• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1HOW THE QEMU EXECUTION ENGINE WORKS:
2====================================
3
4Translating ARM to x86 machine code:
5------------------------------------
6
7QEMU starts by isolating code "fragments" from the emulated machine code.
8Each "fragment" corresponds to a series of ARM instructions ending with a
9branch (e.g. jumps, conditional branches, returns).
10
11Each fragment is translated into a "translated block" (a.k.a. TB) of host
12machine code (e.g. x86). All TBs are put in a cache and each time the
13instruction pointer changes (i.e. at the end of TB execution), a hash
14table lookup is performed to find the next TB to execute.
15
16If none exists, a new one is generated. As a special exception, it is
17sometimes possible to 'link' the end of a given TB to the start of
18another one by tacking an explicit jump instruction.
19
20Note that due to differences in translations of memory-related operations
21(described below in "MMU emulation"), there are actually two TB caches per
22emulated CPU: one for translated kernel code, and one for translated
23user-space code.
24
25When a cache fills up, it is simply totally emptied and translation starts
26again.
27
28CPU state is kept in a single global structure which the generated code
29can access directly (with direct memory addressing).
30
31The file target-arm/translate.c is in charge of translating the ARM or
32Thumb instructions starting at the current instruction pointer position
33into a TB. This is done by decomposing each instruction into a series of
34micro-operations supported by the TCG code generator.
35
36TCG stands for "Tiny Code Generator" and is specific to QEMU. It supports
37several host machine code backends. See source files under tcg/ for details.
38
39
40MMU Emulation:
41--------------
42
43The ARM Memory Management Unit is emulated in software, since it is so
44different from the one on the host. Essentially, a single ARM memory load/store
45instruction is translated into a series of host machine instructions that will
46translate virtual addresses into physical ones by performing the following:
47
48- first lookup in a global 256-entries cache for the current page and see if
49  a corresponding value is already stored there. If this is the case, use it
50  directly.
51
52- otherwise, call a special helper function that will implement the full
53  translation according to the emulated system's state, and modify the
54  cache accordingly.
55
56The page cache is called the "TLB" in the QEMU sources.
57
58Note that there are actually two TLBs: one is used for host machine
59instructions that correspond to kernel code, and the other for instructions
60translated from user-level code.
61
62This means that a memory load in the kernel will not be translated into the
63same instructions than the same load in user space.
64
65Each TLB is also implemented as a global per-emulated-CPU hash-table.
66The user-level TLB is flushed on each process context switch.
67
68When initializing the MMU emulation, one can define several zones of the
69address space, with different access rights / type. This is how memory-mapped
70I/O is implemented: the virtual->physical conversion helper function detects
71that you're trying to read/write from an I/O memory region, and will then call
72a callback function associated to it.
73
74
75Hardware Emulation:
76-------------------
77
78Most hardware emulation code initializes by registering its own region of
79I/O memory, as well as providing read/write callbacks for it. Then actions
80will be based on which offset of the I/O memory is read from/written to and
81eventually with which value.
82
83You can have a look at hw/goldfish_tty.c that implements an emulated serial
84port for the Goldfish platform.
85
86"Goldfish" is simply the name of the virtual Linux platform used to build
87the Android-emulator-specific kernel image. The corresponding sources are
88located in the origin/android-goldfish-2.6.27 branch of
89git://android.git.kernel.org/kernel/common.git. You can have a look at
90arch/arm/mach-goldfish/ for the corresponding kernel driver sources.
91
92