Qemu对x86复位状态的模拟

最新推荐文章于 2023-12-16 19:00:00 发布

嵌云阁主

最新推荐文章于 2023-12-16 19:00:00 发布

阅读量4.3k

点赞数

分类专栏：虚拟机文章标签： x86 features initialization exception translation ext

本文链接：https://blog.csdn.net/lights_joy/article/details/4358555

版权

虚拟机专栏收录该内容

5 篇文章 0 订阅

订阅专栏

快乐虾

http://blog.csdn.net/lights_joy/

lights@hb165.com

本文适用于

QEMU-0.10.5

VS2008

欢迎转载，但请保留作者信息

1.1 X86复位后的行为

关于x86复位后的行为，intel的手册上是这样说的：

Following power-up or an assertion of the RESET# pin, each processor on the system

bus performs a hardware initialization of the processor (known as a hardware reset)

and an optional built-in self-test (BIST). A hardware reset sets each processor’s

registers to a known state and places the processor in real-address mode. It also

invalidates the internal caches, translation lookaside buffers (TLBs) and the branch

target buffer (BTB). At this point, the action taken depends on the processor family:

• Pentium 4 and Intel Xeon processors — All the processors on the system bus

(including a single processor in a uniprocessor system) execute the multiple

processor (MP) initialization protocol. The processor that is selected through this

protocol as the bootstrap processor (BSP) then immediately starts executing

software-initialization code in the current code segment beginning at the offset in

the EIP register. The application (non-BSP) processors (APs) go into a Wait For

Startup IPI (SIPI) state while the BSP is executing initialization code. See Section

7.5, “Multiple-Processor (MP) Initialization,” for more details. Note that in a

uniprocessor system, the single Pentium 4 or Intel Xeon processor automatically

becomes the BSP.

• P6 family processors — The action taken is the same as for the Pentium 4 and

Intel Xeon processors (as described in the previous paragraph).

也就是说它做了几件事：

1、复位内部寄存器的值。

2、将芯片置为实模式。

3、使内部缓存、TLB和BTB失效。

4、执行MP初始化协议，选择启动一个CPU，其它总线上的CPU进入等待状态。

5、主CPU开始执行CS:EIP的代码。

1.2 Qemu对内部寄存器的模拟

Qemu使用了一个叫CPUX86State的结构体来表示CPU的所有状态：

typedef struct CPUX86State {

/* standard registers */

target_ulong regs[CPU_NB_REGS];

target_ulong eip;

target_ulong eflags; /* eflags register. During CPU emulation, CC

flags and DF are set to zero because they are

stored elsewhere */

/* emulator internal eflags handling */

target_ulong cc_src;

target_ulong cc_dst;

uint32_t cc_op;

int32_t df; /* D flag : 1 if D = 0, -1 if D = 1 */

uint32_t hflags; /* TB flags, see HF_xxx constants. These flags

are known at translation time. */

uint32_t hflags2; /* various other flags, see HF2_xxx constants. */

/* segments */

SegmentCache segs[6]; /* selector values */

SegmentCache ldt;

SegmentCache tr;

SegmentCache gdt; /* only base and limit are used */

SegmentCache idt; /* only base and limit are used */

target_ulong cr[5]; /* NOTE: cr1 is unused */

uint64_t a20_mask;

/* FPU state */

unsigned int fpstt; /* top of stack index */

unsigned int fpus;

unsigned int fpuc;

uint8_t fptags[8]; /* 0 = valid, 1 = empty */

union {

CPU86_LDouble d __attribute__((aligned(16)));

MMXReg mmx;

} fpregs[8];

/* emulator internal variables */

float_status fp_status;

CPU86_LDouble ft0;

float_status mmx_status; /* for 3DNow! float ops */

float_status sse_status;

uint32_t mxcsr;

XMMReg xmm_regs[CPU_NB_REGS];

XMMReg xmm_t0;

MMXReg mmx_t0;

target_ulong cc_tmp; /* temporary for rcr/rcl */

/* sysenter registers */

uint32_t sysenter_cs;

target_ulong sysenter_esp;

target_ulong sysenter_eip;

uint64_t efer;

uint64_t star;

uint64_t vm_hsave;

uint64_t vm_vmcb;

uint64_t tsc_offset;

uint64_t intercept;

uint16_t intercept_cr_read;

uint16_t intercept_cr_write;

uint16_t intercept_dr_read;

uint16_t intercept_dr_write;

uint32_t intercept_exceptions;

uint8_t v_tpr;

uint64_t tsc;

uint64_t pat;

/* exception/interrupt handling */

int error_code;

int exception_is_int;

target_ulong exception_next_eip;

target_ulong dr[8]; /* debug registers */

union {

CPUBreakpoint *cpu_breakpoint[4];

CPUWatchpoint *cpu_watchpoint[4];

}; /* break/watchpoints for dr[0..3] */

uint32_t smbase;

int old_exception; /* exception in flight */

CPU_COMMON

/* processor features (e.g. for CPUID insn) */

uint32_t cpuid_level;

uint32_t cpuid_vendor1;

uint32_t cpuid_vendor2;

uint32_t cpuid_vendor3;

uint32_t cpuid_version;

uint32_t cpuid_features;

uint32_t cpuid_ext_features;

uint32_t cpuid_xlevel;

uint32_t cpuid_model[12];

uint32_t cpuid_ext2_features;

uint32_t cpuid_ext3_features;

uint32_t cpuid_apic_id;

/* MTRRs */

uint64_t mtrr_fixed[11];

uint64_t mtrr_deftype;

struct {

uint64_t base;

uint64_t mask;

} mtrr_var[8];

/* For KVM */

uint64_t interrupt_bitmap[256 / 64];

/* in order to simplify APIC support, we leave this pointer to the

user */

struct APICState *apic_state;

} CPUX86State;

每一个寄存都可以在这个结构体中找到相应的成员。当然这个结构体中还包含了一些qemu内部使用的变量。

当虚拟的CPU复位后，qemu会调用一个叫cpu_reset的函数，在这个函数中将这个虚拟CPU的寄存器复位：

/* NOTE: must be called outside the CPU execute loop */

void cpu_reset(CPUX86State *env)

{

int i;

if (qemu_loglevel_mask(CPU_LOG_RESET)) {

qemu_log("CPU Reset (CPU %d)/n", env->cpu_index);

log_cpu_state(env, X86_DUMP_FPU | X86_DUMP_CCOP);

}

memset(env, 0, offsetof(CPUX86State, breakpoints));

tlb_flush(env, 1);

env->old_exception = -1;

/* init to reset state */

#ifdef CONFIG_SOFTMMU

env->hflags |= HF_SOFTMMU_MASK;

#endif

env->hflags2 |= HF2_GIF_MASK;

cpu_x86_update_cr0(env, 0x60000010);

env->a20_mask = ~0x0;

env->smbase = 0x30000;

env->idt.limit = 0xffff;

env->gdt.limit = 0xffff;

env->ldt.limit = 0xffff;

env->ldt.flags = DESC_P_MASK | (2 << DESC_TYPE_SHIFT);

env->tr.limit = 0xffff;

env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);

cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,

DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK);

cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffff,