Outstanding questions Figure out direct jumps (grep USE_DIRECT_JUMP) Begin each block with a snippet that increments the cycle counter by the number of instructions in the block (should work even with direct block chaining, unless direct jumps can occur to the middle of a basic block). Do something magical to make rdtsc work (figure out the instruction offset and add/subtract it from the cycle counter?). Figure out if it's possible to reliably put at the end of the block instead. Can blocks ever be interrupted mid-way? Is the vmtimer ever read during execution of a TB (meaning it would not have its intermediate value)? Is it actually okay if it just jumps up on each TB? Is randomization used anywhere meaningful? How do jumps into the middle of blocks work? In gen_jmp_tb, why are there all of the things after gen_op_goto_tbx? Answered questions === rt_clock doesn't show up anywhere. Where are the RTC readings coming from? pc.c:cmos_init calls rtc_set_date with the host time. Thereafter, the RTC updates itself from timers fired off vm_clock