A recent change to the handling of constants in TCG changed the pattern of ops emitted for a constant add. We no longer emit a mov and the constant can be applied directly to the TCG_op_add arguments. This was causing SEGVs when running the insn plugin with arg=inline. Fix this by updating copy_add_i64 to do the right thing while also adding a comment at the top of the append section as an aide memoir if something like this happens again. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Emilio G. Cota <cota@braap.org> Message-Id: <20210213130325.14781-10-alex.bennee@linaro.org>
918 lines
27 KiB
C
918 lines
27 KiB
C
/*
|
|
* plugin-gen.c - TCG-related bits of plugin infrastructure
|
|
*
|
|
* Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
|
|
* License: GNU GPL, version 2 or later.
|
|
* See the COPYING file in the top-level directory.
|
|
*
|
|
* We support instrumentation at an instruction granularity. That is,
|
|
* if a plugin wants to instrument the memory accesses performed by a
|
|
* particular instruction, it can just do that instead of instrumenting
|
|
* all memory accesses. Thus, in order to do this we first have to
|
|
* translate a TB, so that plugins can decide what/where to instrument.
|
|
*
|
|
* Injecting the desired instrumentation could be done with a second
|
|
* translation pass that combined the instrumentation requests, but that
|
|
* would be ugly and inefficient since we would decode the guest code twice.
|
|
* Instead, during TB translation we add "empty" instrumentation calls for all
|
|
* possible instrumentation events, and then once we collect the instrumentation
|
|
* requests from plugins, we either "fill in" those empty events or remove them
|
|
* if they have no requests.
|
|
*
|
|
* When "filling in" an event we first copy the empty callback's TCG ops. This
|
|
* might seem unnecessary, but it is done to support an arbitrary number
|
|
* of callbacks per event. Take for example a regular instruction callback.
|
|
* We first generate a callback to an empty helper function. Then, if two
|
|
* plugins register one callback each for this instruction, we make two copies
|
|
* of the TCG ops generated for the empty callback, substituting the function
|
|
* pointer that points to the empty helper function with the plugins' desired
|
|
* callback functions. After that we remove the empty callback's ops.
|
|
*
|
|
* Note that the location in TCGOp.args[] of the pointer to a helper function
|
|
* varies across different guest and host architectures. Instead of duplicating
|
|
* the logic that figures this out, we rely on the fact that the empty
|
|
* callbacks point to empty functions that are unique pointers in the program.
|
|
* Thus, to find the right location we just have to look for a match in
|
|
* TCGOp.args[]. This is the main reason why we first copy an empty callback's
|
|
* TCG ops and then fill them in; regardless of whether we have one or many
|
|
* callbacks for that event, the logic to add all of them is the same.
|
|
*
|
|
* When generating more than one callback per event, we make a small
|
|
* optimization to avoid generating redundant operations. For instance, for the
|
|
* second and all subsequent callbacks of an event, we do not need to reload the
|
|
* CPU's index into a TCG temp, since the first callback did it already.
|
|
*/
|
|
#include "qemu/osdep.h"
|
|
#include "cpu.h"
|
|
#include "tcg/tcg.h"
|
|
#include "tcg/tcg-op.h"
|
|
#include "trace/mem.h"
|
|
#include "exec/exec-all.h"
|
|
#include "exec/plugin-gen.h"
|
|
#include "exec/translator.h"
|
|
|
|
#ifdef CONFIG_SOFTMMU
|
|
# define CONFIG_SOFTMMU_GATE 1
|
|
#else
|
|
# define CONFIG_SOFTMMU_GATE 0
|
|
#endif
|
|
|
|
/*
|
|
* plugin_cb_start TCG op args[]:
|
|
* 0: enum plugin_gen_from
|
|
* 1: enum plugin_gen_cb
|
|
* 2: set to 1 for mem callback that is a write, 0 otherwise.
|
|
*/
|
|
|
|
enum plugin_gen_from {
|
|
PLUGIN_GEN_FROM_TB,
|
|
PLUGIN_GEN_FROM_INSN,
|
|
PLUGIN_GEN_FROM_MEM,
|
|
PLUGIN_GEN_AFTER_INSN,
|
|
PLUGIN_GEN_N_FROMS,
|
|
};
|
|
|
|
enum plugin_gen_cb {
|
|
PLUGIN_GEN_CB_UDATA,
|
|
PLUGIN_GEN_CB_INLINE,
|
|
PLUGIN_GEN_CB_MEM,
|
|
PLUGIN_GEN_ENABLE_MEM_HELPER,
|
|
PLUGIN_GEN_DISABLE_MEM_HELPER,
|
|
PLUGIN_GEN_N_CBS,
|
|
};
|
|
|
|
/*
|
|
* These helpers are stubs that get dynamically switched out for calls
|
|
* direct to the plugin if they are subscribed to.
|
|
*/
|
|
void HELPER(plugin_vcpu_udata_cb)(uint32_t cpu_index, void *udata)
|
|
{ }
|
|
|
|
void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
|
|
qemu_plugin_meminfo_t info, uint64_t vaddr,
|
|
void *userdata)
|
|
{ }
|
|
|
|
static void do_gen_mem_cb(TCGv vaddr, uint32_t info)
|
|
{
|
|
TCGv_i32 cpu_index = tcg_temp_new_i32();
|
|
TCGv_i32 meminfo = tcg_const_i32(info);
|
|
TCGv_i64 vaddr64 = tcg_temp_new_i64();
|
|
TCGv_ptr udata = tcg_const_ptr(NULL);
|
|
|
|
tcg_gen_ld_i32(cpu_index, cpu_env,
|
|
-offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
|
|
tcg_gen_extu_tl_i64(vaddr64, vaddr);
|
|
|
|
gen_helper_plugin_vcpu_mem_cb(cpu_index, meminfo, vaddr64, udata);
|
|
|
|
tcg_temp_free_ptr(udata);
|
|
tcg_temp_free_i64(vaddr64);
|
|
tcg_temp_free_i32(meminfo);
|
|
tcg_temp_free_i32(cpu_index);
|
|
}
|
|
|
|
static void gen_empty_udata_cb(void)
|
|
{
|
|
TCGv_i32 cpu_index = tcg_temp_new_i32();
|
|
TCGv_ptr udata = tcg_const_ptr(NULL); /* will be overwritten later */
|
|
|
|
tcg_gen_ld_i32(cpu_index, cpu_env,
|
|
-offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
|
|
gen_helper_plugin_vcpu_udata_cb(cpu_index, udata);
|
|
|
|
tcg_temp_free_ptr(udata);
|
|
tcg_temp_free_i32(cpu_index);
|
|
}
|
|
|
|
/*
|
|
* For now we only support addi_i64.
|
|
* When we support more ops, we can generate one empty inline cb for each.
|
|
*/
|
|
static void gen_empty_inline_cb(void)
|
|
{
|
|
TCGv_i64 val = tcg_temp_new_i64();
|
|
TCGv_ptr ptr = tcg_const_ptr(NULL); /* overwritten later */
|
|
|
|
tcg_gen_ld_i64(val, ptr, 0);
|
|
/* pass an immediate != 0 so that it doesn't get optimized away */
|
|
tcg_gen_addi_i64(val, val, 0xdeadface);
|
|
tcg_gen_st_i64(val, ptr, 0);
|
|
tcg_temp_free_ptr(ptr);
|
|
tcg_temp_free_i64(val);
|
|
}
|
|
|
|
static void gen_empty_mem_cb(TCGv addr, uint32_t info)
|
|
{
|
|
do_gen_mem_cb(addr, info);
|
|
}
|
|
|
|
/*
|
|
* Share the same function for enable/disable. When enabling, the NULL
|
|
* pointer will be overwritten later.
|
|
*/
|
|
static void gen_empty_mem_helper(void)
|
|
{
|
|
TCGv_ptr ptr;
|
|
|
|
ptr = tcg_const_ptr(NULL);
|
|
tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) -
|
|
offsetof(ArchCPU, env));
|
|
tcg_temp_free_ptr(ptr);
|
|
}
|
|
|
|
static inline
|
|
void gen_plugin_cb_start(enum plugin_gen_from from,
|
|
enum plugin_gen_cb type, unsigned wr)
|
|
{
|
|
TCGOp *op;
|
|
|
|
tcg_gen_plugin_cb_start(from, type, wr);
|
|
op = tcg_last_op();
|
|
QSIMPLEQ_INSERT_TAIL(&tcg_ctx->plugin_ops, op, plugin_link);
|
|
}
|
|
|
|
static void gen_wrapped(enum plugin_gen_from from,
|
|
enum plugin_gen_cb type, void (*func)(void))
|
|
{
|
|
gen_plugin_cb_start(from, type, 0);
|
|
func();
|
|
tcg_gen_plugin_cb_end();
|
|
}
|
|
|
|
static inline void plugin_gen_empty_callback(enum plugin_gen_from from)
|
|
{
|
|
switch (from) {
|
|
case PLUGIN_GEN_AFTER_INSN:
|
|
gen_wrapped(from, PLUGIN_GEN_DISABLE_MEM_HELPER,
|
|
gen_empty_mem_helper);
|
|
break;
|
|
case PLUGIN_GEN_FROM_INSN:
|
|
/*
|
|
* Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
|
|
* the first callback of an instruction
|
|
*/
|
|
gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
|
|
gen_empty_mem_helper);
|
|
/* fall through */
|
|
case PLUGIN_GEN_FROM_TB:
|
|
gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb);
|
|
gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
|
|
break;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
}
|
|
|
|
union mem_gen_fn {
|
|
void (*mem_fn)(TCGv, uint32_t);
|
|
void (*inline_fn)(void);
|
|
};
|
|
|
|
static void gen_mem_wrapped(enum plugin_gen_cb type,
|
|
const union mem_gen_fn *f, TCGv addr,
|
|
uint32_t info, bool is_mem)
|
|
{
|
|
int wr = !!(info & TRACE_MEM_ST);
|
|
|
|
gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, type, wr);
|
|
if (is_mem) {
|
|
f->mem_fn(addr, info);
|
|
} else {
|
|
f->inline_fn();
|
|
}
|
|
tcg_gen_plugin_cb_end();
|
|
}
|
|
|
|
void plugin_gen_empty_mem_callback(TCGv addr, uint32_t info)
|
|
{
|
|
union mem_gen_fn fn;
|
|
|
|
fn.mem_fn = gen_empty_mem_cb;
|
|
gen_mem_wrapped(PLUGIN_GEN_CB_MEM, &fn, addr, info, true);
|
|
|
|
fn.inline_fn = gen_empty_inline_cb;
|
|
gen_mem_wrapped(PLUGIN_GEN_CB_INLINE, &fn, 0, info, false);
|
|
}
|
|
|
|
static TCGOp *find_op(TCGOp *op, TCGOpcode opc)
|
|
{
|
|
while (op) {
|
|
if (op->opc == opc) {
|
|
return op;
|
|
}
|
|
op = QTAILQ_NEXT(op, link);
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
static TCGOp *rm_ops_range(TCGOp *begin, TCGOp *end)
|
|
{
|
|
TCGOp *ret = QTAILQ_NEXT(end, link);
|
|
|
|
QTAILQ_REMOVE_SEVERAL(&tcg_ctx->ops, begin, end, link);
|
|
return ret;
|
|
}
|
|
|
|
/* remove all ops until (and including) plugin_cb_end */
|
|
static TCGOp *rm_ops(TCGOp *op)
|
|
{
|
|
TCGOp *end_op = find_op(op, INDEX_op_plugin_cb_end);
|
|
|
|
tcg_debug_assert(end_op);
|
|
return rm_ops_range(op, end_op);
|
|
}
|
|
|
|
static TCGOp *copy_op_nocheck(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
*begin_op = QTAILQ_NEXT(*begin_op, link);
|
|
tcg_debug_assert(*begin_op);
|
|
op = tcg_op_insert_after(tcg_ctx, op, (*begin_op)->opc);
|
|
memcpy(op->args, (*begin_op)->args, sizeof(op->args));
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_op(TCGOp **begin_op, TCGOp *op, TCGOpcode opc)
|
|
{
|
|
op = copy_op_nocheck(begin_op, op);
|
|
tcg_debug_assert((*begin_op)->opc == opc);
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_extu_i32_i64(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
if (TCG_TARGET_REG_BITS == 32) {
|
|
/* mov_i32 */
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i32);
|
|
/* mov_i32 w/ $0 */
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i32);
|
|
} else {
|
|
/* extu_i32_i64 */
|
|
op = copy_op(begin_op, op, INDEX_op_extu_i32_i64);
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_mov_i64(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
if (TCG_TARGET_REG_BITS == 32) {
|
|
/* 2x mov_i32 */
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i32);
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i32);
|
|
} else {
|
|
/* mov_i64 */
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i64);
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_const_ptr(TCGOp **begin_op, TCGOp *op, void *ptr)
|
|
{
|
|
if (UINTPTR_MAX == UINT32_MAX) {
|
|
/* mov_i32 */
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i32);
|
|
op->args[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr));
|
|
} else {
|
|
/* mov_i64 */
|
|
op = copy_op(begin_op, op, INDEX_op_mov_i64);
|
|
op->args[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr));
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_extu_tl_i64(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
if (TARGET_LONG_BITS == 32) {
|
|
/* extu_i32_i64 */
|
|
op = copy_extu_i32_i64(begin_op, op);
|
|
} else {
|
|
/* mov_i64 */
|
|
op = copy_mov_i64(begin_op, op);
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_ld_i64(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
if (TCG_TARGET_REG_BITS == 32) {
|
|
/* 2x ld_i32 */
|
|
op = copy_op(begin_op, op, INDEX_op_ld_i32);
|
|
op = copy_op(begin_op, op, INDEX_op_ld_i32);
|
|
} else {
|
|
/* ld_i64 */
|
|
op = copy_op(begin_op, op, INDEX_op_ld_i64);
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_st_i64(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
if (TCG_TARGET_REG_BITS == 32) {
|
|
/* 2x st_i32 */
|
|
op = copy_op(begin_op, op, INDEX_op_st_i32);
|
|
op = copy_op(begin_op, op, INDEX_op_st_i32);
|
|
} else {
|
|
/* st_i64 */
|
|
op = copy_op(begin_op, op, INDEX_op_st_i64);
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_add_i64(TCGOp **begin_op, TCGOp *op, uint64_t v)
|
|
{
|
|
if (TCG_TARGET_REG_BITS == 32) {
|
|
/* all 32-bit backends must implement add2_i32 */
|
|
g_assert(TCG_TARGET_HAS_add2_i32);
|
|
op = copy_op(begin_op, op, INDEX_op_add2_i32);
|
|
op->args[4] = tcgv_i32_arg(tcg_constant_i32(v));
|
|
op->args[5] = tcgv_i32_arg(tcg_constant_i32(v >> 32));
|
|
} else {
|
|
op = copy_op(begin_op, op, INDEX_op_add_i64);
|
|
op->args[2] = tcgv_i64_arg(tcg_constant_i64(v));
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
|
|
{
|
|
if (UINTPTR_MAX == UINT32_MAX) {
|
|
/* st_i32 */
|
|
op = copy_op(begin_op, op, INDEX_op_st_i32);
|
|
} else {
|
|
/* st_i64 */
|
|
op = copy_st_i64(begin_op, op);
|
|
}
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
|
|
void *func, unsigned tcg_flags, int *cb_idx)
|
|
{
|
|
/* copy all ops until the call */
|
|
do {
|
|
op = copy_op_nocheck(begin_op, op);
|
|
} while (op->opc != INDEX_op_call);
|
|
|
|
/* fill in the op call */
|
|
op->param1 = (*begin_op)->param1;
|
|
op->param2 = (*begin_op)->param2;
|
|
tcg_debug_assert(op->life == 0);
|
|
if (*cb_idx == -1) {
|
|
int i;
|
|
|
|
/*
|
|
* Instead of working out the position of the callback in args[], just
|
|
* look for @empty_func, since it should be a unique pointer.
|
|
*/
|
|
for (i = 0; i < MAX_OPC_PARAM_ARGS; i++) {
|
|
if ((uintptr_t)(*begin_op)->args[i] == (uintptr_t)empty_func) {
|
|
*cb_idx = i;
|
|
break;
|
|
}
|
|
}
|
|
tcg_debug_assert(i < MAX_OPC_PARAM_ARGS);
|
|
}
|
|
op->args[*cb_idx] = (uintptr_t)func;
|
|
op->args[*cb_idx + 1] = tcg_flags;
|
|
|
|
return op;
|
|
}
|
|
|
|
/*
|
|
* When we append/replace ops here we are sensitive to changing patterns of
|
|
* TCGOps generated by the tcg_gen_FOO calls when we generated the
|
|
* empty callbacks. This will assert very quickly in a debug build as
|
|
* we assert the ops we are replacing are the correct ones.
|
|
*/
|
|
static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
|
|
TCGOp *begin_op, TCGOp *op, int *cb_idx)
|
|
{
|
|
/* const_ptr */
|
|
op = copy_const_ptr(&begin_op, op, cb->userp);
|
|
|
|
/* copy the ld_i32, but note that we only have to copy it once */
|
|
begin_op = QTAILQ_NEXT(begin_op, link);
|
|
tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
|
|
if (*cb_idx == -1) {
|
|
op = tcg_op_insert_after(tcg_ctx, op, INDEX_op_ld_i32);
|
|
memcpy(op->args, begin_op->args, sizeof(op->args));
|
|
}
|
|
|
|
/* call */
|
|
op = copy_call(&begin_op, op, HELPER(plugin_vcpu_udata_cb),
|
|
cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
|
|
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
|
|
TCGOp *begin_op, TCGOp *op,
|
|
int *unused)
|
|
{
|
|
/* const_ptr */
|
|
op = copy_const_ptr(&begin_op, op, cb->userp);
|
|
|
|
/* ld_i64 */
|
|
op = copy_ld_i64(&begin_op, op);
|
|
|
|
/* add_i64 */
|
|
op = copy_add_i64(&begin_op, op, cb->inline_insn.imm);
|
|
|
|
/* st_i64 */
|
|
op = copy_st_i64(&begin_op, op);
|
|
|
|
return op;
|
|
}
|
|
|
|
static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
|
|
TCGOp *begin_op, TCGOp *op, int *cb_idx)
|
|
{
|
|
enum plugin_gen_cb type = begin_op->args[1];
|
|
|
|
tcg_debug_assert(type == PLUGIN_GEN_CB_MEM);
|
|
|
|
/* const_i32 == mov_i32 ("info", so it remains as is) */
|
|
op = copy_op(&begin_op, op, INDEX_op_mov_i32);
|
|
|
|
/* const_ptr */
|
|
op = copy_const_ptr(&begin_op, op, cb->userp);
|
|
|
|
/* copy the ld_i32, but note that we only have to copy it once */
|
|
begin_op = QTAILQ_NEXT(begin_op, link);
|
|
tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
|
|
if (*cb_idx == -1) {
|
|
op = tcg_op_insert_after(tcg_ctx, op, INDEX_op_ld_i32);
|
|
memcpy(op->args, begin_op->args, sizeof(op->args));
|
|
}
|
|
|
|
/* extu_tl_i64 */
|
|
op = copy_extu_tl_i64(&begin_op, op);
|
|
|
|
if (type == PLUGIN_GEN_CB_MEM) {
|
|
/* call */
|
|
op = copy_call(&begin_op, op, HELPER(plugin_vcpu_mem_cb),
|
|
cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
|
|
}
|
|
|
|
return op;
|
|
}
|
|
|
|
typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
|
|
TCGOp *begin_op, TCGOp *op, int *intp);
|
|
typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
|
|
|
|
static bool op_ok(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
|
|
{
|
|
int w;
|
|
|
|
w = op->args[2];
|
|
return !!(cb->rw & (w + 1));
|
|
}
|
|
|
|
static inline
|
|
void inject_cb_type(const GArray *cbs, TCGOp *begin_op, inject_fn inject,
|
|
op_ok_fn ok)
|
|
{
|
|
TCGOp *end_op;
|
|
TCGOp *op;
|
|
int cb_idx = -1;
|
|
int i;
|
|
|
|
if (!cbs || cbs->len == 0) {
|
|
rm_ops(begin_op);
|
|
return;
|
|
}
|
|
|
|
end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
|
|
tcg_debug_assert(end_op);
|
|
|
|
op = end_op;
|
|
for (i = 0; i < cbs->len; i++) {
|
|
struct qemu_plugin_dyn_cb *cb =
|
|
&g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
|
|
|
|
if (!ok(begin_op, cb)) {
|
|
continue;
|
|
}
|
|
op = inject(cb, begin_op, op, &cb_idx);
|
|
}
|
|
rm_ops_range(begin_op, end_op);
|
|
}
|
|
|
|
static void
|
|
inject_udata_cb(const GArray *cbs, TCGOp *begin_op)
|
|
{
|
|
inject_cb_type(cbs, begin_op, append_udata_cb, op_ok);
|
|
}
|
|
|
|
static void
|
|
inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
|
|
{
|
|
inject_cb_type(cbs, begin_op, append_inline_cb, ok);
|
|
}
|
|
|
|
static void
|
|
inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
|
|
{
|
|
inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
|
|
}
|
|
|
|
/* we could change the ops in place, but we can reuse more code by copying */
|
|
static void inject_mem_helper(TCGOp *begin_op, GArray *arr)
|
|
{
|
|
TCGOp *orig_op = begin_op;
|
|
TCGOp *end_op;
|
|
TCGOp *op;
|
|
|
|
end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
|
|
tcg_debug_assert(end_op);
|
|
|
|
/* const ptr */
|
|
op = copy_const_ptr(&begin_op, end_op, arr);
|
|
|
|
/* st_ptr */
|
|
op = copy_st_ptr(&begin_op, op);
|
|
|
|
rm_ops_range(orig_op, end_op);
|
|
}
|
|
|
|
/*
|
|
* Tracking memory accesses performed from helpers requires extra work.
|
|
* If an instruction is emulated with helpers, we do two things:
|
|
* (1) copy the CB descriptors, and keep track of it so that they can be
|
|
* freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
|
|
* that we can read them at run-time (i.e. when the helper executes).
|
|
* This run-time access is performed from qemu_plugin_vcpu_mem_cb.
|
|
*
|
|
* Note that plugin_gen_disable_mem_helpers undoes (2). Since it
|
|
* is possible that the code we generate after the instruction is
|
|
* dead, we also add checks before generating tb_exit etc.
|
|
*/
|
|
static void inject_mem_enable_helper(struct qemu_plugin_insn *plugin_insn,
|
|
TCGOp *begin_op)
|
|
{
|
|
GArray *cbs[2];
|
|
GArray *arr;
|
|
size_t n_cbs, i;
|
|
|
|
cbs[0] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
|
|
cbs[1] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
|
|
|
|
n_cbs = 0;
|
|
for (i = 0; i < ARRAY_SIZE(cbs); i++) {
|
|
n_cbs += cbs[i]->len;
|
|
}
|
|
|
|
plugin_insn->mem_helper = plugin_insn->calls_helpers && n_cbs;
|
|
if (likely(!plugin_insn->mem_helper)) {
|
|
rm_ops(begin_op);
|
|
return;
|
|
}
|
|
|
|
arr = g_array_sized_new(false, false,
|
|
sizeof(struct qemu_plugin_dyn_cb), n_cbs);
|
|
|
|
for (i = 0; i < ARRAY_SIZE(cbs); i++) {
|
|
g_array_append_vals(arr, cbs[i]->data, cbs[i]->len);
|
|
}
|
|
|
|
qemu_plugin_add_dyn_cb_arr(arr);
|
|
inject_mem_helper(begin_op, arr);
|
|
}
|
|
|
|
static void inject_mem_disable_helper(struct qemu_plugin_insn *plugin_insn,
|
|
TCGOp *begin_op)
|
|
{
|
|
if (likely(!plugin_insn->mem_helper)) {
|
|
rm_ops(begin_op);
|
|
return;
|
|
}
|
|
inject_mem_helper(begin_op, NULL);
|
|
}
|
|
|
|
/* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
|
|
void plugin_gen_disable_mem_helpers(void)
|
|
{
|
|
TCGv_ptr ptr;
|
|
|
|
if (likely(tcg_ctx->plugin_insn == NULL ||
|
|
!tcg_ctx->plugin_insn->mem_helper)) {
|
|
return;
|
|
}
|
|
ptr = tcg_const_ptr(NULL);
|
|
tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) -
|
|
offsetof(ArchCPU, env));
|
|
tcg_temp_free_ptr(ptr);
|
|
tcg_ctx->plugin_insn->mem_helper = false;
|
|
}
|
|
|
|
static void plugin_gen_tb_udata(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op)
|
|
{
|
|
inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR], begin_op);
|
|
}
|
|
|
|
static void plugin_gen_tb_inline(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op)
|
|
{
|
|
inject_inline_cb(ptb->cbs[PLUGIN_CB_INLINE], begin_op, op_ok);
|
|
}
|
|
|
|
static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op, int insn_idx)
|
|
{
|
|
struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
|
|
|
|
inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], begin_op);
|
|
}
|
|
|
|
static void plugin_gen_insn_inline(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op, int insn_idx)
|
|
{
|
|
struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
|
|
inject_inline_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE],
|
|
begin_op, op_ok);
|
|
}
|
|
|
|
static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op, int insn_idx)
|
|
{
|
|
struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
|
|
inject_mem_cb(insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], begin_op);
|
|
}
|
|
|
|
static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op, int insn_idx)
|
|
{
|
|
const GArray *cbs;
|
|
struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
|
|
|
|
cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
|
|
inject_inline_cb(cbs, begin_op, op_rw);
|
|
}
|
|
|
|
static void plugin_gen_enable_mem_helper(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op, int insn_idx)
|
|
{
|
|
struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
|
|
inject_mem_enable_helper(insn, begin_op);
|
|
}
|
|
|
|
static void plugin_gen_disable_mem_helper(const struct qemu_plugin_tb *ptb,
|
|
TCGOp *begin_op, int insn_idx)
|
|
{
|
|
struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
|
|
inject_mem_disable_helper(insn, begin_op);
|
|
}
|
|
|
|
static void plugin_inject_cb(const struct qemu_plugin_tb *ptb, TCGOp *begin_op,
|
|
int insn_idx)
|
|
{
|
|
enum plugin_gen_from from = begin_op->args[0];
|
|
enum plugin_gen_cb type = begin_op->args[1];
|
|
|
|
switch (from) {
|
|
case PLUGIN_GEN_FROM_TB:
|
|
switch (type) {
|
|
case PLUGIN_GEN_CB_UDATA:
|
|
plugin_gen_tb_udata(ptb, begin_op);
|
|
return;
|
|
case PLUGIN_GEN_CB_INLINE:
|
|
plugin_gen_tb_inline(ptb, begin_op);
|
|
return;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
case PLUGIN_GEN_FROM_INSN:
|
|
switch (type) {
|
|
case PLUGIN_GEN_CB_UDATA:
|
|
plugin_gen_insn_udata(ptb, begin_op, insn_idx);
|
|
return;
|
|
case PLUGIN_GEN_CB_INLINE:
|
|
plugin_gen_insn_inline(ptb, begin_op, insn_idx);
|
|
return;
|
|
case PLUGIN_GEN_ENABLE_MEM_HELPER:
|
|
plugin_gen_enable_mem_helper(ptb, begin_op, insn_idx);
|
|
return;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
case PLUGIN_GEN_FROM_MEM:
|
|
switch (type) {
|
|
case PLUGIN_GEN_CB_MEM:
|
|
plugin_gen_mem_regular(ptb, begin_op, insn_idx);
|
|
return;
|
|
case PLUGIN_GEN_CB_INLINE:
|
|
plugin_gen_mem_inline(ptb, begin_op, insn_idx);
|
|
return;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
case PLUGIN_GEN_AFTER_INSN:
|
|
switch (type) {
|
|
case PLUGIN_GEN_DISABLE_MEM_HELPER:
|
|
plugin_gen_disable_mem_helper(ptb, begin_op, insn_idx);
|
|
return;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
}
|
|
|
|
/* #define DEBUG_PLUGIN_GEN_OPS */
|
|
static void pr_ops(void)
|
|
{
|
|
#ifdef DEBUG_PLUGIN_GEN_OPS
|
|
TCGOp *op;
|
|
int i = 0;
|
|
|
|
QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
|
|
const char *name = "";
|
|
const char *type = "";
|
|
|
|
if (op->opc == INDEX_op_plugin_cb_start) {
|
|
switch (op->args[0]) {
|
|
case PLUGIN_GEN_FROM_TB:
|
|
name = "tb";
|
|
break;
|
|
case PLUGIN_GEN_FROM_INSN:
|
|
name = "insn";
|
|
break;
|
|
case PLUGIN_GEN_FROM_MEM:
|
|
name = "mem";
|
|
break;
|
|
case PLUGIN_GEN_AFTER_INSN:
|
|
name = "after insn";
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
switch (op->args[1]) {
|
|
case PLUGIN_GEN_CB_UDATA:
|
|
type = "udata";
|
|
break;
|
|
case PLUGIN_GEN_CB_INLINE:
|
|
type = "inline";
|
|
break;
|
|
case PLUGIN_GEN_CB_MEM:
|
|
type = "mem";
|
|
break;
|
|
case PLUGIN_GEN_ENABLE_MEM_HELPER:
|
|
type = "enable mem helper";
|
|
break;
|
|
case PLUGIN_GEN_DISABLE_MEM_HELPER:
|
|
type = "disable mem helper";
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
printf("op[%2i]: %s %s %s\n", i, tcg_op_defs[op->opc].name, name, type);
|
|
i++;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
|
|
{
|
|
TCGOp *op;
|
|
int insn_idx;
|
|
|
|
pr_ops();
|
|
insn_idx = -1;
|
|
QSIMPLEQ_FOREACH(op, &tcg_ctx->plugin_ops, plugin_link) {
|
|
enum plugin_gen_from from = op->args[0];
|
|
enum plugin_gen_cb type = op->args[1];
|
|
|
|
tcg_debug_assert(op->opc == INDEX_op_plugin_cb_start);
|
|
/* ENABLE_MEM_HELPER is the first callback of an instruction */
|
|
if (from == PLUGIN_GEN_FROM_INSN &&
|
|
type == PLUGIN_GEN_ENABLE_MEM_HELPER) {
|
|
insn_idx++;
|
|
}
|
|
plugin_inject_cb(plugin_tb, op, insn_idx);
|
|
}
|
|
pr_ops();
|
|
}
|
|
|
|
bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb)
|
|
{
|
|
struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
|
|
bool ret = false;
|
|
|
|
if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_mask)) {
|
|
ret = true;
|
|
|
|
QSIMPLEQ_INIT(&tcg_ctx->plugin_ops);
|
|
ptb->vaddr = tb->pc;
|
|
ptb->vaddr2 = -1;
|
|
get_page_addr_code_hostp(cpu->env_ptr, tb->pc, &ptb->haddr1);
|
|
ptb->haddr2 = NULL;
|
|
|
|
plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB);
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
|
|
{
|
|
struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
|
|
struct qemu_plugin_insn *pinsn;
|
|
|
|
pinsn = qemu_plugin_tb_insn_get(ptb);
|
|
tcg_ctx->plugin_insn = pinsn;
|
|
pinsn->vaddr = db->pc_next;
|
|
plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
|
|
|
|
/*
|
|
* Detect page crossing to get the new host address.
|
|
* Note that we skip this when haddr1 == NULL, e.g. when we're
|
|
* fetching instructions from a region not backed by RAM.
|
|
*/
|
|
if (likely(ptb->haddr1 != NULL && ptb->vaddr2 == -1) &&
|
|
unlikely((db->pc_next & TARGET_PAGE_MASK) !=
|
|
(db->pc_first & TARGET_PAGE_MASK))) {
|
|
get_page_addr_code_hostp(cpu->env_ptr, db->pc_next,
|
|
&ptb->haddr2);
|
|
ptb->vaddr2 = db->pc_next;
|
|
}
|
|
if (likely(ptb->vaddr2 == -1)) {
|
|
pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
|
|
} else {
|
|
pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
|
|
}
|
|
}
|
|
|
|
void plugin_gen_insn_end(void)
|
|
{
|
|
plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN);
|
|
}
|
|
|
|
void plugin_gen_tb_end(CPUState *cpu)
|
|
{
|
|
struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
|
|
int i;
|
|
|
|
/* collect instrumentation requests */
|
|
qemu_plugin_tb_trans_cb(cpu, ptb);
|
|
|
|
/* inject the instrumentation at the appropriate places */
|
|
plugin_gen_inject(ptb);
|
|
|
|
/* clean up */
|
|
for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
|
|
if (ptb->cbs[i]) {
|
|
g_array_set_size(ptb->cbs[i], 0);
|
|
}
|
|
}
|
|
ptb->n = 0;
|
|
tcg_ctx->plugin_insn = NULL;
|
|
}
|