11 |
|
|
12 |
@section Features |
@section Features |
13 |
|
|
14 |
QEMU is a FAST! processor emulator. Its purpose is to run Linux executables |
QEMU is a FAST! processor emulator. By using dynamic translation it |
15 |
compiled for one architecture on another. For example, x86 Linux |
achieves a reasonnable speed while being easy to port on new host |
16 |
processes can be ran on PowerPC Linux architectures. By using dynamic |
CPUs. |
17 |
translation it achieves a reasonnable speed while being easy to port on |
|
18 |
new host CPUs. Its main goal is to be able to launch the @code{Wine} |
QEMU has two operating modes: |
19 |
Windows API emulator (@url{http://www.winehq.org}) or @code{DOSEMU} |
@itemize |
20 |
(@url{http://www.dosemu.org}) on non-x86 CPUs. |
@item User mode emulation. In this mode, QEMU can launch Linux processes |
21 |
|
compiled for one CPU on another CPU. Linux system calls are converted |
22 |
|
because of endianness and 32/64 bit mismatches. The Wine Windows API |
23 |
|
emulator (@url{http://www.winehq.org}) and the DOSEMU DOS emulator |
24 |
|
(@url{www.dosemu.org}) are the main targets for QEMU. |
25 |
|
|
26 |
|
@item Full system emulation. In this mode, QEMU emulates a full |
27 |
|
system, including a processor and various peripherials. Currently, it |
28 |
|
is only used to launch an x86 Linux kernel on an x86 Linux system. It |
29 |
|
enables easier testing and debugging of system code. It can also be |
30 |
|
used to provide virtual hosting of several virtual PCs on a single |
31 |
|
server. |
32 |
|
|
33 |
|
@end itemize |
34 |
|
|
35 |
|
As QEMU requires no host kernel patches to run, it is very safe and |
36 |
|
easy to use. |
37 |
|
|
38 |
QEMU generic features: |
QEMU generic features: |
39 |
|
|
40 |
@itemize |
@itemize |
41 |
|
|
42 |
@item User space only emulation. |
@item User space only or full system emulation. |
43 |
|
|
44 |
|
@item Using dynamic translation to native code for reasonnable speed. |
45 |
|
|
46 |
@item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. |
@item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. |
47 |
|
|
48 |
@item Using dynamic translation to native code for reasonnable speed. |
@item Self-modifying code support. |
49 |
|
|
50 |
|
@item Precise exception support. |
51 |
|
|
52 |
|
@item The virtual CPU is a library (@code{libqemu}) which can be used |
53 |
|
in other projects. |
54 |
|
|
55 |
|
@end itemize |
56 |
|
|
57 |
|
QEMU user mode emulation features: |
58 |
|
@itemize |
59 |
@item Generic Linux system call converter, including most ioctls. |
@item Generic Linux system call converter, including most ioctls. |
60 |
|
|
61 |
@item clone() emulation using native CPU clone() to use Linux scheduler for threads. |
@item clone() emulation using native CPU clone() to use Linux scheduler for threads. |
62 |
|
|
63 |
@item Accurate signal handling by remapping host signals to target signals. |
@item Accurate signal handling by remapping host signals to target signals. |
64 |
|
@end itemize |
65 |
|
@end itemize |
66 |
|
|
67 |
@item Self-modifying code support. |
QEMU full system emulation features: |
68 |
|
@itemize |
69 |
@item The virtual CPU is a library (@code{libqemu}) which can be used |
@item Using mmap() system calls to simulate the MMU |
|
in other projects. |
|
|
|
|
70 |
@end itemize |
@end itemize |
71 |
|
|
72 |
@section x86 emulation |
@section x86 emulation |
76 |
@itemize |
@itemize |
77 |
|
|
78 |
@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
79 |
User space LDT and GDT are emulated. VM86 mode is also supported to run DOSEMU. |
LDT/GDT and IDT are emulated. VM86 mode is also supported to run DOSEMU. |
80 |
|
|
81 |
@item Precise user space x86 exceptions. |
@item Support of host page sizes bigger than 4KB in user mode emulation. |
|
|
|
|
@item Support of host page sizes bigger than 4KB. |
|
82 |
|
|
83 |
@item QEMU can emulate itself on x86. |
@item QEMU can emulate itself on x86. |
84 |
|
|
98 |
@item IPC syscalls are missing. |
@item IPC syscalls are missing. |
99 |
|
|
100 |
@item The x86 segment limits and access rights are not tested at every |
@item The x86 segment limits and access rights are not tested at every |
101 |
memory access (and will never be to have good performances). |
memory access. |
102 |
|
|
103 |
@item On non x86 host CPUs, @code{double}s are used instead of the non standard |
@item On non x86 host CPUs, @code{double}s are used instead of the non standard |
104 |
10 byte @code{long double}s of x86 for floating point emulation to get |
10 byte @code{long double}s of x86 for floating point emulation to get |
105 |
maximum performances. |
maximum performances. |
106 |
|
|
107 |
|
@item Full system emulation only works if no data are mapped above the virtual address |
108 |
|
0xc0000000 (yet). |
109 |
|
|
110 |
|
@item Some priviledged instructions or behaviors are missing. Only the ones |
111 |
|
needed for proper Linux kernel operation are emulated. |
112 |
|
|
113 |
|
@item No memory separation between the kernel and the user processes is done. |
114 |
|
It will be implemented very soon. |
115 |
|
|
116 |
@end itemize |
@end itemize |
117 |
|
|
118 |
@section ARM emulation |
@section ARM emulation |
128 |
|
|
129 |
@end itemize |
@end itemize |
130 |
|
|
131 |
@chapter Invocation |
@chapter QEMU User space emulation invocation |
132 |
|
|
133 |
@section Quick Start |
@section Quick Start |
134 |
|
|
232 |
Act as if the host page size was 'pagesize' bytes |
Act as if the host page size was 'pagesize' bytes |
233 |
@end table |
@end table |
234 |
|
|
235 |
|
@chapter QEMU System emulator invocation |
236 |
|
|
237 |
|
@section Quick Start |
238 |
|
|
239 |
|
This section explains how to launch a Linux kernel inside QEMU. |
240 |
|
|
241 |
|
@enumerate |
242 |
|
@item |
243 |
|
Download the archive @file{vl-test-xxx.tar.gz} containing a Linux kernel |
244 |
|
and an initrd (initial Ram Disk). The archive also contains a |
245 |
|
precompiled version of @file{vl}, the QEMU System emulator. |
246 |
|
|
247 |
|
@item Optional: If you want network support (for example to launch X11 examples), you |
248 |
|
must copy the script @file{vl-ifup} in @file{/etc} and configure |
249 |
|
properly @code{sudo} so that the command @code{ifconfig} contained in |
250 |
|
@file{vl-ifup} can be executed as root. You must verify that your host |
251 |
|
kernel supports the TUN/TAP network interfaces: the device |
252 |
|
@file{/dev/net/tun} must be present. |
253 |
|
|
254 |
|
When network is enabled, there is a virtual network connection between |
255 |
|
the host kernel and the emulated kernel. The emulated kernel is seen |
256 |
|
from the host kernel at IP address 172.20.0.2 and the host kernel is |
257 |
|
seen from the emulated kernel at IP address 172.20.0.1. |
258 |
|
|
259 |
|
@item Launch @code{vl.sh}. You should have the following output: |
260 |
|
|
261 |
|
@example |
262 |
|
> ./vl.sh |
263 |
|
connected to host network interface: tun0 |
264 |
|
Uncompressing Linux... Ok, booting the kernel. |
265 |
|
Linux version 2.4.20 (bellard@voyager) (gcc version 2.95.2 20000220 (Debian GNU/Linux)) #42 Wed Jun 25 14:16:12 CEST 2003 |
266 |
|
BIOS-provided physical RAM map: |
267 |
|
BIOS-88: 0000000000000000 - 000000000009f000 (usable) |
268 |
|
BIOS-88: 0000000000100000 - 0000000002000000 (usable) |
269 |
|
32MB LOWMEM available. |
270 |
|
On node 0 totalpages: 8192 |
271 |
|
zone(0): 4096 pages. |
272 |
|
zone(1): 4096 pages. |
273 |
|
zone(2): 0 pages. |
274 |
|
Kernel command line: root=/dev/ram ramdisk_size=6144 |
275 |
|
Initializing CPU#0 |
276 |
|
Detected 501.785 MHz processor. |
277 |
|
Calibrating delay loop... 973.20 BogoMIPS |
278 |
|
Memory: 24776k/32768k available (725k kernel code, 7604k reserved, 151k data, 48k init, 0k highmem) |
279 |
|
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes) |
280 |
|
Inode cache hash table entries: 2048 (order: 2, 16384 bytes) |
281 |
|
Mount-cache hash table entries: 512 (order: 0, 4096 bytes) |
282 |
|
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) |
283 |
|
Page-cache hash table entries: 8192 (order: 3, 32768 bytes) |
284 |
|
CPU: Intel Pentium Pro stepping 03 |
285 |
|
Checking 'hlt' instruction... OK. |
286 |
|
POSIX conformance testing by UNIFIX |
287 |
|
Linux NET4.0 for Linux 2.4 |
288 |
|
Based upon Swansea University Computer Society NET3.039 |
289 |
|
Initializing RT netlink socket |
290 |
|
apm: BIOS not found. |
291 |
|
Starting kswapd |
292 |
|
pty: 256 Unix98 ptys configured |
293 |
|
Serial driver version 5.05c (2001-07-08) with no serial options enabled |
294 |
|
ttyS00 at 0x03f8 (irq = 4) is a 16450 |
295 |
|
ne.c:v1.10 9/23/94 Donald Becker (becker@scyld.com) |
296 |
|
Last modified Nov 1, 2000 by Paul Gortmaker |
297 |
|
NE*000 ethercard probe at 0x300: 52 54 00 12 34 56 |
298 |
|
eth0: NE2000 found at 0x300, using IRQ 9. |
299 |
|
RAMDISK driver initialized: 16 RAM disks of 6144K size 1024 blocksize |
300 |
|
NET4: Linux TCP/IP 1.0 for NET4.0 |
301 |
|
IP Protocols: ICMP, UDP, TCP, IGMP |
302 |
|
IP: routing cache hash table of 512 buckets, 4Kbytes |
303 |
|
TCP: Hash tables configured (established 2048 bind 2048) |
304 |
|
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. |
305 |
|
RAMDISK: ext2 filesystem found at block 0 |
306 |
|
RAMDISK: Loading 6144 blocks [1 disk] into ram disk... done. |
307 |
|
Freeing initrd memory: 6144k freed |
308 |
|
VFS: Mounted root (ext2 filesystem). |
309 |
|
Freeing unused kernel memory: 48k freed |
310 |
|
sh: can't access tty; job control turned off |
311 |
|
# |
312 |
|
@end example |
313 |
|
|
314 |
|
@item |
315 |
|
Then you can play with the kernel inside the virtual serial console. You |
316 |
|
can launch @code{ls} for example. Type @key{Ctrl-a h} to have an help |
317 |
|
about the keys you can type inside the virtual serial console. In |
318 |
|
particular @key{Ctrl-a b} is the Magic SysRq key. |
319 |
|
|
320 |
|
@item |
321 |
|
If the network is enabled, launch the script @file{/etc/linuxrc} in the |
322 |
|
emulator (don't forget the leading dot): |
323 |
|
@example |
324 |
|
. /etc/linuxrc |
325 |
|
@end example |
326 |
|
|
327 |
|
Then enable X11 connections on your PC from the emulated Linux: |
328 |
|
@example |
329 |
|
xhost +172.20.0.2 |
330 |
|
@end example |
331 |
|
|
332 |
|
You can now launch @file{xterm} or @file{xlogo} and verify that you have |
333 |
|
a real Virtual Linux system ! |
334 |
|
|
335 |
|
@end enumerate |
336 |
|
|
337 |
|
NOTE: the example initrd is a modified version of the one made by Kevin |
338 |
|
Lawton for the plex86 Project (@url{www.plex86.org}). |
339 |
|
|
340 |
|
@section Kernel Compilation |
341 |
|
|
342 |
|
You can use any Linux kernel within QEMU provided it is mapped at |
343 |
|
address 0x90000000 (the default is 0xc0000000). You must modify only two |
344 |
|
lines in the kernel source: |
345 |
|
|
346 |
|
In asm/page.h, replace |
347 |
|
@example |
348 |
|
#define __PAGE_OFFSET (0xc0000000) |
349 |
|
@end example |
350 |
|
by |
351 |
|
@example |
352 |
|
#define __PAGE_OFFSET (0x90000000) |
353 |
|
@end example |
354 |
|
|
355 |
|
And in arch/i386/vmlinux.lds, replace |
356 |
|
@example |
357 |
|
. = 0xc0000000 + 0x100000; |
358 |
|
@end example |
359 |
|
by |
360 |
|
@example |
361 |
|
. = 0x90000000 + 0x100000; |
362 |
|
@end example |
363 |
|
|
364 |
|
The file config-2.4.20 gives the configuration of the example kernel. |
365 |
|
|
366 |
|
Just type |
367 |
|
@example |
368 |
|
make bzImage |
369 |
|
@end example |
370 |
|
|
371 |
|
As you would do to make a real kernel. Then you can use with QEMU |
372 |
|
exactly the same kernel as you would boot on your PC (in |
373 |
|
@file{arch/i386/boot/bzImage}). |
374 |
|
|
375 |
|
@section PC Emulation |
376 |
|
|
377 |
|
QEMU emulates the following PC peripherials: |
378 |
|
|
379 |
|
@itemize |
380 |
|
@item |
381 |
|
PIC (interrupt controler) |
382 |
|
@item |
383 |
|
PIT (timers) |
384 |
|
@item |
385 |
|
CMOS memory |
386 |
|
@item |
387 |
|
Serial port (port=0x3f8, irq=4) |
388 |
|
@item |
389 |
|
NE2000 network adapter (port=0x300, irq=9) |
390 |
|
@item |
391 |
|
Dumb VGA (to print the @code{uncompressing Linux kernel} message) |
392 |
|
@end itemize |
393 |
|
|
394 |
@chapter QEMU Internals |
@chapter QEMU Internals |
395 |
|
|
396 |
@section QEMU compared to other emulators |
@section QEMU compared to other emulators |
397 |
|
|
398 |
Unlike bochs [3], QEMU emulates only a user space x86 CPU. It means that |
Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than |
399 |
you cannot launch an operating system with it. The benefit is that it is |
bochs as it uses dynamic compilation and because it uses the host MMU to |
400 |
simpler and faster due to the fact that some of the low level CPU state |
simulate the x86 MMU. The downside is that currently the emulation is |
401 |
can be ignored (in particular, no virtual memory needs to be emulated). |
not as accurate as bochs (for example, you cannot currently run Windows |
402 |
|
inside QEMU). |
403 |
|
|
404 |
Like Valgrind [2], QEMU does user space emulation and dynamic |
Like Valgrind [2], QEMU does user space emulation and dynamic |
405 |
translation. Valgrind is mainly a memory debugger while QEMU has no |
translation. Valgrind is mainly a memory debugger while QEMU has no |
406 |
support for it (QEMU could be used to detect out of bound memory accesses |
support for it (QEMU could be used to detect out of bound memory |
407 |
as Valgrind, but it has no support to track uninitialised data as |
accesses as Valgrind, but it has no support to track uninitialised data |
408 |
Valgrind does). Valgrind dynamic translator generates better code than |
as Valgrind does). Valgrind dynamic translator generates better code |
409 |
QEMU (in particular it does register allocation) but it is closely tied |
than QEMU (in particular it does register allocation) but it is closely |
410 |
to an x86 host and target. |
tied to an x86 host and target and has no support for precise exception |
411 |
|
and system emulation. |
412 |
EM86 [4] is the closest project to QEMU (and QEMU still uses some of its |
|
413 |
code, in particular the ELF file loader). EM86 was limited to an alpha |
EM86 [4] is the closest project to user space QEMU (and QEMU still uses |
414 |
host and used a proprietary and slow interpreter (the interpreter part |
some of its code, in particular the ELF file loader). EM86 was limited |
415 |
of the FX!32 Digital Win32 code translator [5]). |
to an alpha host and used a proprietary and slow interpreter (the |
416 |
|
interpreter part of the FX!32 Digital Win32 code translator [5]). |
417 |
|
|
418 |
TWIN [6] is a Windows API emulator like Wine. It is less accurate than |
TWIN [6] is a Windows API emulator like Wine. It is less accurate than |
419 |
Wine but includes a protected mode x86 interpreter to launch x86 Windows |
Wine but includes a protected mode x86 interpreter to launch x86 Windows |
422 |
because all the data structures and function parameters exchanged |
because all the data structures and function parameters exchanged |
423 |
between the API and the x86 code must be converted. |
between the API and the x86 code must be converted. |
424 |
|
|
425 |
|
User mode Linux [7] was the only solution before QEMU to launch a Linux |
426 |
|
kernel as a process while not needing any host kernel patches. However, |
427 |
|
user mode Linux requires heavy kernel patches while QEMU accepts |
428 |
|
unpatched Linux kernels. It would be interesting to compare the |
429 |
|
performance of the two approaches. |
430 |
|
|
431 |
|
The new Plex86 [8] PC virtualizer is done in the same spirit as the QEMU |
432 |
|
system emulator. It requires a patched Linux kernel to work (you cannot |
433 |
|
launch the same kernel on your PC), but the patches are really small. As |
434 |
|
it is a PC virtualizer (no emulation is done except for some priveledged |
435 |
|
instructions), it has the potential of being faster than QEMU. The |
436 |
|
downside is that a complicated (and potentially unsafe) kernel patch is |
437 |
|
needed. |
438 |
|
|
439 |
@section Portable dynamic translation |
@section Portable dynamic translation |
440 |
|
|
441 |
QEMU is a dynamic translator. When it first encounters a piece of code, |
QEMU is a dynamic translator. When it first encounters a piece of code, |
618 |
shared object as the ld-linux.so ELF interpreter. That way, it can be |
shared object as the ld-linux.so ELF interpreter. That way, it can be |
619 |
relocated at load time. |
relocated at load time. |
620 |
|
|
621 |
|
@section MMU emulation |
622 |
|
|
623 |
|
For system emulation, QEMU uses the mmap() system call to emulate the |
624 |
|
target CPU MMU. It works as long the emulated OS does not use an area |
625 |
|
reserved by the host OS (such as the area above 0xc0000000 on x86 |
626 |
|
Linux). |
627 |
|
|
628 |
|
It is planned to add a slower but more precise MMU emulation |
629 |
|
with a software MMU. |
630 |
|
|
631 |
@section Bibliography |
@section Bibliography |
632 |
|
|
633 |
@table @asis |
@table @asis |
658 |
@url{http://www.willows.com/}, Windows API library emulation from |
@url{http://www.willows.com/}, Windows API library emulation from |
659 |
Willows Software. |
Willows Software. |
660 |
|
|
661 |
|
@item [7] |
662 |
|
@url{http://user-mode-linux.sourceforge.net/}, |
663 |
|
The User-mode Linux Kernel. |
664 |
|
|
665 |
|
@item [8] |
666 |
|
@url{http://www.plex86.org/}, |
667 |
|
The new Plex86 project. |
668 |
|
|
669 |
@end table |
@end table |
670 |
|
|
671 |
@chapter Regression Tests |
@chapter Regression Tests |