Platform emulation with Bochs

Bochs is an x86 PC emulator and debugger licensed under the lesser GNU Public License (GPL). The platform provides emulation of an entire PC platform, including one or more processors and various PC peripherals, such as hard disks, display, CD-ROM drives, and other common peripherals. You can use Bochs to run operating systems targeted for PC platforms, and it's also an ideal application for operating system development (because crashes of the operating system under development can be isolated within the guest in addition to the debugging capabilities that Bochs provides). Bochs accomplishes this through emulation, but it comes at the cost of performance.

Let's take a quick detour and understand the difference between emulation and the more common virtualization methods available today.

Platform emulation

Bochs is a platform emulator, which means that it's not actually virtualization in the modern sense but rather a simulation. In virtualization, the hypervisor and virtual machines (VMs) execute on the bare-metal hardware (with the hypervisor creating the environment to share the hardware amongst the VMs, commonly through hardware instructions). This process is commonly called direct execution, because the instructions are executed directly by the host processor. This type of virtualization uses support from modern-day processors (such as Intel Virtualization Technology for x86 [VT-x] or AMD virtualization [AMD-V]). Emulation commonly provides a layer between the VM and the underlying hardware and operating system to create the illusion of the desired platform environment as shown in Figure 1.

Figure 1. Virtualization vs. emulation
Image showing the difference between virtualization and emulation
Image showing the difference between virtualization and emulation

Emulation also commonly interprets the instructions of the guest VM (compared to virtualization, where the instruction set architecture of the guests must be the same as the host). This creates an interesting advantage for emulation, where the guest VM platform can be entirely different from the host (for example, running an x86 guest on an IBM® PowerPC® target).

Another interesting advantage of emulation is that there is complete control of the environment, which makes it easy to pause the entire machine to inspect its state as well as introduce any kind of fault into the emulation to test an operating system's error tree. This functionality comes at the cost of performance, but it's a real benefit for this type of environment. In addition, the emulator provides a true isolation of the guest from the host. In this way, emulators can provide complete transparency of the environment.

Emulation performance

There are cases where emulation can be used in performance architectures. One example is the code-morphing technology created by Transmeta. Transmeta's processor was a very long instruction word (VLIW) super-scalar architecture that could emulate x86 code sequences. It did so through either emulation or dynamic compilation of code sequences (similar to the capabilities of QEMU). Transmeta opened its doors in 1995, and then closed them in late 2007.

Other examples include Java technology, which is interpreted from Java bytecodes to the underlying architecture of the host. Java technology implements just-in-time (JIT) compilation to work around some of the inefficiencies, similar to Transmeta and numerous other emulation solutions (including QEMU, another platform emulation solution similar to Bochs). But Bochs also achieves efficient emulation (up to 100 million instructions per second [MIPS] on a modern processor) while also being portable. Bochs was developed purely in the C++ language for interpreted x86 instruction execution and platform emulation.

Bochs implementation

Now, let's explore some of the internals of Bochs to understand how it achieves useful performance in a pure C++ implementation. This article focuses on two aspects of emulation: the CPU (instruction set architecture [ISA] emulation) and devices.

CPU emulation

Bochs is unique in its method for emulation. Although other solutions offer direct execution or JIT compilation, Bochs implements pure emulation of the CPU ISA (including support for x86 and x86-64 CPU emulation with up to eight CPUs in a symmetric multiprocessing configuration). Bochs provides emulation of a real CPU, even to the level of emulating the CPU's fetch-decode-execute flow.

In the flow stage, Bochs performs permissions checks, and then fetches the opcode. In the decode stage, Bochs decodes the fetched x86 instruction into an internal representation. It also maintains an instruction cache for improved performance by storing the "micro operations" of the original x86 system (which can be fetched later without the overhead of decoding). Finally, in the execute stage, Bochs performs a number of operations around execution of the specific instruction (including calculating effective addresses for operands, and then performing an indirect call to the particular instruction execution method). When the instruction has been executed, any affected registers and flags can be updated (as appropriate). Bochs provides an optimization here called lazy flags update to calculate the arithmetic flags only when they're required (instead of updating at each step).

Outside of the fetch-decode-execute flow, Bochs also manages external events such as device interrupts and other necessary features like byte-swapping and other privileged checks. In addition to the generic x86 CPU, Bochs implements a number of CPU features, such as the Intel Pentium Processor with MMX technology; Intel's Streaming Single Instruction, Multiple Data Extensions 2 (SSE2); and AMD 3DNow! instructions.

Bochs's internal instruction cache provides a nice trade-off to traditional JIT compilation. Although JIT compilation provides some advantages for speeding up execution, it does so at the cost of larger amounts of memory.

Device emulation

Bochs provides an emulation of the PC platform, with the device emulation based on the device type. For example, the keyboard is a physical device shared between the host and guest, but the disk is shared through an emulation, where the guest disk is a file on the host disk's file system.

Bochs provides a useful list of emulated hardware, including memory, an NE2000 Ethernet card, Cirrus Logic video card (PCI or ISA), Intel 440FX PCI chipset, BIOS, USB root hub, Sound Blaster sound card, and disk and floppy controllers. Like the CPU, these devices are emulated as well, which can introduce considerable overhead in the path. For example, when a driver communicates with hardware, it manipulates registers to request some desired operation of the device. In an emulated platform, the registers and memory that represent the device are emulated. When the guest operating system's driver peeks and pokes at the memory and hardware registers, software exists underneath to emulate the device (see Figure 2). Beyond that emulated interface, the device emulation must then perform the desired operation, which implies an emulation of the device and potentially communication with a physical device in the host platform (such as the physical network interface card [NIC] or physical disk).

Figure 2. Device virtualization through emulation
Image showing device virtualization through emulation
Image showing device virtualization through emulation

Using Bochs

Bochs and its utilities are quite simple to use for emulating a variety of guest operating systems. This example demonstrates the emulation of the Plan 9 from Bell Labs operating system.

Installing Bochs

First, you must install Bochs if it's not already available on your system. For my Ubuntu system, I use the apt package manager to install the necessary packages:

$ sudo apt-get install bochs
$ sudo apt-get install bochs-x

This command installs the Bochs IA-32/64 PC emulator and the X-11 emulator for Bochs.

Prepare for a Plan 9 installation

To emulate Plan 9 on Bochs, you need two more things for your virtualized environment: a CD-ROM containing the Plan 9 installation image and a virtual hard disk (VHD) as the target for your installation.

First, get the Plan 9 image from the Bell Labs site, as indicated by the following command line:

$ wget
$ bunzip2 plan9.iso.bz2

The plan9 image is an ISO format file that can be interpreted using the ISO 9660 format (as an emulation of a CD-ROM drive, which you'll see shortly).

The next step is to create your VHD. Recall that this will be a file on the host operating system. Bochs provides a special utility to create this file called bximage. The bximage utility is interactive and allows you to specify a number of options for how the file is created and managed. Listing 1 provides the session to create the VHD. After invoking bximage, you specify that you want to create a hard disk image (rather than a floppy image). Bochs can support a number of image types, but for performance, request flat, because no run time dynamic growth will be necessary. The Plan 9 operating system requires a significant amount of space for its installation, so specify a 700MB disk followed by the name of the hard disk file (c.img).

Listing 1. Creating the VHD image for Bochs using bximage
$ bximage
                  Disk Image Creation Tool for Bochs
        $Id: bximage.c,v 1.34 2009/04/14 09:45:22 sshwarts Exp $

Do you want to create a floppy disk image or a hard disk image?
Please type hd or fd. [hd] 

What kind of image should I create?
Please type flat, sparse or growing. [flat] 

Enter the hard disk size in megabytes, between 1 and 129023
[10] 400

I will create a 'flat' hard disk image with
  sectors per track=63
  total sectors=1433376
  total size=699.89 megabytes

What should I name the image?

Writing: [] Done.

I wrote 314302464 bytes to c.img.

The following line should appear in your bochsrc:
  ata0-master: type=disk, path="c.img", mode=flat, cylinders=1422, heads=16, spt=63
$ ls -la c.img
-rw-r--r-- 1 mtj mtj 733888512 2010-12-19 14:30 c.img

Install Plan 9

With your CD-ROM image and hard disk image in hand, the next step is to create your Bochs configuration file. This file defines how the Bochs emulation should be performed while specifying where to find key aspects of the environment (ISO file, hard disk image, and so on). The bochsrc configuration file is shown in Listing 2. This file defines an x86 platform with 128MB of RAM, a mouse, default Extended Graphics Array display, a hard disk (defined as ata0-master, created through bximage), a CD-ROM (defined as ata1-master, pointed to your downloaded plan9.iso file), a log file for Bochs output (bochsout.txt), and the default boot device of the CD-ROM.

Listing 2. The bochsrc configuration file
# bochsrc
megs: 128
mouse: enabled=1
ata0-master: type=disk, path="c.img", mode=flat, cylinders=609, heads=16, spt=63
ata1-master: type=cdrom, path=./plan9.iso, status=inserted
log: bochsout.txt
boot: cdrom

Bochs provides a large number of options expressible through the configuration file. These options can define which devices are available on the platform or the types of options expressed (for example, individual CPU configurations such as SSE or the Advanced Encryption Standard extension).

To begin the installation of Plan 9 to Bochs, start Bochs with the -q option (to skip the start menu) in the same directory as your disk image, ISO image, and bochsrc file:

$ bochs -q

This command creates a new window representing the emulated platform, which is shown in Figure 3. As shown, the emulator has recognized your disk and CD-ROM and has booted the CD to begin Plan 9 operating system installation.

Figure 3. Starting Bochs (installation of the Plan 9 operating system)
Starting Bochs (installation of the Plan 9 operating system)
Starting Bochs (installation of the Plan 9 operating system)

As the installation continues, Plan 9 goes through a variety of configuration and installation steps. Figure 4 shows the setup of the disk (for partitioning).

Figure 4. Installing the Plan 9 operating system
Image showing installation of the Plan 9 operating system
Image showing installation of the Plan 9 operating system

The windowing system used in these examples is Plan 9's rio. Rio was an interesting windowing system with some unique attributes. For example, a window in rio was its own private namespace and exported a file system interface to applications running in the operating system (allowing rio to run within a rio window). Rio predated the X windowing system for UNIX and provided a technical foundation for windowing systems that followed it.

When the lengthy installation is complete, the emulation machine is stopped and the bochsrc file updated to boot from the disk (boot: disk). Note that at the top of the window (see Figure 5) is the Bochs control showing the elements that are active (CD-ROM, mouse) and a set of controls on the right (to reset, suspend, or power off the emulated machine).

Figure 5. Plan 9 running in the context of Bochs
Image showing the Plan 9 operating system running in the context of Bochs
Image showing the Plan 9 operating system running in the context of Bochs

Running other operating systems

One of the joys of emulation is the ability to easily run other operating systems in a quick and simple way. You can find a list of disk images at the Bochs site (see Related topics) to try some other operating systems, such as FreeDOS, DLX Linux (10MB Linux image), OpenBSD, GNU/Hurd, and KNOPPIX. Figure 6 shows the FreeDOS kernel booting on Bochs.

Figure 6. Running FreeDOS on Bochs
Image showing the FreeDOS operating system running on Bochs
Image showing the FreeDOS operating system running on Bochs

FreeDOS is a project that was created after Microsoft announced that it would no longer produce MS-DOS and is used by a number of companies under the GPL.

Other emulation platforms

Although Bochs is a useful application for platform emulation, other solutions provide similar capabilities. QEMU is one of the most popular, as it provides not only PC-compatible platform emulation but a variety of other processor architectures, as well (ARM, PowerPC, and others).

Other specialized platforms include the SPIM (a MIPS processor simulator) and the computer history simulation project, which provides platform emulation of a number of historically significant computing systems (Altair, VAX 11/780, IBM 1130, and more).

Going further

Bochs is a great platform emulator for executing older operating systems, but it's also an ideal platform for developing operating systems. Bochs provides efficient platform emulation and debugging capabilities that are not easily provided on raw hardware (including a full-featured graphical debugger). Nothing beats real hardware for software testing, but Bochs can provide a useful development environment that is portable across a variety of x86 and non-x86 hosts.

Downloadable resources

Related topics

  • Visit the Bochs Web site for the latest version of Bochs as well as news, documentation, sample disk images, and access to the mailing list to resolve any issues you may encounter. You can also enter a bug report at the site.
  • Read the paper "Virtualization Without Direct Execution or Jitting: Designing a Portable Virtual Machine Infrastructure," by Darek Mihocka and Stanislav Shwartsman, to get the gory details of Bochs and learn how it provides an efficient platform without direct execution.
  • Transmeta Corporation (see the Transmeta page on Wikipedia) developed code morphing technology that translated x86 instructions into the native VLIW for execution. Read more about VLIW architectures and the CPU architectures that use them on the VLIW architectures page on Wikipedia.
  • "How To Write a Computer Emulator," by Marat Fayzullin, nicely introduces the topic and also explores how CPU emulation is implemented along with emulation of other aspects, such as memory.
  • The Plan 9 operating system was created by Bell Labs in the 1980s as a research operating system and successor to UNIX. Plan 9 represented all system interfaces as files instead of special devices. It continues to be developed for research and in the hobbyist community. Learn more about Plan 9's windowing system, rio, in this presentation from Rob Pike. For those who'd like to experiment with Plan 9's applications on their favorite operating system (like Linux), Plan 9 from User Space provides a user space implementation of many of the significant components.
  • In the developerWorks Linux zone, find hundreds of how-to articles and tutorials, as well as downloads, discussion forums, and a wealth of other resources for Linux developers and administrators.
  • Evaluate IBM products in the way that suits you best: Download a product trial, try a product online, use a product in a cloud environment.
  • Follow developerWorks on Twitter, or subscribe to a feed of Linux tweets on developerWorks.
ArticleTitle=Platform emulation with Bochs