1 /* 2 * plugin-gen.c - TCG-related bits of plugin infrastructure 3 * 4 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org> 5 * License: GNU GPL, version 2 or later. 6 * See the COPYING file in the top-level directory. 7 * 8 * We support instrumentation at an instruction granularity. That is, 9 * if a plugin wants to instrument the memory accesses performed by a 10 * particular instruction, it can just do that instead of instrumenting 11 * all memory accesses. Thus, in order to do this we first have to 12 * translate a TB, so that plugins can decide what/where to instrument. 13 * 14 * Injecting the desired instrumentation could be done with a second 15 * translation pass that combined the instrumentation requests, but that 16 * would be ugly and inefficient since we would decode the guest code twice. 17 * Instead, during TB translation we add "empty" instrumentation calls for all 18 * possible instrumentation events, and then once we collect the instrumentation 19 * requests from plugins, we either "fill in" those empty events or remove them 20 * if they have no requests. 21 * 22 * When "filling in" an event we first copy the empty callback's TCG ops. This 23 * might seem unnecessary, but it is done to support an arbitrary number 24 * of callbacks per event. Take for example a regular instruction callback. 25 * We first generate a callback to an empty helper function. Then, if two 26 * plugins register one callback each for this instruction, we make two copies 27 * of the TCG ops generated for the empty callback, substituting the function 28 * pointer that points to the empty helper function with the plugins' desired 29 * callback functions. After that we remove the empty callback's ops. 30 * 31 * Note that the location in TCGOp.args[] of the pointer to a helper function 32 * varies across different guest and host architectures. Instead of duplicating 33 * the logic that figures this out, we rely on the fact that the empty 34 * callbacks point to empty functions that are unique pointers in the program. 35 * Thus, to find the right location we just have to look for a match in 36 * TCGOp.args[]. This is the main reason why we first copy an empty callback's 37 * TCG ops and then fill them in; regardless of whether we have one or many 38 * callbacks for that event, the logic to add all of them is the same. 39 * 40 * When generating more than one callback per event, we make a small 41 * optimization to avoid generating redundant operations. For instance, for the 42 * second and all subsequent callbacks of an event, we do not need to reload the 43 * CPU's index into a TCG temp, since the first callback did it already. 44 */ 45 #include "qemu/osdep.h" 46 #include "tcg/tcg.h" 47 #include "tcg/tcg-op.h" 48 #include "exec/exec-all.h" 49 #include "exec/plugin-gen.h" 50 #include "exec/translator.h" 51 52 #ifdef CONFIG_SOFTMMU 53 # define CONFIG_SOFTMMU_GATE 1 54 #else 55 # define CONFIG_SOFTMMU_GATE 0 56 #endif 57 58 /* 59 * plugin_cb_start TCG op args[]: 60 * 0: enum plugin_gen_from 61 * 1: enum plugin_gen_cb 62 * 2: set to 1 for mem callback that is a write, 0 otherwise. 63 */ 64 65 enum plugin_gen_from { 66 PLUGIN_GEN_FROM_TB, 67 PLUGIN_GEN_FROM_INSN, 68 PLUGIN_GEN_FROM_MEM, 69 PLUGIN_GEN_AFTER_INSN, 70 PLUGIN_GEN_N_FROMS, 71 }; 72 73 enum plugin_gen_cb { 74 PLUGIN_GEN_CB_UDATA, 75 PLUGIN_GEN_CB_INLINE, 76 PLUGIN_GEN_CB_MEM, 77 PLUGIN_GEN_ENABLE_MEM_HELPER, 78 PLUGIN_GEN_DISABLE_MEM_HELPER, 79 PLUGIN_GEN_N_CBS, 80 }; 81 82 /* 83 * These helpers are stubs that get dynamically switched out for calls 84 * direct to the plugin if they are subscribed to. 85 */ 86 void HELPER(plugin_vcpu_udata_cb)(uint32_t cpu_index, void *udata) 87 { } 88 89 void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index, 90 qemu_plugin_meminfo_t info, uint64_t vaddr, 91 void *userdata) 92 { } 93 94 static void do_gen_mem_cb(TCGv vaddr, uint32_t info) 95 { 96 TCGv_i32 cpu_index = tcg_temp_new_i32(); 97 TCGv_i32 meminfo = tcg_const_i32(info); 98 TCGv_i64 vaddr64 = tcg_temp_new_i64(); 99 TCGv_ptr udata = tcg_const_ptr(NULL); 100 101 tcg_gen_ld_i32(cpu_index, cpu_env, 102 -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index)); 103 tcg_gen_extu_tl_i64(vaddr64, vaddr); 104 105 gen_helper_plugin_vcpu_mem_cb(cpu_index, meminfo, vaddr64, udata); 106 107 tcg_temp_free_ptr(udata); 108 tcg_temp_free_i64(vaddr64); 109 tcg_temp_free_i32(meminfo); 110 tcg_temp_free_i32(cpu_index); 111 } 112 113 static void gen_empty_udata_cb(void) 114 { 115 TCGv_i32 cpu_index = tcg_temp_new_i32(); 116 TCGv_ptr udata = tcg_const_ptr(NULL); /* will be overwritten later */ 117 118 tcg_gen_ld_i32(cpu_index, cpu_env, 119 -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index)); 120 gen_helper_plugin_vcpu_udata_cb(cpu_index, udata); 121 122 tcg_temp_free_ptr(udata); 123 tcg_temp_free_i32(cpu_index); 124 } 125 126 /* 127 * For now we only support addi_i64. 128 * When we support more ops, we can generate one empty inline cb for each. 129 */ 130 static void gen_empty_inline_cb(void) 131 { 132 TCGv_i64 val = tcg_temp_new_i64(); 133 TCGv_ptr ptr = tcg_const_ptr(NULL); /* overwritten later */ 134 135 tcg_gen_ld_i64(val, ptr, 0); 136 /* pass an immediate != 0 so that it doesn't get optimized away */ 137 tcg_gen_addi_i64(val, val, 0xdeadface); 138 tcg_gen_st_i64(val, ptr, 0); 139 tcg_temp_free_ptr(ptr); 140 tcg_temp_free_i64(val); 141 } 142 143 static void gen_empty_mem_cb(TCGv addr, uint32_t info) 144 { 145 do_gen_mem_cb(addr, info); 146 } 147 148 /* 149 * Share the same function for enable/disable. When enabling, the NULL 150 * pointer will be overwritten later. 151 */ 152 static void gen_empty_mem_helper(void) 153 { 154 TCGv_ptr ptr; 155 156 ptr = tcg_const_ptr(NULL); 157 tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) - 158 offsetof(ArchCPU, env)); 159 tcg_temp_free_ptr(ptr); 160 } 161 162 static void gen_plugin_cb_start(enum plugin_gen_from from, 163 enum plugin_gen_cb type, unsigned wr) 164 { 165 tcg_gen_plugin_cb_start(from, type, wr); 166 } 167 168 static void gen_wrapped(enum plugin_gen_from from, 169 enum plugin_gen_cb type, void (*func)(void)) 170 { 171 gen_plugin_cb_start(from, type, 0); 172 func(); 173 tcg_gen_plugin_cb_end(); 174 } 175 176 static void plugin_gen_empty_callback(enum plugin_gen_from from) 177 { 178 switch (from) { 179 case PLUGIN_GEN_AFTER_INSN: 180 gen_wrapped(from, PLUGIN_GEN_DISABLE_MEM_HELPER, 181 gen_empty_mem_helper); 182 break; 183 case PLUGIN_GEN_FROM_INSN: 184 /* 185 * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being 186 * the first callback of an instruction 187 */ 188 gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER, 189 gen_empty_mem_helper); 190 /* fall through */ 191 case PLUGIN_GEN_FROM_TB: 192 gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb); 193 gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb); 194 break; 195 default: 196 g_assert_not_reached(); 197 } 198 } 199 200 union mem_gen_fn { 201 void (*mem_fn)(TCGv, uint32_t); 202 void (*inline_fn)(void); 203 }; 204 205 static void gen_mem_wrapped(enum plugin_gen_cb type, 206 const union mem_gen_fn *f, TCGv addr, 207 uint32_t info, bool is_mem) 208 { 209 enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info); 210 211 gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, type, rw); 212 if (is_mem) { 213 f->mem_fn(addr, info); 214 } else { 215 f->inline_fn(); 216 } 217 tcg_gen_plugin_cb_end(); 218 } 219 220 void plugin_gen_empty_mem_callback(TCGv addr, uint32_t info) 221 { 222 union mem_gen_fn fn; 223 224 fn.mem_fn = gen_empty_mem_cb; 225 gen_mem_wrapped(PLUGIN_GEN_CB_MEM, &fn, addr, info, true); 226 227 fn.inline_fn = gen_empty_inline_cb; 228 gen_mem_wrapped(PLUGIN_GEN_CB_INLINE, &fn, 0, info, false); 229 } 230 231 static TCGOp *find_op(TCGOp *op, TCGOpcode opc) 232 { 233 while (op) { 234 if (op->opc == opc) { 235 return op; 236 } 237 op = QTAILQ_NEXT(op, link); 238 } 239 return NULL; 240 } 241 242 static TCGOp *rm_ops_range(TCGOp *begin, TCGOp *end) 243 { 244 TCGOp *ret = QTAILQ_NEXT(end, link); 245 246 QTAILQ_REMOVE_SEVERAL(&tcg_ctx->ops, begin, end, link); 247 return ret; 248 } 249 250 /* remove all ops until (and including) plugin_cb_end */ 251 static TCGOp *rm_ops(TCGOp *op) 252 { 253 TCGOp *end_op = find_op(op, INDEX_op_plugin_cb_end); 254 255 tcg_debug_assert(end_op); 256 return rm_ops_range(op, end_op); 257 } 258 259 static TCGOp *copy_op_nocheck(TCGOp **begin_op, TCGOp *op) 260 { 261 *begin_op = QTAILQ_NEXT(*begin_op, link); 262 tcg_debug_assert(*begin_op); 263 op = tcg_op_insert_after(tcg_ctx, op, (*begin_op)->opc); 264 memcpy(op->args, (*begin_op)->args, sizeof(op->args)); 265 return op; 266 } 267 268 static TCGOp *copy_op(TCGOp **begin_op, TCGOp *op, TCGOpcode opc) 269 { 270 op = copy_op_nocheck(begin_op, op); 271 tcg_debug_assert((*begin_op)->opc == opc); 272 return op; 273 } 274 275 static TCGOp *copy_extu_i32_i64(TCGOp **begin_op, TCGOp *op) 276 { 277 if (TCG_TARGET_REG_BITS == 32) { 278 /* mov_i32 */ 279 op = copy_op(begin_op, op, INDEX_op_mov_i32); 280 /* mov_i32 w/ $0 */ 281 op = copy_op(begin_op, op, INDEX_op_mov_i32); 282 } else { 283 /* extu_i32_i64 */ 284 op = copy_op(begin_op, op, INDEX_op_extu_i32_i64); 285 } 286 return op; 287 } 288 289 static TCGOp *copy_mov_i64(TCGOp **begin_op, TCGOp *op) 290 { 291 if (TCG_TARGET_REG_BITS == 32) { 292 /* 2x mov_i32 */ 293 op = copy_op(begin_op, op, INDEX_op_mov_i32); 294 op = copy_op(begin_op, op, INDEX_op_mov_i32); 295 } else { 296 /* mov_i64 */ 297 op = copy_op(begin_op, op, INDEX_op_mov_i64); 298 } 299 return op; 300 } 301 302 static TCGOp *copy_const_ptr(TCGOp **begin_op, TCGOp *op, void *ptr) 303 { 304 if (UINTPTR_MAX == UINT32_MAX) { 305 /* mov_i32 */ 306 op = copy_op(begin_op, op, INDEX_op_mov_i32); 307 op->args[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr)); 308 } else { 309 /* mov_i64 */ 310 op = copy_op(begin_op, op, INDEX_op_mov_i64); 311 op->args[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr)); 312 } 313 return op; 314 } 315 316 static TCGOp *copy_extu_tl_i64(TCGOp **begin_op, TCGOp *op) 317 { 318 if (TARGET_LONG_BITS == 32) { 319 /* extu_i32_i64 */ 320 op = copy_extu_i32_i64(begin_op, op); 321 } else { 322 /* mov_i64 */ 323 op = copy_mov_i64(begin_op, op); 324 } 325 return op; 326 } 327 328 static TCGOp *copy_ld_i64(TCGOp **begin_op, TCGOp *op) 329 { 330 if (TCG_TARGET_REG_BITS == 32) { 331 /* 2x ld_i32 */ 332 op = copy_op(begin_op, op, INDEX_op_ld_i32); 333 op = copy_op(begin_op, op, INDEX_op_ld_i32); 334 } else { 335 /* ld_i64 */ 336 op = copy_op(begin_op, op, INDEX_op_ld_i64); 337 } 338 return op; 339 } 340 341 static TCGOp *copy_st_i64(TCGOp **begin_op, TCGOp *op) 342 { 343 if (TCG_TARGET_REG_BITS == 32) { 344 /* 2x st_i32 */ 345 op = copy_op(begin_op, op, INDEX_op_st_i32); 346 op = copy_op(begin_op, op, INDEX_op_st_i32); 347 } else { 348 /* st_i64 */ 349 op = copy_op(begin_op, op, INDEX_op_st_i64); 350 } 351 return op; 352 } 353 354 static TCGOp *copy_add_i64(TCGOp **begin_op, TCGOp *op, uint64_t v) 355 { 356 if (TCG_TARGET_REG_BITS == 32) { 357 /* all 32-bit backends must implement add2_i32 */ 358 g_assert(TCG_TARGET_HAS_add2_i32); 359 op = copy_op(begin_op, op, INDEX_op_add2_i32); 360 op->args[4] = tcgv_i32_arg(tcg_constant_i32(v)); 361 op->args[5] = tcgv_i32_arg(tcg_constant_i32(v >> 32)); 362 } else { 363 op = copy_op(begin_op, op, INDEX_op_add_i64); 364 op->args[2] = tcgv_i64_arg(tcg_constant_i64(v)); 365 } 366 return op; 367 } 368 369 static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op) 370 { 371 if (UINTPTR_MAX == UINT32_MAX) { 372 /* st_i32 */ 373 op = copy_op(begin_op, op, INDEX_op_st_i32); 374 } else { 375 /* st_i64 */ 376 op = copy_st_i64(begin_op, op); 377 } 378 return op; 379 } 380 381 static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func, 382 void *func, int *cb_idx) 383 { 384 TCGOp *old_op; 385 int func_idx; 386 387 /* copy all ops until the call */ 388 do { 389 op = copy_op_nocheck(begin_op, op); 390 } while (op->opc != INDEX_op_call); 391 392 /* fill in the op call */ 393 old_op = *begin_op; 394 TCGOP_CALLI(op) = TCGOP_CALLI(old_op); 395 TCGOP_CALLO(op) = TCGOP_CALLO(old_op); 396 tcg_debug_assert(op->life == 0); 397 398 func_idx = TCGOP_CALLO(op) + TCGOP_CALLI(op); 399 *cb_idx = func_idx; 400 op->args[func_idx] = (uintptr_t)func; 401 402 return op; 403 } 404 405 /* 406 * When we append/replace ops here we are sensitive to changing patterns of 407 * TCGOps generated by the tcg_gen_FOO calls when we generated the 408 * empty callbacks. This will assert very quickly in a debug build as 409 * we assert the ops we are replacing are the correct ones. 410 */ 411 static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb, 412 TCGOp *begin_op, TCGOp *op, int *cb_idx) 413 { 414 /* const_ptr */ 415 op = copy_const_ptr(&begin_op, op, cb->userp); 416 417 /* copy the ld_i32, but note that we only have to copy it once */ 418 begin_op = QTAILQ_NEXT(begin_op, link); 419 tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32); 420 if (*cb_idx == -1) { 421 op = tcg_op_insert_after(tcg_ctx, op, INDEX_op_ld_i32); 422 memcpy(op->args, begin_op->args, sizeof(op->args)); 423 } 424 425 /* call */ 426 op = copy_call(&begin_op, op, HELPER(plugin_vcpu_udata_cb), 427 cb->f.vcpu_udata, cb_idx); 428 429 return op; 430 } 431 432 static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb, 433 TCGOp *begin_op, TCGOp *op, 434 int *unused) 435 { 436 /* const_ptr */ 437 op = copy_const_ptr(&begin_op, op, cb->userp); 438 439 /* ld_i64 */ 440 op = copy_ld_i64(&begin_op, op); 441 442 /* add_i64 */ 443 op = copy_add_i64(&begin_op, op, cb->inline_insn.imm); 444 445 /* st_i64 */ 446 op = copy_st_i64(&begin_op, op); 447 448 return op; 449 } 450 451 static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb, 452 TCGOp *begin_op, TCGOp *op, int *cb_idx) 453 { 454 enum plugin_gen_cb type = begin_op->args[1]; 455 456 tcg_debug_assert(type == PLUGIN_GEN_CB_MEM); 457 458 /* const_i32 == mov_i32 ("info", so it remains as is) */ 459 op = copy_op(&begin_op, op, INDEX_op_mov_i32); 460 461 /* const_ptr */ 462 op = copy_const_ptr(&begin_op, op, cb->userp); 463 464 /* copy the ld_i32, but note that we only have to copy it once */ 465 begin_op = QTAILQ_NEXT(begin_op, link); 466 tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32); 467 if (*cb_idx == -1) { 468 op = tcg_op_insert_after(tcg_ctx, op, INDEX_op_ld_i32); 469 memcpy(op->args, begin_op->args, sizeof(op->args)); 470 } 471 472 /* extu_tl_i64 */ 473 op = copy_extu_tl_i64(&begin_op, op); 474 475 if (type == PLUGIN_GEN_CB_MEM) { 476 /* call */ 477 op = copy_call(&begin_op, op, HELPER(plugin_vcpu_mem_cb), 478 cb->f.vcpu_udata, cb_idx); 479 } 480 481 return op; 482 } 483 484 typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb, 485 TCGOp *begin_op, TCGOp *op, int *intp); 486 typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb); 487 488 static bool op_ok(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb) 489 { 490 return true; 491 } 492 493 static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb) 494 { 495 int w; 496 497 w = op->args[2]; 498 return !!(cb->rw & (w + 1)); 499 } 500 501 static void inject_cb_type(const GArray *cbs, TCGOp *begin_op, 502 inject_fn inject, op_ok_fn ok) 503 { 504 TCGOp *end_op; 505 TCGOp *op; 506 int cb_idx = -1; 507 int i; 508 509 if (!cbs || cbs->len == 0) { 510 rm_ops(begin_op); 511 return; 512 } 513 514 end_op = find_op(begin_op, INDEX_op_plugin_cb_end); 515 tcg_debug_assert(end_op); 516 517 op = end_op; 518 for (i = 0; i < cbs->len; i++) { 519 struct qemu_plugin_dyn_cb *cb = 520 &g_array_index(cbs, struct qemu_plugin_dyn_cb, i); 521 522 if (!ok(begin_op, cb)) { 523 continue; 524 } 525 op = inject(cb, begin_op, op, &cb_idx); 526 } 527 rm_ops_range(begin_op, end_op); 528 } 529 530 static void 531 inject_udata_cb(const GArray *cbs, TCGOp *begin_op) 532 { 533 inject_cb_type(cbs, begin_op, append_udata_cb, op_ok); 534 } 535 536 static void 537 inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok) 538 { 539 inject_cb_type(cbs, begin_op, append_inline_cb, ok); 540 } 541 542 static void 543 inject_mem_cb(const GArray *cbs, TCGOp *begin_op) 544 { 545 inject_cb_type(cbs, begin_op, append_mem_cb, op_rw); 546 } 547 548 /* we could change the ops in place, but we can reuse more code by copying */ 549 static void inject_mem_helper(TCGOp *begin_op, GArray *arr) 550 { 551 TCGOp *orig_op = begin_op; 552 TCGOp *end_op; 553 TCGOp *op; 554 555 end_op = find_op(begin_op, INDEX_op_plugin_cb_end); 556 tcg_debug_assert(end_op); 557 558 /* const ptr */ 559 op = copy_const_ptr(&begin_op, end_op, arr); 560 561 /* st_ptr */ 562 op = copy_st_ptr(&begin_op, op); 563 564 rm_ops_range(orig_op, end_op); 565 } 566 567 /* 568 * Tracking memory accesses performed from helpers requires extra work. 569 * If an instruction is emulated with helpers, we do two things: 570 * (1) copy the CB descriptors, and keep track of it so that they can be 571 * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so 572 * that we can read them at run-time (i.e. when the helper executes). 573 * This run-time access is performed from qemu_plugin_vcpu_mem_cb. 574 * 575 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it 576 * is possible that the code we generate after the instruction is 577 * dead, we also add checks before generating tb_exit etc. 578 */ 579 static void inject_mem_enable_helper(struct qemu_plugin_insn *plugin_insn, 580 TCGOp *begin_op) 581 { 582 GArray *cbs[2]; 583 GArray *arr; 584 size_t n_cbs, i; 585 586 cbs[0] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR]; 587 cbs[1] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE]; 588 589 n_cbs = 0; 590 for (i = 0; i < ARRAY_SIZE(cbs); i++) { 591 n_cbs += cbs[i]->len; 592 } 593 594 plugin_insn->mem_helper = plugin_insn->calls_helpers && n_cbs; 595 if (likely(!plugin_insn->mem_helper)) { 596 rm_ops(begin_op); 597 return; 598 } 599 600 arr = g_array_sized_new(false, false, 601 sizeof(struct qemu_plugin_dyn_cb), n_cbs); 602 603 for (i = 0; i < ARRAY_SIZE(cbs); i++) { 604 g_array_append_vals(arr, cbs[i]->data, cbs[i]->len); 605 } 606 607 qemu_plugin_add_dyn_cb_arr(arr); 608 inject_mem_helper(begin_op, arr); 609 } 610 611 static void inject_mem_disable_helper(struct qemu_plugin_insn *plugin_insn, 612 TCGOp *begin_op) 613 { 614 if (likely(!plugin_insn->mem_helper)) { 615 rm_ops(begin_op); 616 return; 617 } 618 inject_mem_helper(begin_op, NULL); 619 } 620 621 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */ 622 void plugin_gen_disable_mem_helpers(void) 623 { 624 TCGv_ptr ptr; 625 626 if (likely(tcg_ctx->plugin_insn == NULL || 627 !tcg_ctx->plugin_insn->mem_helper)) { 628 return; 629 } 630 ptr = tcg_const_ptr(NULL); 631 tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) - 632 offsetof(ArchCPU, env)); 633 tcg_temp_free_ptr(ptr); 634 tcg_ctx->plugin_insn->mem_helper = false; 635 } 636 637 static void plugin_gen_tb_udata(const struct qemu_plugin_tb *ptb, 638 TCGOp *begin_op) 639 { 640 inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR], begin_op); 641 } 642 643 static void plugin_gen_tb_inline(const struct qemu_plugin_tb *ptb, 644 TCGOp *begin_op) 645 { 646 inject_inline_cb(ptb->cbs[PLUGIN_CB_INLINE], begin_op, op_ok); 647 } 648 649 static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb, 650 TCGOp *begin_op, int insn_idx) 651 { 652 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx); 653 654 inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], begin_op); 655 } 656 657 static void plugin_gen_insn_inline(const struct qemu_plugin_tb *ptb, 658 TCGOp *begin_op, int insn_idx) 659 { 660 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx); 661 inject_inline_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], 662 begin_op, op_ok); 663 } 664 665 static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb, 666 TCGOp *begin_op, int insn_idx) 667 { 668 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx); 669 inject_mem_cb(insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], begin_op); 670 } 671 672 static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb, 673 TCGOp *begin_op, int insn_idx) 674 { 675 const GArray *cbs; 676 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx); 677 678 cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE]; 679 inject_inline_cb(cbs, begin_op, op_rw); 680 } 681 682 static void plugin_gen_enable_mem_helper(const struct qemu_plugin_tb *ptb, 683 TCGOp *begin_op, int insn_idx) 684 { 685 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx); 686 inject_mem_enable_helper(insn, begin_op); 687 } 688 689 static void plugin_gen_disable_mem_helper(const struct qemu_plugin_tb *ptb, 690 TCGOp *begin_op, int insn_idx) 691 { 692 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx); 693 inject_mem_disable_helper(insn, begin_op); 694 } 695 696 /* #define DEBUG_PLUGIN_GEN_OPS */ 697 static void pr_ops(void) 698 { 699 #ifdef DEBUG_PLUGIN_GEN_OPS 700 TCGOp *op; 701 int i = 0; 702 703 QTAILQ_FOREACH(op, &tcg_ctx->ops, link) { 704 const char *name = ""; 705 const char *type = ""; 706 707 if (op->opc == INDEX_op_plugin_cb_start) { 708 switch (op->args[0]) { 709 case PLUGIN_GEN_FROM_TB: 710 name = "tb"; 711 break; 712 case PLUGIN_GEN_FROM_INSN: 713 name = "insn"; 714 break; 715 case PLUGIN_GEN_FROM_MEM: 716 name = "mem"; 717 break; 718 case PLUGIN_GEN_AFTER_INSN: 719 name = "after insn"; 720 break; 721 default: 722 break; 723 } 724 switch (op->args[1]) { 725 case PLUGIN_GEN_CB_UDATA: 726 type = "udata"; 727 break; 728 case PLUGIN_GEN_CB_INLINE: 729 type = "inline"; 730 break; 731 case PLUGIN_GEN_CB_MEM: 732 type = "mem"; 733 break; 734 case PLUGIN_GEN_ENABLE_MEM_HELPER: 735 type = "enable mem helper"; 736 break; 737 case PLUGIN_GEN_DISABLE_MEM_HELPER: 738 type = "disable mem helper"; 739 break; 740 default: 741 break; 742 } 743 } 744 printf("op[%2i]: %s %s %s\n", i, tcg_op_defs[op->opc].name, name, type); 745 i++; 746 } 747 #endif 748 } 749 750 static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb) 751 { 752 TCGOp *op; 753 int insn_idx = -1; 754 755 pr_ops(); 756 757 QTAILQ_FOREACH(op, &tcg_ctx->ops, link) { 758 switch (op->opc) { 759 case INDEX_op_insn_start: 760 insn_idx++; 761 break; 762 case INDEX_op_plugin_cb_start: 763 { 764 enum plugin_gen_from from = op->args[0]; 765 enum plugin_gen_cb type = op->args[1]; 766 767 switch (from) { 768 case PLUGIN_GEN_FROM_TB: 769 { 770 g_assert(insn_idx == -1); 771 772 switch (type) { 773 case PLUGIN_GEN_CB_UDATA: 774 plugin_gen_tb_udata(plugin_tb, op); 775 break; 776 case PLUGIN_GEN_CB_INLINE: 777 plugin_gen_tb_inline(plugin_tb, op); 778 break; 779 default: 780 g_assert_not_reached(); 781 } 782 break; 783 } 784 case PLUGIN_GEN_FROM_INSN: 785 { 786 g_assert(insn_idx >= 0); 787 788 switch (type) { 789 case PLUGIN_GEN_CB_UDATA: 790 plugin_gen_insn_udata(plugin_tb, op, insn_idx); 791 break; 792 case PLUGIN_GEN_CB_INLINE: 793 plugin_gen_insn_inline(plugin_tb, op, insn_idx); 794 break; 795 case PLUGIN_GEN_ENABLE_MEM_HELPER: 796 plugin_gen_enable_mem_helper(plugin_tb, op, insn_idx); 797 break; 798 default: 799 g_assert_not_reached(); 800 } 801 break; 802 } 803 case PLUGIN_GEN_FROM_MEM: 804 { 805 g_assert(insn_idx >= 0); 806 807 switch (type) { 808 case PLUGIN_GEN_CB_MEM: 809 plugin_gen_mem_regular(plugin_tb, op, insn_idx); 810 break; 811 case PLUGIN_GEN_CB_INLINE: 812 plugin_gen_mem_inline(plugin_tb, op, insn_idx); 813 break; 814 default: 815 g_assert_not_reached(); 816 } 817 818 break; 819 } 820 case PLUGIN_GEN_AFTER_INSN: 821 { 822 g_assert(insn_idx >= 0); 823 824 switch (type) { 825 case PLUGIN_GEN_DISABLE_MEM_HELPER: 826 plugin_gen_disable_mem_helper(plugin_tb, op, insn_idx); 827 break; 828 default: 829 g_assert_not_reached(); 830 } 831 break; 832 } 833 default: 834 g_assert_not_reached(); 835 } 836 break; 837 } 838 default: 839 /* plugins don't care about any other ops */ 840 break; 841 } 842 } 843 pr_ops(); 844 } 845 846 bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db, 847 bool mem_only) 848 { 849 bool ret = false; 850 851 if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_mask)) { 852 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb; 853 int i; 854 855 /* reset callbacks */ 856 for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) { 857 if (ptb->cbs[i]) { 858 g_array_set_size(ptb->cbs[i], 0); 859 } 860 } 861 ptb->n = 0; 862 863 ret = true; 864 865 ptb->vaddr = db->pc_first; 866 ptb->vaddr2 = -1; 867 ptb->haddr1 = db->host_addr[0]; 868 ptb->haddr2 = NULL; 869 ptb->mem_only = mem_only; 870 871 plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB); 872 } 873 874 tcg_ctx->plugin_insn = NULL; 875 876 return ret; 877 } 878 879 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db) 880 { 881 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb; 882 struct qemu_plugin_insn *pinsn; 883 884 pinsn = qemu_plugin_tb_insn_get(ptb, db->pc_next); 885 tcg_ctx->plugin_insn = pinsn; 886 plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN); 887 888 /* 889 * Detect page crossing to get the new host address. 890 * Note that we skip this when haddr1 == NULL, e.g. when we're 891 * fetching instructions from a region not backed by RAM. 892 */ 893 if (ptb->haddr1 == NULL) { 894 pinsn->haddr = NULL; 895 } else if (is_same_page(db, db->pc_next)) { 896 pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr; 897 } else { 898 if (ptb->vaddr2 == -1) { 899 ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first); 900 get_page_addr_code_hostp(cpu->env_ptr, ptb->vaddr2, &ptb->haddr2); 901 } 902 pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2; 903 } 904 } 905 906 void plugin_gen_insn_end(void) 907 { 908 plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN); 909 } 910 911 /* 912 * There are cases where we never get to finalise a translation - for 913 * example a page fault during translation. As a result we shouldn't 914 * do any clean-up here and make sure things are reset in 915 * plugin_gen_tb_start. 916 */ 917 void plugin_gen_tb_end(CPUState *cpu) 918 { 919 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb; 920 921 /* collect instrumentation requests */ 922 qemu_plugin_tb_trans_cb(cpu, ptb); 923 924 /* inject the instrumentation at the appropriate places */ 925 plugin_gen_inject(ptb); 926 } 927