1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/rcu_queue.h" 21 #include "qemu/xxhash.h" 22 #include "qemu/rcu.h" 23 #include "hw/core/cpu.h" 24 #include "exec/cpu-common.h" 25 26 #include "cpu.h" 27 #include "exec/exec-all.h" 28 #include "exec/helper-proto.h" 29 #include "sysemu/sysemu.h" 30 #include "tcg/tcg.h" 31 #include "tcg/tcg-op.h" 32 #include "trace/mem-internal.h" /* mem_info macros */ 33 #include "plugin.h" 34 #include "qemu/compiler.h" 35 36 struct qemu_plugin_cb { 37 struct qemu_plugin_ctx *ctx; 38 union qemu_plugin_cb_sig f; 39 void *udata; 40 QLIST_ENTRY(qemu_plugin_cb) entry; 41 }; 42 43 struct qemu_plugin_state plugin; 44 45 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 46 { 47 struct qemu_plugin_ctx *ctx; 48 qemu_plugin_id_t *id_p; 49 50 id_p = g_hash_table_lookup(plugin.id_ht, &id); 51 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 52 if (ctx == NULL) { 53 error_report("plugin: invalid plugin id %" PRIu64, id); 54 abort(); 55 } 56 return ctx; 57 } 58 59 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 60 { 61 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); 62 cpu_tb_jmp_cache_clear(cpu); 63 } 64 65 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 66 { 67 CPUState *cpu = container_of(k, CPUState, cpu_index); 68 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 69 70 if (cpu->created) { 71 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 72 } else { 73 plugin_cpu_update__async(cpu, mask); 74 } 75 } 76 77 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 78 enum qemu_plugin_event ev) 79 { 80 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 81 82 if (cb == NULL) { 83 return; 84 } 85 QLIST_REMOVE_RCU(cb, entry); 86 g_free(cb); 87 ctx->callbacks[ev] = NULL; 88 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 89 clear_bit(ev, plugin.mask); 90 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 91 } 92 } 93 94 /* 95 * Disable CFI checks. 96 * The callback function has been loaded from an external library so we do not 97 * have type information 98 */ 99 QEMU_DISABLE_CFI 100 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 101 { 102 struct qemu_plugin_cb *cb, *next; 103 104 switch (ev) { 105 case QEMU_PLUGIN_EV_VCPU_INIT: 106 case QEMU_PLUGIN_EV_VCPU_EXIT: 107 case QEMU_PLUGIN_EV_VCPU_IDLE: 108 case QEMU_PLUGIN_EV_VCPU_RESUME: 109 /* iterate safely; plugins might uninstall themselves at any time */ 110 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 111 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 112 113 func(cb->ctx->id, cpu->cpu_index); 114 } 115 break; 116 default: 117 g_assert_not_reached(); 118 } 119 } 120 121 /* 122 * Disable CFI checks. 123 * The callback function has been loaded from an external library so we do not 124 * have type information 125 */ 126 QEMU_DISABLE_CFI 127 static void plugin_cb__simple(enum qemu_plugin_event ev) 128 { 129 struct qemu_plugin_cb *cb, *next; 130 131 switch (ev) { 132 case QEMU_PLUGIN_EV_FLUSH: 133 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 134 qemu_plugin_simple_cb_t func = cb->f.simple; 135 136 func(cb->ctx->id); 137 } 138 break; 139 default: 140 g_assert_not_reached(); 141 } 142 } 143 144 /* 145 * Disable CFI checks. 146 * The callback function has been loaded from an external library so we do not 147 * have type information 148 */ 149 QEMU_DISABLE_CFI 150 static void plugin_cb__udata(enum qemu_plugin_event ev) 151 { 152 struct qemu_plugin_cb *cb, *next; 153 154 switch (ev) { 155 case QEMU_PLUGIN_EV_ATEXIT: 156 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 157 qemu_plugin_udata_cb_t func = cb->f.udata; 158 159 func(cb->ctx->id, cb->udata); 160 } 161 break; 162 default: 163 g_assert_not_reached(); 164 } 165 } 166 167 static void 168 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 169 void *func, void *udata) 170 { 171 struct qemu_plugin_ctx *ctx; 172 173 QEMU_LOCK_GUARD(&plugin.lock); 174 ctx = plugin_id_to_ctx_locked(id); 175 /* if the plugin is on its way out, ignore this request */ 176 if (unlikely(ctx->uninstalling)) { 177 return; 178 } 179 if (func) { 180 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 181 182 if (cb) { 183 cb->f.generic = func; 184 cb->udata = udata; 185 } else { 186 cb = g_new(struct qemu_plugin_cb, 1); 187 cb->ctx = ctx; 188 cb->f.generic = func; 189 cb->udata = udata; 190 ctx->callbacks[ev] = cb; 191 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 192 if (!test_bit(ev, plugin.mask)) { 193 set_bit(ev, plugin.mask); 194 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 195 NULL); 196 } 197 } 198 } else { 199 plugin_unregister_cb__locked(ctx, ev); 200 } 201 } 202 203 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 204 void *func) 205 { 206 do_plugin_register_cb(id, ev, func, NULL); 207 } 208 209 void 210 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 211 void *func, void *udata) 212 { 213 do_plugin_register_cb(id, ev, func, udata); 214 } 215 216 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 217 { 218 bool success; 219 220 qemu_rec_mutex_lock(&plugin.lock); 221 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 222 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 223 &cpu->cpu_index); 224 g_assert(success); 225 qemu_rec_mutex_unlock(&plugin.lock); 226 227 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 228 } 229 230 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 231 { 232 bool success; 233 234 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 235 236 qemu_rec_mutex_lock(&plugin.lock); 237 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 238 g_assert(success); 239 qemu_rec_mutex_unlock(&plugin.lock); 240 } 241 242 struct plugin_for_each_args { 243 struct qemu_plugin_ctx *ctx; 244 qemu_plugin_vcpu_simple_cb_t cb; 245 }; 246 247 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 248 { 249 struct plugin_for_each_args *args = udata; 250 int cpu_index = *(int *)k; 251 252 args->cb(args->ctx->id, cpu_index); 253 } 254 255 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 256 qemu_plugin_vcpu_simple_cb_t cb) 257 { 258 struct plugin_for_each_args args; 259 260 if (cb == NULL) { 261 return; 262 } 263 qemu_rec_mutex_lock(&plugin.lock); 264 args.ctx = plugin_id_to_ctx_locked(id); 265 args.cb = cb; 266 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 267 qemu_rec_mutex_unlock(&plugin.lock); 268 } 269 270 /* Allocate and return a callback record */ 271 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 272 { 273 GArray *cbs = *arr; 274 275 if (!cbs) { 276 cbs = g_array_sized_new(false, false, 277 sizeof(struct qemu_plugin_dyn_cb), 1); 278 *arr = cbs; 279 } 280 281 g_array_set_size(cbs, cbs->len + 1); 282 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 283 } 284 285 void plugin_register_inline_op(GArray **arr, 286 enum qemu_plugin_mem_rw rw, 287 enum qemu_plugin_op op, void *ptr, 288 uint64_t imm) 289 { 290 struct qemu_plugin_dyn_cb *dyn_cb; 291 292 dyn_cb = plugin_get_dyn_cb(arr); 293 dyn_cb->userp = ptr; 294 dyn_cb->type = PLUGIN_CB_INLINE; 295 dyn_cb->rw = rw; 296 dyn_cb->inline_insn.op = op; 297 dyn_cb->inline_insn.imm = imm; 298 } 299 300 static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags) 301 { 302 uint32_t ret; 303 304 switch (flags) { 305 case QEMU_PLUGIN_CB_RW_REGS: 306 ret = 0; 307 break; 308 case QEMU_PLUGIN_CB_R_REGS: 309 ret = TCG_CALL_NO_WG; 310 break; 311 case QEMU_PLUGIN_CB_NO_REGS: 312 default: 313 ret = TCG_CALL_NO_RWG; 314 } 315 return ret; 316 } 317 318 inline void 319 plugin_register_dyn_cb__udata(GArray **arr, 320 qemu_plugin_vcpu_udata_cb_t cb, 321 enum qemu_plugin_cb_flags flags, void *udata) 322 { 323 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 324 325 dyn_cb->userp = udata; 326 dyn_cb->tcg_flags = cb_to_tcg_flags(flags); 327 dyn_cb->f.vcpu_udata = cb; 328 dyn_cb->type = PLUGIN_CB_REGULAR; 329 } 330 331 void plugin_register_vcpu_mem_cb(GArray **arr, 332 void *cb, 333 enum qemu_plugin_cb_flags flags, 334 enum qemu_plugin_mem_rw rw, 335 void *udata) 336 { 337 struct qemu_plugin_dyn_cb *dyn_cb; 338 339 dyn_cb = plugin_get_dyn_cb(arr); 340 dyn_cb->userp = udata; 341 dyn_cb->tcg_flags = cb_to_tcg_flags(flags); 342 dyn_cb->type = PLUGIN_CB_REGULAR; 343 dyn_cb->rw = rw; 344 dyn_cb->f.generic = cb; 345 } 346 347 /* 348 * Disable CFI checks. 349 * The callback function has been loaded from an external library so we do not 350 * have type information 351 */ 352 QEMU_DISABLE_CFI 353 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 354 { 355 struct qemu_plugin_cb *cb, *next; 356 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 357 358 /* no plugin_mask check here; caller should have checked */ 359 360 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 361 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 362 363 func(cb->ctx->id, tb); 364 } 365 } 366 367 /* 368 * Disable CFI checks. 369 * The callback function has been loaded from an external library so we do not 370 * have type information 371 */ 372 QEMU_DISABLE_CFI 373 void 374 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 375 uint64_t a3, uint64_t a4, uint64_t a5, 376 uint64_t a6, uint64_t a7, uint64_t a8) 377 { 378 struct qemu_plugin_cb *cb, *next; 379 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 380 381 if (!test_bit(ev, cpu->plugin_mask)) { 382 return; 383 } 384 385 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 386 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 387 388 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 389 } 390 } 391 392 /* 393 * Disable CFI checks. 394 * The callback function has been loaded from an external library so we do not 395 * have type information 396 */ 397 QEMU_DISABLE_CFI 398 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 399 { 400 struct qemu_plugin_cb *cb, *next; 401 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 402 403 if (!test_bit(ev, cpu->plugin_mask)) { 404 return; 405 } 406 407 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 408 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 409 410 func(cb->ctx->id, cpu->cpu_index, num, ret); 411 } 412 } 413 414 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 415 { 416 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 417 } 418 419 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 420 { 421 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 422 } 423 424 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 425 qemu_plugin_vcpu_simple_cb_t cb) 426 { 427 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 428 } 429 430 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 431 qemu_plugin_vcpu_simple_cb_t cb) 432 { 433 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 434 } 435 436 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 437 qemu_plugin_simple_cb_t cb) 438 { 439 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 440 } 441 442 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 443 { 444 g_array_free((GArray *) p, true); 445 return true; 446 } 447 448 void qemu_plugin_flush_cb(void) 449 { 450 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 451 qht_reset(&plugin.dyn_cb_arr_ht); 452 453 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 454 } 455 456 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 457 { 458 uint64_t *val = cb->userp; 459 460 switch (cb->inline_insn.op) { 461 case QEMU_PLUGIN_INLINE_ADD_U64: 462 *val += cb->inline_insn.imm; 463 break; 464 default: 465 g_assert_not_reached(); 466 } 467 } 468 469 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, uint32_t info) 470 { 471 GArray *arr = cpu->plugin_mem_cbs; 472 size_t i; 473 474 if (arr == NULL) { 475 return; 476 } 477 for (i = 0; i < arr->len; i++) { 478 struct qemu_plugin_dyn_cb *cb = 479 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 480 int w = !!(info & TRACE_MEM_ST) + 1; 481 482 if (!(w & cb->rw)) { 483 break; 484 } 485 switch (cb->type) { 486 case PLUGIN_CB_REGULAR: 487 cb->f.vcpu_mem(cpu->cpu_index, info, vaddr, cb->userp); 488 break; 489 case PLUGIN_CB_INLINE: 490 exec_inline_op(cb); 491 break; 492 default: 493 g_assert_not_reached(); 494 } 495 } 496 } 497 498 void qemu_plugin_atexit_cb(void) 499 { 500 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 501 } 502 503 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 504 qemu_plugin_udata_cb_t cb, 505 void *udata) 506 { 507 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 508 } 509 510 /* 511 * Call this function after longjmp'ing to the main loop. It's possible that the 512 * last instruction of a TB might have used helpers, and therefore the 513 * "disable" instruction will never execute because it ended up as dead code. 514 */ 515 void qemu_plugin_disable_mem_helpers(CPUState *cpu) 516 { 517 cpu->plugin_mem_cbs = NULL; 518 } 519 520 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 521 { 522 return ap == bp; 523 } 524 525 static void __attribute__((__constructor__)) plugin_init(void) 526 { 527 int i; 528 529 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 530 QLIST_INIT(&plugin.cb_lists[i]); 531 } 532 qemu_rec_mutex_init(&plugin.lock); 533 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 534 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 535 QTAILQ_INIT(&plugin.ctxs); 536 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 537 QHT_MODE_AUTO_RESIZE); 538 atexit(qemu_plugin_atexit_cb); 539 } 540