![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to qemu-tech.html CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Qemu by Fabrice Bellard] / qemu|
Return to qemu-tech.html CVS log | Up to [Qemu by Fabrice Bellard] / qemu |
1.1 root 1: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html401/loose.dtd">
2: <html>
3: <!-- Created on May, 1 2009 by texi2html 1.78 -->
4: <!--
5: Written by: Lionel Cons <[email protected]> (original author)
6: Karl Berry <[email protected]>
7: Olaf Bachmann <[email protected]>
8: and many others.
9: Maintained by: Many creative people.
10: Send bugs and suggestions to <[email protected]>
11:
12: -->
13: <head>
14: <title>QEMU Internals</title>
15:
16: <meta name="description" content="QEMU Internals">
17: <meta name="keywords" content="QEMU Internals">
18: <meta name="resource-type" content="document">
19: <meta name="distribution" content="global">
20: <meta name="Generator" content="texi2html 1.78">
21: <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
22: <style type="text/css">
23: <!--
24: a.summary-letter {text-decoration: none}
25: pre.display {font-family: serif}
26: pre.format {font-family: serif}
27: pre.menu-comment {font-family: serif}
28: pre.menu-preformatted {font-family: serif}
29: pre.smalldisplay {font-family: serif; font-size: smaller}
30: pre.smallexample {font-size: smaller}
31: pre.smallformat {font-family: serif; font-size: smaller}
32: pre.smalllisp {font-size: smaller}
33: span.roman {font-family:serif; font-weight:normal;}
34: span.sansserif {font-family:sans-serif; font-weight:normal;}
35: ul.toc {list-style: none}
36: -->
37: </style>
38:
39:
40: </head>
41:
42: <body lang="en" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000">
43:
44: <a name="Top"></a>
45: <a name="SEC_Top"></a>
46: <table cellpadding="1" cellspacing="1" border="0">
47: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
48: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
49: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
50: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
51: </tr></table>
52: <h1 class="settitle">QEMU Internals
53: </h1>
54:
55: <table class="menu" border="0" cellspacing="0">
56: <tr><td align="left" valign="top"><a href="#SEC1">1. Introduction</a></td><td> </td><td align="left" valign="top">
57: </td></tr>
58: <tr><td align="left" valign="top"><a href="#SEC9">2. QEMU Internals</a></td><td> </td><td align="left" valign="top">
59: </td></tr>
60: <tr><td align="left" valign="top"><a href="#SEC27">3. Regression Tests</a></td><td> </td><td align="left" valign="top">
61: </td></tr>
62: <tr><td align="left" valign="top"><a href="#SEC31">4. Index</a></td><td> </td><td align="left" valign="top">
63: </td></tr>
64: </table>
65:
66:
67: <hr size="1">
68: <a name="Introduction"></a>
69: <a name="SEC1"></a>
70: <table cellpadding="1" cellspacing="1" border="0">
71: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Previous section in reading order"> < </a>]</td>
72: <td valign="middle" align="left">[<a href="#SEC2" title="Next section in reading order"> > </a>]</td>
73: <td valign="middle" align="left"> </td>
74: <td valign="middle" align="left">[ << ]</td>
75: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td>
76: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
77: <td valign="middle" align="left"> </td>
78: <td valign="middle" align="left"> </td>
79: <td valign="middle" align="left"> </td>
80: <td valign="middle" align="left"> </td>
81: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
82: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
83: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
84: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
85: </tr></table>
86: <h1 class="chapter"> 1. Introduction </h1>
87:
88: <table class="menu" border="0" cellspacing="0">
89: <tr><td align="left" valign="top"><a href="#SEC2">1.1 Features</a></td><td> </td><td align="left" valign="top"></td></tr>
90: <tr><td align="left" valign="top"><a href="#SEC3">1.2 x86 and x86-64 emulation</a></td><td> </td><td align="left" valign="top"></td></tr>
91: <tr><td align="left" valign="top"><a href="#SEC4">1.3 ARM emulation</a></td><td> </td><td align="left" valign="top"></td></tr>
92: <tr><td align="left" valign="top"><a href="#SEC5">1.4 MIPS emulation</a></td><td> </td><td align="left" valign="top"></td></tr>
93: <tr><td align="left" valign="top"><a href="#SEC6">1.5 PowerPC emulation</a></td><td> </td><td align="left" valign="top"></td></tr>
94: <tr><td align="left" valign="top"><a href="#SEC7">1.6 Sparc32 and Sparc64 emulation</a></td><td> </td><td align="left" valign="top"></td></tr>
95: <tr><td align="left" valign="top"><a href="#SEC8">1.7 Other CPU emulation</a></td><td> </td><td align="left" valign="top"></td></tr>
96: </table>
97:
98: <hr size="6">
99: <a name="intro_005ffeatures"></a>
100: <a name="SEC2"></a>
101: <table cellpadding="1" cellspacing="1" border="0">
102: <tr><td valign="middle" align="left">[<a href="#SEC1" title="Previous section in reading order"> < </a>]</td>
103: <td valign="middle" align="left">[<a href="#SEC3" title="Next section in reading order"> > </a>]</td>
104: <td valign="middle" align="left"> </td>
105: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
106: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
107: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
108: <td valign="middle" align="left"> </td>
109: <td valign="middle" align="left"> </td>
110: <td valign="middle" align="left"> </td>
111: <td valign="middle" align="left"> </td>
112: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
113: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
114: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
115: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
116: </tr></table>
117: <h2 class="section"> 1.1 Features </h2>
118:
119: <p>QEMU is a FAST! processor emulator using a portable dynamic
120: translator.
121: </p>
122: <p>QEMU has two operating modes:
123: </p>
124: <ul class="toc">
125: <li>-
126: Full system emulation. In this mode (full platform virtualization),
127: QEMU emulates a full system (usually a PC), including a processor and
128: various peripherals. It can be used to launch several different
129: Operating Systems at once without rebooting the host machine or to
130: debug system code.
131:
132: </li><li>-
133: User mode emulation. In this mode (application level virtualization),
134: QEMU can launch processes compiled for one CPU on another CPU, however
135: the Operating Systems must match. This can be used for example to ease
136: cross-compilation and cross-debugging.
137: </li></ul>
138:
139: <p>As QEMU requires no host kernel driver to run, it is very safe and
140: easy to use.
141: </p>
142: <p>QEMU generic features:
143: </p>
144: <ul class="toc">
145: <li> User space only or full system emulation.
146:
147: </li><li> Using dynamic translation to native code for reasonable speed.
148:
149: </li><li>
150: Working on x86, x86_64 and PowerPC32/64 hosts. Being tested on ARM,
151: HPPA, Sparc32 and Sparc64. Previous versions had some support for
152: Alpha and S390 hosts, but TCG (see below) doesn't support those yet.
153:
154: </li><li> Self-modifying code support.
155:
156: </li><li> Precise exceptions support.
157:
158: </li><li> The virtual CPU is a library (<code>libqemu</code>) which can be used
159: in other projects (look at ‘<tt>qemu/tests/qruncom.c</tt>’ to have an
160: example of user mode <code>libqemu</code> usage).
161:
162: </li><li>
163: Floating point library supporting both full software emulation and
164: native host FPU instructions.
165:
166: </li></ul>
167:
168: <p>QEMU user mode emulation features:
169: </p><ul class="toc">
170: <li> Generic Linux system call converter, including most ioctls.
171:
172: </li><li> clone() emulation using native CPU clone() to use Linux scheduler for threads.
173:
174: </li><li> Accurate signal handling by remapping host signals to target signals.
175: </li></ul>
176:
177: <p>Linux user emulator (Linux host only) can be used to launch the Wine
178: Windows API emulator (<a href="http://www.winehq.org">http://www.winehq.org</a>). A Darwin user
179: emulator (Darwin hosts only) exists and a BSD user emulator for BSD
180: hosts is under development. It would also be possible to develop a
181: similar user emulator for Solaris.
182: </p>
183: <p>QEMU full system emulation features:
184: </p><ul class="toc">
185: <li>
186: QEMU uses a full software MMU for maximum portability.
187:
188: </li><li>
189: QEMU can optionally use an in-kernel accelerator, like kqemu and
190: kvm. The accelerators execute some of the guest code natively, while
191: continuing to emulate the rest of the machine.
192:
193: </li><li>
194: Various hardware devices can be emulated and in some cases, host
195: devices (e.g. serial and parallel ports, USB, drives) can be used
196: transparently by the guest Operating System. Host device passthrough
197: can be used for talking to external physical peripherals (e.g. a
198: webcam, modem or tape drive).
199:
200: </li><li>
201: Symmetric multiprocessing (SMP) even on a host with a single CPU. On a
202: SMP host system, QEMU can use only one CPU fully due to difficulty in
203: implementing atomic memory accesses efficiently.
204:
205: </li></ul>
206:
207: <hr size="6">
208: <a name="intro_005fx86_005femulation"></a>
209: <a name="SEC3"></a>
210: <table cellpadding="1" cellspacing="1" border="0">
211: <tr><td valign="middle" align="left">[<a href="#SEC2" title="Previous section in reading order"> < </a>]</td>
212: <td valign="middle" align="left">[<a href="#SEC4" title="Next section in reading order"> > </a>]</td>
213: <td valign="middle" align="left"> </td>
214: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
215: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
216: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
217: <td valign="middle" align="left"> </td>
218: <td valign="middle" align="left"> </td>
219: <td valign="middle" align="left"> </td>
220: <td valign="middle" align="left"> </td>
221: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
222: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
223: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
224: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
225: </tr></table>
226: <h2 class="section"> 1.2 x86 and x86-64 emulation </h2>
227:
228: <p>QEMU x86 target features:
229: </p>
230: <ul class="toc">
231: <li> The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation.
232: LDT/GDT and IDT are emulated. VM86 mode is also supported to run
233: DOSEMU. There is some support for MMX/3DNow!, SSE, SSE2, SSE3, SSSE3,
234: and SSE4 as well as x86-64 SVM.
235:
236: </li><li> Support of host page sizes bigger than 4KB in user mode emulation.
237:
238: </li><li> QEMU can emulate itself on x86.
239:
240: </li><li> An extensive Linux x86 CPU test program is included ‘<tt>tests/test-i386</tt>’.
241: It can be used to test other x86 virtual CPUs.
242:
243: </li></ul>
244:
245: <p>Current QEMU limitations:
246: </p>
247: <ul class="toc">
248: <li> Limited x86-64 support.
249:
250: </li><li> IPC syscalls are missing.
251:
252: </li><li> The x86 segment limits and access rights are not tested at every
253: memory access (yet). Hopefully, very few OSes seem to rely on that for
254: normal use.
255:
256: </li></ul>
257:
258: <hr size="6">
259: <a name="intro_005farm_005femulation"></a>
260: <a name="SEC4"></a>
261: <table cellpadding="1" cellspacing="1" border="0">
262: <tr><td valign="middle" align="left">[<a href="#SEC3" title="Previous section in reading order"> < </a>]</td>
263: <td valign="middle" align="left">[<a href="#SEC5" title="Next section in reading order"> > </a>]</td>
264: <td valign="middle" align="left"> </td>
265: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
266: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
267: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
268: <td valign="middle" align="left"> </td>
269: <td valign="middle" align="left"> </td>
270: <td valign="middle" align="left"> </td>
271: <td valign="middle" align="left"> </td>
272: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
273: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
274: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
275: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
276: </tr></table>
277: <h2 class="section"> 1.3 ARM emulation </h2>
278:
279: <ul class="toc">
280: <li> Full ARM 7 user emulation.
281:
282: </li><li> NWFPE FPU support included in user Linux emulation.
283:
284: </li><li> Can run most ARM Linux binaries.
285:
286: </li></ul>
287:
288: <hr size="6">
289: <a name="intro_005fmips_005femulation"></a>
290: <a name="SEC5"></a>
291: <table cellpadding="1" cellspacing="1" border="0">
292: <tr><td valign="middle" align="left">[<a href="#SEC4" title="Previous section in reading order"> < </a>]</td>
293: <td valign="middle" align="left">[<a href="#SEC6" title="Next section in reading order"> > </a>]</td>
294: <td valign="middle" align="left"> </td>
295: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
296: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
297: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
298: <td valign="middle" align="left"> </td>
299: <td valign="middle" align="left"> </td>
300: <td valign="middle" align="left"> </td>
301: <td valign="middle" align="left"> </td>
302: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
303: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
304: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
305: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
306: </tr></table>
307: <h2 class="section"> 1.4 MIPS emulation </h2>
308:
309: <ul class="toc">
310: <li> The system emulation allows full MIPS32/MIPS64 Release 2 emulation,
311: including privileged instructions, FPU and MMU, in both little and big
312: endian modes.
313:
314: </li><li> The Linux userland emulation can run many 32 bit MIPS Linux binaries.
315:
316: </li></ul>
317:
318: <p>Current QEMU limitations:
319: </p>
320: <ul class="toc">
321: <li> Self-modifying code is not always handled correctly.
322:
323: </li><li> 64 bit userland emulation is not implemented.
324:
325: </li><li> The system emulation is not complete enough to run real firmware.
326:
327: </li><li> The watchpoint debug facility is not implemented.
328:
329: </li></ul>
330:
331: <hr size="6">
332: <a name="intro_005fppc_005femulation"></a>
333: <a name="SEC6"></a>
334: <table cellpadding="1" cellspacing="1" border="0">
335: <tr><td valign="middle" align="left">[<a href="#SEC5" title="Previous section in reading order"> < </a>]</td>
336: <td valign="middle" align="left">[<a href="#SEC7" title="Next section in reading order"> > </a>]</td>
337: <td valign="middle" align="left"> </td>
338: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
339: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
340: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
341: <td valign="middle" align="left"> </td>
342: <td valign="middle" align="left"> </td>
343: <td valign="middle" align="left"> </td>
344: <td valign="middle" align="left"> </td>
345: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
346: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
347: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
348: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
349: </tr></table>
350: <h2 class="section"> 1.5 PowerPC emulation </h2>
351:
352: <ul class="toc">
353: <li> Full PowerPC 32 bit emulation, including privileged instructions,
354: FPU and MMU.
355:
356: </li><li> Can run most PowerPC Linux binaries.
357:
358: </li></ul>
359:
360: <hr size="6">
361: <a name="intro_005fsparc_005femulation"></a>
362: <a name="SEC7"></a>
363: <table cellpadding="1" cellspacing="1" border="0">
364: <tr><td valign="middle" align="left">[<a href="#SEC6" title="Previous section in reading order"> < </a>]</td>
365: <td valign="middle" align="left">[<a href="#SEC8" title="Next section in reading order"> > </a>]</td>
366: <td valign="middle" align="left"> </td>
367: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
368: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
369: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
370: <td valign="middle" align="left"> </td>
371: <td valign="middle" align="left"> </td>
372: <td valign="middle" align="left"> </td>
373: <td valign="middle" align="left"> </td>
374: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
375: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
376: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
377: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
378: </tr></table>
379: <h2 class="section"> 1.6 Sparc32 and Sparc64 emulation </h2>
380:
381: <ul class="toc">
382: <li> Full SPARC V8 emulation, including privileged
383: instructions, FPU and MMU. SPARC V9 emulation includes most privileged
384: and VIS instructions, FPU and I/D MMU. Alignment is fully enforced.
385:
386: </li><li> Can run most 32-bit SPARC Linux binaries, SPARC32PLUS Linux binaries and
387: some 64-bit SPARC Linux binaries.
388:
389: </li></ul>
390:
391: <p>Current QEMU limitations:
392: </p>
393: <ul class="toc">
394: <li> IPC syscalls are missing.
395:
396: </li><li> Floating point exception support is buggy.
397:
398: </li><li> Atomic instructions are not correctly implemented.
399:
400: </li><li> There are still some problems with Sparc64 emulators.
401:
402: </li></ul>
403:
404: <hr size="6">
405: <a name="intro_005fother_005femulation"></a>
406: <a name="SEC8"></a>
407: <table cellpadding="1" cellspacing="1" border="0">
408: <tr><td valign="middle" align="left">[<a href="#SEC7" title="Previous section in reading order"> < </a>]</td>
409: <td valign="middle" align="left">[<a href="#SEC9" title="Next section in reading order"> > </a>]</td>
410: <td valign="middle" align="left"> </td>
411: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
412: <td valign="middle" align="left">[<a href="#SEC1" title="Up section"> Up </a>]</td>
413: <td valign="middle" align="left">[<a href="#SEC9" title="Next chapter"> >> </a>]</td>
414: <td valign="middle" align="left"> </td>
415: <td valign="middle" align="left"> </td>
416: <td valign="middle" align="left"> </td>
417: <td valign="middle" align="left"> </td>
418: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
419: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
420: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
421: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
422: </tr></table>
423: <h2 class="section"> 1.7 Other CPU emulation </h2>
424:
425: <p>In addition to the above, QEMU supports emulation of other CPUs with
426: varying levels of success. These are:
427: </p>
428: <ul class="toc">
429: <li>
430: Alpha
431: </li><li>
432: CRIS
433: </li><li>
434: M68k
435: </li><li>
436: SH4
437: </li></ul>
438:
439: <hr size="6">
440: <a name="QEMU-Internals"></a>
441: <a name="SEC9"></a>
442: <table cellpadding="1" cellspacing="1" border="0">
443: <tr><td valign="middle" align="left">[<a href="#SEC8" title="Previous section in reading order"> < </a>]</td>
444: <td valign="middle" align="left">[<a href="#SEC10" title="Next section in reading order"> > </a>]</td>
445: <td valign="middle" align="left"> </td>
446: <td valign="middle" align="left">[<a href="#SEC1" title="Beginning of this chapter or previous chapter"> << </a>]</td>
447: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td>
448: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
449: <td valign="middle" align="left"> </td>
450: <td valign="middle" align="left"> </td>
451: <td valign="middle" align="left"> </td>
452: <td valign="middle" align="left"> </td>
453: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
454: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
455: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
456: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
457: </tr></table>
458: <h1 class="chapter"> 2. QEMU Internals </h1>
459:
460: <table class="menu" border="0" cellspacing="0">
461: <tr><td align="left" valign="top"><a href="#SEC10">2.1 QEMU compared to other emulators</a></td><td> </td><td align="left" valign="top">
462: </td></tr>
463: <tr><td align="left" valign="top"><a href="#SEC11">2.2 Portable dynamic translation</a></td><td> </td><td align="left" valign="top">
464: </td></tr>
465: <tr><td align="left" valign="top"><a href="#SEC12">2.3 Condition code optimisations</a></td><td> </td><td align="left" valign="top">
466: </td></tr>
467: <tr><td align="left" valign="top"><a href="#SEC13">2.4 CPU state optimisations</a></td><td> </td><td align="left" valign="top">
468: </td></tr>
469: <tr><td align="left" valign="top"><a href="#SEC14">2.5 Translation cache</a></td><td> </td><td align="left" valign="top">
470: </td></tr>
471: <tr><td align="left" valign="top"><a href="#SEC15">2.6 Direct block chaining</a></td><td> </td><td align="left" valign="top">
472: </td></tr>
473: <tr><td align="left" valign="top"><a href="#SEC16">2.7 Self-modifying code and translated code invalidation</a></td><td> </td><td align="left" valign="top">
474: </td></tr>
475: <tr><td align="left" valign="top"><a href="#SEC17">2.8 Exception support</a></td><td> </td><td align="left" valign="top">
476: </td></tr>
477: <tr><td align="left" valign="top"><a href="#SEC18">2.9 MMU emulation</a></td><td> </td><td align="left" valign="top">
478: </td></tr>
479: <tr><td align="left" valign="top"><a href="#SEC19">2.10 Device emulation</a></td><td> </td><td align="left" valign="top">
480: </td></tr>
481: <tr><td align="left" valign="top"><a href="#SEC20">2.11 Hardware interrupts</a></td><td> </td><td align="left" valign="top">
482: </td></tr>
483: <tr><td align="left" valign="top"><a href="#SEC21">2.12 User emulation specific details</a></td><td> </td><td align="left" valign="top">
484: </td></tr>
485: <tr><td align="left" valign="top"><a href="#SEC26">2.13 Bibliography</a></td><td> </td><td align="left" valign="top">
486: </td></tr>
487: </table>
488:
489: <hr size="6">
490: <a name="QEMU-compared-to-other-emulators"></a>
491: <a name="SEC10"></a>
492: <table cellpadding="1" cellspacing="1" border="0">
493: <tr><td valign="middle" align="left">[<a href="#SEC9" title="Previous section in reading order"> < </a>]</td>
494: <td valign="middle" align="left">[<a href="#SEC11" title="Next section in reading order"> > </a>]</td>
495: <td valign="middle" align="left"> </td>
496: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
497: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
498: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
499: <td valign="middle" align="left"> </td>
500: <td valign="middle" align="left"> </td>
501: <td valign="middle" align="left"> </td>
502: <td valign="middle" align="left"> </td>
503: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
504: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
505: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
506: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
507: </tr></table>
508: <h2 class="section"> 2.1 QEMU compared to other emulators </h2>
509:
510: <p>Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than
511: bochs as it uses dynamic compilation. Bochs is closely tied to x86 PC
512: emulation while QEMU can emulate several processors.
513: </p>
514: <p>Like Valgrind [2], QEMU does user space emulation and dynamic
515: translation. Valgrind is mainly a memory debugger while QEMU has no
516: support for it (QEMU could be used to detect out of bound memory
517: accesses as Valgrind, but it has no support to track uninitialised data
518: as Valgrind does). The Valgrind dynamic translator generates better code
519: than QEMU (in particular it does register allocation) but it is closely
520: tied to an x86 host and target and has no support for precise exceptions
521: and system emulation.
522: </p>
523: <p>EM86 [4] is the closest project to user space QEMU (and QEMU still uses
524: some of its code, in particular the ELF file loader). EM86 was limited
525: to an alpha host and used a proprietary and slow interpreter (the
526: interpreter part of the FX!32 Digital Win32 code translator [5]).
527: </p>
528: <p>TWIN [6] is a Windows API emulator like Wine. It is less accurate than
529: Wine but includes a protected mode x86 interpreter to launch x86 Windows
530: executables. Such an approach has greater potential because most of the
531: Windows API is executed natively but it is far more difficult to develop
532: because all the data structures and function parameters exchanged
533: between the API and the x86 code must be converted.
534: </p>
535: <p>User mode Linux [7] was the only solution before QEMU to launch a
536: Linux kernel as a process while not needing any host kernel
537: patches. However, user mode Linux requires heavy kernel patches while
538: QEMU accepts unpatched Linux kernels. The price to pay is that QEMU is
539: slower.
540: </p>
541: <p>The Plex86 [8] PC virtualizer is done in the same spirit as the now
542: obsolete qemu-fast system emulator. It requires a patched Linux kernel
543: to work (you cannot launch the same kernel on your PC), but the
544: patches are really small. As it is a PC virtualizer (no emulation is
545: done except for some privileged instructions), it has the potential of
546: being faster than QEMU. The downside is that a complicated (and
547: potentially unsafe) host kernel patch is needed.
548: </p>
549: <p>The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo
550: [11]) are faster than QEMU, but they all need specific, proprietary
551: and potentially unsafe host drivers. Moreover, they are unable to
552: provide cycle exact simulation as an emulator can.
553: </p>
554: <p>VirtualBox [12], Xen [13] and KVM [14] are based on QEMU. QEMU-SystemC
555: [15] uses QEMU to simulate a system where some hardware devices are
556: developed in SystemC.
557: </p>
558: <hr size="6">
559: <a name="Portable-dynamic-translation"></a>
560: <a name="SEC11"></a>
561: <table cellpadding="1" cellspacing="1" border="0">
562: <tr><td valign="middle" align="left">[<a href="#SEC10" title="Previous section in reading order"> < </a>]</td>
563: <td valign="middle" align="left">[<a href="#SEC12" title="Next section in reading order"> > </a>]</td>
564: <td valign="middle" align="left"> </td>
565: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
566: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
567: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
568: <td valign="middle" align="left"> </td>
569: <td valign="middle" align="left"> </td>
570: <td valign="middle" align="left"> </td>
571: <td valign="middle" align="left"> </td>
572: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
573: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
574: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
575: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
576: </tr></table>
577: <h2 class="section"> 2.2 Portable dynamic translation </h2>
578:
579: <p>QEMU is a dynamic translator. When it first encounters a piece of code,
580: it converts it to the host instruction set. Usually dynamic translators
581: are very complicated and highly CPU dependent. QEMU uses some tricks
582: which make it relatively easily portable and simple while achieving good
583: performances.
584: </p>
585: <p>After the release of version 0.9.1, QEMU switched to a new method of
586: generating code, Tiny Code Generator or TCG. TCG relaxes the
587: dependency on the exact version of the compiler used. The basic idea
588: is to split every target instruction into a couple of RISC-like TCG
589: ops (see <code>target-i386/translate.c</code>). Some optimizations can be
590: performed at this stage, including liveness analysis and trivial
591: constant expression evaluation. TCG ops are then implemented in the
592: host CPU back end, also known as TCG target (see
593: <code>tcg/i386/tcg-target.c</code>). For more information, please take a
594: look at <code>tcg/README</code>.
595: </p>
596: <hr size="6">
597: <a name="Condition-code-optimisations"></a>
598: <a name="SEC12"></a>
599: <table cellpadding="1" cellspacing="1" border="0">
600: <tr><td valign="middle" align="left">[<a href="#SEC11" title="Previous section in reading order"> < </a>]</td>
601: <td valign="middle" align="left">[<a href="#SEC13" title="Next section in reading order"> > </a>]</td>
602: <td valign="middle" align="left"> </td>
603: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
604: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
605: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
606: <td valign="middle" align="left"> </td>
607: <td valign="middle" align="left"> </td>
608: <td valign="middle" align="left"> </td>
609: <td valign="middle" align="left"> </td>
610: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
611: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
612: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
613: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
614: </tr></table>
615: <h2 class="section"> 2.3 Condition code optimisations </h2>
616:
617: <p>Lazy evaluation of CPU condition codes (<code>EFLAGS</code> register on x86)
618: is important for CPUs where every instruction sets the condition
619: codes. It tends to be less important on conventional RISC systems
620: where condition codes are only updated when explicitly requested.
621: </p>
622: <p>Instead of computing the condition codes after each x86 instruction,
623: QEMU just stores one operand (called <code>CC_SRC</code>), the result
624: (called <code>CC_DST</code>) and the type of operation (called
625: <code>CC_OP</code>). When the condition codes are needed, the condition
626: codes can be calculated using this information. In addition, an
627: optimized calculation can be performed for some instruction types like
628: conditional branches.
629: </p>
630: <p><code>CC_OP</code> is almost never explicitly set in the generated code
631: because it is known at translation time.
632: </p>
633: <p>The lazy condition code evaluation is used on x86, m68k and cris. ARM
634: uses a simplified variant for the N and Z flags.
635: </p>
636: <hr size="6">
637: <a name="CPU-state-optimisations"></a>
638: <a name="SEC13"></a>
639: <table cellpadding="1" cellspacing="1" border="0">
640: <tr><td valign="middle" align="left">[<a href="#SEC12" title="Previous section in reading order"> < </a>]</td>
641: <td valign="middle" align="left">[<a href="#SEC14" title="Next section in reading order"> > </a>]</td>
642: <td valign="middle" align="left"> </td>
643: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
644: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
645: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
646: <td valign="middle" align="left"> </td>
647: <td valign="middle" align="left"> </td>
648: <td valign="middle" align="left"> </td>
649: <td valign="middle" align="left"> </td>
650: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
651: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
652: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
653: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
654: </tr></table>
655: <h2 class="section"> 2.4 CPU state optimisations </h2>
656:
657: <p>The target CPUs have many internal states which change the way it
658: evaluates instructions. In order to achieve a good speed, the
659: translation phase considers that some state information of the virtual
660: CPU cannot change in it. The state is recorded in the Translation
661: Block (TB). If the state changes (e.g. privilege level), a new TB will
662: be generated and the previous TB won't be used anymore until the state
663: matches the state recorded in the previous TB. For example, if the SS,
664: DS and ES segments have a zero base, then the translator does not even
665: generate an addition for the segment base.
666: </p>
667: <p>[The FPU stack pointer register is not handled that way yet].
668: </p>
669: <hr size="6">
670: <a name="Translation-cache"></a>
671: <a name="SEC14"></a>
672: <table cellpadding="1" cellspacing="1" border="0">
673: <tr><td valign="middle" align="left">[<a href="#SEC13" title="Previous section in reading order"> < </a>]</td>
674: <td valign="middle" align="left">[<a href="#SEC15" title="Next section in reading order"> > </a>]</td>
675: <td valign="middle" align="left"> </td>
676: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
677: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
678: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
679: <td valign="middle" align="left"> </td>
680: <td valign="middle" align="left"> </td>
681: <td valign="middle" align="left"> </td>
682: <td valign="middle" align="left"> </td>
683: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
684: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
685: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
686: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
687: </tr></table>
688: <h2 class="section"> 2.5 Translation cache </h2>
689:
690: <p>A 16 MByte cache holds the most recently used translations. For
691: simplicity, it is completely flushed when it is full. A translation unit
692: contains just a single basic block (a block of x86 instructions
693: terminated by a jump or by a virtual CPU state change which the
694: translator cannot deduce statically).
695: </p>
696: <hr size="6">
697: <a name="Direct-block-chaining"></a>
698: <a name="SEC15"></a>
699: <table cellpadding="1" cellspacing="1" border="0">
700: <tr><td valign="middle" align="left">[<a href="#SEC14" title="Previous section in reading order"> < </a>]</td>
701: <td valign="middle" align="left">[<a href="#SEC16" title="Next section in reading order"> > </a>]</td>
702: <td valign="middle" align="left"> </td>
703: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
704: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
705: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
706: <td valign="middle" align="left"> </td>
707: <td valign="middle" align="left"> </td>
708: <td valign="middle" align="left"> </td>
709: <td valign="middle" align="left"> </td>
710: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
711: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
712: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
713: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
714: </tr></table>
715: <h2 class="section"> 2.6 Direct block chaining </h2>
716:
717: <p>After each translated basic block is executed, QEMU uses the simulated
718: Program Counter (PC) and other cpu state informations (such as the CS
719: segment base value) to find the next basic block.
720: </p>
721: <p>In order to accelerate the most common cases where the new simulated PC
722: is known, QEMU can patch a basic block so that it jumps directly to the
723: next one.
724: </p>
725: <p>The most portable code uses an indirect jump. An indirect jump makes
726: it easier to make the jump target modification atomic. On some host
727: architectures (such as x86 or PowerPC), the <code>JUMP</code> opcode is
728: directly patched so that the block chaining has no overhead.
729: </p>
730: <hr size="6">
731: <a name="Self_002dmodifying-code-and-translated-code-invalidation"></a>
732: <a name="SEC16"></a>
733: <table cellpadding="1" cellspacing="1" border="0">
734: <tr><td valign="middle" align="left">[<a href="#SEC15" title="Previous section in reading order"> < </a>]</td>
735: <td valign="middle" align="left">[<a href="#SEC17" title="Next section in reading order"> > </a>]</td>
736: <td valign="middle" align="left"> </td>
737: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
738: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
739: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
740: <td valign="middle" align="left"> </td>
741: <td valign="middle" align="left"> </td>
742: <td valign="middle" align="left"> </td>
743: <td valign="middle" align="left"> </td>
744: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
745: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
746: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
747: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
748: </tr></table>
749: <h2 class="section"> 2.7 Self-modifying code and translated code invalidation </h2>
750:
751: <p>Self-modifying code is a special challenge in x86 emulation because no
752: instruction cache invalidation is signaled by the application when code
753: is modified.
754: </p>
755: <p>When translated code is generated for a basic block, the corresponding
756: host page is write protected if it is not already read-only. Then, if
757: a write access is done to the page, Linux raises a SEGV signal. QEMU
758: then invalidates all the translated code in the page and enables write
759: accesses to the page.
760: </p>
761: <p>Correct translated code invalidation is done efficiently by maintaining
762: a linked list of every translated block contained in a given page. Other
763: linked lists are also maintained to undo direct block chaining.
764: </p>
765: <p>On RISC targets, correctly written software uses memory barriers and
766: cache flushes, so some of the protection above would not be
767: necessary. However, QEMU still requires that the generated code always
768: matches the target instructions in memory in order to handle
769: exceptions correctly.
770: </p>
771: <hr size="6">
772: <a name="Exception-support"></a>
773: <a name="SEC17"></a>
774: <table cellpadding="1" cellspacing="1" border="0">
775: <tr><td valign="middle" align="left">[<a href="#SEC16" title="Previous section in reading order"> < </a>]</td>
776: <td valign="middle" align="left">[<a href="#SEC18" title="Next section in reading order"> > </a>]</td>
777: <td valign="middle" align="left"> </td>
778: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
779: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
780: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
781: <td valign="middle" align="left"> </td>
782: <td valign="middle" align="left"> </td>
783: <td valign="middle" align="left"> </td>
784: <td valign="middle" align="left"> </td>
785: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
786: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
787: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
788: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
789: </tr></table>
790: <h2 class="section"> 2.8 Exception support </h2>
791:
792: <p>longjmp() is used when an exception such as division by zero is
793: encountered.
794: </p>
795: <p>The host SIGSEGV and SIGBUS signal handlers are used to get invalid
796: memory accesses. The simulated program counter is found by
797: retranslating the corresponding basic block and by looking where the
798: host program counter was at the exception point.
799: </p>
800: <p>The virtual CPU cannot retrieve the exact <code>EFLAGS</code> register because
801: in some cases it is not computed because of condition code
802: optimisations. It is not a big concern because the emulated code can
803: still be restarted in any cases.
804: </p>
805: <hr size="6">
806: <a name="MMU-emulation"></a>
807: <a name="SEC18"></a>
808: <table cellpadding="1" cellspacing="1" border="0">
809: <tr><td valign="middle" align="left">[<a href="#SEC17" title="Previous section in reading order"> < </a>]</td>
810: <td valign="middle" align="left">[<a href="#SEC19" title="Next section in reading order"> > </a>]</td>
811: <td valign="middle" align="left"> </td>
812: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
813: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
814: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
815: <td valign="middle" align="left"> </td>
816: <td valign="middle" align="left"> </td>
817: <td valign="middle" align="left"> </td>
818: <td valign="middle" align="left"> </td>
819: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
820: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
821: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
822: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
823: </tr></table>
824: <h2 class="section"> 2.9 MMU emulation </h2>
825:
826: <p>For system emulation QEMU supports a soft MMU. In that mode, the MMU
827: virtual to physical address translation is done at every memory
828: access. QEMU uses an address translation cache to speed up the
829: translation.
830: </p>
831: <p>In order to avoid flushing the translated code each time the MMU
832: mappings change, QEMU uses a physically indexed translation cache. It
833: means that each basic block is indexed with its physical address.
834: </p>
835: <p>When MMU mappings change, only the chaining of the basic blocks is
836: reset (i.e. a basic block can no longer jump directly to another one).
837: </p>
838: <hr size="6">
839: <a name="Device-emulation"></a>
840: <a name="SEC19"></a>
841: <table cellpadding="1" cellspacing="1" border="0">
842: <tr><td valign="middle" align="left">[<a href="#SEC18" title="Previous section in reading order"> < </a>]</td>
843: <td valign="middle" align="left">[<a href="#SEC20" title="Next section in reading order"> > </a>]</td>
844: <td valign="middle" align="left"> </td>
845: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
846: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
847: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
848: <td valign="middle" align="left"> </td>
849: <td valign="middle" align="left"> </td>
850: <td valign="middle" align="left"> </td>
851: <td valign="middle" align="left"> </td>
852: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
853: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
854: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
855: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
856: </tr></table>
857: <h2 class="section"> 2.10 Device emulation </h2>
858:
859: <p>Systems emulated by QEMU are organized by boards. At initialization
860: phase, each board instantiates a number of CPUs, devices, RAM and
861: ROM. Each device in turn can assign I/O ports or memory areas (for
862: MMIO) to its handlers. When the emulation starts, an access to the
863: ports or MMIO memory areas assigned to the device causes the
864: corresponding handler to be called.
865: </p>
866: <p>RAM and ROM are handled more optimally, only the offset to the host
867: memory needs to be added to the guest address.
868: </p>
869: <p>The video RAM of VGA and other display cards is special: it can be
870: read or written directly like RAM, but write accesses cause the memory
871: to be marked with VGA_DIRTY flag as well.
872: </p>
873: <p>QEMU supports some device classes like serial and parallel ports, USB,
874: drives and network devices, by providing APIs for easier connection to
875: the generic, higher level implementations. The API hides the
876: implementation details from the devices, like native device use or
877: advanced block device formats like QCOW.
878: </p>
879: <p>Usually the devices implement a reset method and register support for
880: saving and loading of the device state. The devices can also use
881: timers, especially together with the use of bottom halves (BHs).
882: </p>
883: <hr size="6">
884: <a name="Hardware-interrupts"></a>
885: <a name="SEC20"></a>
886: <table cellpadding="1" cellspacing="1" border="0">
887: <tr><td valign="middle" align="left">[<a href="#SEC19" title="Previous section in reading order"> < </a>]</td>
888: <td valign="middle" align="left">[<a href="#SEC21" title="Next section in reading order"> > </a>]</td>
889: <td valign="middle" align="left"> </td>
890: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
891: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
892: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
893: <td valign="middle" align="left"> </td>
894: <td valign="middle" align="left"> </td>
895: <td valign="middle" align="left"> </td>
896: <td valign="middle" align="left"> </td>
897: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
898: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
899: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
900: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
901: </tr></table>
902: <h2 class="section"> 2.11 Hardware interrupts </h2>
903:
904: <p>In order to be faster, QEMU does not check at every basic block if an
905: hardware interrupt is pending. Instead, the user must asynchrously
906: call a specific function to tell that an interrupt is pending. This
907: function resets the chaining of the currently executing basic
908: block. It ensures that the execution will return soon in the main loop
909: of the CPU emulator. Then the main loop can test if the interrupt is
910: pending and handle it.
911: </p>
912: <hr size="6">
913: <a name="User-emulation-specific-details"></a>
914: <a name="SEC21"></a>
915: <table cellpadding="1" cellspacing="1" border="0">
916: <tr><td valign="middle" align="left">[<a href="#SEC20" title="Previous section in reading order"> < </a>]</td>
917: <td valign="middle" align="left">[<a href="#SEC22" title="Next section in reading order"> > </a>]</td>
918: <td valign="middle" align="left"> </td>
919: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
920: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
921: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
922: <td valign="middle" align="left"> </td>
923: <td valign="middle" align="left"> </td>
924: <td valign="middle" align="left"> </td>
925: <td valign="middle" align="left"> </td>
926: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
927: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
928: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
929: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
930: </tr></table>
931: <h2 class="section"> 2.12 User emulation specific details </h2>
932:
933: <hr size="6">
934: <a name="SEC22"></a>
935: <table cellpadding="1" cellspacing="1" border="0">
936: <tr><td valign="middle" align="left">[<a href="#SEC21" title="Previous section in reading order"> < </a>]</td>
937: <td valign="middle" align="left">[<a href="#SEC23" title="Next section in reading order"> > </a>]</td>
938: <td valign="middle" align="left"> </td>
939: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
940: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td>
941: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
942: <td valign="middle" align="left"> </td>
943: <td valign="middle" align="left"> </td>
944: <td valign="middle" align="left"> </td>
945: <td valign="middle" align="left"> </td>
946: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
947: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
948: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
949: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
950: </tr></table>
951: <h3 class="subsection"> 2.12.1 Linux system call translation </h3>
952:
953: <p>QEMU includes a generic system call translator for Linux. It means that
954: the parameters of the system calls can be converted to fix the
955: endianness and 32/64 bit issues. The IOCTLs are converted with a generic
956: type description system (see ‘<tt>ioctls.h</tt>’ and ‘<tt>thunk.c</tt>’).
957: </p>
958: <p>QEMU supports host CPUs which have pages bigger than 4KB. It records all
959: the mappings the process does and try to emulated the <code>mmap()</code>
960: system calls in cases where the host <code>mmap()</code> call would fail
961: because of bad page alignment.
962: </p>
963: <hr size="6">
964: <a name="SEC23"></a>
965: <table cellpadding="1" cellspacing="1" border="0">
966: <tr><td valign="middle" align="left">[<a href="#SEC22" title="Previous section in reading order"> < </a>]</td>
967: <td valign="middle" align="left">[<a href="#SEC24" title="Next section in reading order"> > </a>]</td>
968: <td valign="middle" align="left"> </td>
969: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
970: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td>
971: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
972: <td valign="middle" align="left"> </td>
973: <td valign="middle" align="left"> </td>
974: <td valign="middle" align="left"> </td>
975: <td valign="middle" align="left"> </td>
976: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
977: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
978: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
979: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
980: </tr></table>
981: <h3 class="subsection"> 2.12.2 Linux signals </h3>
982:
983: <p>Normal and real-time signals are queued along with their information
984: (<code>siginfo_t</code>) as it is done in the Linux kernel. Then an interrupt
985: request is done to the virtual CPU. When it is interrupted, one queued
986: signal is handled by generating a stack frame in the virtual CPU as the
987: Linux kernel does. The <code>sigreturn()</code> system call is emulated to return
988: from the virtual signal handler.
989: </p>
990: <p>Some signals (such as SIGALRM) directly come from the host. Other
991: signals are synthetized from the virtual CPU exceptions such as SIGFPE
992: when a division by zero is done (see <code>main.c:cpu_loop()</code>).
993: </p>
994: <p>The blocked signal mask is still handled by the host Linux kernel so
995: that most signal system calls can be redirected directly to the host
996: Linux kernel. Only the <code>sigaction()</code> and <code>sigreturn()</code> system
997: calls need to be fully emulated (see ‘<tt>signal.c</tt>’).
998: </p>
999: <hr size="6">
1000: <a name="SEC24"></a>
1001: <table cellpadding="1" cellspacing="1" border="0">
1002: <tr><td valign="middle" align="left">[<a href="#SEC23" title="Previous section in reading order"> < </a>]</td>
1003: <td valign="middle" align="left">[<a href="#SEC25" title="Next section in reading order"> > </a>]</td>
1004: <td valign="middle" align="left"> </td>
1005: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1006: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td>
1007: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
1008: <td valign="middle" align="left"> </td>
1009: <td valign="middle" align="left"> </td>
1010: <td valign="middle" align="left"> </td>
1011: <td valign="middle" align="left"> </td>
1012: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1013: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1014: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1015: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1016: </tr></table>
1017: <h3 class="subsection"> 2.12.3 clone() system call and threads </h3>
1018:
1019: <p>The Linux clone() system call is usually used to create a thread. QEMU
1020: uses the host clone() system call so that real host threads are created
1021: for each emulated thread. One virtual CPU instance is created for each
1022: thread.
1023: </p>
1024: <p>The virtual x86 CPU atomic operations are emulated with a global lock so
1025: that their semantic is preserved.
1026: </p>
1027: <p>Note that currently there are still some locking issues in QEMU. In
1028: particular, the translated cache flush is not protected yet against
1029: reentrancy.
1030: </p>
1031: <hr size="6">
1032: <a name="SEC25"></a>
1033: <table cellpadding="1" cellspacing="1" border="0">
1034: <tr><td valign="middle" align="left">[<a href="#SEC24" title="Previous section in reading order"> < </a>]</td>
1035: <td valign="middle" align="left">[<a href="#SEC26" title="Next section in reading order"> > </a>]</td>
1036: <td valign="middle" align="left"> </td>
1037: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1038: <td valign="middle" align="left">[<a href="#SEC21" title="Up section"> Up </a>]</td>
1039: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
1040: <td valign="middle" align="left"> </td>
1041: <td valign="middle" align="left"> </td>
1042: <td valign="middle" align="left"> </td>
1043: <td valign="middle" align="left"> </td>
1044: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1045: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1046: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1047: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1048: </tr></table>
1049: <h3 class="subsection"> 2.12.4 Self-virtualization </h3>
1050:
1051: <p>QEMU was conceived so that ultimately it can emulate itself. Although
1052: it is not very useful, it is an important test to show the power of the
1053: emulator.
1054: </p>
1055: <p>Achieving self-virtualization is not easy because there may be address
1056: space conflicts. QEMU user emulators solve this problem by being an
1057: executable ELF shared object as the ld-linux.so ELF interpreter. That
1058: way, it can be relocated at load time.
1059: </p>
1060: <hr size="6">
1061: <a name="Bibliography"></a>
1062: <a name="SEC26"></a>
1063: <table cellpadding="1" cellspacing="1" border="0">
1064: <tr><td valign="middle" align="left">[<a href="#SEC25" title="Previous section in reading order"> < </a>]</td>
1065: <td valign="middle" align="left">[<a href="#SEC27" title="Next section in reading order"> > </a>]</td>
1066: <td valign="middle" align="left"> </td>
1067: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1068: <td valign="middle" align="left">[<a href="#SEC9" title="Up section"> Up </a>]</td>
1069: <td valign="middle" align="left">[<a href="#SEC27" title="Next chapter"> >> </a>]</td>
1070: <td valign="middle" align="left"> </td>
1071: <td valign="middle" align="left"> </td>
1072: <td valign="middle" align="left"> </td>
1073: <td valign="middle" align="left"> </td>
1074: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1075: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1076: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1077: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1078: </tr></table>
1079: <h2 class="section"> 2.13 Bibliography </h2>
1080:
1081: <dl compact="compact">
1082: <dt> [1]</dt>
1083: <dd><p><a href="http://citeseer.nj.nec.com/piumarta98optimizing.html">http://citeseer.nj.nec.com/piumarta98optimizing.html</a>, Optimizing
1084: direct threaded code by selective inlining (1998) by Ian Piumarta, Fabio
1085: Riccardi.
1086: </p>
1087: </dd>
1088: <dt> [2]</dt>
1089: <dd><p><a href="http://developer.kde.org/~sewardj/">http://developer.kde.org/~sewardj/</a>, Valgrind, an open-source
1090: memory debugger for x86-GNU/Linux, by Julian Seward.
1091: </p>
1092: </dd>
1093: <dt> [3]</dt>
1094: <dd><p><a href="http://bochs.sourceforge.net/">http://bochs.sourceforge.net/</a>, the Bochs IA-32 Emulator Project,
1095: by Kevin Lawton et al.
1096: </p>
1097: </dd>
1098: <dt> [4]</dt>
1099: <dd><p><a href="http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html">http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html</a>, the EM86
1100: x86 emulator on Alpha-Linux.
1101: </p>
1102: </dd>
1103: <dt> [5]</dt>
1104: <dd><p><a href="http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf">http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf</a>,
1105: DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton
1106: Chernoff and Ray Hookway.
1107: </p>
1108: </dd>
1109: <dt> [6]</dt>
1110: <dd><p><a href="http://www.willows.com/">http://www.willows.com/</a>, Windows API library emulation from
1111: Willows Software.
1112: </p>
1113: </dd>
1114: <dt> [7]</dt>
1115: <dd><p><a href="http://user-mode-linux.sourceforge.net/">http://user-mode-linux.sourceforge.net/</a>,
1116: The User-mode Linux Kernel.
1117: </p>
1118: </dd>
1119: <dt> [8]</dt>
1120: <dd><p><a href="http://www.plex86.org/">http://www.plex86.org/</a>,
1121: The new Plex86 project.
1122: </p>
1123: </dd>
1124: <dt> [9]</dt>
1125: <dd><p><a href="http://www.vmware.com/">http://www.vmware.com/</a>,
1126: The VMWare PC virtualizer.
1127: </p>
1128: </dd>
1129: <dt> [10]</dt>
1130: <dd><p><a href="http://www.microsoft.com/windowsxp/virtualpc/">http://www.microsoft.com/windowsxp/virtualpc/</a>,
1131: The VirtualPC PC virtualizer.
1132: </p>
1133: </dd>
1134: <dt> [11]</dt>
1135: <dd><p><a href="http://www.twoostwo.org/">http://www.twoostwo.org/</a>,
1136: The TwoOStwo PC virtualizer.
1137: </p>
1138: </dd>
1139: <dt> [12]</dt>
1140: <dd><p><a href="http://virtualbox.org/">http://virtualbox.org/</a>,
1141: The VirtualBox PC virtualizer.
1142: </p>
1143: </dd>
1144: <dt> [13]</dt>
1145: <dd><p><a href="http://www.xen.org/">http://www.xen.org/</a>,
1146: The Xen hypervisor.
1147: </p>
1148: </dd>
1149: <dt> [14]</dt>
1150: <dd><p><a href="http://kvm.qumranet.com/kvmwiki/Front_Page">http://kvm.qumranet.com/kvmwiki/Front_Page</a>,
1151: Kernel Based Virtual Machine (KVM).
1152: </p>
1153: </dd>
1154: <dt> [15]</dt>
1155: <dd><p><a href="http://www.greensocs.com/projects/QEMUSystemC">http://www.greensocs.com/projects/QEMUSystemC</a>,
1156: QEMU-SystemC, a hardware co-simulator.
1157: </p>
1158: </dd>
1159: </dl>
1160:
1161: <hr size="6">
1162: <a name="Regression-Tests"></a>
1163: <a name="SEC27"></a>
1164: <table cellpadding="1" cellspacing="1" border="0">
1165: <tr><td valign="middle" align="left">[<a href="#SEC26" title="Previous section in reading order"> < </a>]</td>
1166: <td valign="middle" align="left">[<a href="#SEC28" title="Next section in reading order"> > </a>]</td>
1167: <td valign="middle" align="left"> </td>
1168: <td valign="middle" align="left">[<a href="#SEC9" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1169: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td>
1170: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td>
1171: <td valign="middle" align="left"> </td>
1172: <td valign="middle" align="left"> </td>
1173: <td valign="middle" align="left"> </td>
1174: <td valign="middle" align="left"> </td>
1175: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1176: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1177: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1178: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1179: </tr></table>
1180: <h1 class="chapter"> 3. Regression Tests </h1>
1181:
1182: <p>In the directory ‘<tt>tests/</tt>’, various interesting testing programs
1183: are available. They are used for regression testing.
1184: </p>
1185: <table class="menu" border="0" cellspacing="0">
1186: <tr><td align="left" valign="top"><a href="#SEC28">3.1 ‘<tt>test-i386</tt>’</a></td><td> </td><td align="left" valign="top">
1187: </td></tr>
1188: <tr><td align="left" valign="top"><a href="#SEC29">3.2 ‘<tt>linux-test</tt>’</a></td><td> </td><td align="left" valign="top">
1189: </td></tr>
1190: <tr><td align="left" valign="top"><a href="#SEC30">3.3 ‘<tt>qruncom.c</tt>’</a></td><td> </td><td align="left" valign="top">
1191: </td></tr>
1192: </table>
1193:
1194: <hr size="6">
1195: <a name="test_002di386"></a>
1196: <a name="SEC28"></a>
1197: <table cellpadding="1" cellspacing="1" border="0">
1198: <tr><td valign="middle" align="left">[<a href="#SEC27" title="Previous section in reading order"> < </a>]</td>
1199: <td valign="middle" align="left">[<a href="#SEC29" title="Next section in reading order"> > </a>]</td>
1200: <td valign="middle" align="left"> </td>
1201: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1202: <td valign="middle" align="left">[<a href="#SEC27" title="Up section"> Up </a>]</td>
1203: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td>
1204: <td valign="middle" align="left"> </td>
1205: <td valign="middle" align="left"> </td>
1206: <td valign="middle" align="left"> </td>
1207: <td valign="middle" align="left"> </td>
1208: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1209: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1210: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1211: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1212: </tr></table>
1213: <h2 class="section"> 3.1 ‘<tt>test-i386</tt>’ </h2>
1214:
1215: <p>This program executes most of the 16 bit and 32 bit x86 instructions and
1216: generates a text output. It can be compared with the output obtained with
1217: a real CPU or another emulator. The target <code>make test</code> runs this
1218: program and a <code>diff</code> on the generated output.
1219: </p>
1220: <p>The Linux system call <code>modify_ldt()</code> is used to create x86 selectors
1221: to test some 16 bit addressing and 32 bit with segmentation cases.
1222: </p>
1223: <p>The Linux system call <code>vm86()</code> is used to test vm86 emulation.
1224: </p>
1225: <p>Various exceptions are raised to test most of the x86 user space
1226: exception reporting.
1227: </p>
1228: <hr size="6">
1229: <a name="linux_002dtest"></a>
1230: <a name="SEC29"></a>
1231: <table cellpadding="1" cellspacing="1" border="0">
1232: <tr><td valign="middle" align="left">[<a href="#SEC28" title="Previous section in reading order"> < </a>]</td>
1233: <td valign="middle" align="left">[<a href="#SEC30" title="Next section in reading order"> > </a>]</td>
1234: <td valign="middle" align="left"> </td>
1235: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1236: <td valign="middle" align="left">[<a href="#SEC27" title="Up section"> Up </a>]</td>
1237: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td>
1238: <td valign="middle" align="left"> </td>
1239: <td valign="middle" align="left"> </td>
1240: <td valign="middle" align="left"> </td>
1241: <td valign="middle" align="left"> </td>
1242: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1243: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1244: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1245: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1246: </tr></table>
1247: <h2 class="section"> 3.2 ‘<tt>linux-test</tt>’ </h2>
1248:
1249: <p>This program tests various Linux system calls. It is used to verify
1250: that the system call parameters are correctly converted between target
1251: and host CPUs.
1252: </p>
1253: <hr size="6">
1254: <a name="qruncom_002ec"></a>
1255: <a name="SEC30"></a>
1256: <table cellpadding="1" cellspacing="1" border="0">
1257: <tr><td valign="middle" align="left">[<a href="#SEC29" title="Previous section in reading order"> < </a>]</td>
1258: <td valign="middle" align="left">[<a href="#SEC31" title="Next section in reading order"> > </a>]</td>
1259: <td valign="middle" align="left"> </td>
1260: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1261: <td valign="middle" align="left">[<a href="#SEC27" title="Up section"> Up </a>]</td>
1262: <td valign="middle" align="left">[<a href="#SEC31" title="Next chapter"> >> </a>]</td>
1263: <td valign="middle" align="left"> </td>
1264: <td valign="middle" align="left"> </td>
1265: <td valign="middle" align="left"> </td>
1266: <td valign="middle" align="left"> </td>
1267: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1268: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1269: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1270: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1271: </tr></table>
1272: <h2 class="section"> 3.3 ‘<tt>qruncom.c</tt>’ </h2>
1273:
1274: <p>Example of usage of <code>libqemu</code> to emulate a user mode i386 CPU.
1275: </p>
1276: <hr size="6">
1277: <a name="Index"></a>
1278: <a name="SEC31"></a>
1279: <table cellpadding="1" cellspacing="1" border="0">
1280: <tr><td valign="middle" align="left">[<a href="#SEC30" title="Previous section in reading order"> < </a>]</td>
1281: <td valign="middle" align="left">[ > ]</td>
1282: <td valign="middle" align="left"> </td>
1283: <td valign="middle" align="left">[<a href="#SEC27" title="Beginning of this chapter or previous chapter"> << </a>]</td>
1284: <td valign="middle" align="left">[<a href="#SEC_Top" title="Up section"> Up </a>]</td>
1285: <td valign="middle" align="left">[ >> ]</td>
1286: <td valign="middle" align="left"> </td>
1287: <td valign="middle" align="left"> </td>
1288: <td valign="middle" align="left"> </td>
1289: <td valign="middle" align="left"> </td>
1290: <td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1291: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1292: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1293: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1294: </tr></table>
1295: <h1 class="chapter"> 4. Index </h1>
1296:
1297: <hr size="6">
1298: <a name="SEC_Contents"></a>
1299: <table cellpadding="1" cellspacing="1" border="0">
1300: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1301: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1302: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1303: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1304: </tr></table>
1305: <h1>Table of Contents</h1>
1306: <div class="contents">
1307:
1308: <ul class="toc">
1309: <li><a name="TOC1" href="#SEC1">1. Introduction</a>
1310: <ul class="toc">
1311: <li><a name="TOC2" href="#SEC2">1.1 Features</a></li>
1312: <li><a name="TOC3" href="#SEC3">1.2 x86 and x86-64 emulation</a></li>
1313: <li><a name="TOC4" href="#SEC4">1.3 ARM emulation</a></li>
1314: <li><a name="TOC5" href="#SEC5">1.4 MIPS emulation</a></li>
1315: <li><a name="TOC6" href="#SEC6">1.5 PowerPC emulation</a></li>
1316: <li><a name="TOC7" href="#SEC7">1.6 Sparc32 and Sparc64 emulation</a></li>
1317: <li><a name="TOC8" href="#SEC8">1.7 Other CPU emulation</a></li>
1318: </ul></li>
1319: <li><a name="TOC9" href="#SEC9">2. QEMU Internals</a>
1320: <ul class="toc">
1321: <li><a name="TOC10" href="#SEC10">2.1 QEMU compared to other emulators</a></li>
1322: <li><a name="TOC11" href="#SEC11">2.2 Portable dynamic translation</a></li>
1323: <li><a name="TOC12" href="#SEC12">2.3 Condition code optimisations</a></li>
1324: <li><a name="TOC13" href="#SEC13">2.4 CPU state optimisations</a></li>
1325: <li><a name="TOC14" href="#SEC14">2.5 Translation cache</a></li>
1326: <li><a name="TOC15" href="#SEC15">2.6 Direct block chaining</a></li>
1327: <li><a name="TOC16" href="#SEC16">2.7 Self-modifying code and translated code invalidation</a></li>
1328: <li><a name="TOC17" href="#SEC17">2.8 Exception support</a></li>
1329: <li><a name="TOC18" href="#SEC18">2.9 MMU emulation</a></li>
1330: <li><a name="TOC19" href="#SEC19">2.10 Device emulation</a></li>
1331: <li><a name="TOC20" href="#SEC20">2.11 Hardware interrupts</a></li>
1332: <li><a name="TOC21" href="#SEC21">2.12 User emulation specific details</a>
1333: <ul class="toc">
1334: <li><a name="TOC22" href="#SEC22">2.12.1 Linux system call translation</a></li>
1335: <li><a name="TOC23" href="#SEC23">2.12.2 Linux signals</a></li>
1336: <li><a name="TOC24" href="#SEC24">2.12.3 clone() system call and threads</a></li>
1337: <li><a name="TOC25" href="#SEC25">2.12.4 Self-virtualization</a></li>
1338: </ul></li>
1339: <li><a name="TOC26" href="#SEC26">2.13 Bibliography</a></li>
1340: </ul></li>
1341: <li><a name="TOC27" href="#SEC27">3. Regression Tests</a>
1342: <ul class="toc">
1343: <li><a name="TOC28" href="#SEC28">3.1 ‘<tt>test-i386</tt>’</a></li>
1344: <li><a name="TOC29" href="#SEC29">3.2 ‘<tt>linux-test</tt>’</a></li>
1345: <li><a name="TOC30" href="#SEC30">3.3 ‘<tt>qruncom.c</tt>’</a></li>
1346: </ul></li>
1347: <li><a name="TOC31" href="#SEC31">4. Index</a></li>
1348: </ul>
1349: </div>
1350: <hr size="1">
1351: <a name="SEC_About"></a>
1352: <table cellpadding="1" cellspacing="1" border="0">
1353: <tr><td valign="middle" align="left">[<a href="#SEC_Top" title="Cover (top) of document">Top</a>]</td>
1354: <td valign="middle" align="left">[<a href="#SEC_Contents" title="Table of contents">Contents</a>]</td>
1355: <td valign="middle" align="left">[<a href="#SEC31" title="Index">Index</a>]</td>
1356: <td valign="middle" align="left">[<a href="#SEC_About" title="About (help)"> ? </a>]</td>
1357: </tr></table>
1358: <h1>About This Document</h1>
1359: <p>
1360: This document was generated by <em>Anthony Liguori</em> on <em>May, 1 2009</em> using <a href="http://www.nongnu.org/texi2html/"><em>texi2html 1.78</em></a>.
1361: </p>
1362: <p>
1363: The buttons in the navigation panels have the following meaning:
1364: </p>
1365: <table border="1">
1366: <tr>
1367: <th> Button </th>
1368: <th> Name </th>
1369: <th> Go to </th>
1370: <th> From 1.2.3 go to</th>
1371: </tr>
1372: <tr>
1373: <td align="center"> [ < ] </td>
1374: <td align="center">Back</td>
1375: <td>Previous section in reading order</td>
1376: <td>1.2.2</td>
1377: </tr>
1378: <tr>
1379: <td align="center"> [ > ] </td>
1380: <td align="center">Forward</td>
1381: <td>Next section in reading order</td>
1382: <td>1.2.4</td>
1383: </tr>
1384: <tr>
1385: <td align="center"> [ << ] </td>
1386: <td align="center">FastBack</td>
1387: <td>Beginning of this chapter or previous chapter</td>
1388: <td>1</td>
1389: </tr>
1390: <tr>
1391: <td align="center"> [ Up ] </td>
1392: <td align="center">Up</td>
1393: <td>Up section</td>
1394: <td>1.2</td>
1395: </tr>
1396: <tr>
1397: <td align="center"> [ >> ] </td>
1398: <td align="center">FastForward</td>
1399: <td>Next chapter</td>
1400: <td>2</td>
1401: </tr>
1402: <tr>
1403: <td align="center"> [Top] </td>
1404: <td align="center">Top</td>
1405: <td>Cover (top) of document</td>
1406: <td> </td>
1407: </tr>
1408: <tr>
1409: <td align="center"> [Contents] </td>
1410: <td align="center">Contents</td>
1411: <td>Table of contents</td>
1412: <td> </td>
1413: </tr>
1414: <tr>
1415: <td align="center"> [Index] </td>
1416: <td align="center">Index</td>
1417: <td>Index</td>
1418: <td> </td>
1419: </tr>
1420: <tr>
1421: <td align="center"> [ ? ] </td>
1422: <td align="center">About</td>
1423: <td>About (help)</td>
1424: <td> </td>
1425: </tr>
1426: </table>
1427:
1428: <p>
1429: where the <strong> Example </strong> assumes that the current position is at <strong> Subsubsection One-Two-Three </strong> of a document of the following structure:
1430: </p>
1431:
1432: <ul>
1433: <li> 1. Section One
1434: <ul>
1435: <li>1.1 Subsection One-One
1436: <ul>
1437: <li>...</li>
1438: </ul>
1439: </li>
1440: <li>1.2 Subsection One-Two
1441: <ul>
1442: <li>1.2.1 Subsubsection One-Two-One</li>
1443: <li>1.2.2 Subsubsection One-Two-Two</li>
1444: <li>1.2.3 Subsubsection One-Two-Three
1445: <strong><== Current Position </strong></li>
1446: <li>1.2.4 Subsubsection One-Two-Four</li>
1447: </ul>
1448: </li>
1449: <li>1.3 Subsection One-Three
1450: <ul>
1451: <li>...</li>
1452: </ul>
1453: </li>
1454: <li>1.4 Subsection One-Four</li>
1455: </ul>
1456: </li>
1457: </ul>
1458:
1459: <hr size="1">
1460: <p>
1461: <font size="-1">
1462: This document was generated by <em>Anthony Liguori</em> on <em>May, 1 2009</em> using <a href="http://www.nongnu.org/texi2html/"><em>texi2html 1.78</em></a>.
1463: </font>
1464: <br>
1465:
1466: </p>
1467: </body>
1468: </html>
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.