accel/tcg/plugin-gen.c

   1 /*
   2  * plugin-gen.c - TCG-related bits of plugin infrastructure
   3  *
   4  * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
   5  * License: GNU GPL, version 2 or later.
   6  *   See the COPYING file in the top-level directory.
   7  *
   8  * We support instrumentation at an instruction granularity. That is,
   9  * if a plugin wants to instrument the memory accesses performed by a
  10  * particular instruction, it can just do that instead of instrumenting
  11  * all memory accesses. Thus, in order to do this we first have to
  12  * translate a TB, so that plugins can decide what/where to instrument.
  13  *
  14  * Injecting the desired instrumentation could be done with a second
  15  * translation pass that combined the instrumentation requests, but that
  16  * would be ugly and inefficient since we would decode the guest code twice.
  17  * Instead, during TB translation we add "plugin_cb" marker opcodes
  18  * for all possible instrumentation events, and then once we collect the
  19  * instrumentation requests from plugins, we generate code for those markers
  20  * or remove them if they have no requests.
  21  */
  22 #include "qemu/osdep.h"
  23 #include "qemu/plugin.h"
  24 #include "qemu/log.h"
  25 #include "cpu.h"
  26 #include "tcg/tcg.h"
  27 #include "tcg/tcg-temp-internal.h"
  28 #include "tcg/tcg-op.h"
  29 #include "exec/exec-all.h"
  30 #include "exec/plugin-gen.h"
  31 #include "exec/translator.h"
  32
  33 enum plugin_gen_from {
  34     PLUGIN_GEN_FROM_TB,
  35     PLUGIN_GEN_FROM_INSN,
  36     PLUGIN_GEN_AFTER_INSN,
  37     PLUGIN_GEN_AFTER_TB,
  38 };
  39
  40 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
  41 void plugin_gen_disable_mem_helpers(void)
  42 {
  43     if (tcg_ctx->plugin_insn) {
  44         tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_TB);
  45     }
  46 }
  47
  48 static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
  49                                   struct qemu_plugin_insn *insn)
  50 {
  51     GArray *arr;
  52     size_t len;
  53
  54     /*
  55      * Tracking memory accesses performed from helpers requires extra work.
  56      * If an instruction is emulated with helpers, we do two things:
  57      * (1) copy the CB descriptors, and keep track of it so that they can be
  58      * freed later on, and (2) point CPUState.neg.plugin_mem_cbs to the
  59      * descriptors, so that we can read them at run-time
  60      * (i.e. when the helper executes).
  61      * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
  62      *
  63      * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
  64      * is possible that the code we generate after the instruction is
  65      * dead, we also add checks before generating tb_exit etc.
  66      */
  67     if (!insn->calls_helpers) {
  68         return;
  69     }
  70
  71     if (!insn->mem_cbs || !insn->mem_cbs->len) {
  72         insn->mem_helper = false;
  73         return;
  74     }
  75     insn->mem_helper = true;
  76     ptb->mem_helper = true;
  77
  78     /*
  79      * TODO: It seems like we should be able to use ref/unref
  80      * to avoid needing to actually copy this array.
  81      * Alternately, perhaps we could allocate new memory adjacent
  82      * to the TranslationBlock itself, so that we do not have to
  83      * actively manage the lifetime after this.
  84      */
  85     len = insn->mem_cbs->len;
  86     arr = g_array_sized_new(false, false,
  87                             sizeof(struct qemu_plugin_dyn_cb), len);
  88     g_array_append_vals(arr, insn->mem_cbs->data, len);
  89     qemu_plugin_add_dyn_cb_arr(arr);
  90
  91     tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
  92                    offsetof(CPUState, neg.plugin_mem_cbs) -
  93                    offsetof(ArchCPU, env));
  94 }
  95
  96 static void gen_disable_mem_helper(void)
  97 {
  98     tcg_gen_st_ptr(tcg_constant_ptr(0), tcg_env,
  99                    offsetof(CPUState, neg.plugin_mem_cbs) -
 100                    offsetof(ArchCPU, env));
 101 }
 102
 103 static TCGv_i32 gen_cpu_index(void)
 104 {
 105     TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
 106     tcg_gen_ld_i32(cpu_index, tcg_env,
 107                    -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
 108     return cpu_index;
 109 }
 110
 111 static void gen_udata_cb(struct qemu_plugin_regular_cb *cb)
 112 {
 113     TCGv_i32 cpu_index = gen_cpu_index();
 114     tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
 115                   tcgv_i32_temp(cpu_index),
 116                   tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
 117     tcg_temp_free_i32(cpu_index);
 118 }
 119
 120 static TCGv_ptr gen_plugin_u64_ptr(qemu_plugin_u64 entry)
 121 {
 122     TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
 123
 124     GArray *arr = entry.score->data;
 125     char *base_ptr = arr->data + entry.offset;
 126     size_t entry_size = g_array_get_element_size(arr);
 127
 128     TCGv_i32 cpu_index = gen_cpu_index();
 129     tcg_gen_muli_i32(cpu_index, cpu_index, entry_size);
 130     tcg_gen_ext_i32_ptr(ptr, cpu_index);
 131     tcg_temp_free_i32(cpu_index);
 132     tcg_gen_addi_ptr(ptr, ptr, (intptr_t) base_ptr);
 133
 134     return ptr;
 135 }
 136
 137 static TCGCond plugin_cond_to_tcgcond(enum qemu_plugin_cond cond)
 138 {
 139     switch (cond) {
 140     case QEMU_PLUGIN_COND_EQ:
 141         return TCG_COND_EQ;
 142     case QEMU_PLUGIN_COND_NE:
 143         return TCG_COND_NE;
 144     case QEMU_PLUGIN_COND_LT:
 145         return TCG_COND_LTU;
 146     case QEMU_PLUGIN_COND_LE:
 147         return TCG_COND_LEU;
 148     case QEMU_PLUGIN_COND_GT:
 149         return TCG_COND_GTU;
 150     case QEMU_PLUGIN_COND_GE:
 151         return TCG_COND_GEU;
 152     default:
 153         /* ALWAYS and NEVER conditions should never reach */
 154         g_assert_not_reached();
 155     }
 156 }
 157
 158 static void gen_udata_cond_cb(struct qemu_plugin_conditional_cb *cb)
 159 {
 160     TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
 161     TCGv_i64 val = tcg_temp_ebb_new_i64();
 162     TCGLabel *after_cb = gen_new_label();
 163
 164     /* Condition should be negated, as calling the cb is the "else" path */
 165     TCGCond cond = tcg_invert_cond(plugin_cond_to_tcgcond(cb->cond));
 166
 167     tcg_gen_ld_i64(val, ptr, 0);
 168     tcg_gen_brcondi_i64(cond, val, cb->imm, after_cb);
 169     TCGv_i32 cpu_index = gen_cpu_index();
 170     tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
 171                   tcgv_i32_temp(cpu_index),
 172                   tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
 173     tcg_temp_free_i32(cpu_index);
 174     gen_set_label(after_cb);
 175
 176     tcg_temp_free_i64(val);
 177     tcg_temp_free_ptr(ptr);
 178 }
 179
 180 static void gen_inline_add_u64_cb(struct qemu_plugin_inline_cb *cb)
 181 {
 182     TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
 183     TCGv_i64 val = tcg_temp_ebb_new_i64();
 184
 185     tcg_gen_ld_i64(val, ptr, 0);
 186     tcg_gen_addi_i64(val, val, cb->imm);
 187     tcg_gen_st_i64(val, ptr, 0);
 188
 189     tcg_temp_free_i64(val);
 190     tcg_temp_free_ptr(ptr);
 191 }
 192
 193 static void gen_inline_store_u64_cb(struct qemu_plugin_inline_cb *cb)
 194 {
 195     TCGv_ptr ptr = gen_plugin_u64_ptr(cb->entry);
 196     TCGv_i64 val = tcg_constant_i64(cb->imm);
 197
 198     tcg_gen_st_i64(val, ptr, 0);
 199
 200     tcg_temp_free_ptr(ptr);
 201 }
 202
 203 static void gen_mem_cb(struct qemu_plugin_regular_cb *cb,
 204                        qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
 205 {
 206     TCGv_i32 cpu_index = gen_cpu_index();
 207     tcg_gen_call4(cb->f.vcpu_mem, cb->info, NULL,
 208                   tcgv_i32_temp(cpu_index),
 209                   tcgv_i32_temp(tcg_constant_i32(meminfo)),
 210                   tcgv_i64_temp(addr),
 211                   tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
 212     tcg_temp_free_i32(cpu_index);
 213 }
 214
 215 static void inject_cb(struct qemu_plugin_dyn_cb *cb)
 216
 217 {
 218     switch (cb->type) {
 219     case PLUGIN_CB_REGULAR:
 220         gen_udata_cb(&cb->regular);
 221         break;
 222     case PLUGIN_CB_COND:
 223         gen_udata_cond_cb(&cb->cond);
 224         break;
 225     case PLUGIN_CB_INLINE_ADD_U64:
 226         gen_inline_add_u64_cb(&cb->inline_insn);
 227         break;
 228     case PLUGIN_CB_INLINE_STORE_U64:
 229         gen_inline_store_u64_cb(&cb->inline_insn);
 230         break;
 231     default:
 232         g_assert_not_reached();
 233     }
 234 }
 235
 236 static void inject_mem_cb(struct qemu_plugin_dyn_cb *cb,
 237                           enum qemu_plugin_mem_rw rw,
 238                           qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
 239 {
 240     switch (cb->type) {
 241     case PLUGIN_CB_MEM_REGULAR:
 242         if (rw & cb->regular.rw) {
 243             gen_mem_cb(&cb->regular, meminfo, addr);
 244         }
 245         break;
 246     case PLUGIN_CB_INLINE_ADD_U64:
 247     case PLUGIN_CB_INLINE_STORE_U64:
 248         if (rw & cb->inline_insn.rw) {
 249             inject_cb(cb);
 250         }
 251         break;
 252     default:
 253         g_assert_not_reached();
 254     }
 255 }
 256
 257 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
 258 {
 259     TCGOp *op, *next;
 260     int insn_idx = -1;
 261
 262     if (unlikely(qemu_loglevel_mask(LOG_TB_OP_PLUGIN)
 263                  && qemu_log_in_addr_range(tcg_ctx->plugin_db->pc_first))) {
 264         FILE *logfile = qemu_log_trylock();
 265         if (logfile) {
 266             fprintf(logfile, "OP before plugin injection:\n");
 267             tcg_dump_ops(tcg_ctx, logfile, false);
 268             fprintf(logfile, "\n");
 269             qemu_log_unlock(logfile);
 270         }
 271     }
 272
 273     /*
 274      * While injecting code, we cannot afford to reuse any ebb temps
 275      * that might be live within the existing opcode stream.
 276      * The simplest solution is to release them all and create new.
 277      */
 278     memset(tcg_ctx->free_temps, 0, sizeof(tcg_ctx->free_temps));
 279
 280     QTAILQ_FOREACH_SAFE(op, &tcg_ctx->ops, link, next) {
 281         switch (op->opc) {
 282         case INDEX_op_insn_start:
 283             insn_idx++;
 284             break;
 285
 286         case INDEX_op_plugin_cb:
 287         {
 288             enum plugin_gen_from from = op->args[0];
 289             struct qemu_plugin_insn *insn = NULL;
 290             const GArray *cbs;
 291             int i, n;
 292
 293             if (insn_idx >= 0) {
 294                 insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
 295             }
 296
 297             tcg_ctx->emit_before_op = op;
 298
 299             switch (from) {
 300             case PLUGIN_GEN_AFTER_TB:
 301                 if (plugin_tb->mem_helper) {
 302                     gen_disable_mem_helper();
 303                 }
 304                 break;
 305
 306             case PLUGIN_GEN_AFTER_INSN:
 307                 assert(insn != NULL);
 308                 if (insn->mem_helper) {
 309                     gen_disable_mem_helper();
 310                 }
 311                 break;
 312
 313             case PLUGIN_GEN_FROM_TB:
 314                 assert(insn == NULL);
 315
 316                 cbs = plugin_tb->cbs;
 317                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 318                     inject_cb(
 319                         &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
 320                 }
 321                 break;
 322
 323             case PLUGIN_GEN_FROM_INSN:
 324                 assert(insn != NULL);
 325
 326                 gen_enable_mem_helper(plugin_tb, insn);
 327
 328                 cbs = insn->insn_cbs;
 329                 for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 330                     inject_cb(
 331                         &g_array_index(cbs, struct qemu_plugin_dyn_cb, i));
 332                 }
 333                 break;
 334
 335             default:
 336                 g_assert_not_reached();
 337             }
 338
 339             tcg_ctx->emit_before_op = NULL;
 340             tcg_op_remove(tcg_ctx, op);
 341             break;
 342         }
 343
 344         case INDEX_op_plugin_mem_cb:
 345         {
 346             TCGv_i64 addr = temp_tcgv_i64(arg_temp(op->args[0]));
 347             qemu_plugin_meminfo_t meminfo = op->args[1];
 348             enum qemu_plugin_mem_rw rw =
 349                 (qemu_plugin_mem_is_store(meminfo)
 350                  ? QEMU_PLUGIN_MEM_W : QEMU_PLUGIN_MEM_R);
 351             struct qemu_plugin_insn *insn;
 352             const GArray *cbs;
 353             int i, n;
 354
 355             assert(insn_idx >= 0);
 356             insn = g_ptr_array_index(plugin_tb->insns, insn_idx);
 357
 358             tcg_ctx->emit_before_op = op;
 359
 360             cbs = insn->mem_cbs;
 361             for (i = 0, n = (cbs ? cbs->len : 0); i < n; i++) {
 362                 inject_mem_cb(&g_array_index(cbs, struct qemu_plugin_dyn_cb, i),
 363                               rw, meminfo, addr);
 364             }
 365
 366             tcg_ctx->emit_before_op = NULL;
 367             tcg_op_remove(tcg_ctx, op);
 368             break;
 369         }
 370
 371         default:
 372             /* plugins don't care about any other ops */
 373             break;
 374         }
 375     }
 376 }
 377
 378 bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db)
 379 {
 380     struct qemu_plugin_tb *ptb;
 381
 382     if (!test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS,
 383                   cpu->plugin_state->event_mask)) {
 384         return false;
 385     }
 386
 387     tcg_ctx->plugin_db = db;
 388     tcg_ctx->plugin_insn = NULL;
 389     ptb = tcg_ctx->plugin_tb;
 390
 391     if (ptb) {
 392         /* Reset callbacks */
 393         if (ptb->cbs) {
 394             g_array_set_size(ptb->cbs, 0);
 395         }
 396         ptb->n = 0;
 397         ptb->mem_helper = false;
 398     } else {
 399         ptb = g_new0(struct qemu_plugin_tb, 1);
 400         tcg_ctx->plugin_tb = ptb;
 401         ptb->insns = g_ptr_array_new();
 402     }
 403
 404     tcg_gen_plugin_cb(PLUGIN_GEN_FROM_TB);
 405     return true;
 406 }
 407
 408 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
 409 {
 410     struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
 411     struct qemu_plugin_insn *insn;
 412     size_t n = db->num_insns;
 413     vaddr pc;
 414
 415     assert(n >= 1);
 416     ptb->n = n;
 417     if (n <= ptb->insns->len) {
 418         insn = g_ptr_array_index(ptb->insns, n - 1);
 419     } else {
 420         assert(n - 1 == ptb->insns->len);
 421         insn = g_new0(struct qemu_plugin_insn, 1);
 422         g_ptr_array_add(ptb->insns, insn);
 423     }
 424
 425     tcg_ctx->plugin_insn = insn;
 426     insn->calls_helpers = false;
 427     insn->mem_helper = false;
 428     if (insn->insn_cbs) {
 429         g_array_set_size(insn->insn_cbs, 0);
 430     }
 431     if (insn->mem_cbs) {
 432         g_array_set_size(insn->mem_cbs, 0);
 433     }
 434
 435     pc = db->pc_next;
 436     insn->vaddr = pc;
 437
 438     tcg_gen_plugin_cb(PLUGIN_GEN_FROM_INSN);
 439 }
 440
 441 void plugin_gen_insn_end(void)
 442 {
 443     const DisasContextBase *db = tcg_ctx->plugin_db;
 444     struct qemu_plugin_insn *pinsn = tcg_ctx->plugin_insn;
 445
 446     pinsn->len = db->fake_insn ? db->record_len : db->pc_next - pinsn->vaddr;
 447
 448     tcg_gen_plugin_cb(PLUGIN_GEN_AFTER_INSN);
 449 }
 450
 451 /*
 452  * There are cases where we never get to finalise a translation - for
 453  * example a page fault during translation. As a result we shouldn't
 454  * do any clean-up here and make sure things are reset in
 455  * plugin_gen_tb_start.
 456  */
 457 void plugin_gen_tb_end(CPUState *cpu, size_t num_insns)
 458 {
 459     struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
 460
 461     /* translator may have removed instructions, update final count */
 462     g_assert(num_insns <= ptb->n);
 463     ptb->n = num_insns;
 464
 465     /* collect instrumentation requests */
 466     qemu_plugin_tb_trans_cb(cpu, ptb);
 467
 468     /* inject the instrumentation at the appropriate places */
 469     plugin_gen_inject(ptb);
 470 }