1 /* 2 * QEMU Plugin Core code 3 * 4 * This is the core code that deals with injecting instrumentation into the code 5 * 6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> 7 * Copyright (C) 2019, Linaro 8 * 9 * License: GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 * SPDX-License-Identifier: GPL-2.0-or-later 13 */ 14 #include "qemu/osdep.h" 15 #include "qemu/error-report.h" 16 #include "qemu/config-file.h" 17 #include "qapi/error.h" 18 #include "qemu/lockable.h" 19 #include "qemu/option.h" 20 #include "qemu/rcu_queue.h" 21 #include "qemu/xxhash.h" 22 #include "qemu/rcu.h" 23 #include "hw/core/cpu.h" 24 25 #include "exec/exec-all.h" 26 #include "exec/tb-flush.h" 27 #include "tcg/tcg.h" 28 #include "tcg/tcg-op.h" 29 #include "plugin.h" 30 31 struct qemu_plugin_cb { 32 struct qemu_plugin_ctx *ctx; 33 union qemu_plugin_cb_sig f; 34 void *udata; 35 QLIST_ENTRY(qemu_plugin_cb) entry; 36 }; 37 38 struct qemu_plugin_state plugin; 39 40 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) 41 { 42 struct qemu_plugin_ctx *ctx; 43 qemu_plugin_id_t *id_p; 44 45 id_p = g_hash_table_lookup(plugin.id_ht, &id); 46 ctx = container_of(id_p, struct qemu_plugin_ctx, id); 47 if (ctx == NULL) { 48 error_report("plugin: invalid plugin id %" PRIu64, id); 49 abort(); 50 } 51 return ctx; 52 } 53 54 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) 55 { 56 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); 57 tcg_flush_jmp_cache(cpu); 58 } 59 60 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) 61 { 62 CPUState *cpu = container_of(k, CPUState, cpu_index); 63 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); 64 65 if (DEVICE(cpu)->realized) { 66 async_run_on_cpu(cpu, plugin_cpu_update__async, mask); 67 } else { 68 plugin_cpu_update__async(cpu, mask); 69 } 70 } 71 72 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, 73 enum qemu_plugin_event ev) 74 { 75 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 76 77 if (cb == NULL) { 78 return; 79 } 80 QLIST_REMOVE_RCU(cb, entry); 81 g_free(cb); 82 ctx->callbacks[ev] = NULL; 83 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { 84 clear_bit(ev, plugin.mask); 85 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); 86 } 87 } 88 89 /* 90 * Disable CFI checks. 91 * The callback function has been loaded from an external library so we do not 92 * have type information 93 */ 94 QEMU_DISABLE_CFI 95 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) 96 { 97 struct qemu_plugin_cb *cb, *next; 98 99 switch (ev) { 100 case QEMU_PLUGIN_EV_VCPU_INIT: 101 case QEMU_PLUGIN_EV_VCPU_EXIT: 102 case QEMU_PLUGIN_EV_VCPU_IDLE: 103 case QEMU_PLUGIN_EV_VCPU_RESUME: 104 /* iterate safely; plugins might uninstall themselves at any time */ 105 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 106 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; 107 108 func(cb->ctx->id, cpu->cpu_index); 109 } 110 break; 111 default: 112 g_assert_not_reached(); 113 } 114 } 115 116 /* 117 * Disable CFI checks. 118 * The callback function has been loaded from an external library so we do not 119 * have type information 120 */ 121 QEMU_DISABLE_CFI 122 static void plugin_cb__simple(enum qemu_plugin_event ev) 123 { 124 struct qemu_plugin_cb *cb, *next; 125 126 switch (ev) { 127 case QEMU_PLUGIN_EV_FLUSH: 128 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 129 qemu_plugin_simple_cb_t func = cb->f.simple; 130 131 func(cb->ctx->id); 132 } 133 break; 134 default: 135 g_assert_not_reached(); 136 } 137 } 138 139 /* 140 * Disable CFI checks. 141 * The callback function has been loaded from an external library so we do not 142 * have type information 143 */ 144 QEMU_DISABLE_CFI 145 static void plugin_cb__udata(enum qemu_plugin_event ev) 146 { 147 struct qemu_plugin_cb *cb, *next; 148 149 switch (ev) { 150 case QEMU_PLUGIN_EV_ATEXIT: 151 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 152 qemu_plugin_udata_cb_t func = cb->f.udata; 153 154 func(cb->ctx->id, cb->udata); 155 } 156 break; 157 default: 158 g_assert_not_reached(); 159 } 160 } 161 162 static void 163 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 164 void *func, void *udata) 165 { 166 struct qemu_plugin_ctx *ctx; 167 168 QEMU_LOCK_GUARD(&plugin.lock); 169 ctx = plugin_id_to_ctx_locked(id); 170 /* if the plugin is on its way out, ignore this request */ 171 if (unlikely(ctx->uninstalling)) { 172 return; 173 } 174 if (func) { 175 struct qemu_plugin_cb *cb = ctx->callbacks[ev]; 176 177 if (cb) { 178 cb->f.generic = func; 179 cb->udata = udata; 180 } else { 181 cb = g_new(struct qemu_plugin_cb, 1); 182 cb->ctx = ctx; 183 cb->f.generic = func; 184 cb->udata = udata; 185 ctx->callbacks[ev] = cb; 186 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); 187 if (!test_bit(ev, plugin.mask)) { 188 set_bit(ev, plugin.mask); 189 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, 190 NULL); 191 } 192 } 193 } else { 194 plugin_unregister_cb__locked(ctx, ev); 195 } 196 } 197 198 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, 199 void *func) 200 { 201 do_plugin_register_cb(id, ev, func, NULL); 202 } 203 204 void 205 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, 206 void *func, void *udata) 207 { 208 do_plugin_register_cb(id, ev, func, udata); 209 } 210 211 void qemu_plugin_vcpu_init_hook(CPUState *cpu) 212 { 213 bool success; 214 215 qemu_rec_mutex_lock(&plugin.lock); 216 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); 217 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, 218 &cpu->cpu_index); 219 g_assert(success); 220 qemu_rec_mutex_unlock(&plugin.lock); 221 222 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); 223 } 224 225 void qemu_plugin_vcpu_exit_hook(CPUState *cpu) 226 { 227 bool success; 228 229 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); 230 231 qemu_rec_mutex_lock(&plugin.lock); 232 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); 233 g_assert(success); 234 qemu_rec_mutex_unlock(&plugin.lock); 235 } 236 237 struct plugin_for_each_args { 238 struct qemu_plugin_ctx *ctx; 239 qemu_plugin_vcpu_simple_cb_t cb; 240 }; 241 242 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) 243 { 244 struct plugin_for_each_args *args = udata; 245 int cpu_index = *(int *)k; 246 247 args->cb(args->ctx->id, cpu_index); 248 } 249 250 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, 251 qemu_plugin_vcpu_simple_cb_t cb) 252 { 253 struct plugin_for_each_args args; 254 255 if (cb == NULL) { 256 return; 257 } 258 qemu_rec_mutex_lock(&plugin.lock); 259 args.ctx = plugin_id_to_ctx_locked(id); 260 args.cb = cb; 261 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); 262 qemu_rec_mutex_unlock(&plugin.lock); 263 } 264 265 /* Allocate and return a callback record */ 266 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) 267 { 268 GArray *cbs = *arr; 269 270 if (!cbs) { 271 cbs = g_array_sized_new(false, false, 272 sizeof(struct qemu_plugin_dyn_cb), 1); 273 *arr = cbs; 274 } 275 276 g_array_set_size(cbs, cbs->len + 1); 277 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); 278 } 279 280 void plugin_register_inline_op(GArray **arr, 281 enum qemu_plugin_mem_rw rw, 282 enum qemu_plugin_op op, void *ptr, 283 uint64_t imm) 284 { 285 struct qemu_plugin_dyn_cb *dyn_cb; 286 287 dyn_cb = plugin_get_dyn_cb(arr); 288 dyn_cb->userp = ptr; 289 dyn_cb->type = PLUGIN_CB_INLINE; 290 dyn_cb->rw = rw; 291 dyn_cb->inline_insn.op = op; 292 dyn_cb->inline_insn.imm = imm; 293 } 294 295 void plugin_register_dyn_cb__udata(GArray **arr, 296 qemu_plugin_vcpu_udata_cb_t cb, 297 enum qemu_plugin_cb_flags flags, 298 void *udata) 299 { 300 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); 301 302 dyn_cb->userp = udata; 303 /* Note flags are discarded as unused. */ 304 dyn_cb->f.vcpu_udata = cb; 305 dyn_cb->type = PLUGIN_CB_REGULAR; 306 } 307 308 void plugin_register_vcpu_mem_cb(GArray **arr, 309 void *cb, 310 enum qemu_plugin_cb_flags flags, 311 enum qemu_plugin_mem_rw rw, 312 void *udata) 313 { 314 struct qemu_plugin_dyn_cb *dyn_cb; 315 316 dyn_cb = plugin_get_dyn_cb(arr); 317 dyn_cb->userp = udata; 318 /* Note flags are discarded as unused. */ 319 dyn_cb->type = PLUGIN_CB_REGULAR; 320 dyn_cb->rw = rw; 321 dyn_cb->f.generic = cb; 322 } 323 324 /* 325 * Disable CFI checks. 326 * The callback function has been loaded from an external library so we do not 327 * have type information 328 */ 329 QEMU_DISABLE_CFI 330 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) 331 { 332 struct qemu_plugin_cb *cb, *next; 333 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; 334 335 /* no plugin_mask check here; caller should have checked */ 336 337 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 338 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; 339 340 func(cb->ctx->id, tb); 341 } 342 } 343 344 /* 345 * Disable CFI checks. 346 * The callback function has been loaded from an external library so we do not 347 * have type information 348 */ 349 QEMU_DISABLE_CFI 350 void 351 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, 352 uint64_t a3, uint64_t a4, uint64_t a5, 353 uint64_t a6, uint64_t a7, uint64_t a8) 354 { 355 struct qemu_plugin_cb *cb, *next; 356 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; 357 358 if (!test_bit(ev, cpu->plugin_mask)) { 359 return; 360 } 361 362 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 363 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; 364 365 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); 366 } 367 } 368 369 /* 370 * Disable CFI checks. 371 * The callback function has been loaded from an external library so we do not 372 * have type information 373 */ 374 QEMU_DISABLE_CFI 375 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) 376 { 377 struct qemu_plugin_cb *cb, *next; 378 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; 379 380 if (!test_bit(ev, cpu->plugin_mask)) { 381 return; 382 } 383 384 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 385 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; 386 387 func(cb->ctx->id, cpu->cpu_index, num, ret); 388 } 389 } 390 391 void qemu_plugin_vcpu_idle_cb(CPUState *cpu) 392 { 393 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); 394 } 395 396 void qemu_plugin_vcpu_resume_cb(CPUState *cpu) 397 { 398 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); 399 } 400 401 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, 402 qemu_plugin_vcpu_simple_cb_t cb) 403 { 404 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); 405 } 406 407 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, 408 qemu_plugin_vcpu_simple_cb_t cb) 409 { 410 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); 411 } 412 413 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, 414 qemu_plugin_simple_cb_t cb) 415 { 416 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); 417 } 418 419 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) 420 { 421 g_array_free((GArray *) p, true); 422 return true; 423 } 424 425 void qemu_plugin_flush_cb(void) 426 { 427 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); 428 qht_reset(&plugin.dyn_cb_arr_ht); 429 430 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); 431 } 432 433 void exec_inline_op(struct qemu_plugin_dyn_cb *cb) 434 { 435 uint64_t *val = cb->userp; 436 437 switch (cb->inline_insn.op) { 438 case QEMU_PLUGIN_INLINE_ADD_U64: 439 *val += cb->inline_insn.imm; 440 break; 441 default: 442 g_assert_not_reached(); 443 } 444 } 445 446 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, 447 MemOpIdx oi, enum qemu_plugin_mem_rw rw) 448 { 449 GArray *arr = cpu->plugin_mem_cbs; 450 size_t i; 451 452 if (arr == NULL) { 453 return; 454 } 455 for (i = 0; i < arr->len; i++) { 456 struct qemu_plugin_dyn_cb *cb = 457 &g_array_index(arr, struct qemu_plugin_dyn_cb, i); 458 459 if (!(rw & cb->rw)) { 460 break; 461 } 462 switch (cb->type) { 463 case PLUGIN_CB_REGULAR: 464 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw), 465 vaddr, cb->userp); 466 break; 467 case PLUGIN_CB_INLINE: 468 exec_inline_op(cb); 469 break; 470 default: 471 g_assert_not_reached(); 472 } 473 } 474 } 475 476 void qemu_plugin_atexit_cb(void) 477 { 478 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); 479 } 480 481 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, 482 qemu_plugin_udata_cb_t cb, 483 void *udata) 484 { 485 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); 486 } 487 488 /* 489 * Handle exit from linux-user. Unlike the normal atexit() mechanism 490 * we need to handle the clean-up manually as it's possible threads 491 * are still running. We need to remove all callbacks from code 492 * generation, flush the current translations and then we can safely 493 * trigger the exit callbacks. 494 */ 495 496 void qemu_plugin_user_exit(void) 497 { 498 enum qemu_plugin_event ev; 499 CPUState *cpu; 500 501 /* 502 * Locking order: we must acquire locks in an order that is consistent 503 * with the one in fork_start(). That is: 504 * - start_exclusive(), which acquires qemu_cpu_list_lock, 505 * must be called before acquiring plugin.lock. 506 * - tb_flush(), which acquires mmap_lock(), must be called 507 * while plugin.lock is not held. 508 */ 509 start_exclusive(); 510 511 qemu_rec_mutex_lock(&plugin.lock); 512 /* un-register all callbacks except the final AT_EXIT one */ 513 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { 514 if (ev != QEMU_PLUGIN_EV_ATEXIT) { 515 struct qemu_plugin_cb *cb, *next; 516 517 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { 518 plugin_unregister_cb__locked(cb->ctx, ev); 519 } 520 } 521 } 522 CPU_FOREACH(cpu) { 523 qemu_plugin_disable_mem_helpers(cpu); 524 } 525 qemu_rec_mutex_unlock(&plugin.lock); 526 527 tb_flush(current_cpu); 528 end_exclusive(); 529 530 /* now it's safe to handle the exit case */ 531 qemu_plugin_atexit_cb(); 532 } 533 534 /* 535 * Helpers for *-user to ensure locks are sane across fork() events. 536 */ 537 538 void qemu_plugin_user_prefork_lock(void) 539 { 540 qemu_rec_mutex_lock(&plugin.lock); 541 } 542 543 void qemu_plugin_user_postfork(bool is_child) 544 { 545 if (is_child) { 546 /* should we just reset via plugin_init? */ 547 qemu_rec_mutex_init(&plugin.lock); 548 } else { 549 qemu_rec_mutex_unlock(&plugin.lock); 550 } 551 } 552 553 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) 554 { 555 return ap == bp; 556 } 557 558 static void __attribute__((__constructor__)) plugin_init(void) 559 { 560 int i; 561 562 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { 563 QLIST_INIT(&plugin.cb_lists[i]); 564 } 565 qemu_rec_mutex_init(&plugin.lock); 566 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); 567 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); 568 QTAILQ_INIT(&plugin.ctxs); 569 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, 570 QHT_MODE_AUTO_RESIZE); 571 atexit(qemu_plugin_atexit_cb); 572 } 573