From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=52862 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1PtMxH-0006oG-NN
	for qemu-devel@nongnu.org; Sat, 26 Feb 2011 11:25:16 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <felix.matenaar@rwth-aachen.de>) id 1PtMxG-00088T-CW
	for qemu-devel@nongnu.org; Sat, 26 Feb 2011 11:25:15 -0500
Received: from mta-1.ms.rz.rwth-aachen.de ([134.130.7.72]:41977)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <felix.matenaar@rwth-aachen.de>) id 1PtMxG-00087z-7O
	for qemu-devel@nongnu.org; Sat, 26 Feb 2011 11:25:14 -0500
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/plain; charset=ISO-8859-1
Received: from ironport-out-1.rz.rwth-aachen.de ([134.130.5.40])
	by mta-1.ms.rz.RWTH-Aachen.de
	(Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008))
	with ESMTP id <0LH800458G9YSPD0@mta-1.ms.rz.RWTH-Aachen.de> for
	qemu-devel@nongnu.org; Sat, 26 Feb 2011 17:25:10 +0100 (CET)
Received: from [10.9.0.6] ([unknown] [178.63.246.163])
	by relay-auth-1.ms.rz.rwth-aachen.de
	(Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 9
	2008))
	with ESMTPA id <0LH800L60G9YC430@relay-auth-1.ms.rz.rwth-aachen.de> for
	qemu-devel@nongnu.org; Sat, 26 Feb 2011 17:25:10 +0100 (CET)
Message-id: <4D692965.6030606@rwth-aachen.de>
Date: Sat, 26 Feb 2011 17:25:09 +0100
From: "felix.matenaar@rwth-aachen" <felix.matenaar@rwth-aachen.de>
Subject: [Qemu-devel] Hooking memory access in TCG
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

Hi *,

i am currently trying to trace guest memory access (i386-softmmu). tcg
README says tcg_gen_(st|ld)X_Y functions are responsible for memory
access. Now I've got the following code snippets in tcg-op.h:

/* representing all tcg_gen_st and tcg_gen_ld functions in README*/
static inline void tcg_gen_ld8s_i32(TCGv_i32 ret, TCGv_ptr arg2,
tcg_target_long offset)
{
    tcg_gen_ldst_op_i32(INDEX_op_ld8s_i32, ret, arg2, offset);
    int sizemask = 0;
    sizemask |= tcg_gen_sizemask(0, 0, 0);
    sizemask |= tcg_gen_sizemask(1, 0, 0);
    sizemask |= tcg_gen_sizemask(2, 0, 0);
    tcg_gen_helper3(tcg_flx_debug, sizemask, ret, ret, arg2,
tcg_const_i32(offset));
}

static inline void tcg_gen_helper3(void *func, int sizemask, TCGv_i32 ret,
                                    TCGv_i32 a, TCGv_i32 b, TCGv_i32 c)
{
    TCGv_ptr fn;
    TCGArg args[3];
    fn = tcg_const_ptr((tcg_target_long)func);
    args[0] = GET_TCGV_I32(a);
    args[1] = GET_TCGV_I32(b);
    args[2] = GET_TCGV_I32(c);
    tcg_gen_callN(&tcg_ctx, fn, TCG_CALL_CONST | TCG_CALL_PURE, sizemask,
                  GET_TCGV_I32(ret), 3, args);
    tcg_temp_free_ptr(fn);
}

static inline int32_t tcg_flx_debug(int32_t arg1, int32_t arg2, int32_t
arg3){
    printf("reading 0x%x from 0x%x\n",arg1,arg2+arg3);
    return arg1;
}


tcg_flx_debug produces output which does not seem to look like what I
want. What confuses me is that e.g.
tcg_gen_ld32u_tl(cpu_T[0], cpu_env, offsetof(CPUX86State,ldt.selector))
in translate.c ends up in one of the functions I am trying to hook but
the second and the third argument obviously are not directly valid
base+offset addresses in the guest memory.

So how is this part working? What I would like to build is that on each
read/write to guest memory, an analysis function is triggered with
address and value.

Regards,
    Felix Matenaar