Download as PDF, PPTX
![Traditional CPU Emulation Approach
Fetch target pc(0x50000):40008800
instruction
Decode
Opcode : 0x10 (add), rt:0, ra:1, rb:2
switch(opcode)
Look up instruction case add :
function table add(rt, ra, rb)
break;
void add(int rt, int ra, int rb) {
Execution env->gpr[rt] = env->gpr[ra] +
env->gpr[rb];
}](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-14-2048.jpg)
![Performance Issues (1/3)
Functional call overhead
void add(int rt, int ra, int rb) {
env->gpr[rt] = pushq %rbp
env->gpr[ra] + env->gpr[rb]; movq %rsp, %rbp
} movl %edi, -4(%rbp)
movl %esi, -8(%rbp)
movl %edx, -12(%rbp)
Prologue : reserve stack movq env(%rip), %r8
movl -4(%rbp), %eax
movslq %eax,%rsi
movq env(%rip), %rdi
movl -8(%rbp), %eax
movslq %eax,%rcx
movq env(%rip), %rdx
Epilogue : movl -12(%rbp), %eax
Release stack and cltq
movl 4(%rdx,%rax,4), %eax
return to caller addl 4(%rdi,%rcx,4), %eax
movl %eax, 4(%r8,%rsi,4)
leave
ret](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-15-2048.jpg)
![Performance Issues (3/3)
Un-matched description ability of high-level language
add r0, r1, r2
void add(int rt, int ra, int rb) {
env->gpr[rt] = env->gpr[ra] + env->gpr[rb];
}
From high-level language
X86 Host
pushq %rbp
movq %rsp, %rbp
movl %edi, -4(%rbp)
mov 0x7c(%r14),%r15d
movl %esi, -8(%rbp) mov 0x6c(%r14),%r12d
movl %edx, -12(%rbp) add %r12d,%r15d
movq env(%rip), %r8
movl -4(%rbp), %eax
mov %r15d,0x8(%r14)
movslq %eax,%rsi
movq env(%rip), %rdi
movl -8(%rbp), %eax
movslq %eax,%rcx
movq env(%rip), %rdx
movl -12(%rbp), %eax
cltq
movl 4(%rdx,%rax,4), %eax
addl 4(%rdi,%rcx,4), %eax
movl %eax, 4(%r8,%rsi,4)
leave
ret](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-17-2048.jpg)
![Build Micro-op Template
Micro-op: common and simple host
operation
add r0, r1, r2
void add(int rt, int ra, int rb) {
env->gpr[rt] = env->gpr[ra] + env->gpr[rb];
}
mov 0x7c(%r14),%r15d read data from register-related addr
mov 0x6c(%r14),%r12d the same
add %r12d,%r15d ALU operation on registers
mov %r15d,0x8(%r14) store date into register-related addr](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-20-2048.jpg)
![Build Micro-op Template
Use compiler trick to force register use and alias
register as variable
register struct CPUNDS32State *env asm(r14);
register target_ulong T0 asm(r15);
register target_ulong T1 asm(r12);
register target_ulong T2 asm(r13);
T0 = env->gpr[19]; mov 0x7c(%r14),%r15d
T1 = env->gpr[15]; mov 0x6c(%r14),%r12d
T0 = T0 + T1; add %r12d,%r15d
env->gpr[2] = T0; mov %r15d,0x8(%r14)](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-21-2048.jpg)
![Build Micro-op Template
Use function call and more compiler trick to produce related host
instruction
-O2 : remove prologue because of leaf-function
__volatile__("" : : : "memory") : produce one epilog
void op_load_gpr_T0_gpr_r0(void) { 0000000000000000 <op_load_gpr_T0_gpr0>:
T0 = env->gpr[0]; 0: 45 8b 3e mov (%r14),%r15d
FORCE_RET(); 3: c3 retq
}
void op_add(void) { 0000000000001c18 <op_add>:
T0 = T1 + T2; 1c18: 45 01 e7 add %r12d,%r15d
FORCE_RET(); 1c1b: c3 retq
}
void op_addi(void){
T0 += (int32_t)PARAM1; 0000000000002b85 <op_addi>:
FORCE_RET(); 2b85: 8d 05 00 00 00 00 lea 0(%rip),%eax
}
2b8b: 41 01 c7 add %eax,%r15d
2b8e: c3 retq](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-22-2048.jpg)
![Optimization : Use Basic Block
000081ac <abort>:
Basic block : code that 81ac: addi $sp,$sp,#-24
has one exit point and 81b0: swi $fp,[$sp+#20]
81b4: addi $fp,$sp,#16
one problem flow 81b8: movi55 $r0,#1
alternation instruction 81ba: sethi $r15,#8
81be: ori $r15,$r15,#0x32c
81c2: jral $lp,$r15
81c6: mov55 $sp,$fp
81c8: lwi $fp,[$fp+#0]
Encounter a branch 81cc: addi $sp,$sp,#4
instruction 81d0: ret5 $lp](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-26-2048.jpg)
![Optimization : Chain Basic Block
Certainbranch target is deterministic, i.e no
more judgment is required
84a8: smwa.adm $sp,[$sp],$sp,#0x8
void select(int *a, int *b) { 84ac: addi10.sp #-4
84ae: mov55 $fp,$sp
if (*b < 10) 84b0: lwi450 $r2,[$r1]
*a = *b * 2; 84b2: mov55 $r3,$r0
else 84b4: slli333 $r0,$r2,#0x2
*a = *b * 4 + 1; 84b6: addi333 $r0,$r0,#0x1
} 84b8: add333 $r1,$r2,$r2
84ba: sltsi45 $r2,#0xa
84bc: beqzs8 84c2 <select+0x1a>
84be: swi450 $r1,[$r3]
Yes condition 84c0: j8 84c4 <select+0x1c>
84c2: swi450 $r0,[$r3]
No condition 84c4: addi $sp,$fp,#4
84c8: lwi.bi $fp,[$sp],#4
84cc: ret5 $lp
84ce: srli45 $r0,#0x0
Lazy condition code flag evaluation](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-27-2048.jpg)
![static void realview_init(ram_addr_t ram_size,
const char *boot_device,
const char *kernel_filename, const char *kernel_cmdline,
const char *initrd_filename, const char *cpu_model,
enum realview_board_type board_type)
{
…
sysbus_create_simple("pl050_keyboard", 0x10006000, pic[20]);
sysbus_create_simple("pl050_mouse", 0x10007000, pic[21]);
sysbus_create_simple("pl011", 0x10009000, pic[12]);
sysbus_create_simple("pl011", 0x1000a000, pic[13]);
sysbus_create_simple("pl011", 0x1000b000, pic[14]);
sysbus_create_simple("pl011", 0x1000c000, pic[15]);
/* DMA controller is optional, apparently. */
sysbus_create_simple("pl081", 0x10030000, pic[24]);
sysbus_create_simple("sp804", 0x10011000, pic[4]);
sysbus_create_simple("sp804", 0x10012000, pic[5]);
sysbus_create_simple("pl110_versatile", 0x10020000, pic[23]);
sysbus_create_varargs("pl181", 0x10005000, pic[17], pic[18], NULL);
sysbus_create_simple("pl031", 0x10017000, pic[10]);
…
dev = sysbus_create_simple("realview_i2c", 0x10002000, NULL);
i2c = (i2c_bus *)qdev_get_child_bus(dev, "i2c");
i2c_create_slave(i2c, "ds1338", 0x68);
…](https://image.slidesharecdn.com/qemu-jit-code-generator-system-emulation-100319102410-phpapp02/75/Qemu-JIT-Code-Generator-and-System-Emulation-43-2048.jpg)
Uploaded byNational Cheng Kung University
Qemu JIT Code Generator and System Emulation
QEMU is an open source system emulator that uses just-in-time (JIT) compilation to achieve high performance system emulation. It works by translating target CPU instructions to simple host CPU micro-operations at runtime. These micro-operations are cached and chained together into basic blocks to reduce overhead. This approach avoids the performance issues of traditional emulators by removing interpretation overhead and leveraging CPU parallelism through pipelining of basic blocks.
More Related Content
Similar to Qemu JIT Code Generator and System Emulation
![reductio [ad absurdum]](https://cdn.slidesharecdn.com/ss_thumbnails/taualywhssudecboubib-signature-40f4714a7511dbefb3f8b81978ee26a52b8bc17a56b46da771a1d673a5b4d7df-poli-170804175449-thumbnail.jpg?width=640&height=640&fit=bounds)
More from National Cheng Kung University
Qemu JIT Code Generator and System Emulation
- 1. QEMU Just-In-Time Code Generator and System Emulation 趙至敏 (cmchao), Andes Technology 黃敬群 (jserv), 0xlab March 15, 2010 / 台灣科技大學資訊工程所
- 2. Rights to copy © Copyright 2010 Chih-Min Chao <cmchao@gmail.com> and 0xlab <contact@0xlab.org> Corrections, suggestions, contributions and translations are welcome! Last update: March 15, 2010 Attribution – ShareAlike 3.0 You are free to copy, distribute, display, and perform the work to make derivative works to make commercial use of the work Under the following conditions Attribution. You must give the original author credit. Share Alike. If you alter, transform, or build upon this work, you may distribute the resulting work only under a license identical to this one. For any reuse or distribution, you must make clear to others the license terms of this work. Any of these conditions can be waived if you get permission from the copyright holder. Your fair use and other rights are in no way affected by the above. License text: http://creativecommons.org/licenses/by-sa/3.0/legalcode
- 3. Part I : QEMUJust-In-Time Code Generator
- 4. Outline Concept Traditional Methods & Problems QEMU Approach
- 5. Who am I 趙至敏 (cmchao) 交通大學電子所系統組 (2003~2005) Andes Technology / 晶心科技 (2007~current) Open source project pcmanx (Gtk+-based BBS client) QEMU Contact: cmchao@gmail.com
- 6. Andes Technology High-performance/low-power 32-bit processors designer & provider Full SoC Solution Full Software Solution (toolchains, Linux and RTOS) Full Software Development Environment
- 7. What is QEMU “Quick Emulator” for system level emulation Created by Fabrice Bellard in 2003 Features Just-in-time(JIT) compilation support to achieve high performance (400 ~ 500 MIPS) Cross-platform (most UNIX-like system and MS-Windows) Lots of peripherals support Lots of target hosts and targets support (full system emulation) x86, arm, mips, sh4, cris, sparc, nds32, … User mode emulation: can run applications compiled for another CPU.
- 8. Terminology clarification Emulation vs simulation emulation : be you simulation : be like you Host vs. target(guest) host : where you run QEMU target : the emulated computer
- 9. Screenshot (1) Source : http://free.oszoo.org/img/98lite.png Host :x86 Target : x86
- 10. Screenshot (2) Source : http://www.linuxtopia.org Host : x86 Target : arm
- 11. QEMU System Framework CPUEmulation Peripheral IO Model & Software Interface JIT Memory MMU Monitor & Debugger Moduel Flow Control
- 12. QEMU System Framework CPUEmulation Peripheral IO Model & Software Interface JIT Memory MMU Monitor & Debugger Module Flow Control
- 13. Outline Concept Traditional Methods & Problems QEMU Approach
- 14. Traditional CPU EmulationApproach Fetch target pc(0x50000):40008800 instruction Decode Opcode : 0x10 (add), rt:0, ra:1, rb:2 switch(opcode) Look up instruction case add : function table add(rt, ra, rb) break; void add(int rt, int ra, int rb) { Execution env->gpr[rt] = env->gpr[ra] + env->gpr[rb]; }
- 15. Performance Issues (1/3) Functional call overhead void add(int rt, int ra, int rb) { env->gpr[rt] = pushq %rbp env->gpr[ra] + env->gpr[rb]; movq %rsp, %rbp } movl %edi, -4(%rbp) movl %esi, -8(%rbp) movl %edx, -12(%rbp) Prologue : reserve stack movq env(%rip), %r8 movl -4(%rbp), %eax movslq %eax,%rsi movq env(%rip), %rdi movl -8(%rbp), %eax movslq %eax,%rcx movq env(%rip), %rdx Epilogue : movl -12(%rbp), %eax Release stack and cltq movl 4(%rdx,%rax,4), %eax return to caller addl 4(%rdi,%rcx,4), %eax movl %eax, 4(%r8,%rsi,4) leave ret
- 16. Performance Issues (2/3) Redundant fetch and decode Spacelocality : programs usually run sequentially Temporal locality : 80/20 rule
- 17. Performance Issues (3/3) Un-matched description ability of high-level language add r0, r1, r2 void add(int rt, int ra, int rb) { env->gpr[rt] = env->gpr[ra] + env->gpr[rb]; } From high-level language X86 Host pushq %rbp movq %rsp, %rbp movl %edi, -4(%rbp) mov 0x7c(%r14),%r15d movl %esi, -8(%rbp) mov 0x6c(%r14),%r12d movl %edx, -12(%rbp) add %r12d,%r15d movq env(%rip), %r8 movl -4(%rbp), %eax mov %r15d,0x8(%r14) movslq %eax,%rsi movq env(%rip), %rdi movl -8(%rbp), %eax movslq %eax,%rcx movq env(%rip), %rdx movl -12(%rbp), %eax cltq movl 4(%rdx,%rax,4), %eax addl 4(%rdi,%rcx,4), %eax movl %eax, 4(%r8,%rsi,4) leave ret
- 18. Outline Concept Traditional Methods & Problems QEMU Approach
- 19. Goal Use the most simplified host instruction to describe target instruction Perform automatic translation and patch at run-time
- 20. Build Micro-op Template Micro-op: common and simple host operation add r0, r1, r2 void add(int rt, int ra, int rb) { env->gpr[rt] = env->gpr[ra] + env->gpr[rb]; } mov 0x7c(%r14),%r15d read data from register-related addr mov 0x6c(%r14),%r12d the same add %r12d,%r15d ALU operation on registers mov %r15d,0x8(%r14) store date into register-related addr
- 21. Build Micro-op Template Use compiler trick to force register use and alias register as variable register struct CPUNDS32State *env asm(r14); register target_ulong T0 asm(r15); register target_ulong T1 asm(r12); register target_ulong T2 asm(r13); T0 = env->gpr[19]; mov 0x7c(%r14),%r15d T1 = env->gpr[15]; mov 0x6c(%r14),%r12d T0 = T0 + T1; add %r12d,%r15d env->gpr[2] = T0; mov %r15d,0x8(%r14)
- 22. Build Micro-op Template Use function call and more compiler trick to produce related host instruction -O2 : remove prologue because of leaf-function __volatile__("" : : : "memory") : produce one epilog void op_load_gpr_T0_gpr_r0(void) { 0000000000000000 <op_load_gpr_T0_gpr0>: T0 = env->gpr[0]; 0: 45 8b 3e mov (%r14),%r15d FORCE_RET(); 3: c3 retq } void op_add(void) { 0000000000001c18 <op_add>: T0 = T1 + T2; 1c18: 45 01 e7 add %r12d,%r15d FORCE_RET(); 1c1b: c3 retq } void op_addi(void){ T0 += (int32_t)PARAM1; 0000000000002b85 <op_addi>: FORCE_RET(); 2b85: 8d 05 00 00 00 00 lea 0(%rip),%eax } 2b8b: 41 01 c7 add %eax,%r15d 2b8e: c3 retq
- 23. Build Micro-op Template Build the micro-op vs host code look-up table 000000 <op_load_gpr_T0_gpr0>: case INDEX_op_load_gpr_T0_gpr0: 0: 45 8b 3e mov (%r14),%r15d copy code from op_load_grp_T0_gpr0 3: c3 retq to code-gen buffer break; 0001c18 <op_add>: case INDEX_op_add: 1c18: 45 01 e7 add %r12d,%r15d copy code from op_load_add 1c1b: c3 retq to code-gen buffer break; 002b85 <op_addi>: case INDEX_op_addi: 2b85: 8d 05 00 00 00 00 lea 0(%rip),%eax copy code from op_load_addi 2b8b: 41 01 c7 add %eax,%r15d to code-gen buffer 2b8e: c3 retq patch the constant value part break; File : op.h in build directory
- 24. Code-generation Flow Target instruction Micro-op translation, implemented in advance pc(0x1124): add r0, r1, r2 op_load_gpr_T0_r1 op_load_gpr_T1_r2 op_add op_store_gpr_T0_r0 cached (default size: 16MB) Generate code by look-up pre-built table Set buffer executable and jump to Buffer & Execute Buffer Address : 0x20000 Linux : mprotect() mov 0x7c(%r14),%r15d mov 0x6c(%r14),%r12d add %r12d,%r15d mov %r15d,0x8(%r14)
- 25. Optimization Use basic block as execution unit (space locality) Chain basic block Cache translated basic block (temporal locality)
- 26. Optimization : UseBasic Block 000081ac <abort>: Basic block : code that 81ac: addi $sp,$sp,#-24 has one exit point and 81b0: swi $fp,[$sp+#20] 81b4: addi $fp,$sp,#16 one problem flow 81b8: movi55 $r0,#1 alternation instruction 81ba: sethi $r15,#8 81be: ori $r15,$r15,#0x32c 81c2: jral $lp,$r15 81c6: mov55 $sp,$fp 81c8: lwi $fp,[$fp+#0] Encounter a branch 81cc: addi $sp,$sp,#4 instruction 81d0: ret5 $lp
- 27. Optimization : ChainBasic Block Certainbranch target is deterministic, i.e no more judgment is required 84a8: smwa.adm $sp,[$sp],$sp,#0x8 void select(int *a, int *b) { 84ac: addi10.sp #-4 84ae: mov55 $fp,$sp if (*b < 10) 84b0: lwi450 $r2,[$r1] *a = *b * 2; 84b2: mov55 $r3,$r0 else 84b4: slli333 $r0,$r2,#0x2 *a = *b * 4 + 1; 84b6: addi333 $r0,$r0,#0x1 } 84b8: add333 $r1,$r2,$r2 84ba: sltsi45 $r2,#0xa 84bc: beqzs8 84c2 <select+0x1a> 84be: swi450 $r1,[$r3] Yes condition 84c0: j8 84c4 <select+0x1c> 84c2: swi450 $r0,[$r3] No condition 84c4: addi $sp,$fp,#4 84c8: lwi.bi $fp,[$sp],#4 84cc: ret5 $lp 84ce: srli45 $r0,#0x0 Lazy condition code flag evaluation
- 28. CPU JIT ExecutionFlow Look up TBC by target pc N Translate one Cached basic block Y Exec translated Chain it to existed code basic block Exception happen & handling
- 29. More Optimization GCC4 can not guarantee the occurrence of retq instruction, thus GCC4 support Solution: TCG (Tiny Code Generator) QEMU trick can not be applied (a) 0000000000002b85 <op_addi>: 2b85: 8d 05 00 00 00 00 lea 0(%rip),%eax 2b8b: 41 01 c7 add %eax,%r15d 2b8e: c3 retq Redundant register allocation (b) add r2, r19, r15; mov 0x4(%r14),%r15d Sub r3, r2, r1; mov 0x8(%r14),%r12d add %r12d, %r15d mov %r15d, 0x8(%r14) mov 0x8(%r14),%r15d mov 0x4(%r14),%r12d sub %r12d, %r15d mov %r15d, 0xc(%r14) Duplicated code for different target porting
- 30. Source Code Organization qemu/ qemu-* : OS dependent API wrapper example: memory allocation or socket target-*/ : target porting tcg/ : new and unified JIT framework *-user/ : user-mode emulation on different OS softmmu-* : target MMU acceleration framework hw/ : peripheral model fpu : softfloat FPU emulation library gdb : GDB stub implementation
- 31. Source Tree Organization qemu/target-*/ cpu.h : regs and other cpu status declaration exec.h : declaration and certain inline function used outside op_helper.c : complicated instruction which cannot be modeled with micro-op such as MMU helper.c : exception handling translate.c : target instruction to micro-op mapping
- 32. Part II : QEMUSystem Emulation
- 33. Who am I 黃敬群 (Jim Huang / jserv) Software Group Lead, Openmoko (2007-2008) Engineer, Andes Technology / 晶心科技 (2008~2009) Developer & Co-founder, 0xlab (2009-) http://0xlab.org
- 34.
- 35. QEMU System Framework CPUEmulation Peripheral IO Model & Software Interface JIT Memory MMU Monitor & Debugger Module Flow Control
- 36. Evolution of Software • Full virtualization • Paravirtualization • Hardware-assisted (Binary rewriting) – Cooperative virtualization – Software-based virtualization – Unmodified guest – VMware – Modified guest – VMware and Xen on – VMware, Xen virtualization-aware Virtual Machine … Virtual Machine hardware platforms Dynamic Translation VM … VM Virtual Machine … Virtual Machine Hypervisor Hypervisor Operating System Hardware Hardware Hardware Time Application Ring 3 Guest OS Ring 1 / 3 Application Ring 3 Virtual Operating Ring 0 Machine Ring 0 System Monitor 03/19/10 36 Traditional x86 Architecture Full Virtualization
- 37. Big Picture VM QEMU Policy daemon Emul. CPU VM App1 App2 Context (emulated) NIC Network daemon Event channel CR3 CPU Intermediate stage 2 Host machine representation code block (x86) Guest machine (TCG) code block (x86) stage 1
- 38. QEMU System Emulation Emulates a certain complete machine Cross run unmodified operating system software or firmware Can also emulate Boot ROM including different bootstrap methods. QEMU itself is single-threaded. The speed of emulation depends on the amount of peripherals and modeling complexity.
- 39. I/O Emulation A computeris more than a CPU Also need I/O! Types of I/O: Most performance critical (for • Block (e.g. hard disk) servers): • Network • Network • Input • Block • keyboard, mouse, ... • Sound • Video
- 40. QEMU I/O Memory Access Basic BUS topology modeling SoftMMU QEMU implements fast TLB caches slower target TLB Interrupt Peripherals
- 41. QEMU Peripherals Source: directory hw/ Register callback functions for control register access QEMU Boards initialize CPU core, define Address Map, wire up devices, and load OS/Kernel images Timer, Interrupt controller, DMA, Flash type memory, Serial ports, IDE/SCSI, Graphics adapter, ...
- 42. static QEMUMachine realview_pbx_a9_machine= { .name = "realview-pbx-a9", .desc = "ARM RealView Platform Baseboard Explore for Cortex-A9", .init = realview_pbx_a9_init, .use_scsi = 1, .max_cpus = 4, hw/realview.c }; static void realview_machine_init(void) { qemu_register_machine(&realview_eb_machine); qemu_register_machine(&realview_eb_mpcore_machine); qemu_register_machine(&realview_pb_a8_machine); qemu_register_machine(&realview_pbx_a9_machine); } machine_init(realview_machine_init); device_init(realview_register_devices) static void realview_pbx_a9_init(ram_addr_t ram_size, const char *boot_device, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model) { if (!cpu_model) { cpu_model = "cortex-a9"; } realview_init(ram_size, boot_device, kernel_filename, kernel_cmdline, initrd_filename, cpu_model, BOARD_PBX_A9); }
- 43. static void realview_init(ram_addr_tram_size, const char *boot_device, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model, enum realview_board_type board_type) { … sysbus_create_simple("pl050_keyboard", 0x10006000, pic[20]); sysbus_create_simple("pl050_mouse", 0x10007000, pic[21]); sysbus_create_simple("pl011", 0x10009000, pic[12]); sysbus_create_simple("pl011", 0x1000a000, pic[13]); sysbus_create_simple("pl011", 0x1000b000, pic[14]); sysbus_create_simple("pl011", 0x1000c000, pic[15]); /* DMA controller is optional, apparently. */ sysbus_create_simple("pl081", 0x10030000, pic[24]); sysbus_create_simple("sp804", 0x10011000, pic[4]); sysbus_create_simple("sp804", 0x10012000, pic[5]); sysbus_create_simple("pl110_versatile", 0x10020000, pic[23]); sysbus_create_varargs("pl181", 0x10005000, pic[17], pic[18], NULL); sysbus_create_simple("pl031", 0x10017000, pic[10]); … dev = sysbus_create_simple("realview_i2c", 0x10002000, NULL); i2c = (i2c_bus *)qdev_get_child_bus(dev, "i2c"); i2c_create_slave(i2c, "ds1338", 0x68); …
- 44. DSL = DamnSmall Linux distribution QEMU monitor Default NIC device: Realtek RTL-8029
- 45. Switch back toVGA screen (under Linux) Default NIC device: Realtek RTL-8029
- 46. QEMU monitor Assigned NICdevice: Atheros AR5212 With proper implementation, even WirelessLAN device could be emulated.
- 47. Switch back toVGA screen (under Linux) Assigned NIC device: Atheros AR5212
- 48. Emulated Atheros Wireless LANworks on unmodified Damn Small Linux distribution inside QEMU
- 49. How does aNIC (network interface card) driver work? Transmit path Receive path 49
- 50. How does aNIC (network interface card) driver work? Transmit path: •OS prepares packet to transmit in a buffer in memory •Driver writes start address of buffer to register X of the NIC •Driver writes length of buffer to register Y •Driver writes ‘1’ (GO!) into register T •NIC reads packet from memory addresses [X,X +Y) and sends it on the wire •NIC sends interrupt to host (TX complete, next packet please) Receive path: Driver prepares buffer to receive packet into Driver writes start address of buffer to register X Driver writes length of buffer to register Y Driver writes ‘1’ (READY-TO-RECEIVE) into register R When packet arrives, NIC copies it into memory at [X,X+Y) NIC interrupts host (RX) 50 OS processes packet (e.g., wake the waiting process up)
- 51. The Emulated NIC Emulatorimplements virtual NIC (by the specification of a real NIC like Atheros. NIC registers (X, Y, Z, T, R, …) are just variables in emulator (host) memory If guest writes ‘1’ to register T, emulator reads buffer from memory [X,X+Y) and passes it to physical NIC driver for transmission When physical NIC interrupts (TX complete), emulator injects TX complete interrupt into guest (Similar for RX path) Pro: Cons: Unmodified guest Slow – every access to every NIC (guest already has drivers for Atheros NIC) register causes a VM exit Emulator needs to emulate Example: QEMU, KVM, VMware complex hardware behavior (without VMware Tools) 51
- 52. Para-virtualization Add virtual NICdriver into guest (frontend) Implement the virtual NIC in the hypervisor ( backend) Everything works just like in the emulation case except – protocol between frontend and backend Protocol in emulation case: Guest writes registers X, Y, waits at least 3 ns and writes to register T Hypervisor infers guest wants to transmit packet Paravirtual protocol can be high-level, e.g., ring of buffers to transmit (so NIC doesn’t stay idle after one transmission), and independent of particular NIC registers Pro: How is paravirtual I/O different from Fast – no need to emulate physical device paravirtual guest? Con: Requires guest driver Paravirtual guest requires to modify whole OS → Try doing it on Windows (without source code), or even Linux (lots of changes) Example: QEMU, KVM, VMware → Paravirtual I/O requires the addition of a single (with VMware Tools), Xen driver to a guest 52 → Easy to do on both Windows and Linux guests
- 53. QEMU Debugging GDB stub is non-intrusive and controllable from first executed instruction Provide hardware breakpoint and watchpoint Fully integrated into QEMU Monitor
- 54. QEMU Remote Debugger gdbstub – through CP/IP (gdb) target remote localhost:1234 QEMU options: -s Wait gdb connection to port 1234. -S Do not start CPU at startup localhost:123 4 gdb stub GDB running on 深入淺出 Hello MachinePart I 54 by QEMU World - emulated Host env
- 55. QEMU monitor Press Ctrl-Alt-2 after QEMU window appears to switch to QEMU monitor (qemu) info registers Press Ctrl-C in GDB to get controlled static void shell_thread_func(void *pdata){ … While (1) { ... gets(buf); Debugger 2005-12-31
- 56. (qemu) print 0x40100000 + 0x00 0x40100000 (qemu) x/1d 0x40100000 0x40100000: 0 (qemu) x/1d 0x40100000 0x40100000: 65 CuRT_v1/includes/arch/arm/mach-pxa/pxa255.h CuRT_v1/includes/arch/arm/mach-pxa/pxa255.h /** Full Function UART */ /** Full Function UART */ #define FFUART_BASE #define FFUART_BASE 0x40100000 0x40100000 #define rFFTHR #define rFFTHR (*((volatile ulong *)(FFUART_BASE+0x00))) (*((volatile ulong *)(FFUART_BASE+0x00))) #define rFFLSR #define rFFLSR (*((volatile ulong *)(FFUART_BASE+0x14))) (*((volatile ulong *)(FFUART_BASE+0x14))) character 'A' in serial CuRT serial ‘A’ = 0x41 = 65 driver is disabled
- 57. QEMU Mainline Status 0.9.1 (Jan 6, 2008) Stable and stop for a long time 0.10 (Mar 5, 2009) TCG support (a new general JIT framework) 0.11 (Sep 24, 2009) KVM support 0.12 More KVM support Code refactoring new peripheral framework to support dynamic board configuration
- 58. Reference QEMU: http://www.qemu.org/ Fabrice Bellard, QEMU, a Fast and Portable Dynamic Translator, USENIX 2005 Annual Technical Conference, FREENIX Track Pp. 41– 46 of the Proceedings KVM: http://www.linux-kvm.org/