Merge tag 'pull-la-20220704' of https://gitlab.com/rth7680/qemu into staging
[qemu.git] / plugins / core.c
1 /*
2 * QEMU Plugin Core code
3 *
4 * This is the core code that deals with injecting instrumentation into the code
5 *
6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
7 * Copyright (C) 2019, Linaro
8 *
9 * License: GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 *
12 * SPDX-License-Identifier: GPL-2.0-or-later
13 */
14 #include "qemu/osdep.h"
15 #include "qemu/error-report.h"
16 #include "qemu/config-file.h"
17 #include "qapi/error.h"
18 #include "qemu/lockable.h"
19 #include "qemu/option.h"
20 #include "qemu/rcu_queue.h"
21 #include "qemu/xxhash.h"
22 #include "qemu/rcu.h"
23 #include "hw/core/cpu.h"
24 #include "exec/cpu-common.h"
25
26 #include "exec/exec-all.h"
27 #include "exec/helper-proto.h"
28 #include "tcg/tcg.h"
29 #include "tcg/tcg-op.h"
30 #include "plugin.h"
31 #include "qemu/compiler.h"
32
33 struct qemu_plugin_cb {
34 struct qemu_plugin_ctx *ctx;
35 union qemu_plugin_cb_sig f;
36 void *udata;
37 QLIST_ENTRY(qemu_plugin_cb) entry;
38 };
39
40 struct qemu_plugin_state plugin;
41
42 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
43 {
44 struct qemu_plugin_ctx *ctx;
45 qemu_plugin_id_t *id_p;
46
47 id_p = g_hash_table_lookup(plugin.id_ht, &id);
48 ctx = container_of(id_p, struct qemu_plugin_ctx, id);
49 if (ctx == NULL) {
50 error_report("plugin: invalid plugin id %" PRIu64, id);
51 abort();
52 }
53 return ctx;
54 }
55
56 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
57 {
58 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
59 cpu_tb_jmp_cache_clear(cpu);
60 }
61
62 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
63 {
64 CPUState *cpu = container_of(k, CPUState, cpu_index);
65 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);
66
67 if (cpu->created) {
68 async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
69 } else {
70 plugin_cpu_update__async(cpu, mask);
71 }
72 }
73
74 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
75 enum qemu_plugin_event ev)
76 {
77 struct qemu_plugin_cb *cb = ctx->callbacks[ev];
78
79 if (cb == NULL) {
80 return;
81 }
82 QLIST_REMOVE_RCU(cb, entry);
83 g_free(cb);
84 ctx->callbacks[ev] = NULL;
85 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
86 clear_bit(ev, plugin.mask);
87 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
88 }
89 }
90
91 /*
92 * Disable CFI checks.
93 * The callback function has been loaded from an external library so we do not
94 * have type information
95 */
96 QEMU_DISABLE_CFI
97 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
98 {
99 struct qemu_plugin_cb *cb, *next;
100
101 switch (ev) {
102 case QEMU_PLUGIN_EV_VCPU_INIT:
103 case QEMU_PLUGIN_EV_VCPU_EXIT:
104 case QEMU_PLUGIN_EV_VCPU_IDLE:
105 case QEMU_PLUGIN_EV_VCPU_RESUME:
106 /* iterate safely; plugins might uninstall themselves at any time */
107 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
108 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;
109
110 func(cb->ctx->id, cpu->cpu_index);
111 }
112 break;
113 default:
114 g_assert_not_reached();
115 }
116 }
117
118 /*
119 * Disable CFI checks.
120 * The callback function has been loaded from an external library so we do not
121 * have type information
122 */
123 QEMU_DISABLE_CFI
124 static void plugin_cb__simple(enum qemu_plugin_event ev)
125 {
126 struct qemu_plugin_cb *cb, *next;
127
128 switch (ev) {
129 case QEMU_PLUGIN_EV_FLUSH:
130 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
131 qemu_plugin_simple_cb_t func = cb->f.simple;
132
133 func(cb->ctx->id);
134 }
135 break;
136 default:
137 g_assert_not_reached();
138 }
139 }
140
141 /*
142 * Disable CFI checks.
143 * The callback function has been loaded from an external library so we do not
144 * have type information
145 */
146 QEMU_DISABLE_CFI
147 static void plugin_cb__udata(enum qemu_plugin_event ev)
148 {
149 struct qemu_plugin_cb *cb, *next;
150
151 switch (ev) {
152 case QEMU_PLUGIN_EV_ATEXIT:
153 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
154 qemu_plugin_udata_cb_t func = cb->f.udata;
155
156 func(cb->ctx->id, cb->udata);
157 }
158 break;
159 default:
160 g_assert_not_reached();
161 }
162 }
163
164 static void
165 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
166 void *func, void *udata)
167 {
168 struct qemu_plugin_ctx *ctx;
169
170 QEMU_LOCK_GUARD(&plugin.lock);
171 ctx = plugin_id_to_ctx_locked(id);
172 /* if the plugin is on its way out, ignore this request */
173 if (unlikely(ctx->uninstalling)) {
174 return;
175 }
176 if (func) {
177 struct qemu_plugin_cb *cb = ctx->callbacks[ev];
178
179 if (cb) {
180 cb->f.generic = func;
181 cb->udata = udata;
182 } else {
183 cb = g_new(struct qemu_plugin_cb, 1);
184 cb->ctx = ctx;
185 cb->f.generic = func;
186 cb->udata = udata;
187 ctx->callbacks[ev] = cb;
188 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
189 if (!test_bit(ev, plugin.mask)) {
190 set_bit(ev, plugin.mask);
191 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
192 NULL);
193 }
194 }
195 } else {
196 plugin_unregister_cb__locked(ctx, ev);
197 }
198 }
199
200 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
201 void *func)
202 {
203 do_plugin_register_cb(id, ev, func, NULL);
204 }
205
206 void
207 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
208 void *func, void *udata)
209 {
210 do_plugin_register_cb(id, ev, func, udata);
211 }
212
213 void qemu_plugin_vcpu_init_hook(CPUState *cpu)
214 {
215 bool success;
216
217 qemu_rec_mutex_lock(&plugin.lock);
218 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
219 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
220 &cpu->cpu_index);
221 g_assert(success);
222 qemu_rec_mutex_unlock(&plugin.lock);
223
224 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
225 }
226
227 void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
228 {
229 bool success;
230
231 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);
232
233 qemu_rec_mutex_lock(&plugin.lock);
234 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
235 g_assert(success);
236 qemu_rec_mutex_unlock(&plugin.lock);
237 }
238
239 struct plugin_for_each_args {
240 struct qemu_plugin_ctx *ctx;
241 qemu_plugin_vcpu_simple_cb_t cb;
242 };
243
244 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
245 {
246 struct plugin_for_each_args *args = udata;
247 int cpu_index = *(int *)k;
248
249 args->cb(args->ctx->id, cpu_index);
250 }
251
252 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
253 qemu_plugin_vcpu_simple_cb_t cb)
254 {
255 struct plugin_for_each_args args;
256
257 if (cb == NULL) {
258 return;
259 }
260 qemu_rec_mutex_lock(&plugin.lock);
261 args.ctx = plugin_id_to_ctx_locked(id);
262 args.cb = cb;
263 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
264 qemu_rec_mutex_unlock(&plugin.lock);
265 }
266
267 /* Allocate and return a callback record */
268 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr)
269 {
270 GArray *cbs = *arr;
271
272 if (!cbs) {
273 cbs = g_array_sized_new(false, false,
274 sizeof(struct qemu_plugin_dyn_cb), 1);
275 *arr = cbs;
276 }
277
278 g_array_set_size(cbs, cbs->len + 1);
279 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
280 }
281
282 void plugin_register_inline_op(GArray **arr,
283 enum qemu_plugin_mem_rw rw,
284 enum qemu_plugin_op op, void *ptr,
285 uint64_t imm)
286 {
287 struct qemu_plugin_dyn_cb *dyn_cb;
288
289 dyn_cb = plugin_get_dyn_cb(arr);
290 dyn_cb->userp = ptr;
291 dyn_cb->type = PLUGIN_CB_INLINE;
292 dyn_cb->rw = rw;
293 dyn_cb->inline_insn.op = op;
294 dyn_cb->inline_insn.imm = imm;
295 }
296
297 void plugin_register_dyn_cb__udata(GArray **arr,
298 qemu_plugin_vcpu_udata_cb_t cb,
299 enum qemu_plugin_cb_flags flags,
300 void *udata)
301 {
302 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
303
304 dyn_cb->userp = udata;
305 /* Note flags are discarded as unused. */
306 dyn_cb->f.vcpu_udata = cb;
307 dyn_cb->type = PLUGIN_CB_REGULAR;
308 }
309
310 void plugin_register_vcpu_mem_cb(GArray **arr,
311 void *cb,
312 enum qemu_plugin_cb_flags flags,
313 enum qemu_plugin_mem_rw rw,
314 void *udata)
315 {
316 struct qemu_plugin_dyn_cb *dyn_cb;
317
318 dyn_cb = plugin_get_dyn_cb(arr);
319 dyn_cb->userp = udata;
320 /* Note flags are discarded as unused. */
321 dyn_cb->type = PLUGIN_CB_REGULAR;
322 dyn_cb->rw = rw;
323 dyn_cb->f.generic = cb;
324 }
325
326 /*
327 * Disable CFI checks.
328 * The callback function has been loaded from an external library so we do not
329 * have type information
330 */
331 QEMU_DISABLE_CFI
332 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb)
333 {
334 struct qemu_plugin_cb *cb, *next;
335 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;
336
337 /* no plugin_mask check here; caller should have checked */
338
339 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
340 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;
341
342 func(cb->ctx->id, tb);
343 }
344 }
345
346 /*
347 * Disable CFI checks.
348 * The callback function has been loaded from an external library so we do not
349 * have type information
350 */
351 QEMU_DISABLE_CFI
352 void
353 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
354 uint64_t a3, uint64_t a4, uint64_t a5,
355 uint64_t a6, uint64_t a7, uint64_t a8)
356 {
357 struct qemu_plugin_cb *cb, *next;
358 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;
359
360 if (!test_bit(ev, cpu->plugin_mask)) {
361 return;
362 }
363
364 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
365 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;
366
367 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
368 }
369 }
370
371 /*
372 * Disable CFI checks.
373 * The callback function has been loaded from an external library so we do not
374 * have type information
375 */
376 QEMU_DISABLE_CFI
377 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
378 {
379 struct qemu_plugin_cb *cb, *next;
380 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;
381
382 if (!test_bit(ev, cpu->plugin_mask)) {
383 return;
384 }
385
386 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
387 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;
388
389 func(cb->ctx->id, cpu->cpu_index, num, ret);
390 }
391 }
392
393 void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
394 {
395 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
396 }
397
398 void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
399 {
400 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
401 }
402
403 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
404 qemu_plugin_vcpu_simple_cb_t cb)
405 {
406 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
407 }
408
409 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
410 qemu_plugin_vcpu_simple_cb_t cb)
411 {
412 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
413 }
414
415 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
416 qemu_plugin_simple_cb_t cb)
417 {
418 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
419 }
420
421 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp)
422 {
423 g_array_free((GArray *) p, true);
424 return true;
425 }
426
427 void qemu_plugin_flush_cb(void)
428 {
429 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
430 qht_reset(&plugin.dyn_cb_arr_ht);
431
432 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
433 }
434
435 void exec_inline_op(struct qemu_plugin_dyn_cb *cb)
436 {
437 uint64_t *val = cb->userp;
438
439 switch (cb->inline_insn.op) {
440 case QEMU_PLUGIN_INLINE_ADD_U64:
441 *val += cb->inline_insn.imm;
442 break;
443 default:
444 g_assert_not_reached();
445 }
446 }
447
448 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
449 MemOpIdx oi, enum qemu_plugin_mem_rw rw)
450 {
451 GArray *arr = cpu->plugin_mem_cbs;
452 size_t i;
453
454 if (arr == NULL) {
455 return;
456 }
457 for (i = 0; i < arr->len; i++) {
458 struct qemu_plugin_dyn_cb *cb =
459 &g_array_index(arr, struct qemu_plugin_dyn_cb, i);
460
461 if (!(rw & cb->rw)) {
462 break;
463 }
464 switch (cb->type) {
465 case PLUGIN_CB_REGULAR:
466 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
467 vaddr, cb->userp);
468 break;
469 case PLUGIN_CB_INLINE:
470 exec_inline_op(cb);
471 break;
472 default:
473 g_assert_not_reached();
474 }
475 }
476 }
477
478 void qemu_plugin_atexit_cb(void)
479 {
480 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
481 }
482
483 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
484 qemu_plugin_udata_cb_t cb,
485 void *udata)
486 {
487 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
488 }
489
490 /*
491 * Handle exit from linux-user. Unlike the normal atexit() mechanism
492 * we need to handle the clean-up manually as it's possible threads
493 * are still running. We need to remove all callbacks from code
494 * generation, flush the current translations and then we can safely
495 * trigger the exit callbacks.
496 */
497
498 void qemu_plugin_user_exit(void)
499 {
500 enum qemu_plugin_event ev;
501 CPUState *cpu;
502
503 QEMU_LOCK_GUARD(&plugin.lock);
504
505 start_exclusive();
506
507 /* un-register all callbacks except the final AT_EXIT one */
508 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) {
509 if (ev != QEMU_PLUGIN_EV_ATEXIT) {
510 struct qemu_plugin_ctx *ctx;
511 QTAILQ_FOREACH(ctx, &plugin.ctxs, entry) {
512 plugin_unregister_cb__locked(ctx, ev);
513 }
514 }
515 }
516
517 tb_flush(current_cpu);
518
519 CPU_FOREACH(cpu) {
520 qemu_plugin_disable_mem_helpers(cpu);
521 }
522
523 end_exclusive();
524
525 /* now it's safe to handle the exit case */
526 qemu_plugin_atexit_cb();
527 }
528
529 /*
530 * Call this function after longjmp'ing to the main loop. It's possible that the
531 * last instruction of a TB might have used helpers, and therefore the
532 * "disable" instruction will never execute because it ended up as dead code.
533 */
534 void qemu_plugin_disable_mem_helpers(CPUState *cpu)
535 {
536 cpu->plugin_mem_cbs = NULL;
537 }
538
539 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp)
540 {
541 return ap == bp;
542 }
543
544 static void __attribute__((__constructor__)) plugin_init(void)
545 {
546 int i;
547
548 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
549 QLIST_INIT(&plugin.cb_lists[i]);
550 }
551 qemu_rec_mutex_init(&plugin.lock);
552 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
553 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
554 QTAILQ_INIT(&plugin.ctxs);
555 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
556 QHT_MODE_AUTO_RESIZE);
557 atexit(qemu_plugin_atexit_cb);
558 }