|  | /* | 
|  | * QEMU Plugin API | 
|  | * | 
|  | * This provides the API that is available to the plugins to interact | 
|  | * with QEMU. We have to be careful not to expose internal details of | 
|  | * how QEMU works so we abstract out things like translation and | 
|  | * instructions to anonymous data types: | 
|  | * | 
|  | *  qemu_plugin_tb | 
|  | *  qemu_plugin_insn | 
|  | * | 
|  | * Which can then be passed back into the API to do additional things. | 
|  | * As such all the public functions in here are exported in | 
|  | * qemu-plugin.h. | 
|  | * | 
|  | * The general life-cycle of a plugin is: | 
|  | * | 
|  | *  - plugin is loaded, public qemu_plugin_install called | 
|  | *    - the install func registers callbacks for events | 
|  | *    - usually an atexit_cb is registered to dump info at the end | 
|  | *  - when a registered event occurs the plugin is called | 
|  | *     - some events pass additional info | 
|  | *     - during translation the plugin can decide to instrument any | 
|  | *       instruction | 
|  | *  - when QEMU exits all the registered atexit callbacks are called | 
|  | * | 
|  | * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> | 
|  | * Copyright (C) 2019, Linaro | 
|  | * | 
|  | * License: GNU GPL, version 2 or later. | 
|  | *   See the COPYING file in the top-level directory. | 
|  | * | 
|  | * SPDX-License-Identifier: GPL-2.0-or-later | 
|  | * | 
|  | */ | 
|  |  | 
|  | #include "qemu/osdep.h" | 
|  | #include "qemu/plugin.h" | 
|  | #include "qemu/log.h" | 
|  | #include "tcg/tcg.h" | 
|  | #include "exec/exec-all.h" | 
|  | #include "exec/ram_addr.h" | 
|  | #include "disas/disas.h" | 
|  | #include "plugin.h" | 
|  | #ifndef CONFIG_USER_ONLY | 
|  | #include "qemu/plugin-memory.h" | 
|  | #include "hw/boards.h" | 
|  | #else | 
|  | #include "qemu.h" | 
|  | #ifdef CONFIG_LINUX | 
|  | #include "loader.h" | 
|  | #endif | 
|  | #endif | 
|  |  | 
|  | /* Uninstall and Reset handlers */ | 
|  |  | 
|  | void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb) | 
|  | { | 
|  | plugin_reset_uninstall(id, cb, false); | 
|  | } | 
|  |  | 
|  | void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb) | 
|  | { | 
|  | plugin_reset_uninstall(id, cb, true); | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Plugin Register Functions | 
|  | * | 
|  | * This allows the plugin to register callbacks for various events | 
|  | * during the translation. | 
|  | */ | 
|  |  | 
|  | void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id, | 
|  | qemu_plugin_vcpu_simple_cb_t cb) | 
|  | { | 
|  | plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INIT, cb); | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id, | 
|  | qemu_plugin_vcpu_simple_cb_t cb) | 
|  | { | 
|  | plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXIT, cb); | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb, | 
|  | qemu_plugin_vcpu_udata_cb_t cb, | 
|  | enum qemu_plugin_cb_flags flags, | 
|  | void *udata) | 
|  | { | 
|  | if (!tb->mem_only) { | 
|  | plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR], | 
|  | cb, flags, udata); | 
|  | } | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_tb_exec_inline(struct qemu_plugin_tb *tb, | 
|  | enum qemu_plugin_op op, | 
|  | void *ptr, uint64_t imm) | 
|  | { | 
|  | if (!tb->mem_only) { | 
|  | plugin_register_inline_op(&tb->cbs[PLUGIN_CB_INLINE], 0, op, ptr, imm); | 
|  | } | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn, | 
|  | qemu_plugin_vcpu_udata_cb_t cb, | 
|  | enum qemu_plugin_cb_flags flags, | 
|  | void *udata) | 
|  | { | 
|  | if (!insn->mem_only) { | 
|  | plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], | 
|  | cb, flags, udata); | 
|  | } | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_insn_exec_inline(struct qemu_plugin_insn *insn, | 
|  | enum qemu_plugin_op op, | 
|  | void *ptr, uint64_t imm) | 
|  | { | 
|  | if (!insn->mem_only) { | 
|  | plugin_register_inline_op(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], | 
|  | 0, op, ptr, imm); | 
|  | } | 
|  | } | 
|  |  | 
|  |  | 
|  | /* | 
|  | * We always plant memory instrumentation because they don't finalise until | 
|  | * after the operation has complete. | 
|  | */ | 
|  | void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn, | 
|  | qemu_plugin_vcpu_mem_cb_t cb, | 
|  | enum qemu_plugin_cb_flags flags, | 
|  | enum qemu_plugin_mem_rw rw, | 
|  | void *udata) | 
|  | { | 
|  | plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], | 
|  | cb, flags, rw, udata); | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_mem_inline(struct qemu_plugin_insn *insn, | 
|  | enum qemu_plugin_mem_rw rw, | 
|  | enum qemu_plugin_op op, void *ptr, | 
|  | uint64_t imm) | 
|  | { | 
|  | plugin_register_inline_op(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE], | 
|  | rw, op, ptr, imm); | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id, | 
|  | qemu_plugin_vcpu_tb_trans_cb_t cb) | 
|  | { | 
|  | plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_TB_TRANS, cb); | 
|  | } | 
|  |  | 
|  | void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id, | 
|  | qemu_plugin_vcpu_syscall_cb_t cb) | 
|  | { | 
|  | plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL, cb); | 
|  | } | 
|  |  | 
|  | void | 
|  | qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id, | 
|  | qemu_plugin_vcpu_syscall_ret_cb_t cb) | 
|  | { | 
|  | plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET, cb); | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Plugin Queries | 
|  | * | 
|  | * These are queries that the plugin can make to gauge information | 
|  | * from our opaque data types. We do not want to leak internal details | 
|  | * here just information useful to the plugin. | 
|  | */ | 
|  |  | 
|  | /* | 
|  | * Translation block information: | 
|  | * | 
|  | * A plugin can query the virtual address of the start of the block | 
|  | * and the number of instructions in it. It can also get access to | 
|  | * each translated instruction. | 
|  | */ | 
|  |  | 
|  | size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb) | 
|  | { | 
|  | return tb->n; | 
|  | } | 
|  |  | 
|  | uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb) | 
|  | { | 
|  | return tb->vaddr; | 
|  | } | 
|  |  | 
|  | struct qemu_plugin_insn * | 
|  | qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx) | 
|  | { | 
|  | struct qemu_plugin_insn *insn; | 
|  | if (unlikely(idx >= tb->n)) { | 
|  | return NULL; | 
|  | } | 
|  | insn = g_ptr_array_index(tb->insns, idx); | 
|  | insn->mem_only = tb->mem_only; | 
|  | return insn; | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Instruction information | 
|  | * | 
|  | * These queries allow the plugin to retrieve information about each | 
|  | * instruction being translated. | 
|  | */ | 
|  |  | 
|  | const void *qemu_plugin_insn_data(const struct qemu_plugin_insn *insn) | 
|  | { | 
|  | return insn->data->data; | 
|  | } | 
|  |  | 
|  | size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn) | 
|  | { | 
|  | return insn->data->len; | 
|  | } | 
|  |  | 
|  | uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn) | 
|  | { | 
|  | return insn->vaddr; | 
|  | } | 
|  |  | 
|  | void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn) | 
|  | { | 
|  | return insn->haddr; | 
|  | } | 
|  |  | 
|  | char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn) | 
|  | { | 
|  | CPUState *cpu = current_cpu; | 
|  | return plugin_disas(cpu, insn->vaddr, insn->data->len); | 
|  | } | 
|  |  | 
|  | const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn) | 
|  | { | 
|  | const char *sym = lookup_symbol(insn->vaddr); | 
|  | return sym[0] != 0 ? sym : NULL; | 
|  | } | 
|  |  | 
|  | /* | 
|  | * The memory queries allow the plugin to query information about a | 
|  | * memory access. | 
|  | */ | 
|  |  | 
|  | unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info) | 
|  | { | 
|  | MemOp op = get_memop(info); | 
|  | return op & MO_SIZE; | 
|  | } | 
|  |  | 
|  | bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info) | 
|  | { | 
|  | MemOp op = get_memop(info); | 
|  | return op & MO_SIGN; | 
|  | } | 
|  |  | 
|  | bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info) | 
|  | { | 
|  | MemOp op = get_memop(info); | 
|  | return (op & MO_BSWAP) == MO_BE; | 
|  | } | 
|  |  | 
|  | bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info) | 
|  | { | 
|  | return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W; | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Virtual Memory queries | 
|  | */ | 
|  |  | 
|  | #ifdef CONFIG_SOFTMMU | 
|  | static __thread struct qemu_plugin_hwaddr hwaddr_info; | 
|  | #endif | 
|  |  | 
|  | struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info, | 
|  | uint64_t vaddr) | 
|  | { | 
|  | #ifdef CONFIG_SOFTMMU | 
|  | CPUState *cpu = current_cpu; | 
|  | unsigned int mmu_idx = get_mmuidx(info); | 
|  | enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info); | 
|  | hwaddr_info.is_store = (rw & QEMU_PLUGIN_MEM_W) != 0; | 
|  |  | 
|  | assert(mmu_idx < NB_MMU_MODES); | 
|  |  | 
|  | if (!tlb_plugin_lookup(cpu, vaddr, mmu_idx, | 
|  | hwaddr_info.is_store, &hwaddr_info)) { | 
|  | error_report("invalid use of qemu_plugin_get_hwaddr"); | 
|  | return NULL; | 
|  | } | 
|  |  | 
|  | return &hwaddr_info; | 
|  | #else | 
|  | return NULL; | 
|  | #endif | 
|  | } | 
|  |  | 
|  | bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr) | 
|  | { | 
|  | #ifdef CONFIG_SOFTMMU | 
|  | return haddr->is_io; | 
|  | #else | 
|  | return false; | 
|  | #endif | 
|  | } | 
|  |  | 
|  | uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr) | 
|  | { | 
|  | #ifdef CONFIG_SOFTMMU | 
|  | if (haddr) { | 
|  | if (!haddr->is_io) { | 
|  | RAMBlock *block; | 
|  | ram_addr_t offset; | 
|  | void *hostaddr = haddr->v.ram.hostaddr; | 
|  |  | 
|  | block = qemu_ram_block_from_host(hostaddr, false, &offset); | 
|  | if (!block) { | 
|  | error_report("Bad host ram pointer %p", haddr->v.ram.hostaddr); | 
|  | abort(); | 
|  | } | 
|  |  | 
|  | return block->offset + offset + block->mr->addr; | 
|  | } else { | 
|  | MemoryRegionSection *mrs = haddr->v.io.section; | 
|  | return mrs->offset_within_address_space + haddr->v.io.offset; | 
|  | } | 
|  | } | 
|  | #endif | 
|  | return 0; | 
|  | } | 
|  |  | 
|  | const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h) | 
|  | { | 
|  | #ifdef CONFIG_SOFTMMU | 
|  | if (h && h->is_io) { | 
|  | MemoryRegionSection *mrs = h->v.io.section; | 
|  | if (!mrs->mr->name) { | 
|  | unsigned long maddr = 0xffffffff & (uintptr_t) mrs->mr; | 
|  | g_autofree char *temp = g_strdup_printf("anon%08lx", maddr); | 
|  | return g_intern_string(temp); | 
|  | } else { | 
|  | return g_intern_string(mrs->mr->name); | 
|  | } | 
|  | } else { | 
|  | return g_intern_static_string("RAM"); | 
|  | } | 
|  | #else | 
|  | return g_intern_static_string("Invalid"); | 
|  | #endif | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Queries to the number and potential maximum number of vCPUs there | 
|  | * will be. This helps the plugin dimension per-vcpu arrays. | 
|  | */ | 
|  |  | 
|  | #ifndef CONFIG_USER_ONLY | 
|  | static MachineState * get_ms(void) | 
|  | { | 
|  | return MACHINE(qdev_get_machine()); | 
|  | } | 
|  | #endif | 
|  |  | 
|  | int qemu_plugin_n_vcpus(void) | 
|  | { | 
|  | #ifdef CONFIG_USER_ONLY | 
|  | return -1; | 
|  | #else | 
|  | return get_ms()->smp.cpus; | 
|  | #endif | 
|  | } | 
|  |  | 
|  | int qemu_plugin_n_max_vcpus(void) | 
|  | { | 
|  | #ifdef CONFIG_USER_ONLY | 
|  | return -1; | 
|  | #else | 
|  | return get_ms()->smp.max_cpus; | 
|  | #endif | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Plugin output | 
|  | */ | 
|  | void qemu_plugin_outs(const char *string) | 
|  | { | 
|  | qemu_log_mask(CPU_LOG_PLUGIN, "%s", string); | 
|  | } | 
|  |  | 
|  | bool qemu_plugin_bool_parse(const char *name, const char *value, bool *ret) | 
|  | { | 
|  | return name && value && qapi_bool_parse(name, value, ret, NULL); | 
|  | } | 
|  |  | 
|  | /* | 
|  | * Binary path, start and end locations | 
|  | */ | 
|  | const char *qemu_plugin_path_to_binary(void) | 
|  | { | 
|  | char *path = NULL; | 
|  | #ifdef CONFIG_USER_ONLY | 
|  | TaskState *ts = (TaskState *) current_cpu->opaque; | 
|  | path = g_strdup(ts->bprm->filename); | 
|  | #endif | 
|  | return path; | 
|  | } | 
|  |  | 
|  | uint64_t qemu_plugin_start_code(void) | 
|  | { | 
|  | uint64_t start = 0; | 
|  | #ifdef CONFIG_USER_ONLY | 
|  | TaskState *ts = (TaskState *) current_cpu->opaque; | 
|  | start = ts->info->start_code; | 
|  | #endif | 
|  | return start; | 
|  | } | 
|  |  | 
|  | uint64_t qemu_plugin_end_code(void) | 
|  | { | 
|  | uint64_t end = 0; | 
|  | #ifdef CONFIG_USER_ONLY | 
|  | TaskState *ts = (TaskState *) current_cpu->opaque; | 
|  | end = ts->info->end_code; | 
|  | #endif | 
|  | return end; | 
|  | } | 
|  |  | 
|  | uint64_t qemu_plugin_entry_code(void) | 
|  | { | 
|  | uint64_t entry = 0; | 
|  | #ifdef CONFIG_USER_ONLY | 
|  | TaskState *ts = (TaskState *) current_cpu->opaque; | 
|  | entry = ts->info->entry; | 
|  | #endif | 
|  | return entry; | 
|  | } |