summary refs log tree commit diff stats
path: root/contrib/plugins (follow)
Commit message (Collapse)AuthorAgeFilesLines
* contrib/plugins/uftrace_symbols.pyPierrick Bouvier2025-09-261-0/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | usage: contrib/plugins/uftrace_symbols.py \ --prefix-symbols \ arm-trusted-firmware/build/qemu/debug/bl1/bl1.elf \ arm-trusted-firmware/build/qemu/debug/bl2/bl2.elf \ arm-trusted-firmware/build/qemu/debug/bl31/bl31.elf \ u-boot/u-boot:0x60000000 \ u-boot/u-boot.relocated:0x000000023f6b6000 \ linux/vmlinux Will generate symbols and memory mapping files for uftrace, allowing to have an enhanced trace, instead of raw addresses. It takes a collection of elf files, and automatically find all their symbols, and generate an ordered memory map based on that. This script uses the python (native) pyelftools module. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Acked-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250902075042.223990-9-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-25-alex.bennee@linaro.org>
* contrib/plugins/uftrace: implement x64 supportPierrick Bouvier2025-09-261-0/+86
| | | | | | | | | | | It's trivial to implement x64 support, as it's the same stack layout as aarch64. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-8-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-24-alex.bennee@linaro.org>
* contrib/plugins/uftrace: generate additional files for uftracePierrick Bouvier2025-09-261-1/+130
| | | | | | | | | | | | | | | | | | | | | | | Beyond traces per cpu, uftrace expect to find some specific files. - info: contains information about machine/program run those values are not impacting uftrace behaviour (only reported by uftrace info), and we simply added empty strings. - memory mapping: how every binary is mapped in memory. For system mode, we generate an empty mapping (uftrace_symbols.py, coming in future commit, will take care of that). For user mode, we copy current /proc/self/maps. We don't need to do any special filtering, as reported addresses will necessarily concern guest program, and not QEMU and its libraries. - task: list of tasks. We present every vcpu/privilege level as a separate process, as it's the best view we can have when generating a (visual) chrome trace. Using threads is less convenient in terms of UI. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-7-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-23-alex.bennee@linaro.org>
* contrib/plugins/uftrace: implement privilege level tracingPierrick Bouvier2025-09-261-8/+182
| | | | | | | | | | | | | | | We add new option trace-privilege-level=bool, which will create a separate trace for each privilege level. This allows to follow changes of privilege during execution. We implement aarch64 operations to track current privilege level accordingly. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-6-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-22-alex.bennee@linaro.org>
* contrib/plugins/uftrace: implement tracingPierrick Bouvier2025-09-261-1/+151
| | | | | | | | | | | | | | | | | | | We implement tracing, following uftrace format. Trace is flushed every 32 MB, so file operations don't impact performance at runtime. A different trace is generated per cpu, and we ensure they have a unique name, based on vcpu_index, while keeping room for privilege level coming in next commit. Uftrace format is not officially documented, but it can be found here: https://github.com/namhyung/uftrace/blob/v0.18/libmcount/record.c#L909 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-5-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-21-alex.bennee@linaro.org>
* contrib/plugins/uftrace: track callstackPierrick Bouvier2025-09-261-0/+160
| | | | | | | | | | | | | We now track callstack, based on frame pointer analysis. We can detect function calls, returns, and discontinuities. We implement a frame pointer based unwinding that is used for discontinuities. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-4-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-20-alex.bennee@linaro.org>
* contrib/plugins/uftrace: define cpu operations and implement aarch64Pierrick Bouvier2025-09-261-4/+110
| | | | | | | | | | | | | | We define a new CpuOps structure that will be used to implement tracking independently of guest architecture. As well, we now instrument only instructions following ones that might have touched the frame pointer. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-3-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-19-alex.bennee@linaro.org>
* contrib/plugins/uftrace: skeleton filePierrick Bouvier2025-09-262-1/+75
| | | | | | | | | | | | | | We define a scoreboard that will hold our data per cpu. As well, we define a buffer per cpu that will be used to read registers and memories in a thread-safe way. For now, we just instrument all instructions with an empty callback. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-2-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-18-alex.bennee@linaro.org>
* contrib/plugins/execlog: Explicitly check for qemu_plugin_read_register() ↵Peter Maydell2025-09-261-0/+1
| | | | | | | | | | | | | | | | | | | failure In insn_check_regs() we don't explicitly check whether qemu_plugin_read_register() failed, which confuses Coverity into thinking that sz can be -1 in the memcmp(). In fact the assertion that sz == reg->last->len means this can't happen, but it's clearer to both humans and Coverity if we explicitly assert that sz > 0, as we already do in init_vcpu_register(). Coverity: CID 1611901, 1611902 Fixes: af6e4e0a22c1 ("contrib/plugins: extend execlog to track register changes") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250710144543.1187715-1-peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-17-alex.bennee@linaro.org>
* contrib/plugins/execlog: Add tab to the separator search of insn_disasYodel Eldar2025-07-141-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Currently, execlog searches for a space separator between the instruction mnemonic and operands, but some disassemblers, e.g. Alpha's, use a tab separator instead; this results in a null pointer being passed as the haystack in g_strstr during a subsequent register search, i.e. undefined behavior, because of a missing null check. This patch adds tab to the separator search and a null check on the result. Also, an affected pointer is changed to const. Lastly, a break statement was added to immediately terminate the register search when a user-requested register is found in the current instruction as a trivial optimization, because searching for the remaining requested registers is unnecessary once one is found. Suggested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Yodel Eldar <yodel.eldar@gmail.com> Message-ID: <20250630164124.26315-2-yodel.eldar@gmail.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250710104531.3099313-4-alex.bennee@linaro.org>
* meson: fix Windows buildoltolm2025-06-161-1/+1
| | | | | | | | | | | | The build fails on Windows. Replace calls to Unix programs like ´cat´, ´sed´ and ´true´ with calls to ´python´ and wrap calls to ´os.path.relpath´ in try-except because it can fail when the two paths are on different drives. Make sure to convert the Windows paths to Unix paths to prevent warnings in generated files. Signed-off-by: oltolm <oleg.tolmatcev@gmail.com> Message-id: 20250612221521.1109-2-oleg.tolmatcev@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* contrib/plugins: allow setting of instructions per quantumAlex Bennée2025-06-071-1/+14
| | | | | | | | | | The default is we update time every 1/10th of a second or so. However for some cases we might want to update time more frequently. Allow this to be set via the command line through the ipq argument. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250603110204.838117-7-alex.bennee@linaro.org>
* contrib/plugins: add a scaling factor to the ips argAlex Bennée2025-06-071-1/+33
| | | | | | | | | It's easy to get lost in zeros while setting the numbers of instructions per second. Add a scaling suffix to make things simpler. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250603110204.838117-6-alex.bennee@linaro.org>
* contrib/plugins: Fix type conflict of GLib function pointersKohei Tokunaga2025-04-256-21/+21
| | | | | | | | | | | | | | On Emscripten, function pointer casts can result in runtime failures due to strict function signature checks. This affects the use of g_list_sort and g_slist_sort, which internally perform function pointer casts that are not supported by Emscripten. To avoid these issues, g_list_sort_with_data and g_slist_sort_with_data should be used instead, as they do not rely on function pointer casting. Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <0fcddfca16ca8da2bdaa7b2c114476f5b73d032b.1745295397.git.ktokunaga.mail@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* plugins: add explicit dependency in functional testsPierrick Bouvier2025-03-101-0/+2
| | | | | | | | | | | | | | | | ./tests/functional/test_aarch64_tcg_plugins.py needs to have plugin libinsn built. However, it's not listed as a dependency, so meson can't know it needs to be built. Thus, we keep track of all plugins, and add them as an explicit dependency. Fixes: 4c134d07b9e ("tests: add a new set of tests to exercise plugins") Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250304222439.2035603-9-alex.bennee@linaro.org>
* plugins: fix -Werror=maybe-uninitialized false-positiveMarc-André Lureau2025-02-031-1/+1
| | | | | | | | | | | | ../contrib/plugins/cache.c:638:9: error: ‘l2_cache’ may be used uninitialized [-Werror=maybe-uninitialized] 638 | append_stats_line(rep, l1_dmem_accesses, l1_dmisses, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Is a false-positive, since cores > 1, so the variable is set in the above loop. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
* plugins: enable linking with clang/lldPierrick Bouvier2025-01-171-1/+1
| | | | | | | | | | | | | | | | Windows uses a special mechanism to enable plugins to work (DLL delay loading). Option for lld is different than ld. MSYS2 clang based environment use lld by default, so restricting to this config on Windows is safe, and will avoid false bug reports. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Tested-by: Stefan Weil <sw@weilnetz.de> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250110203401.178532-4-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-26-alex.bennee@linaro.org>
* contrib/plugins/hotpages: fix 32-bit buildPierrick Bouvier2025-01-171-3/+3
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-11-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-21-alex.bennee@linaro.org>
* contrib/plugins/hwprofile: fix 32-bit buildPierrick Bouvier2025-01-171-11/+16
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-10-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-20-alex.bennee@linaro.org>
* contrib/plugins/cflow: fix 32-bit buildPierrick Bouvier2025-01-171-6/+11
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-9-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-19-alex.bennee@linaro.org>
* contrib/plugins/hotblocks: fix 32-bit buildPierrick Bouvier2025-01-171-5/+24
| | | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241217224306.2900490-8-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-18-alex.bennee@linaro.org>
* contrib/plugins/cache: fix 32-bit buildPierrick Bouvier2025-01-171-12/+6
| | | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241217224306.2900490-7-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-17-alex.bennee@linaro.org>
* contrib/plugins/stoptrigger: fix 32-bit buildPierrick Bouvier2025-01-171-21/+27
| | | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241217224306.2900490-6-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-16-alex.bennee@linaro.org>
* contrib/plugins/howvec: ensure we don't regress if this plugin is extendedPierrick Bouvier2025-01-171-3/+4
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-3-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-13-alex.bennee@linaro.org>
* contrib/plugins/bbv.c: Start bb index from 1ckf1042024-12-281-1/+1
| | | | | | | | | Standard simpoint tool reqeusts that index of basic block index starts from 1. Signed-off-by: ckf104 <1900011634@pku.edu.cn> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* contrib/plugins: remove Makefile for contrib/pluginsPierrick Bouvier2024-11-051-87/+0
| | | | | | | | Now replaced by meson build. Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241023212812.1376972-4-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* meson: build contrib/plugins with mesonPierrick Bouvier2024-11-051-0/+28
| | | | | | | | | | | | Tried to unify this meson.build with tests/tcg/plugins/meson.build but the resulting modules are not output in the right directory. Originally proposed by Anton Kochkov, thank you! Solves: https://gitlab.com/qemu-project/qemu/-/issues/1710 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241023212812.1376972-3-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* contrib/plugins/cflow: fix warningPierrick Bouvier2024-11-051-3/+3
| | | | | | | | | | | | | | contrib/plugins/cflow.c: In function ‘plugin_exit’: contrib/plugins/cflow.c:167:19: error: declaration of ‘n’ shadows a previous local [-Werror=shadow=local] 167 | NodeData *n = l->data; | ^ contrib/plugins/cflow.c:139:9: note: shadowed declaration is here 139 | int n = 0; | ^ Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241023212812.1376972-2-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* contrib/plugins: avoid hanging programAlex Bennée2024-09-191-0/+6
| | | | | | | | | | | | Although we asks for instructions per second we work in quanta and that cannot be 0. Fail to load the plugin instead and report the minimum IPS we can handle. Reported-by: Elisha Hollander <just4now666666@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240916085400.1046925-19-alex.bennee@linaro.org>
* contrib/plugins: Add a plugin to generate basic block vectorsAkihiko Odaki2024-09-192-0/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | SimPoint is a widely used tool to find the ideal microarchitecture simulation points so Valgrind[2] and Pin[3] support generating basic block vectors for use with them. Let's add a corresponding plugin to QEMU too. Note that this plugin has a different goal with tests/plugin/bb.c. This plugin creates a vector for each constant interval instead of counting the execution of basic blocks for the entire run and able to describe the change of execution behavior. Its output is also syntactically simple and better suited for parsing, while the output of tests/plugin/bb.c is more human-readable. [1] https://cseweb.ucsd.edu/~calder/simpoint/ [2] https://valgrind.org/docs/manual/bbv-manual.html [3] https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-dynamic-binary-instrumentation-tool.html Signed-off-by: Yotaro Nada <yotaro.nada@gmail.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240816-bb-v3-1-b9aa4a5c75c5@daynix.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240916085400.1046925-16-alex.bennee@linaro.org>
* contrib/plugins: control flow pluginAlex Bennée2024-09-192-0/+389
| | | | | | | | | | | This is a simple control flow tracking plugin that uses the latest inline and conditional operations to detect and track control flow changes. It is currently an exercise at seeing how useful the changes are. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240916085400.1046925-4-alex.bennee@linaro.org>
* contrib/plugins/Makefile: Add a 'distclean' targetThomas Huth2024-09-111-1/+1
| | | | | | | | | | | | | | Running "make distclean" in the build tree currently fails since this tries to run the "distclean" target in the contrib/plugins/ folder, too, but the Makefile there is missing this target. Thus add 'distclean' there to fix this issue. And to avoid regressions with "make distclean", add this command to one of the build jobs, too. Message-ID: <20240902154749.73876-1-thuth@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* contrib/plugins/execlog: Fix shadowed declaration warningPierrick Bouvier2024-08-201-2/+2
| | | | | | | | | | | | | | | | | Found on debian stable. ../contrib/plugins/execlog.c: In function ‘vcpu_tb_trans’: ../contrib/plugins/execlog.c:236:22: error: declaration of ‘n’ shadows a previous local [-Werror=shadow=local] 236 | for (int n = 0; n < all_reg_names->len; n++) { | ^ ../contrib/plugins/execlog.c:184:12: note: shadowed declaration is here 184 | size_t n = qemu_plugin_tb_n_insns(tb); | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240814233645.944327-2-pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* contrib/plugins: add compat for g_memdup2Alex Bennée2024-07-301-0/+25
| | | | | | | | | | | | We were premature if bumping this because some of our builds are still on older glibs. Just copy the compat handler for now and we can remove it later. Fixes: ee293103b0 (plugins: update lockstep to use g_memdup2) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2161 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240729144414.830369-14-alex.bennee@linaro.org>
* contrib/plugins: be more vocal buildingAlex Bennée2024-07-301-5/+20
| | | | | | | | | | | With the conversion to meson and removing the old QEMU Makefile baggage we became very silent when building the plugins. Bring in a copy of the quiet-command logic (and some magic COMMAs) so we can at least assure developers we are building them. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2457 Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240729144414.830369-13-alex.bennee@linaro.org>
* contrib/plugins/cache.c: Remove redundant check of l2_accessPeter Maydell2024-07-301-1/+1
| | | | | | | | | | | | | | | | | In append_stats_line(), we have an expression l2_access ? l2_miss_rate : 0.0 But this is inside an if (l2_access && l2_misses) { ... } block, so Coverity points out that the false part of the ?: is dead code. Remove the unnecessary test. Resolves: Coverity CID 1522458 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240725164851.1930964-1-peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240729144414.830369-12-alex.bennee@linaro.org>
* plugins/execlog.c: correct dump of registers valuesFrédéric Pétrot2024-07-221-1/+1
| | | | | | | | | | | Register values are dumped as 'sz' chunks of two nibbles in the execlog plugin, sz was 1 too big. Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240620083805.73603-1-frederic.petrot@univ-grenoble-alpes.fr> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240718094523.1198645-8-alex.bennee@linaro.org>
* plugins/stoptrigger: TCG plugin to stop execution under conditionsSimon Hamelin2024-07-222-0/+152
| | | | | | | | | | | | | | | | | | | This new plugin allows to stop emulation using conditions on the emulation state. By setting this plugin arguments, it is possible to set an instruction count limit and/or trigger address(es) to stop at. The code returned at emulation exit can be customized. This plugin demonstrates how someone could stop QEMU execution. It could be used for research purposes to launch some code and deterministically stop it and understand where its execution flow went. Co-authored-by: Alexandre Iooss <erdnaxe@crans.org> Signed-off-by: Simon Hamelin <simon.hamelin@grenoble-inp.org> Signed-off-by: Alexandre Iooss <erdnaxe@crans.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240715081521.19122-2-simon.hamelin@grenoble-inp.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240718094523.1198645-5-alex.bennee@linaro.org>
* plugins/lockstep: clean-up outputAlex Bennée2024-07-051-8/+8
| | | | | | | | | We were repeating information which wasn't super clear. As we already will have dumped the last failing PC just note the divergence and dump the previous instruction log. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-27-alex.bennee@linaro.org>
* plugins/lockstep: mention the one-insn-per-tb optionAlex Bennée2024-07-051-1/+2
| | | | | | | | This really helps with lockstep although its super slow on big jobs. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-26-alex.bennee@linaro.org>
* plugins/lockstep: make mixed-mode safeAlex Bennée2024-07-051-2/+2
| | | | | | | | | | The ExecState is shared across the socket and if we want to compare say 64 bit and 32 bit binaries we need the two to use the same sizes for things. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-25-alex.bennee@linaro.org>
* plugins/lockstep: preserve sock_pathAlex Bennée2024-07-051-1/+1
| | | | | | | | | We can't assign sock_path directly from the autofree'd GStrv, take a copy. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-24-alex.bennee@linaro.org>
* contrib/plugins: add Instructions Per Second (IPS) example for cost modelingPierrick Bouvier2024-06-242-0/+165
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This plugin uses the new time control interface to make decisions about the state of time during the emulation. The algorithm is currently very simple. The user specifies an ips rate which applies per core. If the core runs ahead of its allocated execution time the plugin sleeps for a bit to let real time catch up. Either way time is updated for the emulation as a function of total executed instructions with some adjustments for cores that idle. Examples -------- Slow down execution of /bin/true: $ num_insn=$(./build/qemu-x86_64 -plugin ./build/tests/plugin/libinsn.so -d plugin /bin/true |& grep total | sed -e 's/.*: //') $ time ./build/qemu-x86_64 -plugin ./build/contrib/plugins/libips.so,ips=$(($num_insn/4)) /bin/true real 4.000s Boot a Linux kernel simulating a 250MHz cpu: $ /build/qemu-system-x86_64 -kernel /boot/vmlinuz-6.1.0-21-amd64 -append "console=ttyS0" -plugin ./build/contrib/plugins/libips.so,ips=$((250*1000*1000)) -smp 1 -m 512 check time until kernel panic on serial0 Tested in system mode by booting a full debian system, and using: $ sysbench cpu run Performance decrease linearly with the given number of ips. Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240530220610.1245424-7-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240620152220.2192768-11-alex.bennee@linaro.org>
* plugins: Copy memory in qemu_plugin_insn_dataRichard Henderson2024-05-152-4/+5
| | | | | | | | Instead of returning a host pointer, copy the data into storage provided by the caller. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* contrib/plugins/execlog: Fix compiler warningYao Xingtao2024-03-261-3/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. The g_pattern_match_string() is deprecated when glib2 version >= 2.70. Use g_pattern_spec_match_string() instead to avoid this problem. 2. The type of second parameter in g_ptr_array_add() is 'gpointer' {aka 'void *'}, but the type of reg->name is 'const char*'. Cast the type of reg->name to 'gpointer' to avoid this problem. compiler warning message: contrib/plugins/execlog.c:330:17: warning: ‘g_pattern_match_string’ is deprecated: Use 'g_pattern_spec_match_string' instead [-Wdeprecated-declarations] 330 | if (g_pattern_match_string(pat, rd->name) || | ^~ In file included from /usr/include/glib-2.0/glib.h:67, from contrib/plugins/execlog.c:9: /usr/include/glib-2.0/glib/gpattern.h:57:15: note: declared here 57 | gboolean g_pattern_match_string (GPatternSpec *pspec, | ^~~~~~~~~~~~~~~~~~~~~~ contrib/plugins/execlog.c:331:21: warning: ‘g_pattern_match_string’ is deprecated: Use 'g_pattern_spec_match_string' instead [-Wdeprecated-declarations] 331 | g_pattern_match_string(pat, rd_lower)) { | ^~~~~~~~~~~~~~~~~~~~~~ /usr/include/glib-2.0/glib/gpattern.h:57:15: note: declared here 57 | gboolean g_pattern_match_string (GPatternSpec *pspec, | ^~~~~~~~~~~~~~~~~~~~~~ contrib/plugins/execlog.c:339:63: warning: passing argument 2 of ‘g_ptr_array_add’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 339 | g_ptr_array_add(all_reg_names, reg->name); | ~~~^~~~~~ In file included from /usr/include/glib-2.0/glib.h:33: /usr/include/glib-2.0/glib/garray.h:198:62: note: expected ‘gpointer’ {aka ‘void *’} but argument is of type ‘const char *’ 198 | gpointer data); | ~~~~~~~~~~~~~~~~~~^~~~ Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2210 Signed-off-by: Yao Xingtao <yaoxt.fnst@fujitsu.com> Message-ID: <20240326015257.21516-1-yaoxt.fnst@fujitsu.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* tests/plugins: fix use-after-free bugPaolo Bonzini2024-03-201-1/+1
| | | | | | | | | | | rec->count.score is inside rec, which is freed before rec->count.score is. Reorder the instructions Reported by Coverity as CID 1539967. Cc: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* contrib/plugins/howvec: migrate to new per_vcpu APIPierrick Bouvier2024-03-061-15/+38
| | | | | | | | | Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240304130036.124418-11-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240305121005.3528075-24-alex.bennee@linaro.org>
* contrib/plugins/hotblocks: migrate to new per_vcpu APIPierrick Bouvier2024-03-061-20/+30
| | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240304130036.124418-10-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240305121005.3528075-23-alex.bennee@linaro.org>
* contrib/plugins: extend execlog to track register changesAlex Bennée2024-02-281-51/+265
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the new plugin register API we can now track changes to register values. Currently the implementation is fairly dumb which will slow down if a large number of register values are being tracked. This could be improved by only instrumenting instructions which mention registers we are interested in tracking. Example usage: ./qemu-aarch64 -D plugin.log -d plugin \ -cpu max,sve256=on \ -plugin contrib/plugins/libexeclog.so,reg=sp,reg=z\* \ ./tests/tcg/aarch64-linux-user/sha512-sve will display in the execlog any changes to the stack pointer (sp) and the SVE Z registers. As testing registers every instruction will be quite a heavy operation there is an additional flag which attempts to optimise the register tracking by only instrumenting instructions which are likely to change its value. This relies on the QEMU disassembler showing up the register names in disassembly so is an explicit opt-in. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Cc: Akihiko Odaki <akihiko.odaki@daynix.com> Based-On: <20231025093128.33116-19-akihiko.odaki@daynix.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240227144335.1196131-27-alex.bennee@linaro.org>
* contrib/plugins: fix imatchAlex Bennée2024-02-281-1/+1
| | | | | | | | | | We can't directly save the ephemeral imatch from argv as that memory will get recycled. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240227144335.1196131-26-alex.bennee@linaro.org>