Commit debc70650a973b0c67bd8ea69f8887cd41961ba8
1 parent
985d1742
Enhanced Documentation (Stefan Weil)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1873 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
2 changed files
with
236 additions
and
40 deletions
qemu-doc.texi
1 | 1 | \input texinfo @c -*- texinfo -*- |
2 | +@c %**start of header | |
3 | +@setfilename qemu-doc.info | |
4 | +@settitle QEMU CPU Emulator User Documentation | |
5 | +@exampleindent 0 | |
6 | +@paragraphindent 0 | |
7 | +@c %**end of header | |
2 | 8 | |
3 | 9 | @iftex |
4 | -@settitle QEMU CPU Emulator User Documentation | |
5 | 10 | @titlepage |
6 | 11 | @sp 7 |
7 | -@center @titlefont{QEMU CPU Emulator User Documentation} | |
12 | +@center @titlefont{QEMU CPU Emulator} | |
13 | +@sp 1 | |
14 | +@center @titlefont{User Documentation} | |
8 | 15 | @sp 3 |
9 | 16 | @end titlepage |
10 | 17 | @end iftex |
11 | 18 | |
19 | +@ifnottex | |
20 | +@node Top | |
21 | +@top | |
22 | + | |
23 | +@menu | |
24 | +* Introduction:: | |
25 | +* Installation:: | |
26 | +* QEMU PC System emulator:: | |
27 | +* QEMU System emulator for non PC targets:: | |
28 | +* QEMU Linux User space emulator:: | |
29 | +* compilation:: Compilation from the sources | |
30 | +* Index:: | |
31 | +@end menu | |
32 | +@end ifnottex | |
33 | + | |
34 | +@contents | |
35 | + | |
36 | +@node Introduction | |
12 | 37 | @chapter Introduction |
13 | 38 | |
39 | +@menu | |
40 | +* intro_features:: Features | |
41 | +@end menu | |
42 | + | |
43 | +@node intro_features | |
14 | 44 | @section Features |
15 | 45 | |
16 | 46 | QEMU is a FAST! processor emulator using dynamic translation to |
... | ... | @@ -52,27 +82,53 @@ For system emulation, the following hardware targets are supported: |
52 | 82 | |
53 | 83 | For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported. |
54 | 84 | |
85 | +@node Installation | |
55 | 86 | @chapter Installation |
56 | 87 | |
57 | 88 | If you want to compile QEMU yourself, see @ref{compilation}. |
58 | 89 | |
90 | +@menu | |
91 | +* install_linux:: Linux | |
92 | +* install_windows:: Windows | |
93 | +* install_mac:: Macintosh | |
94 | +@end menu | |
95 | + | |
96 | +@node install_linux | |
59 | 97 | @section Linux |
60 | 98 | |
61 | 99 | If a precompiled package is available for your distribution - you just |
62 | 100 | have to install it. Otherwise, see @ref{compilation}. |
63 | 101 | |
102 | +@node install_windows | |
64 | 103 | @section Windows |
65 | 104 | |
66 | 105 | Download the experimental binary installer at |
67 | -@url{http://www.free.oszoo.org/download.html}. | |
106 | +@url{http://www.free.oszoo.org/@/download.html}. | |
68 | 107 | |
108 | +@node install_mac | |
69 | 109 | @section Mac OS X |
70 | 110 | |
71 | 111 | Download the experimental binary installer at |
72 | -@url{http://www.free.oszoo.org/download.html}. | |
112 | +@url{http://www.free.oszoo.org/@/download.html}. | |
73 | 113 | |
114 | +@node QEMU PC System emulator | |
74 | 115 | @chapter QEMU PC System emulator |
75 | 116 | |
117 | +@menu | |
118 | +* pcsys_introduction:: Introduction | |
119 | +* pcsys_quickstart:: Quick Start | |
120 | +* sec_invocation:: Invocation | |
121 | +* pcsys_keys:: Keys | |
122 | +* pcsys_monitor:: QEMU Monitor | |
123 | +* disk_images:: Disk Images | |
124 | +* pcsys_network:: Network emulation | |
125 | +* direct_linux_boot:: Direct Linux Boot | |
126 | +* pcsys_usb:: USB emulation | |
127 | +* gdb_usage:: GDB usage | |
128 | +* pcsys_os_specific:: Target OS specific information | |
129 | +@end menu | |
130 | + | |
131 | +@node pcsys_introduction | |
76 | 132 | @section Introduction |
77 | 133 | |
78 | 134 | @c man begin DESCRIPTION |
... | ... | @@ -118,6 +174,7 @@ QEMU uses YM3812 emulation by Tatsuyuki Satoh. |
118 | 174 | |
119 | 175 | @c man end |
120 | 176 | |
177 | +@node pcsys_quickstart | |
121 | 178 | @section Quick Start |
122 | 179 | |
123 | 180 | Download and uncompress the linux image (@file{linux.img}) and type: |
... | ... | @@ -147,14 +204,14 @@ Select the emulated machine (@code{-M ?} for list) |
147 | 204 | |
148 | 205 | @item -fda file |
149 | 206 | @item -fdb file |
150 | -Use @var{file} as floppy disk 0/1 image (@xref{disk_images}). You can | |
207 | +Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can | |
151 | 208 | use the host floppy by using @file{/dev/fd0} as filename. |
152 | 209 | |
153 | 210 | @item -hda file |
154 | 211 | @item -hdb file |
155 | 212 | @item -hdc file |
156 | 213 | @item -hdd file |
157 | -Use @var{file} as hard disk 0, 1, 2 or 3 image (@xref{disk_images}). | |
214 | +Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}). | |
158 | 215 | |
159 | 216 | @item -cdrom file |
160 | 217 | Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and |
... | ... | @@ -168,7 +225,7 @@ the default. |
168 | 225 | @item -snapshot |
169 | 226 | Write to temporary files instead of disk image files. In this case, |
170 | 227 | the raw disk image you use is not written back. You can however force |
171 | -the write back by pressing @key{C-a s} (@xref{disk_images}). | |
228 | +the write back by pressing @key{C-a s} (@pxref{disk_images}). | |
172 | 229 | |
173 | 230 | @item -m megs |
174 | 231 | Set virtual RAM size to @var{megs} megabytes. Default is 128 MB. |
... | ... | @@ -304,9 +361,12 @@ specifies an already opened TCP socket. |
304 | 361 | Example: |
305 | 362 | @example |
306 | 363 | # launch a first QEMU instance |
307 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,listen=:1234 | |
308 | -# connect the VLAN 0 of this instance to the VLAN 0 of the first instance | |
309 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,connect=127.0.0.1:1234 | |
364 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | |
365 | + -net socket,listen=:1234 | |
366 | +# connect the VLAN 0 of this instance to the VLAN 0 | |
367 | +# of the first instance | |
368 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ | |
369 | + -net socket,connect=127.0.0.1:1234 | |
310 | 370 | @end example |
311 | 371 | |
312 | 372 | @item -net socket[,vlan=n][,fd=h][,mcast=maddr:port] |
... | ... | @@ -328,17 +388,22 @@ mcast support is compatible with User Mode Linux (argument @option{eth@var{N}=mc |
328 | 388 | Example: |
329 | 389 | @example |
330 | 390 | # launch one QEMU instance |
331 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=230.0.0.1:1234 | |
391 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | |
392 | + -net socket,mcast=230.0.0.1:1234 | |
332 | 393 | # launch another QEMU instance on same "bus" |
333 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,mcast=230.0.0.1:1234 | |
394 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ | |
395 | + -net socket,mcast=230.0.0.1:1234 | |
334 | 396 | # launch yet another QEMU instance on same "bus" |
335 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:58 -net socket,mcast=230.0.0.1:1234 | |
397 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:58 \ | |
398 | + -net socket,mcast=230.0.0.1:1234 | |
336 | 399 | @end example |
337 | 400 | |
338 | 401 | Example (User Mode Linux compat.): |
339 | 402 | @example |
340 | -# launch QEMU instance (note mcast address selected is UML's default) | |
341 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=239.192.168.1:1102 | |
403 | +# launch QEMU instance (note mcast address selected | |
404 | +# is UML's default) | |
405 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | |
406 | + -net socket,mcast=239.192.168.1:1102 | |
342 | 407 | # launch UML |
343 | 408 | /path/to/linux ubd0=/path/to/root_fs eth0=mcast |
344 | 409 | @end example |
... | ... | @@ -471,7 +536,7 @@ The default device is @code{vc} in graphical mode and @code{stdio} in |
471 | 536 | non graphical mode. |
472 | 537 | |
473 | 538 | @item -s |
474 | -Wait gdb connection to port 1234 (@xref{gdb_usage}). | |
539 | +Wait gdb connection to port 1234 (@pxref{gdb_usage}). | |
475 | 540 | @item -p port |
476 | 541 | Change gdb connection port. |
477 | 542 | @item -S |
... | ... | @@ -494,6 +559,7 @@ Start right away with a saved state (@code{loadvm} in monitor) |
494 | 559 | |
495 | 560 | @c man end |
496 | 561 | |
562 | +@node pcsys_keys | |
497 | 563 | @section Keys |
498 | 564 | |
499 | 565 | @c man begin OPTIONS |
... | ... | @@ -542,9 +608,6 @@ Send Ctrl-a |
542 | 608 | |
543 | 609 | @ignore |
544 | 610 | |
545 | -@setfilename qemu | |
546 | -@settitle QEMU System Emulator | |
547 | - | |
548 | 611 | @c man begin SEEALSO |
549 | 612 | The HTML documentation of QEMU for more precise information and Linux |
550 | 613 | user mode emulator invocation. |
... | ... | @@ -556,8 +619,7 @@ Fabrice Bellard |
556 | 619 | |
557 | 620 | @end ignore |
558 | 621 | |
559 | -@end ignore | |
560 | - | |
622 | +@node pcsys_monitor | |
561 | 623 | @section QEMU Monitor |
562 | 624 | |
563 | 625 | The QEMU monitor is used to give complex commands to the QEMU |
... | ... | @@ -683,7 +745,7 @@ Dump 10 instructions at the current instruction pointer: |
683 | 745 | |
684 | 746 | @item |
685 | 747 | Dump 80 16 bit values at the start of the video memory. |
686 | -@example | |
748 | +@smallexample | |
687 | 749 | (qemu) xp/80hx 0xb8000 |
688 | 750 | 0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42 |
689 | 751 | 0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41 |
... | ... | @@ -695,7 +757,7 @@ Dump 80 16 bit values at the start of the video memory. |
695 | 757 | 0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
696 | 758 | 0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
697 | 759 | 0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
698 | -@end example | |
760 | +@end smallexample | |
699 | 761 | @end itemize |
700 | 762 | |
701 | 763 | @item p or print/fmt expr |
... | ... | @@ -746,6 +808,14 @@ Since version 0.6.1, QEMU supports many disk image formats, including |
746 | 808 | growable disk images (their size increase as non empty sectors are |
747 | 809 | written), compressed and encrypted disk images. |
748 | 810 | |
811 | +@menu | |
812 | +* disk_images_quickstart:: Quick start for disk image creation | |
813 | +* disk_images_snapshot_mode:: Snapshot mode | |
814 | +* qemu_img_invocation:: qemu-img Invocation | |
815 | +* disk_images_fat_images:: Virtual FAT disk images | |
816 | +@end menu | |
817 | + | |
818 | +@node disk_images_quickstart | |
749 | 819 | @subsection Quick start for disk image creation |
750 | 820 | |
751 | 821 | You can create a disk image with the command: |
... | ... | @@ -756,8 +826,9 @@ where @var{myimage.img} is the disk image filename and @var{mysize} is its |
756 | 826 | size in kilobytes. You can add an @code{M} suffix to give the size in |
757 | 827 | megabytes and a @code{G} suffix for gigabytes. |
758 | 828 | |
759 | -@xref{qemu_img_invocation} for more information. | |
829 | +See @ref{qemu_img_invocation} for more information. | |
760 | 830 | |
831 | +@node disk_images_snapshot_mode | |
761 | 832 | @subsection Snapshot mode |
762 | 833 | |
763 | 834 | If you use the option @option{-snapshot}, all disk images are |
... | ... | @@ -771,6 +842,7 @@ command (or @key{C-a s} in the serial console). |
771 | 842 | |
772 | 843 | @include qemu-img.texi |
773 | 844 | |
845 | +@node disk_images_fat_images | |
774 | 846 | @subsection Virtual FAT disk images |
775 | 847 | |
776 | 848 | QEMU can automatically create a virtual FAT disk image from a |
... | ... | @@ -805,6 +877,7 @@ What you should @emph{never} do: |
805 | 877 | @item write to the FAT directory on the host system while accessing it with the guest system. |
806 | 878 | @end itemize |
807 | 879 | |
880 | +@node pcsys_network | |
808 | 881 | @section Network emulation |
809 | 882 | |
810 | 883 | QEMU can simulate several networks cards (NE2000 boards on the PC |
... | ... | @@ -908,10 +981,10 @@ seen from the emulated kernel at IP address 172.20.0.1. |
908 | 981 | |
909 | 982 | @item Launch @code{qemu.sh}. You should have the following output: |
910 | 983 | |
911 | -@example | |
984 | +@smallexample | |
912 | 985 | > ./qemu.sh |
913 | 986 | Connected to host network interface: tun0 |
914 | -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
987 | +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
915 | 988 | BIOS-provided physical RAM map: |
916 | 989 | BIOS-e801: 0000000000000000 - 000000000009f000 (usable) |
917 | 990 | BIOS-e801: 0000000000100000 - 0000000002000000 (usable) |
... | ... | @@ -920,7 +993,7 @@ On node 0 totalpages: 8192 |
920 | 993 | zone(0): 4096 pages. |
921 | 994 | zone(1): 4096 pages. |
922 | 995 | zone(2): 0 pages. |
923 | -Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe console=ttyS0 | |
996 | +Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe @/ide5=noprobe console=ttyS0 | |
924 | 997 | ide_setup: ide2=noprobe |
925 | 998 | ide_setup: ide3=noprobe |
926 | 999 | ide_setup: ide4=noprobe |
... | ... | @@ -929,7 +1002,7 @@ Initializing CPU#0 |
929 | 1002 | Detected 2399.621 MHz processor. |
930 | 1003 | Console: colour EGA 80x25 |
931 | 1004 | Calibrating delay loop... 4744.80 BogoMIPS |
932 | -Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, 0k highmem) | |
1005 | +Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, @/0k highmem) | |
933 | 1006 | Dentry cache hash table entries: 4096 (order: 3, 32768 bytes) |
934 | 1007 | Inode cache hash table entries: 2048 (order: 2, 16384 bytes) |
935 | 1008 | Mount cache hash table entries: 512 (order: 0, 4096 bytes) |
... | ... | @@ -971,14 +1044,14 @@ EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended |
971 | 1044 | VFS: Mounted root (ext2 filesystem). |
972 | 1045 | Freeing unused kernel memory: 64k freed |
973 | 1046 | |
974 | -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
1047 | +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
975 | 1048 | |
976 | 1049 | QEMU Linux test distribution (based on Redhat 9) |
977 | 1050 | |
978 | 1051 | Type 'exit' to halt the system |
979 | 1052 | |
980 | 1053 | sh-2.05b# |
981 | -@end example | |
1054 | +@end smallexample | |
982 | 1055 | |
983 | 1056 | @item |
984 | 1057 | Then you can play with the kernel inside the virtual serial console. You |
... | ... | @@ -1028,6 +1101,7 @@ Lawton for the plex86 Project (@url{www.plex86.org}). |
1028 | 1101 | |
1029 | 1102 | @end enumerate |
1030 | 1103 | |
1104 | +@node pcsys_usb | |
1031 | 1105 | @section USB emulation |
1032 | 1106 | |
1033 | 1107 | QEMU emulates a PCI UHCI USB controller and a 8 port USB hub connected |
... | ... | @@ -1111,7 +1185,8 @@ QEMU has a primitive support to work with gdb, so that you can do |
1111 | 1185 | In order to use gdb, launch qemu with the '-s' option. It will wait for a |
1112 | 1186 | gdb connection: |
1113 | 1187 | @example |
1114 | -> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda" | |
1188 | +> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \ | |
1189 | + -append "root=/dev/hda" | |
1115 | 1190 | Connected to host network interface: tun0 |
1116 | 1191 | Waiting gdb connection on port 1234 |
1117 | 1192 | @end example |
... | ... | @@ -1143,6 +1218,7 @@ Use @code{set architecture i8086} to dump 16 bit code. Then use |
1143 | 1218 | @code{x/10i $cs*16+*eip} to dump the code at the PC position. |
1144 | 1219 | @end enumerate |
1145 | 1220 | |
1221 | +@node pcsys_os_specific | |
1146 | 1222 | @section Target OS specific information |
1147 | 1223 | |
1148 | 1224 | @subsection Linux |
... | ... | @@ -1229,12 +1305,22 @@ it takes host CPU cycles even when idle. You can install the utility |
1229 | 1305 | from @url{http://www.vmware.com/software/dosidle210.zip} to solve this |
1230 | 1306 | problem. |
1231 | 1307 | |
1308 | +@node QEMU System emulator for non PC targets | |
1232 | 1309 | @chapter QEMU System emulator for non PC targets |
1233 | 1310 | |
1234 | 1311 | QEMU is a generic emulator and it emulates many non PC |
1235 | 1312 | machines. Most of the options are similar to the PC emulator. The |
1236 | 1313 | differences are mentionned in the following sections. |
1237 | 1314 | |
1315 | +@menu | |
1316 | +* QEMU PowerPC System emulator:: | |
1317 | +* Sparc32 System emulator invocation:: | |
1318 | +* Sparc64 System emulator invocation:: | |
1319 | +* MIPS System emulator invocation:: | |
1320 | +* ARM System emulator invocation:: | |
1321 | +@end menu | |
1322 | + | |
1323 | +@node QEMU PowerPC System emulator | |
1238 | 1324 | @section QEMU PowerPC System emulator |
1239 | 1325 | |
1240 | 1326 | Use the executable @file{qemu-system-ppc} to simulate a complete PREP |
... | ... | @@ -1299,6 +1385,7 @@ Set the initial VGA graphic mode. The default is 800x600x15. |
1299 | 1385 | More information is available at |
1300 | 1386 | @url{http://perso.magic.fr/l_indien/qemu-ppc/}. |
1301 | 1387 | |
1388 | +@node Sparc32 System emulator invocation | |
1302 | 1389 | @section Sparc32 System emulator invocation |
1303 | 1390 | |
1304 | 1391 | Use the executable @file{qemu-system-sparc} to simulate a JavaStation |
... | ... | @@ -1327,7 +1414,7 @@ Floppy drive |
1327 | 1414 | The number of peripherals is fixed in the architecture. |
1328 | 1415 | |
1329 | 1416 | QEMU uses the Proll, a PROM replacement available at |
1330 | -@url{http://people.redhat.com/zaitcev/linux/}. The required | |
1417 | +@url{http://people.redhat.com/@/zaitcev/linux/}. The required | |
1331 | 1418 | QEMU-specific patches are included with the sources. |
1332 | 1419 | |
1333 | 1420 | A sample Linux 2.6 series kernel and ram disk image are available on |
... | ... | @@ -1348,6 +1435,7 @@ Set the initial TCX graphic mode. The default is 1024x768. |
1348 | 1435 | |
1349 | 1436 | @c man end |
1350 | 1437 | |
1438 | +@node Sparc64 System emulator invocation | |
1351 | 1439 | @section Sparc64 System emulator invocation |
1352 | 1440 | |
1353 | 1441 | Use the executable @file{qemu-system-sparc64} to simulate a Sun4u machine. |
... | ... | @@ -1366,6 +1454,7 @@ Non Volatile RAM M48T59 |
1366 | 1454 | PC-compatible serial ports |
1367 | 1455 | @end itemize |
1368 | 1456 | |
1457 | +@node MIPS System emulator invocation | |
1369 | 1458 | @section MIPS System emulator invocation |
1370 | 1459 | |
1371 | 1460 | Use the executable @file{qemu-system-mips} to simulate a MIPS machine. |
... | ... | @@ -1383,6 +1472,7 @@ NE2000 network card |
1383 | 1472 | |
1384 | 1473 | More information is available in the QEMU mailing-list archive. |
1385 | 1474 | |
1475 | +@node ARM System emulator invocation | |
1386 | 1476 | @section ARM System emulator invocation |
1387 | 1477 | |
1388 | 1478 | Use the executable @file{qemu-system-arm} to simulate a ARM |
... | ... | @@ -1401,8 +1491,16 @@ SMC 91c111 Ethernet adapter |
1401 | 1491 | A Linux 2.6 test image is available on the QEMU web site. More |
1402 | 1492 | information is available in the QEMU mailing-list archive. |
1403 | 1493 | |
1494 | +@node QEMU Linux User space emulator | |
1404 | 1495 | @chapter QEMU Linux User space emulator |
1405 | 1496 | |
1497 | +@menu | |
1498 | +* Quick Start:: | |
1499 | +* Wine launch:: | |
1500 | +* Command line options:: | |
1501 | +@end menu | |
1502 | + | |
1503 | +@node Quick Start | |
1406 | 1504 | @section Quick Start |
1407 | 1505 | |
1408 | 1506 | In order to launch a Linux process, QEMU needs the process executable |
... | ... | @@ -1446,11 +1544,13 @@ Linux kernel. |
1446 | 1544 | |
1447 | 1545 | @item The x86 version of QEMU is also included. You can try weird things such as: |
1448 | 1546 | @example |
1449 | -qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | |
1547 | +qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \ | |
1548 | + /usr/local/qemu-i386/bin/ls-i386 | |
1450 | 1549 | @end example |
1451 | 1550 | |
1452 | 1551 | @end itemize |
1453 | 1552 | |
1553 | +@node Wine launch | |
1454 | 1554 | @section Wine launch |
1455 | 1555 | |
1456 | 1556 | @itemize |
... | ... | @@ -1467,17 +1567,19 @@ qemu-i386 /usr/local/qemu-i386/bin/ls-i386 |
1467 | 1567 | (@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page). |
1468 | 1568 | |
1469 | 1569 | @item Configure Wine on your account. Look at the provided script |
1470 | -@file{/usr/local/qemu-i386/bin/wine-conf.sh}. Your previous | |
1570 | +@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous | |
1471 | 1571 | @code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}. |
1472 | 1572 | |
1473 | 1573 | @item Then you can try the example @file{putty.exe}: |
1474 | 1574 | |
1475 | 1575 | @example |
1476 | -qemu-i386 /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | |
1576 | +qemu-i386 /usr/local/qemu-i386/wine/bin/wine \ | |
1577 | + /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | |
1477 | 1578 | @end example |
1478 | 1579 | |
1479 | 1580 | @end itemize |
1480 | 1581 | |
1582 | +@node Command line options | |
1481 | 1583 | @section Command line options |
1482 | 1584 | |
1483 | 1585 | @example |
... | ... | @@ -1505,6 +1607,14 @@ Act as if the host page size was 'pagesize' bytes |
1505 | 1607 | @node compilation |
1506 | 1608 | @chapter Compilation from the sources |
1507 | 1609 | |
1610 | +@menu | |
1611 | +* Linux/Unix:: | |
1612 | +* Windows:: | |
1613 | +* Cross compilation for Windows with Linux:: | |
1614 | +* Mac OS X:: | |
1615 | +@end menu | |
1616 | + | |
1617 | +@node Linux/Unix | |
1508 | 1618 | @section Linux/Unix |
1509 | 1619 | |
1510 | 1620 | @subsection Compilation |
... | ... | @@ -1562,6 +1672,7 @@ ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0 |
1562 | 1672 | variables. You must use gcc 3.x on PowerPC. |
1563 | 1673 | @end example |
1564 | 1674 | |
1675 | +@node Windows | |
1565 | 1676 | @section Windows |
1566 | 1677 | |
1567 | 1678 | @itemize |
... | ... | @@ -1571,7 +1682,7 @@ instructions in the download section and the FAQ. |
1571 | 1682 | |
1572 | 1683 | @item Download |
1573 | 1684 | the MinGW development library of SDL 1.2.x |
1574 | -(@file{SDL-devel-1.2.x-mingw32.tar.gz}) from | |
1685 | +(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from | |
1575 | 1686 | @url{http://www.libsdl.org}. Unpack it in a temporary place, and |
1576 | 1687 | unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool |
1577 | 1688 | directory. Edit the @file{sdl-config} script so that it gives the |
... | ... | @@ -1591,6 +1702,7 @@ correct SDL directory when invoked. |
1591 | 1702 | |
1592 | 1703 | @end itemize |
1593 | 1704 | |
1705 | +@node Cross compilation for Windows with Linux | |
1594 | 1706 | @section Cross compilation for Windows with Linux |
1595 | 1707 | |
1596 | 1708 | @itemize |
... | ... | @@ -1622,9 +1734,15 @@ installation directory. |
1622 | 1734 | Note: Currently, Wine does not seem able to launch |
1623 | 1735 | QEMU for Win32. |
1624 | 1736 | |
1737 | +@node Mac OS X | |
1625 | 1738 | @section Mac OS X |
1626 | 1739 | |
1627 | 1740 | The Mac OS X patches are not fully merged in QEMU, so you should look |
1628 | 1741 | at the QEMU mailing list archive to have all the necessary |
1629 | 1742 | information. |
1630 | 1743 | |
1744 | +@node Index | |
1745 | +@chapter Index | |
1746 | +@printindex cp | |
1747 | + | |
1748 | +@bye | ... | ... |
qemu-tech.texi
1 | 1 | \input texinfo @c -*- texinfo -*- |
2 | +@c %**start of header | |
3 | +@setfilename qemu-tech.info | |
4 | +@settitle QEMU Internals | |
5 | +@exampleindent 0 | |
6 | +@paragraphindent 0 | |
7 | +@c %**end of header | |
2 | 8 | |
3 | 9 | @iftex |
4 | -@settitle QEMU Internals | |
5 | 10 | @titlepage |
6 | 11 | @sp 7 |
7 | 12 | @center @titlefont{QEMU Internals} |
... | ... | @@ -9,8 +14,32 @@ |
9 | 14 | @end titlepage |
10 | 15 | @end iftex |
11 | 16 | |
17 | +@ifnottex | |
18 | +@node Top | |
19 | +@top | |
20 | + | |
21 | +@menu | |
22 | +* Introduction:: | |
23 | +* QEMU Internals:: | |
24 | +* Regression Tests:: | |
25 | +* Index:: | |
26 | +@end menu | |
27 | +@end ifnottex | |
28 | + | |
29 | +@contents | |
30 | + | |
31 | +@node Introduction | |
12 | 32 | @chapter Introduction |
13 | 33 | |
34 | +@menu | |
35 | +* intro_features:: Features | |
36 | +* intro_x86_emulation:: x86 emulation | |
37 | +* intro_arm_emulation:: ARM emulation | |
38 | +* intro_ppc_emulation:: PowerPC emulation | |
39 | +* intro_sparc_emulation:: SPARC emulation | |
40 | +@end menu | |
41 | + | |
42 | +@node intro_features | |
14 | 43 | @section Features |
15 | 44 | |
16 | 45 | QEMU is a FAST! processor emulator using a portable dynamic |
... | ... | @@ -43,7 +72,7 @@ QEMU generic features: |
43 | 72 | |
44 | 73 | @item User space only or full system emulation. |
45 | 74 | |
46 | -@item Using dynamic translation to native code for reasonnable speed. | |
75 | +@item Using dynamic translation to native code for reasonable speed. | |
47 | 76 | |
48 | 77 | @item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. |
49 | 78 | |
... | ... | @@ -65,13 +94,13 @@ QEMU user mode emulation features: |
65 | 94 | |
66 | 95 | @item Accurate signal handling by remapping host signals to target signals. |
67 | 96 | @end itemize |
68 | -@end itemize | |
69 | 97 | |
70 | 98 | QEMU full system emulation features: |
71 | 99 | @itemize |
72 | 100 | @item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU. |
73 | 101 | @end itemize |
74 | 102 | |
103 | +@node intro_x86_emulation | |
75 | 104 | @section x86 emulation |
76 | 105 | |
77 | 106 | QEMU x86 target features: |
... | ... | @@ -110,6 +139,7 @@ maximum performances. |
110 | 139 | |
111 | 140 | @end itemize |
112 | 141 | |
142 | +@node intro_arm_emulation | |
113 | 143 | @section ARM emulation |
114 | 144 | |
115 | 145 | @itemize |
... | ... | @@ -122,6 +152,7 @@ maximum performances. |
122 | 152 | |
123 | 153 | @end itemize |
124 | 154 | |
155 | +@node intro_ppc_emulation | |
125 | 156 | @section PowerPC emulation |
126 | 157 | |
127 | 158 | @itemize |
... | ... | @@ -133,6 +164,7 @@ FPU and MMU. |
133 | 164 | |
134 | 165 | @end itemize |
135 | 166 | |
167 | +@node intro_sparc_emulation | |
136 | 168 | @section SPARC emulation |
137 | 169 | |
138 | 170 | @itemize |
... | ... | @@ -166,8 +198,26 @@ implemented. Floating point exception support is untested. |
166 | 198 | |
167 | 199 | @end itemize |
168 | 200 | |
201 | +@node QEMU Internals | |
169 | 202 | @chapter QEMU Internals |
170 | 203 | |
204 | +@menu | |
205 | +* QEMU compared to other emulators:: | |
206 | +* Portable dynamic translation:: | |
207 | +* Register allocation:: | |
208 | +* Condition code optimisations:: | |
209 | +* CPU state optimisations:: | |
210 | +* Translation cache:: | |
211 | +* Direct block chaining:: | |
212 | +* Self-modifying code and translated code invalidation:: | |
213 | +* Exception support:: | |
214 | +* MMU emulation:: | |
215 | +* Hardware interrupts:: | |
216 | +* User emulation specific details:: | |
217 | +* Bibliography:: | |
218 | +@end menu | |
219 | + | |
220 | +@node QEMU compared to other emulators | |
171 | 221 | @section QEMU compared to other emulators |
172 | 222 | |
173 | 223 | Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than |
... | ... | @@ -214,6 +264,7 @@ The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo |
214 | 264 | and potentially unsafe host drivers. Moreover, they are unable to |
215 | 265 | provide cycle exact simulation as an emulator can. |
216 | 266 | |
267 | +@node Portable dynamic translation | |
217 | 268 | @section Portable dynamic translation |
218 | 269 | |
219 | 270 | QEMU is a dynamic translator. When it first encounters a piece of code, |
... | ... | @@ -243,6 +294,7 @@ That way, QEMU is no more difficult to port than a dynamic linker. |
243 | 294 | To go even faster, GCC static register variables are used to keep the |
244 | 295 | state of the virtual CPU. |
245 | 296 | |
297 | +@node Register allocation | |
246 | 298 | @section Register allocation |
247 | 299 | |
248 | 300 | Since QEMU uses fixed simple instructions, no efficient register |
... | ... | @@ -250,6 +302,7 @@ allocation can be done. However, because RISC CPUs have a lot of |
250 | 302 | register, most of the virtual CPU state can be put in registers without |
251 | 303 | doing complicated register allocation. |
252 | 304 | |
305 | +@node Condition code optimisations | |
253 | 306 | @section Condition code optimisations |
254 | 307 | |
255 | 308 | Good CPU condition codes emulation (@code{EFLAGS} register on x86) is a |
... | ... | @@ -268,6 +321,7 @@ generated simple instructions (see |
268 | 321 | the condition codes are not needed by the next instructions, no |
269 | 322 | condition codes are computed at all. |
270 | 323 | |
324 | +@node CPU state optimisations | |
271 | 325 | @section CPU state optimisations |
272 | 326 | |
273 | 327 | The x86 CPU has many internal states which change the way it evaluates |
... | ... | @@ -279,6 +333,7 @@ segment base. |
279 | 333 | |
280 | 334 | [The FPU stack pointer register is not handled that way yet]. |
281 | 335 | |
336 | +@node Translation cache | |
282 | 337 | @section Translation cache |
283 | 338 | |
284 | 339 | A 16 MByte cache holds the most recently used translations. For |
... | ... | @@ -287,6 +342,7 @@ contains just a single basic block (a block of x86 instructions |
287 | 342 | terminated by a jump or by a virtual CPU state change which the |
288 | 343 | translator cannot deduce statically). |
289 | 344 | |
345 | +@node Direct block chaining | |
290 | 346 | @section Direct block chaining |
291 | 347 | |
292 | 348 | After each translated basic block is executed, QEMU uses the simulated |
... | ... | @@ -302,6 +358,7 @@ it easier to make the jump target modification atomic. On some host |
302 | 358 | architectures (such as x86 or PowerPC), the @code{JUMP} opcode is |
303 | 359 | directly patched so that the block chaining has no overhead. |
304 | 360 | |
361 | +@node Self-modifying code and translated code invalidation | |
305 | 362 | @section Self-modifying code and translated code invalidation |
306 | 363 | |
307 | 364 | Self-modifying code is a special challenge in x86 emulation because no |
... | ... | @@ -332,6 +389,7 @@ built. Every store into that page checks the bitmap to see if the code |
332 | 389 | really needs to be invalidated. It avoids invalidating the code when |
333 | 390 | only data is modified in the page. |
334 | 391 | |
392 | +@node Exception support | |
335 | 393 | @section Exception support |
336 | 394 | |
337 | 395 | longjmp() is used when an exception such as division by zero is |
... | ... | @@ -348,6 +406,7 @@ in some cases it is not computed because of condition code |
348 | 406 | optimisations. It is not a big concern because the emulated code can |
349 | 407 | still be restarted in any cases. |
350 | 408 | |
409 | +@node MMU emulation | |
351 | 410 | @section MMU emulation |
352 | 411 | |
353 | 412 | For system emulation, QEMU uses the mmap() system call to emulate the |
... | ... | @@ -367,6 +426,7 @@ means that each basic block is indexed with its physical address. |
367 | 426 | When MMU mappings change, only the chaining of the basic blocks is |
368 | 427 | reset (i.e. a basic block can no longer jump directly to another one). |
369 | 428 | |
429 | +@node Hardware interrupts | |
370 | 430 | @section Hardware interrupts |
371 | 431 | |
372 | 432 | In order to be faster, QEMU does not check at every basic block if an |
... | ... | @@ -377,6 +437,7 @@ block. It ensures that the execution will return soon in the main loop |
377 | 437 | of the CPU emulator. Then the main loop can test if the interrupt is |
378 | 438 | pending and handle it. |
379 | 439 | |
440 | +@node User emulation specific details | |
380 | 441 | @section User emulation specific details |
381 | 442 | |
382 | 443 | @subsection Linux system call translation |
... | ... | @@ -434,6 +495,7 @@ space conflicts. QEMU solves this problem by being an executable ELF |
434 | 495 | shared object as the ld-linux.so ELF interpreter. That way, it can be |
435 | 496 | relocated at load time. |
436 | 497 | |
498 | +@node Bibliography | |
437 | 499 | @section Bibliography |
438 | 500 | |
439 | 501 | @table @asis |
... | ... | @@ -456,7 +518,7 @@ by Kevin Lawton et al. |
456 | 518 | x86 emulator on Alpha-Linux. |
457 | 519 | |
458 | 520 | @item [5] |
459 | -@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf}, | |
521 | +@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf}, | |
460 | 522 | DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton |
461 | 523 | Chernoff and Ray Hookway. |
462 | 524 | |
... | ... | @@ -486,11 +548,19 @@ The TwoOStwo PC virtualizer. |
486 | 548 | |
487 | 549 | @end table |
488 | 550 | |
551 | +@node Regression Tests | |
489 | 552 | @chapter Regression Tests |
490 | 553 | |
491 | 554 | In the directory @file{tests/}, various interesting testing programs |
492 | 555 | are available. There are used for regression testing. |
493 | 556 | |
557 | +@menu | |
558 | +* test-i386:: | |
559 | +* linux-test:: | |
560 | +* qruncom.c:: | |
561 | +@end menu | |
562 | + | |
563 | +@node test-i386 | |
494 | 564 | @section @file{test-i386} |
495 | 565 | |
496 | 566 | This program executes most of the 16 bit and 32 bit x86 instructions and |
... | ... | @@ -506,12 +576,20 @@ The Linux system call @code{vm86()} is used to test vm86 emulation. |
506 | 576 | Various exceptions are raised to test most of the x86 user space |
507 | 577 | exception reporting. |
508 | 578 | |
579 | +@node linux-test | |
509 | 580 | @section @file{linux-test} |
510 | 581 | |
511 | 582 | This program tests various Linux system calls. It is used to verify |
512 | 583 | that the system call parameters are correctly converted between target |
513 | 584 | and host CPUs. |
514 | 585 | |
586 | +@node qruncom.c | |
515 | 587 | @section @file{qruncom.c} |
516 | 588 | |
517 | 589 | Example of usage of @code{libqemu} to emulate a user mode i386 CPU. |
590 | + | |
591 | +@node Index | |
592 | +@chapter Index | |
593 | +@printindex cp | |
594 | + | |
595 | +@bye | ... | ... |