diff mbox series

[v3,26/26] plugins: move reset of plugin data to tb_start

Message ID 20220204204335.1689602-27-alex.bennee@linaro.org
State New
Headers show
Series testing and plugins pre-PR | expand

Commit Message

Alex Bennée Feb. 4, 2022, 8:43 p.m. UTC
We can't always guarantee we get to the end of a translator loop.
Although this can happen for a variety of reasons it does happen more
often on x86 system emulation when an instruction spans across to an
un-faulted page. This caused confusion of the instruction tracking
data resulting in apparent reverse execution (at least from the
plugins point of view).

Fix this by moving the reset code to plugin_gen_tb_start so we always
start with a clean slate.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/824
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20220124201608.604599-23-alex.bennee@linaro.org>
---
 accel/tcg/plugin-gen.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

Comments

Philippe Mathieu-Daudé Feb. 4, 2022, 10:19 p.m. UTC | #1
On 4/2/22 21:43, Alex Bennée wrote:
> We can't always guarantee we get to the end of a translator loop.
> Although this can happen for a variety of reasons it does happen more
> often on x86 system emulation when an instruction spans across to an
> un-faulted page. This caused confusion of the instruction tracking
> data resulting in apparent reverse execution (at least from the
> plugins point of view).
> 
> Fix this by moving the reset code to plugin_gen_tb_start so we always
> start with a clean slate.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/824
> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
> Message-Id: <20220124201608.604599-23-alex.bennee@linaro.org>
> ---
>   accel/tcg/plugin-gen.c | 29 ++++++++++++++++++-----------
>   1 file changed, 18 insertions(+), 11 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Richard Henderson Feb. 6, 2022, 1:16 a.m. UTC | #2
On 2/5/22 07:43, Alex Bennée wrote:
> We can't always guarantee we get to the end of a translator loop.
> Although this can happen for a variety of reasons it does happen more
> often on x86 system emulation when an instruction spans across to an
> un-faulted page. This caused confusion of the instruction tracking
> data resulting in apparent reverse execution (at least from the
> plugins point of view).
> 
> Fix this by moving the reset code to plugin_gen_tb_start so we always
> start with a clean slate.
> 
> Resolves:https://gitlab.com/qemu-project/qemu/-/issues/824
> Signed-off-by: Alex Bennée<alex.bennee@linaro.org>
> Message-Id:<20220124201608.604599-23-alex.bennee@linaro.org>
> ---
>   accel/tcg/plugin-gen.c | 29 ++++++++++++++++++-----------
>   1 file changed, 18 insertions(+), 11 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~
diff mbox series

Patch

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index 22d95fe1c3..ae70e4a5b0 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -854,10 +854,21 @@  static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
 
 bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb, bool mem_only)
 {
-    struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
     bool ret = false;
 
     if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_mask)) {
+        struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
+        int i;
+
+        /* reset callbacks */
+        for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
+            if (ptb->cbs[i]) {
+                g_array_set_size(ptb->cbs[i], 0);
+            }
+        }
+        ptb->n = 0;
+        tcg_ctx->plugin_insn = NULL;
+
         ret = true;
 
         ptb->vaddr = tb->pc;
@@ -904,23 +915,19 @@  void plugin_gen_insn_end(void)
     plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN);
 }
 
+/*
+ * There are cases where we never get to finalise a translation - for
+ * example a page fault during translation. As a result we shouldn't
+ * do any clean-up here and make sure things are reset in
+ * plugin_gen_tb_start.
+ */
 void plugin_gen_tb_end(CPUState *cpu)
 {
     struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
-    int i;
 
     /* collect instrumentation requests */
     qemu_plugin_tb_trans_cb(cpu, ptb);
 
     /* inject the instrumentation at the appropriate places */
     plugin_gen_inject(ptb);
-
-    /* clean up */
-    for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
-        if (ptb->cbs[i]) {
-            g_array_set_size(ptb->cbs[i], 0);
-        }
-    }
-    ptb->n = 0;
-    tcg_ctx->plugin_insn = NULL;
 }