title: Interaction of QEMU and KVM from a perspective of Instruction Replacement
body: <p>Currently I am doing some research on dynamic instruction replacement for x86 Instruction Set Architectures (ISA). Until now, I only did that for RISC-V based processor architectures.
  Since there are no public domain x86 implementations available which could be synthesized to a FPGA, I have to stick with visualization for now.</p>
  
  <p>My experimental setup is as follows:
  A guest application (compiled with gcc, no external libraries) is run in qemu-user-mode. (I found this post indeed very helpful: <a href="https://stackoverflow.com/questions/20675226/qemu-code-flow-instruction-cache-and-tcg/21000294#21000294">QEMU - Code Flow [ Instruction cache and TCG]</a>) The entire system is run on a Fedora 25 Linux operation system and build from the latest git-sources.</p>
  
  <p>Some instructions are (my own code analysis) internally dispatched to</p>
  
  <pre><code>static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s, int modrm)
  </code></pre>
  
  <p>From there, I can't tell what is happening to this class of instructions. </p>
  
  <pre><code>gen_nop_modrm(env, s, modrm); (translate.c:8108)
  </code></pre>
  
  <p>Is the calling method.</p>
  
  <p>My primary objective is to add instructions after an instruction is recognized in order to delay a consecutive execution of the same instruction over again.</p>
  
  <p>I read about how KVM-based QEMU execution works. Obviously, some kind of hypervision is possible (even for USB transactions: <a href="https://www.blackhat.com/docs/eu-14/materials/eu-14-Schumilo-Dont-Trust-Your-USB-How-To-Find-Bugs-In-USB-Device-Drivers-wp.pdf" rel="nofollow noreferrer">https://www.blackhat.com/docs/eu-14/materials/eu-14-Schumilo-Dont-Trust-Your-USB-How-To-Find-Bugs-In-USB-Device-Drivers-wp.pdf</a>) The architecture (although very complex) is so far straight forward.</p>
  
  <p>I am interested in:</p>
  
  <ol>
  <li>How are instructions handled, which are caught by these gen_lea_modrm methods.</li>
  <li>Can instructions which are naively passed through via KVM be observed?</li>
  <li>The Translation Buffer (tb) is chunked (as far as I understood), can I extend the buffer to inject Instructions?</li>
  <li>Are there any build-in facilities to do instruction-profiling</li>
  </ol>
  
  <p>I searched SO thoroughly with the search-terms I had. Any kind of hints, tips or suggestions would really be helpful and appreciated.</p>
  
  <p>Best Regards.</p>