Re: [Qemu-devel] QEMU+Aarch64: in_asm log skips instructions of loop-programs

[Sergey Smolov]

03.09.2015 10:33, Peter Maydell пишет:

On 3 September 2015 at 06:27, Sergey Smolov <address@hidden> wrote:

I mean that in this example QEMU does not write to log "intermediate" SUBS
instructions which appear in loop-unrolling process.
For me it woulb be ok if QEMU generate the following in_asm log:

[log]
IN:
0x0000000000000000:  94000001      bl #+0x4 (addr 0x4)

----------------
IN:
0x0000000000000004:  d2800140      mov x0, #0xa

----------------
IN:
0x0000000000000008:  f1000400      subs x0, x0, #0x1 (1)

----------------
IN:
0x000000000000000c:  54000040      b.eq #+0x8 (addr 0x14)

----------------
IN:
0x0000000000000008:  f1000400      subs x0, x0, #0x1 (1)

QEMU's in_asm logging doesn't work like that. We log the
instructions that we *translate*, not instructions that we
*execute*. Generally we translate basic blocks and then
cache them so they can be executed multiple times. (It's
not actually guaranteed that a translated block will ever
be executed, though it almost always will be.) The
logging of input instructions happens at the translate phase.
When we execute we don't have any information about the
guest instructions involved.

This has nothing to do with "loop-unrolling", which QEMU
doesn't try to do at all.

You might find the 'exec' logging helpful for tracking
which translated blocks get executed.

thanks
-- PMM

Peter,

Thank you for your answer!

I've tested 'exec' logging and it does not contain unrolled llops too. For my sample it looks like:

[log]
Trace 0x7f999385a000 [0000000000000000]
Trace 0x7f999385a050 [0000000000000004]
Trace 0x7f999385a090 [0000000000000008]
Trace 0x7f999385a120 [000000000000000c]
Trace 0x7f999385a190 [0000000000000010]
Trace 0x7f999385a090 [0000000000000008]
Trace 0x7f999385a1d0 [0000000000000014]
Trace 0x7f999385a210 [0000000000000200]
Trace 0x7f999385a210 [0000000000000200]
...
[/log]

and contains only two records related to 'subs' instruction (it is situated on 0x0000000000000008 addresses whcih i've highlighted).

Also, is it true that after translation to internal representation (TCG-representation, yes?) there is no possibility at all to restore guest instructions?

Thanks,

Sergey Smolov