2. Presented by
Date
Event
Introducing UMEQ
User Mode Emulation QuestRémi Duraffort
Linaro Connect HKG15

3. Who am I?
● Rémi Duraffort (aka ivoire)
● STMicroelectronics assignee
○ working on LAVA
● Open source dev
○ VLC media player (core dev)
○ dvblast, PRoot, v8, …
● … not the umeq developer

4. CEC team @ST
● Compilation Expertise Center
○ Team of compiler writers
● Writing
○ compilers
○ engineering tools
● CI@ST
○ building CI systems for ST

5. What do we need?
● Compiling/testing ARM software
○ ./configure
○ make -j16
○ make test
● Requirements:
1. Reliable
2. Parallelizable
3. Fast

6. Parallelizable
● AArch64 boards are expensive
● x86-64 servers are not
● User mode emulation
○ Run foreign binaries seamlessly on the host
○ Can be multi-threaded
○ No virtual-kernel overhead
○ Use available hardware (OpenGL, …)
● User mode on big servers
○ Massively-parallel validations/tests

7. What’s wrong with QEMU?
● Two modes:
○ system mode: It rocks
○ user mode: “It’s complicated”
● User mode
○ using signal or threads: crashes/hangs/works
○ “QEMU threading support is known to be broken”
■ http://wiki.qemu.org/Testing/LTP

8. Demo
qemu-user + signals

9. UMEQ = User
Mode
Emulation
Quest
Introducing

10. A Quest?

11. “QEMU”.flip()
QEMU
FAST! processor
emulator using
dynamic translation to
achieve good
emulation speed.
“qemu user documentation”
UMEQ
First make it work,
Then make it fast.
“umeq philosophy”

12. Demo
umeq usages

13. UMEQ
● Assumptions
○ Guests: AArch64 (on going: armv7)
○ Host: x86-64
○ Process isolation (in guest rootfs)
■ delegated to PRoot (http://proot.me)
● Release status:
○ βeta
○ sources: TBA

14. What’s working?
● Most programs
○ msgmerge, cmake, gcc, ...
● Threads, signals, graphics
● Debugging (under PRoot)
○ gdb, strace
● Not yet working
○ fpu status registers (not fully correct)

15. Demo
umeq debugging

16. Why does it work?
/me asking umeq developer

17. Architecture (classical)
Disassembler JIT
AArch64
bin
IR
x86-64
bin
instr
instr
...
return
instr
...
...
return

18. Why does it work?
● Simple principles
○ all functions should be reentrant
○ data on stack (IR, JITed code) & thread private
○ no lock in signal handlers
■ one reason why qemu hangs
● Transparent regarding
○ signals (as much as possible)
○ syscalls

19. PTrace emulation
● Debugging
○ with gdb aarch64
○ under umeq
○ thanks to PRoot PTrace emulation
■ UMEQ and PRoot cooperation

20. What’s next?

21. Play with UMEQ ...
● PTrace bug (kernel)
○ http://bugzilla.kernel.org/show_bug.cgi?id=91791
● jemalloc (firefox, thunderbird, …)
○ http://bugzilla.mozilla.org/show_bug.cgi?id=1124580
● binutils (libpython/blender)
○ https://sourceware.org/ml/binutils/2015-
01/msg00144.html
○ was already found (and fixed) by someone else

22. … it’s reliable
● Complex programs
○ vlc, firefox, thunderbird, wesnoth, okular
○ Not working under QEMU
● gcc test suite
○ better results than QEMU
○ threading tests fragile under QEMU
● Debugging
○ strace, gdb, ...

23. Why not inside QEMU?
● Easier to experiment in UMEQ
○ smaller code base
○ written from scratch (second iteration)
● Difficult to do the same in QEMU
○ requires good knowledge of QEMU
○ a lot of time
● But this is feasible ! (will be huge)

24. Questions?
Many thanks to “Monty Python and the Holy Grail”

25. Performance (vs QEMU)
Slowdown
md5sum (100M) 6.77
sha512sum (10M) 7.58
bc (configure/build/install) 1.97
binutils (configure/build/install) 1.91
coreutils (configure/build/install) 1.50
helloworld (build) 1.35
mpg123 (decoding) 1.15