> Where does the translator need access to this original code? I was > just thinking about this problem today, wondering how much overhead > there is with this SMC page protection thing.
When an MMU fault occurs qemu re-translates the TB with additional annotations to determine which guest instruction caused the fault. See translate-all.c:cpu_restore_state(). Paul