plugins/api.c

   1 /*
   2  * QEMU Plugin API
   3  *
   4  * This provides the API that is available to the plugins to interact
   5  * with QEMU. We have to be careful not to expose internal details of
   6  * how QEMU works so we abstract out things like translation and
   7  * instructions to anonymous data types:
   8  *
   9  *  qemu_plugin_tb
  10  *  qemu_plugin_insn
  11  *  qemu_plugin_register
  12  *
  13  * Which can then be passed back into the API to do additional things.
  14  * As such all the public functions in here are exported in
  15  * qemu-plugin.h.
  16  *
  17  * The general life-cycle of a plugin is:
  18  *
  19  *  - plugin is loaded, public qemu_plugin_install called
  20  *    - the install func registers callbacks for events
  21  *    - usually an atexit_cb is registered to dump info at the end
  22  *  - when a registered event occurs the plugin is called
  23  *     - some events pass additional info
  24  *     - during translation the plugin can decide to instrument any
  25  *       instruction
  26  *  - when QEMU exits all the registered atexit callbacks are called
  27  *
  28  * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
  29  * Copyright (C) 2019, Linaro
  30  *
  31  * License: GNU GPL, version 2 or later.
  32  *   See the COPYING file in the top-level directory.
  33  *
  34  * SPDX-License-Identifier: GPL-2.0-or-later
  35  *
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/main-loop.h"
  40 #include "qemu/plugin.h"
  41 #include "qemu/log.h"
  42 #include "qemu/timer.h"
  43 #include "tcg/tcg.h"
  44 #include "exec/exec-all.h"
  45 #include "exec/gdbstub.h"
  46 #include "exec/translator.h"
  47 #include "disas/disas.h"
  48 #include "plugin.h"
  49 #ifndef CONFIG_USER_ONLY
  50 #include "qapi/error.h"
  51 #include "migration/blocker.h"
  52 #include "exec/ram_addr.h"
  53 #include "qemu/plugin-memory.h"
  54 #include "hw/boards.h"
  55 #else
  56 #include "qemu.h"
  57 #ifdef CONFIG_LINUX
  58 #include "loader.h"
  59 #endif
  60 #endif
  61
  62 /* Uninstall and Reset handlers */
  63
  64 void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb)
  65 {
  66     plugin_reset_uninstall(id, cb, false);
  67 }
  68
  69 void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb)
  70 {
  71     plugin_reset_uninstall(id, cb, true);
  72 }
  73
  74 /*
  75  * Plugin Register Functions
  76  *
  77  * This allows the plugin to register callbacks for various events
  78  * during the translation.
  79  */
  80
  81 void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id,
  82                                        qemu_plugin_vcpu_simple_cb_t cb)
  83 {
  84     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INIT, cb);
  85 }
  86
  87 void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id,
  88                                        qemu_plugin_vcpu_simple_cb_t cb)
  89 {
  90     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXIT, cb);
  91 }
  92
  93 static bool tb_is_mem_only(void)
  94 {
  95     return tb_cflags(tcg_ctx->gen_tb) & CF_MEMI_ONLY;
  96 }
  97
  98 void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
  99                                           qemu_plugin_vcpu_udata_cb_t cb,
 100                                           enum qemu_plugin_cb_flags flags,
 101                                           void *udata)
 102 {
 103     if (!tb_is_mem_only()) {
 104         plugin_register_dyn_cb__udata(&tb->cbs, cb, flags, udata);
 105     }
 106 }
 107
 108 void qemu_plugin_register_vcpu_tb_exec_cond_cb(struct qemu_plugin_tb *tb,
 109                                                qemu_plugin_vcpu_udata_cb_t cb,
 110                                                enum qemu_plugin_cb_flags flags,
 111                                                enum qemu_plugin_cond cond,
 112                                                qemu_plugin_u64 entry,
 113                                                uint64_t imm,
 114                                                void *udata)
 115 {
 116     if (cond == QEMU_PLUGIN_COND_NEVER || tb_is_mem_only()) {
 117         return;
 118     }
 119     if (cond == QEMU_PLUGIN_COND_ALWAYS) {
 120         qemu_plugin_register_vcpu_tb_exec_cb(tb, cb, flags, udata);
 121         return;
 122     }
 123     plugin_register_dyn_cond_cb__udata(&tb->cbs, cb, flags,
 124                                        cond, entry, imm, udata);
 125 }
 126
 127 void qemu_plugin_register_vcpu_tb_exec_inline_per_vcpu(
 128     struct qemu_plugin_tb *tb,
 129     enum qemu_plugin_op op,
 130     qemu_plugin_u64 entry,
 131     uint64_t imm)
 132 {
 133     if (!tb_is_mem_only()) {
 134         plugin_register_inline_op_on_entry(&tb->cbs, 0, op, entry, imm);
 135     }
 136 }
 137
 138 void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
 139                                             qemu_plugin_vcpu_udata_cb_t cb,
 140                                             enum qemu_plugin_cb_flags flags,
 141                                             void *udata)
 142 {
 143     if (!tb_is_mem_only()) {
 144         plugin_register_dyn_cb__udata(&insn->insn_cbs, cb, flags, udata);
 145     }
 146 }
 147
 148 void qemu_plugin_register_vcpu_insn_exec_cond_cb(
 149     struct qemu_plugin_insn *insn,
 150     qemu_plugin_vcpu_udata_cb_t cb,
 151     enum qemu_plugin_cb_flags flags,
 152     enum qemu_plugin_cond cond,
 153     qemu_plugin_u64 entry,
 154     uint64_t imm,
 155     void *udata)
 156 {
 157     if (cond == QEMU_PLUGIN_COND_NEVER || tb_is_mem_only()) {
 158         return;
 159     }
 160     if (cond == QEMU_PLUGIN_COND_ALWAYS) {
 161         qemu_plugin_register_vcpu_insn_exec_cb(insn, cb, flags, udata);
 162         return;
 163     }
 164     plugin_register_dyn_cond_cb__udata(&insn->insn_cbs, cb, flags,
 165                                        cond, entry, imm, udata);
 166 }
 167
 168 void qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(
 169     struct qemu_plugin_insn *insn,
 170     enum qemu_plugin_op op,
 171     qemu_plugin_u64 entry,
 172     uint64_t imm)
 173 {
 174     if (!tb_is_mem_only()) {
 175         plugin_register_inline_op_on_entry(&insn->insn_cbs, 0, op, entry, imm);
 176     }
 177 }
 178
 179
 180 /*
 181  * We always plant memory instrumentation because they don't finalise until
 182  * after the operation has complete.
 183  */
 184 void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn,
 185                                       qemu_plugin_vcpu_mem_cb_t cb,
 186                                       enum qemu_plugin_cb_flags flags,
 187                                       enum qemu_plugin_mem_rw rw,
 188                                       void *udata)
 189 {
 190     plugin_register_vcpu_mem_cb(&insn->mem_cbs, cb, flags, rw, udata);
 191 }
 192
 193 void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
 194     struct qemu_plugin_insn *insn,
 195     enum qemu_plugin_mem_rw rw,
 196     enum qemu_plugin_op op,
 197     qemu_plugin_u64 entry,
 198     uint64_t imm)
 199 {
 200     plugin_register_inline_op_on_entry(&insn->mem_cbs, rw, op, entry, imm);
 201 }
 202
 203 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id,
 204                                            qemu_plugin_vcpu_tb_trans_cb_t cb)
 205 {
 206     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_TB_TRANS, cb);
 207 }
 208
 209 void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id,
 210                                           qemu_plugin_vcpu_syscall_cb_t cb)
 211 {
 212     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL, cb);
 213 }
 214
 215 void
 216 qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id,
 217                                          qemu_plugin_vcpu_syscall_ret_cb_t cb)
 218 {
 219     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET, cb);
 220 }
 221
 222 /*
 223  * Plugin Queries
 224  *
 225  * These are queries that the plugin can make to gauge information
 226  * from our opaque data types. We do not want to leak internal details
 227  * here just information useful to the plugin.
 228  */
 229
 230 /*
 231  * Translation block information:
 232  *
 233  * A plugin can query the virtual address of the start of the block
 234  * and the number of instructions in it. It can also get access to
 235  * each translated instruction.
 236  */
 237
 238 size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb)
 239 {
 240     return tb->n;
 241 }
 242
 243 uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb)
 244 {
 245     const DisasContextBase *db = tcg_ctx->plugin_db;
 246     return db->pc_first;
 247 }
 248
 249 struct qemu_plugin_insn *
 250 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx)
 251 {
 252     struct qemu_plugin_insn *insn;
 253     if (unlikely(idx >= tb->n)) {
 254         return NULL;
 255     }
 256     insn = g_ptr_array_index(tb->insns, idx);
 257     return insn;
 258 }
 259
 260 /*
 261  * Instruction information
 262  *
 263  * These queries allow the plugin to retrieve information about each
 264  * instruction being translated.
 265  */
 266
 267 size_t qemu_plugin_insn_data(const struct qemu_plugin_insn *insn,
 268                              void *dest, size_t len)
 269 {
 270     const DisasContextBase *db = tcg_ctx->plugin_db;
 271
 272     len = MIN(len, insn->len);
 273     return translator_st(db, dest, insn->vaddr, len) ? len : 0;
 274 }
 275
 276 size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn)
 277 {
 278     return insn->len;
 279 }
 280
 281 uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn)
 282 {
 283     return insn->vaddr;
 284 }
 285
 286 void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn)
 287 {
 288     const DisasContextBase *db = tcg_ctx->plugin_db;
 289     vaddr page0_last = db->pc_first | ~TARGET_PAGE_MASK;
 290
 291     if (db->fake_insn) {
 292         return NULL;
 293     }
 294
 295     /*
 296      * ??? The return value is not intended for use of host memory,
 297      * but as a proxy for address space and physical address.
 298      * Thus we are only interested in the first byte and do not
 299      * care about spanning pages.
 300      */
 301     if (insn->vaddr <= page0_last) {
 302         if (db->host_addr[0] == NULL) {
 303             return NULL;
 304         }
 305         return db->host_addr[0] + insn->vaddr - db->pc_first;
 306     } else {
 307         if (db->host_addr[1] == NULL) {
 308             return NULL;
 309         }
 310         return db->host_addr[1] + insn->vaddr - (page0_last + 1);
 311     }
 312 }
 313
 314 char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn)
 315 {
 316     return plugin_disas(tcg_ctx->cpu, tcg_ctx->plugin_db,
 317                         insn->vaddr, insn->len);
 318 }
 319
 320 const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn)
 321 {
 322     const char *sym = lookup_symbol(insn->vaddr);
 323     return sym[0] != 0 ? sym : NULL;
 324 }
 325
 326 /*
 327  * The memory queries allow the plugin to query information about a
 328  * memory access.
 329  */
 330
 331 unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info)
 332 {
 333     MemOp op = get_memop(info);
 334     return op & MO_SIZE;
 335 }
 336
 337 bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info)
 338 {
 339     MemOp op = get_memop(info);
 340     return op & MO_SIGN;
 341 }
 342
 343 bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info)
 344 {
 345     MemOp op = get_memop(info);
 346     return (op & MO_BSWAP) == MO_BE;
 347 }
 348
 349 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info)
 350 {
 351     return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W;
 352 }
 353
 354 /*
 355  * Virtual Memory queries
 356  */
 357
 358 #ifdef CONFIG_SOFTMMU
 359 static __thread struct qemu_plugin_hwaddr hwaddr_info;
 360 #endif
 361
 362 struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info,
 363                                                   uint64_t vaddr)
 364 {
 365 #ifdef CONFIG_SOFTMMU
 366     CPUState *cpu = current_cpu;
 367     unsigned int mmu_idx = get_mmuidx(info);
 368     enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info);
 369     hwaddr_info.is_store = (rw & QEMU_PLUGIN_MEM_W) != 0;
 370
 371     assert(mmu_idx < NB_MMU_MODES);
 372
 373     if (!tlb_plugin_lookup(cpu, vaddr, mmu_idx,
 374                            hwaddr_info.is_store, &hwaddr_info)) {
 375         error_report("invalid use of qemu_plugin_get_hwaddr");
 376         return NULL;
 377     }
 378
 379     return &hwaddr_info;
 380 #else
 381     return NULL;
 382 #endif
 383 }
 384
 385 bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr)
 386 {
 387 #ifdef CONFIG_SOFTMMU
 388     return haddr->is_io;
 389 #else
 390     return false;
 391 #endif
 392 }
 393
 394 uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr)
 395 {
 396 #ifdef CONFIG_SOFTMMU
 397     if (haddr) {
 398         return haddr->phys_addr;
 399     }
 400 #endif
 401     return 0;
 402 }
 403
 404 const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h)
 405 {
 406 #ifdef CONFIG_SOFTMMU
 407     if (h && h->is_io) {
 408         MemoryRegion *mr = h->mr;
 409         if (!mr->name) {
 410             unsigned maddr = (uintptr_t)mr;
 411             g_autofree char *temp = g_strdup_printf("anon%08x", maddr);
 412             return g_intern_string(temp);
 413         } else {
 414             return g_intern_string(mr->name);
 415         }
 416     } else {
 417         return g_intern_static_string("RAM");
 418     }
 419 #else
 420     return g_intern_static_string("Invalid");
 421 #endif
 422 }
 423
 424 int qemu_plugin_num_vcpus(void)
 425 {
 426     return plugin_num_vcpus();
 427 }
 428
 429 /*
 430  * Plugin output
 431  */
 432 void qemu_plugin_outs(const char *string)
 433 {
 434     qemu_log_mask(CPU_LOG_PLUGIN, "%s", string);
 435 }
 436
 437 bool qemu_plugin_bool_parse(const char *name, const char *value, bool *ret)
 438 {
 439     return name && value && qapi_bool_parse(name, value, ret, NULL);
 440 }
 441
 442 /*
 443  * Binary path, start and end locations
 444  */
 445 const char *qemu_plugin_path_to_binary(void)
 446 {
 447     char *path = NULL;
 448 #ifdef CONFIG_USER_ONLY
 449     TaskState *ts = get_task_state(current_cpu);
 450     path = g_strdup(ts->bprm->filename);
 451 #endif
 452     return path;
 453 }
 454
 455 uint64_t qemu_plugin_start_code(void)
 456 {
 457     uint64_t start = 0;
 458 #ifdef CONFIG_USER_ONLY
 459     TaskState *ts = get_task_state(current_cpu);
 460     start = ts->info->start_code;
 461 #endif
 462     return start;
 463 }
 464
 465 uint64_t qemu_plugin_end_code(void)
 466 {
 467     uint64_t end = 0;
 468 #ifdef CONFIG_USER_ONLY
 469     TaskState *ts = get_task_state(current_cpu);
 470     end = ts->info->end_code;
 471 #endif
 472     return end;
 473 }
 474
 475 uint64_t qemu_plugin_entry_code(void)
 476 {
 477     uint64_t entry = 0;
 478 #ifdef CONFIG_USER_ONLY
 479     TaskState *ts = get_task_state(current_cpu);
 480     entry = ts->info->entry;
 481 #endif
 482     return entry;
 483 }
 484
 485 /*
 486  * Create register handles.
 487  *
 488  * We need to create a handle for each register so the plugin
 489  * infrastructure can call gdbstub to read a register. They are
 490  * currently just a pointer encapsulation of the gdb_reg but in
 491  * future may hold internal plugin state so its important plugin
 492  * authors are not tempted to treat them as numbers.
 493  *
 494  * We also construct a result array with those handles and some
 495  * ancillary data the plugin might find useful.
 496  */
 497
 498 static GArray *create_register_handles(GArray *gdbstub_regs)
 499 {
 500     GArray *find_data = g_array_new(true, true,
 501                                     sizeof(qemu_plugin_reg_descriptor));
 502
 503     for (int i = 0; i < gdbstub_regs->len; i++) {
 504         GDBRegDesc *grd = &g_array_index(gdbstub_regs, GDBRegDesc, i);
 505         qemu_plugin_reg_descriptor desc;
 506
 507         /* skip "un-named" regs */
 508         if (!grd->name) {
 509             continue;
 510         }
 511
 512         /* Create a record for the plugin */
 513         desc.handle = GINT_TO_POINTER(grd->gdb_reg + 1);
 514         desc.name = g_intern_string(grd->name);
 515         desc.feature = g_intern_string(grd->feature_name);
 516         g_array_append_val(find_data, desc);
 517     }
 518
 519     return find_data;
 520 }
 521
 522 GArray *qemu_plugin_get_registers(void)
 523 {
 524     g_assert(current_cpu);
 525
 526     g_autoptr(GArray) regs = gdb_get_register_list(current_cpu);
 527     return create_register_handles(regs);
 528 }
 529
 530 int qemu_plugin_read_register(struct qemu_plugin_register *reg, GByteArray *buf)
 531 {
 532     g_assert(current_cpu);
 533
 534     return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg) - 1);
 535 }
 536
 537 struct qemu_plugin_scoreboard *qemu_plugin_scoreboard_new(size_t element_size)
 538 {
 539     return plugin_scoreboard_new(element_size);
 540 }
 541
 542 void qemu_plugin_scoreboard_free(struct qemu_plugin_scoreboard *score)
 543 {
 544     plugin_scoreboard_free(score);
 545 }
 546
 547 void *qemu_plugin_scoreboard_find(struct qemu_plugin_scoreboard *score,
 548                                   unsigned int vcpu_index)
 549 {
 550     g_assert(vcpu_index < qemu_plugin_num_vcpus());
 551     /* we can't use g_array_index since entry size is not statically known */
 552     char *base_ptr = score->data->data;
 553     return base_ptr + vcpu_index * g_array_get_element_size(score->data);
 554 }
 555
 556 static uint64_t *plugin_u64_address(qemu_plugin_u64 entry,
 557                                     unsigned int vcpu_index)
 558 {
 559     char *ptr = qemu_plugin_scoreboard_find(entry.score, vcpu_index);
 560     return (uint64_t *)(ptr + entry.offset);
 561 }
 562
 563 void qemu_plugin_u64_add(qemu_plugin_u64 entry, unsigned int vcpu_index,
 564                          uint64_t added)
 565 {
 566     *plugin_u64_address(entry, vcpu_index) += added;
 567 }
 568
 569 uint64_t qemu_plugin_u64_get(qemu_plugin_u64 entry,
 570                              unsigned int vcpu_index)
 571 {
 572     return *plugin_u64_address(entry, vcpu_index);
 573 }
 574
 575 void qemu_plugin_u64_set(qemu_plugin_u64 entry, unsigned int vcpu_index,
 576                          uint64_t val)
 577 {
 578     *plugin_u64_address(entry, vcpu_index) = val;
 579 }
 580
 581 uint64_t qemu_plugin_u64_sum(qemu_plugin_u64 entry)
 582 {
 583     uint64_t total = 0;
 584     for (int i = 0, n = qemu_plugin_num_vcpus(); i < n; ++i) {
 585         total += qemu_plugin_u64_get(entry, i);
 586     }
 587     return total;
 588 }
 589
 590 /*
 591  * Time control
 592  */
 593 static bool has_control;
 594 #ifdef CONFIG_SOFTMMU
 595 static Error *migration_blocker;
 596 #endif
 597
 598 const void *qemu_plugin_request_time_control(void)
 599 {
 600     if (!has_control) {
 601         has_control = true;
 602 #ifdef CONFIG_SOFTMMU
 603         error_setg(&migration_blocker,
 604                    "TCG plugin time control does not support migration");
 605         migrate_add_blocker(&migration_blocker, NULL);
 606 #endif
 607         return &has_control;
 608     }
 609     return NULL;
 610 }
 611
 612 #ifdef CONFIG_SOFTMMU
 613 static void advance_virtual_time__async(CPUState *cpu, run_on_cpu_data data)
 614 {
 615     int64_t new_time = data.host_ulong;
 616     qemu_clock_advance_virtual_time(new_time);
 617 }
 618 #endif
 619
 620 void qemu_plugin_update_ns(const void *handle, int64_t new_time)
 621 {
 622 #ifdef CONFIG_SOFTMMU
 623     if (handle == &has_control) {
 624         /* Need to execute out of cpu_exec, so bql can be locked. */
 625         async_run_on_cpu(current_cpu,
 626                          advance_virtual_time__async,
 627                          RUN_ON_CPU_HOST_ULONG(new_time));
 628     }
 629 #endif
 630 }