| 1 | /* |
| 2 | * QEMU Plugin Core code |
| 3 | * |
| 4 | * This is the core code that deals with injecting instrumentation into the code |
| 5 | * |
| 6 | * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> |
| 7 | * Copyright (C) 2019, Linaro |
| 8 | * |
| 9 | * License: GNU GPL, version 2 or later. |
| 10 | * See the COPYING file in the top-level directory. |
| 11 | * |
| 12 | * SPDX-License-Identifier: GPL-2.0-or-later |
| 13 | */ |
| 14 | #include "qemu/osdep.h" |
| 15 | #include "qemu/lockable.h" |
| 16 | #include "qemu/option.h" |
| 17 | #include "qemu/plugin.h" |
| 18 | #include "plugins/qemu-plugin.h" |
| 19 | #include "qemu/queue.h" |
| 20 | #include "qemu/rcu_queue.h" |
| 21 | #include "qemu/rcu.h" |
| 22 | #include "exec/tb-flush.h" |
| 23 | #include "tcg/tcg-op-common.h" |
| 24 | #include "plugin.h" |
| 25 | |
| 26 | struct qemu_plugin_cb { |
| 27 | struct qemu_plugin_ctx *ctx; |
| 28 | union qemu_plugin_cb_sig f; |
| 29 | void *udata; |
| 30 | QLIST_ENTRY(qemu_plugin_cb) entry; |
| 31 | }; |
| 32 | |
| 33 | struct qemu_plugin_state plugin; |
| 34 | |
| 35 | struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) |
| 36 | { |
| 37 | struct qemu_plugin_ctx *ctx; |
| 38 | qemu_plugin_id_t *id_p; |
| 39 | |
| 40 | id_p = g_hash_table_lookup(plugin.id_ht, &id); |
| 41 | ctx = container_of(id_p, struct qemu_plugin_ctx, id); |
| 42 | if (ctx == NULL) { |
| 43 | error_report("plugin: invalid plugin id %" PRIu64, id); |
| 44 | abort(); |
| 45 | } |
| 46 | return ctx; |
| 47 | } |
| 48 | |
| 49 | static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) |
| 50 | { |
| 51 | bitmap_copy(cpu->plugin_state->event_mask, |
| 52 | &data.host_ulong, QEMU_PLUGIN_EV_MAX); |
| 53 | tcg_flush_jmp_cache(cpu); |
| 54 | } |
| 55 | |
| 56 | static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) |
| 57 | { |
| 58 | CPUState *cpu = container_of(k, CPUState, cpu_index); |
| 59 | run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); |
| 60 | |
| 61 | async_run_on_cpu(cpu, plugin_cpu_update__async, mask); |
| 62 | } |
| 63 | |
| 64 | void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, |
| 65 | enum qemu_plugin_event ev) |
| 66 | { |
| 67 | struct qemu_plugin_cb *cb = ctx->callbacks[ev]; |
| 68 | |
| 69 | if (cb == NULL) { |
| 70 | return; |
| 71 | } |
| 72 | QLIST_REMOVE_RCU(cb, entry); |
| 73 | g_free(cb); |
| 74 | ctx->callbacks[ev] = NULL; |
| 75 | if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { |
| 76 | clear_bit(ev, plugin.mask); |
| 77 | g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); |
| 78 | } |
| 79 | } |
| 80 | |
| 81 | /* |
| 82 | * Disable CFI checks. |
| 83 | * The callback function has been loaded from an external library so we do not |
| 84 | * have type information |
| 85 | */ |
| 86 | QEMU_DISABLE_CFI |
| 87 | static void plugin_vcpu_cb__udata(CPUState *cpu, enum qemu_plugin_event ev) |
| 88 | { |
| 89 | struct qemu_plugin_cb *cb, *next; |
| 90 | |
| 91 | switch (ev) { |
| 92 | case QEMU_PLUGIN_EV_VCPU_INIT: |
| 93 | case QEMU_PLUGIN_EV_VCPU_IDLE: |
| 94 | case QEMU_PLUGIN_EV_VCPU_RESUME: |
| 95 | case QEMU_PLUGIN_EV_VCPU_EXIT: |
| 96 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 97 | qemu_plugin_vcpu_udata_cb_t func = cb->f.vcpu_udata; |
| 98 | func(cpu->cpu_index, cb->udata); |
| 99 | } |
| 100 | break; |
| 101 | default: |
| 102 | g_assert_not_reached(); |
| 103 | } |
| 104 | } |
| 105 | |
| 106 | /* |
| 107 | * Disable CFI checks. |
| 108 | * The callback function has been loaded from an external library so we do not |
| 109 | * have type information |
| 110 | */ |
| 111 | QEMU_DISABLE_CFI |
| 112 | static void plugin_vcpu_cb__discon(CPUState *cpu, |
| 113 | enum qemu_plugin_event ev, |
| 114 | enum qemu_plugin_discon_type type, |
| 115 | uint64_t from) |
| 116 | { |
| 117 | struct qemu_plugin_cb *cb, *next; |
| 118 | uint64_t to = cpu->cc->get_pc(cpu); |
| 119 | |
| 120 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS_PC); |
| 121 | if (cpu->cpu_index < plugin.num_vcpus) { |
| 122 | /* iterate safely; plugins might uninstall themselves at any time */ |
| 123 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 124 | qemu_plugin_vcpu_discon_cb_t func = cb->f.vcpu_discon; |
| 125 | func(cpu->cpu_index, type, from, to, cb->udata); |
| 126 | } |
| 127 | } |
| 128 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 129 | } |
| 130 | |
| 131 | /* |
| 132 | * Disable CFI checks. |
| 133 | * The callback function has been loaded from an external library so we do not |
| 134 | * have type information |
| 135 | */ |
| 136 | QEMU_DISABLE_CFI |
| 137 | static void plugin_cb__udata(enum qemu_plugin_event ev) |
| 138 | { |
| 139 | struct qemu_plugin_cb *cb, *next; |
| 140 | |
| 141 | switch (ev) { |
| 142 | case QEMU_PLUGIN_EV_ATEXIT: |
| 143 | case QEMU_PLUGIN_EV_FLUSH: |
| 144 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 145 | qemu_plugin_udata_cb_t func = cb->f.udata; |
| 146 | |
| 147 | func(cb->udata); |
| 148 | } |
| 149 | break; |
| 150 | default: |
| 151 | g_assert_not_reached(); |
| 152 | } |
| 153 | } |
| 154 | |
| 155 | static void |
| 156 | do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, |
| 157 | void *func, void *udata) |
| 158 | { |
| 159 | struct qemu_plugin_ctx *ctx; |
| 160 | |
| 161 | QEMU_LOCK_GUARD(&plugin.lock); |
| 162 | ctx = plugin_id_to_ctx_locked(id); |
| 163 | /* if the plugin is on its way out, ignore this request */ |
| 164 | if (unlikely(ctx->uninstalling)) { |
| 165 | return; |
| 166 | } |
| 167 | if (func) { |
| 168 | struct qemu_plugin_cb *cb = ctx->callbacks[ev]; |
| 169 | |
| 170 | if (cb) { |
| 171 | cb->f.generic = func; |
| 172 | cb->udata = udata; |
| 173 | } else { |
| 174 | cb = g_new(struct qemu_plugin_cb, 1); |
| 175 | cb->ctx = ctx; |
| 176 | cb->f.generic = func; |
| 177 | cb->udata = udata; |
| 178 | ctx->callbacks[ev] = cb; |
| 179 | QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); |
| 180 | if (!test_bit(ev, plugin.mask)) { |
| 181 | set_bit(ev, plugin.mask); |
| 182 | g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, |
| 183 | NULL); |
| 184 | } |
| 185 | } |
| 186 | } else { |
| 187 | plugin_unregister_cb__locked(ctx, ev); |
| 188 | } |
| 189 | } |
| 190 | |
| 191 | void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, |
| 192 | void *func) |
| 193 | { |
| 194 | do_plugin_register_cb(id, ev, func, NULL); |
| 195 | } |
| 196 | |
| 197 | void |
| 198 | plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, |
| 199 | void *func, void *udata) |
| 200 | { |
| 201 | do_plugin_register_cb(id, ev, func, udata); |
| 202 | } |
| 203 | |
| 204 | CPUPluginState *qemu_plugin_create_vcpu_state(void) |
| 205 | { |
| 206 | return g_new0(CPUPluginState, 1); |
| 207 | } |
| 208 | |
| 209 | static void plugin_grow_scoreboards__locked(CPUState *cpu) |
| 210 | { |
| 211 | size_t scoreboard_size = plugin.scoreboard_alloc_size; |
| 212 | bool need_realloc = false; |
| 213 | |
| 214 | if (cpu->cpu_index < scoreboard_size) { |
| 215 | return; |
| 216 | } |
| 217 | |
| 218 | while (cpu->cpu_index >= scoreboard_size) { |
| 219 | scoreboard_size *= 2; |
| 220 | need_realloc = true; |
| 221 | } |
| 222 | |
| 223 | if (!need_realloc) { |
| 224 | return; |
| 225 | } |
| 226 | |
| 227 | if (QLIST_EMPTY(&plugin.scoreboards)) { |
| 228 | /* just update size for future scoreboards */ |
| 229 | plugin.scoreboard_alloc_size = scoreboard_size; |
| 230 | return; |
| 231 | } |
| 232 | |
| 233 | /* |
| 234 | * A scoreboard creation/deletion might be in progress. If a new vcpu is |
| 235 | * initialized at the same time, we are safe, as the new |
| 236 | * plugin.scoreboard_alloc_size was not yet written. |
| 237 | */ |
| 238 | qemu_rec_mutex_unlock(&plugin.lock); |
| 239 | |
| 240 | /* cpus must be stopped, as tb might still use an existing scoreboard. */ |
| 241 | start_exclusive(); |
| 242 | /* re-acquire lock */ |
| 243 | qemu_rec_mutex_lock(&plugin.lock); |
| 244 | /* in case another vcpu is created between unlock and exclusive section. */ |
| 245 | if (scoreboard_size > plugin.scoreboard_alloc_size) { |
| 246 | struct qemu_plugin_scoreboard *score; |
| 247 | QLIST_FOREACH(score, &plugin.scoreboards, entry) { |
| 248 | g_array_set_size(score->data, scoreboard_size); |
| 249 | } |
| 250 | plugin.scoreboard_alloc_size = scoreboard_size; |
| 251 | /* force all tb to be flushed, as scoreboard pointers were changed. */ |
| 252 | tb_flush__exclusive_or_serial(); |
| 253 | } |
| 254 | end_exclusive(); |
| 255 | } |
| 256 | |
| 257 | static void qemu_plugin_vcpu_init__async(CPUState *cpu, run_on_cpu_data unused) |
| 258 | { |
| 259 | bool success; |
| 260 | |
| 261 | assert(cpu->cpu_index != UNASSIGNED_CPU_INDEX); |
| 262 | qemu_rec_mutex_lock(&plugin.lock); |
| 263 | plugin.num_vcpus = MAX(plugin.num_vcpus, cpu->cpu_index + 1); |
| 264 | plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); |
| 265 | success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, |
| 266 | &cpu->cpu_index); |
| 267 | g_assert(success); |
| 268 | plugin_grow_scoreboards__locked(cpu); |
| 269 | qemu_rec_mutex_unlock(&plugin.lock); |
| 270 | |
| 271 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS); |
| 272 | plugin_vcpu_cb__udata(cpu, QEMU_PLUGIN_EV_VCPU_INIT); |
| 273 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 274 | } |
| 275 | |
| 276 | void qemu_plugin_vcpu_init_hook(CPUState *cpu) |
| 277 | { |
| 278 | /* Plugin initialization must wait until the cpu start executing code */ |
| 279 | async_run_on_cpu(cpu, qemu_plugin_vcpu_init__async, RUN_ON_CPU_NULL); |
| 280 | } |
| 281 | |
| 282 | void qemu_plugin_vcpu_exit_hook(CPUState *cpu) |
| 283 | { |
| 284 | bool success; |
| 285 | |
| 286 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS); |
| 287 | plugin_vcpu_cb__udata(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); |
| 288 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 289 | |
| 290 | assert(cpu->cpu_index != UNASSIGNED_CPU_INDEX); |
| 291 | qemu_rec_mutex_lock(&plugin.lock); |
| 292 | success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); |
| 293 | g_assert(success); |
| 294 | qemu_rec_mutex_unlock(&plugin.lock); |
| 295 | } |
| 296 | |
| 297 | struct plugin_for_each_args { |
| 298 | struct qemu_plugin_ctx *ctx; |
| 299 | qemu_plugin_vcpu_udata_cb_t cb; |
| 300 | void *userdata; |
| 301 | }; |
| 302 | |
| 303 | static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) |
| 304 | { |
| 305 | struct plugin_for_each_args *args = udata; |
| 306 | int cpu_index = *(int *)k; |
| 307 | args->cb(cpu_index, args->userdata); |
| 308 | } |
| 309 | |
| 310 | void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, |
| 311 | qemu_plugin_vcpu_udata_cb_t cb, |
| 312 | void *userdata) |
| 313 | { |
| 314 | struct plugin_for_each_args args; |
| 315 | |
| 316 | if (cb == NULL) { |
| 317 | return; |
| 318 | } |
| 319 | qemu_rec_mutex_lock(&plugin.lock); |
| 320 | args.ctx = plugin_id_to_ctx_locked(id); |
| 321 | args.cb = cb; |
| 322 | args.userdata = userdata; |
| 323 | g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); |
| 324 | qemu_rec_mutex_unlock(&plugin.lock); |
| 325 | } |
| 326 | |
| 327 | /* Allocate and return a callback record */ |
| 328 | static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) |
| 329 | { |
| 330 | GArray *cbs = *arr; |
| 331 | |
| 332 | if (!cbs) { |
| 333 | cbs = g_array_sized_new(false, true, |
| 334 | sizeof(struct qemu_plugin_dyn_cb), 1); |
| 335 | *arr = cbs; |
| 336 | } |
| 337 | |
| 338 | g_array_set_size(cbs, cbs->len + 1); |
| 339 | return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); |
| 340 | } |
| 341 | |
| 342 | static enum plugin_dyn_cb_type op_to_cb_type(enum qemu_plugin_op op) |
| 343 | { |
| 344 | switch (op) { |
| 345 | case QEMU_PLUGIN_INLINE_ADD_U64: |
| 346 | return PLUGIN_CB_INLINE_ADD_U64; |
| 347 | case QEMU_PLUGIN_INLINE_STORE_U64: |
| 348 | return PLUGIN_CB_INLINE_STORE_U64; |
| 349 | default: |
| 350 | g_assert_not_reached(); |
| 351 | } |
| 352 | } |
| 353 | |
| 354 | void plugin_register_inline_op_on_entry(GArray **arr, |
| 355 | enum qemu_plugin_mem_rw rw, |
| 356 | enum qemu_plugin_op op, |
| 357 | qemu_plugin_u64 entry, |
| 358 | uint64_t imm) |
| 359 | { |
| 360 | struct qemu_plugin_dyn_cb *dyn_cb; |
| 361 | |
| 362 | struct qemu_plugin_inline_cb inline_cb = { .rw = rw, |
| 363 | .entry = entry, |
| 364 | .imm = imm }; |
| 365 | dyn_cb = plugin_get_dyn_cb(arr); |
| 366 | dyn_cb->type = op_to_cb_type(op); |
| 367 | dyn_cb->inline_insn = inline_cb; |
| 368 | } |
| 369 | |
| 370 | void plugin_register_dyn_cb__udata(GArray **arr, |
| 371 | qemu_plugin_vcpu_udata_cb_t cb, |
| 372 | enum qemu_plugin_cb_flags flags, |
| 373 | void *udata) |
| 374 | { |
| 375 | static TCGHelperInfo info[4] = { |
| 376 | [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG, |
| 377 | [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG, |
| 378 | [QEMU_PLUGIN_CB_RW_REGS].flags = 0, |
| 379 | [QEMU_PLUGIN_CB_RW_REGS_PC].flags = 0, |
| 380 | /* |
| 381 | * Match qemu_plugin_vcpu_udata_cb_t: |
| 382 | * void (*)(uint32_t, void *) |
| 383 | */ |
| 384 | [0 ... 3].typemask = (dh_typemask(void, 0) | |
| 385 | dh_typemask(i32, 1) | |
| 386 | dh_typemask(ptr, 2)) |
| 387 | }; |
| 388 | assert((unsigned)flags < ARRAY_SIZE(info)); |
| 389 | |
| 390 | struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); |
| 391 | struct qemu_plugin_regular_cb regular_cb = { .f.vcpu_udata = cb, |
| 392 | .userp = udata, |
| 393 | .info = &info[flags] }; |
| 394 | dyn_cb->type = PLUGIN_CB_REGULAR; |
| 395 | dyn_cb->regular = regular_cb; |
| 396 | } |
| 397 | |
| 398 | void plugin_register_dyn_cond_cb__udata(GArray **arr, |
| 399 | qemu_plugin_vcpu_udata_cb_t cb, |
| 400 | enum qemu_plugin_cb_flags flags, |
| 401 | enum qemu_plugin_cond cond, |
| 402 | qemu_plugin_u64 entry, |
| 403 | uint64_t imm, |
| 404 | void *udata) |
| 405 | { |
| 406 | static TCGHelperInfo info[4] = { |
| 407 | [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG, |
| 408 | [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG, |
| 409 | [QEMU_PLUGIN_CB_RW_REGS].flags = 0, |
| 410 | [QEMU_PLUGIN_CB_RW_REGS_PC].flags = 0, |
| 411 | /* |
| 412 | * Match qemu_plugin_vcpu_udata_cb_t: |
| 413 | * void (*)(uint32_t, void *) |
| 414 | */ |
| 415 | [0 ... 3].typemask = (dh_typemask(void, 0) | |
| 416 | dh_typemask(i32, 1) | |
| 417 | dh_typemask(ptr, 2)) |
| 418 | }; |
| 419 | assert((unsigned)flags < ARRAY_SIZE(info)); |
| 420 | |
| 421 | struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); |
| 422 | struct qemu_plugin_conditional_cb cond_cb = { .userp = udata, |
| 423 | .f.vcpu_udata = cb, |
| 424 | .cond = cond, |
| 425 | .entry = entry, |
| 426 | .imm = imm, |
| 427 | .info = &info[flags] }; |
| 428 | dyn_cb->type = PLUGIN_CB_COND; |
| 429 | dyn_cb->cond = cond_cb; |
| 430 | } |
| 431 | |
| 432 | void plugin_register_vcpu_mem_cb(GArray **arr, |
| 433 | void *cb, |
| 434 | enum qemu_plugin_cb_flags flags, |
| 435 | enum qemu_plugin_mem_rw rw, |
| 436 | void *udata) |
| 437 | { |
| 438 | /* |
| 439 | * Expect that the underlying type for enum qemu_plugin_meminfo_t |
| 440 | * is either int32_t or uint32_t, aka int or unsigned int. |
| 441 | */ |
| 442 | QEMU_BUILD_BUG_ON( |
| 443 | !__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) && |
| 444 | !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t)); |
| 445 | |
| 446 | static TCGHelperInfo info[4] = { |
| 447 | [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG, |
| 448 | [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG, |
| 449 | [QEMU_PLUGIN_CB_RW_REGS].flags = 0, |
| 450 | [QEMU_PLUGIN_CB_RW_REGS_PC].flags = 0, |
| 451 | /* |
| 452 | * Match qemu_plugin_vcpu_mem_cb_t: |
| 453 | * void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *) |
| 454 | */ |
| 455 | [0 ... 3].typemask = |
| 456 | (dh_typemask(void, 0) | |
| 457 | dh_typemask(i32, 1) | |
| 458 | (__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) |
| 459 | ? dh_typemask(i32, 2) : dh_typemask(s32, 2)) | |
| 460 | dh_typemask(i64, 3) | |
| 461 | dh_typemask(ptr, 4)) |
| 462 | }; |
| 463 | assert((unsigned)flags < ARRAY_SIZE(info)); |
| 464 | |
| 465 | struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); |
| 466 | struct qemu_plugin_regular_cb regular_cb = { .userp = udata, |
| 467 | .rw = rw, |
| 468 | .f.vcpu_mem = cb, |
| 469 | .info = &info[flags] }; |
| 470 | dyn_cb->type = PLUGIN_CB_MEM_REGULAR; |
| 471 | dyn_cb->regular = regular_cb; |
| 472 | } |
| 473 | |
| 474 | /* |
| 475 | * Disable CFI checks. |
| 476 | * The callback function has been loaded from an external library so we do not |
| 477 | * have type information |
| 478 | */ |
| 479 | QEMU_DISABLE_CFI |
| 480 | void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) |
| 481 | { |
| 482 | struct qemu_plugin_cb *cb, *next; |
| 483 | enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; |
| 484 | |
| 485 | /* no plugin_state->event_mask check here; caller should have checked */ |
| 486 | |
| 487 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 488 | qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; |
| 489 | |
| 490 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS); |
| 491 | func(tb, cb->udata); |
| 492 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 493 | } |
| 494 | } |
| 495 | |
| 496 | static void clamp_syscall_arguments(uint64_t *a1, uint64_t *a2, uint64_t *a3, |
| 497 | uint64_t *a4, uint64_t *a5, uint64_t *a6, |
| 498 | uint64_t *a7, uint64_t *a8) |
| 499 | { |
| 500 | if (target_long_bits() == 32) { |
| 501 | const uint64_t mask = UINT32_MAX; |
| 502 | *a1 &= mask; |
| 503 | *a2 &= mask; |
| 504 | *a3 &= mask; |
| 505 | *a4 &= mask; |
| 506 | *a5 &= mask; |
| 507 | *a6 &= mask; |
| 508 | *a7 &= mask; |
| 509 | *a8 &= mask; |
| 510 | } |
| 511 | } |
| 512 | |
| 513 | /* |
| 514 | * Disable CFI checks. |
| 515 | * The callback function has been loaded from an external library so we do not |
| 516 | * have type information |
| 517 | */ |
| 518 | QEMU_DISABLE_CFI |
| 519 | void |
| 520 | qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, |
| 521 | uint64_t a3, uint64_t a4, uint64_t a5, |
| 522 | uint64_t a6, uint64_t a7, uint64_t a8) |
| 523 | { |
| 524 | struct qemu_plugin_cb *cb, *next; |
| 525 | enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; |
| 526 | |
| 527 | if (!test_bit(ev, cpu->plugin_state->event_mask)) { |
| 528 | return; |
| 529 | } |
| 530 | |
| 531 | clamp_syscall_arguments(&a1, &a2, &a3, &a4, &a5, &a6, &a7, &a8); |
| 532 | |
| 533 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 534 | qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; |
| 535 | |
| 536 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS_PC); |
| 537 | func(cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8, cb->udata); |
| 538 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 539 | } |
| 540 | } |
| 541 | |
| 542 | /* |
| 543 | * Disable CFI checks. |
| 544 | * The callback function has been loaded from an external library so we do not |
| 545 | * have type information |
| 546 | */ |
| 547 | QEMU_DISABLE_CFI |
| 548 | void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) |
| 549 | { |
| 550 | struct qemu_plugin_cb *cb, *next; |
| 551 | enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; |
| 552 | |
| 553 | if (!test_bit(ev, cpu->plugin_state->event_mask)) { |
| 554 | return; |
| 555 | } |
| 556 | |
| 557 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 558 | qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; |
| 559 | |
| 560 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS_PC); |
| 561 | func(cpu->cpu_index, num, ret, cb->udata); |
| 562 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 563 | } |
| 564 | } |
| 565 | |
| 566 | /* |
| 567 | * Disable CFI checks. |
| 568 | * The callback function has been loaded from an external library so we do not |
| 569 | * have type information |
| 570 | */ |
| 571 | QEMU_DISABLE_CFI |
| 572 | bool |
| 573 | qemu_plugin_vcpu_syscall_filter(CPUState *cpu, int64_t num, uint64_t a1, |
| 574 | uint64_t a2, uint64_t a3, uint64_t a4, |
| 575 | uint64_t a5, uint64_t a6, uint64_t a7, |
| 576 | uint64_t a8, int64_t *sysret) |
| 577 | { |
| 578 | struct qemu_plugin_cb *cb, *next; |
| 579 | enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_FILTER; |
| 580 | bool filtered = false; |
| 581 | |
| 582 | if (!test_bit(ev, cpu->plugin_state->event_mask)) { |
| 583 | return false; |
| 584 | } |
| 585 | |
| 586 | clamp_syscall_arguments(&a1, &a2, &a3, &a4, &a5, &a6, &a7, &a8); |
| 587 | |
| 588 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS_PC); |
| 589 | |
| 590 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 591 | qemu_plugin_vcpu_syscall_filter_cb_t func = cb->f.vcpu_syscall_filter; |
| 592 | |
| 593 | if (func(cpu->cpu_index, num, a1, a2, a3, a4, |
| 594 | a5, a6, a7, a8, sysret, cb->udata)) { |
| 595 | filtered = true; |
| 596 | break; |
| 597 | } |
| 598 | } |
| 599 | |
| 600 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 601 | |
| 602 | return filtered; |
| 603 | } |
| 604 | |
| 605 | void qemu_plugin_vcpu_idle_cb(CPUState *cpu) |
| 606 | { |
| 607 | /* idle and resume cb may be called before init, ignore in this case */ |
| 608 | if (cpu->cpu_index < plugin.num_vcpus) { |
| 609 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS_PC); |
| 610 | plugin_vcpu_cb__udata(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); |
| 611 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 612 | } |
| 613 | } |
| 614 | |
| 615 | void qemu_plugin_vcpu_resume_cb(CPUState *cpu) |
| 616 | { |
| 617 | if (cpu->cpu_index < plugin.num_vcpus) { |
| 618 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS_PC); |
| 619 | plugin_vcpu_cb__udata(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); |
| 620 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 621 | } |
| 622 | } |
| 623 | |
| 624 | void qemu_plugin_vcpu_interrupt_cb(CPUState *cpu, uint64_t from) |
| 625 | { |
| 626 | plugin_vcpu_cb__discon(cpu, QEMU_PLUGIN_EV_VCPU_INTERRUPT, |
| 627 | QEMU_PLUGIN_DISCON_INTERRUPT, from); |
| 628 | } |
| 629 | |
| 630 | void qemu_plugin_vcpu_exception_cb(CPUState *cpu, uint64_t from) |
| 631 | { |
| 632 | plugin_vcpu_cb__discon(cpu, QEMU_PLUGIN_EV_VCPU_EXCEPTION, |
| 633 | QEMU_PLUGIN_DISCON_EXCEPTION, from); |
| 634 | } |
| 635 | |
| 636 | void qemu_plugin_vcpu_hostcall_cb(CPUState *cpu, uint64_t from) |
| 637 | { |
| 638 | plugin_vcpu_cb__discon(cpu, QEMU_PLUGIN_EV_VCPU_HOSTCALL, |
| 639 | QEMU_PLUGIN_DISCON_HOSTCALL, from); |
| 640 | } |
| 641 | |
| 642 | void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, |
| 643 | qemu_plugin_vcpu_udata_cb_t cb, |
| 644 | void *userdata) |
| 645 | { |
| 646 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb, userdata); |
| 647 | } |
| 648 | |
| 649 | void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, |
| 650 | qemu_plugin_vcpu_udata_cb_t cb, |
| 651 | void *userdata) |
| 652 | { |
| 653 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb, userdata); |
| 654 | } |
| 655 | |
| 656 | void qemu_plugin_register_vcpu_discon_cb(qemu_plugin_id_t id, |
| 657 | enum qemu_plugin_discon_type type, |
| 658 | qemu_plugin_vcpu_discon_cb_t cb, |
| 659 | void *userdata) |
| 660 | { |
| 661 | if (type & QEMU_PLUGIN_DISCON_INTERRUPT) { |
| 662 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_VCPU_INTERRUPT, cb, userdata); |
| 663 | } |
| 664 | if (type & QEMU_PLUGIN_DISCON_EXCEPTION) { |
| 665 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_VCPU_EXCEPTION, cb, userdata); |
| 666 | } |
| 667 | if (type & QEMU_PLUGIN_DISCON_HOSTCALL) { |
| 668 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_VCPU_HOSTCALL, cb, userdata); |
| 669 | } |
| 670 | } |
| 671 | |
| 672 | void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, |
| 673 | qemu_plugin_udata_cb_t cb, |
| 674 | void *userdata) |
| 675 | { |
| 676 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_FLUSH, cb, userdata); |
| 677 | } |
| 678 | |
| 679 | static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) |
| 680 | { |
| 681 | g_array_free((GArray *) p, true); |
| 682 | return true; |
| 683 | } |
| 684 | |
| 685 | void qemu_plugin_flush_cb(void) |
| 686 | { |
| 687 | qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); |
| 688 | qht_reset(&plugin.dyn_cb_arr_ht); |
| 689 | |
| 690 | plugin_cb__udata(QEMU_PLUGIN_EV_FLUSH); |
| 691 | } |
| 692 | |
| 693 | void exec_inline_op(enum plugin_dyn_cb_type type, |
| 694 | struct qemu_plugin_inline_cb *cb, |
| 695 | int cpu_index) |
| 696 | { |
| 697 | char *ptr = cb->entry.score->data->data; |
| 698 | size_t elem_size = g_array_get_element_size( |
| 699 | cb->entry.score->data); |
| 700 | size_t offset = cb->entry.offset; |
| 701 | uint64_t *val = (uint64_t *)(ptr + offset + cpu_index * elem_size); |
| 702 | |
| 703 | switch (type) { |
| 704 | case PLUGIN_CB_INLINE_ADD_U64: |
| 705 | *val += cb->imm; |
| 706 | break; |
| 707 | case PLUGIN_CB_INLINE_STORE_U64: |
| 708 | *val = cb->imm; |
| 709 | break; |
| 710 | default: |
| 711 | g_assert_not_reached(); |
| 712 | } |
| 713 | } |
| 714 | |
| 715 | QEMU_DISABLE_CFI |
| 716 | void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, |
| 717 | uint64_t value_low, |
| 718 | uint64_t value_high, |
| 719 | MemOpIdx oi, enum qemu_plugin_mem_rw rw) |
| 720 | { |
| 721 | GArray *arr = cpu->neg.plugin_mem_cbs; |
| 722 | size_t i; |
| 723 | |
| 724 | if (arr == NULL) { |
| 725 | return; |
| 726 | } |
| 727 | |
| 728 | cpu->neg.plugin_mem_value_low = value_low; |
| 729 | cpu->neg.plugin_mem_value_high = value_high; |
| 730 | |
| 731 | for (i = 0; i < arr->len; i++) { |
| 732 | struct qemu_plugin_dyn_cb *cb = |
| 733 | &g_array_index(arr, struct qemu_plugin_dyn_cb, i); |
| 734 | |
| 735 | switch (cb->type) { |
| 736 | case PLUGIN_CB_MEM_REGULAR: |
| 737 | if (rw & cb->regular.rw) { |
| 738 | qemu_plugin_set_cb_flags(cpu, |
| 739 | tcg_call_to_qemu_plugin_cb_flags(cb->regular.info->flags)); |
| 740 | |
| 741 | cb->regular.f.vcpu_mem(cpu->cpu_index, |
| 742 | make_plugin_meminfo(oi, rw), |
| 743 | vaddr, cb->regular.userp); |
| 744 | qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS); |
| 745 | } |
| 746 | break; |
| 747 | case PLUGIN_CB_INLINE_ADD_U64: |
| 748 | case PLUGIN_CB_INLINE_STORE_U64: |
| 749 | if (rw & cb->inline_insn.rw) { |
| 750 | exec_inline_op(cb->type, &cb->inline_insn, cpu->cpu_index); |
| 751 | } |
| 752 | break; |
| 753 | default: |
| 754 | g_assert_not_reached(); |
| 755 | } |
| 756 | } |
| 757 | } |
| 758 | |
| 759 | void qemu_plugin_atexit_cb(void) |
| 760 | { |
| 761 | plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); |
| 762 | } |
| 763 | |
| 764 | void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, |
| 765 | qemu_plugin_udata_cb_t cb, |
| 766 | void *udata) |
| 767 | { |
| 768 | plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); |
| 769 | } |
| 770 | |
| 771 | /* |
| 772 | * Handle exit from linux-user. Unlike the normal atexit() mechanism |
| 773 | * we need to handle the clean-up manually as it's possible threads |
| 774 | * are still running. We need to remove all callbacks from code |
| 775 | * generation, flush the current translations and then we can safely |
| 776 | * trigger the exit callbacks. |
| 777 | */ |
| 778 | |
| 779 | void qemu_plugin_user_exit(void) |
| 780 | { |
| 781 | enum qemu_plugin_event ev; |
| 782 | CPUState *cpu; |
| 783 | |
| 784 | /* |
| 785 | * Locking order: we must acquire locks in an order that is consistent |
| 786 | * with the one in fork_start(). That is: |
| 787 | * - start_exclusive(), which acquires qemu_cpu_list_lock, |
| 788 | * must be called before acquiring plugin.lock. |
| 789 | */ |
| 790 | start_exclusive(); |
| 791 | |
| 792 | qemu_rec_mutex_lock(&plugin.lock); |
| 793 | /* un-register all callbacks except the final AT_EXIT one */ |
| 794 | for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { |
| 795 | if (ev != QEMU_PLUGIN_EV_ATEXIT) { |
| 796 | struct qemu_plugin_cb *cb, *next; |
| 797 | |
| 798 | QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { |
| 799 | plugin_unregister_cb__locked(cb->ctx, ev); |
| 800 | } |
| 801 | } |
| 802 | } |
| 803 | CPU_FOREACH(cpu) { |
| 804 | qemu_plugin_disable_mem_helpers(cpu); |
| 805 | } |
| 806 | qemu_rec_mutex_unlock(&plugin.lock); |
| 807 | |
| 808 | tb_flush__exclusive_or_serial(); |
| 809 | end_exclusive(); |
| 810 | |
| 811 | /* now it's safe to handle the exit case */ |
| 812 | qemu_plugin_atexit_cb(); |
| 813 | } |
| 814 | |
| 815 | /* |
| 816 | * Helpers for *-user to ensure locks are sane across fork() events. |
| 817 | */ |
| 818 | |
| 819 | void qemu_plugin_user_prefork_lock(void) |
| 820 | { |
| 821 | qemu_rec_mutex_lock(&plugin.lock); |
| 822 | } |
| 823 | |
| 824 | void qemu_plugin_user_postfork(bool is_child) |
| 825 | { |
| 826 | if (is_child) { |
| 827 | /* should we just reset via plugin_init? */ |
| 828 | qemu_rec_mutex_init(&plugin.lock); |
| 829 | } else { |
| 830 | qemu_rec_mutex_unlock(&plugin.lock); |
| 831 | } |
| 832 | } |
| 833 | |
| 834 | static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) |
| 835 | { |
| 836 | return ap == bp; |
| 837 | } |
| 838 | |
| 839 | static void __attribute__((__constructor__)) plugin_init(void) |
| 840 | { |
| 841 | int i; |
| 842 | |
| 843 | for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { |
| 844 | QLIST_INIT(&plugin.cb_lists[i]); |
| 845 | } |
| 846 | qemu_rec_mutex_init(&plugin.lock); |
| 847 | plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); |
| 848 | plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); |
| 849 | QLIST_INIT(&plugin.scoreboards); |
| 850 | plugin.scoreboard_alloc_size = 16; /* avoid frequent reallocation */ |
| 851 | QTAILQ_INIT(&plugin.ctxs); |
| 852 | qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, |
| 853 | QHT_MODE_AUTO_RESIZE); |
| 854 | atexit(qemu_plugin_atexit_cb); |
| 855 | } |
| 856 | |
| 857 | int plugin_num_vcpus(void) |
| 858 | { |
| 859 | return plugin.num_vcpus; |
| 860 | } |
| 861 | |
| 862 | struct qemu_plugin_scoreboard *plugin_scoreboard_new(size_t element_size) |
| 863 | { |
| 864 | struct qemu_plugin_scoreboard *score = |
| 865 | g_malloc0(sizeof(struct qemu_plugin_scoreboard)); |
| 866 | score->data = g_array_new(FALSE, TRUE, element_size); |
| 867 | g_array_set_size(score->data, plugin.scoreboard_alloc_size); |
| 868 | |
| 869 | qemu_rec_mutex_lock(&plugin.lock); |
| 870 | QLIST_INSERT_HEAD(&plugin.scoreboards, score, entry); |
| 871 | qemu_rec_mutex_unlock(&plugin.lock); |
| 872 | |
| 873 | return score; |
| 874 | } |
| 875 | |
| 876 | void plugin_scoreboard_free(struct qemu_plugin_scoreboard *score) |
| 877 | { |
| 878 | qemu_rec_mutex_lock(&plugin.lock); |
| 879 | QLIST_REMOVE(score, entry); |
| 880 | qemu_rec_mutex_unlock(&plugin.lock); |
| 881 | |
| 882 | g_array_free(score->data, TRUE); |
| 883 | g_free(score); |
| 884 | } |
| 885 | |
| 886 | enum qemu_plugin_cb_flags tcg_call_to_qemu_plugin_cb_flags(int flags) |
| 887 | { |
| 888 | if (flags & TCG_CALL_NO_RWG) { |
| 889 | return QEMU_PLUGIN_CB_NO_REGS; |
| 890 | } else if (flags & TCG_CALL_NO_WG) { |
| 891 | return QEMU_PLUGIN_CB_R_REGS; |
| 892 | } else { |
| 893 | return QEMU_PLUGIN_CB_RW_REGS_PC; |
| 894 | } |
| 895 | } |