1 /* 2 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 3 * Copyright (C) 2019, Linaro 4 * 5 * License: GNU GPL, version 2 or later. 6 * See the COPYING file in the top-level directory. 7 * 8 * SPDX-License-Identifier: GPL-2.0-or-later 9 */ 10 11 #ifndef QEMU_QEMU_PLUGIN_H 12 #define QEMU_QEMU_PLUGIN_H 13 14 #include <inttypes.h> 15 #include <stdbool.h> 16 #include <stddef.h> 17 18 /* 19 * For best performance, build the plugin with -fvisibility=hidden so that 20 * QEMU_PLUGIN_LOCAL is implicit. Then, just mark qemu_plugin_install with 21 * QEMU_PLUGIN_EXPORT. For more info, see 22 * https://gcc.gnu.org/wiki/Visibility 23 */ 24 #if defined _WIN32 || defined __CYGWIN__ 25 #ifdef BUILDING_DLL 26 #define QEMU_PLUGIN_EXPORT __declspec(dllexport) 27 #else 28 #define QEMU_PLUGIN_EXPORT __declspec(dllimport) 29 #endif 30 #define QEMU_PLUGIN_LOCAL 31 #else 32 #define QEMU_PLUGIN_EXPORT __attribute__((visibility("default"))) 33 #define QEMU_PLUGIN_LOCAL __attribute__((visibility("hidden"))) 34 #endif 35 36 /** 37 * typedef qemu_plugin_id_t - Unique plugin ID 38 */ 39 typedef uint64_t qemu_plugin_id_t; 40 41 /* 42 * Versioning plugins: 43 * 44 * The plugin API will pass a minimum and current API version that 45 * QEMU currently supports. The minimum API will be incremented if an 46 * API needs to be deprecated. 47 * 48 * The plugins export the API they were built against by exposing the 49 * symbol qemu_plugin_version which can be checked. 50 */ 51 52 extern QEMU_PLUGIN_EXPORT int qemu_plugin_version; 53 54 #define QEMU_PLUGIN_VERSION 1 55 56 /** 57 * struct qemu_info_t - system information for plugins 58 * 59 * This structure provides for some limited information about the 60 * system to allow the plugin to make decisions on how to proceed. For 61 * example it might only be suitable for running on some guest 62 * architectures or when under full system emulation. 63 */ 64 typedef struct qemu_info_t { 65 /** @target_name: string describing architecture */ 66 const char *target_name; 67 /** @version: minimum and current plugin API level */ 68 struct { 69 int min; 70 int cur; 71 } version; 72 /** @system_emulation: is this a full system emulation? */ 73 bool system_emulation; 74 union { 75 /** @system: information relevant to system emulation */ 76 struct { 77 /** @system.smp_vcpus: initial number of vCPUs */ 78 int smp_vcpus; 79 /** @system.max_vcpus: maximum possible number of vCPUs */ 80 int max_vcpus; 81 } system; 82 }; 83 } qemu_info_t; 84 85 /** 86 * qemu_plugin_install() - Install a plugin 87 * @id: this plugin's opaque ID 88 * @info: a block describing some details about the guest 89 * @argc: number of arguments 90 * @argv: array of arguments (@argc elements) 91 * 92 * All plugins must export this symbol which is called when the plugin 93 * is first loaded. Calling qemu_plugin_uninstall() from this function 94 * is a bug. 95 * 96 * Note: @info is only live during the call. Copy any information we 97 * want to keep. @argv remains valid throughout the lifetime of the 98 * loaded plugin. 99 * 100 * Return: 0 on successful loading, !0 for an error. 101 */ 102 QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id, 103 const qemu_info_t *info, 104 int argc, char **argv); 105 106 /** 107 * typedef qemu_plugin_simple_cb_t - simple callback 108 * @id: the unique qemu_plugin_id_t 109 * 110 * This callback passes no information aside from the unique @id. 111 */ 112 typedef void (*qemu_plugin_simple_cb_t)(qemu_plugin_id_t id); 113 114 /** 115 * typedef qemu_plugin_udata_cb_t - callback with user data 116 * @id: the unique qemu_plugin_id_t 117 * @userdata: a pointer to some user data supplied when the callback 118 * was registered. 119 */ 120 typedef void (*qemu_plugin_udata_cb_t)(qemu_plugin_id_t id, void *userdata); 121 122 /** 123 * typedef qemu_plugin_vcpu_simple_cb_t - vcpu callback 124 * @id: the unique qemu_plugin_id_t 125 * @vcpu_index: the current vcpu context 126 */ 127 typedef void (*qemu_plugin_vcpu_simple_cb_t)(qemu_plugin_id_t id, 128 unsigned int vcpu_index); 129 130 /** 131 * typedef qemu_plugin_vcpu_udata_cb_t - vcpu callback 132 * @vcpu_index: the current vcpu context 133 * @userdata: a pointer to some user data supplied when the callback 134 * was registered. 135 */ 136 typedef void (*qemu_plugin_vcpu_udata_cb_t)(unsigned int vcpu_index, 137 void *userdata); 138 139 /** 140 * qemu_plugin_uninstall() - Uninstall a plugin 141 * @id: this plugin's opaque ID 142 * @cb: callback to be called once the plugin has been removed 143 * 144 * Do NOT assume that the plugin has been uninstalled once this function 145 * returns. Plugins are uninstalled asynchronously, and therefore the given 146 * plugin receives callbacks until @cb is called. 147 * 148 * Note: Calling this function from qemu_plugin_install() is a bug. 149 */ 150 void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb); 151 152 /** 153 * qemu_plugin_reset() - Reset a plugin 154 * @id: this plugin's opaque ID 155 * @cb: callback to be called once the plugin has been reset 156 * 157 * Unregisters all callbacks for the plugin given by @id. 158 * 159 * Do NOT assume that the plugin has been reset once this function returns. 160 * Plugins are reset asynchronously, and therefore the given plugin receives 161 * callbacks until @cb is called. 162 */ 163 void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb); 164 165 /** 166 * qemu_plugin_register_vcpu_init_cb() - register a vCPU initialization callback 167 * @id: plugin ID 168 * @cb: callback function 169 * 170 * The @cb function is called every time a vCPU is initialized. 171 * 172 * See also: qemu_plugin_register_vcpu_exit_cb() 173 */ 174 void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id, 175 qemu_plugin_vcpu_simple_cb_t cb); 176 177 /** 178 * qemu_plugin_register_vcpu_exit_cb() - register a vCPU exit callback 179 * @id: plugin ID 180 * @cb: callback function 181 * 182 * The @cb function is called every time a vCPU exits. 183 * 184 * See also: qemu_plugin_register_vcpu_init_cb() 185 */ 186 void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id, 187 qemu_plugin_vcpu_simple_cb_t cb); 188 189 /** 190 * qemu_plugin_register_vcpu_idle_cb() - register a vCPU idle callback 191 * @id: plugin ID 192 * @cb: callback function 193 * 194 * The @cb function is called every time a vCPU idles. 195 */ 196 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 197 qemu_plugin_vcpu_simple_cb_t cb); 198 199 /** 200 * qemu_plugin_register_vcpu_resume_cb() - register a vCPU resume callback 201 * @id: plugin ID 202 * @cb: callback function 203 * 204 * The @cb function is called every time a vCPU resumes execution. 205 */ 206 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 207 qemu_plugin_vcpu_simple_cb_t cb); 208 209 /** struct qemu_plugin_tb - Opaque handle for a translation block */ 210 struct qemu_plugin_tb; 211 /** struct qemu_plugin_insn - Opaque handle for a translated instruction */ 212 struct qemu_plugin_insn; 213 214 /** 215 * enum qemu_plugin_cb_flags - type of callback 216 * 217 * @QEMU_PLUGIN_CB_NO_REGS: callback does not access the CPU's regs 218 * @QEMU_PLUGIN_CB_R_REGS: callback reads the CPU's regs 219 * @QEMU_PLUGIN_CB_RW_REGS: callback reads and writes the CPU's regs 220 * 221 * Note: currently unused, plugins cannot read or change system 222 * register state. 223 */ 224 enum qemu_plugin_cb_flags { 225 QEMU_PLUGIN_CB_NO_REGS, 226 QEMU_PLUGIN_CB_R_REGS, 227 QEMU_PLUGIN_CB_RW_REGS, 228 }; 229 230 enum qemu_plugin_mem_rw { 231 QEMU_PLUGIN_MEM_R = 1, 232 QEMU_PLUGIN_MEM_W, 233 QEMU_PLUGIN_MEM_RW, 234 }; 235 236 /** 237 * typedef qemu_plugin_vcpu_tb_trans_cb_t - translation callback 238 * @id: unique plugin id 239 * @tb: opaque handle used for querying and instrumenting a block. 240 */ 241 typedef void (*qemu_plugin_vcpu_tb_trans_cb_t)(qemu_plugin_id_t id, 242 struct qemu_plugin_tb *tb); 243 244 /** 245 * qemu_plugin_register_vcpu_tb_trans_cb() - register a translate cb 246 * @id: plugin ID 247 * @cb: callback function 248 * 249 * The @cb function is called every time a translation occurs. The @cb 250 * function is passed an opaque qemu_plugin_type which it can query 251 * for additional information including the list of translated 252 * instructions. At this point the plugin can register further 253 * callbacks to be triggered when the block or individual instruction 254 * executes. 255 */ 256 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id, 257 qemu_plugin_vcpu_tb_trans_cb_t cb); 258 259 /** 260 * qemu_plugin_register_vcpu_tb_exec_cb() - register execution callback 261 * @tb: the opaque qemu_plugin_tb handle for the translation 262 * @cb: callback function 263 * @flags: does the plugin read or write the CPU's registers? 264 * @userdata: any plugin data to pass to the @cb? 265 * 266 * The @cb function is called every time a translated unit executes. 267 */ 268 void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb, 269 qemu_plugin_vcpu_udata_cb_t cb, 270 enum qemu_plugin_cb_flags flags, 271 void *userdata); 272 273 /** 274 * enum qemu_plugin_op - describes an inline op 275 * 276 * @QEMU_PLUGIN_INLINE_ADD_U64: add an immediate value uint64_t 277 * 278 * Note: currently only a single inline op is supported. 279 */ 280 281 enum qemu_plugin_op { 282 QEMU_PLUGIN_INLINE_ADD_U64, 283 }; 284 285 /** 286 * qemu_plugin_register_vcpu_tb_exec_inline() - execution inline op 287 * @tb: the opaque qemu_plugin_tb handle for the translation 288 * @op: the type of qemu_plugin_op (e.g. ADD_U64) 289 * @ptr: the target memory location for the op 290 * @imm: the op data (e.g. 1) 291 * 292 * Insert an inline op to every time a translated unit executes. 293 * Useful if you just want to increment a single counter somewhere in 294 * memory. 295 * 296 * Note: ops are not atomic so in multi-threaded/multi-smp situations 297 * you will get inexact results. 298 */ 299 void qemu_plugin_register_vcpu_tb_exec_inline(struct qemu_plugin_tb *tb, 300 enum qemu_plugin_op op, 301 void *ptr, uint64_t imm); 302 303 /** 304 * qemu_plugin_register_vcpu_insn_exec_cb() - register insn execution cb 305 * @insn: the opaque qemu_plugin_insn handle for an instruction 306 * @cb: callback function 307 * @flags: does the plugin read or write the CPU's registers? 308 * @userdata: any plugin data to pass to the @cb? 309 * 310 * The @cb function is called every time an instruction is executed 311 */ 312 void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn, 313 qemu_plugin_vcpu_udata_cb_t cb, 314 enum qemu_plugin_cb_flags flags, 315 void *userdata); 316 317 /** 318 * qemu_plugin_register_vcpu_insn_exec_inline() - insn execution inline op 319 * @insn: the opaque qemu_plugin_insn handle for an instruction 320 * @op: the type of qemu_plugin_op (e.g. ADD_U64) 321 * @ptr: the target memory location for the op 322 * @imm: the op data (e.g. 1) 323 * 324 * Insert an inline op to every time an instruction executes. Useful 325 * if you just want to increment a single counter somewhere in memory. 326 */ 327 void qemu_plugin_register_vcpu_insn_exec_inline(struct qemu_plugin_insn *insn, 328 enum qemu_plugin_op op, 329 void *ptr, uint64_t imm); 330 331 /** 332 * qemu_plugin_tb_n_insns() - query helper for number of insns in TB 333 * @tb: opaque handle to TB passed to callback 334 * 335 * Returns: number of instructions in this block 336 */ 337 size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb); 338 339 /** 340 * qemu_plugin_tb_vaddr() - query helper for vaddr of TB start 341 * @tb: opaque handle to TB passed to callback 342 * 343 * Returns: virtual address of block start 344 */ 345 uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb); 346 347 /** 348 * qemu_plugin_tb_get_insn() - retrieve handle for instruction 349 * @tb: opaque handle to TB passed to callback 350 * @idx: instruction number, 0 indexed 351 * 352 * The returned handle can be used in follow up helper queries as well 353 * as when instrumenting an instruction. It is only valid for the 354 * lifetime of the callback. 355 * 356 * Returns: opaque handle to instruction 357 */ 358 struct qemu_plugin_insn * 359 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx); 360 361 /** 362 * qemu_plugin_insn_data() - return ptr to instruction data 363 * @insn: opaque instruction handle from qemu_plugin_tb_get_insn() 364 * 365 * Note: data is only valid for duration of callback. See 366 * qemu_plugin_insn_size() to calculate size of stream. 367 * 368 * Returns: pointer to a stream of bytes containing the value of this 369 * instructions opcode. 370 */ 371 const void *qemu_plugin_insn_data(const struct qemu_plugin_insn *insn); 372 373 /** 374 * qemu_plugin_insn_size() - return size of instruction 375 * @insn: opaque instruction handle from qemu_plugin_tb_get_insn() 376 * 377 * Returns: size of instruction in bytes 378 */ 379 size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn); 380 381 /** 382 * qemu_plugin_insn_vaddr() - return vaddr of instruction 383 * @insn: opaque instruction handle from qemu_plugin_tb_get_insn() 384 * 385 * Returns: virtual address of instruction 386 */ 387 uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn); 388 389 /** 390 * qemu_plugin_insn_haddr() - return hardware addr of instruction 391 * @insn: opaque instruction handle from qemu_plugin_tb_get_insn() 392 * 393 * Returns: hardware (physical) target address of instruction 394 */ 395 void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn); 396 397 /** 398 * typedef qemu_plugin_meminfo_t - opaque memory transaction handle 399 * 400 * This can be further queried using the qemu_plugin_mem_* query 401 * functions. 402 */ 403 typedef uint32_t qemu_plugin_meminfo_t; 404 /** struct qemu_plugin_hwaddr - opaque hw address handle */ 405 struct qemu_plugin_hwaddr; 406 407 /** 408 * qemu_plugin_mem_size_shift() - get size of access 409 * @info: opaque memory transaction handle 410 * 411 * Returns: size of access in ^2 (0=byte, 1=16bit, 2=32bit etc...) 412 */ 413 unsigned int qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info); 414 /** 415 * qemu_plugin_mem_is_sign_extended() - was the access sign extended 416 * @info: opaque memory transaction handle 417 * 418 * Returns: true if it was, otherwise false 419 */ 420 bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info); 421 /** 422 * qemu_plugin_mem_is_big_endian() - was the access big endian 423 * @info: opaque memory transaction handle 424 * 425 * Returns: true if it was, otherwise false 426 */ 427 bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info); 428 /** 429 * qemu_plugin_mem_is_store() - was the access a store 430 * @info: opaque memory transaction handle 431 * 432 * Returns: true if it was, otherwise false 433 */ 434 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info); 435 436 /** 437 * qemu_plugin_get_hwaddr() - return handle for memory operation 438 * @info: opaque memory info structure 439 * @vaddr: the virtual address of the memory operation 440 * 441 * For system emulation returns a qemu_plugin_hwaddr handle to query 442 * details about the actual physical address backing the virtual 443 * address. For linux-user guests it just returns NULL. 444 * 445 * This handle is *only* valid for the duration of the callback. Any 446 * information about the handle should be recovered before the 447 * callback returns. 448 */ 449 struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info, 450 uint64_t vaddr); 451 452 /* 453 * The following additional queries can be run on the hwaddr structure to 454 * return information about it - namely whether it is for an IO access and the 455 * physical address associated with the access. 456 */ 457 458 /** 459 * qemu_plugin_hwaddr_is_io() - query whether memory operation is IO 460 * @haddr: address handle from qemu_plugin_get_hwaddr() 461 * 462 * Returns true if the handle's memory operation is to memory-mapped IO, or 463 * false if it is to RAM 464 */ 465 bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr); 466 467 /** 468 * qemu_plugin_hwaddr_phys_addr() - query physical address for memory operation 469 * @haddr: address handle from qemu_plugin_get_hwaddr() 470 * 471 * Returns the physical address associated with the memory operation 472 * 473 * Note that the returned physical address may not be unique if you are dealing 474 * with multiple address spaces. 475 */ 476 uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr); 477 478 /* 479 * Returns a string representing the device. The string is valid for 480 * the lifetime of the plugin. 481 */ 482 const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h); 483 484 typedef void 485 (*qemu_plugin_vcpu_mem_cb_t)(unsigned int vcpu_index, 486 qemu_plugin_meminfo_t info, uint64_t vaddr, 487 void *userdata); 488 489 void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn, 490 qemu_plugin_vcpu_mem_cb_t cb, 491 enum qemu_plugin_cb_flags flags, 492 enum qemu_plugin_mem_rw rw, 493 void *userdata); 494 495 void qemu_plugin_register_vcpu_mem_inline(struct qemu_plugin_insn *insn, 496 enum qemu_plugin_mem_rw rw, 497 enum qemu_plugin_op op, void *ptr, 498 uint64_t imm); 499 500 501 502 typedef void 503 (*qemu_plugin_vcpu_syscall_cb_t)(qemu_plugin_id_t id, unsigned int vcpu_index, 504 int64_t num, uint64_t a1, uint64_t a2, 505 uint64_t a3, uint64_t a4, uint64_t a5, 506 uint64_t a6, uint64_t a7, uint64_t a8); 507 508 void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id, 509 qemu_plugin_vcpu_syscall_cb_t cb); 510 511 typedef void 512 (*qemu_plugin_vcpu_syscall_ret_cb_t)(qemu_plugin_id_t id, unsigned int vcpu_idx, 513 int64_t num, int64_t ret); 514 515 void 516 qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id, 517 qemu_plugin_vcpu_syscall_ret_cb_t cb); 518 519 520 /** 521 * qemu_plugin_insn_disas() - return disassembly string for instruction 522 * @insn: instruction reference 523 * 524 * Returns an allocated string containing the disassembly 525 */ 526 527 char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn); 528 529 /** 530 * qemu_plugin_insn_symbol() - best effort symbol lookup 531 * @insn: instruction reference 532 * 533 * Return a static string referring to the symbol. This is dependent 534 * on the binary QEMU is running having provided a symbol table. 535 */ 536 const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn); 537 538 /** 539 * qemu_plugin_vcpu_for_each() - iterate over the existing vCPU 540 * @id: plugin ID 541 * @cb: callback function 542 * 543 * The @cb function is called once for each existing vCPU. 544 * 545 * See also: qemu_plugin_register_vcpu_init_cb() 546 */ 547 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 548 qemu_plugin_vcpu_simple_cb_t cb); 549 550 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 551 qemu_plugin_simple_cb_t cb); 552 553 /** 554 * qemu_plugin_register_atexit_cb() - register exit callback 555 * @id: plugin ID 556 * @cb: callback 557 * @userdata: user data for callback 558 * 559 * The @cb function is called once execution has finished. Plugins 560 * should be able to free all their resources at this point much like 561 * after a reset/uninstall callback is called. 562 * 563 * In user-mode it is possible a few un-instrumented instructions from 564 * child threads may run before the host kernel reaps the threads. 565 */ 566 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 567 qemu_plugin_udata_cb_t cb, void *userdata); 568 569 /* returns -1 in user-mode */ 570 int qemu_plugin_n_vcpus(void); 571 572 /* returns -1 in user-mode */ 573 int qemu_plugin_n_max_vcpus(void); 574 575 /** 576 * qemu_plugin_outs() - output string via QEMU's logging system 577 * @string: a string 578 */ 579 void qemu_plugin_outs(const char *string); 580 581 /** 582 * qemu_plugin_bool_parse() - parses a boolean argument in the form of 583 * "<argname>=[on|yes|true|off|no|false]" 584 * 585 * @name: argument name, the part before the equals sign 586 * @val: argument value, what's after the equals sign 587 * @ret: output return value 588 * 589 * returns true if the combination @name=@val parses correctly to a boolean 590 * argument, and false otherwise 591 */ 592 bool qemu_plugin_bool_parse(const char *name, const char *val, bool *ret); 593 594 /** 595 * qemu_plugin_path_to_binary() - path to binary file being executed 596 * 597 * Return a string representing the path to the binary. For user-mode 598 * this is the main executable. For system emulation we currently 599 * return NULL. The user should g_free() the string once no longer 600 * needed. 601 */ 602 const char *qemu_plugin_path_to_binary(void); 603 604 /** 605 * qemu_plugin_start_code() - returns start of text segment 606 * 607 * Returns the nominal start address of the main text segment in 608 * user-mode. Currently returns 0 for system emulation. 609 */ 610 uint64_t qemu_plugin_start_code(void); 611 612 /** 613 * qemu_plugin_end_code() - returns end of text segment 614 * 615 * Returns the nominal end address of the main text segment in 616 * user-mode. Currently returns 0 for system emulation. 617 */ 618 uint64_t qemu_plugin_end_code(void); 619 620 /** 621 * qemu_plugin_entry_code() - returns start address for module 622 * 623 * Returns the nominal entry address of the main text segment in 624 * user-mode. Currently returns 0 for system emulation. 625 */ 626 uint64_t qemu_plugin_entry_code(void); 627 628 #endif /* QEMU_QEMU_PLUGIN_H */ 629