principle of QEMU CPU emulation

Question

In QEMU, an operating system can run above software emulated CPU. How can be a CPU emulated by software? I want to know about detail.

If CPU is emulated by software does registers are emulated with host system memory?

Let say there is ARM assembly code

LDRB r0, [r1], #1

How can this be emulated in x86 environment?

My guess is that emulating software keeps memory mapping space for r0 (4 bytes), r1 (4 bytes) and then updates the register value for corresponding memory location... Am I wrong?

Answer 1

Please see this file for the C-level modelling of the state of an ARM CPU as done by QEMU.

It's pretty straight-forward, and (of course) as you suspect the registers (and all other state) are modelled as C variables.

The core structure begins:

typedef struct CPUARMState {
    /* Regs for current mode.  */
    uint32_t regs[16];
   /* Frequently accessed CPSR bits are stored separately for efficiency.
      This contains all the other bits.  Use cpsr_{read,write} to access
      the whole CPSR.  */
   uint32_t uncached_cpsr;
   uint32_t spsr;