1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/rcu_queue.h" 21 #include "qemu/xxhash.h" 22 #include "qemu/rcu.h" 23 #include "hw/core/cpu.h" 24 #include "exec/cpu-common.h" 25 26 #include "exec/exec-all.h" 27 #include "exec/helper-proto.h" 28 #include "tcg/tcg.h" 29 #include "tcg/tcg-op.h" 30 #include "trace/mem.h" /* mem_info macros */ 31 #include "plugin.h" 32 #include "qemu/compiler.h" 33 34 struct qemu_plugin_cb { 35 struct qemu_plugin_ctx *ctx; 36 union qemu_plugin_cb_sig f; 37 void *udata; 38 QLIST_ENTRY(qemu_plugin_cb) entry; 39 }; 40 41 struct qemu_plugin_state plugin; 42 43 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 44 { 45 struct qemu_plugin_ctx *ctx; 46 qemu_plugin_id_t *id_p; 47 48 id_p = g_hash_table_lookup(plugin.id_ht, &id); 49 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 50 if (ctx == NULL) { 51 error_report("plugin: invalid plugin id %" PRIu64, id); 52 abort(); 53 } 54 return ctx; 55 } 56 57 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 58 { 59 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); 60 cpu_tb_jmp_cache_clear(cpu); 61 } 62 63 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 64 { 65 CPUState *cpu = container_of(k, CPUState, cpu_index); 66 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 67 68 if (cpu->created) { 69 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 70 } else { 71 plugin_cpu_update__async(cpu, mask); 72 } 73 } 74 75 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 76 enum qemu_plugin_event ev) 77 { 78 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 79 80 if (cb == NULL) { 81 return; 82 } 83 QLIST_REMOVE_RCU(cb, entry); 84 g_free(cb); 85 ctx->callbacks[ev] = NULL; 86 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 87 clear_bit(ev, plugin.mask); 88 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 89 } 90 } 91 92 /* 93 * Disable CFI checks. 94 * The callback function has been loaded from an external library so we do not 95 * have type information 96 */ 97 QEMU_DISABLE_CFI 98 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 99 { 100 struct qemu_plugin_cb *cb, *next; 101 102 switch (ev) { 103 case QEMU_PLUGIN_EV_VCPU_INIT: 104 case QEMU_PLUGIN_EV_VCPU_EXIT: 105 case QEMU_PLUGIN_EV_VCPU_IDLE: 106 case QEMU_PLUGIN_EV_VCPU_RESUME: 107 /* iterate safely; plugins might uninstall themselves at any time */ 108 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 109 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 110 111 func(cb->ctx->id, cpu->cpu_index); 112 } 113 break; 114 default: 115 g_assert_not_reached(); 116 } 117 } 118 119 /* 120 * Disable CFI checks. 121 * The callback function has been loaded from an external library so we do not 122 * have type information 123 */ 124 QEMU_DISABLE_CFI 125 static void plugin_cb__simple(enum qemu_plugin_event ev) 126 { 127 struct qemu_plugin_cb *cb, *next; 128 129 switch (ev) { 130 case QEMU_PLUGIN_EV_FLUSH: 131 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 132 qemu_plugin_simple_cb_t func = cb->f.simple; 133 134 func(cb->ctx->id); 135 } 136 break; 137 default: 138 g_assert_not_reached(); 139 } 140 } 141 142 /* 143 * Disable CFI checks. 144 * The callback function has been loaded from an external library so we do not 145 * have type information 146 */ 147 QEMU_DISABLE_CFI 148 static void plugin_cb__udata(enum qemu_plugin_event ev) 149 { 150 struct qemu_plugin_cb *cb, *next; 151 152 switch (ev) { 153 case QEMU_PLUGIN_EV_ATEXIT: 154 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 155 qemu_plugin_udata_cb_t func = cb->f.udata; 156 157 func(cb->ctx->id, cb->udata); 158 } 159 break; 160 default: 161 g_assert_not_reached(); 162 } 163 } 164 165 static void 166 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 167 void *func, void *udata) 168 { 169 struct qemu_plugin_ctx *ctx; 170 171 QEMU_LOCK_GUARD(&plugin.lock); 172 ctx = plugin_id_to_ctx_locked(id); 173 /* if the plugin is on its way out, ignore this request */ 174 if (unlikely(ctx->uninstalling)) { 175 return; 176 } 177 if (func) { 178 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 179 180 if (cb) { 181 cb->f.generic = func; 182 cb->udata = udata; 183 } else { 184 cb = g_new(struct qemu_plugin_cb, 1); 185 cb->ctx = ctx; 186 cb->f.generic = func; 187 cb->udata = udata; 188 ctx->callbacks[ev] = cb; 189 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 190 if (!test_bit(ev, plugin.mask)) { 191 set_bit(ev, plugin.mask); 192 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 193 NULL); 194 } 195 } 196 } else { 197 plugin_unregister_cb__locked(ctx, ev); 198 } 199 } 200 201 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 202 void *func) 203 { 204 do_plugin_register_cb(id, ev, func, NULL); 205 } 206 207 void 208 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 209 void *func, void *udata) 210 { 211 do_plugin_register_cb(id, ev, func, udata); 212 } 213 214 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 215 { 216 bool success; 217 218 qemu_rec_mutex_lock(&plugin.lock); 219 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 220 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 221 &cpu->cpu_index); 222 g_assert(success); 223 qemu_rec_mutex_unlock(&plugin.lock); 224 225 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 226 } 227 228 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 229 { 230 bool success; 231 232 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 233 234 qemu_rec_mutex_lock(&plugin.lock); 235 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 236 g_assert(success); 237 qemu_rec_mutex_unlock(&plugin.lock); 238 } 239 240 struct plugin_for_each_args { 241 struct qemu_plugin_ctx *ctx; 242 qemu_plugin_vcpu_simple_cb_t cb; 243 }; 244 245 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 246 { 247 struct plugin_for_each_args *args = udata; 248 int cpu_index = *(int *)k; 249 250 args->cb(args->ctx->id, cpu_index); 251 } 252 253 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 254 qemu_plugin_vcpu_simple_cb_t cb) 255 { 256 struct plugin_for_each_args args; 257 258 if (cb == NULL) { 259 return; 260 } 261 qemu_rec_mutex_lock(&plugin.lock); 262 args.ctx = plugin_id_to_ctx_locked(id); 263 args.cb = cb; 264 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 265 qemu_rec_mutex_unlock(&plugin.lock); 266 } 267 268 /* Allocate and return a callback record */ 269 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 270 { 271 GArray *cbs = *arr; 272 273 if (!cbs) { 274 cbs = g_array_sized_new(false, false, 275 sizeof(struct qemu_plugin_dyn_cb), 1); 276 *arr = cbs; 277 } 278 279 g_array_set_size(cbs, cbs->len + 1); 280 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 281 } 282 283 void plugin_register_inline_op(GArray **arr, 284 enum qemu_plugin_mem_rw rw, 285 enum qemu_plugin_op op, void *ptr, 286 uint64_t imm) 287 { 288 struct qemu_plugin_dyn_cb *dyn_cb; 289 290 dyn_cb = plugin_get_dyn_cb(arr); 291 dyn_cb->userp = ptr; 292 dyn_cb->type = PLUGIN_CB_INLINE; 293 dyn_cb->rw = rw; 294 dyn_cb->inline_insn.op = op; 295 dyn_cb->inline_insn.imm = imm; 296 } 297 298 void plugin_register_dyn_cb__udata(GArray **arr, 299 qemu_plugin_vcpu_udata_cb_t cb, 300 enum qemu_plugin_cb_flags flags, 301 void *udata) 302 { 303 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 304 305 dyn_cb->userp = udata; 306 /* Note flags are discarded as unused. */ 307 dyn_cb->f.vcpu_udata = cb; 308 dyn_cb->type = PLUGIN_CB_REGULAR; 309 } 310 311 void plugin_register_vcpu_mem_cb(GArray **arr, 312 void *cb, 313 enum qemu_plugin_cb_flags flags, 314 enum qemu_plugin_mem_rw rw, 315 void *udata) 316 { 317 struct qemu_plugin_dyn_cb *dyn_cb; 318 319 dyn_cb = plugin_get_dyn_cb(arr); 320 dyn_cb->userp = udata; 321 /* Note flags are discarded as unused. */ 322 dyn_cb->type = PLUGIN_CB_REGULAR; 323 dyn_cb->rw = rw; 324 dyn_cb->f.generic = cb; 325 } 326 327 /* 328 * Disable CFI checks. 329 * The callback function has been loaded from an external library so we do not 330 * have type information 331 */ 332 QEMU_DISABLE_CFI 333 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 334 { 335 struct qemu_plugin_cb *cb, *next; 336 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 337 338 /* no plugin_mask check here; caller should have checked */ 339 340 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 341 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 342 343 func(cb->ctx->id, tb); 344 } 345 } 346 347 /* 348 * Disable CFI checks. 349 * The callback function has been loaded from an external library so we do not 350 * have type information 351 */ 352 QEMU_DISABLE_CFI 353 void 354 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 355 uint64_t a3, uint64_t a4, uint64_t a5, 356 uint64_t a6, uint64_t a7, uint64_t a8) 357 { 358 struct qemu_plugin_cb *cb, *next; 359 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 360 361 if (!test_bit(ev, cpu->plugin_mask)) { 362 return; 363 } 364 365 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 366 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 367 368 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 369 } 370 } 371 372 /* 373 * Disable CFI checks. 374 * The callback function has been loaded from an external library so we do not 375 * have type information 376 */ 377 QEMU_DISABLE_CFI 378 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 379 { 380 struct qemu_plugin_cb *cb, *next; 381 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 382 383 if (!test_bit(ev, cpu->plugin_mask)) { 384 return; 385 } 386 387 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 388 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 389 390 func(cb->ctx->id, cpu->cpu_index, num, ret); 391 } 392 } 393 394 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 395 { 396 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 397 } 398 399 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 400 { 401 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 402 } 403 404 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 405 qemu_plugin_vcpu_simple_cb_t cb) 406 { 407 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 408 } 409 410 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 411 qemu_plugin_vcpu_simple_cb_t cb) 412 { 413 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 414 } 415 416 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 417 qemu_plugin_simple_cb_t cb) 418 { 419 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 420 } 421 422 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 423 { 424 g_array_free((GArray *) p, true); 425 return true; 426 } 427 428 void qemu_plugin_flush_cb(void) 429 { 430 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 431 qht_reset(&plugin.dyn_cb_arr_ht); 432 433 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 434 } 435 436 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 437 { 438 uint64_t *val = cb->userp; 439 440 switch (cb->inline_insn.op) { 441 case QEMU_PLUGIN_INLINE_ADD_U64: 442 *val += cb->inline_insn.imm; 443 break; 444 default: 445 g_assert_not_reached(); 446 } 447 } 448 449 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, uint32_t info) 450 { 451 GArray *arr = cpu->plugin_mem_cbs; 452 size_t i; 453 454 if (arr == NULL) { 455 return; 456 } 457 for (i = 0; i < arr->len; i++) { 458 struct qemu_plugin_dyn_cb *cb = 459 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 460 int w = !!(info & TRACE_MEM_ST) + 1; 461 462 if (!(w & cb->rw)) { 463 break; 464 } 465 switch (cb->type) { 466 case PLUGIN_CB_REGULAR: 467 cb->f.vcpu_mem(cpu->cpu_index, info, vaddr, cb->userp); 468 break; 469 case PLUGIN_CB_INLINE: 470 exec_inline_op(cb); 471 break; 472 default: 473 g_assert_not_reached(); 474 } 475 } 476 } 477 478 void qemu_plugin_atexit_cb(void) 479 { 480 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 481 } 482 483 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 484 qemu_plugin_udata_cb_t cb, 485 void *udata) 486 { 487 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 488 } 489 490 /* 491 * Handle exit from linux-user. Unlike the normal atexit() mechanism 492 * we need to handle the clean-up manually as it's possible threads 493 * are still running. We need to remove all callbacks from code 494 * generation, flush the current translations and then we can safely 495 * trigger the exit callbacks. 496 */ 497 498 void qemu_plugin_user_exit(void) 499 { 500 enum qemu_plugin_event ev; 501 CPUState *cpu; 502 503 QEMU_LOCK_GUARD(&plugin.lock); 504 505 start_exclusive(); 506 507 /* un-register all callbacks except the final AT_EXIT one */ 508 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { 509 if (ev != QEMU_PLUGIN_EV_ATEXIT) { 510 struct qemu_plugin_ctx *ctx; 511 QTAILQ_FOREACH(ctx, &plugin.ctxs, entry) { 512 plugin_unregister_cb__locked(ctx, ev); 513 } 514 } 515 } 516 517 tb_flush(current_cpu); 518 519 CPU_FOREACH(cpu) { 520 qemu_plugin_disable_mem_helpers(cpu); 521 } 522 523 end_exclusive(); 524 525 /* now it's safe to handle the exit case */ 526 qemu_plugin_atexit_cb(); 527 } 528 529 /* 530 * Call this function after longjmp'ing to the main loop. It's possible that the 531 * last instruction of a TB might have used helpers, and therefore the 532 * "disable" instruction will never execute because it ended up as dead code. 533 */ 534 void qemu_plugin_disable_mem_helpers(CPUState *cpu) 535 { 536 cpu->plugin_mem_cbs = NULL; 537 } 538 539 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 540 { 541 return ap == bp; 542 } 543 544 static void __attribute__((__constructor__)) plugin_init(void) 545 { 546 int i; 547 548 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 549 QLIST_INIT(&plugin.cb_lists[i]); 550 } 551 qemu_rec_mutex_init(&plugin.lock); 552 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 553 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 554 QTAILQ_INIT(&plugin.ctxs); 555 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 556 QHT_MODE_AUTO_RESIZE); 557 atexit(qemu_plugin_atexit_cb); 558 } 559