1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/rcu_queue.h" 21 #include "qemu/xxhash.h" 22 #include "qemu/rcu.h" 23 #include "hw/core/cpu.h" 24 #include "exec/cpu-common.h" 25 26 #include "exec/exec-all.h" 27 #include "exec/tb-flush.h" 28 #include "exec/helper-proto.h" 29 #include "tcg/tcg.h" 30 #include "tcg/tcg-op.h" 31 #include "plugin.h" 32 #include "qemu/compiler.h" 33 34 struct qemu_plugin_cb { 35 struct qemu_plugin_ctx *ctx; 36 union qemu_plugin_cb_sig f; 37 void *udata; 38 QLIST_ENTRY(qemu_plugin_cb) entry; 39 }; 40 41 struct qemu_plugin_state plugin; 42 43 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 44 { 45 struct qemu_plugin_ctx *ctx; 46 qemu_plugin_id_t *id_p; 47 48 id_p = g_hash_table_lookup(plugin.id_ht, &id); 49 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 50 if (ctx == NULL) { 51 error_report("plugin: invalid plugin id %" PRIu64, id); 52 abort(); 53 } 54 return ctx; 55 } 56 57 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 58 { 59 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); 60 tcg_flush_jmp_cache(cpu); 61 } 62 63 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 64 { 65 CPUState *cpu = container_of(k, CPUState, cpu_index); 66 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 67 68 if (cpu->created) { 69 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 70 } else { 71 plugin_cpu_update__async(cpu, mask); 72 } 73 } 74 75 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 76 enum qemu_plugin_event ev) 77 { 78 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 79 80 if (cb == NULL) { 81 return; 82 } 83 QLIST_REMOVE_RCU(cb, entry); 84 g_free(cb); 85 ctx->callbacks[ev] = NULL; 86 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 87 clear_bit(ev, plugin.mask); 88 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 89 } 90 } 91 92 /* 93 * Disable CFI checks. 94 * The callback function has been loaded from an external library so we do not 95 * have type information 96 */ 97 QEMU_DISABLE_CFI 98 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 99 { 100 struct qemu_plugin_cb *cb, *next; 101 102 switch (ev) { 103 case QEMU_PLUGIN_EV_VCPU_INIT: 104 case QEMU_PLUGIN_EV_VCPU_EXIT: 105 case QEMU_PLUGIN_EV_VCPU_IDLE: 106 case QEMU_PLUGIN_EV_VCPU_RESUME: 107 /* iterate safely; plugins might uninstall themselves at any time */ 108 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 109 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 110 111 func(cb->ctx->id, cpu->cpu_index); 112 } 113 break; 114 default: 115 g_assert_not_reached(); 116 } 117 } 118 119 /* 120 * Disable CFI checks. 121 * The callback function has been loaded from an external library so we do not 122 * have type information 123 */ 124 QEMU_DISABLE_CFI 125 static void plugin_cb__simple(enum qemu_plugin_event ev) 126 { 127 struct qemu_plugin_cb *cb, *next; 128 129 switch (ev) { 130 case QEMU_PLUGIN_EV_FLUSH: 131 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 132 qemu_plugin_simple_cb_t func = cb->f.simple; 133 134 func(cb->ctx->id); 135 } 136 break; 137 default: 138 g_assert_not_reached(); 139 } 140 } 141 142 /* 143 * Disable CFI checks. 144 * The callback function has been loaded from an external library so we do not 145 * have type information 146 */ 147 QEMU_DISABLE_CFI 148 static void plugin_cb__udata(enum qemu_plugin_event ev) 149 { 150 struct qemu_plugin_cb *cb, *next; 151 152 switch (ev) { 153 case QEMU_PLUGIN_EV_ATEXIT: 154 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 155 qemu_plugin_udata_cb_t func = cb->f.udata; 156 157 func(cb->ctx->id, cb->udata); 158 } 159 break; 160 default: 161 g_assert_not_reached(); 162 } 163 } 164 165 static void 166 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 167 void *func, void *udata) 168 { 169 struct qemu_plugin_ctx *ctx; 170 171 QEMU_LOCK_GUARD(&plugin.lock); 172 ctx = plugin_id_to_ctx_locked(id); 173 /* if the plugin is on its way out, ignore this request */ 174 if (unlikely(ctx->uninstalling)) { 175 return; 176 } 177 if (func) { 178 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 179 180 if (cb) { 181 cb->f.generic = func; 182 cb->udata = udata; 183 } else { 184 cb = g_new(struct qemu_plugin_cb, 1); 185 cb->ctx = ctx; 186 cb->f.generic = func; 187 cb->udata = udata; 188 ctx->callbacks[ev] = cb; 189 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 190 if (!test_bit(ev, plugin.mask)) { 191 set_bit(ev, plugin.mask); 192 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 193 NULL); 194 } 195 } 196 } else { 197 plugin_unregister_cb__locked(ctx, ev); 198 } 199 } 200 201 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 202 void *func) 203 { 204 do_plugin_register_cb(id, ev, func, NULL); 205 } 206 207 void 208 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 209 void *func, void *udata) 210 { 211 do_plugin_register_cb(id, ev, func, udata); 212 } 213 214 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 215 { 216 bool success; 217 218 qemu_rec_mutex_lock(&plugin.lock); 219 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 220 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 221 &cpu->cpu_index); 222 g_assert(success); 223 qemu_rec_mutex_unlock(&plugin.lock); 224 225 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 226 } 227 228 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 229 { 230 bool success; 231 232 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 233 234 qemu_rec_mutex_lock(&plugin.lock); 235 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 236 g_assert(success); 237 qemu_rec_mutex_unlock(&plugin.lock); 238 } 239 240 struct plugin_for_each_args { 241 struct qemu_plugin_ctx *ctx; 242 qemu_plugin_vcpu_simple_cb_t cb; 243 }; 244 245 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 246 { 247 struct plugin_for_each_args *args = udata; 248 int cpu_index = *(int *)k; 249 250 args->cb(args->ctx->id, cpu_index); 251 } 252 253 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 254 qemu_plugin_vcpu_simple_cb_t cb) 255 { 256 struct plugin_for_each_args args; 257 258 if (cb == NULL) { 259 return; 260 } 261 qemu_rec_mutex_lock(&plugin.lock); 262 args.ctx = plugin_id_to_ctx_locked(id); 263 args.cb = cb; 264 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 265 qemu_rec_mutex_unlock(&plugin.lock); 266 } 267 268 /* Allocate and return a callback record */ 269 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 270 { 271 GArray *cbs = *arr; 272 273 if (!cbs) { 274 cbs = g_array_sized_new(false, false, 275 sizeof(struct qemu_plugin_dyn_cb), 1); 276 *arr = cbs; 277 } 278 279 g_array_set_size(cbs, cbs->len + 1); 280 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 281 } 282 283 void plugin_register_inline_op(GArray **arr, 284 enum qemu_plugin_mem_rw rw, 285 enum qemu_plugin_op op, void *ptr, 286 uint64_t imm) 287 { 288 struct qemu_plugin_dyn_cb *dyn_cb; 289 290 dyn_cb = plugin_get_dyn_cb(arr); 291 dyn_cb->userp = ptr; 292 dyn_cb->type = PLUGIN_CB_INLINE; 293 dyn_cb->rw = rw; 294 dyn_cb->inline_insn.op = op; 295 dyn_cb->inline_insn.imm = imm; 296 } 297 298 void plugin_register_dyn_cb__udata(GArray **arr, 299 qemu_plugin_vcpu_udata_cb_t cb, 300 enum qemu_plugin_cb_flags flags, 301 void *udata) 302 { 303 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 304 305 dyn_cb->userp = udata; 306 /* Note flags are discarded as unused. */ 307 dyn_cb->f.vcpu_udata = cb; 308 dyn_cb->type = PLUGIN_CB_REGULAR; 309 } 310 311 void plugin_register_vcpu_mem_cb(GArray **arr, 312 void *cb, 313 enum qemu_plugin_cb_flags flags, 314 enum qemu_plugin_mem_rw rw, 315 void *udata) 316 { 317 struct qemu_plugin_dyn_cb *dyn_cb; 318 319 dyn_cb = plugin_get_dyn_cb(arr); 320 dyn_cb->userp = udata; 321 /* Note flags are discarded as unused. */ 322 dyn_cb->type = PLUGIN_CB_REGULAR; 323 dyn_cb->rw = rw; 324 dyn_cb->f.generic = cb; 325 } 326 327 /* 328 * Disable CFI checks. 329 * The callback function has been loaded from an external library so we do not 330 * have type information 331 */ 332 QEMU_DISABLE_CFI 333 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 334 { 335 struct qemu_plugin_cb *cb, *next; 336 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 337 338 /* no plugin_mask check here; caller should have checked */ 339 340 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 341 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 342 343 func(cb->ctx->id, tb); 344 } 345 } 346 347 /* 348 * Disable CFI checks. 349 * The callback function has been loaded from an external library so we do not 350 * have type information 351 */ 352 QEMU_DISABLE_CFI 353 void 354 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 355 uint64_t a3, uint64_t a4, uint64_t a5, 356 uint64_t a6, uint64_t a7, uint64_t a8) 357 { 358 struct qemu_plugin_cb *cb, *next; 359 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 360 361 if (!test_bit(ev, cpu->plugin_mask)) { 362 return; 363 } 364 365 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 366 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 367 368 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 369 } 370 } 371 372 /* 373 * Disable CFI checks. 374 * The callback function has been loaded from an external library so we do not 375 * have type information 376 */ 377 QEMU_DISABLE_CFI 378 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 379 { 380 struct qemu_plugin_cb *cb, *next; 381 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 382 383 if (!test_bit(ev, cpu->plugin_mask)) { 384 return; 385 } 386 387 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 388 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 389 390 func(cb->ctx->id, cpu->cpu_index, num, ret); 391 } 392 } 393 394 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 395 { 396 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 397 } 398 399 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 400 { 401 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 402 } 403 404 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 405 qemu_plugin_vcpu_simple_cb_t cb) 406 { 407 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 408 } 409 410 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 411 qemu_plugin_vcpu_simple_cb_t cb) 412 { 413 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 414 } 415 416 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 417 qemu_plugin_simple_cb_t cb) 418 { 419 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 420 } 421 422 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 423 { 424 g_array_free((GArray *) p, true); 425 return true; 426 } 427 428 void qemu_plugin_flush_cb(void) 429 { 430 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 431 qht_reset(&plugin.dyn_cb_arr_ht); 432 433 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 434 } 435 436 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 437 { 438 uint64_t *val = cb->userp; 439 440 switch (cb->inline_insn.op) { 441 case QEMU_PLUGIN_INLINE_ADD_U64: 442 *val += cb->inline_insn.imm; 443 break; 444 default: 445 g_assert_not_reached(); 446 } 447 } 448 449 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, 450 MemOpIdx oi, enum qemu_plugin_mem_rw rw) 451 { 452 GArray *arr = cpu->plugin_mem_cbs; 453 size_t i; 454 455 if (arr == NULL) { 456 return; 457 } 458 for (i = 0; i < arr->len; i++) { 459 struct qemu_plugin_dyn_cb *cb = 460 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 461 462 if (!(rw & cb->rw)) { 463 break; 464 } 465 switch (cb->type) { 466 case PLUGIN_CB_REGULAR: 467 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw), 468 vaddr, cb->userp); 469 break; 470 case PLUGIN_CB_INLINE: 471 exec_inline_op(cb); 472 break; 473 default: 474 g_assert_not_reached(); 475 } 476 } 477 } 478 479 void qemu_plugin_atexit_cb(void) 480 { 481 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 482 } 483 484 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 485 qemu_plugin_udata_cb_t cb, 486 void *udata) 487 { 488 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 489 } 490 491 /* 492 * Handle exit from linux-user. Unlike the normal atexit() mechanism 493 * we need to handle the clean-up manually as it's possible threads 494 * are still running. We need to remove all callbacks from code 495 * generation, flush the current translations and then we can safely 496 * trigger the exit callbacks. 497 */ 498 499 void qemu_plugin_user_exit(void) 500 { 501 enum qemu_plugin_event ev; 502 CPUState *cpu; 503 504 /* 505 * Locking order: we must acquire locks in an order that is consistent 506 * with the one in fork_start(). That is: 507 * - start_exclusive(), which acquires qemu_cpu_list_lock, 508 * must be called before acquiring plugin.lock. 509 * - tb_flush(), which acquires mmap_lock(), must be called 510 * while plugin.lock is not held. 511 */ 512 start_exclusive(); 513 514 qemu_rec_mutex_lock(&plugin.lock); 515 /* un-register all callbacks except the final AT_EXIT one */ 516 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { 517 if (ev != QEMU_PLUGIN_EV_ATEXIT) { 518 struct qemu_plugin_cb *cb, *next; 519 520 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 521 plugin_unregister_cb__locked(cb->ctx, ev); 522 } 523 } 524 } 525 CPU_FOREACH(cpu) { 526 qemu_plugin_disable_mem_helpers(cpu); 527 } 528 qemu_rec_mutex_unlock(&plugin.lock); 529 530 tb_flush(current_cpu); 531 end_exclusive(); 532 533 /* now it's safe to handle the exit case */ 534 qemu_plugin_atexit_cb(); 535 } 536 537 /* 538 * Helpers for *-user to ensure locks are sane across fork() events. 539 */ 540 541 void qemu_plugin_user_prefork_lock(void) 542 { 543 qemu_rec_mutex_lock(&plugin.lock); 544 } 545 546 void qemu_plugin_user_postfork(bool is_child) 547 { 548 if (is_child) { 549 /* should we just reset via plugin_init? */ 550 qemu_rec_mutex_init(&plugin.lock); 551 } else { 552 qemu_rec_mutex_unlock(&plugin.lock); 553 } 554 } 555 556 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 557 { 558 return ap == bp; 559 } 560 561 static void __attribute__((__constructor__)) plugin_init(void) 562 { 563 int i; 564 565 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 566 QLIST_INIT(&plugin.cb_lists[i]); 567 } 568 qemu_rec_mutex_init(&plugin.lock); 569 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 570 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 571 QTAILQ_INIT(&plugin.ctxs); 572 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 573 QHT_MODE_AUTO_RESIZE); 574 atexit(qemu_plugin_atexit_cb); 575 } 576