plugins/api.c

   1 /*
   2  * QEMU Plugin API
   3  *
   4  * This provides the API that is available to the plugins to interact
   5  * with QEMU. We have to be careful not to expose internal details of
   6  * how QEMU works so we abstract out things like translation and
   7  * instructions to anonymous data types:
   8  *
   9  *  qemu_plugin_tb
  10  *  qemu_plugin_insn
  11  *  qemu_plugin_register
  12  *
  13  * Which can then be passed back into the API to do additional things.
  14  * As such all the public functions in here are exported in
  15  * qemu-plugin.h.
  16  *
  17  * The general life-cycle of a plugin is:
  18  *
  19  *  - plugin is loaded, public qemu_plugin_install called
  20  *    - the install func registers callbacks for events
  21  *    - usually an atexit_cb is registered to dump info at the end
  22  *  - when a registered event occurs the plugin is called
  23  *     - some events pass additional info
  24  *     - during translation the plugin can decide to instrument any
  25  *       instruction
  26  *  - when QEMU exits all the registered atexit callbacks are called
  27  *
  28  * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
  29  * Copyright (C) 2019, Linaro
  30  *
  31  * License: GNU GPL, version 2 or later.
  32  *   See the COPYING file in the top-level directory.
  33  *
  34  * SPDX-License-Identifier: GPL-2.0-or-later
  35  *
  36  */
  37
  38 #include "qemu/osdep.h"
  39 #include "qemu/main-loop.h"
  40 #include "qemu/plugin.h"
  41 #include "qemu/log.h"
  42 #include "tcg/tcg.h"
  43 #include "exec/exec-all.h"
  44 #include "exec/gdbstub.h"
  45 #include "exec/ram_addr.h"
  46 #include "disas/disas.h"
  47 #include "plugin.h"
  48 #ifndef CONFIG_USER_ONLY
  49 #include "qemu/plugin-memory.h"
  50 #include "hw/boards.h"
  51 #else
  52 #include "qemu.h"
  53 #ifdef CONFIG_LINUX
  54 #include "loader.h"
  55 #endif
  56 #endif
  57
  58 /* Uninstall and Reset handlers */
  59
  60 void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb)
  61 {
  62     plugin_reset_uninstall(id, cb, false);
  63 }
  64
  65 void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb)
  66 {
  67     plugin_reset_uninstall(id, cb, true);
  68 }
  69
  70 /*
  71  * Plugin Register Functions
  72  *
  73  * This allows the plugin to register callbacks for various events
  74  * during the translation.
  75  */
  76
  77 void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id,
  78                                        qemu_plugin_vcpu_simple_cb_t cb)
  79 {
  80     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INIT, cb);
  81 }
  82
  83 void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id,
  84                                        qemu_plugin_vcpu_simple_cb_t cb)
  85 {
  86     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXIT, cb);
  87 }
  88
  89 void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
  90                                           qemu_plugin_vcpu_udata_cb_t cb,
  91                                           enum qemu_plugin_cb_flags flags,
  92                                           void *udata)
  93 {
  94     if (!tb->mem_only) {
  95         int index = flags == QEMU_PLUGIN_CB_R_REGS ||
  96                     flags == QEMU_PLUGIN_CB_RW_REGS ?
  97                     PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR;
  98
  99         plugin_register_dyn_cb__udata(&tb->cbs[index],
 100                                       cb, flags, udata);
 101     }
 102 }
 103
 104 void qemu_plugin_register_vcpu_tb_exec_inline_per_vcpu(
 105     struct qemu_plugin_tb *tb,
 106     enum qemu_plugin_op op,
 107     qemu_plugin_u64 entry,
 108     uint64_t imm)
 109 {
 110     if (!tb->mem_only) {
 111         plugin_register_inline_op_on_entry(
 112             &tb->cbs[PLUGIN_CB_INLINE], 0, op, entry, imm);
 113     }
 114 }
 115
 116 void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
 117                                             qemu_plugin_vcpu_udata_cb_t cb,
 118                                             enum qemu_plugin_cb_flags flags,
 119                                             void *udata)
 120 {
 121     if (!insn->mem_only) {
 122         int index = flags == QEMU_PLUGIN_CB_R_REGS ||
 123                     flags == QEMU_PLUGIN_CB_RW_REGS ?
 124                     PLUGIN_CB_REGULAR_R : PLUGIN_CB_REGULAR;
 125
 126         plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][index],
 127                                       cb, flags, udata);
 128     }
 129 }
 130
 131 void qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(
 132     struct qemu_plugin_insn *insn,
 133     enum qemu_plugin_op op,
 134     qemu_plugin_u64 entry,
 135     uint64_t imm)
 136 {
 137     if (!insn->mem_only) {
 138         plugin_register_inline_op_on_entry(
 139             &insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], 0, op, entry, imm);
 140     }
 141 }
 142
 143
 144 /*
 145  * We always plant memory instrumentation because they don't finalise until
 146  * after the operation has complete.
 147  */
 148 void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn,
 149                                       qemu_plugin_vcpu_mem_cb_t cb,
 150                                       enum qemu_plugin_cb_flags flags,
 151                                       enum qemu_plugin_mem_rw rw,
 152                                       void *udata)
 153 {
 154     plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR],
 155                                 cb, flags, rw, udata);
 156 }
 157
 158 void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
 159     struct qemu_plugin_insn *insn,
 160     enum qemu_plugin_mem_rw rw,
 161     enum qemu_plugin_op op,
 162     qemu_plugin_u64 entry,
 163     uint64_t imm)
 164 {
 165     plugin_register_inline_op_on_entry(
 166         &insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE], rw, op, entry, imm);
 167 }
 168
 169 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id,
 170                                            qemu_plugin_vcpu_tb_trans_cb_t cb)
 171 {
 172     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_TB_TRANS, cb);
 173 }
 174
 175 void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id,
 176                                           qemu_plugin_vcpu_syscall_cb_t cb)
 177 {
 178     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL, cb);
 179 }
 180
 181 void
 182 qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id,
 183                                          qemu_plugin_vcpu_syscall_ret_cb_t cb)
 184 {
 185     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET, cb);
 186 }
 187
 188 /*
 189  * Plugin Queries
 190  *
 191  * These are queries that the plugin can make to gauge information
 192  * from our opaque data types. We do not want to leak internal details
 193  * here just information useful to the plugin.
 194  */
 195
 196 /*
 197  * Translation block information:
 198  *
 199  * A plugin can query the virtual address of the start of the block
 200  * and the number of instructions in it. It can also get access to
 201  * each translated instruction.
 202  */
 203
 204 size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb)
 205 {
 206     return tb->n;
 207 }
 208
 209 uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb)
 210 {
 211     return tb->vaddr;
 212 }
 213
 214 struct qemu_plugin_insn *
 215 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx)
 216 {
 217     struct qemu_plugin_insn *insn;
 218     if (unlikely(idx >= tb->n)) {
 219         return NULL;
 220     }
 221     insn = g_ptr_array_index(tb->insns, idx);
 222     insn->mem_only = tb->mem_only;
 223     return insn;
 224 }
 225
 226 /*
 227  * Instruction information
 228  *
 229  * These queries allow the plugin to retrieve information about each
 230  * instruction being translated.
 231  */
 232
 233 const void *qemu_plugin_insn_data(const struct qemu_plugin_insn *insn)
 234 {
 235     return insn->data->data;
 236 }
 237
 238 size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn)
 239 {
 240     return insn->data->len;
 241 }
 242
 243 uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn)
 244 {
 245     return insn->vaddr;
 246 }
 247
 248 void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn)
 249 {
 250     return insn->haddr;
 251 }
 252
 253 char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn)
 254 {
 255     CPUState *cpu = current_cpu;
 256     return plugin_disas(cpu, insn->vaddr, insn->data->len);
 257 }
 258
 259 const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn)
 260 {
 261     const char *sym = lookup_symbol(insn->vaddr);
 262     return sym[0] != 0 ? sym : NULL;
 263 }
 264
 265 /*
 266  * The memory queries allow the plugin to query information about a
 267  * memory access.
 268  */
 269
 270 unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info)
 271 {
 272     MemOp op = get_memop(info);
 273     return op & MO_SIZE;
 274 }
 275
 276 bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info)
 277 {
 278     MemOp op = get_memop(info);
 279     return op & MO_SIGN;
 280 }
 281
 282 bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info)
 283 {
 284     MemOp op = get_memop(info);
 285     return (op & MO_BSWAP) == MO_BE;
 286 }
 287
 288 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info)
 289 {
 290     return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W;
 291 }
 292
 293 /*
 294  * Virtual Memory queries
 295  */
 296
 297 #ifdef CONFIG_SOFTMMU
 298 static __thread struct qemu_plugin_hwaddr hwaddr_info;
 299 #endif
 300
 301 struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info,
 302                                                   uint64_t vaddr)
 303 {
 304 #ifdef CONFIG_SOFTMMU
 305     CPUState *cpu = current_cpu;
 306     unsigned int mmu_idx = get_mmuidx(info);
 307     enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info);
 308     hwaddr_info.is_store = (rw & QEMU_PLUGIN_MEM_W) != 0;
 309
 310     assert(mmu_idx < NB_MMU_MODES);
 311
 312     if (!tlb_plugin_lookup(cpu, vaddr, mmu_idx,
 313                            hwaddr_info.is_store, &hwaddr_info)) {
 314         error_report("invalid use of qemu_plugin_get_hwaddr");
 315         return NULL;
 316     }
 317
 318     return &hwaddr_info;
 319 #else
 320     return NULL;
 321 #endif
 322 }
 323
 324 bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr)
 325 {
 326 #ifdef CONFIG_SOFTMMU
 327     return haddr->is_io;
 328 #else
 329     return false;
 330 #endif
 331 }
 332
 333 uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr)
 334 {
 335 #ifdef CONFIG_SOFTMMU
 336     if (haddr) {
 337         return haddr->phys_addr;
 338     }
 339 #endif
 340     return 0;
 341 }
 342
 343 const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h)
 344 {
 345 #ifdef CONFIG_SOFTMMU
 346     if (h && h->is_io) {
 347         MemoryRegion *mr = h->mr;
 348         if (!mr->name) {
 349             unsigned maddr = (uintptr_t)mr;
 350             g_autofree char *temp = g_strdup_printf("anon%08x", maddr);
 351             return g_intern_string(temp);
 352         } else {
 353             return g_intern_string(mr->name);
 354         }
 355     } else {
 356         return g_intern_static_string("RAM");
 357     }
 358 #else
 359     return g_intern_static_string("Invalid");
 360 #endif
 361 }
 362
 363 int qemu_plugin_num_vcpus(void)
 364 {
 365     return plugin_num_vcpus();
 366 }
 367
 368 /*
 369  * Plugin output
 370  */
 371 void qemu_plugin_outs(const char *string)
 372 {
 373     qemu_log_mask(CPU_LOG_PLUGIN, "%s", string);
 374 }
 375
 376 bool qemu_plugin_bool_parse(const char *name, const char *value, bool *ret)
 377 {
 378     return name && value && qapi_bool_parse(name, value, ret, NULL);
 379 }
 380
 381 /*
 382  * Binary path, start and end locations
 383  */
 384 const char *qemu_plugin_path_to_binary(void)
 385 {
 386     char *path = NULL;
 387 #ifdef CONFIG_USER_ONLY
 388     TaskState *ts = get_task_state(current_cpu);
 389     path = g_strdup(ts->bprm->filename);
 390 #endif
 391     return path;
 392 }
 393
 394 uint64_t qemu_plugin_start_code(void)
 395 {
 396     uint64_t start = 0;
 397 #ifdef CONFIG_USER_ONLY
 398     TaskState *ts = get_task_state(current_cpu);
 399     start = ts->info->start_code;
 400 #endif
 401     return start;
 402 }
 403
 404 uint64_t qemu_plugin_end_code(void)
 405 {
 406     uint64_t end = 0;
 407 #ifdef CONFIG_USER_ONLY
 408     TaskState *ts = get_task_state(current_cpu);
 409     end = ts->info->end_code;
 410 #endif
 411     return end;
 412 }
 413
 414 uint64_t qemu_plugin_entry_code(void)
 415 {
 416     uint64_t entry = 0;
 417 #ifdef CONFIG_USER_ONLY
 418     TaskState *ts = get_task_state(current_cpu);
 419     entry = ts->info->entry;
 420 #endif
 421     return entry;
 422 }
 423
 424 /*
 425  * Create register handles.
 426  *
 427  * We need to create a handle for each register so the plugin
 428  * infrastructure can call gdbstub to read a register. They are
 429  * currently just a pointer encapsulation of the gdb_reg but in
 430  * future may hold internal plugin state so its important plugin
 431  * authors are not tempted to treat them as numbers.
 432  *
 433  * We also construct a result array with those handles and some
 434  * ancillary data the plugin might find useful.
 435  */
 436
 437 static GArray *create_register_handles(GArray *gdbstub_regs)
 438 {
 439     GArray *find_data = g_array_new(true, true,
 440                                     sizeof(qemu_plugin_reg_descriptor));
 441
 442     for (int i = 0; i < gdbstub_regs->len; i++) {
 443         GDBRegDesc *grd = &g_array_index(gdbstub_regs, GDBRegDesc, i);
 444         qemu_plugin_reg_descriptor desc;
 445
 446         /* skip "un-named" regs */
 447         if (!grd->name) {
 448             continue;
 449         }
 450
 451         /* Create a record for the plugin */
 452         desc.handle = GINT_TO_POINTER(grd->gdb_reg);
 453         desc.name = g_intern_string(grd->name);
 454         desc.feature = g_intern_string(grd->feature_name);
 455         g_array_append_val(find_data, desc);
 456     }
 457
 458     return find_data;
 459 }
 460
 461 GArray *qemu_plugin_get_registers(void)
 462 {
 463     g_assert(current_cpu);
 464
 465     g_autoptr(GArray) regs = gdb_get_register_list(current_cpu);
 466     return create_register_handles(regs);
 467 }
 468
 469 int qemu_plugin_read_register(struct qemu_plugin_register *reg, GByteArray *buf)
 470 {
 471     g_assert(current_cpu);
 472
 473     return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg));
 474 }
 475
 476 struct qemu_plugin_scoreboard *qemu_plugin_scoreboard_new(size_t element_size)
 477 {
 478     return plugin_scoreboard_new(element_size);
 479 }
 480
 481 void qemu_plugin_scoreboard_free(struct qemu_plugin_scoreboard *score)
 482 {
 483     plugin_scoreboard_free(score);
 484 }
 485
 486 void *qemu_plugin_scoreboard_find(struct qemu_plugin_scoreboard *score,
 487                                   unsigned int vcpu_index)
 488 {
 489     g_assert(vcpu_index < qemu_plugin_num_vcpus());
 490     /* we can't use g_array_index since entry size is not statically known */
 491     char *base_ptr = score->data->data;
 492     return base_ptr + vcpu_index * g_array_get_element_size(score->data);
 493 }
 494
 495 static uint64_t *plugin_u64_address(qemu_plugin_u64 entry,
 496                                     unsigned int vcpu_index)
 497 {
 498     char *ptr = qemu_plugin_scoreboard_find(entry.score, vcpu_index);
 499     return (uint64_t *)(ptr + entry.offset);
 500 }
 501
 502 void qemu_plugin_u64_add(qemu_plugin_u64 entry, unsigned int vcpu_index,
 503                          uint64_t added)
 504 {
 505     *plugin_u64_address(entry, vcpu_index) += added;
 506 }
 507
 508 uint64_t qemu_plugin_u64_get(qemu_plugin_u64 entry,
 509                              unsigned int vcpu_index)
 510 {
 511     return *plugin_u64_address(entry, vcpu_index);
 512 }
 513
 514 void qemu_plugin_u64_set(qemu_plugin_u64 entry, unsigned int vcpu_index,
 515                          uint64_t val)
 516 {
 517     *plugin_u64_address(entry, vcpu_index) = val;
 518 }
 519
 520 uint64_t qemu_plugin_u64_sum(qemu_plugin_u64 entry)
 521 {
 522     uint64_t total = 0;
 523     for (int i = 0, n = qemu_plugin_num_vcpus(); i < n; ++i) {
 524         total += qemu_plugin_u64_get(entry, i);
 525     }
 526     return total;
 527 }