2 * plugin-gen.c - TCG-related bits of plugin infrastructure
4 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
5 * License: GNU GPL, version 2 or later.
6 * See the COPYING file in the top-level directory.
8 * We support instrumentation at an instruction granularity. That is,
9 * if a plugin wants to instrument the memory accesses performed by a
10 * particular instruction, it can just do that instead of instrumenting
11 * all memory accesses. Thus, in order to do this we first have to
12 * translate a TB, so that plugins can decide what/where to instrument.
14 * Injecting the desired instrumentation could be done with a second
15 * translation pass that combined the instrumentation requests, but that
16 * would be ugly and inefficient since we would decode the guest code twice.
17 * Instead, during TB translation we add "empty" instrumentation calls for all
18 * possible instrumentation events, and then once we collect the instrumentation
19 * requests from plugins, we either "fill in" those empty events or remove them
20 * if they have no requests.
22 * When "filling in" an event we first copy the empty callback's TCG ops. This
23 * might seem unnecessary, but it is done to support an arbitrary number
24 * of callbacks per event. Take for example a regular instruction callback.
25 * We first generate a callback to an empty helper function. Then, if two
26 * plugins register one callback each for this instruction, we make two copies
27 * of the TCG ops generated for the empty callback, substituting the function
28 * pointer that points to the empty helper function with the plugins' desired
29 * callback functions. After that we remove the empty callback's ops.
31 * Note that the location in TCGOp.args[] of the pointer to a helper function
32 * varies across different guest and host architectures. Instead of duplicating
33 * the logic that figures this out, we rely on the fact that the empty
34 * callbacks point to empty functions that are unique pointers in the program.
35 * Thus, to find the right location we just have to look for a match in
36 * TCGOp.args[]. This is the main reason why we first copy an empty callback's
37 * TCG ops and then fill them in; regardless of whether we have one or many
38 * callbacks for that event, the logic to add all of them is the same.
40 * When generating more than one callback per event, we make a small
41 * optimization to avoid generating redundant operations. For instance, for the
42 * second and all subsequent callbacks of an event, we do not need to reload the
43 * CPU's index into a TCG temp, since the first callback did it already.
45 #include "qemu/osdep.h"
48 #include "tcg/tcg-op.h"
49 #include "trace/mem.h"
50 #include "exec/exec-all.h"
51 #include "exec/plugin-gen.h"
52 #include "exec/translator.h"
55 # define CONFIG_SOFTMMU_GATE 1
57 # define CONFIG_SOFTMMU_GATE 0
61 * plugin_cb_start TCG op args[]:
62 * 0: enum plugin_gen_from
63 * 1: enum plugin_gen_cb
64 * 2: set to 1 for mem callback that is a write, 0 otherwise.
67 enum plugin_gen_from
{
71 PLUGIN_GEN_AFTER_INSN
,
79 PLUGIN_GEN_ENABLE_MEM_HELPER
,
80 PLUGIN_GEN_DISABLE_MEM_HELPER
,
85 * These helpers are stubs that get dynamically switched out for calls
86 * direct to the plugin if they are subscribed to.
88 void HELPER(plugin_vcpu_udata_cb
)(uint32_t cpu_index
, void *udata
)
91 void HELPER(plugin_vcpu_mem_cb
)(unsigned int vcpu_index
,
92 qemu_plugin_meminfo_t info
, uint64_t vaddr
,
96 static void do_gen_mem_cb(TCGv vaddr
, uint32_t info
)
98 TCGv_i32 cpu_index
= tcg_temp_new_i32();
99 TCGv_i32 meminfo
= tcg_const_i32(info
);
100 TCGv_i64 vaddr64
= tcg_temp_new_i64();
101 TCGv_ptr udata
= tcg_const_ptr(NULL
);
103 tcg_gen_ld_i32(cpu_index
, cpu_env
,
104 -offsetof(ArchCPU
, env
) + offsetof(CPUState
, cpu_index
));
105 tcg_gen_extu_tl_i64(vaddr64
, vaddr
);
107 gen_helper_plugin_vcpu_mem_cb(cpu_index
, meminfo
, vaddr64
, udata
);
109 tcg_temp_free_ptr(udata
);
110 tcg_temp_free_i64(vaddr64
);
111 tcg_temp_free_i32(meminfo
);
112 tcg_temp_free_i32(cpu_index
);
115 static void gen_empty_udata_cb(void)
117 TCGv_i32 cpu_index
= tcg_temp_new_i32();
118 TCGv_ptr udata
= tcg_const_ptr(NULL
); /* will be overwritten later */
120 tcg_gen_ld_i32(cpu_index
, cpu_env
,
121 -offsetof(ArchCPU
, env
) + offsetof(CPUState
, cpu_index
));
122 gen_helper_plugin_vcpu_udata_cb(cpu_index
, udata
);
124 tcg_temp_free_ptr(udata
);
125 tcg_temp_free_i32(cpu_index
);
129 * For now we only support addi_i64.
130 * When we support more ops, we can generate one empty inline cb for each.
132 static void gen_empty_inline_cb(void)
134 TCGv_i64 val
= tcg_temp_new_i64();
135 TCGv_ptr ptr
= tcg_const_ptr(NULL
); /* overwritten later */
137 tcg_gen_ld_i64(val
, ptr
, 0);
138 /* pass an immediate != 0 so that it doesn't get optimized away */
139 tcg_gen_addi_i64(val
, val
, 0xdeadface);
140 tcg_gen_st_i64(val
, ptr
, 0);
141 tcg_temp_free_ptr(ptr
);
142 tcg_temp_free_i64(val
);
145 static void gen_empty_mem_cb(TCGv addr
, uint32_t info
)
147 do_gen_mem_cb(addr
, info
);
151 * Share the same function for enable/disable. When enabling, the NULL
152 * pointer will be overwritten later.
154 static void gen_empty_mem_helper(void)
158 ptr
= tcg_const_ptr(NULL
);
159 tcg_gen_st_ptr(ptr
, cpu_env
, offsetof(CPUState
, plugin_mem_cbs
) -
160 offsetof(ArchCPU
, env
));
161 tcg_temp_free_ptr(ptr
);
165 void gen_plugin_cb_start(enum plugin_gen_from from
,
166 enum plugin_gen_cb type
, unsigned wr
)
170 tcg_gen_plugin_cb_start(from
, type
, wr
);
172 QSIMPLEQ_INSERT_TAIL(&tcg_ctx
->plugin_ops
, op
, plugin_link
);
175 static void gen_wrapped(enum plugin_gen_from from
,
176 enum plugin_gen_cb type
, void (*func
)(void))
178 gen_plugin_cb_start(from
, type
, 0);
180 tcg_gen_plugin_cb_end();
183 static inline void plugin_gen_empty_callback(enum plugin_gen_from from
)
186 case PLUGIN_GEN_AFTER_INSN
:
187 gen_wrapped(from
, PLUGIN_GEN_DISABLE_MEM_HELPER
,
188 gen_empty_mem_helper
);
190 case PLUGIN_GEN_FROM_INSN
:
192 * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
193 * the first callback of an instruction
195 gen_wrapped(from
, PLUGIN_GEN_ENABLE_MEM_HELPER
,
196 gen_empty_mem_helper
);
198 case PLUGIN_GEN_FROM_TB
:
199 gen_wrapped(from
, PLUGIN_GEN_CB_UDATA
, gen_empty_udata_cb
);
200 gen_wrapped(from
, PLUGIN_GEN_CB_INLINE
, gen_empty_inline_cb
);
203 g_assert_not_reached();
208 void (*mem_fn
)(TCGv
, uint32_t);
209 void (*inline_fn
)(void);
212 static void gen_mem_wrapped(enum plugin_gen_cb type
,
213 const union mem_gen_fn
*f
, TCGv addr
,
214 uint32_t info
, bool is_mem
)
216 int wr
= !!(info
& TRACE_MEM_ST
);
218 gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM
, type
, wr
);
220 f
->mem_fn(addr
, info
);
224 tcg_gen_plugin_cb_end();
227 void plugin_gen_empty_mem_callback(TCGv addr
, uint32_t info
)
231 fn
.mem_fn
= gen_empty_mem_cb
;
232 gen_mem_wrapped(PLUGIN_GEN_CB_MEM
, &fn
, addr
, info
, true);
234 fn
.inline_fn
= gen_empty_inline_cb
;
235 gen_mem_wrapped(PLUGIN_GEN_CB_INLINE
, &fn
, 0, info
, false);
238 static TCGOp
*find_op(TCGOp
*op
, TCGOpcode opc
)
241 if (op
->opc
== opc
) {
244 op
= QTAILQ_NEXT(op
, link
);
249 static TCGOp
*rm_ops_range(TCGOp
*begin
, TCGOp
*end
)
251 TCGOp
*ret
= QTAILQ_NEXT(end
, link
);
253 QTAILQ_REMOVE_SEVERAL(&tcg_ctx
->ops
, begin
, end
, link
);
257 /* remove all ops until (and including) plugin_cb_end */
258 static TCGOp
*rm_ops(TCGOp
*op
)
260 TCGOp
*end_op
= find_op(op
, INDEX_op_plugin_cb_end
);
262 tcg_debug_assert(end_op
);
263 return rm_ops_range(op
, end_op
);
266 static TCGOp
*copy_op_nocheck(TCGOp
**begin_op
, TCGOp
*op
)
268 *begin_op
= QTAILQ_NEXT(*begin_op
, link
);
269 tcg_debug_assert(*begin_op
);
270 op
= tcg_op_insert_after(tcg_ctx
, op
, (*begin_op
)->opc
);
271 memcpy(op
->args
, (*begin_op
)->args
, sizeof(op
->args
));
275 static TCGOp
*copy_op(TCGOp
**begin_op
, TCGOp
*op
, TCGOpcode opc
)
277 op
= copy_op_nocheck(begin_op
, op
);
278 tcg_debug_assert((*begin_op
)->opc
== opc
);
282 static TCGOp
*copy_extu_i32_i64(TCGOp
**begin_op
, TCGOp
*op
)
284 if (TCG_TARGET_REG_BITS
== 32) {
286 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
288 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
291 op
= copy_op(begin_op
, op
, INDEX_op_extu_i32_i64
);
296 static TCGOp
*copy_mov_i64(TCGOp
**begin_op
, TCGOp
*op
)
298 if (TCG_TARGET_REG_BITS
== 32) {
300 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
301 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
304 op
= copy_op(begin_op
, op
, INDEX_op_mov_i64
);
309 static TCGOp
*copy_const_ptr(TCGOp
**begin_op
, TCGOp
*op
, void *ptr
)
311 if (UINTPTR_MAX
== UINT32_MAX
) {
313 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
314 op
->args
[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr
));
317 op
= copy_op(begin_op
, op
, INDEX_op_mov_i64
);
318 op
->args
[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr
));
323 static TCGOp
*copy_const_i64(TCGOp
**begin_op
, TCGOp
*op
, uint64_t v
)
325 if (TCG_TARGET_REG_BITS
== 32) {
327 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
328 op
->args
[1] = tcgv_i32_arg(tcg_constant_i32(v
));
329 op
= copy_op(begin_op
, op
, INDEX_op_mov_i32
);
330 op
->args
[1] = tcgv_i32_arg(tcg_constant_i32(v
>> 32));
333 op
= copy_op(begin_op
, op
, INDEX_op_mov_i64
);
334 op
->args
[1] = tcgv_i64_arg(tcg_constant_i64(v
));
339 static TCGOp
*copy_extu_tl_i64(TCGOp
**begin_op
, TCGOp
*op
)
341 if (TARGET_LONG_BITS
== 32) {
343 op
= copy_extu_i32_i64(begin_op
, op
);
346 op
= copy_mov_i64(begin_op
, op
);
351 static TCGOp
*copy_ld_i64(TCGOp
**begin_op
, TCGOp
*op
)
353 if (TCG_TARGET_REG_BITS
== 32) {
355 op
= copy_op(begin_op
, op
, INDEX_op_ld_i32
);
356 op
= copy_op(begin_op
, op
, INDEX_op_ld_i32
);
359 op
= copy_op(begin_op
, op
, INDEX_op_ld_i64
);
364 static TCGOp
*copy_st_i64(TCGOp
**begin_op
, TCGOp
*op
)
366 if (TCG_TARGET_REG_BITS
== 32) {
368 op
= copy_op(begin_op
, op
, INDEX_op_st_i32
);
369 op
= copy_op(begin_op
, op
, INDEX_op_st_i32
);
372 op
= copy_op(begin_op
, op
, INDEX_op_st_i64
);
377 static TCGOp
*copy_add_i64(TCGOp
**begin_op
, TCGOp
*op
)
379 if (TCG_TARGET_REG_BITS
== 32) {
380 /* all 32-bit backends must implement add2_i32 */
381 g_assert(TCG_TARGET_HAS_add2_i32
);
382 op
= copy_op(begin_op
, op
, INDEX_op_add2_i32
);
384 op
= copy_op(begin_op
, op
, INDEX_op_add_i64
);
389 static TCGOp
*copy_st_ptr(TCGOp
**begin_op
, TCGOp
*op
)
391 if (UINTPTR_MAX
== UINT32_MAX
) {
393 op
= copy_op(begin_op
, op
, INDEX_op_st_i32
);
396 op
= copy_st_i64(begin_op
, op
);
401 static TCGOp
*copy_call(TCGOp
**begin_op
, TCGOp
*op
, void *empty_func
,
402 void *func
, unsigned tcg_flags
, int *cb_idx
)
404 /* copy all ops until the call */
406 op
= copy_op_nocheck(begin_op
, op
);
407 } while (op
->opc
!= INDEX_op_call
);
409 /* fill in the op call */
410 op
->param1
= (*begin_op
)->param1
;
411 op
->param2
= (*begin_op
)->param2
;
412 tcg_debug_assert(op
->life
== 0);
417 * Instead of working out the position of the callback in args[], just
418 * look for @empty_func, since it should be a unique pointer.
420 for (i
= 0; i
< MAX_OPC_PARAM_ARGS
; i
++) {
421 if ((uintptr_t)(*begin_op
)->args
[i
] == (uintptr_t)empty_func
) {
426 tcg_debug_assert(i
< MAX_OPC_PARAM_ARGS
);
428 op
->args
[*cb_idx
] = (uintptr_t)func
;
429 op
->args
[*cb_idx
+ 1] = tcg_flags
;
434 static TCGOp
*append_udata_cb(const struct qemu_plugin_dyn_cb
*cb
,
435 TCGOp
*begin_op
, TCGOp
*op
, int *cb_idx
)
438 op
= copy_const_ptr(&begin_op
, op
, cb
->userp
);
440 /* copy the ld_i32, but note that we only have to copy it once */
441 begin_op
= QTAILQ_NEXT(begin_op
, link
);
442 tcg_debug_assert(begin_op
&& begin_op
->opc
== INDEX_op_ld_i32
);
444 op
= tcg_op_insert_after(tcg_ctx
, op
, INDEX_op_ld_i32
);
445 memcpy(op
->args
, begin_op
->args
, sizeof(op
->args
));
449 op
= copy_call(&begin_op
, op
, HELPER(plugin_vcpu_udata_cb
),
450 cb
->f
.vcpu_udata
, cb
->tcg_flags
, cb_idx
);
455 static TCGOp
*append_inline_cb(const struct qemu_plugin_dyn_cb
*cb
,
456 TCGOp
*begin_op
, TCGOp
*op
,
460 op
= copy_const_ptr(&begin_op
, op
, cb
->userp
);
463 op
= copy_ld_i64(&begin_op
, op
);
466 op
= copy_const_i64(&begin_op
, op
, cb
->inline_insn
.imm
);
469 op
= copy_add_i64(&begin_op
, op
);
472 op
= copy_st_i64(&begin_op
, op
);
477 static TCGOp
*append_mem_cb(const struct qemu_plugin_dyn_cb
*cb
,
478 TCGOp
*begin_op
, TCGOp
*op
, int *cb_idx
)
480 enum plugin_gen_cb type
= begin_op
->args
[1];
482 tcg_debug_assert(type
== PLUGIN_GEN_CB_MEM
);
484 /* const_i32 == mov_i32 ("info", so it remains as is) */
485 op
= copy_op(&begin_op
, op
, INDEX_op_mov_i32
);
488 op
= copy_const_ptr(&begin_op
, op
, cb
->userp
);
490 /* copy the ld_i32, but note that we only have to copy it once */
491 begin_op
= QTAILQ_NEXT(begin_op
, link
);
492 tcg_debug_assert(begin_op
&& begin_op
->opc
== INDEX_op_ld_i32
);
494 op
= tcg_op_insert_after(tcg_ctx
, op
, INDEX_op_ld_i32
);
495 memcpy(op
->args
, begin_op
->args
, sizeof(op
->args
));
499 op
= copy_extu_tl_i64(&begin_op
, op
);
501 if (type
== PLUGIN_GEN_CB_MEM
) {
503 op
= copy_call(&begin_op
, op
, HELPER(plugin_vcpu_mem_cb
),
504 cb
->f
.vcpu_udata
, cb
->tcg_flags
, cb_idx
);
510 typedef TCGOp
*(*inject_fn
)(const struct qemu_plugin_dyn_cb
*cb
,
511 TCGOp
*begin_op
, TCGOp
*op
, int *intp
);
512 typedef bool (*op_ok_fn
)(const TCGOp
*op
, const struct qemu_plugin_dyn_cb
*cb
);
514 static bool op_ok(const TCGOp
*op
, const struct qemu_plugin_dyn_cb
*cb
)
519 static bool op_rw(const TCGOp
*op
, const struct qemu_plugin_dyn_cb
*cb
)
524 return !!(cb
->rw
& (w
+ 1));
528 void inject_cb_type(const GArray
*cbs
, TCGOp
*begin_op
, inject_fn inject
,
536 if (!cbs
|| cbs
->len
== 0) {
541 end_op
= find_op(begin_op
, INDEX_op_plugin_cb_end
);
542 tcg_debug_assert(end_op
);
545 for (i
= 0; i
< cbs
->len
; i
++) {
546 struct qemu_plugin_dyn_cb
*cb
=
547 &g_array_index(cbs
, struct qemu_plugin_dyn_cb
, i
);
549 if (!ok(begin_op
, cb
)) {
552 op
= inject(cb
, begin_op
, op
, &cb_idx
);
554 rm_ops_range(begin_op
, end_op
);
558 inject_udata_cb(const GArray
*cbs
, TCGOp
*begin_op
)
560 inject_cb_type(cbs
, begin_op
, append_udata_cb
, op_ok
);
564 inject_inline_cb(const GArray
*cbs
, TCGOp
*begin_op
, op_ok_fn ok
)
566 inject_cb_type(cbs
, begin_op
, append_inline_cb
, ok
);
570 inject_mem_cb(const GArray
*cbs
, TCGOp
*begin_op
)
572 inject_cb_type(cbs
, begin_op
, append_mem_cb
, op_rw
);
575 /* we could change the ops in place, but we can reuse more code by copying */
576 static void inject_mem_helper(TCGOp
*begin_op
, GArray
*arr
)
578 TCGOp
*orig_op
= begin_op
;
582 end_op
= find_op(begin_op
, INDEX_op_plugin_cb_end
);
583 tcg_debug_assert(end_op
);
586 op
= copy_const_ptr(&begin_op
, end_op
, arr
);
589 op
= copy_st_ptr(&begin_op
, op
);
591 rm_ops_range(orig_op
, end_op
);
595 * Tracking memory accesses performed from helpers requires extra work.
596 * If an instruction is emulated with helpers, we do two things:
597 * (1) copy the CB descriptors, and keep track of it so that they can be
598 * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
599 * that we can read them at run-time (i.e. when the helper executes).
600 * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
602 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
603 * is possible that the code we generate after the instruction is
604 * dead, we also add checks before generating tb_exit etc.
606 static void inject_mem_enable_helper(struct qemu_plugin_insn
*plugin_insn
,
613 cbs
[0] = plugin_insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_REGULAR
];
614 cbs
[1] = plugin_insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_INLINE
];
617 for (i
= 0; i
< ARRAY_SIZE(cbs
); i
++) {
618 n_cbs
+= cbs
[i
]->len
;
621 plugin_insn
->mem_helper
= plugin_insn
->calls_helpers
&& n_cbs
;
622 if (likely(!plugin_insn
->mem_helper
)) {
627 arr
= g_array_sized_new(false, false,
628 sizeof(struct qemu_plugin_dyn_cb
), n_cbs
);
630 for (i
= 0; i
< ARRAY_SIZE(cbs
); i
++) {
631 g_array_append_vals(arr
, cbs
[i
]->data
, cbs
[i
]->len
);
634 qemu_plugin_add_dyn_cb_arr(arr
);
635 inject_mem_helper(begin_op
, arr
);
638 static void inject_mem_disable_helper(struct qemu_plugin_insn
*plugin_insn
,
641 if (likely(!plugin_insn
->mem_helper
)) {
645 inject_mem_helper(begin_op
, NULL
);
648 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
649 void plugin_gen_disable_mem_helpers(void)
653 if (likely(tcg_ctx
->plugin_insn
== NULL
||
654 !tcg_ctx
->plugin_insn
->mem_helper
)) {
657 ptr
= tcg_const_ptr(NULL
);
658 tcg_gen_st_ptr(ptr
, cpu_env
, offsetof(CPUState
, plugin_mem_cbs
) -
659 offsetof(ArchCPU
, env
));
660 tcg_temp_free_ptr(ptr
);
661 tcg_ctx
->plugin_insn
->mem_helper
= false;
664 static void plugin_gen_tb_udata(const struct qemu_plugin_tb
*ptb
,
667 inject_udata_cb(ptb
->cbs
[PLUGIN_CB_REGULAR
], begin_op
);
670 static void plugin_gen_tb_inline(const struct qemu_plugin_tb
*ptb
,
673 inject_inline_cb(ptb
->cbs
[PLUGIN_CB_INLINE
], begin_op
, op_ok
);
676 static void plugin_gen_insn_udata(const struct qemu_plugin_tb
*ptb
,
677 TCGOp
*begin_op
, int insn_idx
)
679 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
681 inject_udata_cb(insn
->cbs
[PLUGIN_CB_INSN
][PLUGIN_CB_REGULAR
], begin_op
);
684 static void plugin_gen_insn_inline(const struct qemu_plugin_tb
*ptb
,
685 TCGOp
*begin_op
, int insn_idx
)
687 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
688 inject_inline_cb(insn
->cbs
[PLUGIN_CB_INSN
][PLUGIN_CB_INLINE
],
692 static void plugin_gen_mem_regular(const struct qemu_plugin_tb
*ptb
,
693 TCGOp
*begin_op
, int insn_idx
)
695 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
696 inject_mem_cb(insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_REGULAR
], begin_op
);
699 static void plugin_gen_mem_inline(const struct qemu_plugin_tb
*ptb
,
700 TCGOp
*begin_op
, int insn_idx
)
703 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
705 cbs
= insn
->cbs
[PLUGIN_CB_MEM
][PLUGIN_CB_INLINE
];
706 inject_inline_cb(cbs
, begin_op
, op_rw
);
709 static void plugin_gen_enable_mem_helper(const struct qemu_plugin_tb
*ptb
,
710 TCGOp
*begin_op
, int insn_idx
)
712 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
713 inject_mem_enable_helper(insn
, begin_op
);
716 static void plugin_gen_disable_mem_helper(const struct qemu_plugin_tb
*ptb
,
717 TCGOp
*begin_op
, int insn_idx
)
719 struct qemu_plugin_insn
*insn
= g_ptr_array_index(ptb
->insns
, insn_idx
);
720 inject_mem_disable_helper(insn
, begin_op
);
723 static void plugin_inject_cb(const struct qemu_plugin_tb
*ptb
, TCGOp
*begin_op
,
726 enum plugin_gen_from from
= begin_op
->args
[0];
727 enum plugin_gen_cb type
= begin_op
->args
[1];
730 case PLUGIN_GEN_FROM_TB
:
732 case PLUGIN_GEN_CB_UDATA
:
733 plugin_gen_tb_udata(ptb
, begin_op
);
735 case PLUGIN_GEN_CB_INLINE
:
736 plugin_gen_tb_inline(ptb
, begin_op
);
739 g_assert_not_reached();
741 case PLUGIN_GEN_FROM_INSN
:
743 case PLUGIN_GEN_CB_UDATA
:
744 plugin_gen_insn_udata(ptb
, begin_op
, insn_idx
);
746 case PLUGIN_GEN_CB_INLINE
:
747 plugin_gen_insn_inline(ptb
, begin_op
, insn_idx
);
749 case PLUGIN_GEN_ENABLE_MEM_HELPER
:
750 plugin_gen_enable_mem_helper(ptb
, begin_op
, insn_idx
);
753 g_assert_not_reached();
755 case PLUGIN_GEN_FROM_MEM
:
757 case PLUGIN_GEN_CB_MEM
:
758 plugin_gen_mem_regular(ptb
, begin_op
, insn_idx
);
760 case PLUGIN_GEN_CB_INLINE
:
761 plugin_gen_mem_inline(ptb
, begin_op
, insn_idx
);
764 g_assert_not_reached();
766 case PLUGIN_GEN_AFTER_INSN
:
768 case PLUGIN_GEN_DISABLE_MEM_HELPER
:
769 plugin_gen_disable_mem_helper(ptb
, begin_op
, insn_idx
);
772 g_assert_not_reached();
775 g_assert_not_reached();
779 /* #define DEBUG_PLUGIN_GEN_OPS */
780 static void pr_ops(void)
782 #ifdef DEBUG_PLUGIN_GEN_OPS
786 QTAILQ_FOREACH(op
, &tcg_ctx
->ops
, link
) {
787 const char *name
= "";
788 const char *type
= "";
790 if (op
->opc
== INDEX_op_plugin_cb_start
) {
791 switch (op
->args
[0]) {
792 case PLUGIN_GEN_FROM_TB
:
795 case PLUGIN_GEN_FROM_INSN
:
798 case PLUGIN_GEN_FROM_MEM
:
801 case PLUGIN_GEN_AFTER_INSN
:
807 switch (op
->args
[1]) {
808 case PLUGIN_GEN_CB_UDATA
:
811 case PLUGIN_GEN_CB_INLINE
:
814 case PLUGIN_GEN_CB_MEM
:
817 case PLUGIN_GEN_ENABLE_MEM_HELPER
:
818 type
= "enable mem helper";
820 case PLUGIN_GEN_DISABLE_MEM_HELPER
:
821 type
= "disable mem helper";
827 printf("op[%2i]: %s %s %s\n", i
, tcg_op_defs
[op
->opc
].name
, name
, type
);
833 static void plugin_gen_inject(const struct qemu_plugin_tb
*plugin_tb
)
840 QSIMPLEQ_FOREACH(op
, &tcg_ctx
->plugin_ops
, plugin_link
) {
841 enum plugin_gen_from from
= op
->args
[0];
842 enum plugin_gen_cb type
= op
->args
[1];
844 tcg_debug_assert(op
->opc
== INDEX_op_plugin_cb_start
);
845 /* ENABLE_MEM_HELPER is the first callback of an instruction */
846 if (from
== PLUGIN_GEN_FROM_INSN
&&
847 type
== PLUGIN_GEN_ENABLE_MEM_HELPER
) {
850 plugin_inject_cb(plugin_tb
, op
, insn_idx
);
855 bool plugin_gen_tb_start(CPUState
*cpu
, const TranslationBlock
*tb
)
857 struct qemu_plugin_tb
*ptb
= tcg_ctx
->plugin_tb
;
860 if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS
, cpu
->plugin_mask
)) {
863 QSIMPLEQ_INIT(&tcg_ctx
->plugin_ops
);
866 get_page_addr_code_hostp(cpu
->env_ptr
, tb
->pc
, &ptb
->haddr1
);
869 plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB
);
874 void plugin_gen_insn_start(CPUState
*cpu
, const DisasContextBase
*db
)
876 struct qemu_plugin_tb
*ptb
= tcg_ctx
->plugin_tb
;
877 struct qemu_plugin_insn
*pinsn
;
879 pinsn
= qemu_plugin_tb_insn_get(ptb
);
880 tcg_ctx
->plugin_insn
= pinsn
;
881 pinsn
->vaddr
= db
->pc_next
;
882 plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN
);
885 * Detect page crossing to get the new host address.
886 * Note that we skip this when haddr1 == NULL, e.g. when we're
887 * fetching instructions from a region not backed by RAM.
889 if (likely(ptb
->haddr1
!= NULL
&& ptb
->vaddr2
== -1) &&
890 unlikely((db
->pc_next
& TARGET_PAGE_MASK
) !=
891 (db
->pc_first
& TARGET_PAGE_MASK
))) {
892 get_page_addr_code_hostp(cpu
->env_ptr
, db
->pc_next
,
894 ptb
->vaddr2
= db
->pc_next
;
896 if (likely(ptb
->vaddr2
== -1)) {
897 pinsn
->haddr
= ptb
->haddr1
+ pinsn
->vaddr
- ptb
->vaddr
;
899 pinsn
->haddr
= ptb
->haddr2
+ pinsn
->vaddr
- ptb
->vaddr2
;
903 void plugin_gen_insn_end(void)
905 plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN
);
908 void plugin_gen_tb_end(CPUState
*cpu
)
910 struct qemu_plugin_tb
*ptb
= tcg_ctx
->plugin_tb
;
913 /* collect instrumentation requests */
914 qemu_plugin_tb_trans_cb(cpu
, ptb
);
916 /* inject the instrumentation at the appropriate places */
917 plugin_gen_inject(ptb
);
920 for (i
= 0; i
< PLUGIN_N_CB_SUBTYPES
; i
++) {
922 g_array_set_size(ptb
->cbs
[i
], 0);
926 tcg_ctx
->plugin_insn
= NULL
;