Hello Qemu users,
I am interested in using Qemu for a research project of mine, and I was curious if it was possible to, for a kernel running on Qemu, run a callback on instruction fetches and data accesses. In the context of Simics (an x86 emulator), this can be accomplished by creating a module with Simics as such:
```
/* Initialize our Simics module. */
void init_local(void)
{
const class_data_t funcs = {
.new_instance = ls_new_instance,
.class_desc = "desc",
.description = "A simics module."
};
/* Register the empty device class. */
conf_class_t *conf_class = SIM_register_class(SIM_MODULE_NAME, &funcs);
/* Register our class class as a trace consumer. */
static const trace_consume_interface_t trace_int = {
.consume = (void (*)(conf_object_t *, trace_entry_t *))my_tool_entrypoint
};
SIM_register_interface(conf_class, TRACE_CONSUME_INTERFACE, &trace_int);
}
```
By doing this, Simics will call `my_tool_entrypoint` on every instruction and every data access; allowing me to instrument the kernel I'm running as I see fit. Is such a feature available for a guest OS running on Qemu? I see that there is some kind of tracing utility (
http://git.qemu-project.org/?p=qemu.git;a=blob_plain;f=docs/tracing.txt), but from reading it, it doesn't seem like it's possible to do what I'm looking for. We can modify the OS to hook into Qemu however we need. I am aware that this would result in a gigantic performance hit, but that is acceptable for my use case.
If this feature is not currently available, and it sounds like something others would want, it is something I would possibly be able to spend a lot of time on after the New Year adding it to Qemu assuming it probably wouldn't take less than a couple of months.
Thanks in advance for your time and assistance. Please let me know if this is a message that I should forward to qemu-devel and I will do that instead.
Regards,
David Vernet