1HOW THE QEMU EXECUTION ENGINE WORKS: 2==================================== 3 4Translating ARM to x86 machine code: 5------------------------------------ 6 7QEMU starts by isolating code "fragments" from the emulated machine code. 8Each "fragment" corresponds to a series of ARM instructions ending with a 9branch (e.g. jumps, conditional branches, returns). 10 11Each fragment is translated into a "translated block" (a.k.a. TB) of host 12machine code (e.g. x86). All TBs are put in a cache and each time the 13instruction pointer changes (i.e. at the end of TB execution), a hash 14table lookup is performed to find the next TB to execute. 15 16If none exists, a new one is generated. As a special exception, it is 17sometimes possible to 'link' the end of a given TB to the start of 18another one by tacking an explicit jump instruction. 19 20Note that due to differences in translations of memory-related operations 21(described below in "MMU emulation"), there are actually two TB caches per 22emulated CPU: one for translated kernel code, and one for translated 23user-space code. 24 25When a cache fills up, it is simply totally emptied and translation starts 26again. 27 28CPU state is kept in a single global structure which the generated code 29can access directly (with direct memory addressing). 30 31The file target-arm/translate.c is in charge of translating the ARM or 32Thumb instructions starting at the current instruction pointer position 33into a TB. This is done by decomposing each instruction into a series of 34micro-operations supported by the TCG code generator. 35 36TCG stands for "Tiny Code Generator" and is specific to QEMU. It supports 37several host machine code backends. See source files under tcg/ for details. 38 39 40MMU Emulation: 41-------------- 42 43The ARM Memory Management Unit is emulated in software, since it is so 44different from the one on the host. Essentially, a single ARM memory load/store 45instruction is translated into a series of host machine instructions that will 46translate virtual addresses into physical ones by performing the following: 47 48- first lookup in a global 256-entries cache for the current page and see if 49 a corresponding value is already stored there. If this is the case, use it 50 directly. 51 52- otherwise, call a special helper function that will implement the full 53 translation according to the emulated system's state, and modify the 54 cache accordingly. 55 56The page cache is called the "TLB" in the QEMU sources. 57 58Note that there are actually two TLBs: one is used for host machine 59instructions that correspond to kernel code, and the other for instructions 60translated from user-level code. 61 62This means that a memory load in the kernel will not be translated into the 63same instructions than the same load in user space. 64 65Each TLB is also implemented as a global per-emulated-CPU hash-table. 66The user-level TLB is flushed on each process context switch. 67 68When initializing the MMU emulation, one can define several zones of the 69address space, with different access rights / type. This is how memory-mapped 70I/O is implemented: the virtual->physical conversion helper function detects 71that you're trying to read/write from an I/O memory region, and will then call 72a callback function associated to it. 73 74 75Hardware Emulation: 76------------------- 77 78Most hardware emulation code initializes by registering its own region of 79I/O memory, as well as providing read/write callbacks for it. Then actions 80will be based on which offset of the I/O memory is read from/written to and 81eventually with which value. 82 83You can have a look at hw/goldfish_tty.c that implements an emulated serial 84port for the Goldfish platform. 85 86"Goldfish" is simply the name of the virtual Linux platform used to build 87the Android-emulator-specific kernel image. The corresponding sources are 88located in the origin/android-goldfish-2.6.27 branch of 89git://android.git.kernel.org/kernel/common.git. You can have a look at 90arch/arm/mach-goldfish/ for the corresponding kernel driver sources. 91 92