10 |
@chapter Introduction |
@chapter Introduction |
11 |
|
|
12 |
QEMU is an x86 processor emulator. Its purpose is to run x86 Linux |
QEMU is an x86 processor emulator. Its purpose is to run x86 Linux |
13 |
processes on non-x86 Linux architectures such as PowerPC or ARM. By |
processes on non-x86 Linux architectures such as PowerPC. By using |
14 |
using dynamic translation it achieves a reasonnable speed while being |
dynamic translation it achieves a reasonnable speed while being easy to |
15 |
easy to port on new host CPUs. Its main goal is to be able to launch the |
port on new host CPUs. Its main goal is to be able to launch the |
16 |
@code{Wine} Windows API emulator (@url{http://www.winehq.org}) on |
@code{Wine} Windows API emulator (@url{http://www.winehq.org}) or |
17 |
non-x86 CPUs. |
@code{DOSEMU} (@url{http://www.dosemu.org}) on non-x86 CPUs. |
18 |
|
|
19 |
QEMU features: |
QEMU features: |
20 |
|
|
22 |
|
|
23 |
@item User space only x86 emulator. |
@item User space only x86 emulator. |
24 |
|
|
25 |
@item Currently ported on i386, PowerPC and S390. |
@item Currently ported on i386, PowerPC. Work in progress for S390, Alpha and Sparc. |
26 |
|
|
27 |
@item Using dynamic translation to native code for reasonnable speed. |
@item Using dynamic translation to native code for reasonnable speed. |
28 |
|
|
29 |
@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
30 |
User space LDT and GDT are emulated. VM86 mode is also supported |
User space LDT and GDT are emulated. VM86 mode is also supported. |
|
(experimental). |
|
31 |
|
|
32 |
@item Generic Linux system call converter, including most ioctls. |
@item Generic Linux system call converter, including most ioctls. |
33 |
|
|
34 |
@item clone() emulation using native CPU clone() to use Linux scheduler for threads. |
@item clone() emulation using native CPU clone() to use Linux scheduler for threads. |
35 |
|
|
36 |
@item Accurate signal handling by remapping host signals to virtual x86 signals. |
@item Accurate signal handling by remapping host signals to virtual x86 signals. |
37 |
|
|
38 |
@item QEMU can emulate itself on x86 (experimental). |
@item Precise user space x86 exceptions. |
39 |
|
|
40 |
|
@item Self-modifying code support. |
41 |
|
|
42 |
|
@item Support of host page sizes bigger than 4KB. |
43 |
|
|
44 |
|
@item QEMU can emulate itself on x86. |
45 |
|
|
46 |
@item The virtual x86 CPU is a library (@code{libqemu}) which can be used |
@item The virtual x86 CPU is a library (@code{libqemu}) which can be used |
47 |
in other projects. |
in other projects. |
51 |
|
|
52 |
@end itemize |
@end itemize |
53 |
|
|
54 |
Current QEMU Limitations: |
Current QEMU limitations: |
55 |
|
|
56 |
@itemize |
@itemize |
57 |
|
|
|
@item Not all x86 exceptions are precise (yet). [Very few programs need that]. |
|
|
|
|
|
@item No support for self-modifying code (yet). [Very few programs need that, a notable exception is QEMU itself !]. |
|
|
|
|
58 |
@item No SSE/MMX support (yet). |
@item No SSE/MMX support (yet). |
59 |
|
|
60 |
@item No x86-64 support. |
@item No x86-64 support. |
61 |
|
|
62 |
@item Some Linux syscalls are missing. |
@item IPC syscalls are missing. |
63 |
|
|
64 |
@item The x86 segment limits and access rights are not tested at every |
@item The x86 segment limits and access rights are not tested at every |
65 |
memory access (and will never be to have good performances). |
memory access (and will never be to have good performances). |
120 |
|
|
121 |
@end itemize |
@end itemize |
122 |
|
|
123 |
@section Wine launch (Currently only tested when emulating x86 on x86) |
@section Wine launch |
124 |
|
|
125 |
@itemize |
@itemize |
126 |
|
|
153 |
usage: qemu [-h] [-d] [-L path] [-s size] program [arguments...] |
usage: qemu [-h] [-d] [-L path] [-s size] program [arguments...] |
154 |
@end example |
@end example |
155 |
|
|
156 |
@table @samp |
@table @option |
157 |
@item -h |
@item -h |
158 |
Print the help |
Print the help |
|
@item -d |
|
|
Activate log (logfile=/tmp/qemu.log) |
|
159 |
@item -L path |
@item -L path |
160 |
Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386) |
Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386) |
161 |
@item -s size |
@item -s size |
162 |
Set the x86 stack size in bytes (default=524288) |
Set the x86 stack size in bytes (default=524288) |
163 |
@end table |
@end table |
164 |
|
|
165 |
|
Debug options: |
166 |
|
|
167 |
|
@table @option |
168 |
|
@item -d |
169 |
|
Activate log (logfile=/tmp/qemu.log) |
170 |
|
@item -p pagesize |
171 |
|
Act as if the host page size was 'pagesize' bytes |
172 |
|
@end table |
173 |
|
|
174 |
@chapter QEMU Internals |
@chapter QEMU Internals |
175 |
|
|
176 |
@section QEMU compared to other emulators |
@section QEMU compared to other emulators |
273 |
terminated by a jump or by a virtual CPU state change which the |
terminated by a jump or by a virtual CPU state change which the |
274 |
translator cannot deduce statically). |
translator cannot deduce statically). |
275 |
|
|
276 |
[Currently, the translated code is not patched if it jumps to another |
@section Direct block chaining |
277 |
translated code]. |
|
278 |
|
After each translated basic block is executed, QEMU uses the simulated |
279 |
|
Program Counter (PC) and other cpu state informations (such as the CS |
280 |
|
segment base value) to find the next basic block. |
281 |
|
|
282 |
|
In order to accelerate the most common cases where the new simulated PC |
283 |
|
is known, QEMU can patch a basic block so that it jumps directly to the |
284 |
|
next one. |
285 |
|
|
286 |
|
The most portable code uses an indirect jump. An indirect jump makes it |
287 |
|
easier to make the jump target modification atomic. On some |
288 |
|
architectures (such as PowerPC), the @code{JUMP} opcode is directly |
289 |
|
patched so that the block chaining has no overhead. |
290 |
|
|
291 |
|
@section Self-modifying code and translated code invalidation |
292 |
|
|
293 |
|
Self-modifying code is a special challenge in x86 emulation because no |
294 |
|
instruction cache invalidation is signaled by the application when code |
295 |
|
is modified. |
296 |
|
|
297 |
|
When translated code is generated for a basic block, the corresponding |
298 |
|
host page is write protected if it is not already read-only (with the |
299 |
|
system call @code{mprotect()}). Then, if a write access is done to the |
300 |
|
page, Linux raises a SEGV signal. QEMU then invalidates all the |
301 |
|
translated code in the page and enables write accesses to the page. |
302 |
|
|
303 |
|
Correct translated code invalidation is done efficiently by maintaining |
304 |
|
a linked list of every translated block contained in a given page. Other |
305 |
|
linked lists are also maintained to undo direct block chaining. |
306 |
|
|
307 |
|
Althought the overhead of doing @code{mprotect()} calls is important, |
308 |
|
most MSDOS programs can be emulated at reasonnable speed with QEMU and |
309 |
|
DOSEMU. |
310 |
|
|
311 |
|
Note that QEMU also invalidates pages of translated code when it detects |
312 |
|
that memory mappings are modified with @code{mmap()} or @code{munmap()}. |
313 |
|
|
314 |
@section Exception support |
@section Exception support |
315 |
|
|
316 |
longjmp() is used when an exception such as division by zero is |
longjmp() is used when an exception such as division by zero is |
317 |
encountered. The host SIGSEGV and SIGBUS signal handlers are used to get |
encountered. |
|
invalid memory accesses. |
|
318 |
|
|
319 |
[Currently, the virtual CPU cannot retrieve the exact CPU state in some |
The host SIGSEGV and SIGBUS signal handlers are used to get invalid |
320 |
exceptions, although it could except for the @code{EFLAGS} register]. |
memory accesses. The exact CPU state can be retrieved because all the |
321 |
|
x86 registers are stored in fixed host registers. The simulated program |
322 |
|
counter is found by retranslating the corresponding basic block and by |
323 |
|
looking where the host program counter was at the exception point. |
324 |
|
|
325 |
|
The virtual CPU cannot retrieve the exact @code{EFLAGS} register because |
326 |
|
in some cases it is not computed because of condition code |
327 |
|
optimisations. It is not a big concern because the emulated code can |
328 |
|
still be restarted in any cases. |
329 |
|
|
330 |
@section Linux system call translation |
@section Linux system call translation |
331 |
|
|
334 |
endianness and 32/64 bit issues. The IOCTLs are converted with a generic |
endianness and 32/64 bit issues. The IOCTLs are converted with a generic |
335 |
type description system (see @file{ioctls.h} and @file{thunk.c}). |
type description system (see @file{ioctls.h} and @file{thunk.c}). |
336 |
|
|
337 |
|
QEMU supports host CPUs which have pages bigger than 4KB. It records all |
338 |
|
the mappings the process does and try to emulated the @code{mmap()} |
339 |
|
system calls in cases where the host @code{mmap()} call would fail |
340 |
|
because of bad page alignment. |
341 |
|
|
342 |
@section Linux signals |
@section Linux signals |
343 |
|
|
344 |
Normal and real-time signals are queued along with their information |
Normal and real-time signals are queued along with their information |
367 |
The virtual x86 CPU atomic operations are emulated with a global lock so |
The virtual x86 CPU atomic operations are emulated with a global lock so |
368 |
that their semantic is preserved. |
that their semantic is preserved. |
369 |
|
|
370 |
|
Note that currently there are still some locking issues in QEMU. In |
371 |
|
particular, the translated cache flush is not protected yet against |
372 |
|
reentrancy. |
373 |
|
|
374 |
@section Self-virtualization |
@section Self-virtualization |
375 |
|
|
376 |
QEMU was conceived so that ultimately it can emulate itself. Althought |
QEMU was conceived so that ultimately it can emulate itself. Althought |
382 |
shared object as the ld-linux.so ELF interpreter. That way, it can be |
shared object as the ld-linux.so ELF interpreter. That way, it can be |
383 |
relocated at load time. |
relocated at load time. |
384 |
|
|
|
Since self-modifying code is not supported yet, QEMU cannot emulate |
|
|
itself in case of translation cache flush. This limitation will be |
|
|
suppressed soon. |
|
|
|
|
385 |
@section Bibliography |
@section Bibliography |
386 |
|
|
387 |
@table @asis |
@table @asis |
434 |
The Linux system call @code{modify_ldt()} is used to create x86 selectors |
The Linux system call @code{modify_ldt()} is used to create x86 selectors |
435 |
to test some 16 bit addressing and 32 bit with segmentation cases. |
to test some 16 bit addressing and 32 bit with segmentation cases. |
436 |
|
|
437 |
@section @file{testsig} |
The Linux system call @code{vm86()} is used to test vm86 emulation. |
438 |
|
|
439 |
This program tests various signal cases, including SIGFPE, SIGSEGV and |
Various exceptions are raised to test most of the x86 user space |
440 |
SIGILL. |
exception reporting. |
|
|
|
|
@section @file{testclone} |
|
|
|
|
|
Tests the @code{clone()} system call (basic test). |
|
|
|
|
|
@section @file{testthread} |
|
|
|
|
|
Tests the glibc threads (more complicated than @code{clone()} because signals |
|
|
are also used). |
|
441 |
|
|
442 |
@section @file{sha1} |
@section @file{sha1} |
443 |
|
|
445 |
because it mostly tests the ability of the virtual CPU to optimize the |
because it mostly tests the ability of the virtual CPU to optimize the |
446 |
@code{rol} x86 instruction and the condition code computations. |
@code{rol} x86 instruction and the condition code computations. |
447 |
|
|
|
@section @file{runcom} |
|
|
|
|
|
A very simple MSDOS emulator to test the Linux vm86() system call |
|
|
emulation. The excellent 54 byte @file{pi_10.com} PI number calculator |
|
|
can be launched with it. @file{pi_10.com} was written by Bertram |
|
|
Felgenhauer (more information at @url{http://www.boo.net/~jasonp/pipage.html}). |
|