4 * This provides the API that is available to the plugins to interact
5 * with QEMU. We have to be careful not to expose internal details of
6 * how QEMU works so we abstract out things like translation and
7 * instructions to anonymous data types:
11 * qemu_plugin_register
13 * Which can then be passed back into the API to do additional things.
14 * As such all the public functions in here are exported in
17 * The general life-cycle of a plugin is:
19 * - plugin is loaded, public qemu_plugin_install called
20 * - the install func registers callbacks for events
21 * - usually an atexit_cb is registered to dump info at the end
22 * - when a registered event occurs the plugin is called
23 * - some events pass additional info
24 * - during translation the plugin can decide to instrument any
26 * - when QEMU exits all the registered atexit callbacks are called
28 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
29 * Copyright (C) 2019, Linaro
31 * License: GNU GPL, version 2 or later.
32 * See the COPYING file in the top-level directory.
34 * SPDX-License-Identifier: GPL-2.0-or-later
38 #include "qemu/osdep.h"
39 #include "qemu/main-loop.h"
40 #include "qemu/plugin.h"
42 #include "qemu/timer.h"
44 #include "exec/exec-all.h"
45 #include "exec/gdbstub.h"
46 #include "exec/translator.h"
47 #include "disas/disas.h"
49 #ifndef CONFIG_USER_ONLY
50 #include "qapi/error.h"
51 #include "migration/blocker.h"
52 #include "exec/ram_addr.h"
53 #include "qemu/plugin-memory.h"
54 #include "hw/boards.h"
62 /* Uninstall and Reset handlers */
64 void qemu_plugin_uninstall(qemu_plugin_id_t id
, qemu_plugin_simple_cb_t cb
)
66 plugin_reset_uninstall(id
, cb
, false);
69 void qemu_plugin_reset(qemu_plugin_id_t id
, qemu_plugin_simple_cb_t cb
)
71 plugin_reset_uninstall(id
, cb
, true);
75 * Plugin Register Functions
77 * This allows the plugin to register callbacks for various events
78 * during the translation.
81 void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id
,
82 qemu_plugin_vcpu_simple_cb_t cb
)
84 plugin_register_cb(id
, QEMU_PLUGIN_EV_VCPU_INIT
, cb
);
87 void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id
,
88 qemu_plugin_vcpu_simple_cb_t cb
)
90 plugin_register_cb(id
, QEMU_PLUGIN_EV_VCPU_EXIT
, cb
);
93 static bool tb_is_mem_only(void)
95 return tb_cflags(tcg_ctx
->gen_tb
) & CF_MEMI_ONLY
;
98 void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb
*tb
,
99 qemu_plugin_vcpu_udata_cb_t cb
,
100 enum qemu_plugin_cb_flags flags
,
103 if (!tb_is_mem_only()) {
104 plugin_register_dyn_cb__udata(&tb
->cbs
, cb
, flags
, udata
);
108 void qemu_plugin_register_vcpu_tb_exec_cond_cb(struct qemu_plugin_tb
*tb
,
109 qemu_plugin_vcpu_udata_cb_t cb
,
110 enum qemu_plugin_cb_flags flags
,
111 enum qemu_plugin_cond cond
,
112 qemu_plugin_u64 entry
,
116 if (cond
== QEMU_PLUGIN_COND_NEVER
|| tb_is_mem_only()) {
119 if (cond
== QEMU_PLUGIN_COND_ALWAYS
) {
120 qemu_plugin_register_vcpu_tb_exec_cb(tb
, cb
, flags
, udata
);
123 plugin_register_dyn_cond_cb__udata(&tb
->cbs
, cb
, flags
,
124 cond
, entry
, imm
, udata
);
127 void qemu_plugin_register_vcpu_tb_exec_inline_per_vcpu(
128 struct qemu_plugin_tb
*tb
,
129 enum qemu_plugin_op op
,
130 qemu_plugin_u64 entry
,
133 if (!tb_is_mem_only()) {
134 plugin_register_inline_op_on_entry(&tb
->cbs
, 0, op
, entry
, imm
);
138 void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn
*insn
,
139 qemu_plugin_vcpu_udata_cb_t cb
,
140 enum qemu_plugin_cb_flags flags
,
143 if (!tb_is_mem_only()) {
144 plugin_register_dyn_cb__udata(&insn
->insn_cbs
, cb
, flags
, udata
);
148 void qemu_plugin_register_vcpu_insn_exec_cond_cb(
149 struct qemu_plugin_insn
*insn
,
150 qemu_plugin_vcpu_udata_cb_t cb
,
151 enum qemu_plugin_cb_flags flags
,
152 enum qemu_plugin_cond cond
,
153 qemu_plugin_u64 entry
,
157 if (cond
== QEMU_PLUGIN_COND_NEVER
|| tb_is_mem_only()) {
160 if (cond
== QEMU_PLUGIN_COND_ALWAYS
) {
161 qemu_plugin_register_vcpu_insn_exec_cb(insn
, cb
, flags
, udata
);
164 plugin_register_dyn_cond_cb__udata(&insn
->insn_cbs
, cb
, flags
,
165 cond
, entry
, imm
, udata
);
168 void qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(
169 struct qemu_plugin_insn
*insn
,
170 enum qemu_plugin_op op
,
171 qemu_plugin_u64 entry
,
174 if (!tb_is_mem_only()) {
175 plugin_register_inline_op_on_entry(&insn
->insn_cbs
, 0, op
, entry
, imm
);
181 * We always plant memory instrumentation because they don't finalise until
182 * after the operation has complete.
184 void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn
*insn
,
185 qemu_plugin_vcpu_mem_cb_t cb
,
186 enum qemu_plugin_cb_flags flags
,
187 enum qemu_plugin_mem_rw rw
,
190 plugin_register_vcpu_mem_cb(&insn
->mem_cbs
, cb
, flags
, rw
, udata
);
193 void qemu_plugin_register_vcpu_mem_inline_per_vcpu(
194 struct qemu_plugin_insn
*insn
,
195 enum qemu_plugin_mem_rw rw
,
196 enum qemu_plugin_op op
,
197 qemu_plugin_u64 entry
,
200 plugin_register_inline_op_on_entry(&insn
->mem_cbs
, rw
, op
, entry
, imm
);
203 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id
,
204 qemu_plugin_vcpu_tb_trans_cb_t cb
)
206 plugin_register_cb(id
, QEMU_PLUGIN_EV_VCPU_TB_TRANS
, cb
);
209 void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id
,
210 qemu_plugin_vcpu_syscall_cb_t cb
)
212 plugin_register_cb(id
, QEMU_PLUGIN_EV_VCPU_SYSCALL
, cb
);
216 qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id
,
217 qemu_plugin_vcpu_syscall_ret_cb_t cb
)
219 plugin_register_cb(id
, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET
, cb
);
225 * These are queries that the plugin can make to gauge information
226 * from our opaque data types. We do not want to leak internal details
227 * here just information useful to the plugin.
231 * Translation block information:
233 * A plugin can query the virtual address of the start of the block
234 * and the number of instructions in it. It can also get access to
235 * each translated instruction.
238 size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb
*tb
)
243 uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb
*tb
)
245 const DisasContextBase
*db
= tcg_ctx
->plugin_db
;
249 struct qemu_plugin_insn
*
250 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb
*tb
, size_t idx
)
252 struct qemu_plugin_insn
*insn
;
253 if (unlikely(idx
>= tb
->n
)) {
256 insn
= g_ptr_array_index(tb
->insns
, idx
);
261 * Instruction information
263 * These queries allow the plugin to retrieve information about each
264 * instruction being translated.
267 size_t qemu_plugin_insn_data(const struct qemu_plugin_insn
*insn
,
268 void *dest
, size_t len
)
270 const DisasContextBase
*db
= tcg_ctx
->plugin_db
;
272 len
= MIN(len
, insn
->len
);
273 return translator_st(db
, dest
, insn
->vaddr
, len
) ? len
: 0;
276 size_t qemu_plugin_insn_size(const struct qemu_plugin_insn
*insn
)
281 uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn
*insn
)
286 void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn
*insn
)
288 const DisasContextBase
*db
= tcg_ctx
->plugin_db
;
289 vaddr page0_last
= db
->pc_first
| ~TARGET_PAGE_MASK
;
296 * ??? The return value is not intended for use of host memory,
297 * but as a proxy for address space and physical address.
298 * Thus we are only interested in the first byte and do not
299 * care about spanning pages.
301 if (insn
->vaddr
<= page0_last
) {
302 if (db
->host_addr
[0] == NULL
) {
305 return db
->host_addr
[0] + insn
->vaddr
- db
->pc_first
;
307 if (db
->host_addr
[1] == NULL
) {
310 return db
->host_addr
[1] + insn
->vaddr
- (page0_last
+ 1);
314 char *qemu_plugin_insn_disas(const struct qemu_plugin_insn
*insn
)
316 return plugin_disas(tcg_ctx
->cpu
, tcg_ctx
->plugin_db
,
317 insn
->vaddr
, insn
->len
);
320 const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn
*insn
)
322 const char *sym
= lookup_symbol(insn
->vaddr
);
323 return sym
[0] != 0 ? sym
: NULL
;
327 * The memory queries allow the plugin to query information about a
331 unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info
)
333 MemOp op
= get_memop(info
);
337 bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info
)
339 MemOp op
= get_memop(info
);
343 bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info
)
345 MemOp op
= get_memop(info
);
346 return (op
& MO_BSWAP
) == MO_BE
;
349 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info
)
351 return get_plugin_meminfo_rw(info
) & QEMU_PLUGIN_MEM_W
;
354 qemu_plugin_mem_value
qemu_plugin_mem_get_value(qemu_plugin_meminfo_t info
)
356 uint64_t low
= current_cpu
->neg
.plugin_mem_value_low
;
357 qemu_plugin_mem_value value
;
359 switch (qemu_plugin_mem_size_shift(info
)) {
361 value
.type
= QEMU_PLUGIN_MEM_VALUE_U8
;
362 value
.data
.u8
= (uint8_t)low
;
365 value
.type
= QEMU_PLUGIN_MEM_VALUE_U16
;
366 value
.data
.u16
= (uint16_t)low
;
369 value
.type
= QEMU_PLUGIN_MEM_VALUE_U32
;
370 value
.data
.u32
= (uint32_t)low
;
373 value
.type
= QEMU_PLUGIN_MEM_VALUE_U64
;
374 value
.data
.u64
= low
;
377 value
.type
= QEMU_PLUGIN_MEM_VALUE_U128
;
378 value
.data
.u128
.low
= low
;
379 value
.data
.u128
.high
= current_cpu
->neg
.plugin_mem_value_high
;
382 g_assert_not_reached();
388 * Virtual Memory queries
391 #ifdef CONFIG_SOFTMMU
392 static __thread
struct qemu_plugin_hwaddr hwaddr_info
;
395 struct qemu_plugin_hwaddr
*qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info
,
398 #ifdef CONFIG_SOFTMMU
399 CPUState
*cpu
= current_cpu
;
400 unsigned int mmu_idx
= get_mmuidx(info
);
401 enum qemu_plugin_mem_rw rw
= get_plugin_meminfo_rw(info
);
402 hwaddr_info
.is_store
= (rw
& QEMU_PLUGIN_MEM_W
) != 0;
404 assert(mmu_idx
< NB_MMU_MODES
);
406 if (!tlb_plugin_lookup(cpu
, vaddr
, mmu_idx
,
407 hwaddr_info
.is_store
, &hwaddr_info
)) {
408 error_report("invalid use of qemu_plugin_get_hwaddr");
418 bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr
*haddr
)
420 #ifdef CONFIG_SOFTMMU
427 uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr
*haddr
)
429 #ifdef CONFIG_SOFTMMU
431 return haddr
->phys_addr
;
437 const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr
*h
)
439 #ifdef CONFIG_SOFTMMU
441 MemoryRegion
*mr
= h
->mr
;
443 unsigned maddr
= (uintptr_t)mr
;
444 g_autofree
char *temp
= g_strdup_printf("anon%08x", maddr
);
445 return g_intern_string(temp
);
447 return g_intern_string(mr
->name
);
450 return g_intern_static_string("RAM");
453 return g_intern_static_string("Invalid");
457 int qemu_plugin_num_vcpus(void)
459 return plugin_num_vcpus();
465 void qemu_plugin_outs(const char *string
)
467 qemu_log_mask(CPU_LOG_PLUGIN
, "%s", string
);
470 bool qemu_plugin_bool_parse(const char *name
, const char *value
, bool *ret
)
472 return name
&& value
&& qapi_bool_parse(name
, value
, ret
, NULL
);
476 * Binary path, start and end locations
478 const char *qemu_plugin_path_to_binary(void)
481 #ifdef CONFIG_USER_ONLY
482 TaskState
*ts
= get_task_state(current_cpu
);
483 path
= g_strdup(ts
->bprm
->filename
);
488 uint64_t qemu_plugin_start_code(void)
491 #ifdef CONFIG_USER_ONLY
492 TaskState
*ts
= get_task_state(current_cpu
);
493 start
= ts
->info
->start_code
;
498 uint64_t qemu_plugin_end_code(void)
501 #ifdef CONFIG_USER_ONLY
502 TaskState
*ts
= get_task_state(current_cpu
);
503 end
= ts
->info
->end_code
;
508 uint64_t qemu_plugin_entry_code(void)
511 #ifdef CONFIG_USER_ONLY
512 TaskState
*ts
= get_task_state(current_cpu
);
513 entry
= ts
->info
->entry
;
519 * Create register handles.
521 * We need to create a handle for each register so the plugin
522 * infrastructure can call gdbstub to read a register. They are
523 * currently just a pointer encapsulation of the gdb_reg but in
524 * future may hold internal plugin state so its important plugin
525 * authors are not tempted to treat them as numbers.
527 * We also construct a result array with those handles and some
528 * ancillary data the plugin might find useful.
531 static GArray
*create_register_handles(GArray
*gdbstub_regs
)
533 GArray
*find_data
= g_array_new(true, true,
534 sizeof(qemu_plugin_reg_descriptor
));
536 for (int i
= 0; i
< gdbstub_regs
->len
; i
++) {
537 GDBRegDesc
*grd
= &g_array_index(gdbstub_regs
, GDBRegDesc
, i
);
538 qemu_plugin_reg_descriptor desc
;
540 /* skip "un-named" regs */
545 /* Create a record for the plugin */
546 desc
.handle
= GINT_TO_POINTER(grd
->gdb_reg
+ 1);
547 desc
.name
= g_intern_string(grd
->name
);
548 desc
.feature
= g_intern_string(grd
->feature_name
);
549 g_array_append_val(find_data
, desc
);
555 GArray
*qemu_plugin_get_registers(void)
557 g_assert(current_cpu
);
559 g_autoptr(GArray
) regs
= gdb_get_register_list(current_cpu
);
560 return create_register_handles(regs
);
563 bool qemu_plugin_read_memory_vaddr(vaddr addr
, GByteArray
*data
, size_t len
)
565 g_assert(current_cpu
);
571 g_byte_array_set_size(data
, len
);
573 int result
= cpu_memory_rw_debug(current_cpu
, addr
, data
->data
,
583 int qemu_plugin_read_register(struct qemu_plugin_register
*reg
, GByteArray
*buf
)
585 g_assert(current_cpu
);
587 return gdb_read_register(current_cpu
, buf
, GPOINTER_TO_INT(reg
) - 1);
590 struct qemu_plugin_scoreboard
*qemu_plugin_scoreboard_new(size_t element_size
)
592 return plugin_scoreboard_new(element_size
);
595 void qemu_plugin_scoreboard_free(struct qemu_plugin_scoreboard
*score
)
597 plugin_scoreboard_free(score
);
600 void *qemu_plugin_scoreboard_find(struct qemu_plugin_scoreboard
*score
,
601 unsigned int vcpu_index
)
603 g_assert(vcpu_index
< qemu_plugin_num_vcpus());
604 /* we can't use g_array_index since entry size is not statically known */
605 char *base_ptr
= score
->data
->data
;
606 return base_ptr
+ vcpu_index
* g_array_get_element_size(score
->data
);
609 static uint64_t *plugin_u64_address(qemu_plugin_u64 entry
,
610 unsigned int vcpu_index
)
612 char *ptr
= qemu_plugin_scoreboard_find(entry
.score
, vcpu_index
);
613 return (uint64_t *)(ptr
+ entry
.offset
);
616 void qemu_plugin_u64_add(qemu_plugin_u64 entry
, unsigned int vcpu_index
,
619 *plugin_u64_address(entry
, vcpu_index
) += added
;
622 uint64_t qemu_plugin_u64_get(qemu_plugin_u64 entry
,
623 unsigned int vcpu_index
)
625 return *plugin_u64_address(entry
, vcpu_index
);
628 void qemu_plugin_u64_set(qemu_plugin_u64 entry
, unsigned int vcpu_index
,
631 *plugin_u64_address(entry
, vcpu_index
) = val
;
634 uint64_t qemu_plugin_u64_sum(qemu_plugin_u64 entry
)
637 for (int i
= 0, n
= qemu_plugin_num_vcpus(); i
< n
; ++i
) {
638 total
+= qemu_plugin_u64_get(entry
, i
);
646 static bool has_control
;
647 #ifdef CONFIG_SOFTMMU
648 static Error
*migration_blocker
;
651 const void *qemu_plugin_request_time_control(void)
655 #ifdef CONFIG_SOFTMMU
656 error_setg(&migration_blocker
,
657 "TCG plugin time control does not support migration");
658 migrate_add_blocker(&migration_blocker
, NULL
);
665 #ifdef CONFIG_SOFTMMU
666 static void advance_virtual_time__async(CPUState
*cpu
, run_on_cpu_data data
)
668 int64_t new_time
= data
.host_ulong
;
669 qemu_clock_advance_virtual_time(new_time
);
673 void qemu_plugin_update_ns(const void *handle
, int64_t new_time
)
675 #ifdef CONFIG_SOFTMMU
676 if (handle
== &has_control
) {
677 /* Need to execute out of cpu_exec, so bql can be locked. */
678 async_run_on_cpu(current_cpu
,
679 advance_virtual_time__async
,
680 RUN_ON_CPU_HOST_ULONG(new_time
));