Hi there.
I'm porting into qemu some code I had for bochs. For this purpose, the first
part is a backdoor communication channel, such that code in the guest will be
able to directly communicate with qemu in a pre-defined manner (namely, the
decode of an illegal instruction).
Right now, this comes with a '--with-backdoor=PATH' flag in the configure
script, which lets the user activate the communication channel, and make qemu
compile all '.c' files in PATH as target code.
In those files, the user can place any code, plus backdoor callbacks (these are
a must), which are free to interact with any other piece of code in qemu.
Are you interested on merging this kind of functionality?
The only reason for this is to control the behaviour of the other piece of code
I'm working on (which I would very much like to integrate into qemu).
This other piece is a set of static instrumentation points using macros that the
user can re-define at compile time.
For an example of how it would look like:
http://bochs.sourceforge.net/cgi-bin/lxr/source/instrument/