1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/rcu_queue.h" 21 #include "qemu/xxhash.h" 22 #include "qemu/rcu.h" 23 #include "hw/core/cpu.h" 24 25 #include "exec/exec-all.h" 26 #include "exec/tb-flush.h" 27 #include "tcg/tcg.h" 28 #include "tcg/tcg-op.h" 29 #include "plugin.h" 30 #include "qemu/compiler.h" 31 32 struct qemu_plugin_cb { 33 struct qemu_plugin_ctx *ctx; 34 union qemu_plugin_cb_sig f; 35 void *udata; 36 QLIST_ENTRY(qemu_plugin_cb) entry; 37 }; 38 39 struct qemu_plugin_state plugin; 40 41 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 42 { 43 struct qemu_plugin_ctx *ctx; 44 qemu_plugin_id_t *id_p; 45 46 id_p = g_hash_table_lookup(plugin.id_ht, &id); 47 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 48 if (ctx == NULL) { 49 error_report("plugin: invalid plugin id %" PRIu64, id); 50 abort(); 51 } 52 return ctx; 53 } 54 55 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 56 { 57 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); 58 tcg_flush_jmp_cache(cpu); 59 } 60 61 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 62 { 63 CPUState *cpu = container_of(k, CPUState, cpu_index); 64 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 65 66 if (DEVICE(cpu)->realized) { 67 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 68 } else { 69 plugin_cpu_update__async(cpu, mask); 70 } 71 } 72 73 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 74 enum qemu_plugin_event ev) 75 { 76 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 77 78 if (cb == NULL) { 79 return; 80 } 81 QLIST_REMOVE_RCU(cb, entry); 82 g_free(cb); 83 ctx->callbacks[ev] = NULL; 84 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 85 clear_bit(ev, plugin.mask); 86 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 87 } 88 } 89 90 /* 91 * Disable CFI checks. 92 * The callback function has been loaded from an external library so we do not 93 * have type information 94 */ 95 QEMU_DISABLE_CFI 96 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 97 { 98 struct qemu_plugin_cb *cb, *next; 99 100 switch (ev) { 101 case QEMU_PLUGIN_EV_VCPU_INIT: 102 case QEMU_PLUGIN_EV_VCPU_EXIT: 103 case QEMU_PLUGIN_EV_VCPU_IDLE: 104 case QEMU_PLUGIN_EV_VCPU_RESUME: 105 /* iterate safely; plugins might uninstall themselves at any time */ 106 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 107 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 108 109 func(cb->ctx->id, cpu->cpu_index); 110 } 111 break; 112 default: 113 g_assert_not_reached(); 114 } 115 } 116 117 /* 118 * Disable CFI checks. 119 * The callback function has been loaded from an external library so we do not 120 * have type information 121 */ 122 QEMU_DISABLE_CFI 123 static void plugin_cb__simple(enum qemu_plugin_event ev) 124 { 125 struct qemu_plugin_cb *cb, *next; 126 127 switch (ev) { 128 case QEMU_PLUGIN_EV_FLUSH: 129 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 130 qemu_plugin_simple_cb_t func = cb->f.simple; 131 132 func(cb->ctx->id); 133 } 134 break; 135 default: 136 g_assert_not_reached(); 137 } 138 } 139 140 /* 141 * Disable CFI checks. 142 * The callback function has been loaded from an external library so we do not 143 * have type information 144 */ 145 QEMU_DISABLE_CFI 146 static void plugin_cb__udata(enum qemu_plugin_event ev) 147 { 148 struct qemu_plugin_cb *cb, *next; 149 150 switch (ev) { 151 case QEMU_PLUGIN_EV_ATEXIT: 152 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 153 qemu_plugin_udata_cb_t func = cb->f.udata; 154 155 func(cb->ctx->id, cb->udata); 156 } 157 break; 158 default: 159 g_assert_not_reached(); 160 } 161 } 162 163 static void 164 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 165 void *func, void *udata) 166 { 167 struct qemu_plugin_ctx *ctx; 168 169 QEMU_LOCK_GUARD(&plugin.lock); 170 ctx = plugin_id_to_ctx_locked(id); 171 /* if the plugin is on its way out, ignore this request */ 172 if (unlikely(ctx->uninstalling)) { 173 return; 174 } 175 if (func) { 176 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 177 178 if (cb) { 179 cb->f.generic = func; 180 cb->udata = udata; 181 } else { 182 cb = g_new(struct qemu_plugin_cb, 1); 183 cb->ctx = ctx; 184 cb->f.generic = func; 185 cb->udata = udata; 186 ctx->callbacks[ev] = cb; 187 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 188 if (!test_bit(ev, plugin.mask)) { 189 set_bit(ev, plugin.mask); 190 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 191 NULL); 192 } 193 } 194 } else { 195 plugin_unregister_cb__locked(ctx, ev); 196 } 197 } 198 199 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 200 void *func) 201 { 202 do_plugin_register_cb(id, ev, func, NULL); 203 } 204 205 void 206 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 207 void *func, void *udata) 208 { 209 do_plugin_register_cb(id, ev, func, udata); 210 } 211 212 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 213 { 214 bool success; 215 216 qemu_rec_mutex_lock(&plugin.lock); 217 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 218 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 219 &cpu->cpu_index); 220 g_assert(success); 221 qemu_rec_mutex_unlock(&plugin.lock); 222 223 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 224 } 225 226 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 227 { 228 bool success; 229 230 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 231 232 qemu_rec_mutex_lock(&plugin.lock); 233 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 234 g_assert(success); 235 qemu_rec_mutex_unlock(&plugin.lock); 236 } 237 238 struct plugin_for_each_args { 239 struct qemu_plugin_ctx *ctx; 240 qemu_plugin_vcpu_simple_cb_t cb; 241 }; 242 243 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 244 { 245 struct plugin_for_each_args *args = udata; 246 int cpu_index = *(int *)k; 247 248 args->cb(args->ctx->id, cpu_index); 249 } 250 251 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 252 qemu_plugin_vcpu_simple_cb_t cb) 253 { 254 struct plugin_for_each_args args; 255 256 if (cb == NULL) { 257 return; 258 } 259 qemu_rec_mutex_lock(&plugin.lock); 260 args.ctx = plugin_id_to_ctx_locked(id); 261 args.cb = cb; 262 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 263 qemu_rec_mutex_unlock(&plugin.lock); 264 } 265 266 /* Allocate and return a callback record */ 267 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 268 { 269 GArray *cbs = *arr; 270 271 if (!cbs) { 272 cbs = g_array_sized_new(false, false, 273 sizeof(struct qemu_plugin_dyn_cb), 1); 274 *arr = cbs; 275 } 276 277 g_array_set_size(cbs, cbs->len + 1); 278 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 279 } 280 281 void plugin_register_inline_op(GArray **arr, 282 enum qemu_plugin_mem_rw rw, 283 enum qemu_plugin_op op, void *ptr, 284 uint64_t imm) 285 { 286 struct qemu_plugin_dyn_cb *dyn_cb; 287 288 dyn_cb = plugin_get_dyn_cb(arr); 289 dyn_cb->userp = ptr; 290 dyn_cb->type = PLUGIN_CB_INLINE; 291 dyn_cb->rw = rw; 292 dyn_cb->inline_insn.op = op; 293 dyn_cb->inline_insn.imm = imm; 294 } 295 296 void plugin_register_dyn_cb__udata(GArray **arr, 297 qemu_plugin_vcpu_udata_cb_t cb, 298 enum qemu_plugin_cb_flags flags, 299 void *udata) 300 { 301 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 302 303 dyn_cb->userp = udata; 304 /* Note flags are discarded as unused. */ 305 dyn_cb->f.vcpu_udata = cb; 306 dyn_cb->type = PLUGIN_CB_REGULAR; 307 } 308 309 void plugin_register_vcpu_mem_cb(GArray **arr, 310 void *cb, 311 enum qemu_plugin_cb_flags flags, 312 enum qemu_plugin_mem_rw rw, 313 void *udata) 314 { 315 struct qemu_plugin_dyn_cb *dyn_cb; 316 317 dyn_cb = plugin_get_dyn_cb(arr); 318 dyn_cb->userp = udata; 319 /* Note flags are discarded as unused. */ 320 dyn_cb->type = PLUGIN_CB_REGULAR; 321 dyn_cb->rw = rw; 322 dyn_cb->f.generic = cb; 323 } 324 325 /* 326 * Disable CFI checks. 327 * The callback function has been loaded from an external library so we do not 328 * have type information 329 */ 330 QEMU_DISABLE_CFI 331 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 332 { 333 struct qemu_plugin_cb *cb, *next; 334 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 335 336 /* no plugin_mask check here; caller should have checked */ 337 338 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 339 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 340 341 func(cb->ctx->id, tb); 342 } 343 } 344 345 /* 346 * Disable CFI checks. 347 * The callback function has been loaded from an external library so we do not 348 * have type information 349 */ 350 QEMU_DISABLE_CFI 351 void 352 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 353 uint64_t a3, uint64_t a4, uint64_t a5, 354 uint64_t a6, uint64_t a7, uint64_t a8) 355 { 356 struct qemu_plugin_cb *cb, *next; 357 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 358 359 if (!test_bit(ev, cpu->plugin_mask)) { 360 return; 361 } 362 363 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 364 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 365 366 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 367 } 368 } 369 370 /* 371 * Disable CFI checks. 372 * The callback function has been loaded from an external library so we do not 373 * have type information 374 */ 375 QEMU_DISABLE_CFI 376 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 377 { 378 struct qemu_plugin_cb *cb, *next; 379 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 380 381 if (!test_bit(ev, cpu->plugin_mask)) { 382 return; 383 } 384 385 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 386 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 387 388 func(cb->ctx->id, cpu->cpu_index, num, ret); 389 } 390 } 391 392 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 393 { 394 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 395 } 396 397 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 398 { 399 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 400 } 401 402 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 403 qemu_plugin_vcpu_simple_cb_t cb) 404 { 405 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 406 } 407 408 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 409 qemu_plugin_vcpu_simple_cb_t cb) 410 { 411 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 412 } 413 414 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 415 qemu_plugin_simple_cb_t cb) 416 { 417 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 418 } 419 420 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 421 { 422 g_array_free((GArray *) p, true); 423 return true; 424 } 425 426 void qemu_plugin_flush_cb(void) 427 { 428 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 429 qht_reset(&plugin.dyn_cb_arr_ht); 430 431 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 432 } 433 434 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 435 { 436 uint64_t *val = cb->userp; 437 438 switch (cb->inline_insn.op) { 439 case QEMU_PLUGIN_INLINE_ADD_U64: 440 *val += cb->inline_insn.imm; 441 break; 442 default: 443 g_assert_not_reached(); 444 } 445 } 446 447 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, 448 MemOpIdx oi, enum qemu_plugin_mem_rw rw) 449 { 450 GArray *arr = cpu->plugin_mem_cbs; 451 size_t i; 452 453 if (arr == NULL) { 454 return; 455 } 456 for (i = 0; i < arr->len; i++) { 457 struct qemu_plugin_dyn_cb *cb = 458 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 459 460 if (!(rw & cb->rw)) { 461 break; 462 } 463 switch (cb->type) { 464 case PLUGIN_CB_REGULAR: 465 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw), 466 vaddr, cb->userp); 467 break; 468 case PLUGIN_CB_INLINE: 469 exec_inline_op(cb); 470 break; 471 default: 472 g_assert_not_reached(); 473 } 474 } 475 } 476 477 void qemu_plugin_atexit_cb(void) 478 { 479 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 480 } 481 482 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 483 qemu_plugin_udata_cb_t cb, 484 void *udata) 485 { 486 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 487 } 488 489 /* 490 * Handle exit from linux-user. Unlike the normal atexit() mechanism 491 * we need to handle the clean-up manually as it's possible threads 492 * are still running. We need to remove all callbacks from code 493 * generation, flush the current translations and then we can safely 494 * trigger the exit callbacks. 495 */ 496 497 void qemu_plugin_user_exit(void) 498 { 499 enum qemu_plugin_event ev; 500 CPUState *cpu; 501 502 /* 503 * Locking order: we must acquire locks in an order that is consistent 504 * with the one in fork_start(). That is: 505 * - start_exclusive(), which acquires qemu_cpu_list_lock, 506 * must be called before acquiring plugin.lock. 507 * - tb_flush(), which acquires mmap_lock(), must be called 508 * while plugin.lock is not held. 509 */ 510 start_exclusive(); 511 512 qemu_rec_mutex_lock(&plugin.lock); 513 /* un-register all callbacks except the final AT_EXIT one */ 514 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { 515 if (ev != QEMU_PLUGIN_EV_ATEXIT) { 516 struct qemu_plugin_cb *cb, *next; 517 518 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 519 plugin_unregister_cb__locked(cb->ctx, ev); 520 } 521 } 522 } 523 CPU_FOREACH(cpu) { 524 qemu_plugin_disable_mem_helpers(cpu); 525 } 526 qemu_rec_mutex_unlock(&plugin.lock); 527 528 tb_flush(current_cpu); 529 end_exclusive(); 530 531 /* now it's safe to handle the exit case */ 532 qemu_plugin_atexit_cb(); 533 } 534 535 /* 536 * Helpers for *-user to ensure locks are sane across fork() events. 537 */ 538 539 void qemu_plugin_user_prefork_lock(void) 540 { 541 qemu_rec_mutex_lock(&plugin.lock); 542 } 543 544 void qemu_plugin_user_postfork(bool is_child) 545 { 546 if (is_child) { 547 /* should we just reset via plugin_init? */ 548 qemu_rec_mutex_init(&plugin.lock); 549 } else { 550 qemu_rec_mutex_unlock(&plugin.lock); 551 } 552 } 553 554 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 555 { 556 return ap == bp; 557 } 558 559 static void __attribute__((__constructor__)) plugin_init(void) 560 { 561 int i; 562 563 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 564 QLIST_INIT(&plugin.cb_lists[i]); 565 } 566 qemu_rec_mutex_init(&plugin.lock); 567 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 568 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 569 QTAILQ_INIT(&plugin.ctxs); 570 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 571 QHT_MODE_AUTO_RESIZE); 572 atexit(qemu_plugin_atexit_cb); 573 } 574