Re: [Qemu-devel] [PATCH v3 19/50] tcg: let plugins instrument memory accesses

[Alex Bennée]

Aaron Lindsay OS <address@hidden> writes:

> On Jun 28 18:11, Alex Bennée wrote:
>> Aaron Lindsay OS <address@hidden> writes:
>> > On Jun 14 18:11, Alex Bennée wrote:
>> >> From: "Emilio G. Cota" <address@hidden>
>> >>
>> >> Here the trickiest feature is passing the host address to
>> >> memory callbacks that request it. Perhaps it would be more
>> >> appropriate to pass a "physical" address to plugins, but since
>> >> in QEMU host addr ~= guest physical, I'm going with that for
>> >> simplicity.
>> >
>> > How much more difficult would it be to get the true physical address (on
>> > the guest)?
>>
>> Previously there was a helper that converted host address (i.e. where
>> QEMU actually stores that value) back to the physical address (ram
>> offset + ram base). However the code for calculating all of this is
>> pretty invasive and requires tweaks to all the softmmu TCG backends as
>> well as hooks into a slew of memory functions.
>>
>> I'm re-working this now so we just have the one memory callback and we
>> provide a helper function that can provide an opaque hwaddr struct which
>> can then be queried.
>
> To make sure I understand - you're implying that one such query will
> return the PA from the guest's perspective, right?

Yes - although it will be two queries:

  struct qemu_plugin_hwaddr *hw = qemu_plugin_get_hwaddr(info, vaddr);

This does the actual lookup and stores enough information for the
further queries.

  uint64_t pa = qemu_plugin_hwaddr_to_raddr(hw);

will return the physical address (assuming it's a RAM reference and not
some IO location).

>
>> The catch is you can only call this helper during a
>> memory callback.
>
> Does this mean it will be difficult to get the physical address for the
> bytes containing the instruction encoding itself?

Hmm good question. We track the hostaddr of the instructions as we load
them so we should be able to track that back to the guest physical
address. There isn't a helper for doing that yet though.

>
>> I'm not sure if having this restriction violates our
>> aim of not leaking implementation details to the plugin but it makes the
>> code simpler.
>
> Assuming that the purpose of "not leaking implementation details" is to
> allow the same plugin interface to work with other backend
> implementations in the future, isn't this probably fine?

Quite. We don't want plugin authors to make any assumptions about the
internals of the TCG. It's not totally opaque because there are
translation time events where we offer the plugin a chance to instrument
individual instructions (or even a "block") which obviously exposes
there is a JIT of some sort.

> It may add an
> unnecessary limitation for another backend driving the same plugin
> interface, but I don't think it likely changes the structure of the
> interface itself. And that seems like the sort of restriction that could
> easily be dropped in the future while remaining backwards-compatible.
>
>> Internally what the helper does is simply re-query the SoftMMU TLB. As
>> the TLBs are per-CPU nothing else can have touched the TLB and the cache
>> should be hot so the cost of lookup should be minor. We could also
>> potentially expand the helpers so if you are interested in only IO
>> accesses we can do the full resolution and figure out what device we
>> just accessed.
>
> Oh, so you're already working on doing just what I asked about?

Yes.

>
>> > This is important enough to me that I would be willing to help if
>> > pointed in the right direction.
>>
>> Well I'll certainly CC on the next series (hopefully posted Monday,
>> softfreeze starts Tuesday). I'll welcome any testing and review. Also if
>> you can tell us more about your use case that will help.
>
> Awesome, thanks!
>
> In terms of our use case - we use QEMU to drive studies to help us
> design the next generation of processors. As you can imagine, having the
> right physical addresses is important for some aspects of that. We're
> currently using a version of Pavel Dovgalyuk's earlier plugin patchset
> with some of our own patches/fixes on top, but it would obviously make
> our lives easier to work together to get this sort of infrastructure
> upstream!

Was this:

 Date: Tue, 05 Jun 2018 13:39:15 +0300
 Message-ID: <152819515565.30857.16834004920507717324.stgit@pasha-ThinkPad-T60>
 Subject: [Qemu-devel] [RFC PATCH v2 0/7] QEMU binary instrumentation prototype

There have certainly been a lot of attempts to getting some sort of
plugin functionality into QEMU. I make no promises this one will be the
one but we shall see!

What patches did you add on top?

>
> -Aaron


--
Alex Bennée