4 * This provides the API that is available to the plugins to interact
5 * with QEMU. We have to be careful not to expose internal details of
6 * how QEMU works so we abstract out things like translation and
7 * instructions to anonymous data types:
12 * Which can then be passed back into the API to do additional things.
13 * As such all the public functions in here are exported in
16 * The general life-cycle of a plugin is:
18 * - plugin is loaded, public qemu_plugin_install called
19 * - the install func registers callbacks for events
20 * - usually an atexit_cb is registered to dump info at the end
21 * - when a registered event occurs the plugin is called
22 * - some events pass additional info
23 * - during translation the plugin can decide to instrument any
25 * - when QEMU exits all the registered atexit callbacks are called
27 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
28 * Copyright (C) 2019, Linaro
30 * License: GNU GPL, version 2 or later.
31 * See the COPYING file in the top-level directory.
33 * SPDX-License-Identifier: GPL-2.0-or-later
37 #include "qemu/osdep.h"
38 #include "qemu/plugin.h"
40 #include "exec/exec-all.h"
41 #include "exec/ram_addr.h"
42 #include "disas/disas.h"
44 #ifndef CONFIG_USER_ONLY
45 #include "qemu/plugin-memory.h"
46 #include "hw/boards.h"
54 /* Uninstall and Reset handlers */
56 void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb)
58 plugin_reset_uninstall(id, cb, false);
61 void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb)
63 plugin_reset_uninstall(id, cb, true);
67 * Plugin Register Functions
69 * This allows the plugin to register callbacks for various events
70 * during the translation.
73 void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id,
74 qemu_plugin_vcpu_simple_cb_t cb)
76 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INIT, cb);
79 void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id,
80 qemu_plugin_vcpu_simple_cb_t cb)
82 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXIT, cb);
85 void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb,
86 qemu_plugin_vcpu_udata_cb_t cb,
87 enum qemu_plugin_cb_flags flags,
91 plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR],
96 void qemu_plugin_register_vcpu_tb_exec_inline(struct qemu_plugin_tb *tb,
97 enum qemu_plugin_op op,
98 void *ptr, uint64_t imm)
101 plugin_register_inline_op(&tb->cbs[PLUGIN_CB_INLINE], 0, op, ptr, imm);
105 void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn,
106 qemu_plugin_vcpu_udata_cb_t cb,
107 enum qemu_plugin_cb_flags flags,
110 if (!insn->mem_only) {
111 plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR],
116 void qemu_plugin_register_vcpu_insn_exec_inline(struct qemu_plugin_insn *insn,
117 enum qemu_plugin_op op,
118 void *ptr, uint64_t imm)
120 if (!insn->mem_only) {
121 plugin_register_inline_op(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE],
128 * We always plant memory instrumentation because they don't finalise until
129 * after the operation has complete.
131 void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn,
132 qemu_plugin_vcpu_mem_cb_t cb,
133 enum qemu_plugin_cb_flags flags,
134 enum qemu_plugin_mem_rw rw,
137 plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR],
138 cb, flags, rw, udata);
141 void qemu_plugin_register_vcpu_mem_inline(struct qemu_plugin_insn *insn,
142 enum qemu_plugin_mem_rw rw,
143 enum qemu_plugin_op op, void *ptr,
146 plugin_register_inline_op(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE],
150 void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id,
151 qemu_plugin_vcpu_tb_trans_cb_t cb)
153 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_TB_TRANS, cb);
156 void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id,
157 qemu_plugin_vcpu_syscall_cb_t cb)
159 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL, cb);
163 qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id,
164 qemu_plugin_vcpu_syscall_ret_cb_t cb)
166 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET, cb);
172 * These are queries that the plugin can make to gauge information
173 * from our opaque data types. We do not want to leak internal details
174 * here just information useful to the plugin.
178 * Translation block information:
180 * A plugin can query the virtual address of the start of the block
181 * and the number of instructions in it. It can also get access to
182 * each translated instruction.
185 size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb)
190 uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb)
195 struct qemu_plugin_insn *
196 qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx)
198 struct qemu_plugin_insn *insn;
199 if (unlikely(idx >= tb->n)) {
202 insn = g_ptr_array_index(tb->insns, idx);
203 insn->mem_only = tb->mem_only;
208 * Instruction information
210 * These queries allow the plugin to retrieve information about each
211 * instruction being translated.
214 const void *qemu_plugin_insn_data(const struct qemu_plugin_insn *insn)
216 return insn->data->data;
219 size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn)
221 return insn->data->len;
224 uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn)
229 void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn)
234 char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn)
236 CPUState *cpu = current_cpu;
237 return plugin_disas(cpu, insn->vaddr, insn->data->len);
240 const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn)
242 const char *sym = lookup_symbol(insn->vaddr);
243 return sym[0] != 0 ? sym : NULL;
247 * The memory queries allow the plugin to query information about a
251 unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info)
253 MemOp op = get_memop(info);
257 bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info)
259 MemOp op = get_memop(info);
263 bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info)
265 MemOp op = get_memop(info);
266 return (op & MO_BSWAP) == MO_BE;
269 bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info)
271 return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W;
275 * Virtual Memory queries
278 #ifdef CONFIG_SOFTMMU
279 static __thread struct qemu_plugin_hwaddr hwaddr_info;
282 struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info,
285 #ifdef CONFIG_SOFTMMU
286 CPUState *cpu = current_cpu;
287 unsigned int mmu_idx = get_mmuidx(info);
288 enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info);
289 hwaddr_info.is_store = (rw & QEMU_PLUGIN_MEM_W) != 0;
291 if (!tlb_plugin_lookup(cpu, vaddr, mmu_idx,
292 hwaddr_info.is_store, &hwaddr_info)) {
293 error_report("invalid use of qemu_plugin_get_hwaddr");
303 bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr)
305 #ifdef CONFIG_SOFTMMU
312 uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr)
314 #ifdef CONFIG_SOFTMMU
319 void *hostaddr = haddr->v.ram.hostaddr;
321 block = qemu_ram_block_from_host(hostaddr, false, &offset);
323 error_report("Bad host ram pointer %p", haddr->v.ram.hostaddr);
327 return block->offset + offset + block->mr->addr;
329 MemoryRegionSection *mrs = haddr->v.io.section;
330 return mrs->offset_within_address_space + haddr->v.io.offset;
337 const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h)
339 #ifdef CONFIG_SOFTMMU
341 MemoryRegionSection *mrs = h->v.io.section;
342 if (!mrs->mr->name) {
343 unsigned long maddr = 0xffffffff & (uintptr_t) mrs->mr;
344 g_autofree char *temp = g_strdup_printf("anon%08lx", maddr);
345 return g_intern_string(temp);
347 return g_intern_string(mrs->mr->name);
350 return g_intern_static_string("RAM");
353 return g_intern_static_string("Invalid");
358 * Queries to the number and potential maximum number of vCPUs there
359 * will be. This helps the plugin dimension per-vcpu arrays.
362 #ifndef CONFIG_USER_ONLY
363 static MachineState * get_ms(void)
365 return MACHINE(qdev_get_machine());
369 int qemu_plugin_n_vcpus(void)
371 #ifdef CONFIG_USER_ONLY
374 return get_ms()->smp.cpus;
378 int qemu_plugin_n_max_vcpus(void)
380 #ifdef CONFIG_USER_ONLY
383 return get_ms()->smp.max_cpus;
390 void qemu_plugin_outs(const char *string)
392 qemu_log_mask(CPU_LOG_PLUGIN, "%s", string);
395 bool qemu_plugin_bool_parse(const char *name, const char *value, bool *ret)
397 return name && value && qapi_bool_parse(name, value, ret, NULL);
401 * Binary path, start and end locations
403 const char *qemu_plugin_path_to_binary(void)
406 #ifdef CONFIG_USER_ONLY
407 TaskState *ts = (TaskState *) current_cpu->opaque;
408 path = g_strdup(ts->bprm->filename);
413 uint64_t qemu_plugin_start_code(void)
416 #ifdef CONFIG_USER_ONLY
417 TaskState *ts = (TaskState *) current_cpu->opaque;
418 start = ts->info->start_code;
423 uint64_t qemu_plugin_end_code(void)
426 #ifdef CONFIG_USER_ONLY
427 TaskState *ts = (TaskState *) current_cpu->opaque;
428 end = ts->info->end_code;
433 uint64_t qemu_plugin_entry_code(void)
436 #ifdef CONFIG_USER_ONLY
437 TaskState *ts = (TaskState *) current_cpu->opaque;
438 entry = ts->info->entry;