2 * plugin-gen.c - TCG-related bits of plugin infrastructure
4 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
5 * License: GNU GPL, version 2 or later.
6 * See the COPYING file in the top-level directory.
8 * We support instrumentation at an instruction granularity. That is,
9 * if a plugin wants to instrument the memory accesses performed by a
10 * particular instruction, it can just do that instead of instrumenting
11 * all memory accesses. Thus, in order to do this we first have to
12 * translate a TB, so that plugins can decide what/where to instrument.
14 * Injecting the desired instrumentation could be done with a second
15 * translation pass that combined the instrumentation requests, but that
16 * would be ugly and inefficient since we would decode the guest code twice.
17 * Instead, during TB translation we add "empty" instrumentation calls for all
18 * possible instrumentation events, and then once we collect the instrumentation
19 * requests from plugins, we either "fill in" those empty events or remove them
20 * if they have no requests.
22 * When "filling in" an event we first copy the empty callback's TCG ops. This
23 * might seem unnecessary, but it is done to support an arbitrary number
24 * of callbacks per event. Take for example a regular instruction callback.
25 * We first generate a callback to an empty helper function. Then, if two
26 * plugins register one callback each for this instruction, we make two copies
27 * of the TCG ops generated for the empty callback, substituting the function
28 * pointer that points to the empty helper function with the plugins' desired
29 * callback functions. After that we remove the empty callback's ops.
31 * Note that the location in TCGOp.args[] of the pointer to a helper function
32 * varies across different guest and host architectures. Instead of duplicating
33 * the logic that figures this out, we rely on the fact that the empty
34 * callbacks point to empty functions that are unique pointers in the program.
35 * Thus, to find the right location we just have to look for a match in
36 * TCGOp.args[]. This is the main reason why we first copy an empty callback's
37 * TCG ops and then fill them in; regardless of whether we have one or many
38 * callbacks for that event, the logic to add all of them is the same.
40 * When generating more than one callback per event, we make a small
41 * optimization to avoid generating redundant operations. For instance, for the
42 * second and all subsequent callbacks of an event, we do not need to reload the
43 * CPU's index into a TCG temp, since the first callback did it already.
45 #include "qemu/osdep.h"
46 #include "qemu/plugin.h"
49 #include "tcg/tcg-temp-internal.h"
50 #include "tcg/tcg-op.h"
51 #include "exec/exec-all.h"
52 #include "exec/plugin-gen.h"
53 #include "exec/translator.h"
54 #include "exec/helper-proto-common.h"
56 #define HELPER_H "accel/tcg/plugin-helpers.h"
57 #include "exec/helper-info.c.inc"
61 # define CONFIG_SOFTMMU_GATE 1
63 # define CONFIG_SOFTMMU_GATE 0
67 * plugin_cb_start TCG op args[]:
68 * 0: enum plugin_gen_from
69 * 1: enum plugin_gen_cb
70 * 2: set to 1 for mem callback that is a write, 0 otherwise.
73 enum plugin_gen_from
{
77 PLUGIN_GEN_AFTER_INSN
,
83 PLUGIN_GEN_CB_UDATA_R
,
86 PLUGIN_GEN_ENABLE_MEM_HELPER
,
87 PLUGIN_GEN_DISABLE_MEM_HELPER
,
92 * These helpers are stubs that get dynamically switched out for calls
93 * direct to the plugin if they are subscribed to.
95 void HELPER(plugin_vcpu_udata_cb_no_wg
)(uint32_t cpu_index
, void *udata
)
98 void HELPER(plugin_vcpu_udata_cb_no_rwg
)(uint32_t cpu_index
, void *udata
)
101 void HELPER(plugin_vcpu_mem_cb
)(unsigned int vcpu_index
,
102 qemu_plugin_meminfo_t info
, uint64_t vaddr
,
106 static void gen_empty_udata_cb(void (*gen_helper
)(TCGv_i32
, TCGv_ptr
))
108 TCGv_i32 cpu_index
= tcg_temp_ebb_new_i32();
109 TCGv_ptr udata
= tcg_temp_ebb_new_ptr();
111 tcg_gen_movi_ptr(udata
, 0);
112 tcg_gen_ld_i32(cpu_index
, tcg_env
,
113 -offsetof(ArchCPU
, env
) + offsetof(CPUState
, cpu_index
));
114 gen_helper(cpu_index
, udata
);
116 tcg_temp_free_ptr(udata
);
117 tcg_temp_free_i32(cpu_index
);
120 static void gen_empty_udata_cb_no_wg(void)
122 gen_empty_udata_cb(gen_helper_plugin_vcpu_udata_cb_no_wg
);
125 static void gen_empty_udata_cb_no_rwg(void)
127 gen_empty_udata_cb(gen_helper_plugin_vcpu_udata_cb_no_rwg
);
131 * For now we only support addi_i64.
132 * When we support more ops, we can generate one empty inline cb for each.
134 static void gen_empty_inline_cb(void)
136 TCGv_i32 cpu_index
= tcg_temp_ebb_new_i32();
137 TCGv_ptr cpu_index_as_ptr
= tcg_temp_ebb_new_ptr();
138 TCGv_i64 val
= tcg_temp_ebb_new_i64();
139 TCGv_ptr ptr
= tcg_temp_ebb_new_ptr();
141 tcg_gen_ld_i32(cpu_index
, tcg_env
,
142 -offsetof(ArchCPU
, env
) + offsetof(CPUState
, cpu_index
));
143 /* second operand will be replaced by immediate value */
144 tcg_gen_mul_i32(cpu_index
, cpu_index
, cpu_index
);
145 tcg_gen_ext_i32_ptr(cpu_index_as_ptr
, cpu_index
);
147 tcg_gen_movi_ptr(ptr
, 0);
148 tcg_gen_add_ptr(ptr
, ptr
, cpu_index_as_ptr
);
149 tcg_gen_ld_i64(val
, ptr
, 0);
150 /* second operand will be replaced by immediate value */
151 tcg_gen_add_i64(val
, val
, val
);
153 tcg_gen_st_i64(val
, ptr
, 0);
154 tcg_temp_free_ptr(ptr
);
155 tcg_temp_free_i64(val
);
156 tcg_temp_free_ptr(cpu_index_as_ptr
);
157 tcg_temp_free_i32(cpu_index
);
160 static void gen_empty_mem_cb(TCGv_i64 addr
, uint32_t info
)
162 TCGv_i32 cpu_index
= tcg_temp_ebb_new_i32();
163 TCGv_i32 meminfo
= tcg_temp_ebb_new_i32();
164 TCGv_ptr udata
= tcg_temp_ebb_new_ptr();
166 tcg_gen_movi_i32(meminfo
, info
);
167 tcg_gen_movi_ptr(udata
, 0);
168 tcg_gen_ld_i32(cpu_index
, tcg_env
,
169 -offsetof(ArchCPU
, env
) + offsetof(CPUState
, cpu_index
));
171 gen_helper_plugin_vcpu_mem_cb(cpu_index
, meminfo
, addr
, udata
);
173 tcg_temp_free_ptr(udata
);
174 tcg_temp_free_i32(meminfo
);
175 tcg_temp_free_i32(cpu_index
);
179 * Share the same function for enable/disable. When enabling, the NULL
180 * pointer will be overwritten later.
182 static void gen_empty_mem_helper(void)
184 TCGv_ptr ptr
= tcg_temp_ebb_new_ptr();
186 tcg_gen_movi_ptr(ptr
, 0);
187 tcg_gen_st_ptr(ptr
, tcg_env
, offsetof(CPUState
, plugin_mem_cbs
) -
188 offsetof(ArchCPU
, env
));
189 tcg_temp_free_ptr(ptr
);
192 static void gen_plugin_cb_start(enum plugin_gen_from from
,
193 enum plugin_gen_cb type
, unsigned wr
)
195 tcg_gen_plugin_cb_start(from
, type
, wr
);
198 static void gen_wrapped(enum plugin_gen_from from
,
199 enum plugin_gen_cb type
, void (*func
)(void))
201 gen_plugin_cb_start(from
, type
, 0);
203 tcg_gen_plugin_cb_end();
206 static void plugin_gen_empty_callback(enum plugin_gen_from from
)
209 case PLUGIN_GEN_AFTER_INSN
:
210 gen_wrapped(from
, PLUGIN_GEN_DISABLE_MEM_HELPER
,
211 gen_empty_mem_helper
);
213 case PLUGIN_GEN_FROM_INSN
:
215 * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
216 * the first callback of an instruction
218 gen_wrapped(from
, PLUGIN_GEN_ENABLE_MEM_HELPER
,
219 gen_empty_mem_helper
);
221 case PLUGIN_GEN_FROM_TB
:
222 gen_wrapped(from
, PLUGIN_GEN_CB_UDATA
, gen_empty_udata_cb_no_rwg
);
223 gen_wrapped(from
, PLUGIN_GEN_CB_UDATA_R
, gen_empty_udata_cb_no_wg
);
224 gen_wrapped(from
, PLUGIN_GEN_CB_INLINE
, gen_empty_inline_cb
);
227 g_assert_not_reached();
231 void plugin_gen_empty_mem_callback(TCGv_i64 addr
, uint32_t info
)
233 enum qemu_plugin_mem_rw rw
= get_plugin_meminfo_rw(info
);
235 gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM
, PLUGIN_GEN_CB_MEM
, rw
);
236 gen_empty_mem_cb(addr
, info
);
237 tcg_gen_plugin_cb_end();
239 gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM
, PLUGIN_GEN_CB_INLINE
, rw
);
240 gen_empty_inline_cb();
241 tcg_gen_plugin_cb_end();
244 static TCGOp
*find_op(TCGOp
*op
, TCGOpcode opc
)
247 if (op
->opc
== opc
) {
250 op
= QTAILQ_NEXT(op
, link
);
255 static TCGOp
*rm_ops_range(TCGOp
*begin
, TCGOp
*end
)
257 TCGOp
*ret
= QTAILQ_NEXT(end
, link
);
259 QTAILQ_REMOVE_SEVERAL(&tcg_ctx
->ops
, begin
, end
, link
);
263 /* remove all ops until (and including) plugin_cb_end */
264 static TCGOp
*rm_ops(TCGOp
*op
)
266 TCGOp
*end_op
= find_op(op
, INDEX_op_plugin_cb_end
);
268 tcg_debug_assert(end_op
);
269 return rm_ops_range(op
, end_op
);
272 static TCGOp
*copy_op_nocheck(TCGOp
**begin_op
, TCGOp
*op
)
274 TCGOp
*old_op
= QTAILQ_NEXT(*begin_op
, link
);
275 unsigned nargs
= old_op
->nargs
;
278 op
= tcg_op_insert_after(tcg_ctx
, op
, old_op
->opc
, nargs
);
279 memcpy(op
->args
, old_op
->args
, sizeof(op
->args
[0]) * nargs
);
284 static TCGOp
*copy_op(TCGOp
**begin_op
, TCGOp
*op
, TCGOpcode opc
)
286 op
= copy_op_nocheck(begin_op
, op
);
287 tcg_debug_assert((*begin_op
)->opc
== opc
);
291 static TCGOp
*copy_const_ptr(TCGOp
**begin_op
, TCGOp
*op
, void *ptr
)
293 if (UINTPTR_MAX
== UINT32_MAX
) {
295 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
296 op
->args
[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr
));
299 op
= copy_op(begin_op
, op
, INDEX_op_mov_i64
);
300 op
->args
[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr
));
305 static TCGOp
*copy_ld_i32(TCGOp
**begin_op
, TCGOp
*op
)
307 return copy_op(begin_op
, op
, INDEX_op_ld_i32
);
310 static TCGOp
*copy_ext_i32_ptr(TCGOp
**begin_op
, TCGOp
*op
)
312 if (UINTPTR_MAX
== UINT32_MAX
) {
313 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
315 op
= copy_op(begin_op
, op
, INDEX_op_ext_i32_i64
);
320 static TCGOp
*copy_add_ptr(TCGOp
**begin_op
, TCGOp
*op
)
322 if (UINTPTR_MAX
== UINT32_MAX
) {
323 op
= copy_op(begin_op
, op
, INDEX_op_add_i32
);
325 op
= copy_op(begin_op
, op
, INDEX_op_add_i64
);
330 static TCGOp
*copy_ld_i64(TCGOp
**begin_op
, TCGOp
*op
)
332 if (TCG_TARGET_REG_BITS
== 32) {
334 op
= copy_ld_i32(begin_op
, op
);
335 op
= copy_ld_i32(begin_op
, op
);
338 op
= copy_op(begin_op
, op
, INDEX_op_ld_i64
);
343 static TCGOp
*copy_st_i64(TCGOp
**begin_op
, TCGOp
*op
)
345 if (TCG_TARGET_REG_BITS
== 32) {
347 op
= copy_op(begin_op
, op
, INDEX_op_st_i32
);
348 op
= copy_op(begin_op
, op
, INDEX_op_st_i32
);
351 op
= copy_op(begin_op
, op
, INDEX_op_st_i64
);
356 static TCGOp
*copy_add_i64(TCGOp
**begin_op
, TCGOp
*op
, uint64_t v
)
358 if (TCG_TARGET_REG_BITS
== 32) {
359 /* all 32-bit backends must implement add2_i32 */
360 g_assert(TCG_TARGET_HAS_add2_i32
);
361 op
= copy_op(begin_op
, op
, INDEX_op_add2_i32
);
362 op
->args
[4] = tcgv_i32_arg(tcg_constant_i32(v
));
363 op
->args
[5] = tcgv_i32_arg(tcg_constant_i32(v
>> 32));
365 op
= copy_op(begin_op
, op
, INDEX_op_add_i64
);
366 op
->args
[2] = tcgv_i64_arg(tcg_constant_i64(v
));
371 static TCGOp
*copy_mul_i32(TCGOp
**begin_op
, TCGOp
*op
, uint32_t v
)
373 op
= copy_op(begin_op
, op
, INDEX_op_mul_i32
);
374 op
->args
[2] = tcgv_i32_arg(tcg_constant_i32(v
));
378 static TCGOp
*copy_st_ptr(TCGOp
**begin_op
, TCGOp
*op
)
380 if (UINTPTR_MAX
== UINT32_MAX
) {
382 op
= copy_op(begin_op
, op
, INDEX_op_st_i32
);
385 op
= copy_st_i64(begin_op
, op
);
390 static TCGOp
*copy_call(TCGOp
**begin_op
, TCGOp
*op
, void *func
, int *cb_idx
)
395 /* copy all ops until the call */
397 op
= copy_op_nocheck(begin_op
, op
);
398 } while (op
->opc
!= INDEX_op_call
);
400 /* fill in the op call */
402 TCGOP_CALLI(op
) = TCGOP_CALLI(old_op
);
403 TCGOP_CALLO(op
) = TCGOP_CALLO(old_op
);
404 tcg_debug_assert(op
->life
== 0);
406 func_idx
= TCGOP_CALLO(op
) + TCGOP_CALLI(op
);
408 op
->args
[func_idx
] = (uintptr_t)func
;
414 * When we append/replace ops here we are sensitive to changing patterns of
415 * TCGOps generated by the tcg_gen_FOO calls when we generated the
416 * empty callbacks. This will assert very quickly in a debug build as
417 * we assert the ops we are replacing are the correct ones.
419 static TCGOp
*append_udata_cb(const struct qemu_plugin_dyn_cb
*cb
,
420 TCGOp
*begin_op
, TCGOp
*op
, int *cb_idx
)
423 op
= copy_const_ptr(&begin_op
, op
, cb
->userp
);
425 /* copy the ld_i32, but note that we only have to copy it once */
427 op
= copy_op(&begin_op
, op
, INDEX_op_ld_i32
);
429 begin_op
= QTAILQ_NEXT(begin_op
, link
);
430 tcg_debug_assert(begin_op
&& begin_op
->opc
== INDEX_op_ld_i32
);
434 op
= copy_call(&begin_op
, op
, cb
->f
.vcpu_udata
, cb_idx
);
439 static TCGOp
*append_inline_cb(const struct qemu_plugin_dyn_cb
*cb
,
440 TCGOp
*begin_op
, TCGOp
*op
,
443 char *ptr
= cb
->inline_insn
.entry
.score
->data
->data
;
444 size_t elem_size
= g_array_get_element_size(
445 cb
->inline_insn
.entry
.score
->data
);
446 size_t offset
= cb
->inline_insn
.entry
.offset
;
448 op
= copy_ld_i32(&begin_op
, op
);
449 op
= copy_mul_i32(&begin_op
, op
, elem_size
);
450 op
= copy_ext_i32_ptr(&begin_op
, op
);
451 op
= copy_const_ptr(&begin_op
, op
, ptr
+ offset
);
452 op
= copy_add_ptr(&begin_op
, op
);
453 op
= copy_ld_i64(&begin_op
, op
);
454 op
= copy_add_i64(&begin_op
, op
, cb
->inline_insn
.imm
);
455 op
= copy_st_i64(&begin_op
, op
);
459 static TCGOp
*append_mem_cb(const struct qemu_plugin_dyn_cb
*cb
,
460 TCGOp
*begin_op
, TCGOp
*op
, int *cb_idx
)
462 enum plugin_gen_cb type
= begin_op
->args
[1];
464 tcg_debug_assert(type
== PLUGIN_GEN_CB_MEM
);
466 /* const_i32 == mov_i32 ("info", so it remains as is) */
467 op
= copy_op(&begin_op
, op
, INDEX_op_mov_i32
);
470 op
= copy_const_ptr(&begin_op
, op
, cb
->userp
);
472 /* copy the ld_i32, but note that we only have to copy it once */
474 op
= copy_op(&begin_op
, op
, INDEX_op_ld_i32
);
476 begin_op
= QTAILQ_NEXT(begin_op
, link
);
477 tcg_debug_assert(begin_op
&& begin_op
->opc
== INDEX_op_ld_i32
);
480 if (type
== PLUGIN_GEN_CB_MEM
) {
482 op
= copy_call(&begin_op
, op
, cb
->f
.vcpu_udata
, cb_idx
);
488 typedef TCGOp
*(*inject_fn
)(const struct qemu_plugin_dyn_cb
*cb
,
489 TCGOp
*begin_op
, TCGOp
*op
, int *intp
);
490 typedef bool (*op_ok_fn
)(const TCGOp
*op
, const struct qemu_plugin_dyn_cb
*cb
);
492 static bool op_ok(const TCGOp
*op
, const struct qemu_plugin_dyn_cb
*cb
)
497 static bool op_rw(const TCGOp
*op
, const struct qemu_plugin_dyn_cb
*cb
)
502 return !!(cb
->rw
& (w
+ 1));
505 static void inject_cb_type(const GArray
*cbs
, TCGOp
*begin_op
,
506 inject_fn inject
, op_ok_fn ok
)
513 if (!cbs
|| cbs
->len
== 0) {
518 end_op
= find_op(begin_op
, INDEX_op_plugin_cb_end
);
519 tcg_debug_assert(end_op
);
522 for (i
= 0; i
< cbs
->len
; i
++) {
523 struct qemu_plugin_dyn_cb
*cb
=
524 &g_array_index(cbs
, struct qemu_plugin_dyn_cb
, i
);
526 if (!ok(begin_op
, cb
)) {
529 op
= inject(cb
, begin_op
, op
, &cb_idx
);
531 rm_ops_range(begin_op
, end_op
);
535 inject_udata_cb(const GArray
*cbs
, TCGOp
*begin_op
)
537 inject_cb_type(cbs
, begin_op
, append_udata_cb
, op_ok
);
541 inject_inline_cb(const GArray
*cbs
, TCGOp
*begin_op
, op_ok_fn ok
)
543 inject_cb_type(cbs
, begin_op
, append_inline_cb
, ok
);
547 inject_mem_cb(const GArray
*cbs
, TCGOp
*begin_op
)
549 inject_cb_type(cbs
, begin_op
, append_mem_cb
, op_rw
);
552 /* we could change the ops in place, but we can reuse more code by copying */
553 static void inject_mem_helper(TCGOp
*begin_op
, GArray
*arr
)
555 TCGOp
*orig_op
= begin_op
;
559 end_op
= find_op(begin_op
, INDEX_op_plugin_cb_end
);
560 tcg_debug_assert(end_op
);
563 op
= copy_const_ptr(&begin_op
, end_op
, arr
);
566 op
= copy_st_ptr(&begin_op
, op
);
568 rm_ops_range(orig_op
, end_op
);
572 * Tracking memory accesses performed from helpers requires extra work.
573 * If an instruction is emulated with helpers, we do two things:
574 * (1) copy the CB descriptors, and keep track of it so that they can be
575 * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
576 * that we can read them at run-time (i.e. when the helper executes).
577 * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
579 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
580 * is possible that the code we generate after the instruction is
581 * dead, we also add checks before generating tb_exit etc.
583 static void inject_mem_enable_helper(struct qemu_plugin_tb
*ptb
,
584 struct qemu_plugin_insn
*plugin_insn
,
591 cbs
[0] = plugin_insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_REGULAR
];
592 cbs
[1] = plugin_insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_INLINE
];
595 for (i
= 0; i
< ARRAY_SIZE(cbs
); i
++) {
596 n_cbs
+= cbs
[i
]->len
;
599 plugin_insn
->mem_helper
= plugin_insn
->calls_helpers
&& n_cbs
;
600 if (likely(!plugin_insn
->mem_helper
)) {
604 ptb
->mem_helper
= true;
606 arr
= g_array_sized_new(false, false,
607 sizeof(struct qemu_plugin_dyn_cb
), n_cbs
);
609 for (i
= 0; i
< ARRAY_SIZE(cbs
); i
++) {
610 g_array_append_vals(arr
, cbs
[i
]->data
, cbs
[i
]->len
);
613 qemu_plugin_add_dyn_cb_arr(arr
);
614 inject_mem_helper(begin_op
, arr
);
617 static void inject_mem_disable_helper(struct qemu_plugin_insn
*plugin_insn
,
620 if (likely(!plugin_insn
->mem_helper
)) {
624 inject_mem_helper(begin_op
, NULL
);
627 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
628 void plugin_gen_disable_mem_helpers(void)
631 * We could emit the clearing unconditionally and be done. However, this can
632 * be wasteful if for instance plugins don't track memory accesses, or if
633 * most TBs don't use helpers. Instead, emit the clearing iff the TB calls
634 * helpers that might access guest memory.
636 * Note: we do not reset plugin_tb->mem_helper here; a TB might have several
637 * exit points, and we want to emit the clearing from all of them.
639 if (!tcg_ctx
->plugin_tb
->mem_helper
) {
642 tcg_gen_st_ptr(tcg_constant_ptr(NULL
), tcg_env
,
643 offsetof(CPUState
, plugin_mem_cbs
) - offsetof(ArchCPU
, env
));
646 static void plugin_gen_tb_udata(const struct qemu_plugin_tb
*ptb
,
649 inject_udata_cb(ptb
->cbs
[PLUGIN_CB_REGULAR
], begin_op
);
652 static void plugin_gen_tb_udata_r(const struct qemu_plugin_tb
*ptb
,
655 inject_udata_cb(ptb
->cbs
[PLUGIN_CB_REGULAR_R
], begin_op
);
658 static void plugin_gen_tb_inline(const struct qemu_plugin_tb
*ptb
,
661 inject_inline_cb(ptb
->cbs
[PLUGIN_CB_INLINE
], begin_op
, op_ok
);
664 static void plugin_gen_insn_udata(const struct qemu_plugin_tb
*ptb
,
665 TCGOp
*begin_op
, int insn_idx
)
667 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
669 inject_udata_cb(insn
->cbs
[PLUGIN_CB_INSN
][PLUGIN_CB_REGULAR
], begin_op
);
672 static void plugin_gen_insn_udata_r(const struct qemu_plugin_tb
*ptb
,
673 TCGOp
*begin_op
, int insn_idx
)
675 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
677 inject_udata_cb(insn
->cbs
[PLUGIN_CB_INSN
][PLUGIN_CB_REGULAR_R
], begin_op
);
680 static void plugin_gen_insn_inline(const struct qemu_plugin_tb
*ptb
,
681 TCGOp
*begin_op
, int insn_idx
)
683 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
684 inject_inline_cb(insn
->cbs
[PLUGIN_CB_INSN
][PLUGIN_CB_INLINE
],
688 static void plugin_gen_mem_regular(const struct qemu_plugin_tb
*ptb
,
689 TCGOp
*begin_op
, int insn_idx
)
691 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
692 inject_mem_cb(insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_REGULAR
], begin_op
);
695 static void plugin_gen_mem_inline(const struct qemu_plugin_tb
*ptb
,
696 TCGOp
*begin_op
, int insn_idx
)
699 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
701 cbs
= insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_INLINE
];
702 inject_inline_cb(cbs
, begin_op
, op_rw
);
705 static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb
*ptb
,
706 TCGOp
*begin_op
, int insn_idx
)
708 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
709 inject_mem_enable_helper(ptb
, insn
, begin_op
);
712 static void plugin_gen_disable_mem_helper(struct qemu_plugin_tb
*ptb
,
713 TCGOp
*begin_op
, int insn_idx
)
715 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
716 inject_mem_disable_helper(insn
, begin_op
);
719 /* #define DEBUG_PLUGIN_GEN_OPS */
720 static void pr_ops(void)
722 #ifdef DEBUG_PLUGIN_GEN_OPS
726 QTAILQ_FOREACH(op
, &tcg_ctx
->ops
, link
) {
727 const char *name
= "";
728 const char *type
= "";
730 if (op
->opc
== INDEX_op_plugin_cb_start
) {
731 switch (op
->args
[0]) {
732 case PLUGIN_GEN_FROM_TB
:
735 case PLUGIN_GEN_FROM_INSN
:
738 case PLUGIN_GEN_FROM_MEM
:
741 case PLUGIN_GEN_AFTER_INSN
:
747 switch (op
->args
[1]) {
748 case PLUGIN_GEN_CB_UDATA
:
751 case PLUGIN_GEN_CB_INLINE
:
754 case PLUGIN_GEN_CB_MEM
:
757 case PLUGIN_GEN_ENABLE_MEM_HELPER
:
758 type
= "enable mem helper";
760 case PLUGIN_GEN_DISABLE_MEM_HELPER
:
761 type
= "disable mem helper";
767 printf("op[%2i]: %s %s %s\n", i
, tcg_op_defs
[op
->opc
].name
, name
, type
);
773 static void plugin_gen_inject(struct qemu_plugin_tb
*plugin_tb
)
780 QTAILQ_FOREACH(op
, &tcg_ctx
->ops
, link
) {
782 case INDEX_op_insn_start
:
785 case INDEX_op_plugin_cb_start
:
787 enum plugin_gen_from from
= op
->args
[0];
788 enum plugin_gen_cb type
= op
->args
[1];
791 case PLUGIN_GEN_FROM_TB
:
793 g_assert(insn_idx
== -1);
796 case PLUGIN_GEN_CB_UDATA
:
797 plugin_gen_tb_udata(plugin_tb
, op
);
799 case PLUGIN_GEN_CB_UDATA_R
:
800 plugin_gen_tb_udata_r(plugin_tb
, op
);
802 case PLUGIN_GEN_CB_INLINE
:
803 plugin_gen_tb_inline(plugin_tb
, op
);
806 g_assert_not_reached();
810 case PLUGIN_GEN_FROM_INSN
:
812 g_assert(insn_idx
>= 0);
815 case PLUGIN_GEN_CB_UDATA
:
816 plugin_gen_insn_udata(plugin_tb
, op
, insn_idx
);
818 case PLUGIN_GEN_CB_UDATA_R
:
819 plugin_gen_insn_udata_r(plugin_tb
, op
, insn_idx
);
821 case PLUGIN_GEN_CB_INLINE
:
822 plugin_gen_insn_inline(plugin_tb
, op
, insn_idx
);
824 case PLUGIN_GEN_ENABLE_MEM_HELPER
:
825 plugin_gen_enable_mem_helper(plugin_tb
, op
, insn_idx
);
828 g_assert_not_reached();
832 case PLUGIN_GEN_FROM_MEM
:
834 g_assert(insn_idx
>= 0);
837 case PLUGIN_GEN_CB_MEM
:
838 plugin_gen_mem_regular(plugin_tb
, op
, insn_idx
);
840 case PLUGIN_GEN_CB_INLINE
:
841 plugin_gen_mem_inline(plugin_tb
, op
, insn_idx
);
844 g_assert_not_reached();
849 case PLUGIN_GEN_AFTER_INSN
:
851 g_assert(insn_idx
>= 0);
854 case PLUGIN_GEN_DISABLE_MEM_HELPER
:
855 plugin_gen_disable_mem_helper(plugin_tb
, op
, insn_idx
);
858 g_assert_not_reached();
863 g_assert_not_reached();
868 /* plugins don't care about any other ops */
875 bool plugin_gen_tb_start(CPUState
*cpu
, const DisasContextBase
*db
,
880 if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS
, cpu
->plugin_state
->event_mask
)) {
881 struct qemu_plugin_tb
*ptb
= tcg_ctx
->plugin_tb
;
884 /* reset callbacks */
885 for (i
= 0; i
< PLUGIN_N_CB_SUBTYPES
; i
++) {
887 g_array_set_size(ptb
->cbs
[i
], 0);
894 ptb
->vaddr
= db
->pc_first
;
896 ptb
->haddr1
= db
->host_addr
[0];
898 ptb
->mem_only
= mem_only
;
899 ptb
->mem_helper
= false;
901 plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB
);
904 tcg_ctx
->plugin_insn
= NULL
;
909 void plugin_gen_insn_start(CPUState
*cpu
, const DisasContextBase
*db
)
911 struct qemu_plugin_tb
*ptb
= tcg_ctx
->plugin_tb
;
912 struct qemu_plugin_insn
*pinsn
;
914 pinsn
= qemu_plugin_tb_insn_get(ptb
, db
->pc_next
);
915 tcg_ctx
->plugin_insn
= pinsn
;
916 plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN
);
919 * Detect page crossing to get the new host address.
920 * Note that we skip this when haddr1 == NULL, e.g. when we're
921 * fetching instructions from a region not backed by RAM.
923 if (ptb
->haddr1
== NULL
) {
925 } else if (is_same_page(db
, db
->pc_next
)) {
926 pinsn
->haddr
= ptb
->haddr1
+ pinsn
->vaddr
- ptb
->vaddr
;
928 if (ptb
->vaddr2
== -1) {
929 ptb
->vaddr2
= TARGET_PAGE_ALIGN(db
->pc_first
);
930 get_page_addr_code_hostp(cpu_env(cpu
), ptb
->vaddr2
, &ptb
->haddr2
);
932 pinsn
->haddr
= ptb
->haddr2
+ pinsn
->vaddr
- ptb
->vaddr2
;
936 void plugin_gen_insn_end(void)
938 plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN
);
942 * There are cases where we never get to finalise a translation - for
943 * example a page fault during translation. As a result we shouldn't
944 * do any clean-up here and make sure things are reset in
945 * plugin_gen_tb_start.
947 void plugin_gen_tb_end(CPUState
*cpu
, size_t num_insns
)
949 struct qemu_plugin_tb
*ptb
= tcg_ctx
->plugin_tb
;
951 /* translator may have removed instructions, update final count */
952 g_assert(num_insns
<= ptb
->n
);
955 /* collect instrumentation requests */
956 qemu_plugin_tb_trans_cb(cpu
, ptb
);
958 /* inject the instrumentation at the appropriate places */
959 plugin_gen_inject(ptb
);