plugins/core.c

   1 /*
   2  * QEMU Plugin Core code
   3  *
   4  * This is the core code that deals with injecting instrumentation into the code
   5  *
   6  * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
   7  * Copyright (C) 2019, Linaro
   8  *
   9  * License: GNU GPL, version 2 or later.
  10  *   See the COPYING file in the top-level directory.
  11  *
  12  * SPDX-License-Identifier: GPL-2.0-or-later
  13  */
  14 #include "qemu/osdep.h"
  15 #include "qemu/error-report.h"
  16 #include "qemu/config-file.h"
  17 #include "qapi/error.h"
  18 #include "qemu/lockable.h"
  19 #include "qemu/option.h"
  20 #include "qemu/rcu_queue.h"
  21 #include "qemu/xxhash.h"
  22 #include "qemu/rcu.h"
  23 #include "hw/core/cpu.h"
  24
  25 #include "exec/exec-all.h"
  26 #include "exec/tb-flush.h"
  27 #include "tcg/tcg.h"
  28 #include "tcg/tcg-op.h"
  29 #include "plugin.h"
  30 #include "qemu/compiler.h"
  31
  32 struct qemu_plugin_cb {
  33     struct qemu_plugin_ctx *ctx;
  34     union qemu_plugin_cb_sig f;
  35     void *udata;
  36     QLIST_ENTRY(qemu_plugin_cb) entry;
  37 };
  38
  39 struct qemu_plugin_state plugin;
  40
  41 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
  42 {
  43     struct qemu_plugin_ctx *ctx;
  44     qemu_plugin_id_t *id_p;
  45
  46     id_p = g_hash_table_lookup(plugin.id_ht, &id);
  47     ctx = container_of(id_p, struct qemu_plugin_ctx, id);
  48     if (ctx == NULL) {
  49         error_report("plugin: invalid plugin id %" PRIu64, id);
  50         abort();
  51     }
  52     return ctx;
  53 }
  54
  55 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
  56 {
  57     bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
  58     tcg_flush_jmp_cache(cpu);
  59 }
  60
  61 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
  62 {
  63     CPUState *cpu = container_of(k, CPUState, cpu_index);
  64     run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);
  65
  66     if (DEVICE(cpu)->realized) {
  67         async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
  68     } else {
  69         plugin_cpu_update__async(cpu, mask);
  70     }
  71 }
  72
  73 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
  74                                   enum qemu_plugin_event ev)
  75 {
  76     struct qemu_plugin_cb *cb = ctx->callbacks[ev];
  77
  78     if (cb == NULL) {
  79         return;
  80     }
  81     QLIST_REMOVE_RCU(cb, entry);
  82     g_free(cb);
  83     ctx->callbacks[ev] = NULL;
  84     if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
  85         clear_bit(ev, plugin.mask);
  86         g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
  87     }
  88 }
  89
  90 /*
  91  * Disable CFI checks.
  92  * The callback function has been loaded from an external library so we do not
  93  * have type information
  94  */
  95 QEMU_DISABLE_CFI
  96 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
  97 {
  98     struct qemu_plugin_cb *cb, *next;
  99
 100     switch (ev) {
 101     case QEMU_PLUGIN_EV_VCPU_INIT:
 102     case QEMU_PLUGIN_EV_VCPU_EXIT:
 103     case QEMU_PLUGIN_EV_VCPU_IDLE:
 104     case QEMU_PLUGIN_EV_VCPU_RESUME:
 105         /* iterate safely; plugins might uninstall themselves at any time */
 106         QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 107             qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;
 108
 109             func(cb->ctx->id, cpu->cpu_index);
 110         }
 111         break;
 112     default:
 113         g_assert_not_reached();
 114     }
 115 }
 116
 117 /*
 118  * Disable CFI checks.
 119  * The callback function has been loaded from an external library so we do not
 120  * have type information
 121  */
 122 QEMU_DISABLE_CFI
 123 static void plugin_cb__simple(enum qemu_plugin_event ev)
 124 {
 125     struct qemu_plugin_cb *cb, *next;
 126
 127     switch (ev) {
 128     case QEMU_PLUGIN_EV_FLUSH:
 129         QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 130             qemu_plugin_simple_cb_t func = cb->f.simple;
 131
 132             func(cb->ctx->id);
 133         }
 134         break;
 135     default:
 136         g_assert_not_reached();
 137     }
 138 }
 139
 140 /*
 141  * Disable CFI checks.
 142  * The callback function has been loaded from an external library so we do not
 143  * have type information
 144  */
 145 QEMU_DISABLE_CFI
 146 static void plugin_cb__udata(enum qemu_plugin_event ev)
 147 {
 148     struct qemu_plugin_cb *cb, *next;
 149
 150     switch (ev) {
 151     case QEMU_PLUGIN_EV_ATEXIT:
 152         QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 153             qemu_plugin_udata_cb_t func = cb->f.udata;
 154
 155             func(cb->ctx->id, cb->udata);
 156         }
 157         break;
 158     default:
 159         g_assert_not_reached();
 160     }
 161 }
 162
 163 static void
 164 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
 165                       void *func, void *udata)
 166 {
 167     struct qemu_plugin_ctx *ctx;
 168
 169     QEMU_LOCK_GUARD(&plugin.lock);
 170     ctx = plugin_id_to_ctx_locked(id);
 171     /* if the plugin is on its way out, ignore this request */
 172     if (unlikely(ctx->uninstalling)) {
 173         return;
 174     }
 175     if (func) {
 176         struct qemu_plugin_cb *cb = ctx->callbacks[ev];
 177
 178         if (cb) {
 179             cb->f.generic = func;
 180             cb->udata = udata;
 181         } else {
 182             cb = g_new(struct qemu_plugin_cb, 1);
 183             cb->ctx = ctx;
 184             cb->f.generic = func;
 185             cb->udata = udata;
 186             ctx->callbacks[ev] = cb;
 187             QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
 188             if (!test_bit(ev, plugin.mask)) {
 189                 set_bit(ev, plugin.mask);
 190                 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
 191                                      NULL);
 192             }
 193         }
 194     } else {
 195         plugin_unregister_cb__locked(ctx, ev);
 196     }
 197 }
 198
 199 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
 200                         void *func)
 201 {
 202     do_plugin_register_cb(id, ev, func, NULL);
 203 }
 204
 205 void
 206 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
 207                          void *func, void *udata)
 208 {
 209     do_plugin_register_cb(id, ev, func, udata);
 210 }
 211
 212 void qemu_plugin_vcpu_init_hook(CPUState *cpu)
 213 {
 214     bool success;
 215
 216     qemu_rec_mutex_lock(&plugin.lock);
 217     plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
 218     success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
 219                                   &cpu->cpu_index);
 220     g_assert(success);
 221     qemu_rec_mutex_unlock(&plugin.lock);
 222
 223     plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
 224 }
 225
 226 void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
 227 {
 228     bool success;
 229
 230     plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);
 231
 232     qemu_rec_mutex_lock(&plugin.lock);
 233     success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
 234     g_assert(success);
 235     qemu_rec_mutex_unlock(&plugin.lock);
 236 }
 237
 238 struct plugin_for_each_args {
 239     struct qemu_plugin_ctx *ctx;
 240     qemu_plugin_vcpu_simple_cb_t cb;
 241 };
 242
 243 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
 244 {
 245     struct plugin_for_each_args *args = udata;
 246     int cpu_index = *(int *)k;
 247
 248     args->cb(args->ctx->id, cpu_index);
 249 }
 250
 251 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
 252                                qemu_plugin_vcpu_simple_cb_t cb)
 253 {
 254     struct plugin_for_each_args args;
 255
 256     if (cb == NULL) {
 257         return;
 258     }
 259     qemu_rec_mutex_lock(&plugin.lock);
 260     args.ctx = plugin_id_to_ctx_locked(id);
 261     args.cb = cb;
 262     g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
 263     qemu_rec_mutex_unlock(&plugin.lock);
 264 }
 265
 266 /* Allocate and return a callback record */
 267 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr)
 268 {
 269     GArray *cbs = *arr;
 270
 271     if (!cbs) {
 272         cbs = g_array_sized_new(false, false,
 273                                 sizeof(struct qemu_plugin_dyn_cb), 1);
 274         *arr = cbs;
 275     }
 276
 277     g_array_set_size(cbs, cbs->len + 1);
 278     return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
 279 }
 280
 281 void plugin_register_inline_op(GArray **arr,
 282                                enum qemu_plugin_mem_rw rw,
 283                                enum qemu_plugin_op op, void *ptr,
 284                                uint64_t imm)
 285 {
 286     struct qemu_plugin_dyn_cb *dyn_cb;
 287
 288     dyn_cb = plugin_get_dyn_cb(arr);
 289     dyn_cb->userp = ptr;
 290     dyn_cb->type = PLUGIN_CB_INLINE;
 291     dyn_cb->rw = rw;
 292     dyn_cb->inline_insn.op = op;
 293     dyn_cb->inline_insn.imm = imm;
 294 }
 295
 296 void plugin_register_dyn_cb__udata(GArray **arr,
 297                                    qemu_plugin_vcpu_udata_cb_t cb,
 298                                    enum qemu_plugin_cb_flags flags,
 299                                    void *udata)
 300 {
 301     struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
 302
 303     dyn_cb->userp = udata;
 304     /* Note flags are discarded as unused. */
 305     dyn_cb->f.vcpu_udata = cb;
 306     dyn_cb->type = PLUGIN_CB_REGULAR;
 307 }
 308
 309 void plugin_register_vcpu_mem_cb(GArray **arr,
 310                                  void *cb,
 311                                  enum qemu_plugin_cb_flags flags,
 312                                  enum qemu_plugin_mem_rw rw,
 313                                  void *udata)
 314 {
 315     struct qemu_plugin_dyn_cb *dyn_cb;
 316
 317     dyn_cb = plugin_get_dyn_cb(arr);
 318     dyn_cb->userp = udata;
 319     /* Note flags are discarded as unused. */
 320     dyn_cb->type = PLUGIN_CB_REGULAR;
 321     dyn_cb->rw = rw;
 322     dyn_cb->f.generic = cb;
 323 }
 324
 325 /*
 326  * Disable CFI checks.
 327  * The callback function has been loaded from an external library so we do not
 328  * have type information
 329  */
 330 QEMU_DISABLE_CFI
 331 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb)
 332 {
 333     struct qemu_plugin_cb *cb, *next;
 334     enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;
 335
 336     /* no plugin_mask check here; caller should have checked */
 337
 338     QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 339         qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;
 340
 341         func(cb->ctx->id, tb);
 342     }
 343 }
 344
 345 /*
 346  * Disable CFI checks.
 347  * The callback function has been loaded from an external library so we do not
 348  * have type information
 349  */
 350 QEMU_DISABLE_CFI
 351 void
 352 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
 353                          uint64_t a3, uint64_t a4, uint64_t a5,
 354                          uint64_t a6, uint64_t a7, uint64_t a8)
 355 {
 356     struct qemu_plugin_cb *cb, *next;
 357     enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;
 358
 359     if (!test_bit(ev, cpu->plugin_mask)) {
 360         return;
 361     }
 362
 363     QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 364         qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;
 365
 366         func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
 367     }
 368 }
 369
 370 /*
 371  * Disable CFI checks.
 372  * The callback function has been loaded from an external library so we do not
 373  * have type information
 374  */
 375 QEMU_DISABLE_CFI
 376 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
 377 {
 378     struct qemu_plugin_cb *cb, *next;
 379     enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;
 380
 381     if (!test_bit(ev, cpu->plugin_mask)) {
 382         return;
 383     }
 384
 385     QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 386         qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;
 387
 388         func(cb->ctx->id, cpu->cpu_index, num, ret);
 389     }
 390 }
 391
 392 void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
 393 {
 394     plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
 395 }
 396
 397 void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
 398 {
 399     plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
 400 }
 401
 402 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
 403                                        qemu_plugin_vcpu_simple_cb_t cb)
 404 {
 405     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
 406 }
 407
 408 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
 409                                          qemu_plugin_vcpu_simple_cb_t cb)
 410 {
 411     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
 412 }
 413
 414 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
 415                                    qemu_plugin_simple_cb_t cb)
 416 {
 417     plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
 418 }
 419
 420 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp)
 421 {
 422     g_array_free((GArray *) p, true);
 423     return true;
 424 }
 425
 426 void qemu_plugin_flush_cb(void)
 427 {
 428     qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
 429     qht_reset(&plugin.dyn_cb_arr_ht);
 430
 431     plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
 432 }
 433
 434 void exec_inline_op(struct qemu_plugin_dyn_cb *cb)
 435 {
 436     uint64_t *val = cb->userp;
 437
 438     switch (cb->inline_insn.op) {
 439     case QEMU_PLUGIN_INLINE_ADD_U64:
 440         *val += cb->inline_insn.imm;
 441         break;
 442     default:
 443         g_assert_not_reached();
 444     }
 445 }
 446
 447 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
 448                              MemOpIdx oi, enum qemu_plugin_mem_rw rw)
 449 {
 450     GArray *arr = cpu->plugin_mem_cbs;
 451     size_t i;
 452
 453     if (arr == NULL) {
 454         return;
 455     }
 456     for (i = 0; i < arr->len; i++) {
 457         struct qemu_plugin_dyn_cb *cb =
 458             &g_array_index(arr, struct qemu_plugin_dyn_cb, i);
 459
 460         if (!(rw & cb->rw)) {
 461                 break;
 462         }
 463         switch (cb->type) {
 464         case PLUGIN_CB_REGULAR:
 465             cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
 466                            vaddr, cb->userp);
 467             break;
 468         case PLUGIN_CB_INLINE:
 469             exec_inline_op(cb);
 470             break;
 471         default:
 472             g_assert_not_reached();
 473         }
 474     }
 475 }
 476
 477 void qemu_plugin_atexit_cb(void)
 478 {
 479     plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
 480 }
 481
 482 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
 483                                     qemu_plugin_udata_cb_t cb,
 484                                     void *udata)
 485 {
 486     plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
 487 }
 488
 489 /*
 490  * Handle exit from linux-user. Unlike the normal atexit() mechanism
 491  * we need to handle the clean-up manually as it's possible threads
 492  * are still running. We need to remove all callbacks from code
 493  * generation, flush the current translations and then we can safely
 494  * trigger the exit callbacks.
 495  */
 496
 497 void qemu_plugin_user_exit(void)
 498 {
 499     enum qemu_plugin_event ev;
 500     CPUState *cpu;
 501
 502     /*
 503      * Locking order: we must acquire locks in an order that is consistent
 504      * with the one in fork_start(). That is:
 505      * - start_exclusive(), which acquires qemu_cpu_list_lock,
 506      *   must be called before acquiring plugin.lock.
 507      * - tb_flush(), which acquires mmap_lock(), must be called
 508      *   while plugin.lock is not held.
 509      */
 510     start_exclusive();
 511
 512     qemu_rec_mutex_lock(&plugin.lock);
 513     /* un-register all callbacks except the final AT_EXIT one */
 514     for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) {
 515         if (ev != QEMU_PLUGIN_EV_ATEXIT) {
 516             struct qemu_plugin_cb *cb, *next;
 517
 518             QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
 519                 plugin_unregister_cb__locked(cb->ctx, ev);
 520             }
 521         }
 522     }
 523     CPU_FOREACH(cpu) {
 524         qemu_plugin_disable_mem_helpers(cpu);
 525     }
 526     qemu_rec_mutex_unlock(&plugin.lock);
 527
 528     tb_flush(current_cpu);
 529     end_exclusive();
 530
 531     /* now it's safe to handle the exit case */
 532     qemu_plugin_atexit_cb();
 533 }
 534
 535 /*
 536  * Helpers for *-user to ensure locks are sane across fork() events.
 537  */
 538
 539 void qemu_plugin_user_prefork_lock(void)
 540 {
 541     qemu_rec_mutex_lock(&plugin.lock);
 542 }
 543
 544 void qemu_plugin_user_postfork(bool is_child)
 545 {
 546     if (is_child) {
 547         /* should we just reset via plugin_init? */
 548         qemu_rec_mutex_init(&plugin.lock);
 549     } else {
 550         qemu_rec_mutex_unlock(&plugin.lock);
 551     }
 552 }
 553
 554 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp)
 555 {
 556     return ap == bp;
 557 }
 558
 559 static void __attribute__((__constructor__)) plugin_init(void)
 560 {
 561     int i;
 562
 563     for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
 564         QLIST_INIT(&plugin.cb_lists[i]);
 565     }
 566     qemu_rec_mutex_init(&plugin.lock);
 567     plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
 568     plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
 569     QTAILQ_INIT(&plugin.ctxs);
 570     qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
 571              QHT_MODE_AUTO_RESIZE);
 572     atexit(qemu_plugin_atexit_cb);
 573 }