1 /* 2 * QEMU Plugin API 3 * 4 * This provides the API that is available to the plugins to interact 5 * with QEMU. We have to be careful not to expose internal details of 6 * how QEMU works so we abstract out things like translation and 7 * instructions to anonymous data types: 8 * 9 * qemu_plugin_tb 10 * qemu_plugin_insn 11 * qemu_plugin_register 12 * 13 * Which can then be passed back into the API to do additional things. 14 * As such all the public functions in here are exported in 15 * qemu-plugin.h. 16 * 17 * The general life-cycle of a plugin is: 18 * 19 * - plugin is loaded, public qemu_plugin_install called 20 * - the install func registers callbacks for events 21 * - usually an atexit_cb is registered to dump info at the end 22 * - when a registered event occurs the plugin is called 23 * - some events pass additional info 24 * - during translation the plugin can decide to instrument any 25 * instruction 26 * - when QEMU exits all the registered atexit callbacks are called 27 * 28 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 29 * Copyright (C) 2019, Linaro 30 * 31 * License: GNU GPL, version 2 or later. 32 * See the COPYING file in the top-level directory. 33 * 34 * SPDX-License-Identifier: GPL-2.0-or-later 35 * 36 */ 37 38 #include "qemu/osdep.h" 39 #include "qemu/main-loop.h" 40 #include "qemu/plugin.h" 41 #include "qemu/log.h" 42 #include "tcg/tcg.h" 43 #include "exec/exec-all.h" 44 #include "exec/gdbstub.h" 45 #include "exec/ram_addr.h" 46 #include "disas/disas.h" 47 #include "plugin.h" 48 #ifndef CONFIG_USER_ONLY 49 #include "qemu/plugin-memory.h" 50 #include "hw/boards.h" 51 #else 52 #include "qemu.h" 53 #ifdef CONFIG_LINUX 54 #include "loader.h" 55 #endif 56 #endif 57 58 /* Uninstall and Reset handlers */ 59 60 void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb) 61 { 62 plugin_reset_uninstall(id, cb, false); 63 } 64 65 void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb) 66 { 67 plugin_reset_uninstall(id, cb, true); 68 } 69 70 /* 71 * Plugin Register Functions 72 * 73 * This allows the plugin to register callbacks for various events 74 * during the translation. 75 */ 76 77 void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id, 78 qemu_plugin_vcpu_simple_cb_t cb) 79 { 80 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INIT, cb); 81 } 82 83 void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id, 84 qemu_plugin_vcpu_simple_cb_t cb) 85 { 86 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXIT, cb); 87 } 88 89 void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb, 90 qemu_plugin_vcpu_udata_cb_t cb, 91 enum qemu_plugin_cb_flags flags, 92 void *udata) 93 { 94 if (!tb->mem_only) { 95 int index = flags == QEMU_PLUGIN_CB_R_REGS || 96 flags == QEMU_PLUGIN_CB_RW_REGS ? 97 PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR; 98 99 plugin_register_dyn_cb__udata(&tb->cbs[index], 100 cb, flags, udata); 101 } 102 } 103 104 void qemu_plugin_register_vcpu_tb_exec_inline(struct qemu_plugin_tb *tb, 105 enum qemu_plugin_op op, 106 void *ptr, uint64_t imm) 107 { 108 if (!tb->mem_only) { 109 plugin_register_inline_op(&tb->cbs[PLUGIN_CB_INLINE], 110 0, op, ptr, imm); 111 } 112 } 113 114 void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn, 115 qemu_plugin_vcpu_udata_cb_t cb, 116 enum qemu_plugin_cb_flags flags, 117 void *udata) 118 { 119 if (!insn->mem_only) { 120 int index = flags == QEMU_PLUGIN_CB_R_REGS || 121 flags == QEMU_PLUGIN_CB_RW_REGS ? 122 PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR; 123 124 plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][index], 125 cb, flags, udata); 126 } 127 } 128 129 void qemu_plugin_register_vcpu_insn_exec_inline(struct qemu_plugin_insn *insn, 130 enum qemu_plugin_op op, 131 void *ptr, uint64_t imm) 132 { 133 if (!insn->mem_only) { 134 plugin_register_inline_op(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], 135 0, op, ptr, imm); 136 } 137 } 138 139 140 /* 141 * We always plant memory instrumentation because they don't finalise until 142 * after the operation has complete. 143 */ 144 void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn, 145 qemu_plugin_vcpu_mem_cb_t cb, 146 enum qemu_plugin_cb_flags flags, 147 enum qemu_plugin_mem_rw rw, 148 void *udata) 149 { 150 plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], 151 cb, flags, rw, udata); 152 } 153 154 void qemu_plugin_register_vcpu_mem_inline(struct qemu_plugin_insn *insn, 155 enum qemu_plugin_mem_rw rw, 156 enum qemu_plugin_op op, void *ptr, 157 uint64_t imm) 158 { 159 plugin_register_inline_op(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE], 160 rw, op, ptr, imm); 161 } 162 163 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id, 164 qemu_plugin_vcpu_tb_trans_cb_t cb) 165 { 166 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_TB_TRANS, cb); 167 } 168 169 void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id, 170 qemu_plugin_vcpu_syscall_cb_t cb) 171 { 172 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL, cb); 173 } 174 175 void 176 qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id, 177 qemu_plugin_vcpu_syscall_ret_cb_t cb) 178 { 179 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET, cb); 180 } 181 182 /* 183 * Plugin Queries 184 * 185 * These are queries that the plugin can make to gauge information 186 * from our opaque data types. We do not want to leak internal details 187 * here just information useful to the plugin. 188 */ 189 190 /* 191 * Translation block information: 192 * 193 * A plugin can query the virtual address of the start of the block 194 * and the number of instructions in it. It can also get access to 195 * each translated instruction. 196 */ 197 198 size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb) 199 { 200 return tb->n; 201 } 202 203 uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb) 204 { 205 return tb->vaddr; 206 } 207 208 struct qemu_plugin_insn * 209 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx) 210 { 211 struct qemu_plugin_insn *insn; 212 if (unlikely(idx >= tb->n)) { 213 return NULL; 214 } 215 insn = g_ptr_array_index(tb->insns, idx); 216 insn->mem_only = tb->mem_only; 217 return insn; 218 } 219 220 /* 221 * Instruction information 222 * 223 * These queries allow the plugin to retrieve information about each 224 * instruction being translated. 225 */ 226 227 const void *qemu_plugin_insn_data(const struct qemu_plugin_insn *insn) 228 { 229 return insn->data->data; 230 } 231 232 size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn) 233 { 234 return insn->data->len; 235 } 236 237 uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn) 238 { 239 return insn->vaddr; 240 } 241 242 void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn) 243 { 244 return insn->haddr; 245 } 246 247 char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn) 248 { 249 CPUState *cpu = current_cpu; 250 return plugin_disas(cpu, insn->vaddr, insn->data->len); 251 } 252 253 const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn) 254 { 255 const char *sym = lookup_symbol(insn->vaddr); 256 return sym[0] != 0 ? sym : NULL; 257 } 258 259 /* 260 * The memory queries allow the plugin to query information about a 261 * memory access. 262 */ 263 264 unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info) 265 { 266 MemOp op = get_memop(info); 267 return op & MO_SIZE; 268 } 269 270 bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info) 271 { 272 MemOp op = get_memop(info); 273 return op & MO_SIGN; 274 } 275 276 bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info) 277 { 278 MemOp op = get_memop(info); 279 return (op & MO_BSWAP) == MO_BE; 280 } 281 282 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info) 283 { 284 return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W; 285 } 286 287 /* 288 * Virtual Memory queries 289 */ 290 291 #ifdef CONFIG_SOFTMMU 292 static __thread struct qemu_plugin_hwaddr hwaddr_info; 293 #endif 294 295 struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info, 296 uint64_t vaddr) 297 { 298 #ifdef CONFIG_SOFTMMU 299 CPUState *cpu = current_cpu; 300 unsigned int mmu_idx = get_mmuidx(info); 301 enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info); 302 hwaddr_info.is_store = (rw & QEMU_PLUGIN_MEM_W) != 0; 303 304 assert(mmu_idx < NB_MMU_MODES); 305 306 if (!tlb_plugin_lookup(cpu, vaddr, mmu_idx, 307 hwaddr_info.is_store, &hwaddr_info)) { 308 error_report("invalid use of qemu_plugin_get_hwaddr"); 309 return NULL; 310 } 311 312 return &hwaddr_info; 313 #else 314 return NULL; 315 #endif 316 } 317 318 bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr) 319 { 320 #ifdef CONFIG_SOFTMMU 321 return haddr->is_io; 322 #else 323 return false; 324 #endif 325 } 326 327 uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr) 328 { 329 #ifdef CONFIG_SOFTMMU 330 if (haddr) { 331 return haddr->phys_addr; 332 } 333 #endif 334 return 0; 335 } 336 337 const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h) 338 { 339 #ifdef CONFIG_SOFTMMU 340 if (h && h->is_io) { 341 MemoryRegion *mr = h->mr; 342 if (!mr->name) { 343 unsigned maddr = (uintptr_t)mr; 344 g_autofree char *temp = g_strdup_printf("anon%08x", maddr); 345 return g_intern_string(temp); 346 } else { 347 return g_intern_string(mr->name); 348 } 349 } else { 350 return g_intern_static_string("RAM"); 351 } 352 #else 353 return g_intern_static_string("Invalid"); 354 #endif 355 } 356 357 int qemu_plugin_num_vcpus(void) 358 { 359 return plugin_num_vcpus(); 360 } 361 362 /* 363 * Plugin output 364 */ 365 void qemu_plugin_outs(const char *string) 366 { 367 qemu_log_mask(CPU_LOG_PLUGIN, "%s", string); 368 } 369 370 bool qemu_plugin_bool_parse(const char *name, const char *value, bool *ret) 371 { 372 return name && value && qapi_bool_parse(name, value, ret, NULL); 373 } 374 375 /* 376 * Binary path, start and end locations 377 */ 378 const char *qemu_plugin_path_to_binary(void) 379 { 380 char *path = NULL; 381 #ifdef CONFIG_USER_ONLY 382 TaskState *ts = get_task_state(current_cpu); 383 path = g_strdup(ts->bprm->filename); 384 #endif 385 return path; 386 } 387 388 uint64_t qemu_plugin_start_code(void) 389 { 390 uint64_t start = 0; 391 #ifdef CONFIG_USER_ONLY 392 TaskState *ts = get_task_state(current_cpu); 393 start = ts->info->start_code; 394 #endif 395 return start; 396 } 397 398 uint64_t qemu_plugin_end_code(void) 399 { 400 uint64_t end = 0; 401 #ifdef CONFIG_USER_ONLY 402 TaskState *ts = get_task_state(current_cpu); 403 end = ts->info->end_code; 404 #endif 405 return end; 406 } 407 408 uint64_t qemu_plugin_entry_code(void) 409 { 410 uint64_t entry = 0; 411 #ifdef CONFIG_USER_ONLY 412 TaskState *ts = get_task_state(current_cpu); 413 entry = ts->info->entry; 414 #endif 415 return entry; 416 } 417 418 /* 419 * Create register handles. 420 * 421 * We need to create a handle for each register so the plugin 422 * infrastructure can call gdbstub to read a register. They are 423 * currently just a pointer encapsulation of the gdb_reg but in 424 * future may hold internal plugin state so its important plugin 425 * authors are not tempted to treat them as numbers. 426 * 427 * We also construct a result array with those handles and some 428 * ancillary data the plugin might find useful. 429 */ 430 431 static GArray *create_register_handles(GArray *gdbstub_regs) 432 { 433 GArray *find_data = g_array_new(true, true, 434 sizeof(qemu_plugin_reg_descriptor)); 435 436 for (int i = 0; i < gdbstub_regs->len; i++) { 437 GDBRegDesc *grd = &g_array_index(gdbstub_regs, GDBRegDesc, i); 438 qemu_plugin_reg_descriptor desc; 439 440 /* skip "un-named" regs */ 441 if (!grd->name) { 442 continue; 443 } 444 445 /* Create a record for the plugin */ 446 desc.handle = GINT_TO_POINTER(grd->gdb_reg); 447 desc.name = g_intern_string(grd->name); 448 desc.feature = g_intern_string(grd->feature_name); 449 g_array_append_val(find_data, desc); 450 } 451 452 return find_data; 453 } 454 455 GArray *qemu_plugin_get_registers(void) 456 { 457 g_assert(current_cpu); 458 459 g_autoptr(GArray) regs = gdb_get_register_list(current_cpu); 460 return create_register_handles(regs); 461 } 462 463 int qemu_plugin_read_register(struct qemu_plugin_register *reg, GByteArray *buf) 464 { 465 g_assert(current_cpu); 466 467 return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg)); 468 } 469 470 struct qemu_plugin_scoreboard *qemu_plugin_scoreboard_new(size_t element_size) 471 { 472 return plugin_scoreboard_new(element_size); 473 } 474 475 void qemu_plugin_scoreboard_free(struct qemu_plugin_scoreboard *score) 476 { 477 plugin_scoreboard_free(score); 478 } 479 480 void *qemu_plugin_scoreboard_find(struct qemu_plugin_scoreboard *score, 481 unsigned int vcpu_index) 482 { 483 g_assert(vcpu_index < qemu_plugin_num_vcpus()); 484 /* we can't use g_array_index since entry size is not statically known */ 485 char *base_ptr = score->data->data; 486 return base_ptr + vcpu_index * g_array_get_element_size(score->data); 487 } 488 489 static uint64_t *plugin_u64_address(qemu_plugin_u64 entry, 490 unsigned int vcpu_index) 491 { 492 char *ptr = qemu_plugin_scoreboard_find(entry.score, vcpu_index); 493 return (uint64_t *)(ptr + entry.offset); 494 } 495 496 void qemu_plugin_u64_add(qemu_plugin_u64 entry, unsigned int vcpu_index, 497 uint64_t added) 498 { 499 *plugin_u64_address(entry, vcpu_index) += added; 500 } 501 502 uint64_t qemu_plugin_u64_get(qemu_plugin_u64 entry, 503 unsigned int vcpu_index) 504 { 505 return *plugin_u64_address(entry, vcpu_index); 506 } 507 508 void qemu_plugin_u64_set(qemu_plugin_u64 entry, unsigned int vcpu_index, 509 uint64_t val) 510 { 511 *plugin_u64_address(entry, vcpu_index) = val; 512 } 513 514 uint64_t qemu_plugin_u64_sum(qemu_plugin_u64 entry) 515 { 516 uint64_t total = 0; 517 for (int i = 0, n = qemu_plugin_num_vcpus(); i < n; ++i) { 518 total += qemu_plugin_u64_get(entry, i); 519 } 520 return total; 521 } 522