
and `raise_exception_helper`. We also introduce a C "constructor" for
`PlainMetaAddress`.
* It significantly reduces the API of `GeneratedCodeBasicInfo`, which
was supposed to be put on a diet since a long time. Specifically,
many jump target related methods have been moved to free functions in
`IRHelpers.h`. Also `GCBI::getSuccessors` has been pushed into its
only user, `PruneRetSuccessors`, to prevent further usage of a
deprecated API. In the future, it would be nice to drop it entirely.
* It introduces `efa::BasicBlock::InlinedFrom`.
* Introduce an enum to represent named argument indices for `newpc`.
This enables us to more effectively manipulate its argument list.
* It improves the verification and error reporting for
`efa::FunctionMetadata`.
* Update tests.
This commit is preliminary to another piece of work to improve the
generality of inlining beyond the simple "fake function" scenario, for
which the feature was originally conceived.
Alessandro Di Federico