Diese Präsentation wurde erfolgreich gemeldet.
Wir verwenden Ihre LinkedIn Profilangaben und Informationen zu Ihren Aktivitäten, um Anzeigen zu personalisieren und Ihnen relevantere Inhalte anzuzeigen. Sie können Ihre Anzeigeneinstellungen jederzeit ändern.

QEMU - Binary Translation

12.275 Aufrufe

Veröffentlicht am

Introduction to binary translation in QEMU(TCG). Describe how it works. In addition, there is a section which demonstrate qemu-monitor, a debug tool for AArch64/QEMU.

There are lots of animations in the slides so download and open it with Microsoft PowerPoint for the best experience. Below is the download link.
Google Driver Link: http://goo.gl/XXMC9X

Veröffentlicht in: Software
  • DOWNLOAD FULL. BOOKS INTO AVAILABLE FORMAT ......................................................................................................................... ......................................................................................................................... 1.DOWNLOAD FULL. PDF EBOOK here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... 1.DOWNLOAD FULL. doc Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... 1.DOWNLOAD FULL. PDF EBOOK here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... 1.DOWNLOAD FULL. doc Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier
  • Hello! Get Your Professional Job-Winning Resume Here - Check our website! https://vk.cc/818RFv
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier
  • Frankly, the first time I saw a very good detail indepth explanation of QEMU, bravo!!
       Antworten 
    Sind Sie sicher, dass Sie …  Ja  Nein
    Ihre Nachricht erscheint hier

QEMU - Binary Translation

  1. 1. QEMU Binary Translations 2014/09/25@NCKU Embedded Course Jeff Liaw rampant1018@gmail.com
  2. 2. Outline Introduction of QEMU Overview Translation Block Tiny Code Generator Porting to New Architecture Linaro QEMU Monitor A debug tool for AArch64/QEMU YODO Lab -2-
  3. 3. Introduction of QEMU
  4. 4. What is QEMU? Quick EMUlator QEMU is a FAST! processor emulator Time for booting linux kernel(buildroot)  QEMU needs 2 sec  Foundation Model needs 12 sec Simulation V.S Emulation Simulation – For analysis and study Emulation – For usage as substitute YODO Lab -4-
  5. 5. Usage of QEMU Modes: System-mode emulation – emulation of a full system User-mode emulation – launch processes compiled for another CPU(same OS)  Ex. execute arm/linux program on x86/linux Popular uses: For cross-compilation development environments Virtualization, device emulation, for kvm Android Emulator(part of SDK) YODO Lab -5-
  6. 6. QEMU Generic Features Support Self-modifying code Precise exception FPU  software emulation  host FPU instructions Dynamic translation to native code => speed YODO Lab -6-
  7. 7. QEMU Full System Emulation Features Full software MMU => portability Optionally use an in-kernel accelerator(kvm) Various hardware devices can be emulated SMP even on host with a single CPU YODO Lab -7-
  8. 8. QEMU Emulation Example Host(Win7/x86) emulate Guest(Linux/arm) x86 ISA is different from ARM’s ISA emulate YODO Lab -8-
  9. 9. Dynamic Translation Target CPU instruction → Host CPU instruction(runtime) 32MB YODO Lab -9-
  10. 10. Translation & Execution initialize the process or and jump to the host code Main Loop:  IRQ handle  translation  run guest restore normal state and return to the main loop Overhead! YODO Lab -10-
  11. 11. Translation & Execution We need emulation! Host Emulation  Main Loop:  IRQ handle  translation  run guest YODO Lab -11-
  12. 12. Basic Block(Translated Block, TB) Block exit point: encounter branch(modify PC) reach page boundary 000081ac<abort>: 81ac: add $sp, $sp #-24 81b0: str $fp, [$sp+#20] … 81c2: beq $lr 81c6: mov $sp, $fp … 81d0: ret $lr Branch occur Block 1 Block 2 YODO Lab -12-
  13. 13. Block Chaining Jump directly between basic blocks YODO Lab -13-
  14. 14. Chaining Steps tb_add_jump() in “cpu-exec.c” YODO Lab -14-
  15. 15. CPU Execution Flow Exceptions: asynchronous interrupts(unchain) process I/O no more TB Look up TBC by target PC Translate one basic block Chain it to existed block Cached Execute translated code Exception handling N Y tb_gen_code() tb_add_jump() cpu_tb_exec() YODO Lab -15-
  16. 16. Example arm-none-eabi-gcc -c -mcpu=arm926ej-s -g foo.c foo.o -O0 YODO Lab -16-
  17. 17. Example  r4 = dummy  r5 = i dummy++ when i < 5 dummy-- when i >= 5 i count from 0 to 9 Translation Cache TB 1 TB 1 cpu-exec TB 2 TB 2 TB 3 TB 3 TB 4 TB 4 TB 5 TB 5 YODO Lab -17-
  18. 18. CPU dependency(bad idea) generate host code Target CPU Host CPU Bomb!!!!!! YODO Lab -18-
  19. 19. CPU independency(good idea) -19- generate host code Target CPU Host CPU All problems in CS can be solved by another level of indirection YODO Lab -19-
  20. 20. Tiny Code Generator(TCG) Since QEMU 0.10 Relax dependency Steps: 1. Target instruction → RISC-like TCG ops 2. Optimizations 3. TCG ops → host instructions Frontend Backend YODO Lab -20-
  21. 21. TCG micro-ops Simple instruction Ex. add → TCG micro-ops ARM micro-ops Convert P.S tmp5 and tmp6 are temporary variables YODO Lab -21-
  22. 22. TCG micro-ops Complicated instruction Ex. qadd → TCG micro-ops(helper) ARM micro-ops Convert P.S tmp5, tmp6 and tmp7 are temporary variables YODO Lab -22-
  23. 23. TCG micro-ops TCG micro-ops Basic functions Temporary variables Divide one instruction to multiple small operations Helper function handle complicated instructions YODO Lab -23-
  24. 24. TCG Frontend API tcg_gen_<op>[i]_<reg_size> <op> - operation [i] - immediate or register <reg_size> - size of register YODO Lab -24-
  25. 25. TCG Frontend API Temporary variable allocate & delete Call helper function YODO Lab -25-
  26. 26. TCG internal Two column: op code(opc) op parameter(opparam) OPC OPPARAM op_add_i32 ret arg1 arg2 OPC OPPARAM YODO Lab -26-
  27. 27. ARM Convert micro-ops OPC OPPARAM op_movi_i32 op_mov_i32 op_add_i32 op_mov_i32 t0 arg2 t1 cpu_R[arg1] t1 t1 t0 cpu_R[arg1] t1 YODO Lab -27-
  28. 28. TCG Backend Frontend Backend OPC OPPARAM op_movi_i32 op_mov_i32 op_add_i32 op_mov_i32 t0 arg2 t1 cpu_R[arg1] t1 t1 t0 cpu_R[arg1] t1 YODO Lab -28-
  29. 29. TCG Backend micro-ops → host code QEMU on x86-64 micro-ops Host machine Convert YODO Lab -29-
  30. 30. TCG Backend x86-64 backend example OPC OPPARAM op_movi_i32 op_mov_i32 op_add_i32 op_mov_i32 t0 arg2 t1 cpu_R[arg1] t1 t1 t0 cpu_R[arg1] t1 YODO Lab -30-
  31. 31. TCG Porting Porting source tree qemu/target-*/ cpu.h translate.c op_helper.c helper.c qemu/tcg/*/ tcg-target. c tcg-target. h Frontend Backend regs and cpu status declaration target instruction → micro-op complicated instruction which can’t be modeled with micro-op exception handling(ex. divide 0) YODO Lab -31-
  32. 32. Linaro
  33. 33. Overview Build the future of Open Source Software on ARM Does the core engineering YODO Lab -33-
  34. 34. Members Core Members Club Members Group Members YODO Lab -34-
  35. 35. Android L Developer Preview Android emulator based on QEMU Differences to mainline QEMU User Interface  keypad/buttons  accelerated graphics Emulated Devices  Fast IPC(qemu_pipe)  GSM, GPS, sensors Ref: http://www.linaro.org/blog/core-dump/running-64bit-android-l-qemu/ YODO Lab -35-
  36. 36. QEMU-Monitor
  37. 37. Overview QEMU provide gdb stub debug in running image display general purpose registers(pc, spsr) single step execution But can not display system register hard to debug kernel image YODO Lab -37-
  38. 38. QEMU gdbserver & qemu-monitor  QEMU gdbserver send gdb packet when VM_STATE change  Custom packet through IPC socket GDB_VM_STATE _CHANGE Send GDB Packet Send Custom Packet Receive Custom Packet Print Related Information IPC Socket QEMU qemu-monitor Custom Packet YODO Lab -38-
  39. 39. QEMU System Registers Mapping Some registers are not implemented Hard-coded target-arm/helper.c Hash Key QEMU Variables mapping to ARM registers YODO Lab -39-
  40. 40. Screenshot YODO Lab -40-
  41. 41. YODO Lab 41
  42. 42. QEMU & KVM QEMU run independently QEMU + KVM qemu(userspace tool) kvm(hypervisor) YODO Lab -42-

×