summary refs log tree commit diff stats
path: root/contrib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* contrib/plugins/uftrace_symbols.pyPierrick Bouvier2025-09-261-0/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | usage: contrib/plugins/uftrace_symbols.py \ --prefix-symbols \ arm-trusted-firmware/build/qemu/debug/bl1/bl1.elf \ arm-trusted-firmware/build/qemu/debug/bl2/bl2.elf \ arm-trusted-firmware/build/qemu/debug/bl31/bl31.elf \ u-boot/u-boot:0x60000000 \ u-boot/u-boot.relocated:0x000000023f6b6000 \ linux/vmlinux Will generate symbols and memory mapping files for uftrace, allowing to have an enhanced trace, instead of raw addresses. It takes a collection of elf files, and automatically find all their symbols, and generate an ordered memory map based on that. This script uses the python (native) pyelftools module. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Acked-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250902075042.223990-9-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-25-alex.bennee@linaro.org>
* contrib/plugins/uftrace: implement x64 supportPierrick Bouvier2025-09-261-0/+86
| | | | | | | | | | | It's trivial to implement x64 support, as it's the same stack layout as aarch64. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-8-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-24-alex.bennee@linaro.org>
* contrib/plugins/uftrace: generate additional files for uftracePierrick Bouvier2025-09-261-1/+130
| | | | | | | | | | | | | | | | | | | | | | | Beyond traces per cpu, uftrace expect to find some specific files. - info: contains information about machine/program run those values are not impacting uftrace behaviour (only reported by uftrace info), and we simply added empty strings. - memory mapping: how every binary is mapped in memory. For system mode, we generate an empty mapping (uftrace_symbols.py, coming in future commit, will take care of that). For user mode, we copy current /proc/self/maps. We don't need to do any special filtering, as reported addresses will necessarily concern guest program, and not QEMU and its libraries. - task: list of tasks. We present every vcpu/privilege level as a separate process, as it's the best view we can have when generating a (visual) chrome trace. Using threads is less convenient in terms of UI. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-7-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-23-alex.bennee@linaro.org>
* contrib/plugins/uftrace: implement privilege level tracingPierrick Bouvier2025-09-261-8/+182
| | | | | | | | | | | | | | | We add new option trace-privilege-level=bool, which will create a separate trace for each privilege level. This allows to follow changes of privilege during execution. We implement aarch64 operations to track current privilege level accordingly. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-6-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-22-alex.bennee@linaro.org>
* contrib/plugins/uftrace: implement tracingPierrick Bouvier2025-09-261-1/+151
| | | | | | | | | | | | | | | | | | | We implement tracing, following uftrace format. Trace is flushed every 32 MB, so file operations don't impact performance at runtime. A different trace is generated per cpu, and we ensure they have a unique name, based on vcpu_index, while keeping room for privilege level coming in next commit. Uftrace format is not officially documented, but it can be found here: https://github.com/namhyung/uftrace/blob/v0.18/libmcount/record.c#L909 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-5-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-21-alex.bennee@linaro.org>
* contrib/plugins/uftrace: track callstackPierrick Bouvier2025-09-261-0/+160
| | | | | | | | | | | | | We now track callstack, based on frame pointer analysis. We can detect function calls, returns, and discontinuities. We implement a frame pointer based unwinding that is used for discontinuities. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-4-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-20-alex.bennee@linaro.org>
* contrib/plugins/uftrace: define cpu operations and implement aarch64Pierrick Bouvier2025-09-261-4/+110
| | | | | | | | | | | | | | We define a new CpuOps structure that will be used to implement tracking independently of guest architecture. As well, we now instrument only instructions following ones that might have touched the frame pointer. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-3-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-19-alex.bennee@linaro.org>
* contrib/plugins/uftrace: skeleton filePierrick Bouvier2025-09-262-1/+75
| | | | | | | | | | | | | | We define a scoreboard that will hold our data per cpu. As well, we define a buffer per cpu that will be used to read registers and memories in a thread-safe way. For now, we just instrument all instructions with an empty callback. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250902075042.223990-2-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-18-alex.bennee@linaro.org>
* contrib/plugins/execlog: Explicitly check for qemu_plugin_read_register() ↵Peter Maydell2025-09-261-0/+1
| | | | | | | | | | | | | | | | | | | failure In insn_check_regs() we don't explicitly check whether qemu_plugin_read_register() failed, which confuses Coverity into thinking that sz can be -1 in the memcmp(). In fact the assertion that sz == reg->last->len means this can't happen, but it's clearer to both humans and Coverity if we explicitly assert that sz > 0, as we already do in init_vcpu_register(). Coverity: CID 1611901, 1611902 Fixes: af6e4e0a22c1 ("contrib/plugins: extend execlog to track register changes") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250710144543.1187715-1-peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-17-alex.bennee@linaro.org>
* util: drop qemu_socket_set_nonblock()Vladimir Sementsov-Ogievskiy2025-09-191-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use common qemu_set_blocking() instead. Note that pre-patch the behavior of Win32 and Linux realizations are inconsistent: we ignore failure for Win32, and assert success for Linux. How do we convert the callers? 1. Most of callers call qemu_socket_set_nonblock() on a freshly created socket fd, in conditions when we may simply report an error. Seems correct switching to error handling both for Windows (pre-patch error is ignored) and Linux (pre-patch we assert success). Anyway, we normally don't expect errors in these cases. Still in tests let's use &error_abort for simplicity. What are exclusions? 2. hw/virtio/vhost-user.c - we are inside #ifdef CONFIG_LINUX, so no damage in switching to error handling from assertion. 3. io/channel-socket.c: here we convert both old calls to qemu_socket_set_nonblock() and qemu_socket_set_block() to one new call. Pre-patch we assert success for Linux in qemu_socket_set_nonblock(), and ignore all other errors here. So, for Windows switch is a bit dangerous: we may get new errors or crashes(when error_abort is passed) in cases where we have silently ignored the error before (was it correct in all such cases, if they were?) Still, there is no other way to stricter API than take this risk. 4. util/vhost-user-server - compiled only for Linux (see util/meson.build), so we are safe, switching from assertion to &error_abort. Note: In qga/channel-posix.c we use g_warning(), where g_printerr() would actually be a better choice. Still let's for now follow common style of qga, where g_warning() is commonly used to print such messages, and no call to g_printerr(). Converting everything to use g_printerr() should better be another series. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
* contrib/plugins/execlog: Add tab to the separator search of insn_disasYodel Eldar2025-07-141-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Currently, execlog searches for a space separator between the instruction mnemonic and operands, but some disassemblers, e.g. Alpha's, use a tab separator instead; this results in a null pointer being passed as the haystack in g_strstr during a subsequent register search, i.e. undefined behavior, because of a missing null check. This patch adds tab to the separator search and a null check on the result. Also, an affected pointer is changed to const. Lastly, a break statement was added to immediately terminate the register search when a user-requested register is found in the current instruction as a trivial optimization, because searching for the remaining requested registers is unnecessary once one is found. Suggested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Yodel Eldar <yodel.eldar@gmail.com> Message-ID: <20250630164124.26315-2-yodel.eldar@gmail.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250710104531.3099313-4-alex.bennee@linaro.org>
* contrib: replace FSF postal address with licenses URLSean Wei2025-06-261-2/+2
| | | | | | | | | | | | | The LGPLv2.1 boiler-plate in pdb.c file still contained the obsolete "51 Franklin Street" postal address. Replace it with the canonical GNU licenses URL recommended by the FSF: https://www.gnu.org/licenses/ Signed-off-by: Sean Wei <me@sean.taipei> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Message-ID: <20250613.qemu.patch.10@sean.taipei> Signed-off-by: Thomas Huth <thuth@redhat.com>
* meson: fix Windows buildoltolm2025-06-161-1/+1
| | | | | | | | | | | | The build fails on Windows. Replace calls to Unix programs like ´cat´, ´sed´ and ´true´ with calls to ´python´ and wrap calls to ´os.path.relpath´ in try-except because it can fail when the two paths are on different drives. Make sure to convert the Windows paths to Unix paths to prevent warnings in generated files. Signed-off-by: oltolm <oleg.tolmatcev@gmail.com> Message-id: 20250612221521.1109-2-oleg.tolmatcev@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* contrib/plugins: allow setting of instructions per quantumAlex Bennée2025-06-071-1/+14
| | | | | | | | | | The default is we update time every 1/10th of a second or so. However for some cases we might want to update time more frequently. Allow this to be set via the command line through the ipq argument. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250603110204.838117-7-alex.bennee@linaro.org>
* contrib/plugins: add a scaling factor to the ips argAlex Bennée2025-06-071-1/+33
| | | | | | | | | It's easy to get lost in zeros while setting the numbers of instructions per second. Add a scaling suffix to make things simpler. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250603110204.838117-6-alex.bennee@linaro.org>
* contrib/plugins: Fix type conflict of GLib function pointersKohei Tokunaga2025-04-256-21/+21
| | | | | | | | | | | | | | On Emscripten, function pointer casts can result in runtime failures due to strict function signature checks. This affects the use of g_list_sort and g_slist_sort, which internally perform function pointer casts that are not supported by Emscripten. To avoid these issues, g_list_sort_with_data and g_slist_sort_with_data should be used instead, as they do not rely on function pointer casting. Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <0fcddfca16ca8da2bdaa7b2c114476f5b73d032b.1745295397.git.ktokunaga.mail@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* plugins: add explicit dependency in functional testsPierrick Bouvier2025-03-101-0/+2
| | | | | | | | | | | | | | | | ./tests/functional/test_aarch64_tcg_plugins.py needs to have plugin libinsn built. However, it's not listed as a dependency, so meson can't know it needs to be built. Thus, we keep track of all plugins, and add them as an explicit dependency. Fixes: 4c134d07b9e ("tests: add a new set of tests to exercise plugins") Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250304222439.2035603-9-alex.bennee@linaro.org>
* hw/vmapple/vmapple: Add vmapple machine typeAlexander Graf2025-03-041-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apple defines a new "vmapple" machine type as part of its proprietary macOS Virtualization.Framework vmm. This machine type is similar to the virt one, but with subtle differences in base devices, a few special vmapple device additions and a vastly different boot chain. This patch reimplements this machine type in QEMU. To use it, you have to have a readily installed version of macOS for VMApple, run on macOS with -accel hvf, pass the Virtualization.Framework boot rom (AVPBooter) in via -bios, pass the aux and root volume as pflash and pass aux and root volume as virtio drives. In addition, you also need to find the machine UUID and pass that as -M vmapple,uuid= parameter: $ qemu-system-aarch64 -accel hvf -M vmapple,uuid=0x1234 -m 4G \ -bios /System/Library/Frameworks/Virtualization.framework/Versions/A/Resources/AVPBooter.vmapple2.bin -drive file=aux,if=pflash,format=raw \ -drive file=root,if=pflash,format=raw \ -drive file=aux,if=none,id=aux,format=raw \ -device vmapple-virtio-blk-pci,variant=aux,drive=aux \ -drive file=root,if=none,id=root,format=raw \ -device vmapple-virtio-blk-pci,variant=root,drive=root With all these in place, you should be able to see macOS booting successfully. Known issues: - Currently only macOS 12 guests are supported. The boot process for 13+ will need further investigation and adjustment. Signed-off-by: Alexander Graf <graf@amazon.com> Co-authored-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Tested-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20241223221645.29911-15-phil@philjordan.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* plugins: fix -Werror=maybe-uninitialized false-positiveMarc-André Lureau2025-02-031-1/+1
| | | | | | | | | | | | ../contrib/plugins/cache.c:638:9: error: ‘l2_cache’ may be used uninitialized [-Werror=maybe-uninitialized] 638 | append_stats_line(rep, l1_dmem_accesses, l1_dmisses, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Is a false-positive, since cores > 1, so the variable is set in the above loop. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
* plugins: enable linking with clang/lldPierrick Bouvier2025-01-171-1/+1
| | | | | | | | | | | | | | | | Windows uses a special mechanism to enable plugins to work (DLL delay loading). Option for lld is different than ld. MSYS2 clang based environment use lld by default, so restricting to this config on Windows is safe, and will avoid false bug reports. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Tested-by: Stefan Weil <sw@weilnetz.de> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250110203401.178532-4-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-26-alex.bennee@linaro.org>
* contrib/plugins/hotpages: fix 32-bit buildPierrick Bouvier2025-01-171-3/+3
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-11-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-21-alex.bennee@linaro.org>
* contrib/plugins/hwprofile: fix 32-bit buildPierrick Bouvier2025-01-171-11/+16
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-10-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-20-alex.bennee@linaro.org>
* contrib/plugins/cflow: fix 32-bit buildPierrick Bouvier2025-01-171-6/+11
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-9-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-19-alex.bennee@linaro.org>
* contrib/plugins/hotblocks: fix 32-bit buildPierrick Bouvier2025-01-171-5/+24
| | | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241217224306.2900490-8-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-18-alex.bennee@linaro.org>
* contrib/plugins/cache: fix 32-bit buildPierrick Bouvier2025-01-171-12/+6
| | | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241217224306.2900490-7-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-17-alex.bennee@linaro.org>
* contrib/plugins/stoptrigger: fix 32-bit buildPierrick Bouvier2025-01-171-21/+27
| | | | | | | | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241217224306.2900490-6-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-16-alex.bennee@linaro.org>
* contrib/plugins/howvec: ensure we don't regress if this plugin is extendedPierrick Bouvier2025-01-171-3/+4
| | | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241217224306.2900490-3-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250116160306.1709518-13-alex.bennee@linaro.org>
* contrib/plugins/bbv.c: Start bb index from 1ckf1042024-12-281-1/+1
| | | | | | | | | Standard simpoint tool reqeusts that index of basic block index starts from 1. Signed-off-by: ckf104 <1900011634@pku.edu.cn> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* contrib/plugins: remove Makefile for contrib/pluginsPierrick Bouvier2024-11-051-87/+0
| | | | | | | | Now replaced by meson build. Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241023212812.1376972-4-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* meson: build contrib/plugins with mesonPierrick Bouvier2024-11-051-0/+28
| | | | | | | | | | | | Tried to unify this meson.build with tests/tcg/plugins/meson.build but the resulting modules are not output in the right directory. Originally proposed by Anton Kochkov, thank you! Solves: https://gitlab.com/qemu-project/qemu/-/issues/1710 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241023212812.1376972-3-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* contrib/plugins/cflow: fix warningPierrick Bouvier2024-11-051-3/+3
| | | | | | | | | | | | | | contrib/plugins/cflow.c: In function ‘plugin_exit’: contrib/plugins/cflow.c:167:19: error: declaration of ‘n’ shadows a previous local [-Werror=shadow=local] 167 | NodeData *n = l->data; | ^ contrib/plugins/cflow.c:139:9: note: shadowed declaration is here 139 | int n = 0; | ^ Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20241023212812.1376972-2-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* contrib/plugins: avoid hanging programAlex Bennée2024-09-191-0/+6
| | | | | | | | | | | | Although we asks for instructions per second we work in quanta and that cannot be 0. Fail to load the plugin instead and report the minimum IPS we can handle. Reported-by: Elisha Hollander <just4now666666@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240916085400.1046925-19-alex.bennee@linaro.org>
* contrib/plugins: Add a plugin to generate basic block vectorsAkihiko Odaki2024-09-192-0/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | SimPoint is a widely used tool to find the ideal microarchitecture simulation points so Valgrind[2] and Pin[3] support generating basic block vectors for use with them. Let's add a corresponding plugin to QEMU too. Note that this plugin has a different goal with tests/plugin/bb.c. This plugin creates a vector for each constant interval instead of counting the execution of basic blocks for the entire run and able to describe the change of execution behavior. Its output is also syntactically simple and better suited for parsing, while the output of tests/plugin/bb.c is more human-readable. [1] https://cseweb.ucsd.edu/~calder/simpoint/ [2] https://valgrind.org/docs/manual/bbv-manual.html [3] https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-dynamic-binary-instrumentation-tool.html Signed-off-by: Yotaro Nada <yotaro.nada@gmail.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240816-bb-v3-1-b9aa4a5c75c5@daynix.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240916085400.1046925-16-alex.bennee@linaro.org>
* contrib/plugins: control flow pluginAlex Bennée2024-09-192-0/+389
| | | | | | | | | | | This is a simple control flow tracking plugin that uses the latest inline and conditional operations to detect and track control flow changes. It is currently an exercise at seeing how useful the changes are. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240916085400.1046925-4-alex.bennee@linaro.org>
* contrib/plugins/Makefile: Add a 'distclean' targetThomas Huth2024-09-111-1/+1
| | | | | | | | | | | | | | Running "make distclean" in the build tree currently fails since this tries to run the "distclean" target in the contrib/plugins/ folder, too, but the Makefile there is missing this target. Thus add 'distclean' there to fix this issue. And to avoid regressions with "make distclean", add this command to one of the build jobs, too. Message-ID: <20240902154749.73876-1-thuth@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* contrib/plugins/execlog: Fix shadowed declaration warningPierrick Bouvier2024-08-201-2/+2
| | | | | | | | | | | | | | | | | Found on debian stable. ../contrib/plugins/execlog.c: In function ‘vcpu_tb_trans’: ../contrib/plugins/execlog.c:236:22: error: declaration of ‘n’ shadows a previous local [-Werror=shadow=local] 236 | for (int n = 0; n < all_reg_names->len; n++) { | ^ ../contrib/plugins/execlog.c:184:12: note: shadowed declaration is here 184 | size_t n = qemu_plugin_tb_n_insns(tb); | Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240814233645.944327-2-pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* contrib/plugins: add compat for g_memdup2Alex Bennée2024-07-301-0/+25
| | | | | | | | | | | | We were premature if bumping this because some of our builds are still on older glibs. Just copy the compat handler for now and we can remove it later. Fixes: ee293103b0 (plugins: update lockstep to use g_memdup2) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2161 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240729144414.830369-14-alex.bennee@linaro.org>
* contrib/plugins: be more vocal buildingAlex Bennée2024-07-301-5/+20
| | | | | | | | | | | With the conversion to meson and removing the old QEMU Makefile baggage we became very silent when building the plugins. Bring in a copy of the quiet-command logic (and some magic COMMAs) so we can at least assure developers we are building them. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2457 Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240729144414.830369-13-alex.bennee@linaro.org>
* contrib/plugins/cache.c: Remove redundant check of l2_accessPeter Maydell2024-07-301-1/+1
| | | | | | | | | | | | | | | | | In append_stats_line(), we have an expression l2_access ? l2_miss_rate : 0.0 But this is inside an if (l2_access && l2_misses) { ... } block, so Coverity points out that the false part of the ?: is dead code. Remove the unnecessary test. Resolves: Coverity CID 1522458 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240725164851.1930964-1-peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240729144414.830369-12-alex.bennee@linaro.org>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2024-07-242-0/+24
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * target/i386/kvm: support for reading RAPL MSRs using a helper program * hpet: emulation improvements # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmaelL4UHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMXoQf+K77lNlHLETSgeeP3dr7yZPOmXjjN # qFY/18jiyLw7MK1rZC09fF+n9SoaTH8JDKupt0z9M1R10HKHLIO04f8zDE+dOxaE # Rou3yKnlTgFPGSoPPFr1n1JJfxtYlLZRoUzaAcHUaa4W7JR/OHJX90n1Rb9MXeDk # jV6P0v1FWtIDdM6ERm9qBGoQdYhj6Ra2T4/NZKJFXwIhKEkxgu4yO7WXv8l0dxQz # jE4fKotqAvrkYW1EsiVZm30lw/19duhvGiYeQXoYhk8KKXXjAbJMblLITSNWsCio # 3l6Uud/lOxekkJDAq5nH3H9hCBm0WwvwL+0vRf3Mkr+/xRGvrhtmUdp8NQ== # =00mB # -----END PGP SIGNATURE----- # gpg: Signature made Tue 23 Jul 2024 03:19:58 AM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: hpet: avoid timer storms on periodic timers hpet: store full 64-bit target value of the counter hpet: accept 64-bit reads and writes hpet: place read-only bits directly in "new_val" hpet: remove unnecessary variable "index" hpet: ignore high bits of comparator in 32-bit mode hpet: fix and cleanup persistence of interrupt status Add support for RAPL MSRs in KVM/Qemu tools: build qemu-vmsr-helper qio: add support for SO_PEERCRED for socket channel target/i386: do not crash if microvm guest uses SGX CPUID leaves Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tools: build qemu-vmsr-helperAnthony Harivel2024-07-222-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a privileged helper to access RAPL MSR. The privileged helper tool, qemu-vmsr-helper, is designed to provide virtual machines with the ability to read specific RAPL (Running Average Power Limit) MSRs without requiring CAP_SYS_RAWIO privileges or relying on external, out-of-tree patches. The helper tool leverages Unix permissions and SO_PEERCRED socket options to enforce access control, ensuring that only processes explicitly requesting read access via readmsr() from a valid Thread ID can access these MSRs. The list of RAPL MSRs that are allowed to be read by the helper tool is defined in rapl-msr-index.h. This list corresponds to the RAPL MSRs that will be supported in the next commit titled "Add support for RAPL MSRs in KVM/QEMU." The tool is intentionally designed to run on the Linux x86 platform. This initial implementation is tailored for Intel CPUs but can be extended to support AMD CPUs in the future. Signed-off-by: Anthony Harivel <aharivel@redhat.com> Link: https://lore.kernel.org/r/20240522153453.1230389-3-aharivel@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2024-07-241-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pci,pc: features,fixes pci: Initial support for SPDM Responders cxl: Add support for scan media, feature commands, device patrol scrub control, DDR5 ECS control, firmware updates virtio: in-order support virtio-net: support for SR-IOV emulation (note: known issues on s390, might get reverted if not fixed) smbios: memory device size is now configurable per Machine cpu: architecture agnostic code to support vCPU Hotplug Fixes, cleanups all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmae9l8PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRp8fYH/impBH9nViO/WK48io4mLSkl0EUL8Y/xrMvH # zKFCKaXq8D96VTt1Z4EGKYgwG0voBKZaCEKYU/0ARGnSlSwxINQ8ROCnBWMfn2sx # yQt08EXVMznNLtXjc6U5zCoCi6SaV85GH40No3MUFXBQt29ZSlFqO/fuHGZHYBwS # wuVKvTjjNF4EsGt3rS4Qsv6BwZWMM+dE6yXpKWk68kR8IGp+6QGxkMbWt9uEX2Md # VuemKVnFYw0XGCGy5K+ZkvoA2DGpEw0QxVSOMs8CI55Oc9SkTKz5fUSzXXGo1if+ # M1CTjOPJu6pMym6gy6XpFa8/QioDA/jE2vBQvfJ64TwhJDV159s= # =k8e9 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 23 Jul 2024 10:16:31 AM AEST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (61 commits) hw/nvme: Add SPDM over DOE support backends: Initial support for SPDM socket support hw/pci: Add all Data Object Types defined in PCIe r6.0 tests/acpi: Add expected ACPI AML files for RISC-V tests/qtest/bios-tables-test.c: Enable basic testing for RISC-V tests/acpi: Add empty ACPI data files for RISC-V tests/qtest/bios-tables-test.c: Remove the fall back path tests/acpi: update expected DSDT blob for aarch64 and microvm acpi/gpex: Create PCI link devices outside PCI root bridge tests/acpi: Allow DSDT acpi table changes for aarch64 hw/riscv/virt-acpi-build.c: Update the HID of RISC-V UART hw/riscv/virt-acpi-build.c: Add namespace devices for PLIC and APLIC virtio-iommu: Add trace point on virtio_iommu_detach_endpoint_from_domain hw/vfio/common: Add vfio_listener_region_del_iommu trace event virtio-iommu: Remove the end point on detach virtio-iommu: Free [host_]resv_ranges on unset_iommu_devices virtio-iommu: Remove probe_done Revert "virtio-iommu: Clear IOMMUDevice when VFIO device is unplugged" gdbstub: Add helper function to unregister GDB register space physmem: Add helper function to destroy CPU AddressSpace ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | contrib/vhost-user-blk: fix overflowing expressionStefano Garzarella2024-07-211-1/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity reported: >>> CID 1549454: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "le32_to_cpu(desc->num_sectors) << 9" with type "uint32_t" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "uint64_t" (64 bits, unsigned). 199 le32_to_cpu(desc->num_sectors) << 9 }; Coverity noticed this issue after commit ab04420c3 ("contrib/vhost-user-*: use QEMU bswap helper functions"), but it was pre-existing and introduced from the beginning by commit caa1ee4313 ("vhost-user-blk: add discard/write zeroes features support"). Explicitly cast the 32-bit value before the shift to fix this issue. Fixes: Coverity CID 1549454 Fixes: 5ab04420c3 ("contrib/vhost-user-*: use QEMU bswap helper functions") Fixes: caa1ee4313 ("vhost-user-blk: add discard/write zeroes features support") Cc: changpeng.liu@intel.com Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20240712153857.207440-1-sgarzare@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | plugins/execlog.c: correct dump of registers valuesFrédéric Pétrot2024-07-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | Register values are dumped as 'sz' chunks of two nibbles in the execlog plugin, sz was 1 too big. Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240620083805.73603-1-frederic.petrot@univ-grenoble-alpes.fr> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240718094523.1198645-8-alex.bennee@linaro.org>
* | plugins/stoptrigger: TCG plugin to stop execution under conditionsSimon Hamelin2024-07-222-0/+152
|/ | | | | | | | | | | | | | | | | | | This new plugin allows to stop emulation using conditions on the emulation state. By setting this plugin arguments, it is possible to set an instruction count limit and/or trigger address(es) to stop at. The code returned at emulation exit can be customized. This plugin demonstrates how someone could stop QEMU execution. It could be used for research purposes to launch some code and deterministically stop it and understand where its execution flow went. Co-authored-by: Alexandre Iooss <erdnaxe@crans.org> Signed-off-by: Simon Hamelin <simon.hamelin@grenoble-inp.org> Signed-off-by: Alexandre Iooss <erdnaxe@crans.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240715081521.19122-2-simon.hamelin@grenoble-inp.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240718094523.1198645-5-alex.bennee@linaro.org>
* plugins/lockstep: clean-up outputAlex Bennée2024-07-051-8/+8
| | | | | | | | | We were repeating information which wasn't super clear. As we already will have dumped the last failing PC just note the divergence and dump the previous instruction log. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-27-alex.bennee@linaro.org>
* plugins/lockstep: mention the one-insn-per-tb optionAlex Bennée2024-07-051-1/+2
| | | | | | | | This really helps with lockstep although its super slow on big jobs. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-26-alex.bennee@linaro.org>
* plugins/lockstep: make mixed-mode safeAlex Bennée2024-07-051-2/+2
| | | | | | | | | | The ExecState is shared across the socket and if we want to compare say 64 bit and 32 bit binaries we need the two to use the same sizes for things. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-25-alex.bennee@linaro.org>
* plugins/lockstep: preserve sock_pathAlex Bennée2024-07-051-1/+1
| | | | | | | | | We can't assign sock_path directly from the autofree'd GStrv, take a copy. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240705084047.857176-24-alex.bennee@linaro.org>
* contrib/vhost-user-*: use QEMU bswap helper functionsStefano Garzarella2024-07-022-12/+13
| | | | | | | | | | | | | | | Let's replace the calls to le*toh() and htole*() with qemu/bswap.h helpers to make the code more portable. Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20240618100447.145697-1-sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>