If you're trying this, it's important to note that '-d in_asm' does not "trace with disassembly for each executed instruction" as the article suggests. It trace

If you're trying this, it's important to note that '-d in_asm' does not "trace with disassembly for each executed instruction" as the article suggests. It traces disassembly when the insns are translated (JITted); once that has happened the insns can be executed multiple times and they won't reappear in in_asm logs. The 'time of execution' logging is '-d cpu' and '-d exec', which just log 'we executed this translation block' without any disassembly -- you then can correlate those logs with the previous 'in_asm' logging. This is the most notable manifestation of the general point that QEMU's -d logging is primarily aimed at debugging QEMU itself -- it logs things that are easy to log and interpreting the output requires some understanding of QEMU's internals. The "I want to debug my guest without thinking about QEMU implementation details" interfaces are the gdbstub and more recently the TCG plugin API.