[mirror_qemu.git] / plugins / core.c

/*
 * QEMU Plugin Core code
 *
 * This is the core code that deals with injecting instrumentation into the code
 *
 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
 * Copyright (C) 2019, Linaro
 *
 * License: GNU GPL, version 2 or later.
 *   See the COPYING file in the top-level directory.
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */
#include "qemu/osdep.h"
#include "qemu/error-report.h"
#include "qemu/config-file.h"
#include "qapi/error.h"
#include "qemu/lockable.h"
#include "qemu/option.h"
#include "qemu/rcu_queue.h"
#include "qemu/xxhash.h"
#include "qemu/rcu.h"
#include "hw/core/cpu.h"
#include "exec/cpu-common.h"

#include "cpu.h"
#include "exec/exec-all.h"
#include "exec/helper-proto.h"
#include "sysemu/sysemu.h"
#include "tcg/tcg.h"
#include "tcg/tcg-op.h"
#include "trace/mem-internal.h" /* mem_info macros */
#include "plugin.h"

struct qemu_plugin_cb {
    struct qemu_plugin_ctx *ctx;
    union qemu_plugin_cb_sig f;
    void *udata;
    QLIST_ENTRY(qemu_plugin_cb) entry;
};

struct qemu_plugin_state plugin;

struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
{
    struct qemu_plugin_ctx *ctx;
    qemu_plugin_id_t *id_p;

    id_p = g_hash_table_lookup(plugin.id_ht, &id);
    ctx = container_of(id_p, struct qemu_plugin_ctx, id);
    if (ctx == NULL) {
        error_report("plugin: invalid plugin id %" PRIu64, id);
        abort();
    }
    return ctx;
}

static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
{
    bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
    cpu_tb_jmp_cache_clear(cpu);
}

static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
{
    CPUState *cpu = container_of(k, CPUState, cpu_index);
    run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);

    if (cpu->created) {
        async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
    } else {
        plugin_cpu_update__async(cpu, mask);
    }
}

void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
                                  enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb = ctx->callbacks[ev];

    if (cb == NULL) {
        return;
    }
    QLIST_REMOVE_RCU(cb, entry);
    g_free(cb);
    ctx->callbacks[ev] = NULL;
    if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
        clear_bit(ev, plugin.mask);
        g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
    }
}

static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb, *next;

    switch (ev) {
    case QEMU_PLUGIN_EV_VCPU_INIT:
    case QEMU_PLUGIN_EV_VCPU_EXIT:
    case QEMU_PLUGIN_EV_VCPU_IDLE:
    case QEMU_PLUGIN_EV_VCPU_RESUME:
        /* iterate safely; plugins might uninstall themselves at any time */
        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
            qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;

            func(cb->ctx->id, cpu->cpu_index);
        }
        break;
    default:
        g_assert_not_reached();
    }
}

static void plugin_cb__simple(enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb, *next;

    switch (ev) {
    case QEMU_PLUGIN_EV_FLUSH:
        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
            qemu_plugin_simple_cb_t func = cb->f.simple;

            func(cb->ctx->id);
        }
        break;
    default:
        g_assert_not_reached();
    }
}

static void plugin_cb__udata(enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb, *next;

    switch (ev) {
    case QEMU_PLUGIN_EV_ATEXIT:
        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
            qemu_plugin_udata_cb_t func = cb->f.udata;

            func(cb->ctx->id, cb->udata);
        }
        break;
    default:
        g_assert_not_reached();
    }
}

static void
do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
                      void *func, void *udata)
{
    struct qemu_plugin_ctx *ctx;

    QEMU_LOCK_GUARD(&plugin.lock);
    ctx = plugin_id_to_ctx_locked(id);
    /* if the plugin is on its way out, ignore this request */
    if (unlikely(ctx->uninstalling)) {
        return;
    }
    if (func) {
        struct qemu_plugin_cb *cb = ctx->callbacks[ev];

        if (cb) {
            cb->f.generic = func;
            cb->udata = udata;
        } else {
            cb = g_new(struct qemu_plugin_cb, 1);
            cb->ctx = ctx;
            cb->f.generic = func;
            cb->udata = udata;
            ctx->callbacks[ev] = cb;
            QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
            if (!test_bit(ev, plugin.mask)) {
                set_bit(ev, plugin.mask);
                g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
                                     NULL);
            }
        }
    } else {
        plugin_unregister_cb__locked(ctx, ev);
    }
}

void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
                        void *func)
{
    do_plugin_register_cb(id, ev, func, NULL);
}

void
plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
                         void *func, void *udata)
{
    do_plugin_register_cb(id, ev, func, udata);
}

void qemu_plugin_vcpu_init_hook(CPUState *cpu)
{
    bool success;

    qemu_rec_mutex_lock(&plugin.lock);
    plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
    success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
                                  &cpu->cpu_index);
    g_assert(success);
    qemu_rec_mutex_unlock(&plugin.lock);

    plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
}

void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
{
    bool success;

    plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);

    qemu_rec_mutex_lock(&plugin.lock);
    success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
    g_assert(success);
    qemu_rec_mutex_unlock(&plugin.lock);
}

struct plugin_for_each_args {
    struct qemu_plugin_ctx *ctx;
    qemu_plugin_vcpu_simple_cb_t cb;
};

static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
{
    struct plugin_for_each_args *args = udata;
    int cpu_index = *(int *)k;

    args->cb(args->ctx->id, cpu_index);
}

void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
                               qemu_plugin_vcpu_simple_cb_t cb)
{
    struct plugin_for_each_args args;

    if (cb == NULL) {
        return;
    }
    qemu_rec_mutex_lock(&plugin.lock);
    args.ctx = plugin_id_to_ctx_locked(id);
    args.cb = cb;
    g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
    qemu_rec_mutex_unlock(&plugin.lock);
}

/* Allocate and return a callback record */
static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr)
{
    GArray *cbs = *arr;

    if (!cbs) {
        cbs = g_array_sized_new(false, false,
                                sizeof(struct qemu_plugin_dyn_cb), 1);
        *arr = cbs;
    }

    g_array_set_size(cbs, cbs->len + 1);
    return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
}

void plugin_register_inline_op(GArray **arr,
                               enum qemu_plugin_mem_rw rw,
                               enum qemu_plugin_op op, void *ptr,
                               uint64_t imm)
{
    struct qemu_plugin_dyn_cb *dyn_cb;

    dyn_cb = plugin_get_dyn_cb(arr);
    dyn_cb->userp = ptr;
    dyn_cb->type = PLUGIN_CB_INLINE;
    dyn_cb->rw = rw;
    dyn_cb->inline_insn.op = op;
    dyn_cb->inline_insn.imm = imm;
}

static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags)
{
    uint32_t ret;

    switch (flags) {
    case QEMU_PLUGIN_CB_RW_REGS:
        ret = 0;
        break;
    case QEMU_PLUGIN_CB_R_REGS:
        ret = TCG_CALL_NO_WG;
        break;
    case QEMU_PLUGIN_CB_NO_REGS:
    default:
        ret = TCG_CALL_NO_RWG;
    }
    return ret;
}

inline void
plugin_register_dyn_cb__udata(GArray **arr,
                              qemu_plugin_vcpu_udata_cb_t cb,
                              enum qemu_plugin_cb_flags flags, void *udata)
{
    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);

    dyn_cb->userp = udata;
    dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
    dyn_cb->f.vcpu_udata = cb;
    dyn_cb->type = PLUGIN_CB_REGULAR;
}

void plugin_register_vcpu_mem_cb(GArray **arr,
                                 void *cb,
                                 enum qemu_plugin_cb_flags flags,
                                 enum qemu_plugin_mem_rw rw,
                                 void *udata)
{
    struct qemu_plugin_dyn_cb *dyn_cb;

    dyn_cb = plugin_get_dyn_cb(arr);
    dyn_cb->userp = udata;
    dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
    dyn_cb->type = PLUGIN_CB_REGULAR;
    dyn_cb->rw = rw;
    dyn_cb->f.generic = cb;
}

void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb)
{
    struct qemu_plugin_cb *cb, *next;
    enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;

    /* no plugin_mask check here; caller should have checked */

    QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
        qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;

        func(cb->ctx->id, tb);
    }
}

void
qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
                         uint64_t a3, uint64_t a4, uint64_t a5,
                         uint64_t a6, uint64_t a7, uint64_t a8)
{
    struct qemu_plugin_cb *cb, *next;
    enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;

    if (!test_bit(ev, cpu->plugin_mask)) {
        return;
    }

    QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
        qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;

        func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
    }
}

void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
{
    struct qemu_plugin_cb *cb, *next;
    enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;

    if (!test_bit(ev, cpu->plugin_mask)) {
        return;
    }

    QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
        qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;

        func(cb->ctx->id, cpu->cpu_index, num, ret);
    }
}

void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
{
    plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
}

void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
{
    plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
}

void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
                                       qemu_plugin_vcpu_simple_cb_t cb)
{
    plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
}

void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
                                         qemu_plugin_vcpu_simple_cb_t cb)
{
    plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
}

void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
                                   qemu_plugin_simple_cb_t cb)
{
    plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
}

static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp)
{
    g_array_free((GArray *) p, true);
    return true;
}

void qemu_plugin_flush_cb(void)
{
    qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
    qht_reset(&plugin.dyn_cb_arr_ht);

    plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
}

void exec_inline_op(struct qemu_plugin_dyn_cb *cb)
{
    uint64_t *val = cb->userp;

    switch (cb->inline_insn.op) {
    case QEMU_PLUGIN_INLINE_ADD_U64:
        *val += cb->inline_insn.imm;
        break;
    default:
        g_assert_not_reached();
    }
}

void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, uint32_t info)
{
    GArray *arr = cpu->plugin_mem_cbs;
    size_t i;

    if (arr == NULL) {
        return;
    }
    for (i = 0; i < arr->len; i++) {
        struct qemu_plugin_dyn_cb *cb =
            &g_array_index(arr, struct qemu_plugin_dyn_cb, i);
        int w = !!(info & TRACE_MEM_ST) + 1;

        if (!(w & cb->rw)) {
                break;
        }
        switch (cb->type) {
        case PLUGIN_CB_REGULAR:
            cb->f.vcpu_mem(cpu->cpu_index, info, vaddr, cb->userp);
            break;
        case PLUGIN_CB_INLINE:
            exec_inline_op(cb);
            break;
        default:
            g_assert_not_reached();
        }
    }
}

void qemu_plugin_atexit_cb(void)
{
    plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
}

void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
                                    qemu_plugin_udata_cb_t cb,
                                    void *udata)
{
    plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
}

/*
 * Call this function after longjmp'ing to the main loop. It's possible that the
 * last instruction of a TB might have used helpers, and therefore the
 * "disable" instruction will never execute because it ended up as dead code.
 */
void qemu_plugin_disable_mem_helpers(CPUState *cpu)
{
    cpu->plugin_mem_cbs = NULL;
}

static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp)
{
    return ap == bp;
}

static void __attribute__((__constructor__)) plugin_init(void)
{
    int i;

    for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
        QLIST_INIT(&plugin.cb_lists[i]);
    }
    qemu_rec_mutex_init(&plugin.lock);
    plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
    plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
    QTAILQ_INIT(&plugin.ctxs);
    qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
             QHT_MODE_AUTO_RESIZE);
    atexit(qemu_plugin_atexit_cb);
}
Commit	Line	Data
54cb65d8 EC	1	/*
	2	* QEMU Plugin Core code
	3	*
	4	* This is the core code that deals with injecting instrumentation into the code
	5	*
	6	* Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
	7	* Copyright (C) 2019, Linaro
	8	*
	9	* License: GNU GPL, version 2 or later.
	10	* See the COPYING file in the top-level directory.
	11	*
	12	* SPDX-License-Identifier: GPL-2.0-or-later
	13	*/
	14	#include "qemu/osdep.h"
	15	#include "qemu/error-report.h"
	16	#include "qemu/config-file.h"
	17	#include "qapi/error.h"
ac90871c	18	#include "qemu/lockable.h"
54cb65d8 EC	19	#include "qemu/option.h"
	20	#include "qemu/rcu_queue.h"
	21	#include "qemu/xxhash.h"
	22	#include "qemu/rcu.h"
	23	#include "hw/core/cpu.h"
	24	#include "exec/cpu-common.h"
	25
	26	#include "cpu.h"
	27	#include "exec/exec-all.h"
	28	#include "exec/helper-proto.h"
	29	#include "sysemu/sysemu.h"
	30	#include "tcg/tcg.h"
	31	#include "tcg/tcg-op.h"
	32	#include "trace/mem-internal.h" /* mem_info macros */
	33	#include "plugin.h"
	34
	35	struct qemu_plugin_cb {
	36	struct qemu_plugin_ctx *ctx;
	37	union qemu_plugin_cb_sig f;
	38	void *udata;
	39	QLIST_ENTRY(qemu_plugin_cb) entry;
	40	};
	41
	42	struct qemu_plugin_state plugin;
	43
	44	struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
	45	{
	46	struct qemu_plugin_ctx *ctx;
	47	qemu_plugin_id_t *id_p;
	48
	49	id_p = g_hash_table_lookup(plugin.id_ht, &id);
	50	ctx = container_of(id_p, struct qemu_plugin_ctx, id);
	51	if (ctx == NULL) {
	52	error_report("plugin: invalid plugin id %" PRIu64, id);
	53	abort();
	54	}
	55	return ctx;
	56	}
	57
	58	static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
	59	{
	60	bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX);
	61	cpu_tb_jmp_cache_clear(cpu);
	62	}
	63
	64	static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
	65	{
	66	CPUState *cpu = container_of(k, CPUState, cpu_index);
	67	run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);
	68
	69	if (cpu->created) {
	70	async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
	71	} else {
	72	plugin_cpu_update__async(cpu, mask);
	73	}
	74	}
	75
	76	void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
	77	enum qemu_plugin_event ev)
	78	{
	79	struct qemu_plugin_cb *cb = ctx->callbacks[ev];
	80
	81	if (cb == NULL) {
	82	return;
83	}
84	QLIST_REMOVE_RCU(cb, entry);
85	g_free(cb);
86	ctx->callbacks[ev] = NULL;
87	if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
88	clear_bit(ev, plugin.mask);
89	g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
90	}
91	}
92
93	static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
94	{
95	struct qemu_plugin_cb cb, next;
96
97	switch (ev) {
98	case QEMU_PLUGIN_EV_VCPU_INIT:
99	case QEMU_PLUGIN_EV_VCPU_EXIT:
100	case QEMU_PLUGIN_EV_VCPU_IDLE:
101	case QEMU_PLUGIN_EV_VCPU_RESUME:
102	/* iterate safely; plugins might uninstall themselves at any time */
103	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
104	qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;
105
106	func(cb->ctx->id, cpu->cpu_index);
107	}
108	break;
109	default:
110	g_assert_not_reached();
111	}
112	}
113
114	static void plugin_cb__simple(enum qemu_plugin_event ev)
115	{
116	struct qemu_plugin_cb cb, next;
117
118	switch (ev) {
119	case QEMU_PLUGIN_EV_FLUSH:
120	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
121	qemu_plugin_simple_cb_t func = cb->f.simple;
122
123	func(cb->ctx->id);
124	}
125	break;
126	default:
127	g_assert_not_reached();
128	}
129	}
130
131	static void plugin_cb__udata(enum qemu_plugin_event ev)
132	{
133	struct qemu_plugin_cb cb, next;
134
135	switch (ev) {
136	case QEMU_PLUGIN_EV_ATEXIT:
137	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
138	qemu_plugin_udata_cb_t func = cb->f.udata;
139
140	func(cb->ctx->id, cb->udata);
141	}
142	break;
143	default:
144	g_assert_not_reached();
145	}
146	}
147
148	static void
149	do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
150	void func, void udata)
151	{
152	struct qemu_plugin_ctx *ctx;
153
ac90871c	154	QEMU_LOCK_GUARD(&plugin.lock);
54cb65d8 EC	155	ctx = plugin_id_to_ctx_locked(id);
	156	/* if the plugin is on its way out, ignore this request */
	157	if (unlikely(ctx->uninstalling)) {
ac90871c	158	return;
54cb65d8 EC	159	}
	160	if (func) {
	161	struct qemu_plugin_cb *cb = ctx->callbacks[ev];
	162
	163	if (cb) {
	164	cb->f.generic = func;
	165	cb->udata = udata;
	166	} else {
	167	cb = g_new(struct qemu_plugin_cb, 1);
	168	cb->ctx = ctx;
	169	cb->f.generic = func;
	170	cb->udata = udata;
	171	ctx->callbacks[ev] = cb;
	172	QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
	173	if (!test_bit(ev, plugin.mask)) {
	174	set_bit(ev, plugin.mask);
	175	g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
	176	NULL);
	177	}
	178	}
	179	} else {
	180	plugin_unregister_cb__locked(ctx, ev);
	181	}
54cb65d8 EC	182	}
	183
	184	void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
	185	void *func)
	186	{
	187	do_plugin_register_cb(id, ev, func, NULL);
	188	}
	189
	190	void
	191	plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
	192	void func, void udata)
	193	{
	194	do_plugin_register_cb(id, ev, func, udata);
	195	}
	196
	197	void qemu_plugin_vcpu_init_hook(CPUState *cpu)
	198	{
	199	bool success;
	200
	201	qemu_rec_mutex_lock(&plugin.lock);
	202	plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
	203	success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
	204	&cpu->cpu_index);
	205	g_assert(success);
	206	qemu_rec_mutex_unlock(&plugin.lock);
	207
	208	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
	209	}
	210
	211	void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
	212	{
	213	bool success;
	214
	215	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);
	216
	217	qemu_rec_mutex_lock(&plugin.lock);
	218	success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
	219	g_assert(success);
	220	qemu_rec_mutex_unlock(&plugin.lock);
	221	}
	222
	223	struct plugin_for_each_args {
	224	struct qemu_plugin_ctx *ctx;
	225	qemu_plugin_vcpu_simple_cb_t cb;
	226	};
	227
	228	static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
	229	{
	230	struct plugin_for_each_args *args = udata;
	231	int cpu_index = (int )k;
	232
	233	args->cb(args->ctx->id, cpu_index);
	234	}
	235
	236	void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
	237	qemu_plugin_vcpu_simple_cb_t cb)
	238	{
	239	struct plugin_for_each_args args;
	240
	241	if (cb == NULL) {
	242	return;
	243	}
	244	qemu_rec_mutex_lock(&plugin.lock);
	245	args.ctx = plugin_id_to_ctx_locked(id);
246	args.cb = cb;
247	g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
248	qemu_rec_mutex_unlock(&plugin.lock);
249	}
250
251	/* Allocate and return a callback record */
252	static struct qemu_plugin_dyn_cb plugin_get_dyn_cb(GArray *arr)
253	{
254	GArray cbs = arr;
255
256	if (!cbs) {
257	cbs = g_array_sized_new(false, false,
258	sizeof(struct qemu_plugin_dyn_cb), 1);
259	*arr = cbs;
260	}
261
262	g_array_set_size(cbs, cbs->len + 1);
263	return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
264	}
265
266	void plugin_register_inline_op(GArray **arr,
267	enum qemu_plugin_mem_rw rw,
268	enum qemu_plugin_op op, void *ptr,
269	uint64_t imm)
270	{
271	struct qemu_plugin_dyn_cb *dyn_cb;
272
273	dyn_cb = plugin_get_dyn_cb(arr);
274	dyn_cb->userp = ptr;
275	dyn_cb->type = PLUGIN_CB_INLINE;
276	dyn_cb->rw = rw;
277	dyn_cb->inline_insn.op = op;
278	dyn_cb->inline_insn.imm = imm;
279	}
280
281	static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags)
282	{
283	uint32_t ret;
284
285	switch (flags) {
286	case QEMU_PLUGIN_CB_RW_REGS:
287	ret = 0;
dcc474c6	288	break;
54cb65d8 EC	289	case QEMU_PLUGIN_CB_R_REGS:
	290	ret = TCG_CALL_NO_WG;
	291	break;
	292	case QEMU_PLUGIN_CB_NO_REGS:
	293	default:
	294	ret = TCG_CALL_NO_RWG;
	295	}
	296	return ret;
	297	}
	298
	299	inline void
	300	plugin_register_dyn_cb__udata(GArray **arr,
	301	qemu_plugin_vcpu_udata_cb_t cb,
	302	enum qemu_plugin_cb_flags flags, void *udata)
	303	{
	304	struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
	305
	306	dyn_cb->userp = udata;
	307	dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
	308	dyn_cb->f.vcpu_udata = cb;
	309	dyn_cb->type = PLUGIN_CB_REGULAR;
	310	}
	311
	312	void plugin_register_vcpu_mem_cb(GArray **arr,
	313	void *cb,
	314	enum qemu_plugin_cb_flags flags,
	315	enum qemu_plugin_mem_rw rw,
	316	void *udata)
	317	{
	318	struct qemu_plugin_dyn_cb *dyn_cb;
	319
	320	dyn_cb = plugin_get_dyn_cb(arr);
	321	dyn_cb->userp = udata;
	322	dyn_cb->tcg_flags = cb_to_tcg_flags(flags);
	323	dyn_cb->type = PLUGIN_CB_REGULAR;
	324	dyn_cb->rw = rw;
	325	dyn_cb->f.generic = cb;
	326	}
	327
	328	void qemu_plugin_tb_trans_cb(CPUState cpu, struct qemu_plugin_tb tb)
	329	{
	330	struct qemu_plugin_cb cb, next;
	331	enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;
	332
	333	/* no plugin_mask check here; caller should have checked */
	334
	335	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	336	qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;
	337
	338	func(cb->ctx->id, tb);
	339	}
	340	}
	341
	342	void
	343	qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
	344	uint64_t a3, uint64_t a4, uint64_t a5,
	345	uint64_t a6, uint64_t a7, uint64_t a8)
	346	{
	347	struct qemu_plugin_cb cb, next;
	348	enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;
	349
	350	if (!test_bit(ev, cpu->plugin_mask)) {
	351	return;
	352	}
353
354	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
355	qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;
356
357	func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
358	}
359	}
360
361	void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
362	{
363	struct qemu_plugin_cb cb, next;
364	enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;
365
366	if (!test_bit(ev, cpu->plugin_mask)) {
367	return;
368	}
369
370	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
371	qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;
372
373	func(cb->ctx->id, cpu->cpu_index, num, ret);
374	}
375	}
376
377	void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
378	{
379	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
380	}
381
382	void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
383	{
384	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
385	}
386
387	void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
388	qemu_plugin_vcpu_simple_cb_t cb)
389	{
390	plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
391	}
392
393	void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
394	qemu_plugin_vcpu_simple_cb_t cb)
395	{
396	plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
397	}
398
399	void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
400	qemu_plugin_simple_cb_t cb)
401	{
402	plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
403	}
404
405	static bool free_dyn_cb_arr(void p, uint32_t h, void userp)
406	{
407	g_array_free((GArray *) p, true);
408	return true;
409	}
410
411	void qemu_plugin_flush_cb(void)
412	{
413	qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
414	qht_reset(&plugin.dyn_cb_arr_ht);
415
416	plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
417	}
418
419	void exec_inline_op(struct qemu_plugin_dyn_cb *cb)
420	{
421	uint64_t *val = cb->userp;
422
423	switch (cb->inline_insn.op) {
424	case QEMU_PLUGIN_INLINE_ADD_U64:
425	*val += cb->inline_insn.imm;
426	break;
427	default:
428	g_assert_not_reached();
429	}
430	}
431
432	void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, uint32_t info)
433	{
434	GArray *arr = cpu->plugin_mem_cbs;
435	size_t i;
436
437	if (arr == NULL) {
438	return;
439	}
440	for (i = 0; i < arr->len; i++) {
441	struct qemu_plugin_dyn_cb *cb =
442	&g_array_index(arr, struct qemu_plugin_dyn_cb, i);
443	int w = !!(info & TRACE_MEM_ST) + 1;
444
445	if (!(w & cb->rw)) {
446	break;
447	}
448	switch (cb->type) {
449	case PLUGIN_CB_REGULAR:
450	cb->f.vcpu_mem(cpu->cpu_index, info, vaddr, cb->userp);
451	break;
452	case PLUGIN_CB_INLINE:
453	exec_inline_op(cb);
454	break;
455	default:
456	g_assert_not_reached();
457	}
458	}
459	}
460
461	void qemu_plugin_atexit_cb(void)
462	{
463	plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
464	}
465
466	void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
467	qemu_plugin_udata_cb_t cb,
468	void *udata)
469	{
470	plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
471	}
472
473	/*
474	* Call this function after longjmp'ing to the main loop. It's possible that the
475	* last instruction of a TB might have used helpers, and therefore the
476	* "disable" instruction will never execute because it ended up as dead code.
477	*/
478	void qemu_plugin_disable_mem_helpers(CPUState *cpu)
479	{
480	cpu->plugin_mem_cbs = NULL;
481	}
482
483	static bool plugin_dyn_cb_arr_cmp(const void ap, const void bp)
484	{
485	return ap == bp;
486	}
487
488	static void __attribute__((__constructor__)) plugin_init(void)
489	{
490	int i;
491
492	for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
493	QLIST_INIT(&plugin.cb_lists[i]);
494	}
495	qemu_rec_mutex_init(&plugin.lock);
496	plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
497	plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
498	QTAILQ_INIT(&plugin.ctxs);
499	qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
500	QHT_MODE_AUTO_RESIZE);
501	atexit(qemu_plugin_atexit_cb);
502	}