Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Newer
Older
100644 698 lines (513 sloc) 22.819 kB
1f67313 doc update
bellard authored
1 \input texinfo @c -*- texinfo -*-
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
2 @c %**start of header
3 @setfilename qemu-tech.info
e080e78 Documentation: Use UTF-8 encoding and fix one wrong encoding
Stefan Weil authored
4
5 @documentlanguage en
6 @documentencoding UTF-8
7
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
8 @settitle QEMU Internals
9 @exampleindent 0
10 @paragraphindent 0
11 @c %**end of header
1f67313 doc update
bellard authored
12
a1a32b0 Documentation: Add direntry for info format
Stefan Weil authored
13 @ifinfo
14 @direntry
15 * QEMU Internals: (qemu-tech). The QEMU Emulator Internals.
16 @end direntry
17 @end ifinfo
18
1f67313 doc update
bellard authored
19 @iftex
20 @titlepage
21 @sp 7
22 @center @titlefont{QEMU Internals}
23 @sp 3
24 @end titlepage
25 @end iftex
26
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
27 @ifnottex
28 @node Top
29 @top
30
31 @menu
32 * Introduction::
33 * QEMU Internals::
34 * Regression Tests::
35 * Index::
36 @end menu
37 @end ifnottex
38
39 @contents
40
41 @node Introduction
1f67313 doc update
bellard authored
42 @chapter Introduction
43
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
44 @menu
45 * intro_features:: Features
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
46 * intro_x86_emulation:: x86 and x86-64 emulation
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
47 * intro_arm_emulation:: ARM emulation
24d4de4 Documentation update for MIPS.
ths authored
48 * intro_mips_emulation:: MIPS emulation
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
49 * intro_ppc_emulation:: PowerPC emulation
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
50 * intro_sparc_emulation:: Sparc32 and Sparc64 emulation
51 * intro_other_emulation:: Other CPU emulation
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
52 @end menu
53
54 @node intro_features
1f67313 doc update
bellard authored
55 @section Features
56
57 QEMU is a FAST! processor emulator using a portable dynamic
58 translator.
59
60 QEMU has two operating modes:
61
62 @itemize @minus
63
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
64 @item
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
65 Full system emulation. In this mode (full platform virtualization),
66 QEMU emulates a full system (usually a PC), including a processor and
67 various peripherals. It can be used to launch several different
68 Operating Systems at once without rebooting the host machine or to
69 debug system code.
1f67313 doc update
bellard authored
70
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
71 @item
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
72 User mode emulation. In this mode (application level virtualization),
73 QEMU can launch processes compiled for one CPU on another CPU, however
74 the Operating Systems must match. This can be used for example to ease
75 cross-compilation and cross-debugging.
1f67313 doc update
bellard authored
76 @end itemize
77
78 As QEMU requires no host kernel driver to run, it is very safe and
79 easy to use.
80
81 QEMU generic features:
82
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
83 @itemize
1f67313 doc update
bellard authored
84
85 @item User space only or full system emulation.
86
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
87 @item Using dynamic translation to native code for reasonable speed.
1f67313 doc update
bellard authored
88
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
89 @item
90 Working on x86, x86_64 and PowerPC32/64 hosts. Being tested on ARM,
91 HPPA, Sparc32 and Sparc64. Previous versions had some support for
92 Alpha and S390 hosts, but TCG (see below) doesn't support those yet.
1f67313 doc update
bellard authored
93
94 @item Self-modifying code support.
95
96 @item Precise exceptions support.
97
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
98 @item The virtual CPU is a library (@code{libqemu}) which can be used
ad6a483 update
bellard authored
99 in other projects (look at @file{qemu/tests/qruncom.c} to have an
100 example of user mode @code{libqemu} usage).
1f67313 doc update
bellard authored
101
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
102 @item
103 Floating point library supporting both full software emulation and
104 native host FPU instructions.
105
1f67313 doc update
bellard authored
106 @end itemize
107
108 QEMU user mode emulation features:
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
109 @itemize
1f67313 doc update
bellard authored
110 @item Generic Linux system call converter, including most ioctls.
111
112 @item clone() emulation using native CPU clone() to use Linux scheduler for threads.
113
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
114 @item Accurate signal handling by remapping host signals to target signals.
1f67313 doc update
bellard authored
115 @end itemize
116
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
117 Linux user emulator (Linux host only) can be used to launch the Wine
118 Windows API emulator (@url{http://www.winehq.org}). A Darwin user
119 emulator (Darwin hosts only) exists and a BSD user emulator for BSD
120 hosts is under development. It would also be possible to develop a
121 similar user emulator for Solaris.
122
1f67313 doc update
bellard authored
123 QEMU full system emulation features:
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
124 @itemize
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
125 @item
126 QEMU uses a full software MMU for maximum portability.
127
128 @item
4a1418e Unbreak large mem support by removing kqemu
Anthony Liguori authored
129 QEMU can optionally use an in-kernel accelerator, like kvm. The accelerators
130 execute some of the guest code natively, while
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
131 continuing to emulate the rest of the machine.
132
133 @item
134 Various hardware devices can be emulated and in some cases, host
135 devices (e.g. serial and parallel ports, USB, drives) can be used
136 transparently by the guest Operating System. Host device passthrough
137 can be used for talking to external physical peripherals (e.g. a
138 webcam, modem or tape drive).
139
140 @item
141 Symmetric multiprocessing (SMP) even on a host with a single CPU. On a
142 SMP host system, QEMU can use only one CPU fully due to difficulty in
143 implementing atomic memory accesses efficiently.
144
1f67313 doc update
bellard authored
145 @end itemize
146
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
147 @node intro_x86_emulation
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
148 @section x86 and x86-64 emulation
1f67313 doc update
bellard authored
149
150 QEMU x86 target features:
151
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
152 @itemize
1f67313 doc update
bellard authored
153
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
154 @item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation.
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
155 LDT/GDT and IDT are emulated. VM86 mode is also supported to run
156 DOSEMU. There is some support for MMX/3DNow!, SSE, SSE2, SSE3, SSSE3,
157 and SSE4 as well as x86-64 SVM.
1f67313 doc update
bellard authored
158
159 @item Support of host page sizes bigger than 4KB in user mode emulation.
160
161 @item QEMU can emulate itself on x86.
162
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
163 @item An extensive Linux x86 CPU test program is included @file{tests/test-i386}.
1f67313 doc update
bellard authored
164 It can be used to test other x86 virtual CPUs.
165
166 @end itemize
167
168 Current QEMU limitations:
169
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
170 @itemize
1f67313 doc update
bellard authored
171
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
172 @item Limited x86-64 support.
1f67313 doc update
bellard authored
173
174 @item IPC syscalls are missing.
175
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
176 @item The x86 segment limits and access rights are not tested at every
1f67313 doc update
bellard authored
177 memory access (yet). Hopefully, very few OSes seem to rely on that for
178 normal use.
179
180 @end itemize
181
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
182 @node intro_arm_emulation
1f67313 doc update
bellard authored
183 @section ARM emulation
184
185 @itemize
186
187 @item Full ARM 7 user emulation.
188
189 @item NWFPE FPU support included in user Linux emulation.
190
191 @item Can run most ARM Linux binaries.
192
193 @end itemize
194
24d4de4 Documentation update for MIPS.
ths authored
195 @node intro_mips_emulation
196 @section MIPS emulation
197
198 @itemize
199
200 @item The system emulation allows full MIPS32/MIPS64 Release 2 emulation,
201 including privileged instructions, FPU and MMU, in both little and big
202 endian modes.
203
204 @item The Linux userland emulation can run many 32 bit MIPS Linux binaries.
205
206 @end itemize
207
208 Current QEMU limitations:
209
210 @itemize
211
212 @item Self-modifying code is not always handled correctly.
213
214 @item 64 bit userland emulation is not implemented.
215
216 @item The system emulation is not complete enough to run real firmware.
217
b1f4523 More documentation bits, from Stefan Weil.
ths authored
218 @item The watchpoint debug facility is not implemented.
219
24d4de4 Documentation update for MIPS.
ths authored
220 @end itemize
221
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
222 @node intro_ppc_emulation
1f67313 doc update
bellard authored
223 @section PowerPC emulation
224
225 @itemize
226
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
227 @item Full PowerPC 32 bit emulation, including privileged instructions,
1f67313 doc update
bellard authored
228 FPU and MMU.
229
230 @item Can run most PowerPC Linux binaries.
231
232 @end itemize
233
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
234 @node intro_sparc_emulation
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
235 @section Sparc32 and Sparc64 emulation
1f67313 doc update
bellard authored
236
237 @itemize
238
f6b647c Documentation update
blueswir1 authored
239 @item Full SPARC V8 emulation, including privileged
3475187 sparc64 marge (Blue Swirl)
bellard authored
240 instructions, FPU and MMU. SPARC V9 emulation includes most privileged
a785e42 Update Sparc parts in documentation
blueswir1 authored
241 and VIS instructions, FPU and I/D MMU. Alignment is fully enforced.
1f67313 doc update
bellard authored
242
a785e42 Update Sparc parts in documentation
blueswir1 authored
243 @item Can run most 32-bit SPARC Linux binaries, SPARC32PLUS Linux binaries and
244 some 64-bit SPARC Linux binaries.
3475187 sparc64 marge (Blue Swirl)
bellard authored
245
246 @end itemize
247
248 Current QEMU limitations:
249
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
250 @itemize
3475187 sparc64 marge (Blue Swirl)
bellard authored
251
252 @item IPC syscalls are missing.
253
1f58732 128-bit float support for user mode
blueswir1 authored
254 @item Floating point exception support is buggy.
3475187 sparc64 marge (Blue Swirl)
bellard authored
255
256 @item Atomic instructions are not correctly implemented.
257
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
258 @item There are still some problems with Sparc64 emulators.
259
260 @end itemize
261
262 @node intro_other_emulation
263 @section Other CPU emulation
1f67313 doc update
bellard authored
264
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
265 In addition to the above, QEMU supports emulation of other CPUs with
266 varying levels of success. These are:
267
268 @itemize
269
270 @item
271 Alpha
272 @item
273 CRIS
274 @item
275 M68k
276 @item
277 SH4
1f67313 doc update
bellard authored
278 @end itemize
279
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
280 @node QEMU Internals
1f67313 doc update
bellard authored
281 @chapter QEMU Internals
282
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
283 @menu
284 * QEMU compared to other emulators::
285 * Portable dynamic translation::
286 * Condition code optimisations::
287 * CPU state optimisations::
288 * Translation cache::
289 * Direct block chaining::
290 * Self-modifying code and translated code invalidation::
291 * Exception support::
292 * MMU emulation::
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
293 * Device emulation::
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
294 * Hardware interrupts::
295 * User emulation specific details::
296 * Bibliography::
297 @end menu
298
299 @node QEMU compared to other emulators
1f67313 doc update
bellard authored
300 @section QEMU compared to other emulators
301
302 Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than
303 bochs as it uses dynamic compilation. Bochs is closely tied to x86 PC
304 emulation while QEMU can emulate several processors.
305
306 Like Valgrind [2], QEMU does user space emulation and dynamic
307 translation. Valgrind is mainly a memory debugger while QEMU has no
308 support for it (QEMU could be used to detect out of bound memory
309 accesses as Valgrind, but it has no support to track uninitialised data
310 as Valgrind does). The Valgrind dynamic translator generates better code
311 than QEMU (in particular it does register allocation) but it is closely
312 tied to an x86 host and target and has no support for precise exceptions
313 and system emulation.
314
315 EM86 [4] is the closest project to user space QEMU (and QEMU still uses
316 some of its code, in particular the ELF file loader). EM86 was limited
317 to an alpha host and used a proprietary and slow interpreter (the
318 interpreter part of the FX!32 Digital Win32 code translator [5]).
319
320 TWIN [6] is a Windows API emulator like Wine. It is less accurate than
321 Wine but includes a protected mode x86 interpreter to launch x86 Windows
36d54d1 update
bellard authored
322 executables. Such an approach has greater potential because most of the
1f67313 doc update
bellard authored
323 Windows API is executed natively but it is far more difficult to develop
324 because all the data structures and function parameters exchanged
325 between the API and the x86 code must be converted.
326
327 User mode Linux [7] was the only solution before QEMU to launch a
328 Linux kernel as a process while not needing any host kernel
329 patches. However, user mode Linux requires heavy kernel patches while
330 QEMU accepts unpatched Linux kernels. The price to pay is that QEMU is
331 slower.
332
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
333 The Plex86 [8] PC virtualizer is done in the same spirit as the now
334 obsolete qemu-fast system emulator. It requires a patched Linux kernel
335 to work (you cannot launch the same kernel on your PC), but the
336 patches are really small. As it is a PC virtualizer (no emulation is
337 done except for some privileged instructions), it has the potential of
338 being faster than QEMU. The downside is that a complicated (and
339 potentially unsafe) host kernel patch is needed.
1f67313 doc update
bellard authored
340
341 The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo
342 [11]) are faster than QEMU, but they all need specific, proprietary
343 and potentially unsafe host drivers. Moreover, they are unable to
344 provide cycle exact simulation as an emulator can.
345
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
346 VirtualBox [12], Xen [13] and KVM [14] are based on QEMU. QEMU-SystemC
347 [15] uses QEMU to simulate a system where some hardware devices are
348 developed in SystemC.
349
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
350 @node Portable dynamic translation
1f67313 doc update
bellard authored
351 @section Portable dynamic translation
352
353 QEMU is a dynamic translator. When it first encounters a piece of code,
354 it converts it to the host instruction set. Usually dynamic translators
355 are very complicated and highly CPU dependent. QEMU uses some tricks
356 which make it relatively easily portable and simple while achieving good
357 performances.
358
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
359 After the release of version 0.9.1, QEMU switched to a new method of
360 generating code, Tiny Code Generator or TCG. TCG relaxes the
361 dependency on the exact version of the compiler used. The basic idea
362 is to split every target instruction into a couple of RISC-like TCG
363 ops (see @code{target-i386/translate.c}). Some optimizations can be
364 performed at this stage, including liveness analysis and trivial
365 constant expression evaluation. TCG ops are then implemented in the
366 host CPU back end, also known as TCG target (see
367 @code{tcg/i386/tcg-target.c}). For more information, please take a
368 look at @code{tcg/README}.
1f67313 doc update
bellard authored
369
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
370 @node Condition code optimisations
1f67313 doc update
bellard authored
371 @section Condition code optimisations
372
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
373 Lazy evaluation of CPU condition codes (@code{EFLAGS} register on x86)
374 is important for CPUs where every instruction sets the condition
375 codes. It tends to be less important on conventional RISC systems
f0f26a0 @blueswirl Update docs on dynamic condition code calculation
blueswirl authored
376 where condition codes are only updated when explicitly requested. On
377 Sparc64, costly update of both 32 and 64 bit condition codes can be
378 avoided with lazy evaluation.
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
379
380 Instead of computing the condition codes after each x86 instruction,
381 QEMU just stores one operand (called @code{CC_SRC}), the result
382 (called @code{CC_DST}) and the type of operation (called
383 @code{CC_OP}). When the condition codes are needed, the condition
384 codes can be calculated using this information. In addition, an
385 optimized calculation can be performed for some instruction types like
386 conditional branches.
1f67313 doc update
bellard authored
387
1235fc0 Spelling fixes, by Stefan Weil.
ths authored
388 @code{CC_OP} is almost never explicitly set in the generated code
1f67313 doc update
bellard authored
389 because it is known at translation time.
390
f0f26a0 @blueswirl Update docs on dynamic condition code calculation
blueswirl authored
391 The lazy condition code evaluation is used on x86, m68k, cris and
392 Sparc. ARM uses a simplified variant for the N and Z flags.
1f67313 doc update
bellard authored
393
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
394 @node CPU state optimisations
1f67313 doc update
bellard authored
395 @section CPU state optimisations
396
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
397 The target CPUs have many internal states which change the way it
398 evaluates instructions. In order to achieve a good speed, the
399 translation phase considers that some state information of the virtual
400 CPU cannot change in it. The state is recorded in the Translation
401 Block (TB). If the state changes (e.g. privilege level), a new TB will
402 be generated and the previous TB won't be used anymore until the state
403 matches the state recorded in the previous TB. For example, if the SS,
404 DS and ES segments have a zero base, then the translator does not even
405 generate an addition for the segment base.
1f67313 doc update
bellard authored
406
407 [The FPU stack pointer register is not handled that way yet].
408
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
409 @node Translation cache
1f67313 doc update
bellard authored
410 @section Translation cache
411
15a34c6 doc update
bellard authored
412 A 16 MByte cache holds the most recently used translations. For
1f67313 doc update
bellard authored
413 simplicity, it is completely flushed when it is full. A translation unit
414 contains just a single basic block (a block of x86 instructions
415 terminated by a jump or by a virtual CPU state change which the
416 translator cannot deduce statically).
417
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
418 @node Direct block chaining
1f67313 doc update
bellard authored
419 @section Direct block chaining
420
421 After each translated basic block is executed, QEMU uses the simulated
422 Program Counter (PC) and other cpu state informations (such as the CS
423 segment base value) to find the next basic block.
424
425 In order to accelerate the most common cases where the new simulated PC
426 is known, QEMU can patch a basic block so that it jumps directly to the
427 next one.
428
429 The most portable code uses an indirect jump. An indirect jump makes
430 it easier to make the jump target modification atomic. On some host
431 architectures (such as x86 or PowerPC), the @code{JUMP} opcode is
432 directly patched so that the block chaining has no overhead.
433
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
434 @node Self-modifying code and translated code invalidation
1f67313 doc update
bellard authored
435 @section Self-modifying code and translated code invalidation
436
437 Self-modifying code is a special challenge in x86 emulation because no
438 instruction cache invalidation is signaled by the application when code
439 is modified.
440
441 When translated code is generated for a basic block, the corresponding
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
442 host page is write protected if it is not already read-only. Then, if
443 a write access is done to the page, Linux raises a SEGV signal. QEMU
444 then invalidates all the translated code in the page and enables write
445 accesses to the page.
1f67313 doc update
bellard authored
446
447 Correct translated code invalidation is done efficiently by maintaining
448 a linked list of every translated block contained in a given page. Other
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
449 linked lists are also maintained to undo direct block chaining.
1f67313 doc update
bellard authored
450
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
451 On RISC targets, correctly written software uses memory barriers and
452 cache flushes, so some of the protection above would not be
453 necessary. However, QEMU still requires that the generated code always
454 matches the target instructions in memory in order to handle
455 exceptions correctly.
1f67313 doc update
bellard authored
456
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
457 @node Exception support
1f67313 doc update
bellard authored
458 @section Exception support
459
460 longjmp() is used when an exception such as division by zero is
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
461 encountered.
1f67313 doc update
bellard authored
462
463 The host SIGSEGV and SIGBUS signal handlers are used to get invalid
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
464 memory accesses. The simulated program counter is found by
465 retranslating the corresponding basic block and by looking where the
466 host program counter was at the exception point.
1f67313 doc update
bellard authored
467
468 The virtual CPU cannot retrieve the exact @code{EFLAGS} register because
469 in some cases it is not computed because of condition code
470 optimisations. It is not a big concern because the emulated code can
471 still be restarted in any cases.
472
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
473 @node MMU emulation
1f67313 doc update
bellard authored
474 @section MMU emulation
475
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
476 For system emulation QEMU supports a soft MMU. In that mode, the MMU
477 virtual to physical address translation is done at every memory
478 access. QEMU uses an address translation cache to speed up the
479 translation.
1f67313 doc update
bellard authored
480
481 In order to avoid flushing the translated code each time the MMU
482 mappings change, QEMU uses a physically indexed translation cache. It
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
483 means that each basic block is indexed with its physical address.
1f67313 doc update
bellard authored
484
485 When MMU mappings change, only the chaining of the basic blocks is
486 reset (i.e. a basic block can no longer jump directly to another one).
487
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
488 @node Device emulation
489 @section Device emulation
490
491 Systems emulated by QEMU are organized by boards. At initialization
492 phase, each board instantiates a number of CPUs, devices, RAM and
493 ROM. Each device in turn can assign I/O ports or memory areas (for
494 MMIO) to its handlers. When the emulation starts, an access to the
495 ports or MMIO memory areas assigned to the device causes the
496 corresponding handler to be called.
497
498 RAM and ROM are handled more optimally, only the offset to the host
499 memory needs to be added to the guest address.
500
501 The video RAM of VGA and other display cards is special: it can be
502 read or written directly like RAM, but write accesses cause the memory
503 to be marked with VGA_DIRTY flag as well.
504
505 QEMU supports some device classes like serial and parallel ports, USB,
506 drives and network devices, by providing APIs for easier connection to
507 the generic, higher level implementations. The API hides the
508 implementation details from the devices, like native device use or
509 advanced block device formats like QCOW.
510
511 Usually the devices implement a reset method and register support for
512 saving and loading of the device state. The devices can also use
513 timers, especially together with the use of bottom halves (BHs).
514
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
515 @node Hardware interrupts
1f67313 doc update
bellard authored
516 @section Hardware interrupts
517
518 In order to be faster, QEMU does not check at every basic block if an
519 hardware interrupt is pending. Instead, the user must asynchrously
520 call a specific function to tell that an interrupt is pending. This
521 function resets the chaining of the currently executing basic
522 block. It ensures that the execution will return soon in the main loop
523 of the CPU emulator. Then the main loop can test if the interrupt is
524 pending and handle it.
525
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
526 @node User emulation specific details
1f67313 doc update
bellard authored
527 @section User emulation specific details
528
529 @subsection Linux system call translation
530
531 QEMU includes a generic system call translator for Linux. It means that
532 the parameters of the system calls can be converted to fix the
533 endianness and 32/64 bit issues. The IOCTLs are converted with a generic
534 type description system (see @file{ioctls.h} and @file{thunk.c}).
535
536 QEMU supports host CPUs which have pages bigger than 4KB. It records all
537 the mappings the process does and try to emulated the @code{mmap()}
538 system calls in cases where the host @code{mmap()} call would fail
539 because of bad page alignment.
540
541 @subsection Linux signals
542
543 Normal and real-time signals are queued along with their information
544 (@code{siginfo_t}) as it is done in the Linux kernel. Then an interrupt
545 request is done to the virtual CPU. When it is interrupted, one queued
546 signal is handled by generating a stack frame in the virtual CPU as the
547 Linux kernel does. The @code{sigreturn()} system call is emulated to return
548 from the virtual signal handler.
549
550 Some signals (such as SIGALRM) directly come from the host. Other
551 signals are synthetized from the virtual CPU exceptions such as SIGFPE
552 when a division by zero is done (see @code{main.c:cpu_loop()}).
553
554 The blocked signal mask is still handled by the host Linux kernel so
555 that most signal system calls can be redirected directly to the host
556 Linux kernel. Only the @code{sigaction()} and @code{sigreturn()} system
557 calls need to be fully emulated (see @file{signal.c}).
558
559 @subsection clone() system call and threads
560
561 The Linux clone() system call is usually used to create a thread. QEMU
562 uses the host clone() system call so that real host threads are created
563 for each emulated thread. One virtual CPU instance is created for each
564 thread.
565
566 The virtual x86 CPU atomic operations are emulated with a global lock so
567 that their semantic is preserved.
568
569 Note that currently there are still some locking issues in QEMU. In
570 particular, the translated cache flush is not protected yet against
571 reentrancy.
572
573 @subsection Self-virtualization
574
575 QEMU was conceived so that ultimately it can emulate itself. Although
576 it is not very useful, it is an important test to show the power of the
577 emulator.
578
579 Achieving self-virtualization is not easy because there may be address
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
580 space conflicts. QEMU user emulators solve this problem by being an
581 executable ELF shared object as the ld-linux.so ELF interpreter. That
582 way, it can be relocated at load time.
1f67313 doc update
bellard authored
583
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
584 @node Bibliography
1f67313 doc update
bellard authored
585 @section Bibliography
586
587 @table @asis
588
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
589 @item [1]
1f67313 doc update
bellard authored
590 @url{http://citeseer.nj.nec.com/piumarta98optimizing.html}, Optimizing
591 direct threaded code by selective inlining (1998) by Ian Piumarta, Fabio
592 Riccardi.
593
594 @item [2]
595 @url{http://developer.kde.org/~sewardj/}, Valgrind, an open-source
596 memory debugger for x86-GNU/Linux, by Julian Seward.
597
598 @item [3]
599 @url{http://bochs.sourceforge.net/}, the Bochs IA-32 Emulator Project,
600 by Kevin Lawton et al.
601
602 @item [4]
603 @url{http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html}, the EM86
604 x86 emulator on Alpha-Linux.
605
606 @item [5]
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
607 @url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf},
1f67313 doc update
bellard authored
608 DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton
609 Chernoff and Ray Hookway.
610
611 @item [6]
612 @url{http://www.willows.com/}, Windows API library emulation from
613 Willows Software.
614
615 @item [7]
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
616 @url{http://user-mode-linux.sourceforge.net/},
1f67313 doc update
bellard authored
617 The User-mode Linux Kernel.
618
619 @item [8]
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
620 @url{http://www.plex86.org/},
1f67313 doc update
bellard authored
621 The new Plex86 project.
622
623 @item [9]
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
624 @url{http://www.vmware.com/},
1f67313 doc update
bellard authored
625 The VMWare PC virtualizer.
626
627 @item [10]
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
628 @url{http://www.microsoft.com/windowsxp/virtualpc/},
1f67313 doc update
bellard authored
629 The VirtualPC PC virtualizer.
630
631 @item [11]
5fafdf2 find -type f | xargs sed -i 's/[\t ]$//g' # on most files
ths authored
632 @url{http://www.twoostwo.org/},
1f67313 doc update
bellard authored
633 The TwoOStwo PC virtualizer.
634
998a050 Update (thanks to Edgar, Thiemo, malc, Paul, Laurent and Andrzej)
blueswir1 authored
635 @item [12]
636 @url{http://virtualbox.org/},
637 The VirtualBox PC virtualizer.
638
639 @item [13]
640 @url{http://www.xen.org/},
641 The Xen hypervisor.
642
643 @item [14]
644 @url{http://kvm.qumranet.com/kvmwiki/Front_Page},
645 Kernel Based Virtual Machine (KVM).
646
647 @item [15]
648 @url{http://www.greensocs.com/projects/QEMUSystemC},
649 QEMU-SystemC, a hardware co-simulator.
650
1f67313 doc update
bellard authored
651 @end table
652
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
653 @node Regression Tests
1f67313 doc update
bellard authored
654 @chapter Regression Tests
655
656 In the directory @file{tests/}, various interesting testing programs
b1f4523 More documentation bits, from Stefan Weil.
ths authored
657 are available. They are used for regression testing.
1f67313 doc update
bellard authored
658
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
659 @menu
660 * test-i386::
661 * linux-test::
662 * qruncom.c::
663 @end menu
664
665 @node test-i386
1f67313 doc update
bellard authored
666 @section @file{test-i386}
667
668 This program executes most of the 16 bit and 32 bit x86 instructions and
669 generates a text output. It can be compared with the output obtained with
670 a real CPU or another emulator. The target @code{make test} runs this
671 program and a @code{diff} on the generated output.
672
673 The Linux system call @code{modify_ldt()} is used to create x86 selectors
674 to test some 16 bit addressing and 32 bit with segmentation cases.
675
676 The Linux system call @code{vm86()} is used to test vm86 emulation.
677
678 Various exceptions are raised to test most of the x86 user space
679 exception reporting.
680
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
681 @node linux-test
1f67313 doc update
bellard authored
682 @section @file{linux-test}
683
684 This program tests various Linux system calls. It is used to verify
685 that the system call parameters are correctly converted between target
686 and host CPUs.
687
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
688 @node qruncom.c
15a34c6 doc update
bellard authored
689 @section @file{qruncom.c}
1f67313 doc update
bellard authored
690
15a34c6 doc update
bellard authored
691 Example of usage of @code{libqemu} to emulate a user mode i386 CPU.
debc706 Enhanced Documentation (Stefan Weil)
bellard authored
692
693 @node Index
694 @chapter Index
695 @printindex cp
696
697 @bye
Something went wrong with that request. Please try again.