Document the dlcall plugin under Example Plugins: what it does, the trusted- guests and guest_base == 0 constraints, how to load it, and a pointer to Lorelei, one end-to-end userspace implementation, for prebuilt thunks and a runnable example.
Signed-off-by: Ziyang Zhang <[email protected]> --- docs/about/emulation.rst | 86 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst index 3b4c365933..8528cc7444 100644 --- a/docs/about/emulation.rst +++ b/docs/about/emulation.rst @@ -1046,6 +1046,92 @@ Count traps This plugin counts the number of interrupts (asynchronous events), exceptions (synchronous events) and host calls (e.g. semihosting) per cpu. +Dynamic Linking Call +.................... + +``contrib/plugins/dlcall.c`` + +This plugin provides a dynamic linking function call interception mechanism +for linux-user guests: the guest hands a call off to the host, where the plugin +runs native code in its place instead of the guest emulating it. Interception +alone enables several uses, for instance tracing or auditing guest calls. +One use is acceleration by leveraging the host's native shared libraries. For +example, a thunk layer can run the stock zlib ``minizip`` utility under +emulation while forwarding its ``deflate`` calls to the host's native zlib +library (libz). This avoids emulating those selected library calls instruction +by instruction. + +The guest issues a reserved "magic" system call (4096 by default, configurable +with ``syscall_num=N``) whose first argument selects a pass-through operation: +dlopen/dlclose a host library, dlsym a symbol, and invoke a resolved host +function. The plugin performs the operation on the host and consumes the +syscall, so the real kernel never sees it. + +.. warning:: + + Trusted guests only. The guest can load arbitrary host libraries and run + arbitrary code in the QEMU host process. The plugin is not a sandbox and + provides no isolation. It also requires ``guest_base == 0`` (qemu-user's + default), as guest pointers are dereferenced as host addresses with no + translation. + +The plugin intentionally keeps the QEMU side lightweight and knows nothing +about any particular library or its calling convention. Turning a real library +into working thunks, including argument marshalling, callbacks and variadic +functions, is done entirely in userspace, and any toolchain can implement the +interface. + +Loading the plugin is all that is required from QEMU's side: + +.. code-block:: shell + + qemu-x86_64 -plugin contrib/plugins/libdlcall.so <guest-program> ... + +`Lorelei <https://github.com/rover2024/lorelei>`_ is one end-to-end userspace +implementation of this: it provides the guest and host runtimes and an +automated toolchain that generates the thunks from a library's headers, to +accelerate execution over native libraries. Its prebuilt thunks are for an +x86_64 guest, running on an x86_64, aarch64 or riscv64 host. + +A minimal end-to-end example wraps a one-function library: + +.. code-block:: c + + void hello(const char *name, int lucky); + +In Lorelei a short manifest describes it: + +.. code-block:: toml + + dir = "hello" + project = "hello" + + [symbols] + lib = "libhello.so" # dump its exported symbols from here + + [desc] + headers = ["hello.h"] # parse these for the signatures + +The toolchain turns that into the guest and host thunks, and an ordinary x86_64 +program that calls ``hello()`` then runs over them under the plugin. See the +runnable +`hello <https://github.com/rover2024/lorelei-thunks/tree/main/examples/hello>`_ +(minimal) and +`demo <https://github.com/rover2024/lorelei-thunks/tree/main/examples/demo>`_ +(variadic functions and a callback that reenters the guest) examples, and +`Lorelei <https://github.com/rover2024/lorelei>`_ for prebuilt thunk trees and +the runtime environment they expect. + +.. list-table:: Dynamic Linking Call arguments + :widths: 20 80 + :header-rows: 1 + + * - Option + - Description + * - syscall_num=N + - The magic syscall number the guest issues (default 4096). Must be high + enough not to clash with a real syscall. + Other emulation features ------------------------ -- 2.34.1
