qapi: allow unions to contain further unions
[qemu/armbru.git] / accel / tcg / plugin-gen.c
blob5efb8db2585a1b7489d323b9e1fadd6fc6d447f3
1 /*
2 * plugin-gen.c - TCG-related bits of plugin infrastructure
4 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
5 * License: GNU GPL, version 2 or later.
6 * See the COPYING file in the top-level directory.
8 * We support instrumentation at an instruction granularity. That is,
9 * if a plugin wants to instrument the memory accesses performed by a
10 * particular instruction, it can just do that instead of instrumenting
11 * all memory accesses. Thus, in order to do this we first have to
12 * translate a TB, so that plugins can decide what/where to instrument.
14 * Injecting the desired instrumentation could be done with a second
15 * translation pass that combined the instrumentation requests, but that
16 * would be ugly and inefficient since we would decode the guest code twice.
17 * Instead, during TB translation we add "empty" instrumentation calls for all
18 * possible instrumentation events, and then once we collect the instrumentation
19 * requests from plugins, we either "fill in" those empty events or remove them
20 * if they have no requests.
22 * When "filling in" an event we first copy the empty callback's TCG ops. This
23 * might seem unnecessary, but it is done to support an arbitrary number
24 * of callbacks per event. Take for example a regular instruction callback.
25 * We first generate a callback to an empty helper function. Then, if two
26 * plugins register one callback each for this instruction, we make two copies
27 * of the TCG ops generated for the empty callback, substituting the function
28 * pointer that points to the empty helper function with the plugins' desired
29 * callback functions. After that we remove the empty callback's ops.
31 * Note that the location in TCGOp.args[] of the pointer to a helper function
32 * varies across different guest and host architectures. Instead of duplicating
33 * the logic that figures this out, we rely on the fact that the empty
34 * callbacks point to empty functions that are unique pointers in the program.
35 * Thus, to find the right location we just have to look for a match in
36 * TCGOp.args[]. This is the main reason why we first copy an empty callback's
37 * TCG ops and then fill them in; regardless of whether we have one or many
38 * callbacks for that event, the logic to add all of them is the same.
40 * When generating more than one callback per event, we make a small
41 * optimization to avoid generating redundant operations. For instance, for the
42 * second and all subsequent callbacks of an event, we do not need to reload the
43 * CPU's index into a TCG temp, since the first callback did it already.
45 #include "qemu/osdep.h"
46 #include "tcg/tcg.h"
47 #include "tcg/tcg-temp-internal.h"
48 #include "tcg/tcg-op.h"
49 #include "exec/exec-all.h"
50 #include "exec/plugin-gen.h"
51 #include "exec/translator.h"
53 #ifdef CONFIG_SOFTMMU
54 # define CONFIG_SOFTMMU_GATE 1
55 #else
56 # define CONFIG_SOFTMMU_GATE 0
57 #endif
60 * plugin_cb_start TCG op args[]:
61 * 0: enum plugin_gen_from
62 * 1: enum plugin_gen_cb
63 * 2: set to 1 for mem callback that is a write, 0 otherwise.
66 enum plugin_gen_from {
67 PLUGIN_GEN_FROM_TB,
68 PLUGIN_GEN_FROM_INSN,
69 PLUGIN_GEN_FROM_MEM,
70 PLUGIN_GEN_AFTER_INSN,
71 PLUGIN_GEN_N_FROMS,
74 enum plugin_gen_cb {
75 PLUGIN_GEN_CB_UDATA,
76 PLUGIN_GEN_CB_INLINE,
77 PLUGIN_GEN_CB_MEM,
78 PLUGIN_GEN_ENABLE_MEM_HELPER,
79 PLUGIN_GEN_DISABLE_MEM_HELPER,
80 PLUGIN_GEN_N_CBS,
84 * These helpers are stubs that get dynamically switched out for calls
85 * direct to the plugin if they are subscribed to.
87 void HELPER(plugin_vcpu_udata_cb)(uint32_t cpu_index, void *udata)
88 { }
90 void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
91 qemu_plugin_meminfo_t info, uint64_t vaddr,
92 void *userdata)
93 { }
95 static void do_gen_mem_cb(TCGv vaddr, uint32_t info)
97 TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
98 TCGv_i32 meminfo = tcg_temp_ebb_new_i32();
99 TCGv_i64 vaddr64 = tcg_temp_ebb_new_i64();
100 TCGv_ptr udata = tcg_temp_ebb_new_ptr();
102 tcg_gen_movi_i32(meminfo, info);
103 tcg_gen_movi_ptr(udata, 0);
104 tcg_gen_ld_i32(cpu_index, cpu_env,
105 -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
106 tcg_gen_extu_tl_i64(vaddr64, vaddr);
108 gen_helper_plugin_vcpu_mem_cb(cpu_index, meminfo, vaddr64, udata);
110 tcg_temp_free_ptr(udata);
111 tcg_temp_free_i64(vaddr64);
112 tcg_temp_free_i32(meminfo);
113 tcg_temp_free_i32(cpu_index);
116 static void gen_empty_udata_cb(void)
118 TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();
119 TCGv_ptr udata = tcg_temp_ebb_new_ptr();
121 tcg_gen_movi_ptr(udata, 0);
122 tcg_gen_ld_i32(cpu_index, cpu_env,
123 -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
124 gen_helper_plugin_vcpu_udata_cb(cpu_index, udata);
126 tcg_temp_free_ptr(udata);
127 tcg_temp_free_i32(cpu_index);
131 * For now we only support addi_i64.
132 * When we support more ops, we can generate one empty inline cb for each.
134 static void gen_empty_inline_cb(void)
136 TCGv_i64 val = tcg_temp_ebb_new_i64();
137 TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
139 tcg_gen_movi_ptr(ptr, 0);
140 tcg_gen_ld_i64(val, ptr, 0);
141 /* pass an immediate != 0 so that it doesn't get optimized away */
142 tcg_gen_addi_i64(val, val, 0xdeadface);
143 tcg_gen_st_i64(val, ptr, 0);
144 tcg_temp_free_ptr(ptr);
145 tcg_temp_free_i64(val);
148 static void gen_empty_mem_cb(TCGv addr, uint32_t info)
150 do_gen_mem_cb(addr, info);
154 * Share the same function for enable/disable. When enabling, the NULL
155 * pointer will be overwritten later.
157 static void gen_empty_mem_helper(void)
159 TCGv_ptr ptr = tcg_temp_ebb_new_ptr();
161 tcg_gen_movi_ptr(ptr, 0);
162 tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) -
163 offsetof(ArchCPU, env));
164 tcg_temp_free_ptr(ptr);
167 static void gen_plugin_cb_start(enum plugin_gen_from from,
168 enum plugin_gen_cb type, unsigned wr)
170 tcg_gen_plugin_cb_start(from, type, wr);
173 static void gen_wrapped(enum plugin_gen_from from,
174 enum plugin_gen_cb type, void (*func)(void))
176 gen_plugin_cb_start(from, type, 0);
177 func();
178 tcg_gen_plugin_cb_end();
181 static void plugin_gen_empty_callback(enum plugin_gen_from from)
183 switch (from) {
184 case PLUGIN_GEN_AFTER_INSN:
185 gen_wrapped(from, PLUGIN_GEN_DISABLE_MEM_HELPER,
186 gen_empty_mem_helper);
187 break;
188 case PLUGIN_GEN_FROM_INSN:
190 * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
191 * the first callback of an instruction
193 gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
194 gen_empty_mem_helper);
195 /* fall through */
196 case PLUGIN_GEN_FROM_TB:
197 gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb);
198 gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
199 break;
200 default:
201 g_assert_not_reached();
205 union mem_gen_fn {
206 void (*mem_fn)(TCGv, uint32_t);
207 void (*inline_fn)(void);
210 static void gen_mem_wrapped(enum plugin_gen_cb type,
211 const union mem_gen_fn *f, TCGv addr,
212 uint32_t info, bool is_mem)
214 enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info);
216 gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, type, rw);
217 if (is_mem) {
218 f->mem_fn(addr, info);
219 } else {
220 f->inline_fn();
222 tcg_gen_plugin_cb_end();
225 void plugin_gen_empty_mem_callback(TCGv addr, uint32_t info)
227 union mem_gen_fn fn;
229 fn.mem_fn = gen_empty_mem_cb;
230 gen_mem_wrapped(PLUGIN_GEN_CB_MEM, &fn, addr, info, true);
232 fn.inline_fn = gen_empty_inline_cb;
233 gen_mem_wrapped(PLUGIN_GEN_CB_INLINE, &fn, 0, info, false);
236 static TCGOp *find_op(TCGOp *op, TCGOpcode opc)
238 while (op) {
239 if (op->opc == opc) {
240 return op;
242 op = QTAILQ_NEXT(op, link);
244 return NULL;
247 static TCGOp *rm_ops_range(TCGOp *begin, TCGOp *end)
249 TCGOp *ret = QTAILQ_NEXT(end, link);
251 QTAILQ_REMOVE_SEVERAL(&tcg_ctx->ops, begin, end, link);
252 return ret;
255 /* remove all ops until (and including) plugin_cb_end */
256 static TCGOp *rm_ops(TCGOp *op)
258 TCGOp *end_op = find_op(op, INDEX_op_plugin_cb_end);
260 tcg_debug_assert(end_op);
261 return rm_ops_range(op, end_op);
264 static TCGOp *copy_op_nocheck(TCGOp **begin_op, TCGOp *op)
266 TCGOp *old_op = QTAILQ_NEXT(*begin_op, link);
267 unsigned nargs = old_op->nargs;
269 *begin_op = old_op;
270 op = tcg_op_insert_after(tcg_ctx, op, old_op->opc, nargs);
271 memcpy(op->args, old_op->args, sizeof(op->args[0]) * nargs);
273 return op;
276 static TCGOp *copy_op(TCGOp **begin_op, TCGOp *op, TCGOpcode opc)
278 op = copy_op_nocheck(begin_op, op);
279 tcg_debug_assert((*begin_op)->opc == opc);
280 return op;
283 static TCGOp *copy_extu_i32_i64(TCGOp **begin_op, TCGOp *op)
285 if (TCG_TARGET_REG_BITS == 32) {
286 /* mov_i32 */
287 op = copy_op(begin_op, op, INDEX_op_mov_i32);
288 /* mov_i32 w/ $0 */
289 op = copy_op(begin_op, op, INDEX_op_mov_i32);
290 } else {
291 /* extu_i32_i64 */
292 op = copy_op(begin_op, op, INDEX_op_extu_i32_i64);
294 return op;
297 static TCGOp *copy_mov_i64(TCGOp **begin_op, TCGOp *op)
299 if (TCG_TARGET_REG_BITS == 32) {
300 /* 2x mov_i32 */
301 op = copy_op(begin_op, op, INDEX_op_mov_i32);
302 op = copy_op(begin_op, op, INDEX_op_mov_i32);
303 } else {
304 /* mov_i64 */
305 op = copy_op(begin_op, op, INDEX_op_mov_i64);
307 return op;
310 static TCGOp *copy_const_ptr(TCGOp **begin_op, TCGOp *op, void *ptr)
312 if (UINTPTR_MAX == UINT32_MAX) {
313 /* mov_i32 */
314 op = copy_op(begin_op, op, INDEX_op_mov_i32);
315 op->args[1] = tcgv_i32_arg(tcg_constant_i32((uintptr_t)ptr));
316 } else {
317 /* mov_i64 */
318 op = copy_op(begin_op, op, INDEX_op_mov_i64);
319 op->args[1] = tcgv_i64_arg(tcg_constant_i64((uintptr_t)ptr));
321 return op;
324 static TCGOp *copy_extu_tl_i64(TCGOp **begin_op, TCGOp *op)
326 if (TARGET_LONG_BITS == 32) {
327 /* extu_i32_i64 */
328 op = copy_extu_i32_i64(begin_op, op);
329 } else {
330 /* mov_i64 */
331 op = copy_mov_i64(begin_op, op);
333 return op;
336 static TCGOp *copy_ld_i64(TCGOp **begin_op, TCGOp *op)
338 if (TCG_TARGET_REG_BITS == 32) {
339 /* 2x ld_i32 */
340 op = copy_op(begin_op, op, INDEX_op_ld_i32);
341 op = copy_op(begin_op, op, INDEX_op_ld_i32);
342 } else {
343 /* ld_i64 */
344 op = copy_op(begin_op, op, INDEX_op_ld_i64);
346 return op;
349 static TCGOp *copy_st_i64(TCGOp **begin_op, TCGOp *op)
351 if (TCG_TARGET_REG_BITS == 32) {
352 /* 2x st_i32 */
353 op = copy_op(begin_op, op, INDEX_op_st_i32);
354 op = copy_op(begin_op, op, INDEX_op_st_i32);
355 } else {
356 /* st_i64 */
357 op = copy_op(begin_op, op, INDEX_op_st_i64);
359 return op;
362 static TCGOp *copy_add_i64(TCGOp **begin_op, TCGOp *op, uint64_t v)
364 if (TCG_TARGET_REG_BITS == 32) {
365 /* all 32-bit backends must implement add2_i32 */
366 g_assert(TCG_TARGET_HAS_add2_i32);
367 op = copy_op(begin_op, op, INDEX_op_add2_i32);
368 op->args[4] = tcgv_i32_arg(tcg_constant_i32(v));
369 op->args[5] = tcgv_i32_arg(tcg_constant_i32(v >> 32));
370 } else {
371 op = copy_op(begin_op, op, INDEX_op_add_i64);
372 op->args[2] = tcgv_i64_arg(tcg_constant_i64(v));
374 return op;
377 static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
379 if (UINTPTR_MAX == UINT32_MAX) {
380 /* st_i32 */
381 op = copy_op(begin_op, op, INDEX_op_st_i32);
382 } else {
383 /* st_i64 */
384 op = copy_st_i64(begin_op, op);
386 return op;
389 static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
390 void *func, int *cb_idx)
392 TCGOp *old_op;
393 int func_idx;
395 /* copy all ops until the call */
396 do {
397 op = copy_op_nocheck(begin_op, op);
398 } while (op->opc != INDEX_op_call);
400 /* fill in the op call */
401 old_op = *begin_op;
402 TCGOP_CALLI(op) = TCGOP_CALLI(old_op);
403 TCGOP_CALLO(op) = TCGOP_CALLO(old_op);
404 tcg_debug_assert(op->life == 0);
406 func_idx = TCGOP_CALLO(op) + TCGOP_CALLI(op);
407 *cb_idx = func_idx;
408 op->args[func_idx] = (uintptr_t)func;
410 return op;
414 * When we append/replace ops here we are sensitive to changing patterns of
415 * TCGOps generated by the tcg_gen_FOO calls when we generated the
416 * empty callbacks. This will assert very quickly in a debug build as
417 * we assert the ops we are replacing are the correct ones.
419 static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
420 TCGOp *begin_op, TCGOp *op, int *cb_idx)
422 /* const_ptr */
423 op = copy_const_ptr(&begin_op, op, cb->userp);
425 /* copy the ld_i32, but note that we only have to copy it once */
426 if (*cb_idx == -1) {
427 op = copy_op(&begin_op, op, INDEX_op_ld_i32);
428 } else {
429 begin_op = QTAILQ_NEXT(begin_op, link);
430 tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
433 /* call */
434 op = copy_call(&begin_op, op, HELPER(plugin_vcpu_udata_cb),
435 cb->f.vcpu_udata, cb_idx);
437 return op;
440 static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
441 TCGOp *begin_op, TCGOp *op,
442 int *unused)
444 /* const_ptr */
445 op = copy_const_ptr(&begin_op, op, cb->userp);
447 /* ld_i64 */
448 op = copy_ld_i64(&begin_op, op);
450 /* add_i64 */
451 op = copy_add_i64(&begin_op, op, cb->inline_insn.imm);
453 /* st_i64 */
454 op = copy_st_i64(&begin_op, op);
456 return op;
459 static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
460 TCGOp *begin_op, TCGOp *op, int *cb_idx)
462 enum plugin_gen_cb type = begin_op->args[1];
464 tcg_debug_assert(type == PLUGIN_GEN_CB_MEM);
466 /* const_i32 == mov_i32 ("info", so it remains as is) */
467 op = copy_op(&begin_op, op, INDEX_op_mov_i32);
469 /* const_ptr */
470 op = copy_const_ptr(&begin_op, op, cb->userp);
472 /* copy the ld_i32, but note that we only have to copy it once */
473 if (*cb_idx == -1) {
474 op = copy_op(&begin_op, op, INDEX_op_ld_i32);
475 } else {
476 begin_op = QTAILQ_NEXT(begin_op, link);
477 tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
480 /* extu_tl_i64 */
481 op = copy_extu_tl_i64(&begin_op, op);
483 if (type == PLUGIN_GEN_CB_MEM) {
484 /* call */
485 op = copy_call(&begin_op, op, HELPER(plugin_vcpu_mem_cb),
486 cb->f.vcpu_udata, cb_idx);
489 return op;
492 typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
493 TCGOp *begin_op, TCGOp *op, int *intp);
494 typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
496 static bool op_ok(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
498 return true;
501 static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
503 int w;
505 w = op->args[2];
506 return !!(cb->rw & (w + 1));
509 static void inject_cb_type(const GArray *cbs, TCGOp *begin_op,
510 inject_fn inject, op_ok_fn ok)
512 TCGOp *end_op;
513 TCGOp *op;
514 int cb_idx = -1;
515 int i;
517 if (!cbs || cbs->len == 0) {
518 rm_ops(begin_op);
519 return;
522 end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
523 tcg_debug_assert(end_op);
525 op = end_op;
526 for (i = 0; i < cbs->len; i++) {
527 struct qemu_plugin_dyn_cb *cb =
528 &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
530 if (!ok(begin_op, cb)) {
531 continue;
533 op = inject(cb, begin_op, op, &cb_idx);
535 rm_ops_range(begin_op, end_op);
538 static void
539 inject_udata_cb(const GArray *cbs, TCGOp *begin_op)
541 inject_cb_type(cbs, begin_op, append_udata_cb, op_ok);
544 static void
545 inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
547 inject_cb_type(cbs, begin_op, append_inline_cb, ok);
550 static void
551 inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
553 inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
556 /* we could change the ops in place, but we can reuse more code by copying */
557 static void inject_mem_helper(TCGOp *begin_op, GArray *arr)
559 TCGOp *orig_op = begin_op;
560 TCGOp *end_op;
561 TCGOp *op;
563 end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
564 tcg_debug_assert(end_op);
566 /* const ptr */
567 op = copy_const_ptr(&begin_op, end_op, arr);
569 /* st_ptr */
570 op = copy_st_ptr(&begin_op, op);
572 rm_ops_range(orig_op, end_op);
576 * Tracking memory accesses performed from helpers requires extra work.
577 * If an instruction is emulated with helpers, we do two things:
578 * (1) copy the CB descriptors, and keep track of it so that they can be
579 * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
580 * that we can read them at run-time (i.e. when the helper executes).
581 * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
583 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
584 * is possible that the code we generate after the instruction is
585 * dead, we also add checks before generating tb_exit etc.
587 static void inject_mem_enable_helper(struct qemu_plugin_tb *ptb,
588 struct qemu_plugin_insn *plugin_insn,
589 TCGOp *begin_op)
591 GArray *cbs[2];
592 GArray *arr;
593 size_t n_cbs, i;
595 cbs[0] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
596 cbs[1] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
598 n_cbs = 0;
599 for (i = 0; i < ARRAY_SIZE(cbs); i++) {
600 n_cbs += cbs[i]->len;
603 plugin_insn->mem_helper = plugin_insn->calls_helpers && n_cbs;
604 if (likely(!plugin_insn->mem_helper)) {
605 rm_ops(begin_op);
606 return;
608 ptb->mem_helper = true;
610 arr = g_array_sized_new(false, false,
611 sizeof(struct qemu_plugin_dyn_cb), n_cbs);
613 for (i = 0; i < ARRAY_SIZE(cbs); i++) {
614 g_array_append_vals(arr, cbs[i]->data, cbs[i]->len);
617 qemu_plugin_add_dyn_cb_arr(arr);
618 inject_mem_helper(begin_op, arr);
621 static void inject_mem_disable_helper(struct qemu_plugin_insn *plugin_insn,
622 TCGOp *begin_op)
624 if (likely(!plugin_insn->mem_helper)) {
625 rm_ops(begin_op);
626 return;
628 inject_mem_helper(begin_op, NULL);
631 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
632 void plugin_gen_disable_mem_helpers(void)
635 * We could emit the clearing unconditionally and be done. However, this can
636 * be wasteful if for instance plugins don't track memory accesses, or if
637 * most TBs don't use helpers. Instead, emit the clearing iff the TB calls
638 * helpers that might access guest memory.
640 * Note: we do not reset plugin_tb->mem_helper here; a TB might have several
641 * exit points, and we want to emit the clearing from all of them.
643 if (!tcg_ctx->plugin_tb->mem_helper) {
644 return;
646 tcg_gen_st_ptr(tcg_constant_ptr(NULL), cpu_env,
647 offsetof(CPUState, plugin_mem_cbs) - offsetof(ArchCPU, env));
650 static void plugin_gen_tb_udata(const struct qemu_plugin_tb *ptb,
651 TCGOp *begin_op)
653 inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR], begin_op);
656 static void plugin_gen_tb_inline(const struct qemu_plugin_tb *ptb,
657 TCGOp *begin_op)
659 inject_inline_cb(ptb->cbs[PLUGIN_CB_INLINE], begin_op, op_ok);
662 static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
663 TCGOp *begin_op, int insn_idx)
665 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
667 inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], begin_op);
670 static void plugin_gen_insn_inline(const struct qemu_plugin_tb *ptb,
671 TCGOp *begin_op, int insn_idx)
673 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
674 inject_inline_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE],
675 begin_op, op_ok);
678 static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
679 TCGOp *begin_op, int insn_idx)
681 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
682 inject_mem_cb(insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], begin_op);
685 static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
686 TCGOp *begin_op, int insn_idx)
688 const GArray *cbs;
689 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
691 cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
692 inject_inline_cb(cbs, begin_op, op_rw);
695 static void plugin_gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
696 TCGOp *begin_op, int insn_idx)
698 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
699 inject_mem_enable_helper(ptb, insn, begin_op);
702 static void plugin_gen_disable_mem_helper(struct qemu_plugin_tb *ptb,
703 TCGOp *begin_op, int insn_idx)
705 struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
706 inject_mem_disable_helper(insn, begin_op);
709 /* #define DEBUG_PLUGIN_GEN_OPS */
710 static void pr_ops(void)
712 #ifdef DEBUG_PLUGIN_GEN_OPS
713 TCGOp *op;
714 int i = 0;
716 QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
717 const char *name = "";
718 const char *type = "";
720 if (op->opc == INDEX_op_plugin_cb_start) {
721 switch (op->args[0]) {
722 case PLUGIN_GEN_FROM_TB:
723 name = "tb";
724 break;
725 case PLUGIN_GEN_FROM_INSN:
726 name = "insn";
727 break;
728 case PLUGIN_GEN_FROM_MEM:
729 name = "mem";
730 break;
731 case PLUGIN_GEN_AFTER_INSN:
732 name = "after insn";
733 break;
734 default:
735 break;
737 switch (op->args[1]) {
738 case PLUGIN_GEN_CB_UDATA:
739 type = "udata";
740 break;
741 case PLUGIN_GEN_CB_INLINE:
742 type = "inline";
743 break;
744 case PLUGIN_GEN_CB_MEM:
745 type = "mem";
746 break;
747 case PLUGIN_GEN_ENABLE_MEM_HELPER:
748 type = "enable mem helper";
749 break;
750 case PLUGIN_GEN_DISABLE_MEM_HELPER:
751 type = "disable mem helper";
752 break;
753 default:
754 break;
757 printf("op[%2i]: %s %s %s\n", i, tcg_op_defs[op->opc].name, name, type);
758 i++;
760 #endif
763 static void plugin_gen_inject(struct qemu_plugin_tb *plugin_tb)
765 TCGOp *op;
766 int insn_idx = -1;
768 pr_ops();
770 QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
771 switch (op->opc) {
772 case INDEX_op_insn_start:
773 insn_idx++;
774 break;
775 case INDEX_op_plugin_cb_start:
777 enum plugin_gen_from from = op->args[0];
778 enum plugin_gen_cb type = op->args[1];
780 switch (from) {
781 case PLUGIN_GEN_FROM_TB:
783 g_assert(insn_idx == -1);
785 switch (type) {
786 case PLUGIN_GEN_CB_UDATA:
787 plugin_gen_tb_udata(plugin_tb, op);
788 break;
789 case PLUGIN_GEN_CB_INLINE:
790 plugin_gen_tb_inline(plugin_tb, op);
791 break;
792 default:
793 g_assert_not_reached();
795 break;
797 case PLUGIN_GEN_FROM_INSN:
799 g_assert(insn_idx >= 0);
801 switch (type) {
802 case PLUGIN_GEN_CB_UDATA:
803 plugin_gen_insn_udata(plugin_tb, op, insn_idx);
804 break;
805 case PLUGIN_GEN_CB_INLINE:
806 plugin_gen_insn_inline(plugin_tb, op, insn_idx);
807 break;
808 case PLUGIN_GEN_ENABLE_MEM_HELPER:
809 plugin_gen_enable_mem_helper(plugin_tb, op, insn_idx);
810 break;
811 default:
812 g_assert_not_reached();
814 break;
816 case PLUGIN_GEN_FROM_MEM:
818 g_assert(insn_idx >= 0);
820 switch (type) {
821 case PLUGIN_GEN_CB_MEM:
822 plugin_gen_mem_regular(plugin_tb, op, insn_idx);
823 break;
824 case PLUGIN_GEN_CB_INLINE:
825 plugin_gen_mem_inline(plugin_tb, op, insn_idx);
826 break;
827 default:
828 g_assert_not_reached();
831 break;
833 case PLUGIN_GEN_AFTER_INSN:
835 g_assert(insn_idx >= 0);
837 switch (type) {
838 case PLUGIN_GEN_DISABLE_MEM_HELPER:
839 plugin_gen_disable_mem_helper(plugin_tb, op, insn_idx);
840 break;
841 default:
842 g_assert_not_reached();
844 break;
846 default:
847 g_assert_not_reached();
849 break;
851 default:
852 /* plugins don't care about any other ops */
853 break;
856 pr_ops();
859 bool plugin_gen_tb_start(CPUState *cpu, const DisasContextBase *db,
860 bool mem_only)
862 bool ret = false;
864 if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_mask)) {
865 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
866 int i;
868 /* reset callbacks */
869 for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
870 if (ptb->cbs[i]) {
871 g_array_set_size(ptb->cbs[i], 0);
874 ptb->n = 0;
876 ret = true;
878 ptb->vaddr = db->pc_first;
879 ptb->vaddr2 = -1;
880 ptb->haddr1 = db->host_addr[0];
881 ptb->haddr2 = NULL;
882 ptb->mem_only = mem_only;
883 ptb->mem_helper = false;
885 plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB);
888 tcg_ctx->plugin_insn = NULL;
890 return ret;
893 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
895 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
896 struct qemu_plugin_insn *pinsn;
898 pinsn = qemu_plugin_tb_insn_get(ptb, db->pc_next);
899 tcg_ctx->plugin_insn = pinsn;
900 plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
903 * Detect page crossing to get the new host address.
904 * Note that we skip this when haddr1 == NULL, e.g. when we're
905 * fetching instructions from a region not backed by RAM.
907 if (ptb->haddr1 == NULL) {
908 pinsn->haddr = NULL;
909 } else if (is_same_page(db, db->pc_next)) {
910 pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
911 } else {
912 if (ptb->vaddr2 == -1) {
913 ptb->vaddr2 = TARGET_PAGE_ALIGN(db->pc_first);
914 get_page_addr_code_hostp(cpu->env_ptr, ptb->vaddr2, &ptb->haddr2);
916 pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
920 void plugin_gen_insn_end(void)
922 plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN);
926 * There are cases where we never get to finalise a translation - for
927 * example a page fault during translation. As a result we shouldn't
928 * do any clean-up here and make sure things are reset in
929 * plugin_gen_tb_start.
931 void plugin_gen_tb_end(CPUState *cpu)
933 struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
935 /* collect instrumentation requests */
936 qemu_plugin_tb_trans_cb(cpu, ptb);
938 /* inject the instrumentation at the appropriate places */
939 plugin_gen_inject(ptb);