# green-eye QEMU helpers

`greeneye_trace.c` is an optional QEMU TCG plugin that records **every**
instruction (opt-in) and every memory access as JSONL:

```bash
make -C qemu                      # builds qemu/greeneye-trace.so
qemu-system-riscv64 -machine virt -m 256M -display none -serial file:/tmp/uart.log \
    -bios none -kernel <elf> -S -gdb tcp:127.0.0.1:4444 \
    -plugin qemu/greeneye-trace.so,path=/tmp/ge-trace.jsonl,start=0x80000000,end=0x80010000,exec=off
```

This observes more than green-eye's gdbstub layer can: memory accesses
between stops, instruction coverage, exact access sizes. Use it when you need
a *complete* memory-activity map; use green-eye hooks/watchpoints when you
need semantics (arguments, returns, structure decoding).

The plugin header `qemu-plugin.h` is vendored from QEMU v8.2.2
(`include/qemu/qemu-plugin.h`, GPL-2.0-or-later) so the plugin builds on
systems where the QEMU source tree is not installed. If you prefer your
distro's header, point `CFLAGS` at it instead.

`launch.sh` starts a target through the package and keeps it alive for
`greeneye attach`:

```bash
qemu/launch.sh --kernel firmware/uproc_demo/build/uproc_demo.elf
```