it seems qemu has an inlined sequence to walk the tlb. if that fails, it does a call out.
tcg_out_tlb_load(s, addrlo_idx, mem_index, s_bits, args, label_ptr, offsetof(CPUTLBEntry, addr_write)); /* TLB Hit. */ tcg_out_qemu_st_direct(s, data_reg, data_reg2, tcg_target_call_iarg_regs[0], 0, opc); /* jmp label2 */ tcg_out8(s, OPC_JMP_short); label_ptr[2] = s->code_ptr; s->code_ptr++; /* TLB Miss. */ ... tcg_out_calli(s, (tcg_target_long)qemu_st_helpers[s_bits]); what does the inline sequence look like ? what kind of things (other than refill tlb) performed in callout but not the inlined sequence ? Thanks Xin