[Qemu-devel] Hooking memory access in TCG

[Qemu-devel] Hooking memory access in TCG

[felix.matenaar@rwth-aachen]

Hi *,

i am currently trying to trace guest memory access (i386-softmmu). tcg
README says tcg_gen_(st|ld)X_Y functions are responsible for memory
access. Now I've got the following code snippets in tcg-op.h:

/* representing all tcg_gen_st and tcg_gen_ld functions in README*/
static inline void tcg_gen_ld8s_i32(TCGv_i32 ret, TCGv_ptr arg2,
tcg_target_long offset)
{
    tcg_gen_ldst_op_i32(INDEX_op_ld8s_i32, ret, arg2, offset);
    int sizemask = 0;
    sizemask |= tcg_gen_sizemask(0, 0, 0);
    sizemask |= tcg_gen_sizemask(1, 0, 0);
    sizemask |= tcg_gen_sizemask(2, 0, 0);
    tcg_gen_helper3(tcg_flx_debug, sizemask, ret, ret, arg2,
tcg_const_i32(offset));
}

static inline void tcg_gen_helper3(void *func, int sizemask, TCGv_i32 ret,
                                    TCGv_i32 a, TCGv_i32 b, TCGv_i32 c)
{
    TCGv_ptr fn;
    TCGArg args[3];
    fn = tcg_const_ptr((tcg_target_long)func);
    args[0] = GET_TCGV_I32(a);
    args[1] = GET_TCGV_I32(b);
    args[2] = GET_TCGV_I32(c);
    tcg_gen_callN(&tcg_ctx, fn, TCG_CALL_CONST | TCG_CALL_PURE, sizemask,
                  GET_TCGV_I32(ret), 3, args);
    tcg_temp_free_ptr(fn);
}

static inline int32_t tcg_flx_debug(int32_t arg1, int32_t arg2, int32_t
arg3){
    printf("reading 0x%x from 0x%x\n",arg1,arg2+arg3);
    return arg1;
}


tcg_flx_debug produces output which does not seem to look like what I
want. What confuses me is that e.g.
tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,ldt.selector))
in translate.c ends up in one of the functions I am trying to hook but
the second and the third argument obviously are not directly valid
base+offset addresses in the guest memory.

So how is this part working? What I would like to build is that on each
read/write to guest memory, an analysis function is triggered with
address and value.

Regards,
    Felix Matenaar

Re: [Qemu-devel] Hooking memory access in TCG

[James Greensky]

[-- Attachment #1: Type: text/plain, Size: 2123 bytes --]

You want to hook the tcg_gen_qemu_ functions such as tcg_gen_qemu_ld8s in
tcg-op.h

Jim

On Sat, Feb 26, 2011 at 8:25 AM, felix.matenaar@rwth-aachen <
felix.matenaar@rwth-aachen.de> wrote:

> Hi *,
>
> i am currently trying to trace guest memory access (i386-softmmu). tcg
> README says tcg_gen_(st|ld)X_Y functions are responsible for memory
> access. Now I've got the following code snippets in tcg-op.h:
>
> /* representing all tcg_gen_st and tcg_gen_ld functions in README*/
> static inline void tcg_gen_ld8s_i32(TCGv_i32 ret, TCGv_ptr arg2,
> tcg_target_long offset)
> {
>    tcg_gen_ldst_op_i32(INDEX_op_ld8s_i32, ret, arg2, offset);
>    int sizemask = 0;
>    sizemask |= tcg_gen_sizemask(0, 0, 0);
>    sizemask |= tcg_gen_sizemask(1, 0, 0);
>    sizemask |= tcg_gen_sizemask(2, 0, 0);
>    tcg_gen_helper3(tcg_flx_debug, sizemask, ret, ret, arg2,
> tcg_const_i32(offset));
> }
>
> static inline void tcg_gen_helper3(void *func, int sizemask, TCGv_i32 ret,
>                                    TCGv_i32 a, TCGv_i32 b, TCGv_i32 c)
> {
>    TCGv_ptr fn;
>    TCGArg args[3];
>    fn = tcg_const_ptr((tcg_target_long)func);
>    args[0] = GET_TCGV_I32(a);
>    args[1] = GET_TCGV_I32(b);
>    args[2] = GET_TCGV_I32(c);
>    tcg_gen_callN(&tcg_ctx, fn, TCG_CALL_CONST | TCG_CALL_PURE, sizemask,
>                  GET_TCGV_I32(ret), 3, args);
>    tcg_temp_free_ptr(fn);
> }
>
> static inline int32_t tcg_flx_debug(int32_t arg1, int32_t arg2, int32_t
> arg3){
>    printf("reading 0x%x from 0x%x\n",arg1,arg2+arg3);
>    return arg1;
> }
>
>
> tcg_flx_debug produces output which does not seem to look like what I
> want. What confuses me is that e.g.
> tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,ldt.selector))
> in translate.c ends up in one of the functions I am trying to hook but
> the second and the third argument obviously are not directly valid
> base+offset addresses in the guest memory.
>
> So how is this part working? What I would like to build is that on each
> read/write to guest memory, an analysis function is triggered with
> address and value.
>
> Regards,
>     Felix Matenaar
>
>

[-- Attachment #2: Type: text/html, Size: 3058 bytes --]