1 /*
2 * plugin-gen.c - TCG-related bits of plugin infrastructure
3 *
4 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
5 * License: GNU GPL, version 2 or later.
6 * See the COPYING file in the top-level directory.
7 *
8 * We support instrumentation at an instruction granularity. That is,
9 * if a plugin wants to instrument the memory accesses performed by a
10 * particular instruction, it can just do that instead of instrumenting
11 * all memory accesses. Thus, in order to do this we first have to
12 * translate a TB, so that plugins can decide what/where to instrument.
13 *
14 * Injecting the desired instrumentation could be done with a second
15 * translation pass that combined the instrumentation requests, but that
16 * would be ugly and inefficient since we would decode the guest code twice.
17 * Instead, during TB translation we add "plugin_cb" marker opcodes
18 * for all possible instrumentation events, and then once we collect the
19 * instrumentation requests from plugins, we generate code for those markers
20 * or remove them if they have no requests.
21 */
22 #include "qemu/osdep.h"
23 #include "qemu/plugin.h"
24 #include "qemu/log.h"
25 #include "cpu.h"
26 #include "tcg/tcg.h"
27 #include "tcg/tcg-temp-internal.h"
28 #include "tcg/tcg-op.h"
29 #include "exec/exec-all.h"
30 #include "exec/plugin-gen.h"
31 #include "exec/translator.h"
32
33 enum plugin_gen_from {
34 PLUGIN_GEN_FROM_TB,
35 PLUGIN_GEN_FROM_INSN,
36 PLUGIN_GEN_AFTER_INSN,
37 PLUGIN_GEN_AFTER_TB,
38 };
39
40 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
plugin_gen_disable_mem_helpers(void)41 void plugin_gen_disable_mem_helpers(void)
42 {
43 if (tcg_ctx->plugin_insn) {
44 tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_TB);
45 }
46 }
47
gen_enable_mem_helper(struct qemu_plugin_tb * ptb,struct qemu_plugin_insn * insn)48 static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
49 struct qemu_plugin_insn *insn)
50 {
51 GArray *arr;
52 size_t len;
53
54 /*
55 * Tracking memory accesses performed from helpers requires extra work.
56 * If an instruction is emulated with helpers, we do two things:
57 * (1) copy the CB descriptors, and keep track of it so that they can be
58 * freed later on, and (2) point CPUState.neg.plugin_mem_cbs to the
59 * descriptors, so that we can read them at run-time
60 * (i.e. when the helper executes).
61 * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
62 *
63 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
64 * is possible that the code we generate after the instruction is
65 * dead, we also add checks before generating tb_exit etc.
66 */
67 if (!insn->calls_helpers) {
68 return;
69 }
70
71 if (!insn->mem_cbs || !insn->mem_cbs->len) {
72 insn->mem_helper = false;
73 return;
74 }
75 insn->mem_helper = true;
76 ptb->mem_helper = true;
77
78 /*
79 * TODO: It seems like we should be able to use ref/unref
80 * to avoid needing to actually copy this array.
81 * Alternately, perhaps we could allocate new memory adjacent
82 * to the TranslationBlock itself, so that we do not have to
83 * actively manage the lifetime after this.
84 */
85 len = insn->mem_cbs->len;
86 arr = g_array_sized_new(false, false,
87 sizeof(struct qemu_plugin_dyn_cb), len);
88 g_array_append_vals(arr, insn->mem_cbs->data, len);
89 qemu_plugin_add_dyn_cb_arr(arr);
90
91 tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
92 offsetof(CPUState, neg.plugin_mem_cbs) -
93 offsetof(ArchCPU, env));
94 }
95
gen_disable_mem_helper(void)96 static void gen_disable_mem_helper(void)
97 {
98 tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
99 offsetof(CPUState, neg.plugin_mem_cbs) -
100 offsetof(ArchCPU, env));
101 }
102
gen_cpu_index(void)103 static TCGv_i32 gen_cpu_index(void)
104 {
105 /*
106 * Optimize when we run with a single vcpu. All values using cpu_index,
107 * including scoreboard index, will be optimized out.
108 * User-mode calls tb_flush when setting this flag. In system-mode, all
109 * vcpus are created before generating code.
110 */
111 if (!tcg_cflags_has(current_cpu, CF_PARALLEL)) {
112 return tcg_constant_i32(current_cpu->cpu_index);
113 }
114 TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
115 tcg_gen_ld_i32(cpu_index, tcg_env,
116 -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
117 return cpu_index;
118 }
119
gen_udata_cb(struct qemu_plugin_regular_cb * cb)120 static void gen_udata_cb(struct qemu_plugin_regular_cb *cb)
121 {
122 TCGv_i32 cpu_index = gen_cpu_index();
123 tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
124 tcgv_i32_temp(cpu_index),
125 tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
126 tcg_temp_free_i32(cpu_index);
127 }
128
gen_plugin_u64_ptr(qemu_plugin_u64 entry)129 static TCGv_ptr gen_plugin_u64_ptr(qemu_plugin_u64 entry)
130 {
131 TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
132
133 GArray *arr = entry.score->data;
134 char *base_ptr = arr->data + entry.offset;
135 size_t entry_size = g_array_get_element_size(arr);
136
137 TCGv_i32 cpu_index = gen_cpu_index();
138 tcg_gen_muli_i32(cpu_index, cpu_index, entry_size);
139 tcg_gen_ext_i32_ptr(ptr, cpu_index);
140 tcg_temp_free_i32(cpu_index);
141 tcg_gen_addi_ptr(ptr, ptr, (intptr_t) base_ptr);
142
143 return ptr;
144 }
145
plugin_cond_to_tcgcond(enum qemu_plugin_cond cond)146 static TCGCond plugin_cond_to_tcgcond(enum qemu_plugin_cond cond)
147 {
148 switch (cond) {
149 case QEMU_PLUGIN_COND_EQ:
150 return TCG_COND_EQ;
151 case QEMU_PLUGIN_COND_NE:
152 return TCG_COND_NE;
153 case QEMU_PLUGIN_COND_LT:
154 return TCG_COND_LTU;
155 case QEMU_PLUGIN_COND_LE:
156 return TCG_COND_LEU;
157 case QEMU_PLUGIN_COND_GT:
158 return TCG_COND_GTU;
159 case QEMU_PLUGIN_COND_GE:
160 return TCG_COND_GEU;
161 default:
162 /* ALWAYS and NEVER conditions should never reach */
163 g_assert_not_reached();
164 }
165 }
166
gen_udata_cond_cb(struct qemu_plugin_conditional_cb * cb)167 static void gen_udata_cond_cb(struct qemu_plugin_conditional_cb *cb)
168 {
169 TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
170 TCGv_i64 val = tcg_temp_ebb_new_i64();
171 TCGLabel *after_cb = gen_new_label();
172
173 /* Condition should be negated, as calling the cb is the "else" path */
174 TCGCond cond = tcg_invert_cond(plugin_cond_to_tcgcond(cb->cond));
175
176 tcg_gen_ld_i64(val, ptr, 0);
177 tcg_gen_brcondi_i64(cond, val, cb->imm, after_cb);
178 TCGv_i32 cpu_index = gen_cpu_index();
179 tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
180 tcgv_i32_temp(cpu_index),
181 tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
182 tcg_temp_free_i32(cpu_index);
183 gen_set_label(after_cb);
184
185 tcg_temp_free_i64(val);
186 tcg_temp_free_ptr(ptr);
187 }
188
gen_inline_add_u64_cb(struct qemu_plugin_inline_cb * cb)189 static void gen_inline_add_u64_cb(struct qemu_plugin_inline_cb *cb)
190 {
191 TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
192 TCGv_i64 val = tcg_temp_ebb_new_i64();
193
194 tcg_gen_ld_i64(val, ptr, 0);
195 tcg_gen_addi_i64(val, val, cb->imm);
196 tcg_gen_st_i64(val, ptr, 0);
197
198 tcg_temp_free_i64(val);
199 tcg_temp_free_ptr(ptr);
200 }
201
gen_inline_store_u64_cb(struct qemu_plugin_inline_cb * cb)202 static void gen_inline_store_u64_cb(struct qemu_plugin_inline_cb *cb)
203 {
204 TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
205 TCGv_i64 val = tcg_constant_i64(cb->imm);
206
207 tcg_gen_st_i64(val, ptr, 0);
208
209 tcg_temp_free_ptr(ptr);
210 }
211
gen_mem_cb(struct qemu_plugin_regular_cb * cb,qemu_plugin_meminfo_t meminfo,TCGv_i64 addr)212 static void gen_mem_cb(struct qemu_plugin_regular_cb *cb,
213 qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
214 {
215 TCGv_i32 cpu_index = gen_cpu_index();
216 tcg_gen_call4(cb->f.vcpu_mem, cb->info, NULL,
217 tcgv_i32_temp(cpu_index),
218 tcgv_i32_temp(tcg_constant_i32(meminfo)),
219 tcgv_i64_temp(addr),
220 tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
221 tcg_temp_free_i32(cpu_index);
222 }
223
inject_cb(struct qemu_plugin_dyn_cb * cb)224 static void inject_cb(struct qemu_plugin_dyn_cb *cb)
225
226 {
227 switch (cb->type) {
228 case PLUGIN_CB_REGULAR:
229 gen_udata_cb(&cb->regular);
230 break;
231 case PLUGIN_CB_COND:
232 gen_udata_cond_cb(&cb->cond);
233 break;
234 case PLUGIN_CB_INLINE_ADD_U64:
235 gen_inline_add_u64_cb(&cb->inline_insn);
236 break;
237 case PLUGIN_CB_INLINE_STORE_U64:
238 gen_inline_store_u64_cb(&cb->inline_insn);
239 break;
240 default:
241 g_assert_not_reached();
242 }
243 }
244
inject_mem_cb(struct qemu_plugin_dyn_cb * cb,enum qemu_plugin_mem_rw rw,qemu_plugin_meminfo_t meminfo,TCGv_i64 addr)245 static void inject_mem_cb(struct qemu_plugin_dyn_cb *cb,
246 enum qemu_plugin_mem_rw rw,
247 qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
248 {
249 switch (cb->type) {
250 case PLUGIN_CB_MEM_REGULAR:
251 if (rw & cb->regular.rw) {
252 gen_mem_cb(&cb->regular, meminfo, addr);
253 }
254 break;
255 case PLUGIN_CB_INLINE_ADD_U64:
256 case PLUGIN_CB_INLINE_STORE_U64:
257 if (rw & cb->inline_insn.rw) {
258 inject_cb(cb);
259 }
260 break;
261 default:
262 g_assert_not_reached();
263 }
264 }
265
plugin_gen_inject(struct qemu_plugin_tb * plugin_tb)266 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
267 {
268 TCGOp *op, *next;
269 int insn_idx = -1;
270
271 if (unlikely(qemu_loglevel_mask(LOG_TB_OP_PLUGIN)
272 && qemu_log_in_addr_range(tcg_ctx->plugin_db->pc_first))) {
273 FILE *logfile = qemu_log_trylock();
274 if (logfile) {
275 fprintf(logfile, "OP before plugin injection:\n");
276 tcg_dump_ops(tcg_ctx, logfile, false);
277 fprintf(logfile, "\n");
278 qemu_log_unlock(logfile);
279 }
280 }
281
282 /*
283 * While injecting code, we cannot afford to reuse any ebb temps
284 * that might be live within the existing opcode stream.
285 * The simplest solution is to release them all and create new.
286 */
287 tcg_temp_ebb_reset_freed(tcg_ctx);
288
289 QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
290 switch (op->opc) {
291 case INDEX_op_insn_start:
292 insn_idx++;
293 break;
294
295 case INDEX_op_plugin_cb:
296 {
297 enum plugin_gen_from from = op->args[0];
298 struct qemu_plugin_insn *insn = NULL;
299 const GArray *cbs;
300 int i, n;
301
302 if (insn_idx >= 0) {
303 insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
304 }
305
306 tcg_ctx->emit_before_op = op;
307
308 switch (from) {
309 case PLUGIN_GEN_AFTER_TB:
310 if (plugin_tb->mem_helper) {
311 gen_disable_mem_helper();
312 }
313 break;
314
315 case PLUGIN_GEN_AFTER_INSN:
316 assert(insn != NULL);
317 if (insn->mem_helper) {
318 gen_disable_mem_helper();
319 }
320 break;
321
322 case PLUGIN_GEN_FROM_TB:
323 assert(insn == NULL);
324
325 cbs = plugin_tb->cbs;
326 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
327 inject_cb(
328 &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
329 }
330 break;
331
332 case PLUGIN_GEN_FROM_INSN:
333 assert(insn != NULL);
334
335 gen_enable_mem_helper(plugin_tb, insn);
336
337 cbs = insn->insn_cbs;
338 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
339 inject_cb(
340 &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
341 }
342 break;
343
344 default:
345 g_assert_not_reached();
346 }
347
348 tcg_ctx->emit_before_op = NULL;
349 tcg_op_remove(tcg_ctx, op);
350 break;
351 }
352
353 case INDEX_op_plugin_mem_cb:
354 {
355 TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
356 qemu_plugin_meminfo_t meminfo = op->args[1];
357 enum qemu_plugin_mem_rw rw =
358 (qemu_plugin_mem_is_store(meminfo)
359 ? QEMU_PLUGIN_MEM_W : QEMU_PLUGIN_MEM_R);
360 struct qemu_plugin_insn *insn;
361 const GArray *cbs;
362 int i, n;
363
364 assert(insn_idx >= 0);
365 insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
366
367 tcg_ctx->emit_before_op = op;
368
369 cbs = insn->mem_cbs;
370 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
371 inject_mem_cb(&g_array_index(cbs, struct qemu_plugin_dyn_cb, i),
372 rw, meminfo, addr);
373 }
374
375 tcg_ctx->emit_before_op = NULL;
376 tcg_op_remove(tcg_ctx, op);
377 break;
378 }
379
380 default:
381 /* plugins don't care about any other ops */
382 break;
383 }
384 }
385 }
386
plugin_gen_tb_start(CPUState * cpu,const DisasContextBase * db)387 bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db)
388 {
389 struct qemu_plugin_tb *ptb;
390
391 if (!test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS,
392 cpu->plugin_state->event_mask)) {
393 return false;
394 }
395
396 tcg_ctx->plugin_db = db;
397 tcg_ctx->plugin_insn = NULL;
398 ptb = tcg_ctx->plugin_tb;
399
400 if (ptb) {
401 /* Reset callbacks */
402 if (ptb->cbs) {
403 g_array_set_size(ptb->cbs, 0);
404 }
405 ptb->n = 0;
406 ptb->mem_helper = false;
407 } else {
408 ptb = g_new0(struct qemu_plugin_tb, 1);
409 tcg_ctx->plugin_tb = ptb;
410 ptb->insns = g_ptr_array_new();
411 }
412
413 tcg_gen_plugin_cb(PLUGIN_GEN_FROM_TB);
414 return true;
415 }
416
plugin_gen_insn_start(CPUState * cpu,const DisasContextBase * db)417 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
418 {
419 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
420 struct qemu_plugin_insn *insn;
421 size_t n = db->num_insns;
422 vaddr pc;
423
424 assert(n >= 1);
425 ptb->n = n;
426 if (n <= ptb->insns->len) {
427 insn = g_ptr_array_index(ptb->insns, n - 1);
428 } else {
429 assert(n - 1 == ptb->insns->len);
430 insn = g_new0(struct qemu_plugin_insn, 1);
431 g_ptr_array_add(ptb->insns, insn);
432 }
433
434 tcg_ctx->plugin_insn = insn;
435 insn->calls_helpers = false;
436 insn->mem_helper = false;
437 if (insn->insn_cbs) {
438 g_array_set_size(insn->insn_cbs, 0);
439 }
440 if (insn->mem_cbs) {
441 g_array_set_size(insn->mem_cbs, 0);
442 }
443
444 pc = db->pc_next;
445 insn->vaddr = pc;
446
447 tcg_gen_plugin_cb(PLUGIN_GEN_FROM_INSN);
448 }
449
plugin_gen_insn_end(void)450 void plugin_gen_insn_end(void)
451 {
452 const DisasContextBase *db = tcg_ctx->plugin_db;
453 struct qemu_plugin_insn *pinsn = tcg_ctx->plugin_insn;
454
455 pinsn->len = db->fake_insn ? db->record_len : db->pc_next - pinsn->vaddr;
456
457 tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_INSN);
458 }
459
460 /*
461 * There are cases where we never get to finalise a translation - for
462 * example a page fault during translation. As a result we shouldn't
463 * do any clean-up here and make sure things are reset in
464 * plugin_gen_tb_start.
465 */
plugin_gen_tb_end(CPUState * cpu,size_t num_insns)466 void plugin_gen_tb_end(CPUState *cpu, size_t num_insns)
467 {
468 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
469
470 /* translator may have removed instructions, update final count */
471 g_assert(num_insns <= ptb->n);
472 ptb->n = num_insns;
473
474 /* collect instrumentation requests */
475 qemu_plugin_tb_trans_cb(cpu, ptb);
476
477 /* inject the instrumentation at the appropriate places */
478 plugin_gen_inject(ptb);
479
480 /* reset plugin translation state (plugin_tb is reused between blocks) */
481 tcg_ctx->plugin_db = NULL;
482 tcg_ctx->plugin_insn = NULL;
483 }
484