/[qemu]/qemu/qemu-doc.texi
ViewVC logotype

Diff of /qemu/qemu-doc.texi

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.7 by bellard, Tue Apr 29 20:40:35 2003 UTC revision 1.8 by bellard, Wed May 28 00:27:57 2003 UTC
# Line 10  Line 10 
10  @chapter Introduction  @chapter Introduction
11    
12  QEMU is an x86 processor emulator. Its purpose is to run x86 Linux  QEMU is an x86 processor emulator. Its purpose is to run x86 Linux
13  processes on non-x86 Linux architectures such as PowerPC or ARM. By  processes on non-x86 Linux architectures such as PowerPC. By using
14  using dynamic translation it achieves a reasonnable speed while being  dynamic translation it achieves a reasonnable speed while being easy to
15  easy to port on new host CPUs. Its main goal is to be able to launch the  port on new host CPUs. Its main goal is to be able to launch the
16  @code{Wine} Windows API emulator (@url{http://www.winehq.org}) on  @code{Wine} Windows API emulator (@url{http://www.winehq.org}) or
17  non-x86 CPUs.  @code{DOSEMU} (@url{http://www.dosemu.org}) on non-x86 CPUs.
18    
19  QEMU features:  QEMU features:
20    
# Line 22  QEMU features: Line 22  QEMU features:
22    
23  @item User space only x86 emulator.  @item User space only x86 emulator.
24    
25  @item Currently ported on i386, PowerPC and S390.  @item Currently ported on i386, PowerPC. Work in progress for S390, Alpha and Sparc.
26    
27  @item Using dynamic translation to native code for reasonnable speed.  @item Using dynamic translation to native code for reasonnable speed.
28    
29  @item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation.  @item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation.
30  User space LDT and GDT are emulated. VM86 mode is also supported  User space LDT and GDT are emulated. VM86 mode is also supported.
 (experimental).  
31    
32  @item Generic Linux system call converter, including most ioctls.  @item Generic Linux system call converter, including most ioctls.
33    
34  @item clone() emulation using native CPU clone() to use Linux scheduler for threads.  @item clone() emulation using native CPU clone() to use Linux scheduler for threads.
35    
36  @item Accurate signal handling by remapping host signals to virtual x86 signals.  @item Accurate signal handling by remapping host signals to virtual x86 signals.
37    
38  @item QEMU can emulate itself on x86 (experimental).  @item Precise user space x86 exceptions.
39    
40    @item Self-modifying code support.
41    
42    @item Support of host page sizes bigger than 4KB.
43    
44    @item QEMU can emulate itself on x86.
45    
46  @item The virtual x86 CPU is a library (@code{libqemu}) which can be used  @item The virtual x86 CPU is a library (@code{libqemu}) which can be used
47  in other projects.  in other projects.
# Line 46  It can be used to test other x86 virtual Line 51  It can be used to test other x86 virtual
51    
52  @end itemize  @end itemize
53    
54  Current QEMU Limitations:  Current QEMU limitations:
55    
56  @itemize  @itemize
57    
 @item Not all x86 exceptions are precise (yet). [Very few programs need that].  
   
 @item No support for self-modifying code (yet). [Very few programs need that, a notable exception is QEMU itself !].  
   
58  @item No SSE/MMX support (yet).  @item No SSE/MMX support (yet).
59    
60  @item No x86-64 support.  @item No x86-64 support.
61    
62  @item Some Linux syscalls are missing.  @item IPC syscalls are missing.
63    
64  @item The x86 segment limits and access rights are not tested at every  @item The x86 segment limits and access rights are not tested at every
65  memory access (and will never be to have good performances).  memory access (and will never be to have good performances).
# Line 119  qemu /usr/local/qemu-i386/bin/qemu-i386 Line 120  qemu /usr/local/qemu-i386/bin/qemu-i386
120    
121  @end itemize  @end itemize
122    
123  @section Wine launch (Currently only tested when emulating x86 on x86)  @section Wine launch
124    
125  @itemize  @itemize
126    
# Line 152  qemu /usr/local/qemu-i386/wine/bin/wine Line 153  qemu /usr/local/qemu-i386/wine/bin/wine
153  usage: qemu [-h] [-d] [-L path] [-s size] program [arguments...]  usage: qemu [-h] [-d] [-L path] [-s size] program [arguments...]
154  @end example  @end example
155    
156  @table @samp  @table @option
157  @item -h  @item -h
158  Print the help  Print the help
 @item -d  
 Activate log (logfile=/tmp/qemu.log)  
159  @item -L path    @item -L path  
160  Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)  Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)
161  @item -s size  @item -s size
162  Set the x86 stack size in bytes (default=524288)  Set the x86 stack size in bytes (default=524288)
163  @end table  @end table
164    
165    Debug options:
166    
167    @table @option
168    @item -d
169    Activate log (logfile=/tmp/qemu.log)
170    @item -p pagesize
171    Act as if the host page size was 'pagesize' bytes
172    @end table
173    
174  @chapter QEMU Internals  @chapter QEMU Internals
175    
176  @section QEMU compared to other emulators  @section QEMU compared to other emulators
# Line 265  contains just a single basic block (a bl Line 273  contains just a single basic block (a bl
273  terminated by a jump or by a virtual CPU state change which the  terminated by a jump or by a virtual CPU state change which the
274  translator cannot deduce statically).  translator cannot deduce statically).
275    
276  [Currently, the translated code is not patched if it jumps to another  @section Direct block chaining
277  translated code].  
278    After each translated basic block is executed, QEMU uses the simulated
279    Program Counter (PC) and other cpu state informations (such as the CS
280    segment base value) to find the next basic block.
281    
282    In order to accelerate the most common cases where the new simulated PC
283    is known, QEMU can patch a basic block so that it jumps directly to the
284    next one.
285    
286    The most portable code uses an indirect jump. An indirect jump makes it
287    easier to make the jump target modification atomic. On some
288    architectures (such as PowerPC), the @code{JUMP} opcode is directly
289    patched so that the block chaining has no overhead.
290    
291    @section Self-modifying code and translated code invalidation
292    
293    Self-modifying code is a special challenge in x86 emulation because no
294    instruction cache invalidation is signaled by the application when code
295    is modified.
296    
297    When translated code is generated for a basic block, the corresponding
298    host page is write protected if it is not already read-only (with the
299    system call @code{mprotect()}). Then, if a write access is done to the
300    page, Linux raises a SEGV signal. QEMU then invalidates all the
301    translated code in the page and enables write accesses to the page.
302    
303    Correct translated code invalidation is done efficiently by maintaining
304    a linked list of every translated block contained in a given page. Other
305    linked lists are also maintained to undo direct block chaining.
306    
307    Althought the overhead of doing @code{mprotect()} calls is important,
308    most MSDOS programs can be emulated at reasonnable speed with QEMU and
309    DOSEMU.
310    
311    Note that QEMU also invalidates pages of translated code when it detects
312    that memory mappings are modified with @code{mmap()} or @code{munmap()}.
313    
314  @section Exception support  @section Exception support
315    
316  longjmp() is used when an exception such as division by zero is  longjmp() is used when an exception such as division by zero is
317  encountered. The host SIGSEGV and SIGBUS signal handlers are used to get  encountered.
 invalid memory accesses.  
318    
319  [Currently, the virtual CPU cannot retrieve the exact CPU state in some  The host SIGSEGV and SIGBUS signal handlers are used to get invalid
320  exceptions, although it could except for the @code{EFLAGS} register].  memory accesses. The exact CPU state can be retrieved because all the
321    x86 registers are stored in fixed host registers. The simulated program
322    counter is found by retranslating the corresponding basic block and by
323    looking where the host program counter was at the exception point.
324    
325    The virtual CPU cannot retrieve the exact @code{EFLAGS} register because
326    in some cases it is not computed because of condition code
327    optimisations. It is not a big concern because the emulated code can
328    still be restarted in any cases.
329    
330  @section Linux system call translation  @section Linux system call translation
331    
# Line 284  the parameters of the system calls can b Line 334  the parameters of the system calls can b
334  endianness and 32/64 bit issues. The IOCTLs are converted with a generic  endianness and 32/64 bit issues. The IOCTLs are converted with a generic
335  type description system (see @file{ioctls.h} and @file{thunk.c}).  type description system (see @file{ioctls.h} and @file{thunk.c}).
336    
337    QEMU supports host CPUs which have pages bigger than 4KB. It records all
338    the mappings the process does and try to emulated the @code{mmap()}
339    system calls in cases where the host @code{mmap()} call would fail
340    because of bad page alignment.
341    
342  @section Linux signals  @section Linux signals
343    
344  Normal and real-time signals are queued along with their information  Normal and real-time signals are queued along with their information
# Line 312  thread. Line 367  thread.
367  The virtual x86 CPU atomic operations are emulated with a global lock so  The virtual x86 CPU atomic operations are emulated with a global lock so
368  that their semantic is preserved.  that their semantic is preserved.
369    
370    Note that currently there are still some locking issues in QEMU. In
371    particular, the translated cache flush is not protected yet against
372    reentrancy.
373    
374  @section Self-virtualization  @section Self-virtualization
375    
376  QEMU was conceived so that ultimately it can emulate itself. Althought  QEMU was conceived so that ultimately it can emulate itself. Althought
# Line 323  space conflicts. QEMU solves this proble Line 382  space conflicts. QEMU solves this proble
382  shared object as the ld-linux.so ELF interpreter. That way, it can be  shared object as the ld-linux.so ELF interpreter. That way, it can be
383  relocated at load time.  relocated at load time.
384    
 Since self-modifying code is not supported yet, QEMU cannot emulate  
 itself in case of translation cache flush. This limitation will be  
 suppressed soon.  
   
385  @section Bibliography  @section Bibliography
386    
387  @table @asis  @table @asis
# Line 379  program and a @code{diff} on the generat Line 434  program and a @code{diff} on the generat
434  The Linux system call @code{modify_ldt()} is used to create x86 selectors  The Linux system call @code{modify_ldt()} is used to create x86 selectors
435  to test some 16 bit addressing and 32 bit with segmentation cases.  to test some 16 bit addressing and 32 bit with segmentation cases.
436    
437  @section @file{testsig}  The Linux system call @code{vm86()} is used to test vm86 emulation.
438    
439  This program tests various signal cases, including SIGFPE, SIGSEGV and  Various exceptions are raised to test most of the x86 user space
440  SIGILL.  exception reporting.
   
 @section @file{testclone}  
   
 Tests the @code{clone()} system call (basic test).  
   
 @section @file{testthread}  
   
 Tests the glibc threads (more complicated than @code{clone()} because signals  
 are also used).  
441    
442  @section @file{sha1}  @section @file{sha1}
443    
# Line 399  It is a simple benchmark. Care must be t Line 445  It is a simple benchmark. Care must be t
445  because it mostly tests the ability of the virtual CPU to optimize the  because it mostly tests the ability of the virtual CPU to optimize the
446  @code{rol} x86 instruction and the condition code computations.  @code{rol} x86 instruction and the condition code computations.
447    
 @section @file{runcom}  
   
 A very simple MSDOS emulator to test the Linux vm86() system call  
 emulation. The excellent 54 byte @file{pi_10.com} PI number calculator  
 can be launched with it. @file{pi_10.com} was written by Bertram  
 Felgenhauer (more information at @url{http://www.boo.net/~jasonp/pipage.html}).  

Legend:
Removed from v.1.7  
changed lines
  Added in v.1.8

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26