![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to qemu-tech.html CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Qemu by Fabrice Bellard] / qemu|
Return to qemu-tech.html CVS log | Up to [Qemu by Fabrice Bellard] / qemu |
1.1 ! root 1: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html401/loose.dtd"> ! 2: <html> ! 3: <!-- Created on May, 1 2009 by texi2html 1.78 --> ! 4: <!-- ! 5: Written by: Lionel Cons <[email protected]> (original author) ! 6: Karl Berry <[email protected]> ! 7: Olaf Bachmann <[email protected]> ! 8: and many others. ! 9: Maintained by: Many creative people. ! 10: Send bugs and suggestions to <[email protected]> ! 11: ! 12: --> ! 13: <head> ! 14: <title>QEMU Internals</title> ! 15: ! 16: <meta name="description" content="QEMU Internals"> ! 17: <meta name="keywords" content="QEMU Internals"> ! 18: <meta name="resource-type" content="document"> ! 19: <meta name="distribution" content="global"> ! 20: <meta name="Generator" content="texi2html 1.78"> ! 21: <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> ! 22: <style type="text/css"> ! 23: <!-- ! 24: a.summary-letter {text-decoration: none} ! 25: pre.display {font-family: serif} ! 26: pre.format {font-family: serif} ! 27: pre.menu-comment {font-family: serif} ! 28: pre.menu-preformatted {font-family: serif} ! 29: pre.smalldisplay {font-family: serif; font-size: smaller} ! 30: pre.smallexample {font-size: smaller} ! 31: pre.smallformat {font-family: serif; font-size: smaller} ! 32: pre.smalllisp {font-size: smaller} ! 33: span.roman {font-family:serif; font-weight:normal;} ! 34: span.sansserif {font-family:sans-serif; font-weight:normal;} ! 35: ul.toc {list-style: none} ! 36: --> ! 37: </style> ! 38: ! 39: ! 40: </head> ! 41: ! 42: <body lang="en" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000"> ! 43: ! 44: <a name="Top"></a> ! 45: <a name="SEC_Top"></a> ! 46: <table cellpadding="1" cellspacing="1" border="0"> ! 47: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 48: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 49: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 50: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 51: </tr></table> ! 52: <h1 class="settitle">QEMU Internals ! 53: </h1> ! 54: ! 55: <table class="menu" border="0" cellspacing="0"> ! 56: <tr><td align="left" valign="top"><a href="#SEC1">1. Introduction</a></td><td> </td><td align="left" valign="top"> ! 57: </td></tr> ! 58: <tr><td align="left" valign="top"><a href="#SEC9">2. QEMU Internals</a></td><td> </td><td align="left" valign="top"> ! 59: </td></tr> ! 60: <tr><td align="left" valign="top"><a href="#SEC27">3. Regression Tests</a></td><td> </td><td align="left" valign="top"> ! 61: </td></tr> ! 62: <tr><td align="left" valign="top"><a href="#SEC31">4. Index</a></td><td> </td><td align="left" valign="top"> ! 63: </td></tr> ! 64: </table> ! 65: ! 66: ! 67: <hr size="1"> ! 68: <a name="Introduction"></a> ! 69: <a name="SEC1"></a> ! 70: <table cellpadding="1" cellspacing="1" border="0"> ! 71: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Previous section in reading order"> < </a>]</td> ! 72: <td valign="middle" align="left">[<a href="#SEC2" title="Next section in reading order"> > </a>]</td> ! 73: <td valign="middle" align="left"> </td> ! 74: <td valign="middle" align="left">[ << ]</td> ! 75: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td> ! 76: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 77: <td valign="middle" align="left"> </td> ! 78: <td valign="middle" align="left"> </td> ! 79: <td valign="middle" align="left"> </td> ! 80: <td valign="middle" align="left"> </td> ! 81: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 82: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 83: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 84: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 85: </tr></table> ! 86: <h1 class="chapter"> 1. Introduction </h1> ! 87: ! 88: <table class="menu" border="0" cellspacing="0"> ! 89: <tr><td align="left" valign="top"><a href="#SEC2">1.1 Features</a></td><td> </td><td align="left" valign="top"></td></tr> ! 90: <tr><td align="left" valign="top"><a href="#SEC3">1.2 x86 and x86-64 emulation</a></td><td> </td><td align="left" valign="top"></td></tr> ! 91: <tr><td align="left" valign="top"><a href="#SEC4">1.3 ARM emulation</a></td><td> </td><td align="left" valign="top"></td></tr> ! 92: <tr><td align="left" valign="top"><a href="#SEC5">1.4 MIPS emulation</a></td><td> </td><td align="left" valign="top"></td></tr> ! 93: <tr><td align="left" valign="top"><a href="#SEC6">1.5 PowerPC emulation</a></td><td> </td><td align="left" valign="top"></td></tr> ! 94: <tr><td align="left" valign="top"><a href="#SEC7">1.6 Sparc32 and Sparc64 emulation</a></td><td> </td><td align="left" valign="top"></td></tr> ! 95: <tr><td align="left" valign="top"><a href="#SEC8">1.7 Other CPU emulation</a></td><td> </td><td align="left" valign="top"></td></tr> ! 96: </table> ! 97: ! 98: <hr size="6"> ! 99: <a name="intro_005ffeatures"></a> ! 100: <a name="SEC2"></a> ! 101: <table cellpadding="1" cellspacing="1" border="0"> ! 102: <tr><td valign="middle" align="left">[<a href="#SEC1" title="Previous section in reading order"> < </a>]</td> ! 103: <td valign="middle" align="left">[<a href="#SEC3" title="Next section in reading order"> > </a>]</td> ! 104: <td valign="middle" align="left"> </td> ! 105: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 106: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 107: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 108: <td valign="middle" align="left"> </td> ! 109: <td valign="middle" align="left"> </td> ! 110: <td valign="middle" align="left"> </td> ! 111: <td valign="middle" align="left"> </td> ! 112: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 113: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 114: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 115: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 116: </tr></table> ! 117: <h2 class="section"> 1.1 Features </h2> ! 118: ! 119: <p>QEMU is a FAST! processor emulator using a portable dynamic ! 120: translator. ! 121: </p> ! 122: <p>QEMU has two operating modes: ! 123: </p> ! 124: <ul class="toc"> ! 125: <li>- ! 126: Full system emulation. In this mode (full platform virtualization), ! 127: QEMU emulates a full system (usually a PC), including a processor and ! 128: various peripherals. It can be used to launch several different ! 129: Operating Systems at once without rebooting the host machine or to ! 130: debug system code. ! 131: ! 132: </li><li>- ! 133: User mode emulation. In this mode (application level virtualization), ! 134: QEMU can launch processes compiled for one CPU on another CPU, however ! 135: the Operating Systems must match. This can be used for example to ease ! 136: cross-compilation and cross-debugging. ! 137: </li></ul> ! 138: ! 139: <p>As QEMU requires no host kernel driver to run, it is very safe and ! 140: easy to use. ! 141: </p> ! 142: <p>QEMU generic features: ! 143: </p> ! 144: <ul class="toc"> ! 145: <li> User space only or full system emulation. ! 146: ! 147: </li><li> Using dynamic translation to native code for reasonable speed. ! 148: ! 149: </li><li> ! 150: Working on x86, x86_64 and PowerPC32/64 hosts. Being tested on ARM, ! 151: HPPA, Sparc32 and Sparc64. Previous versions had some support for ! 152: Alpha and S390 hosts, but TCG (see below) doesn't support those yet. ! 153: ! 154: </li><li> Self-modifying code support. ! 155: ! 156: </li><li> Precise exceptions support. ! 157: ! 158: </li><li> The virtual CPU is a library (<code>libqemu</code>) which can be used ! 159: in other projects (look at ‘<tt>qemu/tests/qruncom.c</tt>’ to have an ! 160: example of user mode <code>libqemu</code> usage). ! 161: ! 162: </li><li> ! 163: Floating point library supporting both full software emulation and ! 164: native host FPU instructions. ! 165: ! 166: </li></ul> ! 167: ! 168: <p>QEMU user mode emulation features: ! 169: </p><ul class="toc"> ! 170: <li> Generic Linux system call converter, including most ioctls. ! 171: ! 172: </li><li> clone() emulation using native CPU clone() to use Linux scheduler for threads. ! 173: ! 174: </li><li> Accurate signal handling by remapping host signals to target signals. ! 175: </li></ul> ! 176: ! 177: <p>Linux user emulator (Linux host only) can be used to launch the Wine ! 178: Windows API emulator (<a href="http://www.winehq.org">http://www.winehq.org</a>). A Darwin user ! 179: emulator (Darwin hosts only) exists and a BSD user emulator for BSD ! 180: hosts is under development. It would also be possible to develop a ! 181: similar user emulator for Solaris. ! 182: </p> ! 183: <p>QEMU full system emulation features: ! 184: </p><ul class="toc"> ! 185: <li> ! 186: QEMU uses a full software MMU for maximum portability. ! 187: ! 188: </li><li> ! 189: QEMU can optionally use an in-kernel accelerator, like kqemu and ! 190: kvm. The accelerators execute some of the guest code natively, while ! 191: continuing to emulate the rest of the machine. ! 192: ! 193: </li><li> ! 194: Various hardware devices can be emulated and in some cases, host ! 195: devices (e.g. serial and parallel ports, USB, drives) can be used ! 196: transparently by the guest Operating System. Host device passthrough ! 197: can be used for talking to external physical peripherals (e.g. a ! 198: webcam, modem or tape drive). ! 199: ! 200: </li><li> ! 201: Symmetric multiprocessing (SMP) even on a host with a single CPU. On a ! 202: SMP host system, QEMU can use only one CPU fully due to difficulty in ! 203: implementing atomic memory accesses efficiently. ! 204: ! 205: </li></ul> ! 206: ! 207: <hr size="6"> ! 208: <a name="intro_005fx86_005femulation"></a> ! 209: <a name="SEC3"></a> ! 210: <table cellpadding="1" cellspacing="1" border="0"> ! 211: <tr><td valign="middle" align="left">[<a href="#SEC2" title="Previous section in reading order"> < </a>]</td> ! 212: <td valign="middle" align="left">[<a href="#SEC4" title="Next section in reading order"> > </a>]</td> ! 213: <td valign="middle" align="left"> </td> ! 214: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 215: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 216: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 217: <td valign="middle" align="left"> </td> ! 218: <td valign="middle" align="left"> </td> ! 219: <td valign="middle" align="left"> </td> ! 220: <td valign="middle" align="left"> </td> ! 221: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 222: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 223: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 224: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 225: </tr></table> ! 226: <h2 class="section"> 1.2 x86 and x86-64 emulation </h2> ! 227: ! 228: <p>QEMU x86 target features: ! 229: </p> ! 230: <ul class="toc"> ! 231: <li> The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. ! 232: LDT/GDT and IDT are emulated. VM86 mode is also supported to run ! 233: DOSEMU. There is some support for MMX/3DNow!, SSE, SSE2, SSE3, SSSE3, ! 234: and SSE4 as well as x86-64 SVM. ! 235: ! 236: </li><li> Support of host page sizes bigger than 4KB in user mode emulation. ! 237: ! 238: </li><li> QEMU can emulate itself on x86. ! 239: ! 240: </li><li> An extensive Linux x86 CPU test program is included ‘<tt>tests/test-i386</tt>’. ! 241: It can be used to test other x86 virtual CPUs. ! 242: ! 243: </li></ul> ! 244: ! 245: <p>Current QEMU limitations: ! 246: </p> ! 247: <ul class="toc"> ! 248: <li> Limited x86-64 support. ! 249: ! 250: </li><li> IPC syscalls are missing. ! 251: ! 252: </li><li> The x86 segment limits and access rights are not tested at every ! 253: memory access (yet). Hopefully, very few OSes seem to rely on that for ! 254: normal use. ! 255: ! 256: </li></ul> ! 257: ! 258: <hr size="6"> ! 259: <a name="intro_005farm_005femulation"></a> ! 260: <a name="SEC4"></a> ! 261: <table cellpadding="1" cellspacing="1" border="0"> ! 262: <tr><td valign="middle" align="left">[<a href="#SEC3" title="Previous section in reading order"> < </a>]</td> ! 263: <td valign="middle" align="left">[<a href="#SEC5" title="Next section in reading order"> > </a>]</td> ! 264: <td valign="middle" align="left"> </td> ! 265: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 266: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 267: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 268: <td valign="middle" align="left"> </td> ! 269: <td valign="middle" align="left"> </td> ! 270: <td valign="middle" align="left"> </td> ! 271: <td valign="middle" align="left"> </td> ! 272: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 273: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 274: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 275: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 276: </tr></table> ! 277: <h2 class="section"> 1.3 ARM emulation </h2> ! 278: ! 279: <ul class="toc"> ! 280: <li> Full ARM 7 user emulation. ! 281: ! 282: </li><li> NWFPE FPU support included in user Linux emulation. ! 283: ! 284: </li><li> Can run most ARM Linux binaries. ! 285: ! 286: </li></ul> ! 287: ! 288: <hr size="6"> ! 289: <a name="intro_005fmips_005femulation"></a> ! 290: <a name="SEC5"></a> ! 291: <table cellpadding="1" cellspacing="1" border="0"> ! 292: <tr><td valign="middle" align="left">[<a href="#SEC4" title="Previous section in reading order"> < </a>]</td> ! 293: <td valign="middle" align="left">[<a href="#SEC6" title="Next section in reading order"> > </a>]</td> ! 294: <td valign="middle" align="left"> </td> ! 295: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 296: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 297: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 298: <td valign="middle" align="left"> </td> ! 299: <td valign="middle" align="left"> </td> ! 300: <td valign="middle" align="left"> </td> ! 301: <td valign="middle" align="left"> </td> ! 302: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 303: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 304: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 305: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 306: </tr></table> ! 307: <h2 class="section"> 1.4 MIPS emulation </h2> ! 308: ! 309: <ul class="toc"> ! 310: <li> The system emulation allows full MIPS32/MIPS64 Release 2 emulation, ! 311: including privileged instructions, FPU and MMU, in both little and big ! 312: endian modes. ! 313: ! 314: </li><li> The Linux userland emulation can run many 32 bit MIPS Linux binaries. ! 315: ! 316: </li></ul> ! 317: ! 318: <p>Current QEMU limitations: ! 319: </p> ! 320: <ul class="toc"> ! 321: <li> Self-modifying code is not always handled correctly. ! 322: ! 323: </li><li> 64 bit userland emulation is not implemented. ! 324: ! 325: </li><li> The system emulation is not complete enough to run real firmware. ! 326: ! 327: </li><li> The watchpoint debug facility is not implemented. ! 328: ! 329: </li></ul> ! 330: ! 331: <hr size="6"> ! 332: <a name="intro_005fppc_005femulation"></a> ! 333: <a name="SEC6"></a> ! 334: <table cellpadding="1" cellspacing="1" border="0"> ! 335: <tr><td valign="middle" align="left">[<a href="#SEC5" title="Previous section in reading order"> < </a>]</td> ! 336: <td valign="middle" align="left">[<a href="#SEC7" title="Next section in reading order"> > </a>]</td> ! 337: <td valign="middle" align="left"> </td> ! 338: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 339: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 340: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 341: <td valign="middle" align="left"> </td> ! 342: <td valign="middle" align="left"> </td> ! 343: <td valign="middle" align="left"> </td> ! 344: <td valign="middle" align="left"> </td> ! 345: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 346: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 347: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 348: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 349: </tr></table> ! 350: <h2 class="section"> 1.5 PowerPC emulation </h2> ! 351: ! 352: <ul class="toc"> ! 353: <li> Full PowerPC 32 bit emulation, including privileged instructions, ! 354: FPU and MMU. ! 355: ! 356: </li><li> Can run most PowerPC Linux binaries. ! 357: ! 358: </li></ul> ! 359: ! 360: <hr size="6"> ! 361: <a name="intro_005fsparc_005femulation"></a> ! 362: <a name="SEC7"></a> ! 363: <table cellpadding="1" cellspacing="1" border="0"> ! 364: <tr><td valign="middle" align="left">[<a href="#SEC6" title="Previous section in reading order"> < </a>]</td> ! 365: <td valign="middle" align="left">[<a href="#SEC8" title="Next section in reading order"> > </a>]</td> ! 366: <td valign="middle" align="left"> </td> ! 367: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 368: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 369: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 370: <td valign="middle" align="left"> </td> ! 371: <td valign="middle" align="left"> </td> ! 372: <td valign="middle" align="left"> </td> ! 373: <td valign="middle" align="left"> </td> ! 374: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 375: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 376: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 377: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 378: </tr></table> ! 379: <h2 class="section"> 1.6 Sparc32 and Sparc64 emulation </h2> ! 380: ! 381: <ul class="toc"> ! 382: <li> Full SPARC V8 emulation, including privileged ! 383: instructions, FPU and MMU. SPARC V9 emulation includes most privileged ! 384: and VIS instructions, FPU and I/D MMU. Alignment is fully enforced. ! 385: ! 386: </li><li> Can run most 32-bit SPARC Linux binaries, SPARC32PLUS Linux binaries and ! 387: some 64-bit SPARC Linux binaries. ! 388: ! 389: </li></ul> ! 390: ! 391: <p>Current QEMU limitations: ! 392: </p> ! 393: <ul class="toc"> ! 394: <li> IPC syscalls are missing. ! 395: ! 396: </li><li> Floating point exception support is buggy. ! 397: ! 398: </li><li> Atomic instructions are not correctly implemented. ! 399: ! 400: </li><li> There are still some problems with Sparc64 emulators. ! 401: ! 402: </li></ul> ! 403: ! 404: <hr size="6"> ! 405: <a name="intro_005fother_005femulation"></a> ! 406: <a name="SEC8"></a> ! 407: <table cellpadding="1" cellspacing="1" border="0"> ! 408: <tr><td valign="middle" align="left">[<a href="#SEC7" title="Previous section in reading order"> < </a>]</td> ! 409: <td valign="middle" align="left">[<a href="#SEC9" title="Next section in reading order"> > </a>]</td> ! 410: <td valign="middle" align="left"> </td> ! 411: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 412: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td> ! 413: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td> ! 414: <td valign="middle" align="left"> </td> ! 415: <td valign="middle" align="left"> </td> ! 416: <td valign="middle" align="left"> </td> ! 417: <td valign="middle" align="left"> </td> ! 418: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 419: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 420: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 421: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 422: </tr></table> ! 423: <h2 class="section"> 1.7 Other CPU emulation </h2> ! 424: ! 425: <p>In addition to the above, QEMU supports emulation of other CPUs with ! 426: varying levels of success. These are: ! 427: </p> ! 428: <ul class="toc"> ! 429: <li> ! 430: Alpha ! 431: </li><li> ! 432: CRIS ! 433: </li><li> ! 434: M68k ! 435: </li><li> ! 436: SH4 ! 437: </li></ul> ! 438: ! 439: <hr size="6"> ! 440: <a name="QEMU-Internals"></a> ! 441: <a name="SEC9"></a> ! 442: <table cellpadding="1" cellspacing="1" border="0"> ! 443: <tr><td valign="middle" align="left">[<a href="#SEC8" title="Previous section in reading order"> < </a>]</td> ! 444: <td valign="middle" align="left">[<a href="#SEC10" title="Next section in reading order"> > </a>]</td> ! 445: <td valign="middle" align="left"> </td> ! 446: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 447: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td> ! 448: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 449: <td valign="middle" align="left"> </td> ! 450: <td valign="middle" align="left"> </td> ! 451: <td valign="middle" align="left"> </td> ! 452: <td valign="middle" align="left"> </td> ! 453: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 454: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 455: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 456: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 457: </tr></table> ! 458: <h1 class="chapter"> 2. QEMU Internals </h1> ! 459: ! 460: <table class="menu" border="0" cellspacing="0"> ! 461: <tr><td align="left" valign="top"><a href="#SEC10">2.1 QEMU compared to other emulators</a></td><td> </td><td align="left" valign="top"> ! 462: </td></tr> ! 463: <tr><td align="left" valign="top"><a href="#SEC11">2.2 Portable dynamic translation</a></td><td> </td><td align="left" valign="top"> ! 464: </td></tr> ! 465: <tr><td align="left" valign="top"><a href="#SEC12">2.3 Condition code optimisations</a></td><td> </td><td align="left" valign="top"> ! 466: </td></tr> ! 467: <tr><td align="left" valign="top"><a href="#SEC13">2.4 CPU state optimisations</a></td><td> </td><td align="left" valign="top"> ! 468: </td></tr> ! 469: <tr><td align="left" valign="top"><a href="#SEC14">2.5 Translation cache</a></td><td> </td><td align="left" valign="top"> ! 470: </td></tr> ! 471: <tr><td align="left" valign="top"><a href="#SEC15">2.6 Direct block chaining</a></td><td> </td><td align="left" valign="top"> ! 472: </td></tr> ! 473: <tr><td align="left" valign="top"><a href="#SEC16">2.7 Self-modifying code and translated code invalidation</a></td><td> </td><td align="left" valign="top"> ! 474: </td></tr> ! 475: <tr><td align="left" valign="top"><a href="#SEC17">2.8 Exception support</a></td><td> </td><td align="left" valign="top"> ! 476: </td></tr> ! 477: <tr><td align="left" valign="top"><a href="#SEC18">2.9 MMU emulation</a></td><td> </td><td align="left" valign="top"> ! 478: </td></tr> ! 479: <tr><td align="left" valign="top"><a href="#SEC19">2.10 Device emulation</a></td><td> </td><td align="left" valign="top"> ! 480: </td></tr> ! 481: <tr><td align="left" valign="top"><a href="#SEC20">2.11 Hardware interrupts</a></td><td> </td><td align="left" valign="top"> ! 482: </td></tr> ! 483: <tr><td align="left" valign="top"><a href="#SEC21">2.12 User emulation specific details</a></td><td> </td><td align="left" valign="top"> ! 484: </td></tr> ! 485: <tr><td align="left" valign="top"><a href="#SEC26">2.13 Bibliography</a></td><td> </td><td align="left" valign="top"> ! 486: </td></tr> ! 487: </table> ! 488: ! 489: <hr size="6"> ! 490: <a name="QEMU-compared-to-other-emulators"></a> ! 491: <a name="SEC10"></a> ! 492: <table cellpadding="1" cellspacing="1" border="0"> ! 493: <tr><td valign="middle" align="left">[<a href="#SEC9" title="Previous section in reading order"> < </a>]</td> ! 494: <td valign="middle" align="left">[<a href="#SEC11" title="Next section in reading order"> > </a>]</td> ! 495: <td valign="middle" align="left"> </td> ! 496: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 497: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 498: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 499: <td valign="middle" align="left"> </td> ! 500: <td valign="middle" align="left"> </td> ! 501: <td valign="middle" align="left"> </td> ! 502: <td valign="middle" align="left"> </td> ! 503: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 504: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 505: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 506: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 507: </tr></table> ! 508: <h2 class="section"> 2.1 QEMU compared to other emulators </h2> ! 509: ! 510: <p>Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than ! 511: bochs as it uses dynamic compilation. Bochs is closely tied to x86 PC ! 512: emulation while QEMU can emulate several processors. ! 513: </p> ! 514: <p>Like Valgrind [2], QEMU does user space emulation and dynamic ! 515: translation. Valgrind is mainly a memory debugger while QEMU has no ! 516: support for it (QEMU could be used to detect out of bound memory ! 517: accesses as Valgrind, but it has no support to track uninitialised data ! 518: as Valgrind does). The Valgrind dynamic translator generates better code ! 519: than QEMU (in particular it does register allocation) but it is closely ! 520: tied to an x86 host and target and has no support for precise exceptions ! 521: and system emulation. ! 522: </p> ! 523: <p>EM86 [4] is the closest project to user space QEMU (and QEMU still uses ! 524: some of its code, in particular the ELF file loader). EM86 was limited ! 525: to an alpha host and used a proprietary and slow interpreter (the ! 526: interpreter part of the FX!32 Digital Win32 code translator [5]). ! 527: </p> ! 528: <p>TWIN [6] is a Windows API emulator like Wine. It is less accurate than ! 529: Wine but includes a protected mode x86 interpreter to launch x86 Windows ! 530: executables. Such an approach has greater potential because most of the ! 531: Windows API is executed natively but it is far more difficult to develop ! 532: because all the data structures and function parameters exchanged ! 533: between the API and the x86 code must be converted. ! 534: </p> ! 535: <p>User mode Linux [7] was the only solution before QEMU to launch a ! 536: Linux kernel as a process while not needing any host kernel ! 537: patches. However, user mode Linux requires heavy kernel patches while ! 538: QEMU accepts unpatched Linux kernels. The price to pay is that QEMU is ! 539: slower. ! 540: </p> ! 541: <p>The Plex86 [8] PC virtualizer is done in the same spirit as the now ! 542: obsolete qemu-fast system emulator. It requires a patched Linux kernel ! 543: to work (you cannot launch the same kernel on your PC), but the ! 544: patches are really small. As it is a PC virtualizer (no emulation is ! 545: done except for some privileged instructions), it has the potential of ! 546: being faster than QEMU. The downside is that a complicated (and ! 547: potentially unsafe) host kernel patch is needed. ! 548: </p> ! 549: <p>The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo ! 550: [11]) are faster than QEMU, but they all need specific, proprietary ! 551: and potentially unsafe host drivers. Moreover, they are unable to ! 552: provide cycle exact simulation as an emulator can. ! 553: </p> ! 554: <p>VirtualBox [12], Xen [13] and KVM [14] are based on QEMU. QEMU-SystemC ! 555: [15] uses QEMU to simulate a system where some hardware devices are ! 556: developed in SystemC. ! 557: </p> ! 558: <hr size="6"> ! 559: <a name="Portable-dynamic-translation"></a> ! 560: <a name="SEC11"></a> ! 561: <table cellpadding="1" cellspacing="1" border="0"> ! 562: <tr><td valign="middle" align="left">[<a href="#SEC10" title="Previous section in reading order"> < </a>]</td> ! 563: <td valign="middle" align="left">[<a href="#SEC12" title="Next section in reading order"> > </a>]</td> ! 564: <td valign="middle" align="left"> </td> ! 565: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 566: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 567: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 568: <td valign="middle" align="left"> </td> ! 569: <td valign="middle" align="left"> </td> ! 570: <td valign="middle" align="left"> </td> ! 571: <td valign="middle" align="left"> </td> ! 572: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 573: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 574: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 575: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 576: </tr></table> ! 577: <h2 class="section"> 2.2 Portable dynamic translation </h2> ! 578: ! 579: <p>QEMU is a dynamic translator. When it first encounters a piece of code, ! 580: it converts it to the host instruction set. Usually dynamic translators ! 581: are very complicated and highly CPU dependent. QEMU uses some tricks ! 582: which make it relatively easily portable and simple while achieving good ! 583: performances. ! 584: </p> ! 585: <p>After the release of version 0.9.1, QEMU switched to a new method of ! 586: generating code, Tiny Code Generator or TCG. TCG relaxes the ! 587: dependency on the exact version of the compiler used. The basic idea ! 588: is to split every target instruction into a couple of RISC-like TCG ! 589: ops (see <code>target-i386/translate.c</code>). Some optimizations can be ! 590: performed at this stage, including liveness analysis and trivial ! 591: constant expression evaluation. TCG ops are then implemented in the ! 592: host CPU back end, also known as TCG target (see ! 593: <code>tcg/i386/tcg-target.c</code>). For more information, please take a ! 594: look at <code>tcg/README</code>. ! 595: </p> ! 596: <hr size="6"> ! 597: <a name="Condition-code-optimisations"></a> ! 598: <a name="SEC12"></a> ! 599: <table cellpadding="1" cellspacing="1" border="0"> ! 600: <tr><td valign="middle" align="left">[<a href="#SEC11" title="Previous section in reading order"> < </a>]</td> ! 601: <td valign="middle" align="left">[<a href="#SEC13" title="Next section in reading order"> > </a>]</td> ! 602: <td valign="middle" align="left"> </td> ! 603: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 604: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 605: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 606: <td valign="middle" align="left"> </td> ! 607: <td valign="middle" align="left"> </td> ! 608: <td valign="middle" align="left"> </td> ! 609: <td valign="middle" align="left"> </td> ! 610: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 611: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 612: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 613: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 614: </tr></table> ! 615: <h2 class="section"> 2.3 Condition code optimisations </h2> ! 616: ! 617: <p>Lazy evaluation of CPU condition codes (<code>EFLAGS</code> register on x86) ! 618: is important for CPUs where every instruction sets the condition ! 619: codes. It tends to be less important on conventional RISC systems ! 620: where condition codes are only updated when explicitly requested. ! 621: </p> ! 622: <p>Instead of computing the condition codes after each x86 instruction, ! 623: QEMU just stores one operand (called <code>CC_SRC</code>), the result ! 624: (called <code>CC_DST</code>) and the type of operation (called ! 625: <code>CC_OP</code>). When the condition codes are needed, the condition ! 626: codes can be calculated using this information. In addition, an ! 627: optimized calculation can be performed for some instruction types like ! 628: conditional branches. ! 629: </p> ! 630: <p><code>CC_OP</code> is almost never explicitly set in the generated code ! 631: because it is known at translation time. ! 632: </p> ! 633: <p>The lazy condition code evaluation is used on x86, m68k and cris. ARM ! 634: uses a simplified variant for the N and Z flags. ! 635: </p> ! 636: <hr size="6"> ! 637: <a name="CPU-state-optimisations"></a> ! 638: <a name="SEC13"></a> ! 639: <table cellpadding="1" cellspacing="1" border="0"> ! 640: <tr><td valign="middle" align="left">[<a href="#SEC12" title="Previous section in reading order"> < </a>]</td> ! 641: <td valign="middle" align="left">[<a href="#SEC14" title="Next section in reading order"> > </a>]</td> ! 642: <td valign="middle" align="left"> </td> ! 643: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 644: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 645: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 646: <td valign="middle" align="left"> </td> ! 647: <td valign="middle" align="left"> </td> ! 648: <td valign="middle" align="left"> </td> ! 649: <td valign="middle" align="left"> </td> ! 650: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 651: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 652: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 653: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 654: </tr></table> ! 655: <h2 class="section"> 2.4 CPU state optimisations </h2> ! 656: ! 657: <p>The target CPUs have many internal states which change the way it ! 658: evaluates instructions. In order to achieve a good speed, the ! 659: translation phase considers that some state information of the virtual ! 660: CPU cannot change in it. The state is recorded in the Translation ! 661: Block (TB). If the state changes (e.g. privilege level), a new TB will ! 662: be generated and the previous TB won't be used anymore until the state ! 663: matches the state recorded in the previous TB. For example, if the SS, ! 664: DS and ES segments have a zero base, then the translator does not even ! 665: generate an addition for the segment base. ! 666: </p> ! 667: <p>[The FPU stack pointer register is not handled that way yet]. ! 668: </p> ! 669: <hr size="6"> ! 670: <a name="Translation-cache"></a> ! 671: <a name="SEC14"></a> ! 672: <table cellpadding="1" cellspacing="1" border="0"> ! 673: <tr><td valign="middle" align="left">[<a href="#SEC13" title="Previous section in reading order"> < </a>]</td> ! 674: <td valign="middle" align="left">[<a href="#SEC15" title="Next section in reading order"> > </a>]</td> ! 675: <td valign="middle" align="left"> </td> ! 676: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 677: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 678: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 679: <td valign="middle" align="left"> </td> ! 680: <td valign="middle" align="left"> </td> ! 681: <td valign="middle" align="left"> </td> ! 682: <td valign="middle" align="left"> </td> ! 683: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 684: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 685: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 686: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 687: </tr></table> ! 688: <h2 class="section"> 2.5 Translation cache </h2> ! 689: ! 690: <p>A 16 MByte cache holds the most recently used translations. For ! 691: simplicity, it is completely flushed when it is full. A translation unit ! 692: contains just a single basic block (a block of x86 instructions ! 693: terminated by a jump or by a virtual CPU state change which the ! 694: translator cannot deduce statically). ! 695: </p> ! 696: <hr size="6"> ! 697: <a name="Direct-block-chaining"></a> ! 698: <a name="SEC15"></a> ! 699: <table cellpadding="1" cellspacing="1" border="0"> ! 700: <tr><td valign="middle" align="left">[<a href="#SEC14" title="Previous section in reading order"> < </a>]</td> ! 701: <td valign="middle" align="left">[<a href="#SEC16" title="Next section in reading order"> > </a>]</td> ! 702: <td valign="middle" align="left"> </td> ! 703: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 704: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 705: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 706: <td valign="middle" align="left"> </td> ! 707: <td valign="middle" align="left"> </td> ! 708: <td valign="middle" align="left"> </td> ! 709: <td valign="middle" align="left"> </td> ! 710: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 711: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 712: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 713: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 714: </tr></table> ! 715: <h2 class="section"> 2.6 Direct block chaining </h2> ! 716: ! 717: <p>After each translated basic block is executed, QEMU uses the simulated ! 718: Program Counter (PC) and other cpu state informations (such as the CS ! 719: segment base value) to find the next basic block. ! 720: </p> ! 721: <p>In order to accelerate the most common cases where the new simulated PC ! 722: is known, QEMU can patch a basic block so that it jumps directly to the ! 723: next one. ! 724: </p> ! 725: <p>The most portable code uses an indirect jump. An indirect jump makes ! 726: it easier to make the jump target modification atomic. On some host ! 727: architectures (such as x86 or PowerPC), the <code>JUMP</code> opcode is ! 728: directly patched so that the block chaining has no overhead. ! 729: </p> ! 730: <hr size="6"> ! 731: <a name="Self_002dmodifying-code-and-translated-code-invalidation"></a> ! 732: <a name="SEC16"></a> ! 733: <table cellpadding="1" cellspacing="1" border="0"> ! 734: <tr><td valign="middle" align="left">[<a href="#SEC15" title="Previous section in reading order"> < </a>]</td> ! 735: <td valign="middle" align="left">[<a href="#SEC17" title="Next section in reading order"> > </a>]</td> ! 736: <td valign="middle" align="left"> </td> ! 737: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 738: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 739: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 740: <td valign="middle" align="left"> </td> ! 741: <td valign="middle" align="left"> </td> ! 742: <td valign="middle" align="left"> </td> ! 743: <td valign="middle" align="left"> </td> ! 744: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 745: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 746: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 747: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 748: </tr></table> ! 749: <h2 class="section"> 2.7 Self-modifying code and translated code invalidation </h2> ! 750: ! 751: <p>Self-modifying code is a special challenge in x86 emulation because no ! 752: instruction cache invalidation is signaled by the application when code ! 753: is modified. ! 754: </p> ! 755: <p>When translated code is generated for a basic block, the corresponding ! 756: host page is write protected if it is not already read-only. Then, if ! 757: a write access is done to the page, Linux raises a SEGV signal. QEMU ! 758: then invalidates all the translated code in the page and enables write ! 759: accesses to the page. ! 760: </p> ! 761: <p>Correct translated code invalidation is done efficiently by maintaining ! 762: a linked list of every translated block contained in a given page. Other ! 763: linked lists are also maintained to undo direct block chaining. ! 764: </p> ! 765: <p>On RISC targets, correctly written software uses memory barriers and ! 766: cache flushes, so some of the protection above would not be ! 767: necessary. However, QEMU still requires that the generated code always ! 768: matches the target instructions in memory in order to handle ! 769: exceptions correctly. ! 770: </p> ! 771: <hr size="6"> ! 772: <a name="Exception-support"></a> ! 773: <a name="SEC17"></a> ! 774: <table cellpadding="1" cellspacing="1" border="0"> ! 775: <tr><td valign="middle" align="left">[<a href="#SEC16" title="Previous section in reading order"> < </a>]</td> ! 776: <td valign="middle" align="left">[<a href="#SEC18" title="Next section in reading order"> > </a>]</td> ! 777: <td valign="middle" align="left"> </td> ! 778: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 779: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 780: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 781: <td valign="middle" align="left"> </td> ! 782: <td valign="middle" align="left"> </td> ! 783: <td valign="middle" align="left"> </td> ! 784: <td valign="middle" align="left"> </td> ! 785: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 786: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 787: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 788: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 789: </tr></table> ! 790: <h2 class="section"> 2.8 Exception support </h2> ! 791: ! 792: <p>longjmp() is used when an exception such as division by zero is ! 793: encountered. ! 794: </p> ! 795: <p>The host SIGSEGV and SIGBUS signal handlers are used to get invalid ! 796: memory accesses. The simulated program counter is found by ! 797: retranslating the corresponding basic block and by looking where the ! 798: host program counter was at the exception point. ! 799: </p> ! 800: <p>The virtual CPU cannot retrieve the exact <code>EFLAGS</code> register because ! 801: in some cases it is not computed because of condition code ! 802: optimisations. It is not a big concern because the emulated code can ! 803: still be restarted in any cases. ! 804: </p> ! 805: <hr size="6"> ! 806: <a name="MMU-emulation"></a> ! 807: <a name="SEC18"></a> ! 808: <table cellpadding="1" cellspacing="1" border="0"> ! 809: <tr><td valign="middle" align="left">[<a href="#SEC17" title="Previous section in reading order"> < </a>]</td> ! 810: <td valign="middle" align="left">[<a href="#SEC19" title="Next section in reading order"> > </a>]</td> ! 811: <td valign="middle" align="left"> </td> ! 812: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 813: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 814: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 815: <td valign="middle" align="left"> </td> ! 816: <td valign="middle" align="left"> </td> ! 817: <td valign="middle" align="left"> </td> ! 818: <td valign="middle" align="left"> </td> ! 819: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 820: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 821: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 822: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 823: </tr></table> ! 824: <h2 class="section"> 2.9 MMU emulation </h2> ! 825: ! 826: <p>For system emulation QEMU supports a soft MMU. In that mode, the MMU ! 827: virtual to physical address translation is done at every memory ! 828: access. QEMU uses an address translation cache to speed up the ! 829: translation. ! 830: </p> ! 831: <p>In order to avoid flushing the translated code each time the MMU ! 832: mappings change, QEMU uses a physically indexed translation cache. It ! 833: means that each basic block is indexed with its physical address. ! 834: </p> ! 835: <p>When MMU mappings change, only the chaining of the basic blocks is ! 836: reset (i.e. a basic block can no longer jump directly to another one). ! 837: </p> ! 838: <hr size="6"> ! 839: <a name="Device-emulation"></a> ! 840: <a name="SEC19"></a> ! 841: <table cellpadding="1" cellspacing="1" border="0"> ! 842: <tr><td valign="middle" align="left">[<a href="#SEC18" title="Previous section in reading order"> < </a>]</td> ! 843: <td valign="middle" align="left">[<a href="#SEC20" title="Next section in reading order"> > </a>]</td> ! 844: <td valign="middle" align="left"> </td> ! 845: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 846: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 847: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 848: <td valign="middle" align="left"> </td> ! 849: <td valign="middle" align="left"> </td> ! 850: <td valign="middle" align="left"> </td> ! 851: <td valign="middle" align="left"> </td> ! 852: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 853: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 854: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 855: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 856: </tr></table> ! 857: <h2 class="section"> 2.10 Device emulation </h2> ! 858: ! 859: <p>Systems emulated by QEMU are organized by boards. At initialization ! 860: phase, each board instantiates a number of CPUs, devices, RAM and ! 861: ROM. Each device in turn can assign I/O ports or memory areas (for ! 862: MMIO) to its handlers. When the emulation starts, an access to the ! 863: ports or MMIO memory areas assigned to the device causes the ! 864: corresponding handler to be called. ! 865: </p> ! 866: <p>RAM and ROM are handled more optimally, only the offset to the host ! 867: memory needs to be added to the guest address. ! 868: </p> ! 869: <p>The video RAM of VGA and other display cards is special: it can be ! 870: read or written directly like RAM, but write accesses cause the memory ! 871: to be marked with VGA_DIRTY flag as well. ! 872: </p> ! 873: <p>QEMU supports some device classes like serial and parallel ports, USB, ! 874: drives and network devices, by providing APIs for easier connection to ! 875: the generic, higher level implementations. The API hides the ! 876: implementation details from the devices, like native device use or ! 877: advanced block device formats like QCOW. ! 878: </p> ! 879: <p>Usually the devices implement a reset method and register support for ! 880: saving and loading of the device state. The devices can also use ! 881: timers, especially together with the use of bottom halves (BHs). ! 882: </p> ! 883: <hr size="6"> ! 884: <a name="Hardware-interrupts"></a> ! 885: <a name="SEC20"></a> ! 886: <table cellpadding="1" cellspacing="1" border="0"> ! 887: <tr><td valign="middle" align="left">[<a href="#SEC19" title="Previous section in reading order"> < </a>]</td> ! 888: <td valign="middle" align="left">[<a href="#SEC21" title="Next section in reading order"> > </a>]</td> ! 889: <td valign="middle" align="left"> </td> ! 890: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 891: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 892: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 893: <td valign="middle" align="left"> </td> ! 894: <td valign="middle" align="left"> </td> ! 895: <td valign="middle" align="left"> </td> ! 896: <td valign="middle" align="left"> </td> ! 897: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 898: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 899: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 900: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 901: </tr></table> ! 902: <h2 class="section"> 2.11 Hardware interrupts </h2> ! 903: ! 904: <p>In order to be faster, QEMU does not check at every basic block if an ! 905: hardware interrupt is pending. Instead, the user must asynchrously ! 906: call a specific function to tell that an interrupt is pending. This ! 907: function resets the chaining of the currently executing basic ! 908: block. It ensures that the execution will return soon in the main loop ! 909: of the CPU emulator. Then the main loop can test if the interrupt is ! 910: pending and handle it. ! 911: </p> ! 912: <hr size="6"> ! 913: <a name="User-emulation-specific-details"></a> ! 914: <a name="SEC21"></a> ! 915: <table cellpadding="1" cellspacing="1" border="0"> ! 916: <tr><td valign="middle" align="left">[<a href="#SEC20" title="Previous section in reading order"> < </a>]</td> ! 917: <td valign="middle" align="left">[<a href="#SEC22" title="Next section in reading order"> > </a>]</td> ! 918: <td valign="middle" align="left"> </td> ! 919: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 920: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 921: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 922: <td valign="middle" align="left"> </td> ! 923: <td valign="middle" align="left"> </td> ! 924: <td valign="middle" align="left"> </td> ! 925: <td valign="middle" align="left"> </td> ! 926: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 927: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 928: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 929: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 930: </tr></table> ! 931: <h2 class="section"> 2.12 User emulation specific details </h2> ! 932: ! 933: <hr size="6"> ! 934: <a name="SEC22"></a> ! 935: <table cellpadding="1" cellspacing="1" border="0"> ! 936: <tr><td valign="middle" align="left">[<a href="#SEC21" title="Previous section in reading order"> < </a>]</td> ! 937: <td valign="middle" align="left">[<a href="#SEC23" title="Next section in reading order"> > </a>]</td> ! 938: <td valign="middle" align="left"> </td> ! 939: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 940: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td> ! 941: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 942: <td valign="middle" align="left"> </td> ! 943: <td valign="middle" align="left"> </td> ! 944: <td valign="middle" align="left"> </td> ! 945: <td valign="middle" align="left"> </td> ! 946: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 947: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 948: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 949: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 950: </tr></table> ! 951: <h3 class="subsection"> 2.12.1 Linux system call translation </h3> ! 952: ! 953: <p>QEMU includes a generic system call translator for Linux. It means that ! 954: the parameters of the system calls can be converted to fix the ! 955: endianness and 32/64 bit issues. The IOCTLs are converted with a generic ! 956: type description system (see ‘<tt>ioctls.h</tt>’ and ‘<tt>thunk.c</tt>’). ! 957: </p> ! 958: <p>QEMU supports host CPUs which have pages bigger than 4KB. It records all ! 959: the mappings the process does and try to emulated the <code>mmap()</code> ! 960: system calls in cases where the host <code>mmap()</code> call would fail ! 961: because of bad page alignment. ! 962: </p> ! 963: <hr size="6"> ! 964: <a name="SEC23"></a> ! 965: <table cellpadding="1" cellspacing="1" border="0"> ! 966: <tr><td valign="middle" align="left">[<a href="#SEC22" title="Previous section in reading order"> < </a>]</td> ! 967: <td valign="middle" align="left">[<a href="#SEC24" title="Next section in reading order"> > </a>]</td> ! 968: <td valign="middle" align="left"> </td> ! 969: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 970: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td> ! 971: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 972: <td valign="middle" align="left"> </td> ! 973: <td valign="middle" align="left"> </td> ! 974: <td valign="middle" align="left"> </td> ! 975: <td valign="middle" align="left"> </td> ! 976: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 977: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 978: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 979: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 980: </tr></table> ! 981: <h3 class="subsection"> 2.12.2 Linux signals </h3> ! 982: ! 983: <p>Normal and real-time signals are queued along with their information ! 984: (<code>siginfo_t</code>) as it is done in the Linux kernel. Then an interrupt ! 985: request is done to the virtual CPU. When it is interrupted, one queued ! 986: signal is handled by generating a stack frame in the virtual CPU as the ! 987: Linux kernel does. The <code>sigreturn()</code> system call is emulated to return ! 988: from the virtual signal handler. ! 989: </p> ! 990: <p>Some signals (such as SIGALRM) directly come from the host. Other ! 991: signals are synthetized from the virtual CPU exceptions such as SIGFPE ! 992: when a division by zero is done (see <code>main.c:cpu_loop()</code>). ! 993: </p> ! 994: <p>The blocked signal mask is still handled by the host Linux kernel so ! 995: that most signal system calls can be redirected directly to the host ! 996: Linux kernel. Only the <code>sigaction()</code> and <code>sigreturn()</code> system ! 997: calls need to be fully emulated (see ‘<tt>signal.c</tt>’). ! 998: </p> ! 999: <hr size="6"> ! 1000: <a name="SEC24"></a> ! 1001: <table cellpadding="1" cellspacing="1" border="0"> ! 1002: <tr><td valign="middle" align="left">[<a href="#SEC23" title="Previous section in reading order"> < </a>]</td> ! 1003: <td valign="middle" align="left">[<a href="#SEC25" title="Next section in reading order"> > </a>]</td> ! 1004: <td valign="middle" align="left"> </td> ! 1005: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1006: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td> ! 1007: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 1008: <td valign="middle" align="left"> </td> ! 1009: <td valign="middle" align="left"> </td> ! 1010: <td valign="middle" align="left"> </td> ! 1011: <td valign="middle" align="left"> </td> ! 1012: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1013: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1014: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1015: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1016: </tr></table> ! 1017: <h3 class="subsection"> 2.12.3 clone() system call and threads </h3> ! 1018: ! 1019: <p>The Linux clone() system call is usually used to create a thread. QEMU ! 1020: uses the host clone() system call so that real host threads are created ! 1021: for each emulated thread. One virtual CPU instance is created for each ! 1022: thread. ! 1023: </p> ! 1024: <p>The virtual x86 CPU atomic operations are emulated with a global lock so ! 1025: that their semantic is preserved. ! 1026: </p> ! 1027: <p>Note that currently there are still some locking issues in QEMU. In ! 1028: particular, the translated cache flush is not protected yet against ! 1029: reentrancy. ! 1030: </p> ! 1031: <hr size="6"> ! 1032: <a name="SEC25"></a> ! 1033: <table cellpadding="1" cellspacing="1" border="0"> ! 1034: <tr><td valign="middle" align="left">[<a href="#SEC24" title="Previous section in reading order"> < </a>]</td> ! 1035: <td valign="middle" align="left">[<a href="#SEC26" title="Next section in reading order"> > </a>]</td> ! 1036: <td valign="middle" align="left"> </td> ! 1037: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1038: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td> ! 1039: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 1040: <td valign="middle" align="left"> </td> ! 1041: <td valign="middle" align="left"> </td> ! 1042: <td valign="middle" align="left"> </td> ! 1043: <td valign="middle" align="left"> </td> ! 1044: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1045: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1046: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1047: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1048: </tr></table> ! 1049: <h3 class="subsection"> 2.12.4 Self-virtualization </h3> ! 1050: ! 1051: <p>QEMU was conceived so that ultimately it can emulate itself. Although ! 1052: it is not very useful, it is an important test to show the power of the ! 1053: emulator. ! 1054: </p> ! 1055: <p>Achieving self-virtualization is not easy because there may be address ! 1056: space conflicts. QEMU user emulators solve this problem by being an ! 1057: executable ELF shared object as the ld-linux.so ELF interpreter. That ! 1058: way, it can be relocated at load time. ! 1059: </p> ! 1060: <hr size="6"> ! 1061: <a name="Bibliography"></a> ! 1062: <a name="SEC26"></a> ! 1063: <table cellpadding="1" cellspacing="1" border="0"> ! 1064: <tr><td valign="middle" align="left">[<a href="#SEC25" title="Previous section in reading order"> < </a>]</td> ! 1065: <td valign="middle" align="left">[<a href="#SEC27" title="Next section in reading order"> > </a>]</td> ! 1066: <td valign="middle" align="left"> </td> ! 1067: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1068: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td> ! 1069: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td> ! 1070: <td valign="middle" align="left"> </td> ! 1071: <td valign="middle" align="left"> </td> ! 1072: <td valign="middle" align="left"> </td> ! 1073: <td valign="middle" align="left"> </td> ! 1074: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1075: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1076: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1077: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1078: </tr></table> ! 1079: <h2 class="section"> 2.13 Bibliography </h2> ! 1080: ! 1081: <dl compact="compact"> ! 1082: <dt> [1]</dt> ! 1083: <dd><p><a href="http://citeseer.nj.nec.com/piumarta98optimizing.html">http://citeseer.nj.nec.com/piumarta98optimizing.html</a>, Optimizing ! 1084: direct threaded code by selective inlining (1998) by Ian Piumarta, Fabio ! 1085: Riccardi. ! 1086: </p> ! 1087: </dd> ! 1088: <dt> [2]</dt> ! 1089: <dd><p><a href="http://developer.kde.org/~sewardj/">http://developer.kde.org/~sewardj/</a>, Valgrind, an open-source ! 1090: memory debugger for x86-GNU/Linux, by Julian Seward. ! 1091: </p> ! 1092: </dd> ! 1093: <dt> [3]</dt> ! 1094: <dd><p><a href="http://bochs.sourceforge.net/">http://bochs.sourceforge.net/</a>, the Bochs IA-32 Emulator Project, ! 1095: by Kevin Lawton et al. ! 1096: </p> ! 1097: </dd> ! 1098: <dt> [4]</dt> ! 1099: <dd><p><a href="http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html">http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html</a>, the EM86 ! 1100: x86 emulator on Alpha-Linux. ! 1101: </p> ! 1102: </dd> ! 1103: <dt> [5]</dt> ! 1104: <dd><p><a href="http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf">http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf</a>, ! 1105: DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton ! 1106: Chernoff and Ray Hookway. ! 1107: </p> ! 1108: </dd> ! 1109: <dt> [6]</dt> ! 1110: <dd><p><a href="http://www.willows.com/">http://www.willows.com/</a>, Windows API library emulation from ! 1111: Willows Software. ! 1112: </p> ! 1113: </dd> ! 1114: <dt> [7]</dt> ! 1115: <dd><p><a href="http://user-mode-linux.sourceforge.net/">http://user-mode-linux.sourceforge.net/</a>, ! 1116: The User-mode Linux Kernel. ! 1117: </p> ! 1118: </dd> ! 1119: <dt> [8]</dt> ! 1120: <dd><p><a href="http://www.plex86.org/">http://www.plex86.org/</a>, ! 1121: The new Plex86 project. ! 1122: </p> ! 1123: </dd> ! 1124: <dt> [9]</dt> ! 1125: <dd><p><a href="http://www.vmware.com/">http://www.vmware.com/</a>, ! 1126: The VMWare PC virtualizer. ! 1127: </p> ! 1128: </dd> ! 1129: <dt> [10]</dt> ! 1130: <dd><p><a href="http://www.microsoft.com/windowsxp/virtualpc/">http://www.microsoft.com/windowsxp/virtualpc/</a>, ! 1131: The VirtualPC PC virtualizer. ! 1132: </p> ! 1133: </dd> ! 1134: <dt> [11]</dt> ! 1135: <dd><p><a href="http://www.twoostwo.org/">http://www.twoostwo.org/</a>, ! 1136: The TwoOStwo PC virtualizer. ! 1137: </p> ! 1138: </dd> ! 1139: <dt> [12]</dt> ! 1140: <dd><p><a href="http://virtualbox.org/">http://virtualbox.org/</a>, ! 1141: The VirtualBox PC virtualizer. ! 1142: </p> ! 1143: </dd> ! 1144: <dt> [13]</dt> ! 1145: <dd><p><a href="http://www.xen.org/">http://www.xen.org/</a>, ! 1146: The Xen hypervisor. ! 1147: </p> ! 1148: </dd> ! 1149: <dt> [14]</dt> ! 1150: <dd><p><a href="http://kvm.qumranet.com/kvmwiki/Front_Page">http://kvm.qumranet.com/kvmwiki/Front_Page</a>, ! 1151: Kernel Based Virtual Machine (KVM). ! 1152: </p> ! 1153: </dd> ! 1154: <dt> [15]</dt> ! 1155: <dd><p><a href="http://www.greensocs.com/projects/QEMUSystemC">http://www.greensocs.com/projects/QEMUSystemC</a>, ! 1156: QEMU-SystemC, a hardware co-simulator. ! 1157: </p> ! 1158: </dd> ! 1159: </dl> ! 1160: ! 1161: <hr size="6"> ! 1162: <a name="Regression-Tests"></a> ! 1163: <a name="SEC27"></a> ! 1164: <table cellpadding="1" cellspacing="1" border="0"> ! 1165: <tr><td valign="middle" align="left">[<a href="#SEC26" title="Previous section in reading order"> < </a>]</td> ! 1166: <td valign="middle" align="left">[<a href="#SEC28" title="Next section in reading order"> > </a>]</td> ! 1167: <td valign="middle" align="left"> </td> ! 1168: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1169: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td> ! 1170: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td> ! 1171: <td valign="middle" align="left"> </td> ! 1172: <td valign="middle" align="left"> </td> ! 1173: <td valign="middle" align="left"> </td> ! 1174: <td valign="middle" align="left"> </td> ! 1175: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1176: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1177: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1178: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1179: </tr></table> ! 1180: <h1 class="chapter"> 3. Regression Tests </h1> ! 1181: ! 1182: <p>In the directory ‘<tt>tests/</tt>’, various interesting testing programs ! 1183: are available. They are used for regression testing. ! 1184: </p> ! 1185: <table class="menu" border="0" cellspacing="0"> ! 1186: <tr><td align="left" valign="top"><a href="#SEC28">3.1 ‘<tt>test-i386</tt>’</a></td><td> </td><td align="left" valign="top"> ! 1187: </td></tr> ! 1188: <tr><td align="left" valign="top"><a href="#SEC29">3.2 ‘<tt>linux-test</tt>’</a></td><td> </td><td align="left" valign="top"> ! 1189: </td></tr> ! 1190: <tr><td align="left" valign="top"><a href="#SEC30">3.3 ‘<tt>qruncom.c</tt>’</a></td><td> </td><td align="left" valign="top"> ! 1191: </td></tr> ! 1192: </table> ! 1193: ! 1194: <hr size="6"> ! 1195: <a name="test_002di386"></a> ! 1196: <a name="SEC28"></a> ! 1197: <table cellpadding="1" cellspacing="1" border="0"> ! 1198: <tr><td valign="middle" align="left">[<a href="#SEC27" title="Previous section in reading order"> < </a>]</td> ! 1199: <td valign="middle" align="left">[<a href="#SEC29" title="Next section in reading order"> > </a>]</td> ! 1200: <td valign="middle" align="left"> </td> ! 1201: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1202: <td valign="middle" align="left">[<a href="#SEC27" title="Up section"> Up </a>]</td> ! 1203: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td> ! 1204: <td valign="middle" align="left"> </td> ! 1205: <td valign="middle" align="left"> </td> ! 1206: <td valign="middle" align="left"> </td> ! 1207: <td valign="middle" align="left"> </td> ! 1208: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1209: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1210: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1211: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1212: </tr></table> ! 1213: <h2 class="section"> 3.1 ‘<tt>test-i386</tt>’ </h2> ! 1214: ! 1215: <p>This program executes most of the 16 bit and 32 bit x86 instructions and ! 1216: generates a text output. It can be compared with the output obtained with ! 1217: a real CPU or another emulator. The target <code>make test</code> runs this ! 1218: program and a <code>diff</code> on the generated output. ! 1219: </p> ! 1220: <p>The Linux system call <code>modify_ldt()</code> is used to create x86 selectors ! 1221: to test some 16 bit addressing and 32 bit with segmentation cases. ! 1222: </p> ! 1223: <p>The Linux system call <code>vm86()</code> is used to test vm86 emulation. ! 1224: </p> ! 1225: <p>Various exceptions are raised to test most of the x86 user space ! 1226: exception reporting. ! 1227: </p> ! 1228: <hr size="6"> ! 1229: <a name="linux_002dtest"></a> ! 1230: <a name="SEC29"></a> ! 1231: <table cellpadding="1" cellspacing="1" border="0"> ! 1232: <tr><td valign="middle" align="left">[<a href="#SEC28" title="Previous section in reading order"> < </a>]</td> ! 1233: <td valign="middle" align="left">[<a href="#SEC30" title="Next section in reading order"> > </a>]</td> ! 1234: <td valign="middle" align="left"> </td> ! 1235: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1236: <td valign="middle" align="left">[<a href="#SEC27" title="Up section"> Up </a>]</td> ! 1237: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td> ! 1238: <td valign="middle" align="left"> </td> ! 1239: <td valign="middle" align="left"> </td> ! 1240: <td valign="middle" align="left"> </td> ! 1241: <td valign="middle" align="left"> </td> ! 1242: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1243: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1244: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1245: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1246: </tr></table> ! 1247: <h2 class="section"> 3.2 ‘<tt>linux-test</tt>’ </h2> ! 1248: ! 1249: <p>This program tests various Linux system calls. It is used to verify ! 1250: that the system call parameters are correctly converted between target ! 1251: and host CPUs. ! 1252: </p> ! 1253: <hr size="6"> ! 1254: <a name="qruncom_002ec"></a> ! 1255: <a name="SEC30"></a> ! 1256: <table cellpadding="1" cellspacing="1" border="0"> ! 1257: <tr><td valign="middle" align="left">[<a href="#SEC29" title="Previous section in reading order"> < </a>]</td> ! 1258: <td valign="middle" align="left">[<a href="#SEC31" title="Next section in reading order"> > </a>]</td> ! 1259: <td valign="middle" align="left"> </td> ! 1260: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1261: <td valign="middle" align="left">[<a href="#SEC27" title="Up section"> Up </a>]</td> ! 1262: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td> ! 1263: <td valign="middle" align="left"> </td> ! 1264: <td valign="middle" align="left"> </td> ! 1265: <td valign="middle" align="left"> </td> ! 1266: <td valign="middle" align="left"> </td> ! 1267: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1268: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1269: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1270: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1271: </tr></table> ! 1272: <h2 class="section"> 3.3 ‘<tt>qruncom.c</tt>’ </h2> ! 1273: ! 1274: <p>Example of usage of <code>libqemu</code> to emulate a user mode i386 CPU. ! 1275: </p> ! 1276: <hr size="6"> ! 1277: <a name="Index"></a> ! 1278: <a name="SEC31"></a> ! 1279: <table cellpadding="1" cellspacing="1" border="0"> ! 1280: <tr><td valign="middle" align="left">[<a href="#SEC30" title="Previous section in reading order"> < </a>]</td> ! 1281: <td valign="middle" align="left">[ > ]</td> ! 1282: <td valign="middle" align="left"> </td> ! 1283: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td> ! 1284: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td> ! 1285: <td valign="middle" align="left">[ >> ]</td> ! 1286: <td valign="middle" align="left"> </td> ! 1287: <td valign="middle" align="left"> </td> ! 1288: <td valign="middle" align="left"> </td> ! 1289: <td valign="middle" align="left"> </td> ! 1290: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1291: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1292: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1293: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1294: </tr></table> ! 1295: <h1 class="chapter"> 4. Index </h1> ! 1296: ! 1297: <hr size="6"> ! 1298: <a name="SEC_Contents"></a> ! 1299: <table cellpadding="1" cellspacing="1" border="0"> ! 1300: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1301: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1302: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1303: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1304: </tr></table> ! 1305: <h1>Table of Contents</h1> ! 1306: <div class="contents"> ! 1307: ! 1308: <ul class="toc"> ! 1309: <li><a name="TOC1" href="#SEC1">1. Introduction</a> ! 1310: <ul class="toc"> ! 1311: <li><a name="TOC2" href="#SEC2">1.1 Features</a></li> ! 1312: <li><a name="TOC3" href="#SEC3">1.2 x86 and x86-64 emulation</a></li> ! 1313: <li><a name="TOC4" href="#SEC4">1.3 ARM emulation</a></li> ! 1314: <li><a name="TOC5" href="#SEC5">1.4 MIPS emulation</a></li> ! 1315: <li><a name="TOC6" href="#SEC6">1.5 PowerPC emulation</a></li> ! 1316: <li><a name="TOC7" href="#SEC7">1.6 Sparc32 and Sparc64 emulation</a></li> ! 1317: <li><a name="TOC8" href="#SEC8">1.7 Other CPU emulation</a></li> ! 1318: </ul></li> ! 1319: <li><a name="TOC9" href="#SEC9">2. QEMU Internals</a> ! 1320: <ul class="toc"> ! 1321: <li><a name="TOC10" href="#SEC10">2.1 QEMU compared to other emulators</a></li> ! 1322: <li><a name="TOC11" href="#SEC11">2.2 Portable dynamic translation</a></li> ! 1323: <li><a name="TOC12" href="#SEC12">2.3 Condition code optimisations</a></li> ! 1324: <li><a name="TOC13" href="#SEC13">2.4 CPU state optimisations</a></li> ! 1325: <li><a name="TOC14" href="#SEC14">2.5 Translation cache</a></li> ! 1326: <li><a name="TOC15" href="#SEC15">2.6 Direct block chaining</a></li> ! 1327: <li><a name="TOC16" href="#SEC16">2.7 Self-modifying code and translated code invalidation</a></li> ! 1328: <li><a name="TOC17" href="#SEC17">2.8 Exception support</a></li> ! 1329: <li><a name="TOC18" href="#SEC18">2.9 MMU emulation</a></li> ! 1330: <li><a name="TOC19" href="#SEC19">2.10 Device emulation</a></li> ! 1331: <li><a name="TOC20" href="#SEC20">2.11 Hardware interrupts</a></li> ! 1332: <li><a name="TOC21" href="#SEC21">2.12 User emulation specific details</a> ! 1333: <ul class="toc"> ! 1334: <li><a name="TOC22" href="#SEC22">2.12.1 Linux system call translation</a></li> ! 1335: <li><a name="TOC23" href="#SEC23">2.12.2 Linux signals</a></li> ! 1336: <li><a name="TOC24" href="#SEC24">2.12.3 clone() system call and threads</a></li> ! 1337: <li><a name="TOC25" href="#SEC25">2.12.4 Self-virtualization</a></li> ! 1338: </ul></li> ! 1339: <li><a name="TOC26" href="#SEC26">2.13 Bibliography</a></li> ! 1340: </ul></li> ! 1341: <li><a name="TOC27" href="#SEC27">3. Regression Tests</a> ! 1342: <ul class="toc"> ! 1343: <li><a name="TOC28" href="#SEC28">3.1 ‘<tt>test-i386</tt>’</a></li> ! 1344: <li><a name="TOC29" href="#SEC29">3.2 ‘<tt>linux-test</tt>’</a></li> ! 1345: <li><a name="TOC30" href="#SEC30">3.3 ‘<tt>qruncom.c</tt>’</a></li> ! 1346: </ul></li> ! 1347: <li><a name="TOC31" href="#SEC31">4. Index</a></li> ! 1348: </ul> ! 1349: </div> ! 1350: <hr size="1"> ! 1351: <a name="SEC_About"></a> ! 1352: <table cellpadding="1" cellspacing="1" border="0"> ! 1353: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td> ! 1354: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td> ! 1355: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td> ! 1356: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td> ! 1357: </tr></table> ! 1358: <h1>About This Document</h1> ! 1359: <p> ! 1360: This document was generated by <em>Anthony Liguori</em> on <em>May, 1 2009</em> using <a href="http://www.nongnu.org/texi2html/"><em>texi2html 1.78</em></a>. ! 1361: </p> ! 1362: <p> ! 1363: The buttons in the navigation panels have the following meaning: ! 1364: </p> ! 1365: <table border="1"> ! 1366: <tr> ! 1367: <th> Button </th> ! 1368: <th> Name </th> ! 1369: <th> Go to </th> ! 1370: <th> From 1.2.3 go to</th> ! 1371: </tr> ! 1372: <tr> ! 1373: <td align="center"> [ < ] </td> ! 1374: <td align="center">Back</td> ! 1375: <td>Previous section in reading order</td> ! 1376: <td>1.2.2</td> ! 1377: </tr> ! 1378: <tr> ! 1379: <td align="center"> [ > ] </td> ! 1380: <td align="center">Forward</td> ! 1381: <td>Next section in reading order</td> ! 1382: <td>1.2.4</td> ! 1383: </tr> ! 1384: <tr> ! 1385: <td align="center"> [ << ] </td> ! 1386: <td align="center">FastBack</td> ! 1387: <td>Beginning of this chapter or previous chapter</td> ! 1388: <td>1</td> ! 1389: </tr> ! 1390: <tr> ! 1391: <td align="center"> [ Up ] </td> ! 1392: <td align="center">Up</td> ! 1393: <td>Up section</td> ! 1394: <td>1.2</td> ! 1395: </tr> ! 1396: <tr> ! 1397: <td align="center"> [ >> ] </td> ! 1398: <td align="center">FastForward</td> ! 1399: <td>Next chapter</td> ! 1400: <td>2</td> ! 1401: </tr> ! 1402: <tr> ! 1403: <td align="center"> [Top] </td> ! 1404: <td align="center">Top</td> ! 1405: <td>Cover (top) of document</td> ! 1406: <td> </td> ! 1407: </tr> ! 1408: <tr> ! 1409: <td align="center"> [Contents] </td> ! 1410: <td align="center">Contents</td> ! 1411: <td>Table of contents</td> ! 1412: <td> </td> ! 1413: </tr> ! 1414: <tr> ! 1415: <td align="center"> [Index] </td> ! 1416: <td align="center">Index</td> ! 1417: <td>Index</td> ! 1418: <td> </td> ! 1419: </tr> ! 1420: <tr> ! 1421: <td align="center"> [ ? ] </td> ! 1422: <td align="center">About</td> ! 1423: <td>About (help)</td> ! 1424: <td> </td> ! 1425: </tr> ! 1426: </table> ! 1427: ! 1428: <p> ! 1429: where the <strong> Example </strong> assumes that the current position is at <strong> Subsubsection One-Two-Three </strong> of a document of the following structure: ! 1430: </p> ! 1431: ! 1432: <ul> ! 1433: <li> 1. Section One ! 1434: <ul> ! 1435: <li>1.1 Subsection One-One ! 1436: <ul> ! 1437: <li>...</li> ! 1438: </ul> ! 1439: </li> ! 1440: <li>1.2 Subsection One-Two ! 1441: <ul> ! 1442: <li>1.2.1 Subsubsection One-Two-One</li> ! 1443: <li>1.2.2 Subsubsection One-Two-Two</li> ! 1444: <li>1.2.3 Subsubsection One-Two-Three ! 1445: <strong><== Current Position </strong></li> ! 1446: <li>1.2.4 Subsubsection One-Two-Four</li> ! 1447: </ul> ! 1448: </li> ! 1449: <li>1.3 Subsection One-Three ! 1450: <ul> ! 1451: <li>...</li> ! 1452: </ul> ! 1453: </li> ! 1454: <li>1.4 Subsection One-Four</li> ! 1455: </ul> ! 1456: </li> ! 1457: </ul> ! 1458: ! 1459: <hr size="1"> ! 1460: <p> ! 1461: <font size="-1"> ! 1462: This document was generated by <em>Anthony Liguori</em> on <em>May, 1 2009</em> using <a href="http://www.nongnu.org/texi2html/"><em>texi2html 1.78</em></a>. ! 1463: </font> ! 1464: <br> ! 1465: ! 1466: </p> ! 1467: </body> ! 1468: </html>
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.