From: "Alex Bennée" <alex.bennee@linaro.org>
To: peter.maydell@linaro.org
Cc: "Alexandre Iooss" <erdnaxe@crans.org>,
"Mahmoud Mandour" <ma.mandourr@gmail.com>,
"Alex Bennée" <alex.bennee@linaro.org>,
qemu-devel@nongnu.org
Subject: [PULL v5 38/44] contrib/plugins: add execlog to log instruction execution and memory access
Date: Wed, 14 Jul 2021 16:00:30 +0100 [thread overview]
Message-ID: <20210714150036.21060-39-alex.bennee@linaro.org> (raw)
In-Reply-To: <20210714150036.21060-1-alex.bennee@linaro.org>
From: Alexandre Iooss <erdnaxe@crans.org>
Log instruction execution and memory access to a file.
This plugin can be used for reverse engineering or for side-channel analysis
using QEMU.
Signed-off-by: Alexandre Iooss <erdnaxe@crans.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20210702081307.1653644-2-erdnaxe@crans.org>
Message-Id: <20210709143005.1554-35-alex.bennee@linaro.org>
diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
new file mode 100644
index 0000000000..2de9f0d7d4
--- /dev/null
+++ b/contrib/plugins/execlog.c
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2021, Alexandre Iooss <erdnaxe@crans.org>
+ *
+ * Log instruction execution with memory access.
+ *
+ * License: GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#include <glib.h>
+#include <inttypes.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <qemu-plugin.h>
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
+
+/* Store last executed instruction on each vCPU as a GString */
+GArray *last_exec;
+
+/**
+ * Add memory read or write information to current instruction log
+ */
+static void vcpu_mem(unsigned int cpu_index, qemu_plugin_meminfo_t info,
+ uint64_t vaddr, void *udata)
+{
+ GString *s;
+
+ /* Find vCPU in array */
+ g_assert(cpu_index < last_exec->len);
+ s = g_array_index(last_exec, GString *, cpu_index);
+
+ /* Indicate type of memory access */
+ if (qemu_plugin_mem_is_store(info)) {
+ g_string_append(s, ", store");
+ } else {
+ g_string_append(s, ", load");
+ }
+
+ /* If full system emulation log physical address and device name */
+ struct qemu_plugin_hwaddr *hwaddr = qemu_plugin_get_hwaddr(info, vaddr);
+ if (hwaddr) {
+ uint64_t addr = qemu_plugin_hwaddr_phys_addr(hwaddr);
+ const char *name = qemu_plugin_hwaddr_device_name(hwaddr);
+ g_string_append_printf(s, ", 0x%08"PRIx64", %s", addr, name);
+ } else {
+ g_string_append_printf(s, ", 0x%08"PRIx64, vaddr);
+ }
+}
+
+/**
+ * Log instruction execution
+ */
+static void vcpu_insn_exec(unsigned int cpu_index, void *udata)
+{
+ GString *s;
+
+ /* Find or create vCPU in array */
+ while (cpu_index >= last_exec->len) {
+ s = g_string_new(NULL);
+ g_array_append_val(last_exec, s);
+ }
+ s = g_array_index(last_exec, GString *, cpu_index);
+
+ /* Print previous instruction in cache */
+ if (s->len) {
+ qemu_plugin_outs(s->str);
+ qemu_plugin_outs("s\n");
+ }
+
+ /* Store new instruction in cache */
+ /* vcpu_mem will add memory access information to last_exec */
+ g_string_printf(s, "%u, ", cpu_index);
+ g_string_append(s, (char *)udata);
+}
+
+/**
+ * On translation block new translation
+ *
+ * QEMU convert code by translation block (TB). By hooking here we can then hook
+ * a callback on each instruction and memory access.
+ */
+static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
+{
+ struct qemu_plugin_insn *insn;
+ uint64_t insn_vaddr;
+ uint32_t insn_opcode;
+ char *insn_disas;
+
+ size_t n = qemu_plugin_tb_n_insns(tb);
+ for (size_t i = 0; i < n; i++) {
+ /*
+ * `insn` is shared between translations in QEMU, copy needed data here.
+ * `output` is never freed as it might be used multiple times during
+ * the emulation lifetime.
+ * We only consider the first 32 bits of the instruction, this may be
+ * a limitation for CISC architectures.
+ */
+ insn = qemu_plugin_tb_get_insn(tb, i);
+ insn_vaddr = qemu_plugin_insn_vaddr(insn);
+ insn_opcode = *((uint32_t *)qemu_plugin_insn_data(insn));
+ insn_disas = qemu_plugin_insn_disas(insn);
+ char *output = g_strdup_printf("0x%"PRIx64", 0x%"PRIx32", \"%s\"",
+ insn_vaddr, insn_opcode, insn_disas);
+
+ /* Register callback on memory read or write */
+ qemu_plugin_register_vcpu_mem_cb(insn, vcpu_mem,
+ QEMU_PLUGIN_CB_NO_REGS,
+ QEMU_PLUGIN_MEM_RW, NULL);
+
+ /* Register callback on instruction */
+ qemu_plugin_register_vcpu_insn_exec_cb(insn, vcpu_insn_exec,
+ QEMU_PLUGIN_CB_NO_REGS, output);
+ }
+}
+
+/**
+ * On plugin exit, print last instruction in cache
+ */
+static void plugin_exit(qemu_plugin_id_t id, void *p)
+{
+ guint i;
+ GString *s;
+ for (i = 0; i < last_exec->len; i++) {
+ s = g_array_index(last_exec, GString *, i);
+ if (s->str) {
+ qemu_plugin_outs(s->str);
+ qemu_plugin_outs("\n");
+ }
+ }
+}
+
+/**
+ * Install the plugin
+ */
+QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
+ const qemu_info_t *info, int argc,
+ char **argv)
+{
+ /*
+ * Initialize dynamic array to cache vCPU instruction. In user mode
+ * we don't know the size before emulation.
+ */
+ last_exec = g_array_new(FALSE, FALSE, sizeof(GString *));
+
+ /* Register translation block and exit callbacks */
+ qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans);
+ qemu_plugin_register_atexit_cb(id, plugin_exit, NULL);
+
+ return 0;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index c340bb02b0..83b55030ad 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3017,6 +3017,7 @@ F: include/tcg/
TCG Plugins
M: Alex Bennée <alex.bennee@linaro.org>
+R: Alexandre Iooss <erdnaxe@crans.org>
S: Maintained
F: docs/devel/tcg-plugins.rst
F: plugins/
diff --git a/contrib/plugins/Makefile b/contrib/plugins/Makefile
index 3431bc1ce9..3c9209b6b0 100644
--- a/contrib/plugins/Makefile
+++ b/contrib/plugins/Makefile
@@ -13,6 +13,7 @@ include $(BUILD_DIR)/config-host.mak
VPATH += $(SRC_PATH)/contrib/plugins
NAMES :=
+NAMES += execlog
NAMES += hotblocks
NAMES += hotpages
NAMES += howvec
--
2.20.1
next prev parent reply other threads:[~2021-07-14 15:37 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-14 14:59 [PULL v5 00/44] testing, build and plugin updates Alex Bennée
2021-07-14 14:59 ` [PULL v5 01/44] Jobs based on custom runners: documentation and configuration placeholder Alex Bennée
2021-07-14 14:59 ` [PULL v5 02/44] Jobs based on custom runners: build environment docs and playbook Alex Bennée
2021-07-14 14:59 ` [PULL v5 03/44] Jobs based on custom runners: docs and gitlab-runner setup playbook Alex Bennée
2021-07-14 14:59 ` [PULL v5 04/44] Jobs based on custom runners: add job definitions for QEMU's machines Alex Bennée
2021-07-14 14:59 ` [PULL v5 05/44] tests/tcg: also disable the signals test for plugins Alex Bennée
2021-07-14 14:59 ` [PULL v5 06/44] meson: fix condition for io_uring stubs Alex Bennée
2021-07-14 14:59 ` [PULL v5 07/44] disable modular TCG on Darwin Alex Bennée
2021-07-14 15:00 ` [PULL v5 08/44] build: validate that system capstone works before using it Alex Bennée
2021-07-14 15:00 ` [PULL v5 09/44] gitlab: support for FreeBSD 12, 13 and macOS 11 via cirrus-run Alex Bennée
2021-07-14 15:00 ` [PULL v5 10/44] cirrus: delete FreeBSD and macOS jobs Alex Bennée
2021-07-14 15:00 ` [PULL v5 11/44] hw/usb/ccid: remove references to NSS Alex Bennée
2021-07-14 15:00 ` [PULL v5 12/44] tests/docker: don't use BUILDKIT in GitLab either Alex Bennée
2021-07-14 15:00 ` [PULL v5 13/44] tests/docker: use project specific container registries Alex Bennée
2021-07-14 15:00 ` [PULL v5 14/44] tests/docker: use explicit docker.io registry Alex Bennée
2021-07-14 15:00 ` [PULL v5 15/44] tests/docker: remove FEATURES env var from templates Alex Bennée
2021-07-14 15:00 ` [PULL v5 16/44] tests/docker: fix sorting in package lists Alex Bennée
2021-07-14 15:00 ` [PULL v5 17/44] tests/docker: fix mistakes in centos " Alex Bennée
2021-07-14 15:00 ` [PULL v5 18/44] tests/docker: fix mistakes in fedora package list Alex Bennée
2021-07-14 15:00 ` [PULL v5 19/44] tests/docker: fix mistakes in ubuntu package lists Alex Bennée
2021-07-14 15:00 ` [PULL v5 20/44] tests/docker: remove mingw packages from Fedora Alex Bennée
2021-07-14 15:00 ` [PULL v5 21/44] tests/docker: expand centos8 package list Alex Bennée
2021-07-14 15:00 ` [PULL v5 22/44] tests/docker: expand fedora " Alex Bennée
2021-07-14 15:00 ` [PULL v5 23/44] tests/docker: expand ubuntu1804 " Alex Bennée
2021-07-14 15:00 ` [PULL v5 24/44] tests/docker: expand ubuntu2004 " Alex Bennée
2021-07-14 15:00 ` [PULL v5 25/44] tests/docker: expand opensuse-leap " Alex Bennée
2021-07-14 15:00 ` [PULL v5 26/44] tests/vm: update NetBSD to 9.2 Alex Bennée
2021-07-14 15:00 ` [PULL v5 27/44] tests/vm: update openbsd to release 6.9 Alex Bennée
2021-07-14 15:00 ` [PULL v5 28/44] tests/tcg: make test-mmap a little less aggressive Alex Bennée
2021-07-14 15:00 ` [PULL v5 29/44] plugins: fix-up handling of internal hostaddr for 32 bit Alex Bennée
2021-07-14 15:00 ` [PULL v5 30/44] meson.build: move TCG plugin summary output Alex Bennée
2021-07-14 15:00 ` [PULL v5 31/44] meson.build: relax the libdl test to one for the function dlopen Alex Bennée
2021-07-14 15:00 ` [PULL v5 32/44] tcg/plugins: remove some stale entries from the symbol list Alex Bennée
2021-07-14 15:00 ` [PULL v5 33/44] configure: don't allow plugins to be enabled for a non-TCG build Alex Bennée
2021-07-14 15:00 ` [PULL v5 34/44] configure: add an explicit static and plugins check Alex Bennée
2021-07-14 15:00 ` [PULL v5 35/44] configure: stop user enabling plugins on Windows for now Alex Bennée
2021-07-14 15:00 ` [PULL v5 36/44] tcg/plugins: enable by default for most TCG builds Alex Bennée
2021-07-14 15:00 ` [PULL v5 37/44] contrib/plugins: enable -Wall for building plugins Alex Bennée
2021-07-14 15:00 ` Alex Bennée [this message]
2021-07-14 15:00 ` [PULL v5 39/44] docs/devel: tcg-plugins: add execlog plugin description Alex Bennée
2021-07-14 15:00 ` [PULL v5 40/44] plugins: Added a new cache modelling plugin Alex Bennée
2021-07-14 15:00 ` [PULL v5 41/44] plugins/cache: Enable cache parameterization Alex Bennée
2021-07-14 15:00 ` [PULL v5 42/44] plugins/cache: Added FIFO and LRU eviction policies Alex Bennée
2021-07-14 15:00 ` [PULL v5 43/44] docs/devel: Added cache plugin to the plugins docs Alex Bennée
2021-07-14 15:00 ` [PULL v5 44/44] MAINTAINERS: Added myself as a reviewer for TCG Plugins Alex Bennée
2021-07-15 18:05 ` [PULL v5 00/44] testing, build and plugin updates Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210714150036.21060-39-alex.bennee@linaro.org \
--to=alex.bennee@linaro.org \
--cc=erdnaxe@crans.org \
--cc=ma.mandourr@gmail.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).