1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/plugin.h" 21 #include "qemu/queue.h" 22 #include "qemu/rcu_queue.h" 23 #include "qemu/xxhash.h" 24 #include "qemu/rcu.h" 25 #include "hw/core/cpu.h" 26 27 #include "exec/exec-all.h" 28 #include "exec/tb-flush.h" 29 #include "tcg/tcg.h" 30 #include "tcg/tcg-op.h" 31 #include "plugin.h" 32 33 struct qemu_plugin_cb { 34 struct qemu_plugin_ctx *ctx; 35 union qemu_plugin_cb_sig f; 36 void *udata; 37 QLIST_ENTRY(qemu_plugin_cb) entry; 38 }; 39 40 struct qemu_plugin_state plugin; 41 42 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 43 { 44 struct qemu_plugin_ctx *ctx; 45 qemu_plugin_id_t *id_p; 46 47 id_p = g_hash_table_lookup(plugin.id_ht, &id); 48 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 49 if (ctx == NULL) { 50 error_report("plugin: invalid plugin id %" PRIu64, id); 51 abort(); 52 } 53 return ctx; 54 } 55 56 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 57 { 58 bitmap_copy(cpu->plugin_state->event_mask, 59 &data.host_ulong, QEMU_PLUGIN_EV_MAX); 60 tcg_flush_jmp_cache(cpu); 61 } 62 63 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 64 { 65 CPUState *cpu = container_of(k, CPUState, cpu_index); 66 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 67 68 if (DEVICE(cpu)->realized) { 69 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 70 } else { 71 plugin_cpu_update__async(cpu, mask); 72 } 73 } 74 75 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 76 enum qemu_plugin_event ev) 77 { 78 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 79 80 if (cb == NULL) { 81 return; 82 } 83 QLIST_REMOVE_RCU(cb, entry); 84 g_free(cb); 85 ctx->callbacks[ev] = NULL; 86 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 87 clear_bit(ev, plugin.mask); 88 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 89 } 90 } 91 92 /* 93 * Disable CFI checks. 94 * The callback function has been loaded from an external library so we do not 95 * have type information 96 */ 97 QEMU_DISABLE_CFI 98 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 99 { 100 struct qemu_plugin_cb *cb, *next; 101 102 switch (ev) { 103 case QEMU_PLUGIN_EV_VCPU_INIT: 104 case QEMU_PLUGIN_EV_VCPU_EXIT: 105 case QEMU_PLUGIN_EV_VCPU_IDLE: 106 case QEMU_PLUGIN_EV_VCPU_RESUME: 107 /* iterate safely; plugins might uninstall themselves at any time */ 108 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 109 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 110 111 func(cb->ctx->id, cpu->cpu_index); 112 } 113 break; 114 default: 115 g_assert_not_reached(); 116 } 117 } 118 119 /* 120 * Disable CFI checks. 121 * The callback function has been loaded from an external library so we do not 122 * have type information 123 */ 124 QEMU_DISABLE_CFI 125 static void plugin_cb__simple(enum qemu_plugin_event ev) 126 { 127 struct qemu_plugin_cb *cb, *next; 128 129 switch (ev) { 130 case QEMU_PLUGIN_EV_FLUSH: 131 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 132 qemu_plugin_simple_cb_t func = cb->f.simple; 133 134 func(cb->ctx->id); 135 } 136 break; 137 default: 138 g_assert_not_reached(); 139 } 140 } 141 142 /* 143 * Disable CFI checks. 144 * The callback function has been loaded from an external library so we do not 145 * have type information 146 */ 147 QEMU_DISABLE_CFI 148 static void plugin_cb__udata(enum qemu_plugin_event ev) 149 { 150 struct qemu_plugin_cb *cb, *next; 151 152 switch (ev) { 153 case QEMU_PLUGIN_EV_ATEXIT: 154 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 155 qemu_plugin_udata_cb_t func = cb->f.udata; 156 157 func(cb->ctx->id, cb->udata); 158 } 159 break; 160 default: 161 g_assert_not_reached(); 162 } 163 } 164 165 static void 166 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 167 void *func, void *udata) 168 { 169 struct qemu_plugin_ctx *ctx; 170 171 QEMU_LOCK_GUARD(&plugin.lock); 172 ctx = plugin_id_to_ctx_locked(id); 173 /* if the plugin is on its way out, ignore this request */ 174 if (unlikely(ctx->uninstalling)) { 175 return; 176 } 177 if (func) { 178 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 179 180 if (cb) { 181 cb->f.generic = func; 182 cb->udata = udata; 183 } else { 184 cb = g_new(struct qemu_plugin_cb, 1); 185 cb->ctx = ctx; 186 cb->f.generic = func; 187 cb->udata = udata; 188 ctx->callbacks[ev] = cb; 189 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 190 if (!test_bit(ev, plugin.mask)) { 191 set_bit(ev, plugin.mask); 192 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 193 NULL); 194 } 195 } 196 } else { 197 plugin_unregister_cb__locked(ctx, ev); 198 } 199 } 200 201 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 202 void *func) 203 { 204 do_plugin_register_cb(id, ev, func, NULL); 205 } 206 207 void 208 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 209 void *func, void *udata) 210 { 211 do_plugin_register_cb(id, ev, func, udata); 212 } 213 214 CPUPluginState *qemu_plugin_create_vcpu_state(void) 215 { 216 return g_new0(CPUPluginState, 1); 217 } 218 219 static void plugin_grow_scoreboards__locked(CPUState *cpu) 220 { 221 if (cpu->cpu_index < plugin.scoreboard_alloc_size) { 222 return; 223 } 224 225 bool need_realloc = FALSE; 226 while (cpu->cpu_index >= plugin.scoreboard_alloc_size) { 227 plugin.scoreboard_alloc_size *= 2; 228 need_realloc = TRUE; 229 } 230 231 232 if (!need_realloc || QLIST_EMPTY(&plugin.scoreboards)) { 233 /* nothing to do, we just updated sizes for future scoreboards */ 234 return; 235 } 236 237 /* cpus must be stopped, as tb might still use an existing scoreboard. */ 238 start_exclusive(); 239 struct qemu_plugin_scoreboard *score; 240 QLIST_FOREACH(score, &plugin.scoreboards, entry) { 241 g_array_set_size(score->data, plugin.scoreboard_alloc_size); 242 } 243 /* force all tb to be flushed, as scoreboard pointers were changed. */ 244 tb_flush(cpu); 245 end_exclusive(); 246 } 247 248 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 249 { 250 bool success; 251 252 qemu_rec_mutex_lock(&plugin.lock); 253 plugin.num_vcpus = MAX(plugin.num_vcpus, cpu->cpu_index + 1); 254 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 255 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 256 &cpu->cpu_index); 257 g_assert(success); 258 plugin_grow_scoreboards__locked(cpu); 259 qemu_rec_mutex_unlock(&plugin.lock); 260 261 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 262 } 263 264 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 265 { 266 bool success; 267 268 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 269 270 qemu_rec_mutex_lock(&plugin.lock); 271 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 272 g_assert(success); 273 qemu_rec_mutex_unlock(&plugin.lock); 274 } 275 276 struct plugin_for_each_args { 277 struct qemu_plugin_ctx *ctx; 278 qemu_plugin_vcpu_simple_cb_t cb; 279 }; 280 281 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 282 { 283 struct plugin_for_each_args *args = udata; 284 int cpu_index = *(int *)k; 285 286 args->cb(args->ctx->id, cpu_index); 287 } 288 289 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 290 qemu_plugin_vcpu_simple_cb_t cb) 291 { 292 struct plugin_for_each_args args; 293 294 if (cb == NULL) { 295 return; 296 } 297 qemu_rec_mutex_lock(&plugin.lock); 298 args.ctx = plugin_id_to_ctx_locked(id); 299 args.cb = cb; 300 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 301 qemu_rec_mutex_unlock(&plugin.lock); 302 } 303 304 /* Allocate and return a callback record */ 305 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 306 { 307 GArray *cbs = *arr; 308 309 if (!cbs) { 310 cbs = g_array_sized_new(false, false, 311 sizeof(struct qemu_plugin_dyn_cb), 1); 312 *arr = cbs; 313 } 314 315 g_array_set_size(cbs, cbs->len + 1); 316 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 317 } 318 319 void plugin_register_inline_op(GArray **arr, 320 enum qemu_plugin_mem_rw rw, 321 enum qemu_plugin_op op, 322 void *ptr, 323 uint64_t imm) 324 { 325 struct qemu_plugin_dyn_cb *dyn_cb; 326 327 dyn_cb = plugin_get_dyn_cb(arr); 328 dyn_cb->userp = ptr; 329 dyn_cb->type = PLUGIN_CB_INLINE; 330 dyn_cb->rw = rw; 331 dyn_cb->inline_insn.op = op; 332 dyn_cb->inline_insn.imm = imm; 333 } 334 335 void plugin_register_dyn_cb__udata(GArray **arr, 336 qemu_plugin_vcpu_udata_cb_t cb, 337 enum qemu_plugin_cb_flags flags, 338 void *udata) 339 { 340 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 341 342 dyn_cb->userp = udata; 343 /* Note flags are discarded as unused. */ 344 dyn_cb->f.vcpu_udata = cb; 345 dyn_cb->type = PLUGIN_CB_REGULAR; 346 } 347 348 void plugin_register_vcpu_mem_cb(GArray **arr, 349 void *cb, 350 enum qemu_plugin_cb_flags flags, 351 enum qemu_plugin_mem_rw rw, 352 void *udata) 353 { 354 struct qemu_plugin_dyn_cb *dyn_cb; 355 356 dyn_cb = plugin_get_dyn_cb(arr); 357 dyn_cb->userp = udata; 358 /* Note flags are discarded as unused. */ 359 dyn_cb->type = PLUGIN_CB_REGULAR; 360 dyn_cb->rw = rw; 361 dyn_cb->f.generic = cb; 362 } 363 364 /* 365 * Disable CFI checks. 366 * The callback function has been loaded from an external library so we do not 367 * have type information 368 */ 369 QEMU_DISABLE_CFI 370 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 371 { 372 struct qemu_plugin_cb *cb, *next; 373 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 374 375 /* no plugin_mask check here; caller should have checked */ 376 377 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 378 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 379 380 func(cb->ctx->id, tb); 381 } 382 } 383 384 /* 385 * Disable CFI checks. 386 * The callback function has been loaded from an external library so we do not 387 * have type information 388 */ 389 QEMU_DISABLE_CFI 390 void 391 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 392 uint64_t a3, uint64_t a4, uint64_t a5, 393 uint64_t a6, uint64_t a7, uint64_t a8) 394 { 395 struct qemu_plugin_cb *cb, *next; 396 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 397 398 if (!test_bit(ev, cpu->plugin_state->event_mask)) { 399 return; 400 } 401 402 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 403 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 404 405 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 406 } 407 } 408 409 /* 410 * Disable CFI checks. 411 * The callback function has been loaded from an external library so we do not 412 * have type information 413 */ 414 QEMU_DISABLE_CFI 415 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 416 { 417 struct qemu_plugin_cb *cb, *next; 418 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 419 420 if (!test_bit(ev, cpu->plugin_state->event_mask)) { 421 return; 422 } 423 424 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 425 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 426 427 func(cb->ctx->id, cpu->cpu_index, num, ret); 428 } 429 } 430 431 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 432 { 433 /* idle and resume cb may be called before init, ignore in this case */ 434 if (cpu->cpu_index < plugin.num_vcpus) { 435 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 436 } 437 } 438 439 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 440 { 441 if (cpu->cpu_index < plugin.num_vcpus) { 442 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 443 } 444 } 445 446 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 447 qemu_plugin_vcpu_simple_cb_t cb) 448 { 449 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 450 } 451 452 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 453 qemu_plugin_vcpu_simple_cb_t cb) 454 { 455 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 456 } 457 458 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 459 qemu_plugin_simple_cb_t cb) 460 { 461 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 462 } 463 464 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 465 { 466 g_array_free((GArray *) p, true); 467 return true; 468 } 469 470 void qemu_plugin_flush_cb(void) 471 { 472 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 473 qht_reset(&plugin.dyn_cb_arr_ht); 474 475 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 476 } 477 478 void exec_inline_op(struct qemu_plugin_dyn_cb *cb, int cpu_index) 479 { 480 char *ptr = cb->userp; 481 size_t elem_size = 0; 482 size_t offset = 0; 483 uint64_t *val = (uint64_t *)(ptr + offset + cpu_index * elem_size); 484 485 switch (cb->inline_insn.op) { 486 case QEMU_PLUGIN_INLINE_ADD_U64: 487 *val += cb->inline_insn.imm; 488 break; 489 default: 490 g_assert_not_reached(); 491 } 492 } 493 494 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, 495 MemOpIdx oi, enum qemu_plugin_mem_rw rw) 496 { 497 GArray *arr = cpu->plugin_mem_cbs; 498 size_t i; 499 500 if (arr == NULL) { 501 return; 502 } 503 for (i = 0; i < arr->len; i++) { 504 struct qemu_plugin_dyn_cb *cb = 505 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 506 507 if (!(rw & cb->rw)) { 508 break; 509 } 510 switch (cb->type) { 511 case PLUGIN_CB_REGULAR: 512 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw), 513 vaddr, cb->userp); 514 break; 515 case PLUGIN_CB_INLINE: 516 exec_inline_op(cb, cpu->cpu_index); 517 break; 518 default: 519 g_assert_not_reached(); 520 } 521 } 522 } 523 524 void qemu_plugin_atexit_cb(void) 525 { 526 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 527 } 528 529 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 530 qemu_plugin_udata_cb_t cb, 531 void *udata) 532 { 533 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 534 } 535 536 /* 537 * Handle exit from linux-user. Unlike the normal atexit() mechanism 538 * we need to handle the clean-up manually as it's possible threads 539 * are still running. We need to remove all callbacks from code 540 * generation, flush the current translations and then we can safely 541 * trigger the exit callbacks. 542 */ 543 544 void qemu_plugin_user_exit(void) 545 { 546 enum qemu_plugin_event ev; 547 CPUState *cpu; 548 549 /* 550 * Locking order: we must acquire locks in an order that is consistent 551 * with the one in fork_start(). That is: 552 * - start_exclusive(), which acquires qemu_cpu_list_lock, 553 * must be called before acquiring plugin.lock. 554 * - tb_flush(), which acquires mmap_lock(), must be called 555 * while plugin.lock is not held. 556 */ 557 start_exclusive(); 558 559 qemu_rec_mutex_lock(&plugin.lock); 560 /* un-register all callbacks except the final AT_EXIT one */ 561 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { 562 if (ev != QEMU_PLUGIN_EV_ATEXIT) { 563 struct qemu_plugin_cb *cb, *next; 564 565 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 566 plugin_unregister_cb__locked(cb->ctx, ev); 567 } 568 } 569 } 570 CPU_FOREACH(cpu) { 571 qemu_plugin_disable_mem_helpers(cpu); 572 } 573 qemu_rec_mutex_unlock(&plugin.lock); 574 575 tb_flush(current_cpu); 576 end_exclusive(); 577 578 /* now it's safe to handle the exit case */ 579 qemu_plugin_atexit_cb(); 580 } 581 582 /* 583 * Helpers for *-user to ensure locks are sane across fork() events. 584 */ 585 586 void qemu_plugin_user_prefork_lock(void) 587 { 588 qemu_rec_mutex_lock(&plugin.lock); 589 } 590 591 void qemu_plugin_user_postfork(bool is_child) 592 { 593 if (is_child) { 594 /* should we just reset via plugin_init? */ 595 qemu_rec_mutex_init(&plugin.lock); 596 } else { 597 qemu_rec_mutex_unlock(&plugin.lock); 598 } 599 } 600 601 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 602 { 603 return ap == bp; 604 } 605 606 static void __attribute__((__constructor__)) plugin_init(void) 607 { 608 int i; 609 610 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 611 QLIST_INIT(&plugin.cb_lists[i]); 612 } 613 qemu_rec_mutex_init(&plugin.lock); 614 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 615 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 616 QLIST_INIT(&plugin.scoreboards); 617 plugin.scoreboard_alloc_size = 16; /* avoid frequent reallocation */ 618 QTAILQ_INIT(&plugin.ctxs); 619 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 620 QHT_MODE_AUTO_RESIZE); 621 atexit(qemu_plugin_atexit_cb); 622 } 623 624 int plugin_num_vcpus(void) 625 { 626 return plugin.num_vcpus; 627 } 628 629 struct qemu_plugin_scoreboard *plugin_scoreboard_new(size_t element_size) 630 { 631 struct qemu_plugin_scoreboard *score = 632 g_malloc0(sizeof(struct qemu_plugin_scoreboard)); 633 score->data = g_array_new(FALSE, TRUE, element_size); 634 g_array_set_size(score->data, plugin.scoreboard_alloc_size); 635 636 qemu_rec_mutex_lock(&plugin.lock); 637 QLIST_INSERT_HEAD(&plugin.scoreboards, score, entry); 638 qemu_rec_mutex_unlock(&plugin.lock); 639 640 return score; 641 } 642 643 void plugin_scoreboard_free(struct qemu_plugin_scoreboard *score) 644 { 645 qemu_rec_mutex_lock(&plugin.lock); 646 QLIST_REMOVE(score, entry); 647 qemu_rec_mutex_unlock(&plugin.lock); 648 649 g_array_free(score->data, TRUE); 650 g_free(score); 651 } 652