Re: [Qemu-devel] QEMU+Aarch64: in_asm log skips instructions of loop-programs

[Sergey Smolov <smolov@ispras.ru>]

[-- Attachment #1: Type: text/plain, Size: 2377 bytes --]



03.09.2015 10:33, Peter Maydell пишет:
> On 3 September 2015 at 06:27, Sergey Smolov <smolov@ispras.ru> wrote:
>> I mean that in this example QEMU does not write to log "intermediate" SUBS
>> instructions which appear in loop-unrolling process.
>> For me it woulb be ok if QEMU generate the following in_asm log:
>>
>> [log]
>> IN:
>> 0x0000000000000000:  94000001      bl #+0x4 (addr 0x4)
>>
>> ----------------
>> IN:
>> 0x0000000000000004:  d2800140      mov x0, #0xa
>>
>> ----------------
>> IN:
>> 0x0000000000000008:  f1000400      subs x0, x0, #0x1 (1)
>>
>> ----------------
>> IN:
>> 0x000000000000000c:  54000040      b.eq #+0x8 (addr 0x14)
>>
>> ----------------
>> IN:
>> 0x0000000000000008:  f1000400      subs x0, x0, #0x1 (1)
> QEMU's in_asm logging doesn't work like that. We log the
> instructions that we *translate*, not instructions that we
> *execute*. Generally we translate basic blocks and then
> cache them so they can be executed multiple times. (It's
> not actually guaranteed that a translated block will ever
> be executed, though it almost always will be.) The
> logging of input instructions happens at the translate phase.
> When we execute we don't have any information about the
> guest instructions involved.
>
> This has nothing to do with "loop-unrolling", which QEMU
> doesn't try to do at all.
>
> You might find the 'exec' logging helpful for tracking
> which translated blocks get executed.
>
> thanks
> -- PMM
>

Peter,

Thank you for your answer!

I've tested 'exec' logging and it does not contain unrolled llops too. 
For my sample it looks like:

[log]
Trace 0x7f999385a000 [0000000000000000]
Trace 0x7f999385a050 [0000000000000004]
Trace 0x7f999385a090 [*0000000000000008*]
Trace 0x7f999385a120 [000000000000000c]
Trace 0x7f999385a190 [0000000000000010]
Trace 0x7f999385a090 [*0000000000000008*]
Trace 0x7f999385a1d0 [0000000000000014]
Trace 0x7f999385a210 [0000000000000200]
Trace 0x7f999385a210 [0000000000000200]
...
[/log]

and contains only two records related to 'subs' instruction (it is 
situated on 0x0000000000000008 addresses whcih i've highlighted).

Also, is it true that after translation to internal representation 
(TCG-representation, yes?) there is no possibility at all to restore 
guest instructions?

Thanks,

Sergey Smolov

[-- Attachment #2: Type: text/html, Size: 3101 bytes --]