2 * QEMU Plugin Core code
4 * This is the core code that deals with injecting instrumentation into the code
6 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
7 * Copyright (C) 2019, Linaro
9 * License: GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
12 * SPDX-License-Identifier: GPL-2.0-or-later
14 #include "qemu/osdep.h"
15 #include "qemu/error-report.h"
16 #include "qemu/config-file.h"
17 #include "qapi/error.h"
18 #include "qemu/lockable.h"
19 #include "qemu/option.h"
20 #include "qemu/rcu_queue.h"
21 #include "qemu/xxhash.h"
23 #include "hw/core/cpu.h"
25 #include "exec/exec-all.h"
26 #include "exec/tb-flush.h"
28 #include "tcg/tcg-op.h"
30 #include "qemu/compiler.h"
32 struct qemu_plugin_cb {
33 struct qemu_plugin_ctx *ctx;
34 union qemu_plugin_cb_sig f;
36 QLIST_ENTRY(qemu_plugin_cb) entry;
39 struct qemu_plugin_state plugin;
41 struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
43 struct qemu_plugin_ctx *ctx;
44 qemu_plugin_id_t *id_p;
46 id_p = g_hash_table_lookup(plugin.id_ht, &id);
47 ctx = container_of(id_p, struct qemu_plugin_ctx, id);
49 error_report("plugin: invalid plugin id %" PRIu64, id);
55 static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
57 bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
58 tcg_flush_jmp_cache(cpu);
61 static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
63 CPUState *cpu = container_of(k, CPUState, cpu_index);
64 run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);
66 if (DEVICE(cpu)->realized) {
67 async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
69 plugin_cpu_update__async(cpu, mask);
73 void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
74 enum qemu_plugin_event ev)
76 struct qemu_plugin_cb *cb = ctx->callbacks[ev];
81 QLIST_REMOVE_RCU(cb, entry);
83 ctx->callbacks[ev] = NULL;
84 if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
85 clear_bit(ev, plugin.mask);
86 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
92 * The callback function has been loaded from an external library so we do not
93 * have type information
96 static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
98 struct qemu_plugin_cb *cb, *next;
101 case QEMU_PLUGIN_EV_VCPU_INIT:
102 case QEMU_PLUGIN_EV_VCPU_EXIT:
103 case QEMU_PLUGIN_EV_VCPU_IDLE:
104 case QEMU_PLUGIN_EV_VCPU_RESUME:
105 /* iterate safely; plugins might uninstall themselves at any time */
106 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
107 qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;
109 func(cb->ctx->id, cpu->cpu_index);
113 g_assert_not_reached();
118 * Disable CFI checks.
119 * The callback function has been loaded from an external library so we do not
120 * have type information
123 static void plugin_cb__simple(enum qemu_plugin_event ev)
125 struct qemu_plugin_cb *cb, *next;
128 case QEMU_PLUGIN_EV_FLUSH:
129 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
130 qemu_plugin_simple_cb_t func = cb->f.simple;
136 g_assert_not_reached();
141 * Disable CFI checks.
142 * The callback function has been loaded from an external library so we do not
143 * have type information
146 static void plugin_cb__udata(enum qemu_plugin_event ev)
148 struct qemu_plugin_cb *cb, *next;
151 case QEMU_PLUGIN_EV_ATEXIT:
152 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
153 qemu_plugin_udata_cb_t func = cb->f.udata;
155 func(cb->ctx->id, cb->udata);
159 g_assert_not_reached();
164 do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
165 void *func, void *udata)
167 struct qemu_plugin_ctx *ctx;
169 QEMU_LOCK_GUARD(&plugin.lock);
170 ctx = plugin_id_to_ctx_locked(id);
171 /* if the plugin is on its way out, ignore this request */
172 if (unlikely(ctx->uninstalling)) {
176 struct qemu_plugin_cb *cb = ctx->callbacks[ev];
179 cb->f.generic = func;
182 cb = g_new(struct qemu_plugin_cb, 1);
184 cb->f.generic = func;
186 ctx->callbacks[ev] = cb;
187 QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
188 if (!test_bit(ev, plugin.mask)) {
189 set_bit(ev, plugin.mask);
190 g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
195 plugin_unregister_cb__locked(ctx, ev);
199 void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
202 do_plugin_register_cb(id, ev, func, NULL);
206 plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
207 void *func, void *udata)
209 do_plugin_register_cb(id, ev, func, udata);
212 void qemu_plugin_vcpu_init_hook(CPUState *cpu)
216 qemu_rec_mutex_lock(&plugin.lock);
217 plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
218 success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
221 qemu_rec_mutex_unlock(&plugin.lock);
223 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
226 void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
230 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);
232 qemu_rec_mutex_lock(&plugin.lock);
233 success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
235 qemu_rec_mutex_unlock(&plugin.lock);
238 struct plugin_for_each_args {
239 struct qemu_plugin_ctx *ctx;
240 qemu_plugin_vcpu_simple_cb_t cb;
243 static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
245 struct plugin_for_each_args *args = udata;
246 int cpu_index = *(int *)k;
248 args->cb(args->ctx->id, cpu_index);
251 void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
252 qemu_plugin_vcpu_simple_cb_t cb)
254 struct plugin_for_each_args args;
259 qemu_rec_mutex_lock(&plugin.lock);
260 args.ctx = plugin_id_to_ctx_locked(id);
262 g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
263 qemu_rec_mutex_unlock(&plugin.lock);
266 /* Allocate and return a callback record */
267 static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr)
272 cbs = g_array_sized_new(false, false,
273 sizeof(struct qemu_plugin_dyn_cb), 1);
277 g_array_set_size(cbs, cbs->len + 1);
278 return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
281 void plugin_register_inline_op(GArray **arr,
282 enum qemu_plugin_mem_rw rw,
283 enum qemu_plugin_op op, void *ptr,
286 struct qemu_plugin_dyn_cb *dyn_cb;
288 dyn_cb = plugin_get_dyn_cb(arr);
290 dyn_cb->type = PLUGIN_CB_INLINE;
292 dyn_cb->inline_insn.op = op;
293 dyn_cb->inline_insn.imm = imm;
296 void plugin_register_dyn_cb__udata(GArray **arr,
297 qemu_plugin_vcpu_udata_cb_t cb,
298 enum qemu_plugin_cb_flags flags,
301 struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
303 dyn_cb->userp = udata;
304 /* Note flags are discarded as unused. */
305 dyn_cb->f.vcpu_udata = cb;
306 dyn_cb->type = PLUGIN_CB_REGULAR;
309 void plugin_register_vcpu_mem_cb(GArray **arr,
311 enum qemu_plugin_cb_flags flags,
312 enum qemu_plugin_mem_rw rw,
315 struct qemu_plugin_dyn_cb *dyn_cb;
317 dyn_cb = plugin_get_dyn_cb(arr);
318 dyn_cb->userp = udata;
319 /* Note flags are discarded as unused. */
320 dyn_cb->type = PLUGIN_CB_REGULAR;
322 dyn_cb->f.generic = cb;
326 * Disable CFI checks.
327 * The callback function has been loaded from an external library so we do not
328 * have type information
331 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb)
333 struct qemu_plugin_cb *cb, *next;
334 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;
336 /* no plugin_mask check here; caller should have checked */
338 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
339 qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;
341 func(cb->ctx->id, tb);
346 * Disable CFI checks.
347 * The callback function has been loaded from an external library so we do not
348 * have type information
352 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
353 uint64_t a3, uint64_t a4, uint64_t a5,
354 uint64_t a6, uint64_t a7, uint64_t a8)
356 struct qemu_plugin_cb *cb, *next;
357 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;
359 if (!test_bit(ev, cpu->plugin_mask)) {
363 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
364 qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;
366 func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
371 * Disable CFI checks.
372 * The callback function has been loaded from an external library so we do not
373 * have type information
376 void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
378 struct qemu_plugin_cb *cb, *next;
379 enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;
381 if (!test_bit(ev, cpu->plugin_mask)) {
385 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
386 qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;
388 func(cb->ctx->id, cpu->cpu_index, num, ret);
392 void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
394 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
397 void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
399 plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
402 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
403 qemu_plugin_vcpu_simple_cb_t cb)
405 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
408 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
409 qemu_plugin_vcpu_simple_cb_t cb)
411 plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
414 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
415 qemu_plugin_simple_cb_t cb)
417 plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
420 static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp)
422 g_array_free((GArray *) p, true);
426 void qemu_plugin_flush_cb(void)
428 qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
429 qht_reset(&plugin.dyn_cb_arr_ht);
431 plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
434 void exec_inline_op(struct qemu_plugin_dyn_cb *cb)
436 uint64_t *val = cb->userp;
438 switch (cb->inline_insn.op) {
439 case QEMU_PLUGIN_INLINE_ADD_U64:
440 *val += cb->inline_insn.imm;
443 g_assert_not_reached();
447 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
448 MemOpIdx oi, enum qemu_plugin_mem_rw rw)
450 GArray *arr = cpu->plugin_mem_cbs;
456 for (i = 0; i < arr->len; i++) {
457 struct qemu_plugin_dyn_cb *cb =
458 &g_array_index(arr, struct qemu_plugin_dyn_cb, i);
460 if (!(rw & cb->rw)) {
464 case PLUGIN_CB_REGULAR:
465 cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
468 case PLUGIN_CB_INLINE:
472 g_assert_not_reached();
477 void qemu_plugin_atexit_cb(void)
479 plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
482 void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
483 qemu_plugin_udata_cb_t cb,
486 plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
490 * Handle exit from linux-user. Unlike the normal atexit() mechanism
491 * we need to handle the clean-up manually as it's possible threads
492 * are still running. We need to remove all callbacks from code
493 * generation, flush the current translations and then we can safely
494 * trigger the exit callbacks.
497 void qemu_plugin_user_exit(void)
499 enum qemu_plugin_event ev;
503 * Locking order: we must acquire locks in an order that is consistent
504 * with the one in fork_start(). That is:
505 * - start_exclusive(), which acquires qemu_cpu_list_lock,
506 * must be called before acquiring plugin.lock.
507 * - tb_flush(), which acquires mmap_lock(), must be called
508 * while plugin.lock is not held.
512 qemu_rec_mutex_lock(&plugin.lock);
513 /* un-register all callbacks except the final AT_EXIT one */
514 for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) {
515 if (ev != QEMU_PLUGIN_EV_ATEXIT) {
516 struct qemu_plugin_cb *cb, *next;
518 QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
519 plugin_unregister_cb__locked(cb->ctx, ev);
524 qemu_plugin_disable_mem_helpers(cpu);
526 qemu_rec_mutex_unlock(&plugin.lock);
528 tb_flush(current_cpu);
531 /* now it's safe to handle the exit case */
532 qemu_plugin_atexit_cb();
536 * Helpers for *-user to ensure locks are sane across fork() events.
539 void qemu_plugin_user_prefork_lock(void)
541 qemu_rec_mutex_lock(&plugin.lock);
544 void qemu_plugin_user_postfork(bool is_child)
547 /* should we just reset via plugin_init? */
548 qemu_rec_mutex_init(&plugin.lock);
550 qemu_rec_mutex_unlock(&plugin.lock);
554 static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp)
559 static void __attribute__((__constructor__)) plugin_init(void)
563 for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
564 QLIST_INIT(&plugin.cb_lists[i]);
566 qemu_rec_mutex_init(&plugin.lock);
567 plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
568 plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
569 QTAILQ_INIT(&plugin.ctxs);
570 qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
571 QHT_MODE_AUTO_RESIZE);
572 atexit(qemu_plugin_atexit_cb);