I personally know next to nothing about QEMU, having never used it. I did write our present sim.
In my ignorance I anticipate the most trouble with representing in-flight values. Because Mill explicitly separates instruction initiation from instruction retire, a sim must model instructions that are in-flight in the pipeline, and merge the effects of separate instructions that emerge from the pipes at the same time despite having been initiated at different times. Due to phasing, the init and retire can be in the same bundle cycle, with other execution in the middle. In particular, there can be control flow during the in-flight period.
You can’t just start at an address and assume that everything before is in the belt/memory. There may be an in-flight multiply that will drop to the belt in two cycles, completely unannounced, with a whole function executed since the init. And you can’t just snapshot at every basic block either – in-flights can carry over the branches.
I’m not saying it’s impossible. I’m saying that it will be difficult and we presently have neither the expertise nor the money to take it on. @QEMU experts – there’s a challenge here available if you’d like to join the Mill effort.