diff options
Diffstat (limited to 'plugins')
| -rw-r--r-- | plugins/api.c | 393 | ||||
| -rw-r--r-- | plugins/core.c | 558 | ||||
| -rw-r--r-- | plugins/loader.c | 421 | ||||
| -rw-r--r-- | plugins/meson.build | 15 | ||||
| -rw-r--r-- | plugins/plugin.h | 100 | ||||
| -rw-r--r-- | plugins/qemu-plugins.symbols | 41 |
6 files changed, 1528 insertions, 0 deletions
diff --git a/plugins/api.c b/plugins/api.c new file mode 100644 index 000000000..b143b09ce --- /dev/null +++ b/plugins/api.c @@ -0,0 +1,393 @@ +/* + * QEMU Plugin API + * + * This provides the API that is available to the plugins to interact + * with QEMU. We have to be careful not to expose internal details of + * how QEMU works so we abstract out things like translation and + * instructions to anonymous data types: + * + * qemu_plugin_tb + * qemu_plugin_insn + * + * Which can then be passed back into the API to do additional things. + * As such all the public functions in here are exported in + * qemu-plugin.h. + * + * The general life-cycle of a plugin is: + * + * - plugin is loaded, public qemu_plugin_install called + * - the install func registers callbacks for events + * - usually an atexit_cb is registered to dump info at the end + * - when a registered event occurs the plugin is called + * - some events pass additional info + * - during translation the plugin can decide to instrument any + * instruction + * - when QEMU exits all the registered atexit callbacks are called + * + * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> + * Copyright (C) 2019, Linaro + * + * License: GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + * SPDX-License-Identifier: GPL-2.0-or-later + * + */ + +#include "qemu/osdep.h" +#include "qemu/plugin.h" +#include "tcg/tcg.h" +#include "exec/exec-all.h" +#include "exec/ram_addr.h" +#include "disas/disas.h" +#include "plugin.h" +#ifndef CONFIG_USER_ONLY +#include "qemu/plugin-memory.h" +#include "hw/boards.h" +#endif + +/* Uninstall and Reset handlers */ + +void qemu_plugin_uninstall(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb) +{ + plugin_reset_uninstall(id, cb, false); +} + +void qemu_plugin_reset(qemu_plugin_id_t id, qemu_plugin_simple_cb_t cb) +{ + plugin_reset_uninstall(id, cb, true); +} + +/* + * Plugin Register Functions + * + * This allows the plugin to register callbacks for various events + * during the translation. + */ + +void qemu_plugin_register_vcpu_init_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_simple_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INIT, cb); +} + +void qemu_plugin_register_vcpu_exit_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_simple_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXIT, cb); +} + +void qemu_plugin_register_vcpu_tb_exec_cb(struct qemu_plugin_tb *tb, + qemu_plugin_vcpu_udata_cb_t cb, + enum qemu_plugin_cb_flags flags, + void *udata) +{ + if (!tb->mem_only) { + plugin_register_dyn_cb__udata(&tb->cbs[PLUGIN_CB_REGULAR], + cb, flags, udata); + } +} + +void qemu_plugin_register_vcpu_tb_exec_inline(struct qemu_plugin_tb *tb, + enum qemu_plugin_op op, + void *ptr, uint64_t imm) +{ + if (!tb->mem_only) { + plugin_register_inline_op(&tb->cbs[PLUGIN_CB_INLINE], 0, op, ptr, imm); + } +} + +void qemu_plugin_register_vcpu_insn_exec_cb(struct qemu_plugin_insn *insn, + qemu_plugin_vcpu_udata_cb_t cb, + enum qemu_plugin_cb_flags flags, + void *udata) +{ + if (!insn->mem_only) { + plugin_register_dyn_cb__udata(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], + cb, flags, udata); + } +} + +void qemu_plugin_register_vcpu_insn_exec_inline(struct qemu_plugin_insn *insn, + enum qemu_plugin_op op, + void *ptr, uint64_t imm) +{ + if (!insn->mem_only) { + plugin_register_inline_op(&insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE], + 0, op, ptr, imm); + } +} + + +/* + * We always plant memory instrumentation because they don't finalise until + * after the operation has complete. + */ +void qemu_plugin_register_vcpu_mem_cb(struct qemu_plugin_insn *insn, + qemu_plugin_vcpu_mem_cb_t cb, + enum qemu_plugin_cb_flags flags, + enum qemu_plugin_mem_rw rw, + void *udata) +{ + plugin_register_vcpu_mem_cb(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], + cb, flags, rw, udata); +} + +void qemu_plugin_register_vcpu_mem_inline(struct qemu_plugin_insn *insn, + enum qemu_plugin_mem_rw rw, + enum qemu_plugin_op op, void *ptr, + uint64_t imm) +{ + plugin_register_inline_op(&insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE], + rw, op, ptr, imm); +} + +void qemu_plugin_register_vcpu_tb_trans_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_tb_trans_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_TB_TRANS, cb); +} + +void qemu_plugin_register_vcpu_syscall_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_syscall_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL, cb); +} + +void +qemu_plugin_register_vcpu_syscall_ret_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_syscall_ret_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_SYSCALL_RET, cb); +} + +/* + * Plugin Queries + * + * These are queries that the plugin can make to gauge information + * from our opaque data types. We do not want to leak internal details + * here just information useful to the plugin. + */ + +/* + * Translation block information: + * + * A plugin can query the virtual address of the start of the block + * and the number of instructions in it. It can also get access to + * each translated instruction. + */ + +size_t qemu_plugin_tb_n_insns(const struct qemu_plugin_tb *tb) +{ + return tb->n; +} + +uint64_t qemu_plugin_tb_vaddr(const struct qemu_plugin_tb *tb) +{ + return tb->vaddr; +} + +struct qemu_plugin_insn * +qemu_plugin_tb_get_insn(const struct qemu_plugin_tb *tb, size_t idx) +{ + struct qemu_plugin_insn *insn; + if (unlikely(idx >= tb->n)) { + return NULL; + } + insn = g_ptr_array_index(tb->insns, idx); + insn->mem_only = tb->mem_only; + return insn; +} + +/* + * Instruction information + * + * These queries allow the plugin to retrieve information about each + * instruction being translated. + */ + +const void *qemu_plugin_insn_data(const struct qemu_plugin_insn *insn) +{ + return insn->data->data; +} + +size_t qemu_plugin_insn_size(const struct qemu_plugin_insn *insn) +{ + return insn->data->len; +} + +uint64_t qemu_plugin_insn_vaddr(const struct qemu_plugin_insn *insn) +{ + return insn->vaddr; +} + +void *qemu_plugin_insn_haddr(const struct qemu_plugin_insn *insn) +{ + return insn->haddr; +} + +char *qemu_plugin_insn_disas(const struct qemu_plugin_insn *insn) +{ + CPUState *cpu = current_cpu; + return plugin_disas(cpu, insn->vaddr, insn->data->len); +} + +const char *qemu_plugin_insn_symbol(const struct qemu_plugin_insn *insn) +{ + const char *sym = lookup_symbol(insn->vaddr); + return sym[0] != 0 ? sym : NULL; +} + +/* + * The memory queries allow the plugin to query information about a + * memory access. + */ + +unsigned qemu_plugin_mem_size_shift(qemu_plugin_meminfo_t info) +{ + MemOp op = get_memop(info); + return op & MO_SIZE; +} + +bool qemu_plugin_mem_is_sign_extended(qemu_plugin_meminfo_t info) +{ + MemOp op = get_memop(info); + return op & MO_SIGN; +} + +bool qemu_plugin_mem_is_big_endian(qemu_plugin_meminfo_t info) +{ + MemOp op = get_memop(info); + return (op & MO_BSWAP) == MO_BE; +} + +bool qemu_plugin_mem_is_store(qemu_plugin_meminfo_t info) +{ + return get_plugin_meminfo_rw(info) & QEMU_PLUGIN_MEM_W; +} + +/* + * Virtual Memory queries + */ + +#ifdef CONFIG_SOFTMMU +static __thread struct qemu_plugin_hwaddr hwaddr_info; +#endif + +struct qemu_plugin_hwaddr *qemu_plugin_get_hwaddr(qemu_plugin_meminfo_t info, + uint64_t vaddr) +{ +#ifdef CONFIG_SOFTMMU + CPUState *cpu = current_cpu; + unsigned int mmu_idx = get_mmuidx(info); + enum qemu_plugin_mem_rw rw = get_plugin_meminfo_rw(info); + hwaddr_info.is_store = (rw & QEMU_PLUGIN_MEM_W) != 0; + + if (!tlb_plugin_lookup(cpu, vaddr, mmu_idx, + hwaddr_info.is_store, &hwaddr_info)) { + error_report("invalid use of qemu_plugin_get_hwaddr"); + return NULL; + } + + return &hwaddr_info; +#else + return NULL; +#endif +} + +bool qemu_plugin_hwaddr_is_io(const struct qemu_plugin_hwaddr *haddr) +{ +#ifdef CONFIG_SOFTMMU + return haddr->is_io; +#else + return false; +#endif +} + +uint64_t qemu_plugin_hwaddr_phys_addr(const struct qemu_plugin_hwaddr *haddr) +{ +#ifdef CONFIG_SOFTMMU + if (haddr) { + if (!haddr->is_io) { + RAMBlock *block; + ram_addr_t offset; + void *hostaddr = haddr->v.ram.hostaddr; + + block = qemu_ram_block_from_host(hostaddr, false, &offset); + if (!block) { + error_report("Bad host ram pointer %p", haddr->v.ram.hostaddr); + abort(); + } + + return block->offset + offset + block->mr->addr; + } else { + MemoryRegionSection *mrs = haddr->v.io.section; + return mrs->offset_within_address_space + haddr->v.io.offset; + } + } +#endif + return 0; +} + +const char *qemu_plugin_hwaddr_device_name(const struct qemu_plugin_hwaddr *h) +{ +#ifdef CONFIG_SOFTMMU + if (h && h->is_io) { + MemoryRegionSection *mrs = h->v.io.section; + if (!mrs->mr->name) { + unsigned long maddr = 0xffffffff & (uintptr_t) mrs->mr; + g_autofree char *temp = g_strdup_printf("anon%08lx", maddr); + return g_intern_string(temp); + } else { + return g_intern_string(mrs->mr->name); + } + } else { + return g_intern_static_string("RAM"); + } +#else + return g_intern_static_string("Invalid"); +#endif +} + +/* + * Queries to the number and potential maximum number of vCPUs there + * will be. This helps the plugin dimension per-vcpu arrays. + */ + +#ifndef CONFIG_USER_ONLY +static MachineState * get_ms(void) +{ + return MACHINE(qdev_get_machine()); +} +#endif + +int qemu_plugin_n_vcpus(void) +{ +#ifdef CONFIG_USER_ONLY + return -1; +#else + return get_ms()->smp.cpus; +#endif +} + +int qemu_plugin_n_max_vcpus(void) +{ +#ifdef CONFIG_USER_ONLY + return -1; +#else + return get_ms()->smp.max_cpus; +#endif +} + +/* + * Plugin output + */ +void qemu_plugin_outs(const char *string) +{ + qemu_log_mask(CPU_LOG_PLUGIN, "%s", string); +} + +bool qemu_plugin_bool_parse(const char *name, const char *value, bool *ret) +{ + return name && value && qapi_bool_parse(name, value, ret, NULL); +} diff --git a/plugins/core.c b/plugins/core.c new file mode 100644 index 000000000..792262da0 --- /dev/null +++ b/plugins/core.c @@ -0,0 +1,558 @@ +/* + * QEMU Plugin Core code + * + * This is the core code that deals with injecting instrumentation into the code + * + * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> + * Copyright (C) 2019, Linaro + * + * License: GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ +#include "qemu/osdep.h" +#include "qemu/error-report.h" +#include "qemu/config-file.h" +#include "qapi/error.h" +#include "qemu/lockable.h" +#include "qemu/option.h" +#include "qemu/rcu_queue.h" +#include "qemu/xxhash.h" +#include "qemu/rcu.h" +#include "hw/core/cpu.h" +#include "exec/cpu-common.h" + +#include "exec/exec-all.h" +#include "exec/helper-proto.h" +#include "tcg/tcg.h" +#include "tcg/tcg-op.h" +#include "plugin.h" +#include "qemu/compiler.h" + +struct qemu_plugin_cb { + struct qemu_plugin_ctx *ctx; + union qemu_plugin_cb_sig f; + void *udata; + QLIST_ENTRY(qemu_plugin_cb) entry; +}; + +struct qemu_plugin_state plugin; + +struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id) +{ + struct qemu_plugin_ctx *ctx; + qemu_plugin_id_t *id_p; + + id_p = g_hash_table_lookup(plugin.id_ht, &id); + ctx = container_of(id_p, struct qemu_plugin_ctx, id); + if (ctx == NULL) { + error_report("plugin: invalid plugin id %" PRIu64, id); + abort(); + } + return ctx; +} + +static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data) +{ + bitmap_copy(cpu->plugin_mask, &data.host_ulong, QEMU_PLUGIN_EV_MAX); + cpu_tb_jmp_cache_clear(cpu); +} + +static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata) +{ + CPUState *cpu = container_of(k, CPUState, cpu_index); + run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask); + + if (cpu->created) { + async_run_on_cpu(cpu, plugin_cpu_update__async, mask); + } else { + plugin_cpu_update__async(cpu, mask); + } +} + +void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, + enum qemu_plugin_event ev) +{ + struct qemu_plugin_cb *cb = ctx->callbacks[ev]; + + if (cb == NULL) { + return; + } + QLIST_REMOVE_RCU(cb, entry); + g_free(cb); + ctx->callbacks[ev] = NULL; + if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) { + clear_bit(ev, plugin.mask); + g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL); + } +} + +/* + * Disable CFI checks. + * The callback function has been loaded from an external library so we do not + * have type information + */ +QEMU_DISABLE_CFI +static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev) +{ + struct qemu_plugin_cb *cb, *next; + + switch (ev) { + case QEMU_PLUGIN_EV_VCPU_INIT: + case QEMU_PLUGIN_EV_VCPU_EXIT: + case QEMU_PLUGIN_EV_VCPU_IDLE: + case QEMU_PLUGIN_EV_VCPU_RESUME: + /* iterate safely; plugins might uninstall themselves at any time */ + QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { + qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple; + + func(cb->ctx->id, cpu->cpu_index); + } + break; + default: + g_assert_not_reached(); + } +} + +/* + * Disable CFI checks. + * The callback function has been loaded from an external library so we do not + * have type information + */ +QEMU_DISABLE_CFI +static void plugin_cb__simple(enum qemu_plugin_event ev) +{ + struct qemu_plugin_cb *cb, *next; + + switch (ev) { + case QEMU_PLUGIN_EV_FLUSH: + QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { + qemu_plugin_simple_cb_t func = cb->f.simple; + + func(cb->ctx->id); + } + break; + default: + g_assert_not_reached(); + } +} + +/* + * Disable CFI checks. + * The callback function has been loaded from an external library so we do not + * have type information + */ +QEMU_DISABLE_CFI +static void plugin_cb__udata(enum qemu_plugin_event ev) +{ + struct qemu_plugin_cb *cb, *next; + + switch (ev) { + case QEMU_PLUGIN_EV_ATEXIT: + QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { + qemu_plugin_udata_cb_t func = cb->f.udata; + + func(cb->ctx->id, cb->udata); + } + break; + default: + g_assert_not_reached(); + } +} + +static void +do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, + void *func, void *udata) +{ + struct qemu_plugin_ctx *ctx; + + QEMU_LOCK_GUARD(&plugin.lock); + ctx = plugin_id_to_ctx_locked(id); + /* if the plugin is on its way out, ignore this request */ + if (unlikely(ctx->uninstalling)) { + return; + } + if (func) { + struct qemu_plugin_cb *cb = ctx->callbacks[ev]; + + if (cb) { + cb->f.generic = func; + cb->udata = udata; + } else { + cb = g_new(struct qemu_plugin_cb, 1); + cb->ctx = ctx; + cb->f.generic = func; + cb->udata = udata; + ctx->callbacks[ev] = cb; + QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry); + if (!test_bit(ev, plugin.mask)) { + set_bit(ev, plugin.mask); + g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, + NULL); + } + } + } else { + plugin_unregister_cb__locked(ctx, ev); + } +} + +void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, + void *func) +{ + do_plugin_register_cb(id, ev, func, NULL); +} + +void +plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, + void *func, void *udata) +{ + do_plugin_register_cb(id, ev, func, udata); +} + +void qemu_plugin_vcpu_init_hook(CPUState *cpu) +{ + bool success; + + qemu_rec_mutex_lock(&plugin.lock); + plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL); + success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index, + &cpu->cpu_index); + g_assert(success); + qemu_rec_mutex_unlock(&plugin.lock); + + plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT); +} + +void qemu_plugin_vcpu_exit_hook(CPUState *cpu) +{ + bool success; + + plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT); + + qemu_rec_mutex_lock(&plugin.lock); + success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index); + g_assert(success); + qemu_rec_mutex_unlock(&plugin.lock); +} + +struct plugin_for_each_args { + struct qemu_plugin_ctx *ctx; + qemu_plugin_vcpu_simple_cb_t cb; +}; + +static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata) +{ + struct plugin_for_each_args *args = udata; + int cpu_index = *(int *)k; + + args->cb(args->ctx->id, cpu_index); +} + +void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id, + qemu_plugin_vcpu_simple_cb_t cb) +{ + struct plugin_for_each_args args; + + if (cb == NULL) { + return; + } + qemu_rec_mutex_lock(&plugin.lock); + args.ctx = plugin_id_to_ctx_locked(id); + args.cb = cb; + g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args); + qemu_rec_mutex_unlock(&plugin.lock); +} + +/* Allocate and return a callback record */ +static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr) +{ + GArray *cbs = *arr; + + if (!cbs) { + cbs = g_array_sized_new(false, false, + sizeof(struct qemu_plugin_dyn_cb), 1); + *arr = cbs; + } + + g_array_set_size(cbs, cbs->len + 1); + return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1); +} + +void plugin_register_inline_op(GArray **arr, + enum qemu_plugin_mem_rw rw, + enum qemu_plugin_op op, void *ptr, + uint64_t imm) +{ + struct qemu_plugin_dyn_cb *dyn_cb; + + dyn_cb = plugin_get_dyn_cb(arr); + dyn_cb->userp = ptr; + dyn_cb->type = PLUGIN_CB_INLINE; + dyn_cb->rw = rw; + dyn_cb->inline_insn.op = op; + dyn_cb->inline_insn.imm = imm; +} + +void plugin_register_dyn_cb__udata(GArray **arr, + qemu_plugin_vcpu_udata_cb_t cb, + enum qemu_plugin_cb_flags flags, + void *udata) +{ + struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr); + + dyn_cb->userp = udata; + /* Note flags are discarded as unused. */ + dyn_cb->f.vcpu_udata = cb; + dyn_cb->type = PLUGIN_CB_REGULAR; +} + +void plugin_register_vcpu_mem_cb(GArray **arr, + void *cb, + enum qemu_plugin_cb_flags flags, + enum qemu_plugin_mem_rw rw, + void *udata) +{ + struct qemu_plugin_dyn_cb *dyn_cb; + + dyn_cb = plugin_get_dyn_cb(arr); + dyn_cb->userp = udata; + /* Note flags are discarded as unused. */ + dyn_cb->type = PLUGIN_CB_REGULAR; + dyn_cb->rw = rw; + dyn_cb->f.generic = cb; +} + +/* + * Disable CFI checks. + * The callback function has been loaded from an external library so we do not + * have type information + */ +QEMU_DISABLE_CFI +void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb) +{ + struct qemu_plugin_cb *cb, *next; + enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS; + + /* no plugin_mask check here; caller should have checked */ + + QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { + qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans; + + func(cb->ctx->id, tb); + } +} + +/* + * Disable CFI checks. + * The callback function has been loaded from an external library so we do not + * have type information + */ +QEMU_DISABLE_CFI +void +qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2, + uint64_t a3, uint64_t a4, uint64_t a5, + uint64_t a6, uint64_t a7, uint64_t a8) +{ + struct qemu_plugin_cb *cb, *next; + enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL; + + if (!test_bit(ev, cpu->plugin_mask)) { + return; + } + + QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { + qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall; + + func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8); + } +} + +/* + * Disable CFI checks. + * The callback function has been loaded from an external library so we do not + * have type information + */ +QEMU_DISABLE_CFI +void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret) +{ + struct qemu_plugin_cb *cb, *next; + enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET; + + if (!test_bit(ev, cpu->plugin_mask)) { + return; + } + + QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) { + qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret; + + func(cb->ctx->id, cpu->cpu_index, num, ret); + } +} + +void qemu_plugin_vcpu_idle_cb(CPUState *cpu) +{ + plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE); +} + +void qemu_plugin_vcpu_resume_cb(CPUState *cpu) +{ + plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME); +} + +void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_simple_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb); +} + +void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id, + qemu_plugin_vcpu_simple_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb); +} + +void qemu_plugin_register_flush_cb(qemu_plugin_id_t id, + qemu_plugin_simple_cb_t cb) +{ + plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb); +} + +static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp) +{ + g_array_free((GArray *) p, true); + return true; +} + +void qemu_plugin_flush_cb(void) +{ + qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL); + qht_reset(&plugin.dyn_cb_arr_ht); + + plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH); +} + +void exec_inline_op(struct qemu_plugin_dyn_cb *cb) +{ + uint64_t *val = cb->userp; + + switch (cb->inline_insn.op) { + case QEMU_PLUGIN_INLINE_ADD_U64: + *val += cb->inline_insn.imm; + break; + default: + g_assert_not_reached(); + } +} + +void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr, + MemOpIdx oi, enum qemu_plugin_mem_rw rw) +{ + GArray *arr = cpu->plugin_mem_cbs; + size_t i; + + if (arr == NULL) { + return; + } + for (i = 0; i < arr->len; i++) { + struct qemu_plugin_dyn_cb *cb = + &g_array_index(arr, struct qemu_plugin_dyn_cb, i); + + if (!(rw & cb->rw)) { + break; + } + switch (cb->type) { + case PLUGIN_CB_REGULAR: + cb->f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw), + vaddr, cb->userp); + break; + case PLUGIN_CB_INLINE: + exec_inline_op(cb); + break; + default: + g_assert_not_reached(); + } + } +} + +void qemu_plugin_atexit_cb(void) +{ + plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT); +} + +void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id, + qemu_plugin_udata_cb_t cb, + void *udata) +{ + plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata); +} + +/* + * Handle exit from linux-user. Unlike the normal atexit() mechanism + * we need to handle the clean-up manually as it's possible threads + * are still running. We need to remove all callbacks from code + * generation, flush the current translations and then we can safely + * trigger the exit callbacks. + */ + +void qemu_plugin_user_exit(void) +{ + enum qemu_plugin_event ev; + CPUState *cpu; + + QEMU_LOCK_GUARD(&plugin.lock); + + start_exclusive(); + + /* un-register all callbacks except the final AT_EXIT one */ + for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { + if (ev != QEMU_PLUGIN_EV_ATEXIT) { + struct qemu_plugin_ctx *ctx; + QTAILQ_FOREACH(ctx, &plugin.ctxs, entry) { + plugin_unregister_cb__locked(ctx, ev); + } + } + } + + tb_flush(current_cpu); + + CPU_FOREACH(cpu) { + qemu_plugin_disable_mem_helpers(cpu); + } + + end_exclusive(); + + /* now it's safe to handle the exit case */ + qemu_plugin_atexit_cb(); +} + +/* + * Call this function after longjmp'ing to the main loop. It's possible that the + * last instruction of a TB might have used helpers, and therefore the + * "disable" instruction will never execute because it ended up as dead code. + */ +void qemu_plugin_disable_mem_helpers(CPUState *cpu) +{ + cpu->plugin_mem_cbs = NULL; +} + +static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp) +{ + return ap == bp; +} + +static void __attribute__((__constructor__)) plugin_init(void) +{ + int i; + + for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) { + QLIST_INIT(&plugin.cb_lists[i]); + } + qemu_rec_mutex_init(&plugin.lock); + plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal); + plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal); + QTAILQ_INIT(&plugin.ctxs); + qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16, + QHT_MODE_AUTO_RESIZE); + atexit(qemu_plugin_atexit_cb); +} diff --git a/plugins/loader.c b/plugins/loader.c new file mode 100644 index 000000000..a4ec28169 --- /dev/null +++ b/plugins/loader.c @@ -0,0 +1,421 @@ +/* + * QEMU Plugin Core Loader Code + * + * This is the code responsible for loading and unloading the plugins. + * Aside from the basic housekeeping tasks we also need to ensure any + * generated code is flushed when we remove a plugin so we cannot end + * up calling and unloaded helper function. + * + * Copyright (C) 2017, Emilio G. Cota <cota@braap.org> + * Copyright (C) 2019, Linaro + * + * License: GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "qemu/error-report.h" +#include "qemu/config-file.h" +#include "qapi/error.h" +#include "qemu/lockable.h" +#include "qemu/option.h" +#include "qemu/rcu_queue.h" +#include "qemu/qht.h" +#include "qemu/bitmap.h" +#include "qemu/xxhash.h" +#include "qemu/plugin.h" +#include "hw/core/cpu.h" +#include "exec/exec-all.h" +#ifndef CONFIG_USER_ONLY +#include "hw/boards.h" +#endif +#include "qemu/compiler.h" + +#include "plugin.h" + +/* + * For convenience we use a bitmap for plugin.mask, but really all we need is a + * u32, which is what we store in TranslationBlock. + */ +QEMU_BUILD_BUG_ON(QEMU_PLUGIN_EV_MAX > 32); + +struct qemu_plugin_desc { + char *path; + char **argv; + QTAILQ_ENTRY(qemu_plugin_desc) entry; + int argc; +}; + +struct qemu_plugin_parse_arg { + QemuPluginList *head; + struct qemu_plugin_desc *curr; +}; + +QemuOptsList qemu_plugin_opts = { + .name = "plugin", + .implied_opt_name = "file", + .head = QTAILQ_HEAD_INITIALIZER(qemu_plugin_opts.head), + .desc = { + /* do our own parsing to support multiple plugins */ + { /* end of list */ } + }, +}; + +typedef int (*qemu_plugin_install_func_t)(qemu_plugin_id_t, const qemu_info_t *, int, char **); + +extern struct qemu_plugin_state plugin; + +void qemu_plugin_add_dyn_cb_arr(GArray *arr) +{ + uint32_t hash = qemu_xxhash2((uint64_t)(uintptr_t)arr); + bool inserted; + + inserted = qht_insert(&plugin.dyn_cb_arr_ht, arr, hash, NULL); + g_assert(inserted); +} + +static struct qemu_plugin_desc *plugin_find_desc(QemuPluginList *head, + const char *path) +{ + struct qemu_plugin_desc *desc; + + QTAILQ_FOREACH(desc, head, entry) { + if (strcmp(desc->path, path) == 0) { + return desc; + } + } + return NULL; +} + +static int plugin_add(void *opaque, const char *name, const char *value, + Error **errp) +{ + struct qemu_plugin_parse_arg *arg = opaque; + struct qemu_plugin_desc *p; + bool is_on; + char *fullarg; + + if (strcmp(name, "file") == 0) { + if (strcmp(value, "") == 0) { + error_setg(errp, "requires a non-empty argument"); + return 1; + } + p = plugin_find_desc(arg->head, value); + if (p == NULL) { + p = g_new0(struct qemu_plugin_desc, 1); + p->path = g_strdup(value); + QTAILQ_INSERT_TAIL(arg->head, p, entry); + } + arg->curr = p; + } else { + if (arg->curr == NULL) { + error_setg(errp, "missing earlier '-plugin file=' option"); + return 1; + } + + if (g_strcmp0(name, "arg") == 0 && + !qapi_bool_parse(name, value, &is_on, NULL)) { + if (strchr(value, '=') == NULL) { + /* Will treat arg="argname" as "argname=on" */ + fullarg = g_strdup_printf("%s=%s", value, "on"); + } else { + fullarg = g_strdup_printf("%s", value); + } + warn_report("using 'arg=%s' is deprecated", value); + error_printf("Please use '%s' directly\n", fullarg); + } else { + fullarg = g_strdup_printf("%s=%s", name, value); + } + + p = arg->curr; + p->argc++; + p->argv = g_realloc_n(p->argv, p->argc, sizeof(char *)); + p->argv[p->argc - 1] = fullarg; + } + + return 0; +} + +void qemu_plugin_opt_parse(const char *optarg, QemuPluginList *head) +{ + struct qemu_plugin_parse_arg arg; + QemuOpts *opts; + + opts = qemu_opts_parse_noisily(qemu_find_opts("plugin"), optarg, true); + if (opts == NULL) { + exit(1); + } + arg.head = head; + arg.curr = NULL; + qemu_opt_foreach(opts, plugin_add, &arg, &error_fatal); + qemu_opts_del(opts); +} + +/* + * From: https://en.wikipedia.org/wiki/Xorshift + * This is faster than rand_r(), and gives us a wider range (RAND_MAX is only + * guaranteed to be >= INT_MAX). + */ +static uint64_t xorshift64star(uint64_t x) +{ + x ^= x >> 12; /* a */ + x ^= x << 25; /* b */ + x ^= x >> 27; /* c */ + return x * UINT64_C(2685821657736338717); +} + +/* + * Disable CFI checks. + * The install and version functions have been loaded from an external library + * so we do not have type information + */ +QEMU_DISABLE_CFI +static int plugin_load(struct qemu_plugin_desc *desc, const qemu_info_t *info, Error **errp) +{ + qemu_plugin_install_func_t install; + struct qemu_plugin_ctx *ctx; + gpointer sym; + int rc; + + ctx = qemu_memalign(qemu_dcache_linesize, sizeof(*ctx)); + memset(ctx, 0, sizeof(*ctx)); + ctx->desc = desc; + + ctx->handle = g_module_open(desc->path, G_MODULE_BIND_LOCAL); + if (ctx->handle == NULL) { + error_setg(errp, "Could not load plugin %s: %s", desc->path, g_module_error()); + goto err_dlopen; + } + + if (!g_module_symbol(ctx->handle, "qemu_plugin_install", &sym)) { + error_setg(errp, "Could not load plugin %s: %s", desc->path, g_module_error()); + goto err_symbol; + } + install = (qemu_plugin_install_func_t) sym; + /* symbol was found; it could be NULL though */ + if (install == NULL) { + error_setg(errp, "Could not load plugin %s: qemu_plugin_install is NULL", + desc->path); + goto err_symbol; + } + + if (!g_module_symbol(ctx->handle, "qemu_plugin_version", &sym)) { + error_setg(errp, "Could not load plugin %s: plugin does not declare API version %s", + desc->path, g_module_error()); + goto err_symbol; + } else { + int version = *(int *)sym; + if (version < QEMU_PLUGIN_MIN_VERSION) { + error_setg(errp, "Could not load plugin %s: plugin requires API version %d, but " + "this QEMU supports only a minimum version of %d", + desc->path, version, QEMU_PLUGIN_MIN_VERSION); + goto err_symbol; + } else if (version > QEMU_PLUGIN_VERSION) { + error_setg(errp, "Could not load plugin %s: plugin requires API version %d, but " + "this QEMU supports only up to version %d", + desc->path, version, QEMU_PLUGIN_VERSION); + goto err_symbol; + } + } + + qemu_rec_mutex_lock(&plugin.lock); + + /* find an unused random id with &ctx as the seed */ + ctx->id = (uint64_t)(uintptr_t)ctx; + for (;;) { + void *existing; + + ctx->id = xorshift64star(ctx->id); + existing = g_hash_table_lookup(plugin.id_ht, &ctx->id); + if (likely(existing == NULL)) { + bool success; + + success = g_hash_table_insert(plugin.id_ht, &ctx->id, &ctx->id); + g_assert(success); + break; + } + } + QTAILQ_INSERT_TAIL(&plugin.ctxs, ctx, entry); + ctx->installing = true; + rc = install(ctx->id, info, desc->argc, desc->argv); + ctx->installing = false; + if (rc) { + error_setg(errp, "Could not load plugin %s: qemu_plugin_install returned error code %d", + desc->path, rc); + /* + * we cannot rely on the plugin doing its own cleanup, so + * call a full uninstall if the plugin did not yet call it. + */ + if (!ctx->uninstalling) { + plugin_reset_uninstall(ctx->id, NULL, false); + } + } + + qemu_rec_mutex_unlock(&plugin.lock); + return rc; + + err_symbol: + g_module_close(ctx->handle); + err_dlopen: + qemu_vfree(ctx); + return 1; +} + +/* call after having removed @desc from the list */ +static void plugin_desc_free(struct qemu_plugin_desc *desc) +{ + int i; + + for (i = 0; i < desc->argc; i++) { + g_free(desc->argv[i]); + } + g_free(desc->argv); + g_free(desc->path); + g_free(desc); +} + +/** + * qemu_plugin_load_list - load a list of plugins + * @head: head of the list of descriptors of the plugins to be loaded + * + * Returns 0 if all plugins in the list are installed, !0 otherwise. + * + * Note: the descriptor of each successfully installed plugin is removed + * from the list given by @head. + */ +int qemu_plugin_load_list(QemuPluginList *head, Error **errp) +{ + struct qemu_plugin_desc *desc, *next; + g_autofree qemu_info_t *info = g_new0(qemu_info_t, 1); + + info->target_name = TARGET_NAME; + info->version.min = QEMU_PLUGIN_MIN_VERSION; + info->version.cur = QEMU_PLUGIN_VERSION; +#ifndef CONFIG_USER_ONLY + MachineState *ms = MACHINE(qdev_get_machine()); + info->system_emulation = true; + info->system.smp_vcpus = ms->smp.cpus; + info->system.max_vcpus = ms->smp.max_cpus; +#else + info->system_emulation = false; +#endif + + QTAILQ_FOREACH_SAFE(desc, head, entry, next) { + int err; + + err = plugin_load(desc, info, errp); + if (err) { + return err; + } + QTAILQ_REMOVE(head, desc, entry); + } + return 0; +} + +struct qemu_plugin_reset_data { + struct qemu_plugin_ctx *ctx; + qemu_plugin_simple_cb_t cb; + bool reset; +}; + +static void plugin_reset_destroy__locked(struct qemu_plugin_reset_data *data) +{ + struct qemu_plugin_ctx *ctx = data->ctx; + enum qemu_plugin_event ev; + bool success; + + /* + * After updating the subscription lists there is no need to wait for an RCU + * grace period to elapse, because right now we either are in a "safe async" + * work environment (i.e. all vCPUs are asleep), or no vCPUs have yet been + * created. + */ + for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) { + plugin_unregister_cb__locked(ctx, ev); + } + + if (data->reset) { + g_assert(ctx->resetting); + if (data->cb) { + data->cb(ctx->id); + } + ctx->resetting = false; + g_free(data); + return; + } + + g_assert(ctx->uninstalling); + /* we cannot dlclose if we are going to return to plugin code */ + if (ctx->installing) { + error_report("Calling qemu_plugin_uninstall from the install function " + "is a bug. Instead, return !0 from the install function."); + abort(); + } + + success = g_hash_table_remove(plugin.id_ht, &ctx->id); + g_assert(success); + QTAILQ_REMOVE(&plugin.ctxs, ctx, entry); + if (data->cb) { + data->cb(ctx->id); + } + if (!g_module_close(ctx->handle)) { + warn_report("%s: %s", __func__, g_module_error()); + } + plugin_desc_free(ctx->desc); + qemu_vfree(ctx); + g_free(data); +} + +static void plugin_reset_destroy(struct qemu_plugin_reset_data *data) +{ + qemu_rec_mutex_lock(&plugin.lock); + plugin_reset_destroy__locked(data); + qemu_rec_mutex_lock(&plugin.lock); +} + +static void plugin_flush_destroy(CPUState *cpu, run_on_cpu_data arg) +{ + struct qemu_plugin_reset_data *data = arg.host_ptr; + + g_assert(cpu_in_exclusive_context(cpu)); + tb_flush(cpu); + plugin_reset_destroy(data); +} + +void plugin_reset_uninstall(qemu_plugin_id_t id, + qemu_plugin_simple_cb_t cb, + bool reset) +{ + struct qemu_plugin_reset_data *data; + struct qemu_plugin_ctx *ctx; + + WITH_QEMU_LOCK_GUARD(&plugin.lock) { + ctx = plugin_id_to_ctx_locked(id); + if (ctx->uninstalling || (reset && ctx->resetting)) { + return; + } + ctx->resetting = reset; + ctx->uninstalling = !reset; + } + + data = g_new(struct qemu_plugin_reset_data, 1); + data->ctx = ctx; + data->cb = cb; + data->reset = reset; + /* + * Only flush the code cache if the vCPUs have been created. If so, + * current_cpu must be non-NULL. + */ + if (current_cpu) { + async_safe_run_on_cpu(current_cpu, plugin_flush_destroy, + RUN_ON_CPU_HOST_PTR(data)); + } else { + /* + * If current_cpu isn't set, then we don't have yet any vCPU threads + * and we therefore can remove the callbacks synchronously. + */ + plugin_reset_destroy(data); + } +} diff --git a/plugins/meson.build b/plugins/meson.build new file mode 100644 index 000000000..b3de57853 --- /dev/null +++ b/plugins/meson.build @@ -0,0 +1,15 @@ +plugin_ldflags = [] +# Modules need more symbols than just those in plugins/qemu-plugins.symbols +if not enable_modules + if 'CONFIG_HAS_LD_DYNAMIC_LIST' in config_host + plugin_ldflags = ['-Wl,--dynamic-list=qemu-plugins-ld.symbols'] + elif 'CONFIG_HAS_LD_EXPORTED_SYMBOLS_LIST' in config_host + plugin_ldflags = ['-Wl,-exported_symbols_list,qemu-plugins-ld64.symbols'] + endif +endif + +specific_ss.add(when: 'CONFIG_PLUGIN', if_true: [files( + 'loader.c', + 'core.c', + 'api.c', +), declare_dependency(link_args: plugin_ldflags)]) diff --git a/plugins/plugin.h b/plugins/plugin.h new file mode 100644 index 000000000..b13677d0d --- /dev/null +++ b/plugins/plugin.h @@ -0,0 +1,100 @@ +/* + * Plugin Shared Internal Functions + * + * Copyright (C) 2019, Linaro + * + * License: GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef PLUGIN_INTERNAL_H +#define PLUGIN_INTERNAL_H + +#include <gmodule.h> +#include "qemu/qht.h" + +#define QEMU_PLUGIN_MIN_VERSION 0 + +/* global state */ +struct qemu_plugin_state { + QTAILQ_HEAD(, qemu_plugin_ctx) ctxs; + QLIST_HEAD(, qemu_plugin_cb) cb_lists[QEMU_PLUGIN_EV_MAX]; + /* + * Use the HT as a hash map by inserting k == v, which saves memory as + * documented by GLib. The parent struct is obtained with container_of(). + */ + GHashTable *id_ht; + /* + * Use the HT as a hash map. Note that we could use a list here, + * but with the HT we avoid adding a field to CPUState. + */ + GHashTable *cpu_ht; + DECLARE_BITMAP(mask, QEMU_PLUGIN_EV_MAX); + /* + * @lock protects the struct as well as ctx->uninstalling. + * The lock must be acquired by all API ops. + * The lock is recursive, which greatly simplifies things, e.g. + * callback registration from qemu_plugin_vcpu_for_each(). + */ + QemuRecMutex lock; + /* + * HT of callbacks invoked from helpers. All entries are freed when + * the code cache is flushed. + */ + struct qht dyn_cb_arr_ht; +}; + + +struct qemu_plugin_ctx { + GModule *handle; + qemu_plugin_id_t id; + struct qemu_plugin_cb *callbacks[QEMU_PLUGIN_EV_MAX]; + QTAILQ_ENTRY(qemu_plugin_ctx) entry; + /* + * keep a reference to @desc until uninstall, so that plugins do not have + * to strdup plugin args. + */ + struct qemu_plugin_desc *desc; + bool installing; + bool uninstalling; + bool resetting; +}; + +struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id); + +void plugin_register_inline_op(GArray **arr, + enum qemu_plugin_mem_rw rw, + enum qemu_plugin_op op, void *ptr, + uint64_t imm); + +void plugin_reset_uninstall(qemu_plugin_id_t id, + qemu_plugin_simple_cb_t cb, + bool reset); + +void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev, + void *func); + +void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx, + enum qemu_plugin_event ev); + +void +plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev, + void *func, void *udata); + +void +plugin_register_dyn_cb__udata(GArray **arr, + qemu_plugin_vcpu_udata_cb_t cb, + enum qemu_plugin_cb_flags flags, void *udata); + + +void plugin_register_vcpu_mem_cb(GArray **arr, + void *cb, + enum qemu_plugin_cb_flags flags, + enum qemu_plugin_mem_rw rw, + void *udata); + +void exec_inline_op(struct qemu_plugin_dyn_cb *cb); + +#endif /* _PLUGIN_INTERNAL_H_ */ diff --git a/plugins/qemu-plugins.symbols b/plugins/qemu-plugins.symbols new file mode 100644 index 000000000..4834756ba --- /dev/null +++ b/plugins/qemu-plugins.symbols @@ -0,0 +1,41 @@ +{ + qemu_plugin_bool_parse; + qemu_plugin_get_hwaddr; + qemu_plugin_hwaddr_device_name; + qemu_plugin_hwaddr_is_io; + qemu_plugin_hwaddr_phys_addr; + qemu_plugin_insn_data; + qemu_plugin_insn_disas; + qemu_plugin_insn_haddr; + qemu_plugin_insn_size; + qemu_plugin_insn_symbol; + qemu_plugin_insn_vaddr; + qemu_plugin_mem_is_big_endian; + qemu_plugin_mem_is_sign_extended; + qemu_plugin_mem_is_store; + qemu_plugin_mem_size_shift; + qemu_plugin_n_max_vcpus; + qemu_plugin_n_vcpus; + qemu_plugin_outs; + qemu_plugin_register_atexit_cb; + qemu_plugin_register_flush_cb; + qemu_plugin_register_vcpu_exit_cb; + qemu_plugin_register_vcpu_idle_cb; + qemu_plugin_register_vcpu_init_cb; + qemu_plugin_register_vcpu_insn_exec_cb; + qemu_plugin_register_vcpu_insn_exec_inline; + qemu_plugin_register_vcpu_mem_cb; + qemu_plugin_register_vcpu_mem_inline; + qemu_plugin_register_vcpu_resume_cb; + qemu_plugin_register_vcpu_syscall_cb; + qemu_plugin_register_vcpu_syscall_ret_cb; + qemu_plugin_register_vcpu_tb_exec_cb; + qemu_plugin_register_vcpu_tb_exec_inline; + qemu_plugin_register_vcpu_tb_trans_cb; + qemu_plugin_reset; + qemu_plugin_tb_get_insn; + qemu_plugin_tb_n_insns; + qemu_plugin_tb_vaddr; + qemu_plugin_uninstall; + qemu_plugin_vcpu_for_each; +}; |