contrib/plugins/execlog.c

   1 /*
   2  * Copyright (C) 2021, Alexandre Iooss <erdnaxe@crans.org>
   3  *
   4  * Log instruction execution with memory access.
   5  *
   6  * License: GNU GPL, version 2 or later.
   7  *   See the COPYING file in the top-level directory.
   8  */
   9 #include <glib.h>
  10 #include <inttypes.h>
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <unistd.h>
  15
  16 #include <qemu-plugin.h>
  17
  18 QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
  19
  20 /* Store last executed instruction on each vCPU as a GString */
  21 GArray *last_exec;
  22
  23 /**
  24  * Add memory read or write information to current instruction log
  25  */
  26 static void vcpu_mem(unsigned int cpu_index, qemu_plugin_meminfo_t info,
  27                      uint64_t vaddr, void *udata)
  28 {
  29     GString *s;
  30
  31     /* Find vCPU in array */
  32     g_assert(cpu_index < last_exec->len);
  33     s = g_array_index(last_exec, GString *, cpu_index);
  34
  35     /* Indicate type of memory access */
  36     if (qemu_plugin_mem_is_store(info)) {
  37         g_string_append(s, ", store");
  38     } else {
  39         g_string_append(s, ", load");
  40     }
  41
  42     /* If full system emulation log physical address and device name */
  43     struct qemu_plugin_hwaddr *hwaddr = qemu_plugin_get_hwaddr(info, vaddr);
  44     if (hwaddr) {
  45         uint64_t addr = qemu_plugin_hwaddr_phys_addr(hwaddr);
  46         const char *name = qemu_plugin_hwaddr_device_name(hwaddr);
  47         g_string_append_printf(s, ", 0x%08"PRIx64", %s", addr, name);
  48     } else {
  49         g_string_append_printf(s, ", 0x%08"PRIx64, vaddr);
  50     }
  51 }
  52
  53 /**
  54  * Log instruction execution
  55  */
  56 static void vcpu_insn_exec(unsigned int cpu_index, void *udata)
  57 {
  58     GString *s;
  59
  60     /* Find or create vCPU in array */
  61     while (cpu_index >= last_exec->len) {
  62         s = g_string_new(NULL);
  63         g_array_append_val(last_exec, s);
  64     }
  65     s = g_array_index(last_exec, GString *, cpu_index);
  66
  67     /* Print previous instruction in cache */
  68     if (s->len) {
  69         qemu_plugin_outs(s->str);
  70         qemu_plugin_outs("\n");
  71     }
  72
  73     /* Store new instruction in cache */
  74     /* vcpu_mem will add memory access information to last_exec */
  75     g_string_printf(s, "%u, ", cpu_index);
  76     g_string_append(s, (char *)udata);
  77 }
  78
  79 /**
  80  * On translation block new translation
  81  *
  82  * QEMU convert code by translation block (TB). By hooking here we can then hook
  83  * a callback on each instruction and memory access.
  84  */
  85 static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
  86 {
  87     struct qemu_plugin_insn *insn;
  88     uint64_t insn_vaddr;
  89     uint32_t insn_opcode;
  90     char *insn_disas;
  91
  92     size_t n = qemu_plugin_tb_n_insns(tb);
  93     for (size_t i = 0; i < n; i++) {
  94         /*
  95          * `insn` is shared between translations in QEMU, copy needed data here.
  96          * `output` is never freed as it might be used multiple times during
  97          * the emulation lifetime.
  98          * We only consider the first 32 bits of the instruction, this may be
  99          * a limitation for CISC architectures.
 100          */
 101         insn = qemu_plugin_tb_get_insn(tb, i);
 102         insn_vaddr = qemu_plugin_insn_vaddr(insn);
 103         insn_opcode = *((uint32_t *)qemu_plugin_insn_data(insn));
 104         insn_disas = qemu_plugin_insn_disas(insn);
 105         char *output = g_strdup_printf("0x%"PRIx64", 0x%"PRIx32", \"%s\"",
 106                                        insn_vaddr, insn_opcode, insn_disas);
 107
 108         /* Register callback on memory read or write */
 109         qemu_plugin_register_vcpu_mem_cb(insn, vcpu_mem,
 110                                          QEMU_PLUGIN_CB_NO_REGS,
 111                                          QEMU_PLUGIN_MEM_RW, NULL);
 112
 113         /* Register callback on instruction */
 114         qemu_plugin_register_vcpu_insn_exec_cb(insn, vcpu_insn_exec,
 115                                                QEMU_PLUGIN_CB_NO_REGS, output);
 116     }
 117 }
 118
 119 /**
 120  * On plugin exit, print last instruction in cache
 121  */
 122 static void plugin_exit(qemu_plugin_id_t id, void *p)
 123 {
 124     guint i;
 125     GString *s;
 126     for (i = 0; i < last_exec->len; i++) {
 127         s = g_array_index(last_exec, GString *, i);
 128         if (s->str) {
 129             qemu_plugin_outs(s->str);
 130             qemu_plugin_outs("\n");
 131         }
 132     }
 133 }
 134
 135 /**
 136  * Install the plugin
 137  */
 138 QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 139                                            const qemu_info_t *info, int argc,
 140                                            char **argv)
 141 {
 142     /*
 143      * Initialize dynamic array to cache vCPU instruction. In user mode
 144      * we don't know the size before emulation.
 145      */
 146     last_exec = g_array_new(FALSE, FALSE, sizeof(GString *));
 147
 148     /* Register translation block and exit callbacks */
 149     qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans);
 150     qemu_plugin_register_atexit_cb(id, plugin_exit, NULL);
 151
 152     return 0;
 153 }