On 5/22/25 7:03 PM, Rowan Hart wrote:
This patch adds functionality to enforce the requested QEMU_PLUGIN_CB_
flags level passed when registering a callback function using the
plugins API. Each time a callback is about to be invoked, a thread-local
variable will be updated with the level that callback requested. Then,
called API functions (in particular, the register read and write API)
will call qemu_plugin_get_cb_flags() to check the level is at least the
level they require.

Signed-off-by: Rowan Hart <rowanbh...@gmail.com>
---
  accel/tcg/plugin-gen.c     | 27 +++++++++++++++++
  include/qemu/plugin.h      | 12 ++++++++
  include/qemu/qemu-plugin.h |  3 --
  plugins/api.c              |  8 +++++
  plugins/core.c             | 60 ++++++++++++++++++++++++++++++++++----
  5 files changed, 101 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index c1da753894..ceb2314bc1 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -117,10 +117,19 @@ static TCGv_i32 gen_cpu_index(void)
  static void gen_udata_cb(struct qemu_plugin_regular_cb *cb)
  {
      TCGv_i32 cpu_index = gen_cpu_index();
+    enum qemu_plugin_cb_flags cb_flags =
+        tcg_call_to_qemu_plugin_cb_flags(cb->info->flags);
+    TCGv_i32 flags = tcg_constant_i32(cb_flags);
+    tcg_gen_call1(qemu_plugin_set_cb_flags,
+                    qemu_plugin_get_set_cb_flags_helper_info(), NULL,
+                    tcgv_i32_temp(flags));
      tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
                    tcgv_i32_temp(cpu_index),
                    tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_gen_call0(qemu_plugin_clear_cb_flags,
+                  qemu_plugin_get_clear_cb_flags_helper_info(), NULL);
      tcg_temp_free_i32(cpu_index);
+    tcg_temp_free_i32(flags);
  }
static TCGv_ptr gen_plugin_u64_ptr(qemu_plugin_u64 entry)
@@ -173,10 +182,19 @@ static void gen_udata_cond_cb(struct 
qemu_plugin_conditional_cb *cb)
      tcg_gen_ld_i64(val, ptr, 0);
      tcg_gen_brcondi_i64(cond, val, cb->imm, after_cb);
      TCGv_i32 cpu_index = gen_cpu_index();
+    enum qemu_plugin_cb_flags cb_flags =
+        tcg_call_to_qemu_plugin_cb_flags(cb->info->flags);
+    TCGv_i32 flags = tcg_constant_i32(cb_flags);
+    tcg_gen_call1(qemu_plugin_set_cb_flags,
+                  qemu_plugin_get_set_cb_flags_helper_info(), NULL,
+                  tcgv_i32_temp(flags));
      tcg_gen_call2(cb->f.vcpu_udata, cb->info, NULL,
                    tcgv_i32_temp(cpu_index),
                    tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+     tcg_gen_call0(qemu_plugin_clear_cb_flags,
+                  qemu_plugin_get_clear_cb_flags_helper_info(), NULL);
      tcg_temp_free_i32(cpu_index);
+    tcg_temp_free_i32(flags);
      gen_set_label(after_cb);
tcg_temp_free_i64(val);
@@ -210,12 +228,21 @@ static void gen_mem_cb(struct qemu_plugin_regular_cb *cb,
                         qemu_plugin_meminfo_t meminfo, TCGv_i64 addr)
  {
      TCGv_i32 cpu_index = gen_cpu_index();
+    enum qemu_plugin_cb_flags cb_flags =
+        tcg_call_to_qemu_plugin_cb_flags(cb->info->flags);
+    TCGv_i32 flags = tcg_constant_i32(cb_flags);
+    tcg_gen_call1(qemu_plugin_set_cb_flags,
+                  qemu_plugin_get_set_cb_flags_helper_info(), NULL,
+                  tcgv_i32_temp(flags));
      tcg_gen_call4(cb->f.vcpu_mem, cb->info, NULL,
                    tcgv_i32_temp(cpu_index),
                    tcgv_i32_temp(tcg_constant_i32(meminfo)),
                    tcgv_i64_temp(addr),
                    tcgv_ptr_temp(tcg_constant_ptr(cb->userp)));
+    tcg_gen_call0(qemu_plugin_clear_cb_flags,
+                  qemu_plugin_get_clear_cb_flags_helper_info(), NULL);
      tcg_temp_free_i32(cpu_index);
+    tcg_temp_free_i32(flags);
  }
static void inject_cb(struct qemu_plugin_dyn_cb *cb)
diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index 9726a9ebf3..f312cc1a72 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -209,6 +209,18 @@ void qemu_plugin_user_prefork_lock(void);
   */
  void qemu_plugin_user_postfork(bool is_child);
+enum qemu_plugin_cb_flags tcg_call_to_qemu_plugin_cb_flags(int flags);
+
+void qemu_plugin_set_cb_flags(enum qemu_plugin_cb_flags flags);
+
+enum qemu_plugin_cb_flags qemu_plugin_get_cb_flags(void);
+
+void qemu_plugin_clear_cb_flags(void);
+
+TCGHelperInfo *qemu_plugin_get_set_cb_flags_helper_info(void);
+
+TCGHelperInfo *qemu_plugin_get_clear_cb_flags_helper_info(void);
+
  #else /* !CONFIG_PLUGIN */
static inline void qemu_plugin_add_opts(void)
diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index cfe1692ecb..120fb626a6 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -254,9 +254,6 @@ typedef struct {
   * @QEMU_PLUGIN_CB_NO_REGS: callback does not access the CPU's regs
   * @QEMU_PLUGIN_CB_R_REGS: callback reads the CPU's regs
   * @QEMU_PLUGIN_CB_RW_REGS: callback reads and writes the CPU's regs
- *
- * Note: currently QEMU_PLUGIN_CB_RW_REGS is unused, plugins cannot change
- * system register state.
   */
  enum qemu_plugin_cb_flags {
      QEMU_PLUGIN_CB_NO_REGS,
diff --git a/plugins/api.c b/plugins/api.c
index 3a7add50d2..16141f5c25 100644
--- a/plugins/api.c
+++ b/plugins/api.c
@@ -437,6 +437,10 @@ int qemu_plugin_read_register(struct qemu_plugin_register 
*reg, GByteArray *buf)
  {
      g_assert(current_cpu);
+ if (qemu_plugin_get_cb_flags() == QEMU_PLUGIN_CB_NO_REGS) {
+        return -1;
+    }
+
      return gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg) - 1);
  }
@@ -445,6 +449,10 @@ int qemu_plugin_write_register(struct qemu_plugin_register *reg,
  {
      g_assert(current_cpu);
+ if (buf->len == 0 || qemu_plugin_get_cb_flags() != QEMU_PLUGIN_CB_RW_REGS) {
+        return 0;
+    }
+
      return gdb_write_register(current_cpu, buf->data, GPOINTER_TO_INT(reg) - 
1);
  }
diff --git a/plugins/core.c b/plugins/core.c
index eb9281fe54..0ebde1fb87 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -30,6 +30,9 @@ struct qemu_plugin_cb {
  };
struct qemu_plugin_state plugin;
+static __thread enum qemu_plugin_cb_flags call_cb_flags;
+static TCGHelperInfo qemu_plugin_set_cb_flags_helper;
+static TCGHelperInfo qemu_plugin_clear_cb_flags_helper;
struct qemu_plugin_ctx *plugin_id_to_ctx_locked(qemu_plugin_id_t id)
  {
@@ -364,14 +367,15 @@ void plugin_register_dyn_cb__udata(GArray **arr,
                                     enum qemu_plugin_cb_flags flags,
                                     void *udata)
  {
-    static TCGHelperInfo info[3] = {
+    static TCGHelperInfo info[4] = {
          [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
          [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = 0,
          /*
           * Match qemu_plugin_vcpu_udata_cb_t:
           *   void (*)(uint32_t, void *)
           */
-        [0 ... 2].typemask = (dh_typemask(void, 0) |
+        [0 ... 3].typemask = (dh_typemask(void, 0) |
                                dh_typemask(i32, 1) |
                                dh_typemask(ptr, 2))
      };
@@ -393,14 +397,15 @@ void plugin_register_dyn_cond_cb__udata(GArray **arr,
                                          uint64_t imm,
                                          void *udata)
  {
-    static TCGHelperInfo info[3] = {
+    static TCGHelperInfo info[4] = {
          [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
          [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = 0,
          /*
           * Match qemu_plugin_vcpu_udata_cb_t:
           *   void (*)(uint32_t, void *)
           */
-        [0 ... 2].typemask = (dh_typemask(void, 0) |
+        [0 ... 3].typemask = (dh_typemask(void, 0) |
                                dh_typemask(i32, 1) |
                                dh_typemask(ptr, 2))
      };
@@ -431,14 +436,15 @@ void plugin_register_vcpu_mem_cb(GArray **arr,
          !__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t) &&
          !__builtin_types_compatible_p(qemu_plugin_meminfo_t, int32_t));
- static TCGHelperInfo info[3] = {
+    static TCGHelperInfo info[4] = {
          [QEMU_PLUGIN_CB_NO_REGS].flags = TCG_CALL_NO_RWG,
          [QEMU_PLUGIN_CB_R_REGS].flags = TCG_CALL_NO_WG,
+        [QEMU_PLUGIN_CB_RW_REGS].flags = 0,
          /*
           * Match qemu_plugin_vcpu_mem_cb_t:
           *   void (*)(uint32_t, qemu_plugin_meminfo_t, uint64_t, void *)
           */
-        [0 ... 2].typemask =
+        [0 ... 3].typemask =
              (dh_typemask(void, 0) |
               dh_typemask(i32, 1) |
               (__builtin_types_compatible_p(qemu_plugin_meminfo_t, uint32_t)
@@ -730,6 +736,11 @@ static void __attribute__((__constructor__)) 
plugin_init(void)
      qht_init(&plugin.dyn_cb_arr_ht, plugin_dyn_cb_arr_cmp, 16,
               QHT_MODE_AUTO_RESIZE);
      atexit(qemu_plugin_atexit_cb);
+    qemu_plugin_set_cb_flags_helper.flags = 0;
+    qemu_plugin_set_cb_flags_helper.typemask = (dh_typemask(void, 0) |
+                                               dh_typemask(i32, 1));
+    qemu_plugin_clear_cb_flags_helper.flags = 0;
+    qemu_plugin_clear_cb_flags_helper.typemask = dh_typemask(void, 0);
  }
int plugin_num_vcpus(void)
@@ -760,3 +771,40 @@ void plugin_scoreboard_free(struct qemu_plugin_scoreboard 
*score)
      g_array_free(score->data, TRUE);
      g_free(score);
  }
+
+enum qemu_plugin_cb_flags tcg_call_to_qemu_plugin_cb_flags(int flags)
+{
+    if (flags & TCG_CALL_NO_RWG) {
+        return QEMU_PLUGIN_CB_NO_REGS;
+    } else if (flags & TCG_CALL_NO_WG) {
+        return QEMU_PLUGIN_CB_R_REGS;
+    } else {
+        return QEMU_PLUGIN_CB_RW_REGS;
+    }
+}
+
+void qemu_plugin_set_cb_flags(enum qemu_plugin_cb_flags flags)
+{
+    call_cb_flags = flags;
+}
+
+enum qemu_plugin_cb_flags qemu_plugin_get_cb_flags(void)
+{
+    return call_cb_flags;
+}
+
+void qemu_plugin_clear_cb_flags(void)
+{
+    call_cb_flags = QEMU_PLUGIN_CB_NO_REGS;
+}
+
+
+TCGHelperInfo *qemu_plugin_get_set_cb_flags_helper_info(void)
+{
+    return &qemu_plugin_set_cb_flags_helper;
+}
+
+TCGHelperInfo *qemu_plugin_get_clear_cb_flags_helper_info(void)
+{
+    return &qemu_plugin_clear_cb_flags_helper;
+}

The overall approach is good. The only other alternative I see is having an opaque handle passed to callbacks, but I don't think it's a good way to solve this. So storing flags before and cleaning after callbacks is the way to go.

It would be more efficient to generate a store directly, and keep the qemu_plugin_cb_flags directly in CPUNegativeOffsetState, as we know this will be used only in context of current cpu.
See plugin_mem_value_{low, high} which use this already.

Thanks,
Pierrick

Reply via email to