[PATCH v2 0/7] plugins: access values during a memory read/write

[PATCH v2 0/7] plugins: access values during a memory read/write

[Pierrick Bouvier]

This series allows plugins to know which value is read/written during a memory
access.

For every memory access, we know copy this value before calling mem callbacks,
and those can query it using new API functions:
- qemu_plugin_mem_get_value_upper_bits
- qemu_plugin_mem_get_value_lower_bits

Mem plugin was extended to print accesses, and a new test was added to check
functionality work as expected. A bug was found where callbacks were not
called as expected.

This will open new use cases for plugins, such as following specific values in
memory.

v2
--

fix compilation on aarch64 (missing undef in accel/tcg/atomic_template.h)

Pierrick Bouvier (7):
  plugins: fix mem callback array size
  plugins: save value during memory accesses
  plugins: extend API to get latest memory value accessed
  tests/tcg: add mechanism to run specific tests with plugins
  tests/tcg: allow to check output of plugins
  tests/plugin/mem: add option to print memory accesses
  tests/tcg/x86_64: add test for plugin memory access

 accel/tcg/atomic_template.h                 | 66 +++++++++++++--
 include/qemu/plugin.h                       |  8 ++
 include/qemu/qemu-plugin.h                  | 20 +++++
 accel/tcg/plugin-gen.c                      |  3 +-
 plugins/api.c                               | 21 +++++
 plugins/core.c                              |  7 ++
 tcg/tcg-op-ldst.c                           | 72 +++++++++++++++--
 tests/plugin/mem.c                          | 28 ++++++-
 tests/tcg/x86_64/test-plugin-mem-access.c   | 89 +++++++++++++++++++++
 accel/tcg/atomic_common.c.inc               | 13 ++-
 accel/tcg/ldst_common.c.inc                 | 38 +++++----
 plugins/qemu-plugins.symbols                |  2 +
 tests/tcg/Makefile.target                   |  8 +-
 tests/tcg/x86_64/Makefile.target            |  7 ++
 tests/tcg/x86_64/check-plugin-mem-access.sh | 48 +++++++++++
 15 files changed, 395 insertions(+), 35 deletions(-)
 create mode 100644 tests/tcg/x86_64/test-plugin-mem-access.c
 create mode 100755 tests/tcg/x86_64/check-plugin-mem-access.sh

-- 
2.39.2

[PATCH v2 1/7] plugins: fix mem callback array size

[Pierrick Bouvier]

data was correctly copied, but size of array was not set
(g_array_sized_new only reserves memory, but does not set size).

As a result, callbacks were not called for code path relying on
plugin_register_vcpu_mem_cb().

Found when trying to trigger mem access callbacks for atomic
instructions.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 accel/tcg/plugin-gen.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index b6bae32b997..ec89a085b43 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -85,8 +85,7 @@ static void gen_enable_mem_helper(struct qemu_plugin_tb *ptb,
     len = insn->mem_cbs->len;
     arr = g_array_sized_new(false, false,
                             sizeof(struct qemu_plugin_dyn_cb), len);
-    memcpy(arr->data, insn->mem_cbs->data,
-           len * sizeof(struct qemu_plugin_dyn_cb));
+    g_array_append_vals(arr, insn->mem_cbs->data, len);
     qemu_plugin_add_dyn_cb_arr(arr);
 
     tcg_gen_st_ptr(tcg_constant_ptr((intptr_t)arr), tcg_env,
-- 
2.39.2

[PATCH v2 2/7] plugins: save value during memory accesses

[Pierrick Bouvier]

Different code paths handle memory accesses:
- tcg generated code
- load/store helpers
- atomic helpers

This value is saved in cpu->plugin_state.

Atomic operations are doing read/write at the same time, so we generate
two memory callbacks instead of one, to allow plugins to access distinct
values.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 accel/tcg/atomic_template.h   | 66 ++++++++++++++++++++++++++++----
 include/qemu/plugin.h         |  8 ++++
 plugins/core.c                |  7 ++++
 tcg/tcg-op-ldst.c             | 72 +++++++++++++++++++++++++++++++----
 accel/tcg/atomic_common.c.inc | 13 ++++++-
 accel/tcg/ldst_common.c.inc   | 38 +++++++++++-------
 6 files changed, 173 insertions(+), 31 deletions(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index 1dc2151dafd..830e4f16069 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -53,6 +53,14 @@
 # error unsupported data size
 #endif
 
+#if DATA_SIZE == 16
+# define UPPER_MEMORY_VALUE(val) int128_gethi(val)
+# define LOWER_MEMORY_VALUE(val) int128_getlo(val)
+#else
+# define UPPER_MEMORY_VALUE(val) 0
+# define LOWER_MEMORY_VALUE(val) val
+#endif
+
 #if DATA_SIZE >= 4
 # define ABI_TYPE  DATA_TYPE
 #else
@@ -83,7 +91,12 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
     ret = qatomic_cmpxchg__nocheck(haddr, cmpv, newv);
 #endif
     ATOMIC_MMU_CLEANUP;
-    atomic_trace_rmw_post(env, addr, oi);
+    atomic_trace_rmw_post(env, addr,
+                          UPPER_MEMORY_VALUE(ret),
+                          LOWER_MEMORY_VALUE(ret),
+                          UPPER_MEMORY_VALUE(newv),
+                          LOWER_MEMORY_VALUE(newv),
+                          oi);
     return ret;
 }
 
@@ -97,7 +110,12 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
 
     ret = qatomic_xchg__nocheck(haddr, val);
     ATOMIC_MMU_CLEANUP;
-    atomic_trace_rmw_post(env, addr, oi);
+    atomic_trace_rmw_post(env, addr,
+                          UPPER_MEMORY_VALUE(ret),
+                          LOWER_MEMORY_VALUE(ret),
+                          UPPER_MEMORY_VALUE(val),
+                          LOWER_MEMORY_VALUE(val),
+                          oi);
     return ret;
 }
 
@@ -109,7 +127,12 @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
     haddr = atomic_mmu_lookup(env_cpu(env), addr, oi, DATA_SIZE, retaddr);   \
     ret = qatomic_##X(haddr, val);                                  \
     ATOMIC_MMU_CLEANUP;                                             \
-    atomic_trace_rmw_post(env, addr, oi);                           \
+    atomic_trace_rmw_post(env, addr,                                \
+                          UPPER_MEMORY_VALUE(ret),                  \
+                          LOWER_MEMORY_VALUE(ret),                  \
+                          UPPER_MEMORY_VALUE(val),                  \
+                          LOWER_MEMORY_VALUE(val),                  \
+                          oi);                                      \
     return ret;                                                     \
 }
 
@@ -145,7 +168,12 @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
         cmp = qatomic_cmpxchg__nocheck(haddr, old, new);            \
     } while (cmp != old);                                           \
     ATOMIC_MMU_CLEANUP;                                             \
-    atomic_trace_rmw_post(env, addr, oi);                           \
+    atomic_trace_rmw_post(env, addr,                                \
+                          UPPER_MEMORY_VALUE(old),                  \
+                          LOWER_MEMORY_VALUE(old),                  \
+                          UPPER_MEMORY_VALUE(xval),                 \
+                          LOWER_MEMORY_VALUE(xval),                 \
+                          oi);                                      \
     return RET;                                                     \
 }
 
@@ -188,7 +216,12 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
     ret = qatomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv));
 #endif
     ATOMIC_MMU_CLEANUP;
-    atomic_trace_rmw_post(env, addr, oi);
+    atomic_trace_rmw_post(env, addr,
+                          UPPER_MEMORY_VALUE(ret),
+                          LOWER_MEMORY_VALUE(ret),
+                          UPPER_MEMORY_VALUE(newv),
+                          LOWER_MEMORY_VALUE(newv),
+                          oi);
     return BSWAP(ret);
 }
 
@@ -202,7 +235,12 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
 
     ret = qatomic_xchg__nocheck(haddr, BSWAP(val));
     ATOMIC_MMU_CLEANUP;
-    atomic_trace_rmw_post(env, addr, oi);
+    atomic_trace_rmw_post(env, addr,
+                          UPPER_MEMORY_VALUE(ret),
+                          LOWER_MEMORY_VALUE(ret),
+                          UPPER_MEMORY_VALUE(val),
+                          LOWER_MEMORY_VALUE(val),
+                          oi);
     return BSWAP(ret);
 }
 
@@ -214,7 +252,12 @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
     haddr = atomic_mmu_lookup(env_cpu(env), addr, oi, DATA_SIZE, retaddr);   \
     ret = qatomic_##X(haddr, BSWAP(val));                           \
     ATOMIC_MMU_CLEANUP;                                             \
-    atomic_trace_rmw_post(env, addr, oi);                           \
+    atomic_trace_rmw_post(env, addr,                                \
+                          UPPER_MEMORY_VALUE(ret),                  \
+                          LOWER_MEMORY_VALUE(ret),                  \
+                          UPPER_MEMORY_VALUE(val),                  \
+                          LOWER_MEMORY_VALUE(val),                  \
+                          oi);                                      \
     return BSWAP(ret);                                              \
 }
 
@@ -247,7 +290,12 @@ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
         ldn = qatomic_cmpxchg__nocheck(haddr, ldo, BSWAP(new));     \
     } while (ldo != ldn);                                           \
     ATOMIC_MMU_CLEANUP;                                             \
-    atomic_trace_rmw_post(env, addr, oi);                           \
+    atomic_trace_rmw_post(env, addr,                                \
+                          UPPER_MEMORY_VALUE(old),                  \
+                          LOWER_MEMORY_VALUE(old),                  \
+                          UPPER_MEMORY_VALUE(xval),                 \
+                          LOWER_MEMORY_VALUE(xval),                 \
+                          oi);                                      \
     return RET;                                                     \
 }
 
@@ -281,3 +329,5 @@ GEN_ATOMIC_HELPER_FN(add_fetch, ADD, DATA_TYPE, new)
 #undef SUFFIX
 #undef DATA_SIZE
 #undef SHIFT
+#undef UPPER_MEMORY_VALUE
+#undef LOWER_MEMORY_VALUE
diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index bc5aef979e7..112dcdad717 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -142,9 +142,13 @@ struct qemu_plugin_tb {
 /**
  * struct CPUPluginState - per-CPU state for plugins
  * @event_mask: plugin event bitmap. Modified only via async work.
+ * @mem_value_upper_bits: 64 upper bits of latest accessed mem value.
+ * @mem_value_lower_bits: 64 lower bits of latest accessed mem value.
  */
 struct CPUPluginState {
     DECLARE_BITMAP(event_mask, QEMU_PLUGIN_EV_MAX);
+    uint64_t mem_value_upper_bits;
+    uint64_t mem_value_lower_bits;
 };
 
 /**
@@ -164,6 +168,8 @@ qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1,
 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret);
 
 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
+                             uint64_t value_upper_bits,
+                             uint64_t value_lower_bits,
                              MemOpIdx oi, enum qemu_plugin_mem_rw rw);
 
 void qemu_plugin_flush_cb(void);
@@ -248,6 +254,8 @@ void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
 { }
 
 static inline void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
+                                           uint64_t value_upper_bits,
+                                           uint64_t value_lower_bits,
                                            MemOpIdx oi,
                                            enum qemu_plugin_mem_rw rw)
 { }
diff --git a/plugins/core.c b/plugins/core.c
index 9d737d82787..957a3efb06d 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -575,14 +575,21 @@ void exec_inline_op(enum plugin_dyn_cb_type type,
 }
 
 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
+                             uint64_t value_upper_bits,
+                             uint64_t value_lower_bits,
                              MemOpIdx oi, enum qemu_plugin_mem_rw rw)
 {
     GArray *arr = cpu->neg.plugin_mem_cbs;
+    CPUPluginState *plugin_state = cpu->plugin_state;
     size_t i;
 
     if (arr == NULL) {
         return;
     }
+
+    plugin_state->mem_value_upper_bits = value_upper_bits;
+    plugin_state->mem_value_lower_bits = value_lower_bits;
+
     for (i = 0; i < arr->len; i++) {
         struct qemu_plugin_dyn_cb *cb =
             &g_array_index(arr, struct qemu_plugin_dyn_cb, i);
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 85101602581..93b338704dc 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -148,14 +148,24 @@ static TCGv_i64 plugin_maybe_preserve_addr(TCGTemp *addr)
     return NULL;
 }
 
+#ifdef CONFIG_PLUGIN
 static void
-plugin_gen_mem_callbacks(TCGv_i64 copy_addr, TCGTemp *orig_addr, MemOpIdx oi,
+plugin_gen_mem_callbacks(TCGv_i64 value_upper_bits, TCGv_i64 value_lower_bits,
+                         TCGv_i64 copy_addr, TCGTemp *orig_addr, MemOpIdx oi,
                          enum qemu_plugin_mem_rw rw)
 {
-#ifdef CONFIG_PLUGIN
     if (tcg_ctx->plugin_insn != NULL) {
         qemu_plugin_meminfo_t info = make_plugin_meminfo(oi, rw);
 
+        TCGv_ptr plugin_state = tcg_temp_ebb_new_ptr();
+        tcg_gen_ld_ptr(plugin_state, tcg_env,
+                       offsetof(CPUState, plugin_state) - sizeof(CPUState));
+        tcg_gen_st_i64(value_upper_bits, plugin_state,
+                       offsetof(CPUPluginState, mem_value_upper_bits));
+        tcg_gen_st_i64(value_lower_bits, plugin_state,
+                       offsetof(CPUPluginState, mem_value_lower_bits));
+        tcg_temp_free_ptr(plugin_state);
+
         if (tcg_ctx->addr_type == TCG_TYPE_I32) {
             if (!copy_addr) {
                 copy_addr = tcg_temp_ebb_new_i64();
@@ -172,6 +182,48 @@ plugin_gen_mem_callbacks(TCGv_i64 copy_addr, TCGTemp *orig_addr, MemOpIdx oi,
             }
         }
     }
+}
+#endif
+
+static void
+plugin_gen_mem_callbacks_i32(TCGv_i32 val,
+                             TCGv_i64 copy_addr, TCGTemp *orig_addr,
+                             MemOpIdx oi, enum qemu_plugin_mem_rw rw)
+{
+#ifdef CONFIG_PLUGIN
+    if (tcg_ctx->plugin_insn != NULL) {
+        TCGv_i64 ext_val = tcg_temp_ebb_new_i64();
+        tcg_gen_extu_i32_i64(ext_val, val);
+        plugin_gen_mem_callbacks(tcg_constant_i64(0), ext_val,
+                                 copy_addr, orig_addr, oi, rw);
+        tcg_temp_free_i64(ext_val);
+    }
+#endif
+}
+
+static void
+plugin_gen_mem_callbacks_i64(TCGv_i64 val,
+                             TCGv_i64 copy_addr, TCGTemp *orig_addr,
+                             MemOpIdx oi, enum qemu_plugin_mem_rw rw)
+{
+#ifdef CONFIG_PLUGIN
+    if (tcg_ctx->plugin_insn != NULL) {
+        plugin_gen_mem_callbacks(tcg_constant_i64(0), val,
+                                 copy_addr, orig_addr, oi, rw);
+    }
+#endif
+}
+
+static void
+plugin_gen_mem_callbacks_i128(TCGv_i128 val,
+                             TCGv_i64 copy_addr, TCGTemp *orig_addr,
+                             MemOpIdx oi, enum qemu_plugin_mem_rw rw)
+{
+#ifdef CONFIG_PLUGIN
+    if (tcg_ctx->plugin_insn != NULL) {
+        plugin_gen_mem_callbacks(TCGV128_HIGH(val), TCGV128_LOW(val),
+                                 copy_addr, orig_addr, oi, rw);
+    }
 #endif
 }
 
@@ -203,7 +255,8 @@ static void tcg_gen_qemu_ld_i32_int(TCGv_i32 val, TCGTemp *addr,
         opc = INDEX_op_qemu_ld_a64_i32;
     }
     gen_ldst(opc, tcgv_i32_temp(val), NULL, addr, oi);
-    plugin_gen_mem_callbacks(copy_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R);
+    plugin_gen_mem_callbacks_i32(val, copy_addr, addr, orig_oi,
+                                 QEMU_PLUGIN_MEM_R);
 
     if ((orig_memop ^ memop) & MO_BSWAP) {
         switch (orig_memop & MO_SIZE) {
@@ -271,7 +324,7 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
         }
     }
     gen_ldst(opc, tcgv_i32_temp(val), NULL, addr, oi);
-    plugin_gen_mem_callbacks(NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
+    plugin_gen_mem_callbacks_i32(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
 
     if (swap) {
         tcg_temp_free_i32(swap);
@@ -324,7 +377,8 @@ static void tcg_gen_qemu_ld_i64_int(TCGv_i64 val, TCGTemp *addr,
         opc = INDEX_op_qemu_ld_a64_i64;
     }
     gen_ldst_i64(opc, val, addr, oi);
-    plugin_gen_mem_callbacks(copy_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R);
+    plugin_gen_mem_callbacks_i64(val, copy_addr, addr, orig_oi,
+                                 QEMU_PLUGIN_MEM_R);
 
     if ((orig_memop ^ memop) & MO_BSWAP) {
         int flags = (orig_memop & MO_SIGN
@@ -396,7 +450,7 @@ static void tcg_gen_qemu_st_i64_int(TCGv_i64 val, TCGTemp *addr,
         opc = INDEX_op_qemu_st_a64_i64;
     }
     gen_ldst_i64(opc, val, addr, oi);
-    plugin_gen_mem_callbacks(NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
+    plugin_gen_mem_callbacks_i64(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
 
     if (swap) {
         tcg_temp_free_i64(swap);
@@ -606,7 +660,8 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
                            tcg_constant_i32(orig_oi));
     }
 
-    plugin_gen_mem_callbacks(ext_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R);
+    plugin_gen_mem_callbacks_i128(val, ext_addr, addr, orig_oi,
+                                  QEMU_PLUGIN_MEM_R);
 }
 
 void tcg_gen_qemu_ld_i128_chk(TCGv_i128 val, TCGTemp *addr, TCGArg idx,
@@ -722,7 +777,8 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
                            tcg_constant_i32(orig_oi));
     }
 
-    plugin_gen_mem_callbacks(ext_addr, addr, orig_oi, QEMU_PLUGIN_MEM_W);
+    plugin_gen_mem_callbacks_i128(val, ext_addr, addr, orig_oi,
+                                  QEMU_PLUGIN_MEM_W);
 }
 
 void tcg_gen_qemu_st_i128_chk(TCGv_i128 val, TCGTemp *addr, TCGArg idx,
diff --git a/accel/tcg/atomic_common.c.inc b/accel/tcg/atomic_common.c.inc
index 95a5c5ff12d..bed56d25d47 100644
--- a/accel/tcg/atomic_common.c.inc
+++ b/accel/tcg/atomic_common.c.inc
@@ -14,9 +14,20 @@
  */
 
 static void atomic_trace_rmw_post(CPUArchState *env, uint64_t addr,
+                                  uint64_t read_value_upper_bits,
+                                  uint64_t read_value_lower_bits,
+                                  uint64_t write_value_upper_bits,
+                                  uint64_t write_value_lower_bits,
                                   MemOpIdx oi)
 {
-    qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, oi, QEMU_PLUGIN_MEM_RW);
+    if (cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
+        qemu_plugin_vcpu_mem_cb(env_cpu(env), addr,
+                                read_value_upper_bits, read_value_lower_bits,
+                                oi, QEMU_PLUGIN_MEM_R);
+        qemu_plugin_vcpu_mem_cb(env_cpu(env), addr,
+                                write_value_upper_bits, write_value_lower_bits,
+                                oi, QEMU_PLUGIN_MEM_W);
+    }
 }
 
 /*
diff --git a/accel/tcg/ldst_common.c.inc b/accel/tcg/ldst_common.c.inc
index 87ceb954873..f6d5613a358 100644
--- a/accel/tcg/ldst_common.c.inc
+++ b/accel/tcg/ldst_common.c.inc
@@ -123,10 +123,15 @@ void helper_st_i128(CPUArchState *env, uint64_t addr, Int128 val, MemOpIdx oi)
  * Load helpers for cpu_ldst.h
  */
 
-static void plugin_load_cb(CPUArchState *env, abi_ptr addr, MemOpIdx oi)
+static void plugin_load_cb(CPUArchState *env, abi_ptr addr,
+                           uint64_t value_upper_bits,
+                           uint64_t value_lower_bits,
+                           MemOpIdx oi)
 {
     if (cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
-        qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, oi, QEMU_PLUGIN_MEM_R);
+        qemu_plugin_vcpu_mem_cb(env_cpu(env), addr,
+                                value_upper_bits, value_lower_bits,
+                                oi, QEMU_PLUGIN_MEM_R);
     }
 }
 
@@ -136,7 +141,7 @@ uint8_t cpu_ldb_mmu(CPUArchState *env, abi_ptr addr, MemOpIdx oi, uintptr_t ra)
 
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_UB);
     ret = do_ld1_mmu(env_cpu(env), addr, oi, ra, MMU_DATA_LOAD);
-    plugin_load_cb(env, addr, oi);
+    plugin_load_cb(env, addr, 0, ret, oi);
     return ret;
 }
 
@@ -147,7 +152,7 @@ uint16_t cpu_ldw_mmu(CPUArchState *env, abi_ptr addr,
 
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_16);
     ret = do_ld2_mmu(env_cpu(env), addr, oi, ra, MMU_DATA_LOAD);
-    plugin_load_cb(env, addr, oi);
+    plugin_load_cb(env, addr, 0, ret, oi);
     return ret;
 }
 
@@ -158,7 +163,7 @@ uint32_t cpu_ldl_mmu(CPUArchState *env, abi_ptr addr,
 
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_32);
     ret = do_ld4_mmu(env_cpu(env), addr, oi, ra, MMU_DATA_LOAD);
-    plugin_load_cb(env, addr, oi);
+    plugin_load_cb(env, addr, 0, ret, oi);
     return ret;
 }
 
@@ -169,7 +174,7 @@ uint64_t cpu_ldq_mmu(CPUArchState *env, abi_ptr addr,
 
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_64);
     ret = do_ld8_mmu(env_cpu(env), addr, oi, ra, MMU_DATA_LOAD);
-    plugin_load_cb(env, addr, oi);
+    plugin_load_cb(env, addr, 0, ret, oi);
     return ret;
 }
 
@@ -180,7 +185,7 @@ Int128 cpu_ld16_mmu(CPUArchState *env, abi_ptr addr,
 
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_128);
     ret = do_ld16_mmu(env_cpu(env), addr, oi, ra);
-    plugin_load_cb(env, addr, oi);
+    plugin_load_cb(env, addr, int128_gethi(ret), int128_getlo(ret), oi);
     return ret;
 }
 
@@ -188,10 +193,15 @@ Int128 cpu_ld16_mmu(CPUArchState *env, abi_ptr addr,
  * Store helpers for cpu_ldst.h
  */
 
-static void plugin_store_cb(CPUArchState *env, abi_ptr addr, MemOpIdx oi)
+static void plugin_store_cb(CPUArchState *env, abi_ptr addr,
+                            uint64_t value_upper_bits,
+                            uint64_t value_lower_bits,
+                            MemOpIdx oi)
 {
     if (cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
-        qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, oi, QEMU_PLUGIN_MEM_W);
+        qemu_plugin_vcpu_mem_cb(env_cpu(env), addr,
+                                value_upper_bits, value_lower_bits,
+                                oi, QEMU_PLUGIN_MEM_W);
     }
 }
 
@@ -199,7 +209,7 @@ void cpu_stb_mmu(CPUArchState *env, abi_ptr addr, uint8_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     helper_stb_mmu(env, addr, val, oi, retaddr);
-    plugin_store_cb(env, addr, oi);
+    plugin_store_cb(env, addr, 0, val, oi);
 }
 
 void cpu_stw_mmu(CPUArchState *env, abi_ptr addr, uint16_t val,
@@ -207,7 +217,7 @@ void cpu_stw_mmu(CPUArchState *env, abi_ptr addr, uint16_t val,
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_16);
     do_st2_mmu(env_cpu(env), addr, val, oi, retaddr);
-    plugin_store_cb(env, addr, oi);
+    plugin_store_cb(env, addr, 0, val, oi);
 }
 
 void cpu_stl_mmu(CPUArchState *env, abi_ptr addr, uint32_t val,
@@ -215,7 +225,7 @@ void cpu_stl_mmu(CPUArchState *env, abi_ptr addr, uint32_t val,
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_32);
     do_st4_mmu(env_cpu(env), addr, val, oi, retaddr);
-    plugin_store_cb(env, addr, oi);
+    plugin_store_cb(env, addr, 0, val, oi);
 }
 
 void cpu_stq_mmu(CPUArchState *env, abi_ptr addr, uint64_t val,
@@ -223,7 +233,7 @@ void cpu_stq_mmu(CPUArchState *env, abi_ptr addr, uint64_t val,
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_64);
     do_st8_mmu(env_cpu(env), addr, val, oi, retaddr);
-    plugin_store_cb(env, addr, oi);
+    plugin_store_cb(env, addr, 0, val, oi);
 }
 
 void cpu_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
@@ -231,7 +241,7 @@ void cpu_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_128);
     do_st16_mmu(env_cpu(env), addr, val, oi, retaddr);
-    plugin_store_cb(env, addr, oi);
+    plugin_store_cb(env, addr, int128_gethi(val), int128_getlo(val), oi);
 }
 
 /*
-- 
2.39.2

[PATCH v2 3/7] plugins: extend API to get latest memory value accessed

[Pierrick Bouvier]

Two functions are added to plugins API:
- qemu_plugin_mem_get_value_upper_bits
- qemu_plugin_mem_get_value_lower_bits

This value can be accessed only during a memory callback.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 include/qemu/qemu-plugin.h   | 20 ++++++++++++++++++++
 plugins/api.c                | 21 +++++++++++++++++++++
 plugins/qemu-plugins.symbols |  2 ++
 3 files changed, 43 insertions(+)

diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index c71c705b699..5945f256949 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -551,6 +551,26 @@ bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info);
 QEMU_PLUGIN_API
 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info);
 
+/**
+ * qemu_plugin_mem_get_value_lower_bits() - return 64 lower bits of latest
+ * accessed memory value
+ * @info: opaque memory transaction handle
+ *
+ * Returns: lower bits for value accessed
+ */
+QEMU_PLUGIN_API
+uint64_t qemu_plugin_mem_get_value_lower_bits(qemu_plugin_meminfo_t info);
+
+/**
+ * qemu_plugin_mem_get_value_upper_bits() - return 64 upper bits of latest
+ * accessed memory value
+ * @info: opaque memory transaction handle
+ *
+ * Returns: upper bits for value accessed
+ */
+QEMU_PLUGIN_API
+uint64_t qemu_plugin_mem_get_value_upper_bits(qemu_plugin_meminfo_t info);
+
 /**
  * qemu_plugin_get_hwaddr() - return handle for memory operation
  * @info: opaque memory info structure
diff --git a/plugins/api.c b/plugins/api.c
index 2ff13d09de6..89e9f6ba5b4 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -351,6 +351,27 @@ bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info)
     return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W;
 }
 
+uint64_t qemu_plugin_mem_get_value_upper_bits(qemu_plugin_meminfo_t info)
+{
+    return current_cpu->plugin_state->mem_value_upper_bits;
+}
+
+uint64_t qemu_plugin_mem_get_value_lower_bits(qemu_plugin_meminfo_t info)
+{
+    uint64_t value = current_cpu->plugin_state->mem_value_lower_bits;
+    /* tcg values are sign extended, so we must clip them */
+    switch (qemu_plugin_mem_size_shift(info)) {
+    case 0:
+        return value & 0xff;
+    case 1:
+        return value & 0xffff;
+    case 2:
+        return value & 0xffffffff;
+    default:
+        return value;
+    }
+}
+
 /*
  * Virtual Memory queries
  */
diff --git a/plugins/qemu-plugins.symbols b/plugins/qemu-plugins.symbols
index ca773d8d9fe..9f2646fc812 100644
--- a/plugins/qemu-plugins.symbols
+++ b/plugins/qemu-plugins.symbols
@@ -13,6 +13,8 @@
   qemu_plugin_insn_size;
   qemu_plugin_insn_symbol;
   qemu_plugin_insn_vaddr;
+  qemu_plugin_mem_get_value_upper_bits;
+  qemu_plugin_mem_get_value_lower_bits;
   qemu_plugin_mem_is_big_endian;
   qemu_plugin_mem_is_sign_extended;
   qemu_plugin_mem_is_store;
-- 
2.39.2

[PATCH v2 4/7] tests/tcg: add mechanism to run specific tests with plugins

[Pierrick Bouvier]

Only multiarch tests are run with plugins, and we want to be able to run
per-arch test with plugins too.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 tests/tcg/Makefile.target | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index f21be50d3b2..dc5c8b7a3b4 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -152,10 +152,11 @@ PLUGINS=$(patsubst %.c, lib%.so, $(notdir $(wildcard $(PLUGIN_SRC)/*.c)))
 # only expand MULTIARCH_TESTS which are common on most of our targets
 # to avoid an exponential explosion as new tests are added. We also
 # add some special helpers the run-plugin- rules can use below.
+# In more, extra tests can be added using PLUGINS_TESTS variable.
 
 ifneq ($(MULTIARCH_TESTS),)
 $(foreach p,$(PLUGINS), \
-	$(foreach t,$(MULTIARCH_TESTS),\
+	$(foreach t,$(MULTIARCH_TESTS) $(PLUGINS_TESTS),\
 		$(eval run-plugin-$(t)-with-$(p): $t $p) \
 		$(eval RUN_TESTS+=run-plugin-$(t)-with-$(p))))
 endif # MULTIARCH_TESTS
-- 
2.39.2

[PATCH v2 5/7] tests/tcg: allow to check output of plugins

[Pierrick Bouvier]

A specific plugin test can now read and check a plugin output, to ensure
it contains expected values.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 tests/tcg/Makefile.target | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index dc5c8b7a3b4..55993611cae 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -90,6 +90,7 @@ CFLAGS=
 LDFLAGS=
 
 QEMU_OPTS=
+CHECK_PLUGIN_OUTPUT_COMMAND=true
 
 
 # If TCG debugging, or TCI is enabled things are a lot slower
@@ -180,6 +181,8 @@ run-plugin-%:
 		-plugin $(PLUGIN_LIB)/$(call extract-plugin,$@)$(PLUGIN_ARGS) \
 		-d plugin -D $*.pout \
 		 $(call strip-plugin,$<))
+	@$(CHECK_PLUGIN_OUTPUT_COMMAND) $*.pout || echo \
+	$(CHECK_PLUGIN_OUTPUT_COMMAND) $*.pout failed
 else
 run-%: %
 	$(call run-test, $<, \
@@ -194,6 +197,8 @@ run-plugin-%:
 	   	  -plugin $(PLUGIN_LIB)/$(call extract-plugin,$@)$(PLUGIN_ARGS) \
 	    	  -d plugin -D $*.pout \
 		  $(QEMU_OPTS) $(call strip-plugin,$<))
+	@$(CHECK_PLUGIN_OUTPUT_COMMAND) $*.pout || echo \
+	$(CHECK_PLUGIN_OUTPUT_COMMAND) $*.pout failed
 endif
 
 gdb-%: %
-- 
2.39.2

[PATCH v2 6/7] tests/plugin/mem: add option to print memory accesses

[Pierrick Bouvier]

By using "print-accesses=true" option, mem plugin will now print every
value accessed, with associated size, type (store vs load) and symbol
where this happens.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 tests/plugin/mem.c | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/tests/plugin/mem.c b/tests/plugin/mem.c
index b650dddcce1..d897034a044 100644
--- a/tests/plugin/mem.c
+++ b/tests/plugin/mem.c
@@ -24,7 +24,7 @@ typedef struct {
 static struct qemu_plugin_scoreboard *counts;
 static qemu_plugin_u64 mem_count;
 static qemu_plugin_u64 io_count;
-static bool do_inline, do_callback;
+static bool do_inline, do_callback, do_print_accesses;
 static bool do_haddr;
 static enum qemu_plugin_mem_rw rw = QEMU_PLUGIN_MEM_RW;
 
@@ -60,6 +60,20 @@ static void vcpu_mem(unsigned int cpu_index, qemu_plugin_meminfo_t meminfo,
     }
 }
 
+static void print_access(unsigned int cpu_index, qemu_plugin_meminfo_t meminfo,
+                         uint64_t vaddr, void *udata)
+{
+    unsigned size = 8 << qemu_plugin_mem_size_shift(meminfo);
+    const char *type = qemu_plugin_mem_is_store(meminfo) ? "store" : "load";
+    uint64_t upper = qemu_plugin_mem_get_value_upper_bits(meminfo);
+    uint64_t lower = qemu_plugin_mem_get_value_lower_bits(meminfo);
+    const char *sym = udata ? udata : "";
+    g_autoptr(GString) out = g_string_new("");
+    g_string_printf(out, "access: 0x%.0"PRIx64"%"PRIx64",%d,%s,%s\n",
+                    upper, lower, size, type, sym);
+    qemu_plugin_outs(out->str);
+}
+
 static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
 {
     size_t n = qemu_plugin_tb_n_insns(tb);
@@ -79,6 +93,12 @@ static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
                                              QEMU_PLUGIN_CB_NO_REGS,
                                              rw, NULL);
         }
+        if (do_print_accesses) {
+            const char *sym = qemu_plugin_insn_symbol(insn);
+            qemu_plugin_register_vcpu_mem_cb(insn, print_access,
+                                             QEMU_PLUGIN_CB_NO_REGS,
+                                             rw, (void *) sym);
+        }
     }
 }
 
@@ -117,6 +137,12 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
                 fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
                 return -1;
             }
+        } else if (g_strcmp0(tokens[0], "print-accesses") == 0) {
+            if (!qemu_plugin_bool_parse(tokens[0], tokens[1],
+                                        &do_print_accesses)) {
+                fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
+                return -1;
+            }
         } else {
             fprintf(stderr, "option parsing failed: %s\n", opt);
             return -1;
-- 
2.39.2

[PATCH v2 7/7] tests/tcg/x86_64: add test for plugin memory access

[Pierrick Bouvier]

Add an explicit test to check expected memory values are read/written.
For sizes 8, 16, 32, 64 and 128, we generate a load/store operation.
For size 8 -> 64, we generate an atomic __sync_val_compare_and_swap too.
For 128bits memory access, we rely on SSE2 instructions.

By default, atomic accesses are non atomic if a single cpu is running,
so we force creation of a second one by creating a new thread first.

load/store helpers code path can't be triggered easily in user mode (no
softmmu), so we can't test it here.

Can be run with:
make -C build/tests/tcg/x86_64-linux-user run-plugin-test-plugin-mem-access-with-libmem.so

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 tests/tcg/x86_64/test-plugin-mem-access.c   | 89 +++++++++++++++++++++
 tests/tcg/x86_64/Makefile.target            |  7 ++
 tests/tcg/x86_64/check-plugin-mem-access.sh | 48 +++++++++++
 3 files changed, 144 insertions(+)
 create mode 100644 tests/tcg/x86_64/test-plugin-mem-access.c
 create mode 100755 tests/tcg/x86_64/check-plugin-mem-access.sh

diff --git a/tests/tcg/x86_64/test-plugin-mem-access.c b/tests/tcg/x86_64/test-plugin-mem-access.c
new file mode 100644
index 00000000000..7fdd6a55829
--- /dev/null
+++ b/tests/tcg/x86_64/test-plugin-mem-access.c
@@ -0,0 +1,89 @@
+#include <emmintrin.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+static void *data;
+
+#define DEFINE_STORE(name, type, value) \
+static void store_##name(void)          \
+{                                       \
+    *((type *)data) = value;            \
+}
+
+#define DEFINE_ATOMIC_OP(name, type, value)                 \
+static void atomic_op_##name(void)                          \
+{                                                           \
+    *((type *)data) = 0x42;                                 \
+    __sync_val_compare_and_swap((type *)data, 0x42, value); \
+}
+
+#define DEFINE_LOAD(name, type)                         \
+static void load_##name(void)                           \
+{                                                       \
+    register type var asm("eax") = *((type *) data);    \
+    (void)var;                                          \
+}
+
+DEFINE_STORE(u8, uint8_t, 0xf1)
+DEFINE_ATOMIC_OP(u8, uint8_t, 0xf1)
+DEFINE_LOAD(u8, uint8_t)
+DEFINE_STORE(u16, uint16_t, 0xf123)
+DEFINE_ATOMIC_OP(u16, uint16_t, 0xf123)
+DEFINE_LOAD(u16, uint16_t)
+DEFINE_STORE(u32, uint32_t, 0xff112233)
+DEFINE_ATOMIC_OP(u32, uint32_t, 0xff112233)
+DEFINE_LOAD(u32, uint32_t)
+DEFINE_STORE(u64, uint64_t, 0xf123456789abcdef)
+DEFINE_ATOMIC_OP(u64, uint64_t, 0xf123456789abcdef)
+DEFINE_LOAD(u64, uint64_t)
+
+static void store_u128(void)
+{
+    _mm_store_si128(data, _mm_set_epi32(0xf1223344, 0x55667788,
+                                        0xf1234567, 0x89abcdef));
+}
+
+static void load_u128(void)
+{
+    __m128i var = _mm_load_si128(data);
+    (void)var;
+}
+
+static void *f(void *p)
+{
+    return NULL;
+}
+
+int main(void)
+{
+    /*
+     * We force creation of a second thread to enable cpu flag CF_PARALLEL.
+     * This will generate atomic operations when needed.
+     */
+    pthread_t thread;
+    pthread_create(&thread, NULL, &f, NULL);
+    pthread_join(thread, NULL);
+
+    data = malloc(sizeof(__m128i));
+    atomic_op_u8();
+    store_u8();
+    load_u8();
+
+    atomic_op_u16();
+    store_u16();
+    load_u16();
+
+    atomic_op_u32();
+    store_u32();
+    load_u32();
+
+    atomic_op_u64();
+    store_u64();
+    load_u64();
+
+    store_u128();
+    load_u128();
+
+    free(data);
+}
diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
index 5fedf221174..5f7015fd8b4 100644
--- a/tests/tcg/x86_64/Makefile.target
+++ b/tests/tcg/x86_64/Makefile.target
@@ -14,6 +14,7 @@ X86_64_TESTS += noexec
 X86_64_TESTS += cmpxchg
 X86_64_TESTS += adox
 X86_64_TESTS += test-1648
+PLUGINS_TESTS += test-plugin-mem-access
 TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
 else
 TESTS=$(MULTIARCH_TESTS)
@@ -24,6 +25,12 @@ adox: CFLAGS=-O2
 run-test-i386-ssse3: QEMU_OPTS += -cpu max
 run-plugin-test-i386-ssse3-%: QEMU_OPTS += -cpu max
 
+run-plugin-test-plugin-mem-access-with-libmem.so: \
+	PLUGIN_ARGS=$(COMMA)print-accesses=true
+run-plugin-test-plugin-mem-access-with-libmem.so: \
+	CHECK_PLUGIN_OUTPUT_COMMAND= \
+	$(SRC_PATH)/tests/tcg/x86_64/check-plugin-mem-access.sh
+
 test-x86_64: LDFLAGS+=-lm -lc
 test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
diff --git a/tests/tcg/x86_64/check-plugin-mem-access.sh b/tests/tcg/x86_64/check-plugin-mem-access.sh
new file mode 100755
index 00000000000..3884976af2d
--- /dev/null
+++ b/tests/tcg/x86_64/check-plugin-mem-access.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+die()
+{
+    echo "$@" 1>&2
+    exit 1
+}
+
+check()
+{
+    file=$1
+    pattern=$2
+    grep "$pattern" "$file" > /dev/null || die "\"$pattern\" not found in $file"
+}
+
+[ $# -eq 1 ] || die "usage: plugin_out_file"
+
+plugin_out=$1
+
+expected()
+{
+    cat << EOF
+access: 0xf1,8,store,store_u8
+access: 0x42,8,load,atomic_op_u8
+access: 0xf1,8,store,atomic_op_u8
+access: 0xf1,8,load,load_u8
+access: 0xf123,16,store,store_u16
+access: 0x42,16,load,atomic_op_u16
+access: 0xf123,16,store,atomic_op_u16
+access: 0xf123,16,load,load_u16
+access: 0xff112233,32,store,store_u32
+access: 0x42,32,load,atomic_op_u32
+access: 0xff112233,32,store,atomic_op_u32
+access: 0xff112233,32,load,load_u32
+access: 0xf123456789abcdef,64,store,store_u64
+access: 0x42,64,load,atomic_op_u64
+access: 0xf123456789abcdef,64,store,atomic_op_u64
+access: 0xf123456789abcdef,64,load,load_u64
+access: 0xf122334455667788f123456789abcdef,128,store,store_u128
+access: 0xf122334455667788f123456789abcdef,128,load,load_u128
+EOF
+}
+
+expected | while read line; do
+    check "$plugin_out" "$line"
+done
-- 
2.39.2

RE: [PATCH v2 6/7] tests/plugin/mem: add option to print memory accesses

[Xingtao Yao (Fujitsu) via]

Hi, Pierrick

> +static void print_access(unsigned int cpu_index, qemu_plugin_meminfo_t
> meminfo,
> +                         uint64_t vaddr, void *udata)
> +{
> +    unsigned size = 8 << qemu_plugin_mem_size_shift(meminfo);
> +    const char *type = qemu_plugin_mem_is_store(meminfo) ? "store" : "load";
> +    uint64_t upper = qemu_plugin_mem_get_value_upper_bits(meminfo);
> +    uint64_t lower = qemu_plugin_mem_get_value_lower_bits(meminfo);
> +    const char *sym = udata ? udata : "";
> +    g_autoptr(GString) out = g_string_new("");
> +    g_string_printf(out, "access: 0x%.0"PRIx64"%"PRIx64",%d,%s,%s\n",
> +                    upper, lower, size, type, sym);
> +    qemu_plugin_outs(out->str);
> +}
I think it may be helpful to output the GVA and GPA, can you append these information?


Thanks
Xingtao

Re: [PATCH v2 6/7] tests/plugin/mem: add option to print memory accesses

[Pierrick Bouvier]

Hi Xingtao,

On 6/26/24 20:17, Xingtao Yao (Fujitsu) wrote:
> Hi, Pierrick
> 
>> +static void print_access(unsigned int cpu_index, qemu_plugin_meminfo_t
>> meminfo,
>> +                         uint64_t vaddr, void *udata)
>> +{
>> +    unsigned size = 8 << qemu_plugin_mem_size_shift(meminfo);
>> +    const char *type = qemu_plugin_mem_is_store(meminfo) ? "store" : "load";
>> +    uint64_t upper = qemu_plugin_mem_get_value_upper_bits(meminfo);
>> +    uint64_t lower = qemu_plugin_mem_get_value_lower_bits(meminfo);
>> +    const char *sym = udata ? udata : "";
>> +    g_autoptr(GString) out = g_string_new("");
>> +    g_string_printf(out, "access: 0x%.0"PRIx64"%"PRIx64",%d,%s,%s\n",
>> +                    upper, lower, size, type, sym);
>> +    qemu_plugin_outs(out->str);
>> +}
> I think it may be helpful to output the GVA and GPA, can you append these information?
> 

You mean virtual and physical addresses?

> 
> Thanks
> Xingtao

RE: [PATCH v2 6/7] tests/plugin/mem: add option to print memory accesses

[Xingtao Yao (Fujitsu) via]

> -----Original Message-----
> From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> Sent: Thursday, June 27, 2024 1:29 PM
> To: Yao, Xingtao/姚 幸涛 <yaoxt.fnst@fujitsu.com>; qemu-devel@nongnu.org
> Cc: Alexandre Iooss <erdnaxe@crans.org>; Philippe Mathieu-Daudé
> <philmd@linaro.org>; Mahmoud Mandour <ma.mandourr@gmail.com>; Paolo
> Bonzini <pbonzini@redhat.com>; Eduardo Habkost <eduardo@habkost.net>;
> Richard Henderson <richard.henderson@linaro.org>; Alex Bennée
> <alex.bennee@linaro.org>
> Subject: Re: [PATCH v2 6/7] tests/plugin/mem: add option to print memory
> accesses
> 
> Hi Xingtao,
> 
> On 6/26/24 20:17, Xingtao Yao (Fujitsu) wrote:
> > Hi, Pierrick
> >
> >> +static void print_access(unsigned int cpu_index, qemu_plugin_meminfo_t
> >> meminfo,
> >> +                         uint64_t vaddr, void *udata)
> >> +{
> >> +    unsigned size = 8 << qemu_plugin_mem_size_shift(meminfo);
> >> +    const char *type = qemu_plugin_mem_is_store(meminfo) ? "store" :
> "load";
> >> +    uint64_t upper = qemu_plugin_mem_get_value_upper_bits(meminfo);
> >> +    uint64_t lower = qemu_plugin_mem_get_value_lower_bits(meminfo);
> >> +    const char *sym = udata ? udata : "";
> >> +    g_autoptr(GString) out = g_string_new("");
> >> +    g_string_printf(out, "access: 0x%.0"PRIx64"%"PRIx64",%d,%s,%s\n",
> >> +                    upper, lower, size, type, sym);
> >> +    qemu_plugin_outs(out->str);
> >> +}
> > I think it may be helpful to output the GVA and GPA, can you append these
> information?
> >
> 
> You mean virtual and physical addresses?
Yes. currently we only known the memory value, appending these info may help us to trace the 
memory access.

> 
> >
> > Thanks
> > Xingtao

Re: [PATCH v2 6/7] tests/plugin/mem: add option to print memory accesses

[Pierrick Bouvier]

On 6/26/24 23:04, Xingtao Yao (Fujitsu) wrote:
> 
> 
>> -----Original Message-----
>> From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>> Sent: Thursday, June 27, 2024 1:29 PM
>> To: Yao, Xingtao/姚 幸涛 <yaoxt.fnst@fujitsu.com>; qemu-devel@nongnu.org
>> Cc: Alexandre Iooss <erdnaxe@crans.org>; Philippe Mathieu-Daudé
>> <philmd@linaro.org>; Mahmoud Mandour <ma.mandourr@gmail.com>; Paolo
>> Bonzini <pbonzini@redhat.com>; Eduardo Habkost <eduardo@habkost.net>;
>> Richard Henderson <richard.henderson@linaro.org>; Alex Bennée
>> <alex.bennee@linaro.org>
>> Subject: Re: [PATCH v2 6/7] tests/plugin/mem: add option to print memory
>> accesses
>>
>> Hi Xingtao,
>>
>> On 6/26/24 20:17, Xingtao Yao (Fujitsu) wrote:
>>> Hi, Pierrick
>>>
>>>> +static void print_access(unsigned int cpu_index, qemu_plugin_meminfo_t
>>>> meminfo,
>>>> +                         uint64_t vaddr, void *udata)
>>>> +{
>>>> +    unsigned size = 8 << qemu_plugin_mem_size_shift(meminfo);
>>>> +    const char *type = qemu_plugin_mem_is_store(meminfo) ? "store" :
>> "load";
>>>> +    uint64_t upper = qemu_plugin_mem_get_value_upper_bits(meminfo);
>>>> +    uint64_t lower = qemu_plugin_mem_get_value_lower_bits(meminfo);
>>>> +    const char *sym = udata ? udata : "";
>>>> +    g_autoptr(GString) out = g_string_new("");
>>>> +    g_string_printf(out, "access: 0x%.0"PRIx64"%"PRIx64",%d,%s,%s\n",
>>>> +                    upper, lower, size, type, sym);
>>>> +    qemu_plugin_outs(out->str);
>>>> +}
>>> I think it may be helpful to output the GVA and GPA, can you append these
>> information?
>>>
>>
>> You mean virtual and physical addresses?
> Yes. currently we only known the memory value, appending these info may help us to trace the
> memory access.
> 

Sounds good, I'll add this in v3.

>>
>>>
>>> Thanks
>>> Xingtao

Re: [PATCH v2 2/7] plugins: save value during memory accesses

[Richard Henderson]

On 6/26/24 16:37, Pierrick Bouvier wrote:
> Different code paths handle memory accesses:
> - tcg generated code
> - load/store helpers
> - atomic helpers
> 
> This value is saved in cpu->plugin_state.
> 
> Atomic operations are doing read/write at the same time, so we generate
> two memory callbacks instead of one, to allow plugins to access distinct
> values.
> 
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
> ---
>   accel/tcg/atomic_template.h   | 66 ++++++++++++++++++++++++++++----
>   include/qemu/plugin.h         |  8 ++++
>   plugins/core.c                |  7 ++++
>   tcg/tcg-op-ldst.c             | 72 +++++++++++++++++++++++++++++++----
>   accel/tcg/atomic_common.c.inc | 13 ++++++-
>   accel/tcg/ldst_common.c.inc   | 38 +++++++++++-------
>   6 files changed, 173 insertions(+), 31 deletions(-)
> 
> diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
> index 1dc2151dafd..830e4f16069 100644
> --- a/accel/tcg/atomic_template.h
> +++ b/accel/tcg/atomic_template.h
> @@ -53,6 +53,14 @@
>   # error unsupported data size
>   #endif
>   
> +#if DATA_SIZE == 16
> +# define UPPER_MEMORY_VALUE(val) int128_gethi(val)
> +# define LOWER_MEMORY_VALUE(val) int128_getlo(val)
> +#else
> +# define UPPER_MEMORY_VALUE(val) 0
> +# define LOWER_MEMORY_VALUE(val) val
> +#endif
> +
>   #if DATA_SIZE >= 4
>   # define ABI_TYPE  DATA_TYPE
>   #else
> @@ -83,7 +91,12 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
>       ret = qatomic_cmpxchg__nocheck(haddr, cmpv, newv);
>   #endif
>       ATOMIC_MMU_CLEANUP;
> -    atomic_trace_rmw_post(env, addr, oi);
> +    atomic_trace_rmw_post(env, addr,
> +                          UPPER_MEMORY_VALUE(ret),
> +                          LOWER_MEMORY_VALUE(ret),
> +                          UPPER_MEMORY_VALUE(newv),
> +                          LOWER_MEMORY_VALUE(newv),
> +                          oi);

Just a nit, but tcg is consistent in using little-endian argument ordering for values 
passed by parts.  I would prefer we continue with that.


> @@ -142,9 +142,13 @@ struct qemu_plugin_tb {
>   /**
>    * struct CPUPluginState - per-CPU state for plugins
>    * @event_mask: plugin event bitmap. Modified only via async work.
> + * @mem_value_upper_bits: 64 upper bits of latest accessed mem value.
> + * @mem_value_lower_bits: 64 lower bits of latest accessed mem value.
>    */
>   struct CPUPluginState {
>       DECLARE_BITMAP(event_mask, QEMU_PLUGIN_EV_MAX);
> +    uint64_t mem_value_upper_bits;
> +    uint64_t mem_value_lower_bits;
>   };

At some point we may well support 32 byte acceses, for better guest vector support.  Do we 
have a plan for this beyond "add more fields here"?


r~

Re: [PATCH v2 2/7] plugins: save value during memory accesses

[Pierrick Bouvier]

On 6/27/24 12:10, Richard Henderson wrote:
> On 6/26/24 16:37, Pierrick Bouvier wrote:
>> Different code paths handle memory accesses:
>> - tcg generated code
>> - load/store helpers
>> - atomic helpers
>>
>> This value is saved in cpu->plugin_state.
>>
>> Atomic operations are doing read/write at the same time, so we generate
>> two memory callbacks instead of one, to allow plugins to access distinct
>> values.
>>
>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>> ---
>>    accel/tcg/atomic_template.h   | 66 ++++++++++++++++++++++++++++----
>>    include/qemu/plugin.h         |  8 ++++
>>    plugins/core.c                |  7 ++++
>>    tcg/tcg-op-ldst.c             | 72 +++++++++++++++++++++++++++++++----
>>    accel/tcg/atomic_common.c.inc | 13 ++++++-
>>    accel/tcg/ldst_common.c.inc   | 38 +++++++++++-------
>>    6 files changed, 173 insertions(+), 31 deletions(-)
>>
>> diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
>> index 1dc2151dafd..830e4f16069 100644
>> --- a/accel/tcg/atomic_template.h
>> +++ b/accel/tcg/atomic_template.h
>> @@ -53,6 +53,14 @@
>>    # error unsupported data size
>>    #endif
>>    
>> +#if DATA_SIZE == 16
>> +# define UPPER_MEMORY_VALUE(val) int128_gethi(val)
>> +# define LOWER_MEMORY_VALUE(val) int128_getlo(val)
>> +#else
>> +# define UPPER_MEMORY_VALUE(val) 0
>> +# define LOWER_MEMORY_VALUE(val) val
>> +#endif
>> +
>>    #if DATA_SIZE >= 4
>>    # define ABI_TYPE  DATA_TYPE
>>    #else
>> @@ -83,7 +91,12 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
>>        ret = qatomic_cmpxchg__nocheck(haddr, cmpv, newv);
>>    #endif
>>        ATOMIC_MMU_CLEANUP;
>> -    atomic_trace_rmw_post(env, addr, oi);
>> +    atomic_trace_rmw_post(env, addr,
>> +                          UPPER_MEMORY_VALUE(ret),
>> +                          LOWER_MEMORY_VALUE(ret),
>> +                          UPPER_MEMORY_VALUE(newv),
>> +                          LOWER_MEMORY_VALUE(newv),
>> +                          oi);
> 
> Just a nit, but tcg is consistent in using little-endian argument ordering for values
> passed by parts.  I would prefer we continue with that.
> 

Didn't notice that, but I'll stick to this. Any preference on the naming 
as well while I'm at it? (low/hi vs upper/lower)?

> 
>> @@ -142,9 +142,13 @@ struct qemu_plugin_tb {
>>    /**
>>     * struct CPUPluginState - per-CPU state for plugins
>>     * @event_mask: plugin event bitmap. Modified only via async work.
>> + * @mem_value_upper_bits: 64 upper bits of latest accessed mem value.
>> + * @mem_value_lower_bits: 64 lower bits of latest accessed mem value.
>>     */
>>    struct CPUPluginState {
>>        DECLARE_BITMAP(event_mask, QEMU_PLUGIN_EV_MAX);
>> +    uint64_t mem_value_upper_bits;
>> +    uint64_t mem_value_lower_bits;
>>    };
> 
> At some point we may well support 32 byte acceses, for better guest vector support.  Do we
> have a plan for this beyond "add more fields here"?
>

For now, I sticked to native tcg ops (up to 128 bits), with this simple 
solution. Do you think tcg core will be extended to support more, or 
will helper simply load/store four 128bits words, emitting four 
callbacks as well?

If you have a better idea, I'm open to implement an alternative, but 
didn't want to think too much ahead.

> 
> r~

Re: [PATCH v2 2/7] plugins: save value during memory accesses

[Richard Henderson]

On 6/27/24 12:25, Pierrick Bouvier wrote:
> On 6/27/24 12:10, Richard Henderson wrote:
>> On 6/26/24 16:37, Pierrick Bouvier wrote:
>>> Different code paths handle memory accesses:
>>> - tcg generated code
>>> - load/store helpers
>>> - atomic helpers
>>>
>>> This value is saved in cpu->plugin_state.
>>>
>>> Atomic operations are doing read/write at the same time, so we generate
>>> two memory callbacks instead of one, to allow plugins to access distinct
>>> values.
>>>
>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
>>> ---
>>>    accel/tcg/atomic_template.h   | 66 ++++++++++++++++++++++++++++----
>>>    include/qemu/plugin.h         |  8 ++++
>>>    plugins/core.c                |  7 ++++
>>>    tcg/tcg-op-ldst.c             | 72 +++++++++++++++++++++++++++++++----
>>>    accel/tcg/atomic_common.c.inc | 13 ++++++-
>>>    accel/tcg/ldst_common.c.inc   | 38 +++++++++++-------
>>>    6 files changed, 173 insertions(+), 31 deletions(-)
>>>
>>> diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
>>> index 1dc2151dafd..830e4f16069 100644
>>> --- a/accel/tcg/atomic_template.h
>>> +++ b/accel/tcg/atomic_template.h
>>> @@ -53,6 +53,14 @@
>>>    # error unsupported data size
>>>    #endif
>>> +#if DATA_SIZE == 16
>>> +# define UPPER_MEMORY_VALUE(val) int128_gethi(val)
>>> +# define LOWER_MEMORY_VALUE(val) int128_getlo(val)
>>> +#else
>>> +# define UPPER_MEMORY_VALUE(val) 0
>>> +# define LOWER_MEMORY_VALUE(val) val
>>> +#endif
>>> +
>>>    #if DATA_SIZE >= 4
>>>    # define ABI_TYPE  DATA_TYPE
>>>    #else
>>> @@ -83,7 +91,12 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
>>>        ret = qatomic_cmpxchg__nocheck(haddr, cmpv, newv);
>>>    #endif
>>>        ATOMIC_MMU_CLEANUP;
>>> -    atomic_trace_rmw_post(env, addr, oi);
>>> +    atomic_trace_rmw_post(env, addr,
>>> +                          UPPER_MEMORY_VALUE(ret),
>>> +                          LOWER_MEMORY_VALUE(ret),
>>> +                          UPPER_MEMORY_VALUE(newv),
>>> +                          LOWER_MEMORY_VALUE(newv),
>>> +                          oi);
>>
>> Just a nit, but tcg is consistent in using little-endian argument ordering for values
>> passed by parts.  I would prefer we continue with that.
>>
> 
> Didn't notice that, but I'll stick to this. Any preference on the naming as well while I'm 
> at it? (low/hi vs upper/lower)?

I guess we mostly use high/low, hi/lo, and variations thereof elsewhere as well.  I don't 
see any uses of upper/lower.

>> At some point we may well support 32 byte acceses, for better guest vector support.  Do we
>> have a plan for this beyond "add more fields here"?
>>
> 
> For now, I sticked to native tcg ops (up to 128 bits), with this simple solution. Do you 
> think tcg core will be extended to support more, or will helper simply load/store four 
> 128bits words, emitting four callbacks as well?

I assume we'll support a 256-bit (non-atomic) memory operation.
That avoids some of the "probe for write, perform stores after we know it's safe" sort of 
affair.

I don't think I'll do it while i686 is still a supported host though.

> If you have a better idea, I'm open to implement an alternative, but didn't want to think 
> too much ahead.

Fair.


r~

Re: [PATCH v2 4/7] tests/tcg: add mechanism to run specific tests with plugins

[Richard Henderson]

On 6/26/24 16:37, Pierrick Bouvier wrote:
> Only multiarch tests are run with plugins, and we want to be able to run
> per-arch test with plugins too.
> 
> Signed-off-by: Pierrick Bouvier<pierrick.bouvier@linaro.org>
> ---
>   tests/tcg/Makefile.target | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~