How does QEMU emulate a kernel without a bootloader?

Issue

How does QEMU exactly emulate a kernel? Because a kernel needs a bootloader, but if I run

qemu-system-x86_64 -kernel kern.bin

it emulates a kernel without a bootloader. If it does use a bootloader, which one does it use?

I need to know this because I am working on a simple kernel, and I do not want to write a bootloader myself, because I don't know how to make a bootloader, is it possible to use GRUB on a USB, and will it be able to boot my kernel?

Solution

The behaviour of -kernel varies quite a bit between guest architectures. On some (eg Arm) QEMU loads a kernel by performing the minimum necessary tasks that a guest bootloader would normally do: it loads the file into guest memory, it sets various registers as a Linux kernel requires for startup, and it starts the guest CPU with the program counter pointing at the kernel entry point. (This is sometimes called the "built-in bootloader".)

On x86, it is a bit more complex, because QEMU for x86 guests always automatically runs a BIOS. I haven't looked at the x86 -kernel support in detail, and it probably has some complicated special cases, but the basic approach is:

• QEMU loads the data from the specified file, but not into guest memory
• the guest machine has a special device called 'fw-cfg' which acts as a communication channel between QEMU and guest code
• the BIOS that runs in the guest ('seabios') knows it is running on QEMU and it knows how to talk to the fw-cfg device
• the BIOS asks via the fw-cfg device "what files do you have?", and QEMU says "I have this kern.bin"
• the BIOS reads the kernel file data via the fw-cfg device into guest memory
• the BIOS starts the kernel (setting any necessary registers or other guest CPU state, and jumping to its entry point)

The effect is the same ("get this file into guest RAM, do what we need to set the environment up the way that the kernel documents it needs to be started, jump to its entry point"), but much more work is done by guest BIOS code rather than directly by QEMU.

Answered By - Peter Maydell