[Qemu-discuss] Get branch target in cpu-exec.c

[Jean-Vincent Hay]

Hi !

I'm working on a tool for tracing specific parts of a guest execution.
More precisely, you set an entry point that will be part of the process
you'd like to trace, then the tool will only trace what it believes to
belong or is called by this process (libraries, function calls,
branches...) and get rid of what is not in this process (syscalls,
scheduler, other processes...).

I set a probe in cpu-exec, which allows me to read the current CPU state
and the current target instruction (like -d in_asm) that work pretty
neatly for my needs but I'm hitting two possibilities for the previously
stated need :

- Either I implement my own target specific code flow analysis (which I
already have from another project but will require more maintenance),
- Or I try to rely on the TranslationBlock that matches each instruction
to provide me with its code flow ops and interpret them, but then my
question will be : how does one extract ops from a TB ?


What are your opinions on how to implement such thing ? Has it been
already done ?

Thanks in advance !


Jivay Hay