On 3 September 2015 at 06:27, Sergey Smolov <smo...@ispras.ru> wrote: > I mean that in this example QEMU does not write to log "intermediate" SUBS > instructions which appear in loop-unrolling process. > For me it woulb be ok if QEMU generate the following in_asm log: > > [log] > IN: > 0x0000000000000000: 94000001 bl #+0x4 (addr 0x4) > > ---------------- > IN: > 0x0000000000000004: d2800140 mov x0, #0xa > > ---------------- > IN: > 0x0000000000000008: f1000400 subs x0, x0, #0x1 (1) > > ---------------- > IN: > 0x000000000000000c: 54000040 b.eq #+0x8 (addr 0x14) > > ---------------- > IN: > 0x0000000000000008: f1000400 subs x0, x0, #0x1 (1)
QEMU's in_asm logging doesn't work like that. We log the instructions that we *translate*, not instructions that we *execute*. Generally we translate basic blocks and then cache them so they can be executed multiple times. (It's not actually guaranteed that a translated block will ever be executed, though it almost always will be.) The logging of input instructions happens at the translate phase. When we execute we don't have any information about the guest instructions involved. This has nothing to do with "loop-unrolling", which QEMU doesn't try to do at all. You might find the 'exec' logging helpful for tracking which translated blocks get executed. thanks -- PMM