Re: [PATCH v2 2/2] docs/devel: tvg-plugins: add execlog plugin description

From: Alexandre IOOSS <erdnaxe@crans.org>
To: "Alex Bennée" <alex.bennee@linaro.org>
Cc: Mahmoud Mandour <ma.mandourr@gmail.com>,
	"open list : All patches CC here" <qemu-devel@nongnu.org>
Subject: Re: [PATCH v2 2/2] docs/devel: tvg-plugins: add execlog plugin description
Date: Tue, 22 Jun 2021 15:16:37 +0200	[thread overview]
Message-ID: <9c43ebbe-d0cd-5244-ba86-477e40f0c835@crans.org> (raw)
In-Reply-To: <87y2b2rxju.fsf@linaro.org>

[-- Attachment #1.1: Type: text/plain, Size: 3448 bytes --]

On 6/22/21 12:37 PM, Alex Bennée wrote:
> 
> Alexandre IOOSS <erdnaxe@crans.org> writes:
> 
>> [[PGP Signed Part:Undecided]]
>> On 6/22/21 10:48 AM, Alex Bennée wrote:
>>> Alexandre Iooss<erdnaxe@crans.org>  writes:
>>>> [...]
>>>> +
>>>> +The execlog tool traces executed instructions with memory access. It can be used
>>>> +for debugging and security analysis purposes.
>>> We should probably mention that this will generate a lot of output.
>>> Running the admittedly memory heavy softmmu memory test:
>>>     ./aarch64-softmmu/qemu-system-aarch64 -D test.out -d plugin \
>>>       -plugin contrib/plugins/libexeclog.so  \
>>>       -cpu max -serial mon:stdio -M virt \
>>>       -display none -semihosting-config chardev=serial0 \
>>>       -kernel ./tests/tcg/aarch64-softmmu/memory
>>> generates a 8.6Gb text file. I suspect once this is merged you might
>>> want to look at options to target the instrumentation at areas of
>>> specific interest or abbreviate information.
>>
>> Yes! In my downstream version I am triggering the beginning and the
>> end of trace acquisition by matching two virtual addresses of GPIO
>> device access. This works in my case because I'm also using the same
>> GPIO for triggering an oscilloscope, but maybe we would like to
>> upstream something more generic.
>>
>> I'm still thinking about this (maybe for a later patch) but I believe
>> it would be nice to have the following:
>>   - If no argument is given to the plugin, log everything.
>>   - Allow the user to specify either a memory address, an instruction
>>     virtual address or an opcode that would start the acquisition.
>>   - Same to stop the acquisition.
> 
> Sounds reasonable to me.
> 
>> This would look like this to start/stop acquisition using GPIO PA8 on
>> STM32VLDISCOVERY:
>>
>>    ./arm-softmmu/qemu-system-arm -M stm32vldiscovery \
>>      -kernel ./firmware.elf -d plugin \
>>      -plugin libexeclog.so,arg=mem:1073809424,arg=mem:1073809424
> 
> I quite like the formats you can use for -dfilter, for example:
> 
>    0x1000+0x100,0x2100-0x100,0x3000..0x3100
> 
> it might even be worth exposing qemu_set_dfilter_ranges as a helper
> function to plugins to avoid copy and paste.

We could expose "-dfilter", but maybe it is better to reserve it to 
filter the output of the plugin rather than triggering the tracing?

I could implement a format similar to dfilter to configure triggering. 
This would enable someone to start logging on any access to a memory range.

> 
> So what would your above command trigger? A write to 1073809424 would
> start the trace and the next write to the same address would stop it?
> 

Yes exactly. In this case the first access set the GPIO high, and the 
second access set it low.

I don't believe the plugin can access the value stored in memory (i.e. 
differentiating between setting a GPIO output high or low). I don't find 
this problematic in my case, but maybe it could be for someone else.

 From the discussion I see the following possible patches:
1. Add an argument to trigger the beginning with one address (memory or 
instruction).
2. Add an argument to trigger the end with one address (memory or 
instruction).
3. Add the support for ranges (in "dfilter" style).
4. (maybe) Add the support to trigger on an opcode.
5. Add support for "-dfilter" to filter the logging output.

Thanks,
-- Alexandre

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]