blob: a6be332414fde31d965172f786e7699c43fd90af (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
# green-eye QEMU helpers
`greeneye_trace.c` is an optional QEMU TCG plugin that records **every**
instruction (opt-in) and every memory access as JSONL:
```bash
make -C qemu # builds qemu/greeneye-trace.so
qemu-system-riscv64 -machine virt -m 256M -display none -serial file:/tmp/uart.log \
-bios none -kernel <elf> -S -gdb tcp:127.0.0.1:4444 \
-plugin qemu/greeneye-trace.so,path=/tmp/ge-trace.jsonl,start=0x80000000,end=0x80010000,exec=off
```
This observes more than green-eye's gdbstub layer can: memory accesses
between stops, instruction coverage, exact access sizes. Use it when you need
a *complete* memory-activity map; use green-eye hooks/watchpoints when you
need semantics (arguments, returns, structure decoding).
The plugin header `qemu-plugin.h` is vendored from QEMU v8.2.2
(`include/qemu/qemu-plugin.h`, GPL-2.0-or-later) so the plugin builds on
systems where the QEMU source tree is not installed. If you prefer your
distro's header, point `CFLAGS` at it instead.
`launch.sh` starts a target through the package and keeps it alive for
`greeneye attach`:
```bash
qemu/launch.sh --kernel firmware/uproc_demo/build/uproc_demo.elf
```
|
