1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/plugin.h" 21 #include "qemu/rcu_queue.h" 22 #include "qemu/xxhash.h" 23 #include "qemu/rcu.h" 24 #include "hw/core/cpu.h" 25 26 #include "exec/exec-all.h" 27 #include "exec/tb-flush.h" 28 #include "tcg/tcg.h" 29 #include "tcg/tcg-op.h" 30 #include "plugin.h" 31 32 struct qemu_plugin_cb { 33 struct qemu_plugin_ctx *ctx; 34 union qemu_plugin_cb_sig f; 35 void *udata; 36 QLIST_ENTRY(qemu_plugin_cb) entry; 37 }; 38 39 struct qemu_plugin_state plugin; 40 41 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 42 { 43 struct qemu_plugin_ctx *ctx; 44 qemu_plugin_id_t *id_p; 45 46 id_p = g_hash_table_lookup(plugin.id_ht, &id); 47 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 48 if (ctx == NULL) { 49 error_report("plugin: invalid plugin id %" PRIu64, id); 50 abort(); 51 } 52 return ctx; 53 } 54 55 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 56 { 57 bitmap_copy(cpu->plugin_state->event_mask, 58 &data.host_ulong, QEMU_PLUGIN_EV_MAX); 59 tcg_flush_jmp_cache(cpu); 60 } 61 62 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 63 { 64 CPUState *cpu = container_of(k, CPUState, cpu_index); 65 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 66 67 if (DEVICE(cpu)->realized) { 68 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 69 } else { 70 plugin_cpu_update__async(cpu, mask); 71 } 72 } 73 74 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 75 enum qemu_plugin_event ev) 76 { 77 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 78 79 if (cb == NULL) { 80 return; 81 } 82 QLIST_REMOVE_RCU(cb, entry); 83 g_free(cb); 84 ctx->callbacks[ev] = NULL; 85 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 86 clear_bit(ev, plugin.mask); 87 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 88 } 89 } 90 91 /* 92 * Disable CFI checks. 93 * The callback function has been loaded from an external library so we do not 94 * have type information 95 */ 96 QEMU_DISABLE_CFI 97 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 98 { 99 struct qemu_plugin_cb *cb, *next; 100 101 switch (ev) { 102 case QEMU_PLUGIN_EV_VCPU_INIT: 103 case QEMU_PLUGIN_EV_VCPU_EXIT: 104 case QEMU_PLUGIN_EV_VCPU_IDLE: 105 case QEMU_PLUGIN_EV_VCPU_RESUME: 106 /* iterate safely; plugins might uninstall themselves at any time */ 107 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 108 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 109 110 func(cb->ctx->id, cpu->cpu_index); 111 } 112 break; 113 default: 114 g_assert_not_reached(); 115 } 116 } 117 118 /* 119 * Disable CFI checks. 120 * The callback function has been loaded from an external library so we do not 121 * have type information 122 */ 123 QEMU_DISABLE_CFI 124 static void plugin_cb__simple(enum qemu_plugin_event ev) 125 { 126 struct qemu_plugin_cb *cb, *next; 127 128 switch (ev) { 129 case QEMU_PLUGIN_EV_FLUSH: 130 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 131 qemu_plugin_simple_cb_t func = cb->f.simple; 132 133 func(cb->ctx->id); 134 } 135 break; 136 default: 137 g_assert_not_reached(); 138 } 139 } 140 141 /* 142 * Disable CFI checks. 143 * The callback function has been loaded from an external library so we do not 144 * have type information 145 */ 146 QEMU_DISABLE_CFI 147 static void plugin_cb__udata(enum qemu_plugin_event ev) 148 { 149 struct qemu_plugin_cb *cb, *next; 150 151 switch (ev) { 152 case QEMU_PLUGIN_EV_ATEXIT: 153 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 154 qemu_plugin_udata_cb_t func = cb->f.udata; 155 156 func(cb->ctx->id, cb->udata); 157 } 158 break; 159 default: 160 g_assert_not_reached(); 161 } 162 } 163 164 static void 165 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 166 void *func, void *udata) 167 { 168 struct qemu_plugin_ctx *ctx; 169 170 QEMU_LOCK_GUARD(&plugin.lock); 171 ctx = plugin_id_to_ctx_locked(id); 172 /* if the plugin is on its way out, ignore this request */ 173 if (unlikely(ctx->uninstalling)) { 174 return; 175 } 176 if (func) { 177 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 178 179 if (cb) { 180 cb->f.generic = func; 181 cb->udata = udata; 182 } else { 183 cb = g_new(struct qemu_plugin_cb, 1); 184 cb->ctx = ctx; 185 cb->f.generic = func; 186 cb->udata = udata; 187 ctx->callbacks[ev] = cb; 188 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 189 if (!test_bit(ev, plugin.mask)) { 190 set_bit(ev, plugin.mask); 191 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 192 NULL); 193 } 194 } 195 } else { 196 plugin_unregister_cb__locked(ctx, ev); 197 } 198 } 199 200 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 201 void *func) 202 { 203 do_plugin_register_cb(id, ev, func, NULL); 204 } 205 206 void 207 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 208 void *func, void *udata) 209 { 210 do_plugin_register_cb(id, ev, func, udata); 211 } 212 213 CPUPluginState *qemu_plugin_create_vcpu_state(void) 214 { 215 return g_new0(CPUPluginState, 1); 216 } 217 218 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 219 { 220 bool success; 221 222 qemu_rec_mutex_lock(&plugin.lock); 223 plugin.num_vcpus = MAX(plugin.num_vcpus, cpu->cpu_index + 1); 224 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 225 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 226 &cpu->cpu_index); 227 g_assert(success); 228 qemu_rec_mutex_unlock(&plugin.lock); 229 230 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 231 } 232 233 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 234 { 235 bool success; 236 237 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 238 239 qemu_rec_mutex_lock(&plugin.lock); 240 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 241 g_assert(success); 242 qemu_rec_mutex_unlock(&plugin.lock); 243 } 244 245 struct plugin_for_each_args { 246 struct qemu_plugin_ctx *ctx; 247 qemu_plugin_vcpu_simple_cb_t cb; 248 }; 249 250 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 251 { 252 struct plugin_for_each_args *args = udata; 253 int cpu_index = *(int *)k; 254 255 args->cb(args->ctx->id, cpu_index); 256 } 257 258 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 259 qemu_plugin_vcpu_simple_cb_t cb) 260 { 261 struct plugin_for_each_args args; 262 263 if (cb == NULL) { 264 return; 265 } 266 qemu_rec_mutex_lock(&plugin.lock); 267 args.ctx = plugin_id_to_ctx_locked(id); 268 args.cb = cb; 269 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 270 qemu_rec_mutex_unlock(&plugin.lock); 271 } 272 273 /* Allocate and return a callback record */ 274 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 275 { 276 GArray *cbs = *arr; 277 278 if (!cbs) { 279 cbs = g_array_sized_new(false, false, 280 sizeof(struct qemu_plugin_dyn_cb), 1); 281 *arr = cbs; 282 } 283 284 g_array_set_size(cbs, cbs->len + 1); 285 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 286 } 287 288 void plugin_register_inline_op(GArray **arr, 289 enum qemu_plugin_mem_rw rw, 290 enum qemu_plugin_op op, void *ptr, 291 uint64_t imm) 292 { 293 struct qemu_plugin_dyn_cb *dyn_cb; 294 295 dyn_cb = plugin_get_dyn_cb(arr); 296 dyn_cb->userp = ptr; 297 dyn_cb->type = PLUGIN_CB_INLINE; 298 dyn_cb->rw = rw; 299 dyn_cb->inline_insn.op = op; 300 dyn_cb->inline_insn.imm = imm; 301 } 302 303 void plugin_register_dyn_cb__udata(GArray **arr, 304 qemu_plugin_vcpu_udata_cb_t cb, 305 enum qemu_plugin_cb_flags flags, 306 void *udata) 307 { 308 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 309 310 dyn_cb->userp = udata; 311 /* Note flags are discarded as unused. */ 312 dyn_cb->f.vcpu_udata = cb; 313 dyn_cb->type = PLUGIN_CB_REGULAR; 314 } 315 316 void plugin_register_vcpu_mem_cb(GArray **arr, 317 void *cb, 318 enum qemu_plugin_cb_flags flags, 319 enum qemu_plugin_mem_rw rw, 320 void *udata) 321 { 322 struct qemu_plugin_dyn_cb *dyn_cb; 323 324 dyn_cb = plugin_get_dyn_cb(arr); 325 dyn_cb->userp = udata; 326 /* Note flags are discarded as unused. */ 327 dyn_cb->type = PLUGIN_CB_REGULAR; 328 dyn_cb->rw = rw; 329 dyn_cb->f.generic = cb; 330 } 331 332 /* 333 * Disable CFI checks. 334 * The callback function has been loaded from an external library so we do not 335 * have type information 336 */ 337 QEMU_DISABLE_CFI 338 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 339 { 340 struct qemu_plugin_cb *cb, *next; 341 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 342 343 /* no plugin_mask check here; caller should have checked */ 344 345 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 346 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 347 348 func(cb->ctx->id, tb); 349 } 350 } 351 352 /* 353 * Disable CFI checks. 354 * The callback function has been loaded from an external library so we do not 355 * have type information 356 */ 357 QEMU_DISABLE_CFI 358 void 359 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 360 uint64_t a3, uint64_t a4, uint64_t a5, 361 uint64_t a6, uint64_t a7, uint64_t a8) 362 { 363 struct qemu_plugin_cb *cb, *next; 364 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 365 366 if (!test_bit(ev, cpu->plugin_state->event_mask)) { 367 return; 368 } 369 370 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 371 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 372 373 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 374 } 375 } 376 377 /* 378 * Disable CFI checks. 379 * The callback function has been loaded from an external library so we do not 380 * have type information 381 */ 382 QEMU_DISABLE_CFI 383 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 384 { 385 struct qemu_plugin_cb *cb, *next; 386 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 387 388 if (!test_bit(ev, cpu->plugin_state->event_mask)) { 389 return; 390 } 391 392 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 393 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 394 395 func(cb->ctx->id, cpu->cpu_index, num, ret); 396 } 397 } 398 399 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 400 { 401 /* idle and resume cb may be called before init, ignore in this case */ 402 if (cpu->cpu_index < plugin.num_vcpus) { 403 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 404 } 405 } 406 407 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 408 { 409 if (cpu->cpu_index < plugin.num_vcpus) { 410 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 411 } 412 } 413 414 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 415 qemu_plugin_vcpu_simple_cb_t cb) 416 { 417 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 418 } 419 420 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 421 qemu_plugin_vcpu_simple_cb_t cb) 422 { 423 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 424 } 425 426 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 427 qemu_plugin_simple_cb_t cb) 428 { 429 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 430 } 431 432 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 433 { 434 g_array_free((GArray *) p, true); 435 return true; 436 } 437 438 void qemu_plugin_flush_cb(void) 439 { 440 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 441 qht_reset(&plugin.dyn_cb_arr_ht); 442 443 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 444 } 445 446 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 447 { 448 uint64_t *val = cb->userp; 449 450 switch (cb->inline_insn.op) { 451 case QEMU_PLUGIN_INLINE_ADD_U64: 452 *val += cb->inline_insn.imm; 453 break; 454 default: 455 g_assert_not_reached(); 456 } 457 } 458 459 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, 460 MemOpIdx oi, enum qemu_plugin_mem_rw rw) 461 { 462 GArray *arr = cpu->plugin_mem_cbs; 463 size_t i; 464 465 if (arr == NULL) { 466 return; 467 } 468 for (i = 0; i < arr->len; i++) { 469 struct qemu_plugin_dyn_cb *cb = 470 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 471 472 if (!(rw & cb->rw)) { 473 break; 474 } 475 switch (cb->type) { 476 case PLUGIN_CB_REGULAR: 477 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw), 478 vaddr, cb->userp); 479 break; 480 case PLUGIN_CB_INLINE: 481 exec_inline_op(cb); 482 break; 483 default: 484 g_assert_not_reached(); 485 } 486 } 487 } 488 489 void qemu_plugin_atexit_cb(void) 490 { 491 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 492 } 493 494 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 495 qemu_plugin_udata_cb_t cb, 496 void *udata) 497 { 498 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 499 } 500 501 /* 502 * Handle exit from linux-user. Unlike the normal atexit() mechanism 503 * we need to handle the clean-up manually as it's possible threads 504 * are still running. We need to remove all callbacks from code 505 * generation, flush the current translations and then we can safely 506 * trigger the exit callbacks. 507 */ 508 509 void qemu_plugin_user_exit(void) 510 { 511 enum qemu_plugin_event ev; 512 CPUState *cpu; 513 514 /* 515 * Locking order: we must acquire locks in an order that is consistent 516 * with the one in fork_start(). That is: 517 * - start_exclusive(), which acquires qemu_cpu_list_lock, 518 * must be called before acquiring plugin.lock. 519 * - tb_flush(), which acquires mmap_lock(), must be called 520 * while plugin.lock is not held. 521 */ 522 start_exclusive(); 523 524 qemu_rec_mutex_lock(&plugin.lock); 525 /* un-register all callbacks except the final AT_EXIT one */ 526 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { 527 if (ev != QEMU_PLUGIN_EV_ATEXIT) { 528 struct qemu_plugin_cb *cb, *next; 529 530 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 531 plugin_unregister_cb__locked(cb->ctx, ev); 532 } 533 } 534 } 535 CPU_FOREACH(cpu) { 536 qemu_plugin_disable_mem_helpers(cpu); 537 } 538 qemu_rec_mutex_unlock(&plugin.lock); 539 540 tb_flush(current_cpu); 541 end_exclusive(); 542 543 /* now it's safe to handle the exit case */ 544 qemu_plugin_atexit_cb(); 545 } 546 547 /* 548 * Helpers for *-user to ensure locks are sane across fork() events. 549 */ 550 551 void qemu_plugin_user_prefork_lock(void) 552 { 553 qemu_rec_mutex_lock(&plugin.lock); 554 } 555 556 void qemu_plugin_user_postfork(bool is_child) 557 { 558 if (is_child) { 559 /* should we just reset via plugin_init? */ 560 qemu_rec_mutex_init(&plugin.lock); 561 } else { 562 qemu_rec_mutex_unlock(&plugin.lock); 563 } 564 } 565 566 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 567 { 568 return ap == bp; 569 } 570 571 static void __attribute__((__constructor__)) plugin_init(void) 572 { 573 int i; 574 575 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 576 QLIST_INIT(&plugin.cb_lists[i]); 577 } 578 qemu_rec_mutex_init(&plugin.lock); 579 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 580 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 581 QTAILQ_INIT(&plugin.ctxs); 582 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 583 QHT_MODE_AUTO_RESIZE); 584 atexit(qemu_plugin_atexit_cb); 585 } 586 587 int plugin_num_vcpus(void) 588 { 589 return plugin.num_vcpus; 590 } 591