docs/devel/tcg.rst

9 are very complicated and highly CPU dependent. QEMU uses some tricks
14 Generator". For more information, please take a look at :ref:`tcg-ops-ref`.
19 CPU state optimisations
20 -----------------------
25 CPU cannot change in it. The state is recorded in the Translation
29 to other aspects of the CPU state.  For example, on x86, if the SS,
34 ---------------------
37 Program Counter (PC) and other CPU state information (such as the CS
48 callback to be re-evaluated before executing additional instructions.
49 It is mandatory to exit this way after any CPU state changes that may
62 matches the current CPU state. If the destination TB is available its
77 2. Emit TCG instructions to update the CPU state with any information
90 of step 2's instructions, which update the CPU state information. Step 3,
96 to step 2. Then the CPU state information gets updated and we exit from
101 current CPU state information (creating the TB if it wasn’t already
115 * The change in CPU state must be constant, e.g., a direct branch and
127 Self-modifying code and translated code invalidation
128 ----------------------------------------------------
130 Self-modifying code is a special challenge in x86 emulation because no
134 User-mode emulation marks a host page as write-protected (if it is
135 not already read-only) every time translated code is generated for a
152 -----------------
162 On some targets, some bits of the virtual CPU's state are not flushed to the
165 very often throughout the execution of a translation block---this includes
171 -------------
194 ---------------------
199 limitation you can use the ``-perfmap`` or the ``-jitdump`` option to generate
200 map files. ``-perfmap`` is lightweight and produces only guest-host mappings.
201 ``-jitdump`` additionally saves JITed code and guest debug information (if
203 before the final report can be viewed.
207   perf record $QEMU -perfmap $REMAINING_ARGS
210   perf record -k 1 $QEMU -jitdump $REMAINING_ARGS
211   DEBUGINFOD_URLS= perf inject -j -i perf.data -o perf.data.jitted
212   perf report -i perf.data.jitted
214 Note that qemu-system generates mappings only for ``-kernel`` files in ELF