1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/option.h" 19 #include "qemu/rcu_queue.h" 20 #include "qemu/xxhash.h" 21 #include "qemu/rcu.h" 22 #include "hw/core/cpu.h" 23 #include "exec/cpu-common.h" 24 25 #include "cpu.h" 26 #include "exec/exec-all.h" 27 #include "exec/helper-proto.h" 28 #include "sysemu/sysemu.h" 29 #include "tcg/tcg.h" 30 #include "tcg/tcg-op.h" 31 #include "trace/mem-internal.h" /* mem_info macros */ 32 #include "plugin.h" 33 34 struct qemu_plugin_cb { 35 struct qemu_plugin_ctx *ctx; 36 union qemu_plugin_cb_sig f; 37 void *udata; 38 QLIST_ENTRY(qemu_plugin_cb) entry; 39 }; 40 41 struct qemu_plugin_state plugin; 42 43 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 44 { 45 struct qemu_plugin_ctx *ctx; 46 qemu_plugin_id_t *id_p; 47 48 id_p = g_hash_table_lookup(plugin.id_ht, &id); 49 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 50 if (ctx == NULL) { 51 error_report("plugin: invalid plugin id %" PRIu64, id); 52 abort(); 53 } 54 return ctx; 55 } 56 57 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 58 { 59 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); 60 cpu_tb_jmp_cache_clear(cpu); 61 } 62 63 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 64 { 65 CPUState *cpu = container_of(k, CPUState, cpu_index); 66 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 67 68 if (cpu->created) { 69 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 70 } else { 71 plugin_cpu_update__async(cpu, mask); 72 } 73 } 74 75 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 76 enum qemu_plugin_event ev) 77 { 78 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 79 80 if (cb == NULL) { 81 return; 82 } 83 QLIST_REMOVE_RCU(cb, entry); 84 g_free(cb); 85 ctx->callbacks[ev] = NULL; 86 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 87 clear_bit(ev, plugin.mask); 88 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 89 } 90 } 91 92 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 93 { 94 struct qemu_plugin_cb *cb, *next; 95 96 switch (ev) { 97 case QEMU_PLUGIN_EV_VCPU_INIT: 98 case QEMU_PLUGIN_EV_VCPU_EXIT: 99 case QEMU_PLUGIN_EV_VCPU_IDLE: 100 case QEMU_PLUGIN_EV_VCPU_RESUME: 101 /* iterate safely; plugins might uninstall themselves at any time */ 102 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 103 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 104 105 func(cb->ctx->id, cpu->cpu_index); 106 } 107 break; 108 default: 109 g_assert_not_reached(); 110 } 111 } 112 113 static void plugin_cb__simple(enum qemu_plugin_event ev) 114 { 115 struct qemu_plugin_cb *cb, *next; 116 117 switch (ev) { 118 case QEMU_PLUGIN_EV_FLUSH: 119 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 120 qemu_plugin_simple_cb_t func = cb->f.simple; 121 122 func(cb->ctx->id); 123 } 124 break; 125 default: 126 g_assert_not_reached(); 127 } 128 } 129 130 static void plugin_cb__udata(enum qemu_plugin_event ev) 131 { 132 struct qemu_plugin_cb *cb, *next; 133 134 switch (ev) { 135 case QEMU_PLUGIN_EV_ATEXIT: 136 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 137 qemu_plugin_udata_cb_t func = cb->f.udata; 138 139 func(cb->ctx->id, cb->udata); 140 } 141 break; 142 default: 143 g_assert_not_reached(); 144 } 145 } 146 147 static void 148 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 149 void *func, void *udata) 150 { 151 struct qemu_plugin_ctx *ctx; 152 153 qemu_rec_mutex_lock(&plugin.lock); 154 ctx = plugin_id_to_ctx_locked(id); 155 /* if the plugin is on its way out, ignore this request */ 156 if (unlikely(ctx->uninstalling)) { 157 goto out_unlock; 158 } 159 if (func) { 160 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 161 162 if (cb) { 163 cb->f.generic = func; 164 cb->udata = udata; 165 } else { 166 cb = g_new(struct qemu_plugin_cb, 1); 167 cb->ctx = ctx; 168 cb->f.generic = func; 169 cb->udata = udata; 170 ctx->callbacks[ev] = cb; 171 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 172 if (!test_bit(ev, plugin.mask)) { 173 set_bit(ev, plugin.mask); 174 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 175 NULL); 176 } 177 } 178 } else { 179 plugin_unregister_cb__locked(ctx, ev); 180 } 181 out_unlock: 182 qemu_rec_mutex_unlock(&plugin.lock); 183 } 184 185 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 186 void *func) 187 { 188 do_plugin_register_cb(id, ev, func, NULL); 189 } 190 191 void 192 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 193 void *func, void *udata) 194 { 195 do_plugin_register_cb(id, ev, func, udata); 196 } 197 198 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 199 { 200 bool success; 201 202 qemu_rec_mutex_lock(&plugin.lock); 203 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 204 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 205 &cpu->cpu_index); 206 g_assert(success); 207 qemu_rec_mutex_unlock(&plugin.lock); 208 209 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 210 } 211 212 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 213 { 214 bool success; 215 216 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 217 218 qemu_rec_mutex_lock(&plugin.lock); 219 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 220 g_assert(success); 221 qemu_rec_mutex_unlock(&plugin.lock); 222 } 223 224 struct plugin_for_each_args { 225 struct qemu_plugin_ctx *ctx; 226 qemu_plugin_vcpu_simple_cb_t cb; 227 }; 228 229 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 230 { 231 struct plugin_for_each_args *args = udata; 232 int cpu_index = *(int *)k; 233 234 args->cb(args->ctx->id, cpu_index); 235 } 236 237 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 238 qemu_plugin_vcpu_simple_cb_t cb) 239 { 240 struct plugin_for_each_args args; 241 242 if (cb == NULL) { 243 return; 244 } 245 qemu_rec_mutex_lock(&plugin.lock); 246 args.ctx = plugin_id_to_ctx_locked(id); 247 args.cb = cb; 248 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 249 qemu_rec_mutex_unlock(&plugin.lock); 250 } 251 252 /* Allocate and return a callback record */ 253 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 254 { 255 GArray *cbs = *arr; 256 257 if (!cbs) { 258 cbs = g_array_sized_new(false, false, 259 sizeof(struct qemu_plugin_dyn_cb), 1); 260 *arr = cbs; 261 } 262 263 g_array_set_size(cbs, cbs->len + 1); 264 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 265 } 266 267 void plugin_register_inline_op(GArray **arr, 268 enum qemu_plugin_mem_rw rw, 269 enum qemu_plugin_op op, void *ptr, 270 uint64_t imm) 271 { 272 struct qemu_plugin_dyn_cb *dyn_cb; 273 274 dyn_cb = plugin_get_dyn_cb(arr); 275 dyn_cb->userp = ptr; 276 dyn_cb->type = PLUGIN_CB_INLINE; 277 dyn_cb->rw = rw; 278 dyn_cb->inline_insn.op = op; 279 dyn_cb->inline_insn.imm = imm; 280 } 281 282 static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags) 283 { 284 uint32_t ret; 285 286 switch (flags) { 287 case QEMU_PLUGIN_CB_RW_REGS: 288 ret = 0; 289 break; 290 case QEMU_PLUGIN_CB_R_REGS: 291 ret = TCG_CALL_NO_WG; 292 break; 293 case QEMU_PLUGIN_CB_NO_REGS: 294 default: 295 ret = TCG_CALL_NO_RWG; 296 } 297 return ret; 298 } 299 300 inline void 301 plugin_register_dyn_cb__udata(GArray **arr, 302 qemu_plugin_vcpu_udata_cb_t cb, 303 enum qemu_plugin_cb_flags flags, void *udata) 304 { 305 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 306 307 dyn_cb->userp = udata; 308 dyn_cb->tcg_flags = cb_to_tcg_flags(flags); 309 dyn_cb->f.vcpu_udata = cb; 310 dyn_cb->type = PLUGIN_CB_REGULAR; 311 } 312 313 void plugin_register_vcpu_mem_cb(GArray **arr, 314 void *cb, 315 enum qemu_plugin_cb_flags flags, 316 enum qemu_plugin_mem_rw rw, 317 void *udata) 318 { 319 struct qemu_plugin_dyn_cb *dyn_cb; 320 321 dyn_cb = plugin_get_dyn_cb(arr); 322 dyn_cb->userp = udata; 323 dyn_cb->tcg_flags = cb_to_tcg_flags(flags); 324 dyn_cb->type = PLUGIN_CB_REGULAR; 325 dyn_cb->rw = rw; 326 dyn_cb->f.generic = cb; 327 } 328 329 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 330 { 331 struct qemu_plugin_cb *cb, *next; 332 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 333 334 /* no plugin_mask check here; caller should have checked */ 335 336 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 337 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 338 339 func(cb->ctx->id, tb); 340 } 341 } 342 343 void 344 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 345 uint64_t a3, uint64_t a4, uint64_t a5, 346 uint64_t a6, uint64_t a7, uint64_t a8) 347 { 348 struct qemu_plugin_cb *cb, *next; 349 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 350 351 if (!test_bit(ev, cpu->plugin_mask)) { 352 return; 353 } 354 355 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 356 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 357 358 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 359 } 360 } 361 362 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 363 { 364 struct qemu_plugin_cb *cb, *next; 365 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 366 367 if (!test_bit(ev, cpu->plugin_mask)) { 368 return; 369 } 370 371 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 372 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 373 374 func(cb->ctx->id, cpu->cpu_index, num, ret); 375 } 376 } 377 378 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 379 { 380 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 381 } 382 383 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 384 { 385 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 386 } 387 388 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 389 qemu_plugin_vcpu_simple_cb_t cb) 390 { 391 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 392 } 393 394 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 395 qemu_plugin_vcpu_simple_cb_t cb) 396 { 397 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 398 } 399 400 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 401 qemu_plugin_simple_cb_t cb) 402 { 403 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 404 } 405 406 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 407 { 408 g_array_free((GArray *) p, true); 409 return true; 410 } 411 412 void qemu_plugin_flush_cb(void) 413 { 414 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 415 qht_reset(&plugin.dyn_cb_arr_ht); 416 417 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 418 } 419 420 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 421 { 422 uint64_t *val = cb->userp; 423 424 switch (cb->inline_insn.op) { 425 case QEMU_PLUGIN_INLINE_ADD_U64: 426 *val += cb->inline_insn.imm; 427 break; 428 default: 429 g_assert_not_reached(); 430 } 431 } 432 433 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, uint32_t info) 434 { 435 GArray *arr = cpu->plugin_mem_cbs; 436 size_t i; 437 438 if (arr == NULL) { 439 return; 440 } 441 for (i = 0; i < arr->len; i++) { 442 struct qemu_plugin_dyn_cb *cb = 443 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 444 int w = !!(info & TRACE_MEM_ST) + 1; 445 446 if (!(w & cb->rw)) { 447 break; 448 } 449 switch (cb->type) { 450 case PLUGIN_CB_REGULAR: 451 cb->f.vcpu_mem(cpu->cpu_index, info, vaddr, cb->userp); 452 break; 453 case PLUGIN_CB_INLINE: 454 exec_inline_op(cb); 455 break; 456 default: 457 g_assert_not_reached(); 458 } 459 } 460 } 461 462 void qemu_plugin_atexit_cb(void) 463 { 464 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 465 } 466 467 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 468 qemu_plugin_udata_cb_t cb, 469 void *udata) 470 { 471 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 472 } 473 474 /* 475 * Call this function after longjmp'ing to the main loop. It's possible that the 476 * last instruction of a TB might have used helpers, and therefore the 477 * "disable" instruction will never execute because it ended up as dead code. 478 */ 479 void qemu_plugin_disable_mem_helpers(CPUState *cpu) 480 { 481 cpu->plugin_mem_cbs = NULL; 482 } 483 484 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 485 { 486 return ap == bp; 487 } 488 489 static void __attribute__((__constructor__)) plugin_init(void) 490 { 491 int i; 492 493 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 494 QLIST_INIT(&plugin.cb_lists[i]); 495 } 496 qemu_rec_mutex_init(&plugin.lock); 497 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 498 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 499 QTAILQ_INIT(&plugin.ctxs); 500 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 501 QHT_MODE_AUTO_RESIZE); 502 atexit(qemu_plugin_atexit_cb); 503 } 504