3

I'm studying how emulators like Bochs and QEMU work and had a question -- if I emulate an x86 guest operating system on an x86 host and the guest executes some instruction that assigns a register (for example, mov eax 3), is it guaranteed or even likely that the value will actually be assigned to the eax register on the actual hardware in code run by the emulator?

I'd assume that there would be no reason not to, since the QEMU process is its own separate process (so it doesn't have to share general purpose registers with any other process) and since both the host and the guest architectures are the same and therefore have the same general purpose registers.

Also, if I was to execute a program in QEMU that has two instructions:

mov eax 3
add eax 2

Would it just combine the two into a single mov eax, 5 instruction if it could determine that doing so would not alter the program's execution, since it executes programs by executing blocks of instructions instead of each instruction individually?

Please note that I'm referring to pure emulation in this case (Bochs or non-KVM QEMU) and not hardware virtualization.

10
  • 3
    In the specific case of emulating x86 on x86 or x64, yes, it is highly likely. The processor has facilities built in that make this easier than implementing your own processor; task state switching, for one. The second part, however, goes more toward optimization of code than it does emulation. No. An emulator would never choose to make that swap; it potentially could break all kinds of things. Dec 7, 2016 at 22:11
  • 3
    non-kvm qemu-x86_64-static does not special case x86 on x86 emulation, it generates totally different code. Surprisingly, it is clever enough to optimize the mov+add combination. You can run it using qemu-x86_64-static -d in_asm,out_asm test.elf and see for yourself.
    – Jester
    Dec 7, 2016 at 22:22
  • 3
    BOCHS is a pure interpreter emulator with a dispatch loop, no dynamic recompilation. See the how bochs works under the hood" link on the front page of the site. It uses some cool tricks to run as fast as possible, at least for that emulation method. Dec 7, 2016 at 22:25
  • 4
    With a pure software emulator, the value stored in given emulated register would only transiently and only by coincidence happen to be in the corresponding real register. It would have a more permanent residence in some data structure representing the current CPU state. A dynamically recompiling (JIT'ing) emulator could potentially consistently use the real registers to emulate the virtual ones, but it just as easily be implemented by dynamically picking real registers (or memory locations).
    – Ross Ridge
    Dec 7, 2016 at 22:30
  • 1
    Obviously I'm the first pedant to turn up; mov eax, 5 is not equivalent to mov eax, 3 / add eax, 2. For example, the former does not change the carry flag whereas the latter resets it. You'd need a lot more context to decide that the former was a safe substitution for the latter.
    – Tommy
    Dec 22, 2016 at 18:19

1 Answer 1

8

No, QEMU doesn't work like that. x86-to-x86 is not a special case and is handled like any other guest/host combination in the emulation. All guest code is first translated into an intermediate representation. Then a simple optimisation pass runs (this is where we figure out that 'load 2; add 3' simplifies to 'load 5'). Finally we do register allocation and generate native host code from the IR.

In the IR guest registers are represented with "TCG values", which are sort of like variables in a higher level language. The guest registers are defined as values that live in the CPU state structure in the host memory, but TCG is smart enough not to write them back to memory until they actually need to be, so often the 'live' copy of a guest register will be in a host register. But because register allocation is a completely separate bit of code, it's unlikely that the allocator will happen to pick the same x86 register that the guest code originally used.

Using an IR like this is a very common design pattern for compilers or JITs (and TCG QEMU is a JIT). The advantage is that it's easy to support multiple frontends and backends without an explosion in the number of different combinations you need to think about; QEMU currently supports 18 frontends and 9 backends. It also means common optimisations (like that constant folding that removed the separate add instruction) only need to be implemented once, working purely on the IR.

The TCG IR is documented here: http://wiki.qemu.org/Documentation/TCG

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.