[thirdparty/qemu.git] / plugins / core.c

/*
 * QEMU Plugin Core code
 *
 * This is the core code that deals with injecting instrumentation into the code
 *
 * Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
 * Copyright (C) 2019, Linaro
 *
 * License: GNU GPL, version 2 or later.
 *   See the COPYING file in the top-level directory.
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */
#include "qemu/osdep.h"
#include "qemu/error-report.h"
#include "qemu/config-file.h"
#include "qapi/error.h"
#include "qemu/lockable.h"
#include "qemu/option.h"
#include "qemu/plugin.h"
#include "qemu/queue.h"
#include "qemu/rcu_queue.h"
#include "qemu/xxhash.h"
#include "qemu/rcu.h"
#include "hw/core/cpu.h"

#include "exec/exec-all.h"
#include "exec/tb-flush.h"
#include "tcg/tcg.h"
#include "tcg/tcg-op.h"
#include "plugin.h"

struct qemu_plugin_cb {
    struct qemu_plugin_ctx *ctx;
    union qemu_plugin_cb_sig f;
    void *udata;
    QLIST_ENTRY(qemu_plugin_cb) entry;
};

struct qemu_plugin_state plugin;

struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
{
    struct qemu_plugin_ctx *ctx;
    qemu_plugin_id_t *id_p;

    id_p = g_hash_table_lookup(plugin.id_ht, &id);
    ctx = container_of(id_p, struct qemu_plugin_ctx, id);
    if (ctx == NULL) {
        error_report("plugin: invalid plugin id %" PRIu64, id);
        abort();
    }
    return ctx;
}

static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
{
    bitmap_copy(cpu->plugin_state->event_mask,
                &data.host_ulong, QEMU_PLUGIN_EV_MAX);
    tcg_flush_jmp_cache(cpu);
}

static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
{
    CPUState *cpu = container_of(k, CPUState, cpu_index);
    run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);

    if (DEVICE(cpu)->realized) {
        async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
    } else {
        plugin_cpu_update__async(cpu, mask);
    }
}

void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
                                  enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb = ctx->callbacks[ev];

    if (cb == NULL) {
        return;
    }
    QLIST_REMOVE_RCU(cb, entry);
    g_free(cb);
    ctx->callbacks[ev] = NULL;
    if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
        clear_bit(ev, plugin.mask);
        g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
    }
}

/*
 * Disable CFI checks.
 * The callback function has been loaded from an external library so we do not
 * have type information
 */
QEMU_DISABLE_CFI
static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb, *next;

    switch (ev) {
    case QEMU_PLUGIN_EV_VCPU_INIT:
    case QEMU_PLUGIN_EV_VCPU_EXIT:
    case QEMU_PLUGIN_EV_VCPU_IDLE:
    case QEMU_PLUGIN_EV_VCPU_RESUME:
        /* iterate safely; plugins might uninstall themselves at any time */
        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
            qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;

            func(cb->ctx->id, cpu->cpu_index);
        }
        break;
    default:
        g_assert_not_reached();
    }
}

/*
 * Disable CFI checks.
 * The callback function has been loaded from an external library so we do not
 * have type information
 */
QEMU_DISABLE_CFI
static void plugin_cb__simple(enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb, *next;

    switch (ev) {
    case QEMU_PLUGIN_EV_FLUSH:
        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
            qemu_plugin_simple_cb_t func = cb->f.simple;

            func(cb->ctx->id);
        }
        break;
    default:
        g_assert_not_reached();
    }
}

/*
 * Disable CFI checks.
 * The callback function has been loaded from an external library so we do not
 * have type information
 */
QEMU_DISABLE_CFI
static void plugin_cb__udata(enum qemu_plugin_event ev)
{
    struct qemu_plugin_cb *cb, *next;

    switch (ev) {
    case QEMU_PLUGIN_EV_ATEXIT:
        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
            qemu_plugin_udata_cb_t func = cb->f.udata;

            func(cb->ctx->id, cb->udata);
        }
        break;
    default:
        g_assert_not_reached();
    }
}

static void
do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
                      void *func, void *udata)
{
    struct qemu_plugin_ctx *ctx;

    QEMU_LOCK_GUARD(&plugin.lock);
    ctx = plugin_id_to_ctx_locked(id);
    /* if the plugin is on its way out, ignore this request */
    if (unlikely(ctx->uninstalling)) {
        return;
    }
    if (func) {
        struct qemu_plugin_cb *cb = ctx->callbacks[ev];

        if (cb) {
            cb->f.generic = func;
            cb->udata = udata;
        } else {
            cb = g_new(struct qemu_plugin_cb, 1);
            cb->ctx = ctx;
            cb->f.generic = func;
            cb->udata = udata;
            ctx->callbacks[ev] = cb;
            QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
            if (!test_bit(ev, plugin.mask)) {
                set_bit(ev, plugin.mask);
                g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
                                     NULL);
            }
        }
    } else {
        plugin_unregister_cb__locked(ctx, ev);
    }
}

void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
                        void *func)
{
    do_plugin_register_cb(id, ev, func, NULL);
}

void
plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
                         void *func, void *udata)
{
    do_plugin_register_cb(id, ev, func, udata);
}

CPUPluginState *qemu_plugin_create_vcpu_state(void)
{
    return g_new0(CPUPluginState, 1);
}

static void plugin_grow_scoreboards__locked(CPUState *cpu)
{
    if (cpu->cpu_index < plugin.scoreboard_alloc_size) {
        return;
    }

    bool need_realloc = FALSE;
    while (cpu->cpu_index >= plugin.scoreboard_alloc_size) {
        plugin.scoreboard_alloc_size *= 2;
        need_realloc = TRUE;
    }


    if (!need_realloc || QLIST_EMPTY(&plugin.scoreboards)) {
        /* nothing to do, we just updated sizes for future scoreboards */
        return;
    }

    /* cpus must be stopped, as tb might still use an existing scoreboard. */
    start_exclusive();
    struct qemu_plugin_scoreboard *score;
    QLIST_FOREACH(score, &plugin.scoreboards, entry) {
        g_array_set_size(score->data, plugin.scoreboard_alloc_size);
    }
    /* force all tb to be flushed, as scoreboard pointers were changed. */
    tb_flush(cpu);
    end_exclusive();
}

void qemu_plugin_vcpu_init_hook(CPUState *cpu)
{
    bool success;

    qemu_rec_mutex_lock(&plugin.lock);
    plugin.num_vcpus = MAX(plugin.num_vcpus, cpu->cpu_index + 1);
    plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
    success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
                                  &cpu->cpu_index);
    g_assert(success);
    plugin_grow_scoreboards__locked(cpu);
    qemu_rec_mutex_unlock(&plugin.lock);

    plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
}

void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
{
    bool success;

    plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);

    qemu_rec_mutex_lock(&plugin.lock);
    success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
    g_assert(success);
    qemu_rec_mutex_unlock(&plugin.lock);
}

struct plugin_for_each_args {
    struct qemu_plugin_ctx *ctx;
    qemu_plugin_vcpu_simple_cb_t cb;
};

static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
{
    struct plugin_for_each_args *args = udata;
    int cpu_index = *(int *)k;

    args->cb(args->ctx->id, cpu_index);
}

void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
                               qemu_plugin_vcpu_simple_cb_t cb)
{
    struct plugin_for_each_args args;

    if (cb == NULL) {
        return;
    }
    qemu_rec_mutex_lock(&plugin.lock);
    args.ctx = plugin_id_to_ctx_locked(id);
    args.cb = cb;
    g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
    qemu_rec_mutex_unlock(&plugin.lock);
}

/* Allocate and return a callback record */
static struct qemu_plugin_dyn_cb *plugin_get_dyn_cb(GArray **arr)
{
    GArray *cbs = *arr;

    if (!cbs) {
        cbs = g_array_sized_new(false, true,
                                sizeof(struct qemu_plugin_dyn_cb), 1);
        *arr = cbs;
    }

    g_array_set_size(cbs, cbs->len + 1);
    return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
}

void plugin_register_inline_op_on_entry(GArray **arr,
                                        enum qemu_plugin_mem_rw rw,
                                        enum qemu_plugin_op op,
                                        qemu_plugin_u64 entry,
                                        uint64_t imm)
{
    struct qemu_plugin_dyn_cb *dyn_cb;

    dyn_cb = plugin_get_dyn_cb(arr);
    dyn_cb->userp = NULL;
    dyn_cb->type = PLUGIN_CB_INLINE;
    dyn_cb->rw = rw;
    dyn_cb->inline_insn.entry = entry;
    dyn_cb->inline_insn.op = op;
    dyn_cb->inline_insn.imm = imm;
}

void plugin_register_dyn_cb__udata(GArray **arr,
                                   qemu_plugin_vcpu_udata_cb_t cb,
                                   enum qemu_plugin_cb_flags flags,
                                   void *udata)
{
    static TCGHelperInfo info[3] = {
        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
        /*
         * Match qemu_plugin_vcpu_udata_cb_t:
         *   void (*)(uint32_t, void *)
         */
        [0 ... 2].typemask = (dh_typemask(void, 0) |
                              dh_typemask(i32, 1) |
                              dh_typemask(ptr, 2))
    };

    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
    dyn_cb->userp = udata;
    dyn_cb->type = PLUGIN_CB_REGULAR;
    dyn_cb->regular.f.vcpu_udata = cb;

    assert((unsigned)flags < ARRAY_SIZE(info));
    dyn_cb->regular.info = &info[flags];
}

void plugin_register_vcpu_mem_cb(GArray **arr,
                                 void *cb,
                                 enum qemu_plugin_cb_flags flags,
                                 enum qemu_plugin_mem_rw rw,
                                 void *udata)
{
    /*
     * Expect that the underlying type for enum qemu_plugin_meminfo_t
     * is either int32_t or uint32_t, aka int or unsigned int.
     */
    QEMU_BUILD_BUG_ON(
        !__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) &&
        !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));

    static TCGHelperInfo info[3] = {
        [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
        [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
        /*
         * Match qemu_plugin_vcpu_mem_cb_t:
         *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
         */
        [0 ... 2].typemask =
            (dh_typemask(void, 0) |
             dh_typemask(i32, 1) |
             (__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t)
              ? dh_typemask(i32, 2) : dh_typemask(s32, 2)) |
             dh_typemask(i64, 3) |
             dh_typemask(ptr, 4))
    };

    struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
    dyn_cb->userp = udata;
    dyn_cb->type = PLUGIN_CB_MEM_REGULAR;
    dyn_cb->rw = rw;
    dyn_cb->regular.f.vcpu_mem = cb;

    assert((unsigned)flags < ARRAY_SIZE(info));
    dyn_cb->regular.info = &info[flags];
}

/*
 * Disable CFI checks.
 * The callback function has been loaded from an external library so we do not
 * have type information
 */
QEMU_DISABLE_CFI
void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb)
{
    struct qemu_plugin_cb *cb, *next;
    enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;

    /* no plugin_mask check here; caller should have checked */

    QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
        qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;

        func(cb->ctx->id, tb);
    }
}

/*
 * Disable CFI checks.
 * The callback function has been loaded from an external library so we do not
 * have type information
 */
QEMU_DISABLE_CFI
void
qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
                         uint64_t a3, uint64_t a4, uint64_t a5,
                         uint64_t a6, uint64_t a7, uint64_t a8)
{
    struct qemu_plugin_cb *cb, *next;
    enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;

    if (!test_bit(ev, cpu->plugin_state->event_mask)) {
        return;
    }

    QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
        qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;

        func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
    }
}

/*
 * Disable CFI checks.
 * The callback function has been loaded from an external library so we do not
 * have type information
 */
QEMU_DISABLE_CFI
void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
{
    struct qemu_plugin_cb *cb, *next;
    enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;

    if (!test_bit(ev, cpu->plugin_state->event_mask)) {
        return;
    }

    QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
        qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;

        func(cb->ctx->id, cpu->cpu_index, num, ret);
    }
}

void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
{
    /* idle and resume cb may be called before init, ignore in this case */
    if (cpu->cpu_index < plugin.num_vcpus) {
        plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
    }
}

void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
{
    if (cpu->cpu_index < plugin.num_vcpus) {
        plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
    }
}

void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
                                       qemu_plugin_vcpu_simple_cb_t cb)
{
    plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
}

void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
                                         qemu_plugin_vcpu_simple_cb_t cb)
{
    plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
}

void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
                                   qemu_plugin_simple_cb_t cb)
{
    plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
}

static bool free_dyn_cb_arr(void *p, uint32_t h, void *userp)
{
    g_array_free((GArray *) p, true);
    return true;
}

void qemu_plugin_flush_cb(void)
{
    qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
    qht_reset(&plugin.dyn_cb_arr_ht);

    plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
}

void exec_inline_op(struct qemu_plugin_dyn_cb *cb, int cpu_index)
{
    char *ptr = cb->inline_insn.entry.score->data->data;
    size_t elem_size = g_array_get_element_size(
        cb->inline_insn.entry.score->data);
    size_t offset = cb->inline_insn.entry.offset;
    uint64_t *val = (uint64_t *)(ptr + offset + cpu_index * elem_size);

    switch (cb->inline_insn.op) {
    case QEMU_PLUGIN_INLINE_ADD_U64:
        *val += cb->inline_insn.imm;
        break;
    default:
        g_assert_not_reached();
    }
}

void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
                             MemOpIdx oi, enum qemu_plugin_mem_rw rw)
{
    GArray *arr = cpu->plugin_mem_cbs;
    size_t i;

    if (arr == NULL) {
        return;
    }
    for (i = 0; i < arr->len; i++) {
        struct qemu_plugin_dyn_cb *cb =
            &g_array_index(arr, struct qemu_plugin_dyn_cb, i);

        if (!(rw & cb->rw)) {
                break;
        }
        switch (cb->type) {
        case PLUGIN_CB_MEM_REGULAR:
            cb->regular.f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
                                   vaddr, cb->userp);
            break;
        case PLUGIN_CB_INLINE:
            exec_inline_op(cb, cpu->cpu_index);
            break;
        default:
            g_assert_not_reached();
        }
    }
}

void qemu_plugin_atexit_cb(void)
{
    plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
}

void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
                                    qemu_plugin_udata_cb_t cb,
                                    void *udata)
{
    plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
}

/*
 * Handle exit from linux-user. Unlike the normal atexit() mechanism
 * we need to handle the clean-up manually as it's possible threads
 * are still running. We need to remove all callbacks from code
 * generation, flush the current translations and then we can safely
 * trigger the exit callbacks.
 */

void qemu_plugin_user_exit(void)
{
    enum qemu_plugin_event ev;
    CPUState *cpu;

    /*
     * Locking order: we must acquire locks in an order that is consistent
     * with the one in fork_start(). That is:
     * - start_exclusive(), which acquires qemu_cpu_list_lock,
     *   must be called before acquiring plugin.lock.
     * - tb_flush(), which acquires mmap_lock(), must be called
     *   while plugin.lock is not held.
     */
    start_exclusive();

    qemu_rec_mutex_lock(&plugin.lock);
    /* un-register all callbacks except the final AT_EXIT one */
    for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) {
        if (ev != QEMU_PLUGIN_EV_ATEXIT) {
            struct qemu_plugin_cb *cb, *next;

            QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
                plugin_unregister_cb__locked(cb->ctx, ev);
            }
        }
    }
    CPU_FOREACH(cpu) {
        qemu_plugin_disable_mem_helpers(cpu);
    }
    qemu_rec_mutex_unlock(&plugin.lock);

    tb_flush(current_cpu);
    end_exclusive();

    /* now it's safe to handle the exit case */
    qemu_plugin_atexit_cb();
}

/*
 * Helpers for *-user to ensure locks are sane across fork() events.
 */

void qemu_plugin_user_prefork_lock(void)
{
    qemu_rec_mutex_lock(&plugin.lock);
}

void qemu_plugin_user_postfork(bool is_child)
{
    if (is_child) {
        /* should we just reset via plugin_init? */
        qemu_rec_mutex_init(&plugin.lock);
    } else {
        qemu_rec_mutex_unlock(&plugin.lock);
    }
}

static bool plugin_dyn_cb_arr_cmp(const void *ap, const void *bp)
{
    return ap == bp;
}

static void __attribute__((__constructor__)) plugin_init(void)
{
    int i;

    for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
        QLIST_INIT(&plugin.cb_lists[i]);
    }
    qemu_rec_mutex_init(&plugin.lock);
    plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
    plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
    QLIST_INIT(&plugin.scoreboards);
    plugin.scoreboard_alloc_size = 16; /* avoid frequent reallocation */
    QTAILQ_INIT(&plugin.ctxs);
    qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
             QHT_MODE_AUTO_RESIZE);
    atexit(qemu_plugin_atexit_cb);
}

int plugin_num_vcpus(void)
{
    return plugin.num_vcpus;
}

struct qemu_plugin_scoreboard *plugin_scoreboard_new(size_t element_size)
{
    struct qemu_plugin_scoreboard *score =
        g_malloc0(sizeof(struct qemu_plugin_scoreboard));
    score->data = g_array_new(FALSE, TRUE, element_size);
    g_array_set_size(score->data, plugin.scoreboard_alloc_size);

    qemu_rec_mutex_lock(&plugin.lock);
    QLIST_INSERT_HEAD(&plugin.scoreboards, score, entry);
    qemu_rec_mutex_unlock(&plugin.lock);

    return score;
}

void plugin_scoreboard_free(struct qemu_plugin_scoreboard *score)
{
    qemu_rec_mutex_lock(&plugin.lock);
    QLIST_REMOVE(score, entry);
    qemu_rec_mutex_unlock(&plugin.lock);

    g_array_free(score->data, TRUE);
    g_free(score);
}
Commit	Line	Data
54cb65d8 EC	1	/*
	2	* QEMU Plugin Core code
	3	*
	4	* This is the core code that deals with injecting instrumentation into the code
	5	*
	6	* Copyright (C) 2017, Emilio G. Cota <cota@braap.org>
	7	* Copyright (C) 2019, Linaro
	8	*
	9	* License: GNU GPL, version 2 or later.
	10	* See the COPYING file in the top-level directory.
	11	*
	12	* SPDX-License-Identifier: GPL-2.0-or-later
	13	*/
	14	#include "qemu/osdep.h"
	15	#include "qemu/error-report.h"
	16	#include "qemu/config-file.h"
	17	#include "qapi/error.h"
ac90871c	18	#include "qemu/lockable.h"
54cb65d8	19	#include "qemu/option.h"
c0061471	20	#include "qemu/plugin.h"
a3c2cf0b	21	#include "qemu/queue.h"
54cb65d8 EC	22	#include "qemu/rcu_queue.h"
	23	#include "qemu/xxhash.h"
	24	#include "qemu/rcu.h"
	25	#include "hw/core/cpu.h"
54cb65d8	26
54cb65d8	27	#include "exec/exec-all.h"
548c9609	28	#include "exec/tb-flush.h"
54cb65d8 EC	29	#include "tcg/tcg.h"
54cb65d8 EC	30	#include "tcg/tcg-op.h"
54cb65d8 EC	31	#include "plugin.h"
	32
	33	struct qemu_plugin_cb {
	34	struct qemu_plugin_ctx *ctx;
	35	union qemu_plugin_cb_sig f;
	36	void *udata;
	37	QLIST_ENTRY(qemu_plugin_cb) entry;
	38	};
	39
	40	struct qemu_plugin_state plugin;
	41
	42	struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
	43	{
	44	struct qemu_plugin_ctx *ctx;
	45	qemu_plugin_id_t *id_p;
	46
	47	id_p = g_hash_table_lookup(plugin.id_ht, &id);
	48	ctx = container_of(id_p, struct qemu_plugin_ctx, id);
	49	if (ctx == NULL) {
	50	error_report("plugin: invalid plugin id %" PRIu64, id);
	51	abort();
	52	}
	53	return ctx;
	54	}
	55
	56	static void plugin_cpu_update__async(CPUState *cpu, run_on_cpu_data data)
	57	{
c0061471 AB	58	bitmap_copy(cpu->plugin_state->event_mask,
c0061471 AB	59	&data.host_ulong, QEMU_PLUGIN_EV_MAX);
a976a99a	60	tcg_flush_jmp_cache(cpu);
54cb65d8 EC	61	}
	62
	63	static void plugin_cpu_update__locked(gpointer k, gpointer v, gpointer udata)
	64	{
	65	CPUState *cpu = container_of(k, CPUState, cpu_index);
	66	run_on_cpu_data mask = RUN_ON_CPU_HOST_ULONG(*plugin.mask);
	67
fb13735a	68	if (DEVICE(cpu)->realized) {
54cb65d8 EC	69	async_run_on_cpu(cpu, plugin_cpu_update__async, mask);
	70	} else {
	71	plugin_cpu_update__async(cpu, mask);
	72	}
	73	}
	74
	75	void plugin_unregister_cb__locked(struct qemu_plugin_ctx *ctx,
	76	enum qemu_plugin_event ev)
	77	{
	78	struct qemu_plugin_cb *cb = ctx->callbacks[ev];
	79
	80	if (cb == NULL) {
	81	return;
	82	}
	83	QLIST_REMOVE_RCU(cb, entry);
	84	g_free(cb);
	85	ctx->callbacks[ev] = NULL;
	86	if (QLIST_EMPTY_RCU(&plugin.cb_lists[ev])) {
	87	clear_bit(ev, plugin.mask);
	88	g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked, NULL);
	89	}
	90	}
	91
c905a368 DB	92	/*
	93	* Disable CFI checks.
	94	* The callback function has been loaded from an external library so we do not
	95	* have type information
	96	*/
	97	QEMU_DISABLE_CFI
54cb65d8 EC	98	static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
	99	{
	100	struct qemu_plugin_cb cb, next;
	101
	102	switch (ev) {
	103	case QEMU_PLUGIN_EV_VCPU_INIT:
	104	case QEMU_PLUGIN_EV_VCPU_EXIT:
	105	case QEMU_PLUGIN_EV_VCPU_IDLE:
	106	case QEMU_PLUGIN_EV_VCPU_RESUME:
	107	/* iterate safely; plugins might uninstall themselves at any time */
	108	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	109	qemu_plugin_vcpu_simple_cb_t func = cb->f.vcpu_simple;
	110
	111	func(cb->ctx->id, cpu->cpu_index);
	112	}
	113	break;
	114	default:
	115	g_assert_not_reached();
	116	}
	117	}
	118
c905a368 DB	119	/*
	120	* Disable CFI checks.
	121	* The callback function has been loaded from an external library so we do not
	122	* have type information
	123	*/
	124	QEMU_DISABLE_CFI
54cb65d8 EC	125	static void plugin_cb__simple(enum qemu_plugin_event ev)
	126	{
	127	struct qemu_plugin_cb cb, next;
	128
	129	switch (ev) {
	130	case QEMU_PLUGIN_EV_FLUSH:
	131	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	132	qemu_plugin_simple_cb_t func = cb->f.simple;
	133
	134	func(cb->ctx->id);
	135	}
	136	break;
	137	default:
	138	g_assert_not_reached();
	139	}
	140	}
	141
c905a368 DB	142	/*
	143	* Disable CFI checks.
	144	* The callback function has been loaded from an external library so we do not
	145	* have type information
	146	*/
	147	QEMU_DISABLE_CFI
54cb65d8 EC	148	static void plugin_cb__udata(enum qemu_plugin_event ev)
	149	{
	150	struct qemu_plugin_cb cb, next;
	151
	152	switch (ev) {
	153	case QEMU_PLUGIN_EV_ATEXIT:
	154	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	155	qemu_plugin_udata_cb_t func = cb->f.udata;
	156
	157	func(cb->ctx->id, cb->udata);
	158	}
	159	break;
	160	default:
	161	g_assert_not_reached();
	162	}
	163	}
	164
	165	static void
	166	do_plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
	167	void func, void udata)
	168	{
	169	struct qemu_plugin_ctx *ctx;
	170
ac90871c	171	QEMU_LOCK_GUARD(&plugin.lock);
54cb65d8 EC	172	ctx = plugin_id_to_ctx_locked(id);
	173	/* if the plugin is on its way out, ignore this request */
	174	if (unlikely(ctx->uninstalling)) {
ac90871c	175	return;
54cb65d8 EC	176	}
	177	if (func) {
	178	struct qemu_plugin_cb *cb = ctx->callbacks[ev];
	179
	180	if (cb) {
	181	cb->f.generic = func;
	182	cb->udata = udata;
	183	} else {
	184	cb = g_new(struct qemu_plugin_cb, 1);
	185	cb->ctx = ctx;
	186	cb->f.generic = func;
	187	cb->udata = udata;
	188	ctx->callbacks[ev] = cb;
	189	QLIST_INSERT_HEAD_RCU(&plugin.cb_lists[ev], cb, entry);
	190	if (!test_bit(ev, plugin.mask)) {
	191	set_bit(ev, plugin.mask);
	192	g_hash_table_foreach(plugin.cpu_ht, plugin_cpu_update__locked,
	193	NULL);
	194	}
	195	}
	196	} else {
	197	plugin_unregister_cb__locked(ctx, ev);
	198	}
54cb65d8 EC	199	}
	200
	201	void plugin_register_cb(qemu_plugin_id_t id, enum qemu_plugin_event ev,
	202	void *func)
	203	{
	204	do_plugin_register_cb(id, ev, func, NULL);
	205	}
	206
	207	void
	208	plugin_register_cb_udata(qemu_plugin_id_t id, enum qemu_plugin_event ev,
	209	void func, void udata)
	210	{
	211	do_plugin_register_cb(id, ev, func, udata);
	212	}
	213
c0061471 AB	214	CPUPluginState *qemu_plugin_create_vcpu_state(void)
	215	{
	216	return g_new0(CPUPluginState, 1);
	217	}
	218
a3c2cf0b PB	219	static void plugin_grow_scoreboards__locked(CPUState *cpu)
	220	{
	221	if (cpu->cpu_index < plugin.scoreboard_alloc_size) {
	222	return;
	223	}
	224
	225	bool need_realloc = FALSE;
	226	while (cpu->cpu_index >= plugin.scoreboard_alloc_size) {
	227	plugin.scoreboard_alloc_size *= 2;
	228	need_realloc = TRUE;
	229	}
	230
	231
	232	if (!need_realloc \|\| QLIST_EMPTY(&plugin.scoreboards)) {
	233	/* nothing to do, we just updated sizes for future scoreboards */
	234	return;
	235	}
	236
	237	/* cpus must be stopped, as tb might still use an existing scoreboard. */
	238	start_exclusive();
	239	struct qemu_plugin_scoreboard *score;
	240	QLIST_FOREACH(score, &plugin.scoreboards, entry) {
	241	g_array_set_size(score->data, plugin.scoreboard_alloc_size);
	242	}
	243	/* force all tb to be flushed, as scoreboard pointers were changed. */
	244	tb_flush(cpu);
	245	end_exclusive();
	246	}
	247
54cb65d8 EC	248	void qemu_plugin_vcpu_init_hook(CPUState *cpu)
	249	{
	250	bool success;
	251
	252	qemu_rec_mutex_lock(&plugin.lock);
4a448b14	253	plugin.num_vcpus = MAX(plugin.num_vcpus, cpu->cpu_index + 1);
54cb65d8 EC	254	plugin_cpu_update__locked(&cpu->cpu_index, NULL, NULL);
	255	success = g_hash_table_insert(plugin.cpu_ht, &cpu->cpu_index,
	256	&cpu->cpu_index);
	257	g_assert(success);
a3c2cf0b	258	plugin_grow_scoreboards__locked(cpu);
54cb65d8 EC	259	qemu_rec_mutex_unlock(&plugin.lock);
	260
	261	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_INIT);
	262	}
	263
	264	void qemu_plugin_vcpu_exit_hook(CPUState *cpu)
	265	{
	266	bool success;
	267
	268	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_EXIT);
	269
	270	qemu_rec_mutex_lock(&plugin.lock);
	271	success = g_hash_table_remove(plugin.cpu_ht, &cpu->cpu_index);
	272	g_assert(success);
	273	qemu_rec_mutex_unlock(&plugin.lock);
	274	}
	275
	276	struct plugin_for_each_args {
	277	struct qemu_plugin_ctx *ctx;
	278	qemu_plugin_vcpu_simple_cb_t cb;
	279	};
	280
	281	static void plugin_vcpu_for_each(gpointer k, gpointer v, gpointer udata)
	282	{
	283	struct plugin_for_each_args *args = udata;
	284	int cpu_index = (int )k;
	285
	286	args->cb(args->ctx->id, cpu_index);
	287	}
	288
	289	void qemu_plugin_vcpu_for_each(qemu_plugin_id_t id,
	290	qemu_plugin_vcpu_simple_cb_t cb)
	291	{
	292	struct plugin_for_each_args args;
	293
	294	if (cb == NULL) {
	295	return;
	296	}
	297	qemu_rec_mutex_lock(&plugin.lock);
	298	args.ctx = plugin_id_to_ctx_locked(id);
	299	args.cb = cb;
	300	g_hash_table_foreach(plugin.cpu_ht, plugin_vcpu_for_each, &args);
	301	qemu_rec_mutex_unlock(&plugin.lock);
	302	}
	303
	304	/* Allocate and return a callback record */
	305	static struct qemu_plugin_dyn_cb plugin_get_dyn_cb(GArray *arr)
	306	{
	307	GArray cbs = arr;
	308
	309	if (!cbs) {
25875fe9	310	cbs = g_array_sized_new(false, true,
54cb65d8 EC	311	sizeof(struct qemu_plugin_dyn_cb), 1);
	312	*arr = cbs;
	313	}
	314
	315	g_array_set_size(cbs, cbs->len + 1);
	316	return &g_array_index(cbs, struct qemu_plugin_dyn_cb, cbs->len - 1);
	317	}
	318
0bcebaba PB	319	void plugin_register_inline_op_on_entry(GArray **arr,
	320	enum qemu_plugin_mem_rw rw,
	321	enum qemu_plugin_op op,
	322	qemu_plugin_u64 entry,
	323	uint64_t imm)
	324	{
	325	struct qemu_plugin_dyn_cb *dyn_cb;
	326
	327	dyn_cb = plugin_get_dyn_cb(arr);
	328	dyn_cb->userp = NULL;
	329	dyn_cb->type = PLUGIN_CB_INLINE;
	330	dyn_cb->rw = rw;
	331	dyn_cb->inline_insn.entry = entry;
	332	dyn_cb->inline_insn.op = op;
	333	dyn_cb->inline_insn.imm = imm;
	334	}
	335
c7bb41b4 RH	336	void plugin_register_dyn_cb__udata(GArray **arr,
	337	qemu_plugin_vcpu_udata_cb_t cb,
	338	enum qemu_plugin_cb_flags flags,
	339	void *udata)
54cb65d8	340	{
c7ba9483	341	static TCGHelperInfo info[3] = {
b0748975 RH	342	[QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
b0748975 RH	343	[QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
c7ba9483 RH	344	/*
	345	* Match qemu_plugin_vcpu_udata_cb_t:
	346	* void ()(uint32_t, void )
	347	*/
	348	[0 ... 2].typemask = (dh_typemask(void, 0) \|
	349	dh_typemask(i32, 1) \|
	350	dh_typemask(ptr, 2))
	351	};
54cb65d8	352
c7ba9483	353	struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
54cb65d8	354	dyn_cb->userp = udata;
54cb65d8	355	dyn_cb->type = PLUGIN_CB_REGULAR;
c7ba9483 RH	356	dyn_cb->regular.f.vcpu_udata = cb;
	357
	358	assert((unsigned)flags < ARRAY_SIZE(info));
	359	dyn_cb->regular.info = &info[flags];
54cb65d8 EC	360	}
	361
	362	void plugin_register_vcpu_mem_cb(GArray **arr,
	363	void *cb,
	364	enum qemu_plugin_cb_flags flags,
	365	enum qemu_plugin_mem_rw rw,
	366	void *udata)
	367	{
c7ba9483 RH	368	/*
	369	* Expect that the underlying type for enum qemu_plugin_meminfo_t
	370	* is either int32_t or uint32_t, aka int or unsigned int.
	371	*/
	372	QEMU_BUILD_BUG_ON(
	373	!__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) &&
	374	!__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));
	375
	376	static TCGHelperInfo info[3] = {
b0748975 RH	377	[QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
b0748975 RH	378	[QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
c7ba9483 RH	379	/*
	380	* Match qemu_plugin_vcpu_mem_cb_t:
	381	* void ()(uint32_t, qemu_plugin_meminfo_t, uint64_t, void )
	382	*/
	383	[0 ... 2].typemask =
	384	(dh_typemask(void, 0) \|
	385	dh_typemask(i32, 1) \|
	386	(__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t)
	387	? dh_typemask(i32, 2) : dh_typemask(s32, 2)) \|
	388	dh_typemask(i64, 3) \|
	389	dh_typemask(ptr, 4))
	390	};
54cb65d8	391
c7ba9483	392	struct qemu_plugin_dyn_cb *dyn_cb = plugin_get_dyn_cb(arr);
54cb65d8	393	dyn_cb->userp = udata;
ccd8f17e	394	dyn_cb->type = PLUGIN_CB_MEM_REGULAR;
54cb65d8	395	dyn_cb->rw = rw;
aff56de5	396	dyn_cb->regular.f.vcpu_mem = cb;
c7ba9483 RH	397
	398	assert((unsigned)flags < ARRAY_SIZE(info));
	399	dyn_cb->regular.info = &info[flags];
54cb65d8 EC	400	}
54cb65d8 EC	401
c905a368 DB	402	/*
	403	* Disable CFI checks.
	404	* The callback function has been loaded from an external library so we do not
	405	* have type information
	406	*/
	407	QEMU_DISABLE_CFI
54cb65d8 EC	408	void qemu_plugin_tb_trans_cb(CPUState cpu, struct qemu_plugin_tb tb)
	409	{
	410	struct qemu_plugin_cb cb, next;
	411	enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_TB_TRANS;
	412
	413	/* no plugin_mask check here; caller should have checked */
	414
	415	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	416	qemu_plugin_vcpu_tb_trans_cb_t func = cb->f.vcpu_tb_trans;
	417
	418	func(cb->ctx->id, tb);
	419	}
	420	}
	421
c905a368 DB	422	/*
	423	* Disable CFI checks.
	424	* The callback function has been loaded from an external library so we do not
	425	* have type information
	426	*/
	427	QEMU_DISABLE_CFI
54cb65d8 EC	428	void
	429	qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
	430	uint64_t a3, uint64_t a4, uint64_t a5,
	431	uint64_t a6, uint64_t a7, uint64_t a8)
	432	{
	433	struct qemu_plugin_cb cb, next;
	434	enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL;
	435
c0061471	436	if (!test_bit(ev, cpu->plugin_state->event_mask)) {
54cb65d8 EC	437	return;
	438	}
	439
	440	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	441	qemu_plugin_vcpu_syscall_cb_t func = cb->f.vcpu_syscall;
	442
	443	func(cb->ctx->id, cpu->cpu_index, num, a1, a2, a3, a4, a5, a6, a7, a8);
	444	}
	445	}
	446
c905a368 DB	447	/*
	448	* Disable CFI checks.
	449	* The callback function has been loaded from an external library so we do not
	450	* have type information
	451	*/
	452	QEMU_DISABLE_CFI
54cb65d8 EC	453	void qemu_plugin_vcpu_syscall_ret(CPUState *cpu, int64_t num, int64_t ret)
	454	{
	455	struct qemu_plugin_cb cb, next;
	456	enum qemu_plugin_event ev = QEMU_PLUGIN_EV_VCPU_SYSCALL_RET;
	457
c0061471	458	if (!test_bit(ev, cpu->plugin_state->event_mask)) {
54cb65d8 EC	459	return;
	460	}
	461
	462	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	463	qemu_plugin_vcpu_syscall_ret_cb_t func = cb->f.vcpu_syscall_ret;
	464
	465	func(cb->ctx->id, cpu->cpu_index, num, ret);
	466	}
	467	}
	468
	469	void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
	470	{
c490e681 PB	471	/* idle and resume cb may be called before init, ignore in this case */
	472	if (cpu->cpu_index < plugin.num_vcpus) {
	473	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_IDLE);
	474	}
54cb65d8 EC	475	}
	476
	477	void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
	478	{
c490e681 PB	479	if (cpu->cpu_index < plugin.num_vcpus) {
	480	plugin_vcpu_cb__simple(cpu, QEMU_PLUGIN_EV_VCPU_RESUME);
	481	}
54cb65d8 EC	482	}
	483
	484	void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
	485	qemu_plugin_vcpu_simple_cb_t cb)
	486	{
	487	plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_IDLE, cb);
	488	}
	489
	490	void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
	491	qemu_plugin_vcpu_simple_cb_t cb)
	492	{
	493	plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
	494	}
	495
	496	void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
	497	qemu_plugin_simple_cb_t cb)
	498	{
	499	plugin_register_cb(id, QEMU_PLUGIN_EV_FLUSH, cb);
	500	}
	501
	502	static bool free_dyn_cb_arr(void p, uint32_t h, void userp)
	503	{
	504	g_array_free((GArray *) p, true);
	505	return true;
	506	}
	507
	508	void qemu_plugin_flush_cb(void)
	509	{
	510	qht_iter_remove(&plugin.dyn_cb_arr_ht, free_dyn_cb_arr, NULL);
	511	qht_reset(&plugin.dyn_cb_arr_ht);
	512
	513	plugin_cb__simple(QEMU_PLUGIN_EV_FLUSH);
	514	}
	515
62f92b8d	516	void exec_inline_op(struct qemu_plugin_dyn_cb *cb, int cpu_index)
54cb65d8	517	{
3077be25 PB	518	char *ptr = cb->inline_insn.entry.score->data->data;
	519	size_t elem_size = g_array_get_element_size(
	520	cb->inline_insn.entry.score->data);
	521	size_t offset = cb->inline_insn.entry.offset;
62f92b8d	522	uint64_t val = (uint64_t )(ptr + offset + cpu_index * elem_size);
54cb65d8 EC	523
	524	switch (cb->inline_insn.op) {
	525	case QEMU_PLUGIN_INLINE_ADD_U64:
	526	*val += cb->inline_insn.imm;
	527	break;
	528	default:
	529	g_assert_not_reached();
	530	}
	531	}
	532
37aff087 RH	533	void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
37aff087 RH	534	MemOpIdx oi, enum qemu_plugin_mem_rw rw)
54cb65d8 EC	535	{
	536	GArray *arr = cpu->plugin_mem_cbs;
	537	size_t i;
	538
	539	if (arr == NULL) {
	540	return;
	541	}
	542	for (i = 0; i < arr->len; i++) {
	543	struct qemu_plugin_dyn_cb *cb =
	544	&g_array_index(arr, struct qemu_plugin_dyn_cb, i);
54cb65d8	545
37aff087	546	if (!(rw & cb->rw)) {
54cb65d8 EC	547	break;
	548	}
	549	switch (cb->type) {
ccd8f17e	550	case PLUGIN_CB_MEM_REGULAR:
aff56de5 RH	551	cb->regular.f.vcpu_mem(cpu->cpu_index, make_plugin_meminfo(oi, rw),
aff56de5 RH	552	vaddr, cb->userp);
54cb65d8 EC	553	break;
54cb65d8 EC	554	case PLUGIN_CB_INLINE:
62f92b8d	555	exec_inline_op(cb, cpu->cpu_index);
54cb65d8 EC	556	break;
	557	default:
	558	g_assert_not_reached();
	559	}
	560	}
	561	}
	562
	563	void qemu_plugin_atexit_cb(void)
	564	{
	565	plugin_cb__udata(QEMU_PLUGIN_EV_ATEXIT);
	566	}
	567
	568	void qemu_plugin_register_atexit_cb(qemu_plugin_id_t id,
	569	qemu_plugin_udata_cb_t cb,
	570	void *udata)
	571	{
	572	plugin_register_cb_udata(id, QEMU_PLUGIN_EV_ATEXIT, cb, udata);
	573	}
	574
f7e68c9c AB	575	/*
	576	* Handle exit from linux-user. Unlike the normal atexit() mechanism
	577	* we need to handle the clean-up manually as it's possible threads
	578	* are still running. We need to remove all callbacks from code
	579	* generation, flush the current translations and then we can safely
	580	* trigger the exit callbacks.
	581	*/
	582
	583	void qemu_plugin_user_exit(void)
	584	{
	585	enum qemu_plugin_event ev;
	586	CPUState *cpu;
	587
2bbbc1be EC	588	/*
	589	* Locking order: we must acquire locks in an order that is consistent
	590	* with the one in fork_start(). That is:
	591	* - start_exclusive(), which acquires qemu_cpu_list_lock,
	592	* must be called before acquiring plugin.lock.
	593	* - tb_flush(), which acquires mmap_lock(), must be called
	594	* while plugin.lock is not held.
	595	*/
f7e68c9c AB	596	start_exclusive();
f7e68c9c AB	597
2bbbc1be	598	qemu_rec_mutex_lock(&plugin.lock);
f7e68c9c AB	599	/* un-register all callbacks except the final AT_EXIT one */
	600	for (ev = 0; ev < QEMU_PLUGIN_EV_MAX; ev++) {
	601	if (ev != QEMU_PLUGIN_EV_ATEXIT) {
f4554923 RH	602	struct qemu_plugin_cb cb, next;
	603
	604	QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
	605	plugin_unregister_cb__locked(cb->ctx, ev);
f7e68c9c AB	606	}
	607	}
	608	}
f7e68c9c AB	609	CPU_FOREACH(cpu) {
	610	qemu_plugin_disable_mem_helpers(cpu);
	611	}
2bbbc1be	612	qemu_rec_mutex_unlock(&plugin.lock);
f7e68c9c	613
2bbbc1be	614	tb_flush(current_cpu);
f7e68c9c AB	615	end_exclusive();
	616
	617	/* now it's safe to handle the exit case */
	618	qemu_plugin_atexit_cb();
	619	}
	620
f7e15aff AB	621	/*
	622	* Helpers for *-user to ensure locks are sane across fork() events.
	623	*/
	624
	625	void qemu_plugin_user_prefork_lock(void)
	626	{
	627	qemu_rec_mutex_lock(&plugin.lock);
	628	}
	629
	630	void qemu_plugin_user_postfork(bool is_child)
	631	{
	632	if (is_child) {
	633	/* should we just reset via plugin_init? */
	634	qemu_rec_mutex_init(&plugin.lock);
	635	} else {
	636	qemu_rec_mutex_unlock(&plugin.lock);
	637	}
	638	}
	639
54cb65d8 EC	640	static bool plugin_dyn_cb_arr_cmp(const void ap, const void bp)
	641	{
	642	return ap == bp;
	643	}
	644
	645	static void __attribute__((__constructor__)) plugin_init(void)
	646	{
	647	int i;
	648
	649	for (i = 0; i < QEMU_PLUGIN_EV_MAX; i++) {
	650	QLIST_INIT(&plugin.cb_lists[i]);
	651	}
	652	qemu_rec_mutex_init(&plugin.lock);
	653	plugin.id_ht = g_hash_table_new(g_int64_hash, g_int64_equal);
	654	plugin.cpu_ht = g_hash_table_new(g_int_hash, g_int_equal);
a3c2cf0b PB	655	QLIST_INIT(&plugin.scoreboards);
a3c2cf0b PB	656	plugin.scoreboard_alloc_size = 16; /* avoid frequent reallocation */
54cb65d8 EC	657	QTAILQ_INIT(&plugin.ctxs);
	658	qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
	659	QHT_MODE_AUTO_RESIZE);
	660	atexit(qemu_plugin_atexit_cb);
	661	}
4a448b14 PB	662
	663	int plugin_num_vcpus(void)
	664	{
	665	return plugin.num_vcpus;
	666	}
a3c2cf0b PB	667
	668	struct qemu_plugin_scoreboard *plugin_scoreboard_new(size_t element_size)
	669	{
	670	struct qemu_plugin_scoreboard *score =
	671	g_malloc0(sizeof(struct qemu_plugin_scoreboard));
	672	score->data = g_array_new(FALSE, TRUE, element_size);
	673	g_array_set_size(score->data, plugin.scoreboard_alloc_size);
	674
	675	qemu_rec_mutex_lock(&plugin.lock);
	676	QLIST_INSERT_HEAD(&plugin.scoreboards, score, entry);
	677	qemu_rec_mutex_unlock(&plugin.lock);
	678
	679	return score;
	680	}
	681
	682	void plugin_scoreboard_free(struct qemu_plugin_scoreboard *score)
	683	{
	684	qemu_rec_mutex_lock(&plugin.lock);
	685	QLIST_REMOVE(score, entry);
	686	qemu_rec_mutex_unlock(&plugin.lock);
	687
	688	g_array_free(score->data, TRUE);
	689	g_free(score);
	690	}