1 /*
2 * plugin-gen.c - TCG-related bits of plugin infrastructure
3 *
4 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
5 * License: GNU GPL, version 2 or later.
6 * See the COPYING file in the top-level directory.
7 *
8 * We support instrumentation at an instruction granularity. That is,
9 * if a plugin wants to instrument the memory accesses performed by a
10 * particular instruction, it can just do that instead of instrumenting
11 * all memory accesses. Thus, in order to do this we first have to
12 * translate a TB, so that plugins can decide what/where to instrument.
13 *
14 * Injecting the desired instrumentation could be done with a second
15 * translation pass that combined the instrumentation requests, but that
16 * would be ugly and inefficient since we would decode the guest code twice.
17 * Instead, during TB translation we add "plugin_cb" marker opcodes
18 * for all possible instrumentation events, and then once we collect the
19 * instrumentation requests from plugins, we generate code for those markers
20 * or remove them if they have no requests.
21 */
22 #include "qemu/osdep.h"
23 #include "qemu/plugin.h"
24 #include "qemu/log.h"
25 #include "cpu.h"
26 #include "tcg/tcg.h"
27 #include "tcg/tcg-temp-internal.h"
28 #include "tcg/tcg-op.h"
29 #include "exec/exec-all.h"
30 #include "exec/plugin-gen.h"
31 #include "exec/translator.h"
32
33 enum plugin_gen_from {
34 PLUGIN_GEN_FROM_TB,
35 PLUGIN_GEN_FROM_INSN,
36 PLUGIN_GEN_AFTER_INSN,
37 PLUGIN_GEN_AFTER_TB,
38 };
39
40 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
plugin_gen_disable_mem_helpers(void)41 void plugin_gen_disable_mem_helpers(void)
42 {
43 if (tcg_ctx->plugin_insn) {
44 tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_TB);
45 }
46 }
47
gen_enable_mem_helper(struct qemu_plugin_tb * ptb,struct qemu_plugin_insn * insn)48 static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
49 struct qemu_plugin_insn *insn)
50 {
51 GArray *arr;
52 size_t len;
53
54 /*
55 * Tracking memory accesses performed from helpers requires extra work.
56 * If an instruction is emulated with helpers, we do two things:
57 * (1) copy the CB descriptors, and keep track of it so that they can be
58 * freed later on, and (2) point CPUState.neg.plugin_mem_cbs to the
59 * descriptors, so that we can read them at run-time
60 * (i.e. when the helper executes).
61 * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
62 *
63 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
64 * is possible that the code we generate after the instruction is
65 * dead, we also add checks before generating tb_exit etc.
66 */
67 if (!insn->calls_helpers) {
68 return;
69 }
70
71 if (!insn->mem_cbs || !insn->mem_cbs->len) {
72 insn->mem_helper = false;
73 return;
74 }
75 insn->mem_helper = true;
76 ptb->mem_helper = true;
77
78 /*
79 * TODO: It seems like we should be able to use ref/unref
80 * to avoid needing to actually copy this array.
81 * Alternately, perhaps we could allocate new memory adjacent
82 * to the TranslationBlock itself, so that we do not have to
83 * actively manage the lifetime after this.
84 */
85 len = insn->mem_cbs->len;
86 arr = g_array_sized_new(false, false,
87 sizeof(struct qemu_plugin_dyn_cb), len);
88 memcpy(arr->data, insn->mem_cbs->data,
89 len * sizeof(struct qemu_plugin_dyn_cb));
90 qemu_plugin_add_dyn_cb_arr(arr);
91
92 tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
93 offsetof(CPUState, neg.plugin_mem_cbs) -
94 offsetof(ArchCPU, env));
95 }
96
gen_disable_mem_helper(void)97 static void gen_disable_mem_helper(void)
98 {
99 tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
100 offsetof(CPUState, neg.plugin_mem_cbs) -
101 offsetof(ArchCPU, env));
102 }
103
gen_cpu_index(void)104 static TCGv_i32 gen_cpu_index(void)
105 {
106 TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
107 tcg_gen_ld_i32(cpu_index, tcg_env,
108 -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
109 return cpu_index;
110 }
111
gen_udata_cb(struct qemu_plugin_regular_cb * cb)112 static void gen_udata_cb(struct qemu_plugin_regular_cb *cb)
113 {
114 TCGv_i32 cpu_index = gen_cpu_index();
115 tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
116 tcgv_i32_temp(cpu_index),
117 tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
118 tcg_temp_free_i32(cpu_index);
119 }
120
gen_plugin_u64_ptr(qemu_plugin_u64 entry)121 static TCGv_ptr gen_plugin_u64_ptr(qemu_plugin_u64 entry)
122 {
123 TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
124
125 GArray *arr = entry.score->data;
126 char *base_ptr = arr->data + entry.offset;
127 size_t entry_size = g_array_get_element_size(arr);
128
129 TCGv_i32 cpu_index = gen_cpu_index();
130 tcg_gen_muli_i32(cpu_index, cpu_index, entry_size);
131 tcg_gen_ext_i32_ptr(ptr, cpu_index);
132 tcg_temp_free_i32(cpu_index);
133 tcg_gen_addi_ptr(ptr, ptr, (intptr_t) base_ptr);
134
135 return ptr;
136 }
137
plugin_cond_to_tcgcond(enum qemu_plugin_cond cond)138 static TCGCond plugin_cond_to_tcgcond(enum qemu_plugin_cond cond)
139 {
140 switch (cond) {
141 case QEMU_PLUGIN_COND_EQ:
142 return TCG_COND_EQ;
143 case QEMU_PLUGIN_COND_NE:
144 return TCG_COND_NE;
145 case QEMU_PLUGIN_COND_LT:
146 return TCG_COND_LTU;
147 case QEMU_PLUGIN_COND_LE:
148 return TCG_COND_LEU;
149 case QEMU_PLUGIN_COND_GT:
150 return TCG_COND_GTU;
151 case QEMU_PLUGIN_COND_GE:
152 return TCG_COND_GEU;
153 default:
154 /* ALWAYS and NEVER conditions should never reach */
155 g_assert_not_reached();
156 }
157 }
158
gen_udata_cond_cb(struct qemu_plugin_conditional_cb * cb)159 static void gen_udata_cond_cb(struct qemu_plugin_conditional_cb *cb)
160 {
161 TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
162 TCGv_i64 val = tcg_temp_ebb_new_i64();
163 TCGLabel *after_cb = gen_new_label();
164
165 /* Condition should be negated, as calling the cb is the "else" path */
166 TCGCond cond = tcg_invert_cond(plugin_cond_to_tcgcond(cb->cond));
167
168 tcg_gen_ld_i64(val, ptr, 0);
169 tcg_gen_brcondi_i64(cond, val, cb->imm, after_cb);
170 TCGv_i32 cpu_index = gen_cpu_index();
171 tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
172 tcgv_i32_temp(cpu_index),
173 tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
174 tcg_temp_free_i32(cpu_index);
175 gen_set_label(after_cb);
176
177 tcg_temp_free_i64(val);
178 tcg_temp_free_ptr(ptr);
179 }
180
gen_inline_add_u64_cb(struct qemu_plugin_inline_cb * cb)181 static void gen_inline_add_u64_cb(struct qemu_plugin_inline_cb *cb)
182 {
183 TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
184 TCGv_i64 val = tcg_temp_ebb_new_i64();
185
186 tcg_gen_ld_i64(val, ptr, 0);
187 tcg_gen_addi_i64(val, val, cb->imm);
188 tcg_gen_st_i64(val, ptr, 0);
189
190 tcg_temp_free_i64(val);
191 tcg_temp_free_ptr(ptr);
192 }
193
gen_inline_store_u64_cb(struct qemu_plugin_inline_cb * cb)194 static void gen_inline_store_u64_cb(struct qemu_plugin_inline_cb *cb)
195 {
196 TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
197 TCGv_i64 val = tcg_constant_i64(cb->imm);
198
199 tcg_gen_st_i64(val, ptr, 0);
200
201 tcg_temp_free_ptr(ptr);
202 }
203
gen_mem_cb(struct qemu_plugin_regular_cb * cb,qemu_plugin_meminfo_t meminfo,TCGv_i64 addr)204 static void gen_mem_cb(struct qemu_plugin_regular_cb *cb,
205 qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
206 {
207 TCGv_i32 cpu_index = gen_cpu_index();
208 tcg_gen_call4(cb->f.vcpu_mem, cb->info, NULL,
209 tcgv_i32_temp(cpu_index),
210 tcgv_i32_temp(tcg_constant_i32(meminfo)),
211 tcgv_i64_temp(addr),
212 tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
213 tcg_temp_free_i32(cpu_index);
214 }
215
inject_cb(struct qemu_plugin_dyn_cb * cb)216 static void inject_cb(struct qemu_plugin_dyn_cb *cb)
217
218 {
219 switch (cb->type) {
220 case PLUGIN_CB_REGULAR:
221 gen_udata_cb(&cb->regular);
222 break;
223 case PLUGIN_CB_COND:
224 gen_udata_cond_cb(&cb->cond);
225 break;
226 case PLUGIN_CB_INLINE_ADD_U64:
227 gen_inline_add_u64_cb(&cb->inline_insn);
228 break;
229 case PLUGIN_CB_INLINE_STORE_U64:
230 gen_inline_store_u64_cb(&cb->inline_insn);
231 break;
232 default:
233 g_assert_not_reached();
234 }
235 }
236
inject_mem_cb(struct qemu_plugin_dyn_cb * cb,enum qemu_plugin_mem_rw rw,qemu_plugin_meminfo_t meminfo,TCGv_i64 addr)237 static void inject_mem_cb(struct qemu_plugin_dyn_cb *cb,
238 enum qemu_plugin_mem_rw rw,
239 qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
240 {
241 switch (cb->type) {
242 case PLUGIN_CB_MEM_REGULAR:
243 if (rw && cb->regular.rw) {
244 gen_mem_cb(&cb->regular, meminfo, addr);
245 }
246 break;
247 case PLUGIN_CB_INLINE_ADD_U64:
248 case PLUGIN_CB_INLINE_STORE_U64:
249 if (rw && cb->inline_insn.rw) {
250 inject_cb(cb);
251 }
252 break;
253 default:
254 g_assert_not_reached();
255 break;
256 }
257 }
258
plugin_gen_inject(struct qemu_plugin_tb * plugin_tb)259 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
260 {
261 TCGOp *op, *next;
262 int insn_idx = -1;
263
264 if (unlikely(qemu_loglevel_mask(LOG_TB_OP_PLUGIN)
265 && qemu_log_in_addr_range(tcg_ctx->plugin_db->pc_first))) {
266 FILE *logfile = qemu_log_trylock();
267 if (logfile) {
268 fprintf(logfile, "OP before plugin injection:\n");
269 tcg_dump_ops(tcg_ctx, logfile, false);
270 fprintf(logfile, "\n");
271 qemu_log_unlock(logfile);
272 }
273 }
274
275 /*
276 * While injecting code, we cannot afford to reuse any ebb temps
277 * that might be live within the existing opcode stream.
278 * The simplest solution is to release them all and create new.
279 */
280 memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
281
282 QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
283 switch (op->opc) {
284 case INDEX_op_insn_start:
285 insn_idx++;
286 break;
287
288 case INDEX_op_plugin_cb:
289 {
290 enum plugin_gen_from from = op->args[0];
291 struct qemu_plugin_insn *insn = NULL;
292 const GArray *cbs;
293 int i, n;
294
295 if (insn_idx >= 0) {
296 insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
297 }
298
299 tcg_ctx->emit_before_op = op;
300
301 switch (from) {
302 case PLUGIN_GEN_AFTER_TB:
303 if (plugin_tb->mem_helper) {
304 gen_disable_mem_helper();
305 }
306 break;
307
308 case PLUGIN_GEN_AFTER_INSN:
309 assert(insn != NULL);
310 if (insn->mem_helper) {
311 gen_disable_mem_helper();
312 }
313 break;
314
315 case PLUGIN_GEN_FROM_TB:
316 assert(insn == NULL);
317
318 cbs = plugin_tb->cbs;
319 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
320 inject_cb(
321 &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
322 }
323 break;
324
325 case PLUGIN_GEN_FROM_INSN:
326 assert(insn != NULL);
327
328 gen_enable_mem_helper(plugin_tb, insn);
329
330 cbs = insn->insn_cbs;
331 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
332 inject_cb(
333 &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
334 }
335 break;
336
337 default:
338 g_assert_not_reached();
339 }
340
341 tcg_ctx->emit_before_op = NULL;
342 tcg_op_remove(tcg_ctx, op);
343 break;
344 }
345
346 case INDEX_op_plugin_mem_cb:
347 {
348 TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
349 qemu_plugin_meminfo_t meminfo = op->args[1];
350 enum qemu_plugin_mem_rw rw =
351 (qemu_plugin_mem_is_store(meminfo)
352 ? QEMU_PLUGIN_MEM_W : QEMU_PLUGIN_MEM_R);
353 struct qemu_plugin_insn *insn;
354 const GArray *cbs;
355 int i, n;
356
357 assert(insn_idx >= 0);
358 insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
359
360 tcg_ctx->emit_before_op = op;
361
362 cbs = insn->mem_cbs;
363 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
364 inject_mem_cb(&g_array_index(cbs, struct qemu_plugin_dyn_cb, i),
365 rw, meminfo, addr);
366 }
367
368 tcg_ctx->emit_before_op = NULL;
369 tcg_op_remove(tcg_ctx, op);
370 break;
371 }
372
373 default:
374 /* plugins don't care about any other ops */
375 break;
376 }
377 }
378 }
379
plugin_gen_tb_start(CPUState * cpu,const DisasContextBase * db)380 bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db)
381 {
382 struct qemu_plugin_tb *ptb;
383
384 if (!test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS,
385 cpu->plugin_state->event_mask)) {
386 return false;
387 }
388
389 tcg_ctx->plugin_db = db;
390 tcg_ctx->plugin_insn = NULL;
391 ptb = tcg_ctx->plugin_tb;
392
393 if (ptb) {
394 /* Reset callbacks */
395 if (ptb->cbs) {
396 g_array_set_size(ptb->cbs, 0);
397 }
398 ptb->n = 0;
399 ptb->mem_helper = false;
400 } else {
401 ptb = g_new0(struct qemu_plugin_tb, 1);
402 tcg_ctx->plugin_tb = ptb;
403 ptb->insns = g_ptr_array_new();
404 }
405
406 tcg_gen_plugin_cb(PLUGIN_GEN_FROM_TB);
407 return true;
408 }
409
plugin_gen_insn_start(CPUState * cpu,const DisasContextBase * db)410 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
411 {
412 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
413 struct qemu_plugin_insn *insn;
414 size_t n = db->num_insns;
415 vaddr pc;
416
417 assert(n >= 1);
418 ptb->n = n;
419 if (n <= ptb->insns->len) {
420 insn = g_ptr_array_index(ptb->insns, n - 1);
421 } else {
422 assert(n - 1 == ptb->insns->len);
423 insn = g_new0(struct qemu_plugin_insn, 1);
424 g_ptr_array_add(ptb->insns, insn);
425 }
426
427 tcg_ctx->plugin_insn = insn;
428 insn->calls_helpers = false;
429 insn->mem_helper = false;
430 if (insn->insn_cbs) {
431 g_array_set_size(insn->insn_cbs, 0);
432 }
433 if (insn->mem_cbs) {
434 g_array_set_size(insn->mem_cbs, 0);
435 }
436
437 pc = db->pc_next;
438 insn->vaddr = pc;
439
440 tcg_gen_plugin_cb(PLUGIN_GEN_FROM_INSN);
441 }
442
plugin_gen_insn_end(void)443 void plugin_gen_insn_end(void)
444 {
445 const DisasContextBase *db = tcg_ctx->plugin_db;
446 struct qemu_plugin_insn *pinsn = tcg_ctx->plugin_insn;
447
448 pinsn->len = db->fake_insn ? db->record_len : db->pc_next - pinsn->vaddr;
449
450 tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_INSN);
451 }
452
453 /*
454 * There are cases where we never get to finalise a translation - for
455 * example a page fault during translation. As a result we shouldn't
456 * do any clean-up here and make sure things are reset in
457 * plugin_gen_tb_start.
458 */
plugin_gen_tb_end(CPUState * cpu,size_t num_insns)459 void plugin_gen_tb_end(CPUState *cpu, size_t num_insns)
460 {
461 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
462
463 /* translator may have removed instructions, update final count */
464 g_assert(num_insns <= ptb->n);
465 ptb->n = num_insns;
466
467 /* collect instrumentation requests */
468 qemu_plugin_tb_trans_cb(cpu, ptb);
469
470 /* inject the instrumentation at the appropriate places */
471 plugin_gen_inject(ptb);
472 }
473