include/qemu/qemu-plugin.h | 15 +++++++ linux-user/aarch64/cpu_loop.c | 2 +- linux-user/alpha/cpu_loop.c | 2 +- linux-user/arm/cpu_loop.c | 2 +- linux-user/hexagon/cpu_loop.c | 2 +- linux-user/hppa/cpu_loop.c | 4 ++ linux-user/i386/cpu_loop.c | 8 ++-- linux-user/include/special-errno.h | 8 ++++ linux-user/loongarch64/cpu_loop.c | 5 ++- linux-user/m68k/cpu_loop.c | 2 +- linux-user/microblaze/cpu_loop.c | 2 +- linux-user/mips/cpu_loop.c | 5 ++- linux-user/openrisc/cpu_loop.c | 2 +- linux-user/ppc/cpu_loop.c | 6 ++- linux-user/riscv/cpu_loop.c | 2 +- linux-user/s390x/cpu_loop.c | 2 +- linux-user/sh4/cpu_loop.c | 2 +- linux-user/sparc/cpu_loop.c | 4 +- linux-user/syscall.c | 8 ++++ linux-user/xtensa/cpu_loop.c | 3 ++ plugins/api.c | 17 +++++++- plugins/core.c | 25 ++++++----- tests/tcg/multiarch/Makefile.target | 42 +++++++++++++++++++ .../tcg/multiarch/test-plugin-skip-syscalls.c | 26 ++++++++++++ tests/tcg/plugins/syscall.c | 6 +++ 25 files changed, 170 insertions(+), 32 deletions(-) create mode 100644 tests/tcg/multiarch/test-plugin-skip-syscalls.c
Hi, As originally discussed in the thread at https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00656.html and later proposed in a patch at https://lists.nongnu.org/archive/html/qemu-devel/2025-09/msg02218.html, I am sending an updated version of my patch based on the previous feedback. Notable changes to v1: - Added a setjmp() in the syscall handling path to allow redirecting the PC via cpu_loop_exit() also in syscall callbacks. The previous version would only work in instruction execution / memory access callback contexts, as the setjmp() corresponding to the longjmp() in cpu_loop_exit() was only live in those contexts. - Added a flag to make sure the new API function is only called in contexts where it makes sense, i.e., during execution of guest code. - Added a test that checks the new functionality by skipping a non-existent sentinel syscall. I made it an RFC patch this time as I am not entirely sure if my setting/handling of the new flag makes sense the way it is. I briefly looked into making the QEMU_PLUGIN_CB_* flags actual flags via a bitfield instead of enum values, but that would have required touching a lot of code all over the place, so I'm not sure this is the way to go. Happy to get feedback and your thoughts on the patches! Thanks, Florian Florian Hofhammer (2): plugins: Add PC diversion API function tests/tcg: add test for qemu_plugin_set_pc API include/qemu/qemu-plugin.h | 15 +++++++ linux-user/aarch64/cpu_loop.c | 2 +- linux-user/alpha/cpu_loop.c | 2 +- linux-user/arm/cpu_loop.c | 2 +- linux-user/hexagon/cpu_loop.c | 2 +- linux-user/hppa/cpu_loop.c | 4 ++ linux-user/i386/cpu_loop.c | 8 ++-- linux-user/include/special-errno.h | 8 ++++ linux-user/loongarch64/cpu_loop.c | 5 ++- linux-user/m68k/cpu_loop.c | 2 +- linux-user/microblaze/cpu_loop.c | 2 +- linux-user/mips/cpu_loop.c | 5 ++- linux-user/openrisc/cpu_loop.c | 2 +- linux-user/ppc/cpu_loop.c | 6 ++- linux-user/riscv/cpu_loop.c | 2 +- linux-user/s390x/cpu_loop.c | 2 +- linux-user/sh4/cpu_loop.c | 2 +- linux-user/sparc/cpu_loop.c | 4 +- linux-user/syscall.c | 8 ++++ linux-user/xtensa/cpu_loop.c | 3 ++ plugins/api.c | 17 +++++++- plugins/core.c | 25 ++++++----- tests/tcg/multiarch/Makefile.target | 42 +++++++++++++++++++ .../tcg/multiarch/test-plugin-skip-syscalls.c | 26 ++++++++++++ tests/tcg/plugins/syscall.c | 6 +++ 25 files changed, 170 insertions(+), 32 deletions(-) create mode 100644 tests/tcg/multiarch/test-plugin-skip-syscalls.c -- 2.51.0
Hi, Sorry for necrobumping this thread. I just wanted to follow up on this and ask if there is still interest in this plugin API extension or if it is going to be dropped in favor of the Lorelei patches (which would also fulfill my original use case). Thanks for your time, Florian On 06/10/2025 15:21, Florian Hofhammer wrote: > Hi, > > As originally discussed in the thread at > https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00656.html > and later proposed in a patch at > https://lists.nongnu.org/archive/html/qemu-devel/2025-09/msg02218.html, > I am sending an updated version of my patch based on the previous > feedback. > > Notable changes to v1: > - Added a setjmp() in the syscall handling path to allow redirecting > the PC via cpu_loop_exit() also in syscall callbacks. The previous > version would only work in instruction execution / memory access > callback contexts, as the setjmp() corresponding to the longjmp() in > cpu_loop_exit() was only live in those contexts. > - Added a flag to make sure the new API function is only called in > contexts where it makes sense, i.e., during execution of guest code. > - Added a test that checks the new functionality by skipping a > non-existent sentinel syscall. > > I made it an RFC patch this time as I am not entirely sure if my > setting/handling of the new flag makes sense the way it is. I briefly > looked into making the QEMU_PLUGIN_CB_* flags actual flags via a > bitfield instead of enum values, but that would have required touching > a lot of code all over the place, so I'm not sure this is the way to go. > > Happy to get feedback and your thoughts on the patches! > > Thanks, > Florian > > > Florian Hofhammer (2): > plugins: Add PC diversion API function > tests/tcg: add test for qemu_plugin_set_pc API > > include/qemu/qemu-plugin.h | 15 +++++++ > linux-user/aarch64/cpu_loop.c | 2 +- > linux-user/alpha/cpu_loop.c | 2 +- > linux-user/arm/cpu_loop.c | 2 +- > linux-user/hexagon/cpu_loop.c | 2 +- > linux-user/hppa/cpu_loop.c | 4 ++ > linux-user/i386/cpu_loop.c | 8 ++-- > linux-user/include/special-errno.h | 8 ++++ > linux-user/loongarch64/cpu_loop.c | 5 ++- > linux-user/m68k/cpu_loop.c | 2 +- > linux-user/microblaze/cpu_loop.c | 2 +- > linux-user/mips/cpu_loop.c | 5 ++- > linux-user/openrisc/cpu_loop.c | 2 +- > linux-user/ppc/cpu_loop.c | 6 ++- > linux-user/riscv/cpu_loop.c | 2 +- > linux-user/s390x/cpu_loop.c | 2 +- > linux-user/sh4/cpu_loop.c | 2 +- > linux-user/sparc/cpu_loop.c | 4 +- > linux-user/syscall.c | 8 ++++ > linux-user/xtensa/cpu_loop.c | 3 ++ > plugins/api.c | 17 +++++++- > plugins/core.c | 25 ++++++----- > tests/tcg/multiarch/Makefile.target | 42 +++++++++++++++++++ > .../tcg/multiarch/test-plugin-skip-syscalls.c | 26 ++++++++++++ > tests/tcg/plugins/syscall.c | 6 +++ > 25 files changed, 170 insertions(+), 32 deletions(-) > create mode 100644 tests/tcg/multiarch/test-plugin-skip-syscalls.c >
Florian Hofhammer <florian.hofhammer@epfl.ch> writes: > Hi, > > Sorry for necrobumping this thread. I just wanted to follow up on this > and ask if there is still interest in this plugin API extension or if it > is going to be dropped in favor of the Lorelei patches (which would also > fulfill my original use case). These are the system call filter patches? I guess that depends on if being able to change PC is only for skipping syscalls? > > Thanks for your time, > Florian > > On 06/10/2025 15:21, Florian Hofhammer wrote: >> Hi, >> >> As originally discussed in the thread at >> https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00656.html >> and later proposed in a patch at >> https://lists.nongnu.org/archive/html/qemu-devel/2025-09/msg02218.html, >> I am sending an updated version of my patch based on the previous >> feedback. >> >> Notable changes to v1: >> - Added a setjmp() in the syscall handling path to allow redirecting >> the PC via cpu_loop_exit() also in syscall callbacks. The previous >> version would only work in instruction execution / memory access >> callback contexts, as the setjmp() corresponding to the longjmp() in >> cpu_loop_exit() was only live in those contexts. >> - Added a flag to make sure the new API function is only called in >> contexts where it makes sense, i.e., during execution of guest code. >> - Added a test that checks the new functionality by skipping a >> non-existent sentinel syscall. >> >> I made it an RFC patch this time as I am not entirely sure if my >> setting/handling of the new flag makes sense the way it is. I briefly >> looked into making the QEMU_PLUGIN_CB_* flags actual flags via a >> bitfield instead of enum values, but that would have required touching >> a lot of code all over the place, so I'm not sure this is the way to go. >> >> Happy to get feedback and your thoughts on the patches! >> >> Thanks, >> Florian >> >> >> Florian Hofhammer (2): >> plugins: Add PC diversion API function >> tests/tcg: add test for qemu_plugin_set_pc API >> >> include/qemu/qemu-plugin.h | 15 +++++++ >> linux-user/aarch64/cpu_loop.c | 2 +- >> linux-user/alpha/cpu_loop.c | 2 +- >> linux-user/arm/cpu_loop.c | 2 +- >> linux-user/hexagon/cpu_loop.c | 2 +- >> linux-user/hppa/cpu_loop.c | 4 ++ >> linux-user/i386/cpu_loop.c | 8 ++-- >> linux-user/include/special-errno.h | 8 ++++ >> linux-user/loongarch64/cpu_loop.c | 5 ++- >> linux-user/m68k/cpu_loop.c | 2 +- >> linux-user/microblaze/cpu_loop.c | 2 +- >> linux-user/mips/cpu_loop.c | 5 ++- >> linux-user/openrisc/cpu_loop.c | 2 +- >> linux-user/ppc/cpu_loop.c | 6 ++- >> linux-user/riscv/cpu_loop.c | 2 +- >> linux-user/s390x/cpu_loop.c | 2 +- >> linux-user/sh4/cpu_loop.c | 2 +- >> linux-user/sparc/cpu_loop.c | 4 +- >> linux-user/syscall.c | 8 ++++ >> linux-user/xtensa/cpu_loop.c | 3 ++ >> plugins/api.c | 17 +++++++- >> plugins/core.c | 25 ++++++----- >> tests/tcg/multiarch/Makefile.target | 42 +++++++++++++++++++ >> .../tcg/multiarch/test-plugin-skip-syscalls.c | 26 ++++++++++++ >> tests/tcg/plugins/syscall.c | 6 +++ >> 25 files changed, 170 insertions(+), 32 deletions(-) >> create mode 100644 tests/tcg/multiarch/test-plugin-skip-syscalls.c >> -- Alex Bennée Virtualisation Tech Lead @ Linaro
On 12/12/2025 13:02, Alex Bennée wrote: > Florian Hofhammer <florian.hofhammer@epfl.ch> writes: > >> Hi, >> >> Sorry for necrobumping this thread. I just wanted to follow up on this >> and ask if there is still interest in this plugin API extension or if it >> is going to be dropped in favor of the Lorelei patches (which would also >> fulfill my original use case). > > These are the system call filter patches? > > I guess that depends on if being able to change PC is only for skipping > syscalls? Yes, the Lorelei patches are the syscall filter patches. This was my original use case as well, but I think diverting control flow outside of that use case can be useful as well (e.g., to divert control flow to a different library function implementation when things like LD_PRELOAD are not an option). Best, Florian
On 12/12/25 4:02 AM, Alex Bennée wrote: > Florian Hofhammer <florian.hofhammer@epfl.ch> writes: > >> Hi, >> >> Sorry for necrobumping this thread. I just wanted to follow up on this >> and ask if there is still interest in this plugin API extension or if it >> is going to be dropped in favor of the Lorelei patches (which would also >> fulfill my original use case). > > These are the system call filter patches? > > I guess that depends on if being able to change PC is only for skipping > syscalls? > Both can probably coexist, as they serve different purposes. If only considering syscalls, the syscall filter (that you propose first) is the best way to deal with it, as it's architecture agnostic. That said, it would be sad to drop the effort you made into this series, and overriding pc can be convenient if anyone wants to filter anything else than syscalls, or for fuzzing purpose. >> >> Thanks for your time, >> Florian >> >> On 06/10/2025 15:21, Florian Hofhammer wrote: >>> Hi, >>> >>> As originally discussed in the thread at >>> https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00656.html >>> and later proposed in a patch at >>> https://lists.nongnu.org/archive/html/qemu-devel/2025-09/msg02218.html, >>> I am sending an updated version of my patch based on the previous >>> feedback. >>> >>> Notable changes to v1: >>> - Added a setjmp() in the syscall handling path to allow redirecting >>> the PC via cpu_loop_exit() also in syscall callbacks. The previous >>> version would only work in instruction execution / memory access >>> callback contexts, as the setjmp() corresponding to the longjmp() in >>> cpu_loop_exit() was only live in those contexts. >>> - Added a flag to make sure the new API function is only called in >>> contexts where it makes sense, i.e., during execution of guest code. >>> - Added a test that checks the new functionality by skipping a >>> non-existent sentinel syscall. >>> >>> I made it an RFC patch this time as I am not entirely sure if my >>> setting/handling of the new flag makes sense the way it is. I briefly >>> looked into making the QEMU_PLUGIN_CB_* flags actual flags via a >>> bitfield instead of enum values, but that would have required touching >>> a lot of code all over the place, so I'm not sure this is the way to go. >>> >>> Happy to get feedback and your thoughts on the patches! >>> >>> Thanks, >>> Florian >>> >>> >>> Florian Hofhammer (2): >>> plugins: Add PC diversion API function >>> tests/tcg: add test for qemu_plugin_set_pc API >>> >>> include/qemu/qemu-plugin.h | 15 +++++++ >>> linux-user/aarch64/cpu_loop.c | 2 +- >>> linux-user/alpha/cpu_loop.c | 2 +- >>> linux-user/arm/cpu_loop.c | 2 +- >>> linux-user/hexagon/cpu_loop.c | 2 +- >>> linux-user/hppa/cpu_loop.c | 4 ++ >>> linux-user/i386/cpu_loop.c | 8 ++-- >>> linux-user/include/special-errno.h | 8 ++++ >>> linux-user/loongarch64/cpu_loop.c | 5 ++- >>> linux-user/m68k/cpu_loop.c | 2 +- >>> linux-user/microblaze/cpu_loop.c | 2 +- >>> linux-user/mips/cpu_loop.c | 5 ++- >>> linux-user/openrisc/cpu_loop.c | 2 +- >>> linux-user/ppc/cpu_loop.c | 6 ++- >>> linux-user/riscv/cpu_loop.c | 2 +- >>> linux-user/s390x/cpu_loop.c | 2 +- >>> linux-user/sh4/cpu_loop.c | 2 +- >>> linux-user/sparc/cpu_loop.c | 4 +- >>> linux-user/syscall.c | 8 ++++ >>> linux-user/xtensa/cpu_loop.c | 3 ++ >>> plugins/api.c | 17 +++++++- >>> plugins/core.c | 25 ++++++----- >>> tests/tcg/multiarch/Makefile.target | 42 +++++++++++++++++++ >>> .../tcg/multiarch/test-plugin-skip-syscalls.c | 26 ++++++++++++ >>> tests/tcg/plugins/syscall.c | 6 +++ >>> 25 files changed, 170 insertions(+), 32 deletions(-) >>> create mode 100644 tests/tcg/multiarch/test-plugin-skip-syscalls.c >>> >
On 12/12/2025 18:36, Pierrick Bouvier wrote: > On 12/12/25 4:02 AM, Alex Bennée wrote: >> Florian Hofhammer <florian.hofhammer@epfl.ch> writes: >> >>> Hi, >>> >>> Sorry for necrobumping this thread. I just wanted to follow up on this >>> and ask if there is still interest in this plugin API extension or if it >>> is going to be dropped in favor of the Lorelei patches (which would also >>> fulfill my original use case). >> >> These are the system call filter patches? >> >> I guess that depends on if being able to change PC is only for skipping >> syscalls? >> > > Both can probably coexist, as they serve different purposes. > If only considering syscalls, the syscall filter (that you propose first) is the best way to deal with it, as it's architecture agnostic. > > That said, it would be sad to drop the effort you made into this series, and overriding pc can be convenient if anyone wants to filter anything else than syscalls, or for fuzzing purpose. Yes, while the syscall filtering was my initial use case, setting the PC and diverting control flow can also be used for patching out functionality, diverting function calls, in-process resets for fuzzing, or other use cases. No hard feelings if there isn't enough upstream interest, though! :) Thanks, Florian
© 2016 - 2026 Red Hat, Inc.