Commit debc70650a973b0c67bd8ea69f8887cd41961ba8
1 parent
985d1742
Enhanced Documentation (Stefan Weil)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1873 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
2 changed files
with
236 additions
and
40 deletions
qemu-doc.texi
| 1 | 1 | \input texinfo @c -*- texinfo -*- |
| 2 | +@c %**start of header | |
| 3 | +@setfilename qemu-doc.info | |
| 4 | +@settitle QEMU CPU Emulator User Documentation | |
| 5 | +@exampleindent 0 | |
| 6 | +@paragraphindent 0 | |
| 7 | +@c %**end of header | |
| 2 | 8 | |
| 3 | 9 | @iftex |
| 4 | -@settitle QEMU CPU Emulator User Documentation | |
| 5 | 10 | @titlepage |
| 6 | 11 | @sp 7 |
| 7 | -@center @titlefont{QEMU CPU Emulator User Documentation} | |
| 12 | +@center @titlefont{QEMU CPU Emulator} | |
| 13 | +@sp 1 | |
| 14 | +@center @titlefont{User Documentation} | |
| 8 | 15 | @sp 3 |
| 9 | 16 | @end titlepage |
| 10 | 17 | @end iftex |
| 11 | 18 | |
| 19 | +@ifnottex | |
| 20 | +@node Top | |
| 21 | +@top | |
| 22 | + | |
| 23 | +@menu | |
| 24 | +* Introduction:: | |
| 25 | +* Installation:: | |
| 26 | +* QEMU PC System emulator:: | |
| 27 | +* QEMU System emulator for non PC targets:: | |
| 28 | +* QEMU Linux User space emulator:: | |
| 29 | +* compilation:: Compilation from the sources | |
| 30 | +* Index:: | |
| 31 | +@end menu | |
| 32 | +@end ifnottex | |
| 33 | + | |
| 34 | +@contents | |
| 35 | + | |
| 36 | +@node Introduction | |
| 12 | 37 | @chapter Introduction |
| 13 | 38 | |
| 39 | +@menu | |
| 40 | +* intro_features:: Features | |
| 41 | +@end menu | |
| 42 | + | |
| 43 | +@node intro_features | |
| 14 | 44 | @section Features |
| 15 | 45 | |
| 16 | 46 | QEMU is a FAST! processor emulator using dynamic translation to |
| ... | ... | @@ -52,27 +82,53 @@ For system emulation, the following hardware targets are supported: |
| 52 | 82 | |
| 53 | 83 | For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported. |
| 54 | 84 | |
| 85 | +@node Installation | |
| 55 | 86 | @chapter Installation |
| 56 | 87 | |
| 57 | 88 | If you want to compile QEMU yourself, see @ref{compilation}. |
| 58 | 89 | |
| 90 | +@menu | |
| 91 | +* install_linux:: Linux | |
| 92 | +* install_windows:: Windows | |
| 93 | +* install_mac:: Macintosh | |
| 94 | +@end menu | |
| 95 | + | |
| 96 | +@node install_linux | |
| 59 | 97 | @section Linux |
| 60 | 98 | |
| 61 | 99 | If a precompiled package is available for your distribution - you just |
| 62 | 100 | have to install it. Otherwise, see @ref{compilation}. |
| 63 | 101 | |
| 102 | +@node install_windows | |
| 64 | 103 | @section Windows |
| 65 | 104 | |
| 66 | 105 | Download the experimental binary installer at |
| 67 | -@url{http://www.free.oszoo.org/download.html}. | |
| 106 | +@url{http://www.free.oszoo.org/@/download.html}. | |
| 68 | 107 | |
| 108 | +@node install_mac | |
| 69 | 109 | @section Mac OS X |
| 70 | 110 | |
| 71 | 111 | Download the experimental binary installer at |
| 72 | -@url{http://www.free.oszoo.org/download.html}. | |
| 112 | +@url{http://www.free.oszoo.org/@/download.html}. | |
| 73 | 113 | |
| 114 | +@node QEMU PC System emulator | |
| 74 | 115 | @chapter QEMU PC System emulator |
| 75 | 116 | |
| 117 | +@menu | |
| 118 | +* pcsys_introduction:: Introduction | |
| 119 | +* pcsys_quickstart:: Quick Start | |
| 120 | +* sec_invocation:: Invocation | |
| 121 | +* pcsys_keys:: Keys | |
| 122 | +* pcsys_monitor:: QEMU Monitor | |
| 123 | +* disk_images:: Disk Images | |
| 124 | +* pcsys_network:: Network emulation | |
| 125 | +* direct_linux_boot:: Direct Linux Boot | |
| 126 | +* pcsys_usb:: USB emulation | |
| 127 | +* gdb_usage:: GDB usage | |
| 128 | +* pcsys_os_specific:: Target OS specific information | |
| 129 | +@end menu | |
| 130 | + | |
| 131 | +@node pcsys_introduction | |
| 76 | 132 | @section Introduction |
| 77 | 133 | |
| 78 | 134 | @c man begin DESCRIPTION |
| ... | ... | @@ -118,6 +174,7 @@ QEMU uses YM3812 emulation by Tatsuyuki Satoh. |
| 118 | 174 | |
| 119 | 175 | @c man end |
| 120 | 176 | |
| 177 | +@node pcsys_quickstart | |
| 121 | 178 | @section Quick Start |
| 122 | 179 | |
| 123 | 180 | Download and uncompress the linux image (@file{linux.img}) and type: |
| ... | ... | @@ -147,14 +204,14 @@ Select the emulated machine (@code{-M ?} for list) |
| 147 | 204 | |
| 148 | 205 | @item -fda file |
| 149 | 206 | @item -fdb file |
| 150 | -Use @var{file} as floppy disk 0/1 image (@xref{disk_images}). You can | |
| 207 | +Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can | |
| 151 | 208 | use the host floppy by using @file{/dev/fd0} as filename. |
| 152 | 209 | |
| 153 | 210 | @item -hda file |
| 154 | 211 | @item -hdb file |
| 155 | 212 | @item -hdc file |
| 156 | 213 | @item -hdd file |
| 157 | -Use @var{file} as hard disk 0, 1, 2 or 3 image (@xref{disk_images}). | |
| 214 | +Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}). | |
| 158 | 215 | |
| 159 | 216 | @item -cdrom file |
| 160 | 217 | Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and |
| ... | ... | @@ -168,7 +225,7 @@ the default. |
| 168 | 225 | @item -snapshot |
| 169 | 226 | Write to temporary files instead of disk image files. In this case, |
| 170 | 227 | the raw disk image you use is not written back. You can however force |
| 171 | -the write back by pressing @key{C-a s} (@xref{disk_images}). | |
| 228 | +the write back by pressing @key{C-a s} (@pxref{disk_images}). | |
| 172 | 229 | |
| 173 | 230 | @item -m megs |
| 174 | 231 | Set virtual RAM size to @var{megs} megabytes. Default is 128 MB. |
| ... | ... | @@ -304,9 +361,12 @@ specifies an already opened TCP socket. |
| 304 | 361 | Example: |
| 305 | 362 | @example |
| 306 | 363 | # launch a first QEMU instance |
| 307 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,listen=:1234 | |
| 308 | -# connect the VLAN 0 of this instance to the VLAN 0 of the first instance | |
| 309 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,connect=127.0.0.1:1234 | |
| 364 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | |
| 365 | + -net socket,listen=:1234 | |
| 366 | +# connect the VLAN 0 of this instance to the VLAN 0 | |
| 367 | +# of the first instance | |
| 368 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ | |
| 369 | + -net socket,connect=127.0.0.1:1234 | |
| 310 | 370 | @end example |
| 311 | 371 | |
| 312 | 372 | @item -net socket[,vlan=n][,fd=h][,mcast=maddr:port] |
| ... | ... | @@ -328,17 +388,22 @@ mcast support is compatible with User Mode Linux (argument @option{eth@var{N}=mc |
| 328 | 388 | Example: |
| 329 | 389 | @example |
| 330 | 390 | # launch one QEMU instance |
| 331 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=230.0.0.1:1234 | |
| 391 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | |
| 392 | + -net socket,mcast=230.0.0.1:1234 | |
| 332 | 393 | # launch another QEMU instance on same "bus" |
| 333 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,mcast=230.0.0.1:1234 | |
| 394 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ | |
| 395 | + -net socket,mcast=230.0.0.1:1234 | |
| 334 | 396 | # launch yet another QEMU instance on same "bus" |
| 335 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:58 -net socket,mcast=230.0.0.1:1234 | |
| 397 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:58 \ | |
| 398 | + -net socket,mcast=230.0.0.1:1234 | |
| 336 | 399 | @end example |
| 337 | 400 | |
| 338 | 401 | Example (User Mode Linux compat.): |
| 339 | 402 | @example |
| 340 | -# launch QEMU instance (note mcast address selected is UML's default) | |
| 341 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=239.192.168.1:1102 | |
| 403 | +# launch QEMU instance (note mcast address selected | |
| 404 | +# is UML's default) | |
| 405 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | |
| 406 | + -net socket,mcast=239.192.168.1:1102 | |
| 342 | 407 | # launch UML |
| 343 | 408 | /path/to/linux ubd0=/path/to/root_fs eth0=mcast |
| 344 | 409 | @end example |
| ... | ... | @@ -471,7 +536,7 @@ The default device is @code{vc} in graphical mode and @code{stdio} in |
| 471 | 536 | non graphical mode. |
| 472 | 537 | |
| 473 | 538 | @item -s |
| 474 | -Wait gdb connection to port 1234 (@xref{gdb_usage}). | |
| 539 | +Wait gdb connection to port 1234 (@pxref{gdb_usage}). | |
| 475 | 540 | @item -p port |
| 476 | 541 | Change gdb connection port. |
| 477 | 542 | @item -S |
| ... | ... | @@ -494,6 +559,7 @@ Start right away with a saved state (@code{loadvm} in monitor) |
| 494 | 559 | |
| 495 | 560 | @c man end |
| 496 | 561 | |
| 562 | +@node pcsys_keys | |
| 497 | 563 | @section Keys |
| 498 | 564 | |
| 499 | 565 | @c man begin OPTIONS |
| ... | ... | @@ -542,9 +608,6 @@ Send Ctrl-a |
| 542 | 608 | |
| 543 | 609 | @ignore |
| 544 | 610 | |
| 545 | -@setfilename qemu | |
| 546 | -@settitle QEMU System Emulator | |
| 547 | - | |
| 548 | 611 | @c man begin SEEALSO |
| 549 | 612 | The HTML documentation of QEMU for more precise information and Linux |
| 550 | 613 | user mode emulator invocation. |
| ... | ... | @@ -556,8 +619,7 @@ Fabrice Bellard |
| 556 | 619 | |
| 557 | 620 | @end ignore |
| 558 | 621 | |
| 559 | -@end ignore | |
| 560 | - | |
| 622 | +@node pcsys_monitor | |
| 561 | 623 | @section QEMU Monitor |
| 562 | 624 | |
| 563 | 625 | The QEMU monitor is used to give complex commands to the QEMU |
| ... | ... | @@ -683,7 +745,7 @@ Dump 10 instructions at the current instruction pointer: |
| 683 | 745 | |
| 684 | 746 | @item |
| 685 | 747 | Dump 80 16 bit values at the start of the video memory. |
| 686 | -@example | |
| 748 | +@smallexample | |
| 687 | 749 | (qemu) xp/80hx 0xb8000 |
| 688 | 750 | 0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42 |
| 689 | 751 | 0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41 |
| ... | ... | @@ -695,7 +757,7 @@ Dump 80 16 bit values at the start of the video memory. |
| 695 | 757 | 0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
| 696 | 758 | 0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
| 697 | 759 | 0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
| 698 | -@end example | |
| 760 | +@end smallexample | |
| 699 | 761 | @end itemize |
| 700 | 762 | |
| 701 | 763 | @item p or print/fmt expr |
| ... | ... | @@ -746,6 +808,14 @@ Since version 0.6.1, QEMU supports many disk image formats, including |
| 746 | 808 | growable disk images (their size increase as non empty sectors are |
| 747 | 809 | written), compressed and encrypted disk images. |
| 748 | 810 | |
| 811 | +@menu | |
| 812 | +* disk_images_quickstart:: Quick start for disk image creation | |
| 813 | +* disk_images_snapshot_mode:: Snapshot mode | |
| 814 | +* qemu_img_invocation:: qemu-img Invocation | |
| 815 | +* disk_images_fat_images:: Virtual FAT disk images | |
| 816 | +@end menu | |
| 817 | + | |
| 818 | +@node disk_images_quickstart | |
| 749 | 819 | @subsection Quick start for disk image creation |
| 750 | 820 | |
| 751 | 821 | You can create a disk image with the command: |
| ... | ... | @@ -756,8 +826,9 @@ where @var{myimage.img} is the disk image filename and @var{mysize} is its |
| 756 | 826 | size in kilobytes. You can add an @code{M} suffix to give the size in |
| 757 | 827 | megabytes and a @code{G} suffix for gigabytes. |
| 758 | 828 | |
| 759 | -@xref{qemu_img_invocation} for more information. | |
| 829 | +See @ref{qemu_img_invocation} for more information. | |
| 760 | 830 | |
| 831 | +@node disk_images_snapshot_mode | |
| 761 | 832 | @subsection Snapshot mode |
| 762 | 833 | |
| 763 | 834 | If you use the option @option{-snapshot}, all disk images are |
| ... | ... | @@ -771,6 +842,7 @@ command (or @key{C-a s} in the serial console). |
| 771 | 842 | |
| 772 | 843 | @include qemu-img.texi |
| 773 | 844 | |
| 845 | +@node disk_images_fat_images | |
| 774 | 846 | @subsection Virtual FAT disk images |
| 775 | 847 | |
| 776 | 848 | QEMU can automatically create a virtual FAT disk image from a |
| ... | ... | @@ -805,6 +877,7 @@ What you should @emph{never} do: |
| 805 | 877 | @item write to the FAT directory on the host system while accessing it with the guest system. |
| 806 | 878 | @end itemize |
| 807 | 879 | |
| 880 | +@node pcsys_network | |
| 808 | 881 | @section Network emulation |
| 809 | 882 | |
| 810 | 883 | QEMU can simulate several networks cards (NE2000 boards on the PC |
| ... | ... | @@ -908,10 +981,10 @@ seen from the emulated kernel at IP address 172.20.0.1. |
| 908 | 981 | |
| 909 | 982 | @item Launch @code{qemu.sh}. You should have the following output: |
| 910 | 983 | |
| 911 | -@example | |
| 984 | +@smallexample | |
| 912 | 985 | > ./qemu.sh |
| 913 | 986 | Connected to host network interface: tun0 |
| 914 | -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
| 987 | +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
| 915 | 988 | BIOS-provided physical RAM map: |
| 916 | 989 | BIOS-e801: 0000000000000000 - 000000000009f000 (usable) |
| 917 | 990 | BIOS-e801: 0000000000100000 - 0000000002000000 (usable) |
| ... | ... | @@ -920,7 +993,7 @@ On node 0 totalpages: 8192 |
| 920 | 993 | zone(0): 4096 pages. |
| 921 | 994 | zone(1): 4096 pages. |
| 922 | 995 | zone(2): 0 pages. |
| 923 | -Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe console=ttyS0 | |
| 996 | +Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe @/ide5=noprobe console=ttyS0 | |
| 924 | 997 | ide_setup: ide2=noprobe |
| 925 | 998 | ide_setup: ide3=noprobe |
| 926 | 999 | ide_setup: ide4=noprobe |
| ... | ... | @@ -929,7 +1002,7 @@ Initializing CPU#0 |
| 929 | 1002 | Detected 2399.621 MHz processor. |
| 930 | 1003 | Console: colour EGA 80x25 |
| 931 | 1004 | Calibrating delay loop... 4744.80 BogoMIPS |
| 932 | -Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, 0k highmem) | |
| 1005 | +Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, @/0k highmem) | |
| 933 | 1006 | Dentry cache hash table entries: 4096 (order: 3, 32768 bytes) |
| 934 | 1007 | Inode cache hash table entries: 2048 (order: 2, 16384 bytes) |
| 935 | 1008 | Mount cache hash table entries: 512 (order: 0, 4096 bytes) |
| ... | ... | @@ -971,14 +1044,14 @@ EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended |
| 971 | 1044 | VFS: Mounted root (ext2 filesystem). |
| 972 | 1045 | Freeing unused kernel memory: 64k freed |
| 973 | 1046 | |
| 974 | -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
| 1047 | +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | |
| 975 | 1048 | |
| 976 | 1049 | QEMU Linux test distribution (based on Redhat 9) |
| 977 | 1050 | |
| 978 | 1051 | Type 'exit' to halt the system |
| 979 | 1052 | |
| 980 | 1053 | sh-2.05b# |
| 981 | -@end example | |
| 1054 | +@end smallexample | |
| 982 | 1055 | |
| 983 | 1056 | @item |
| 984 | 1057 | Then you can play with the kernel inside the virtual serial console. You |
| ... | ... | @@ -1028,6 +1101,7 @@ Lawton for the plex86 Project (@url{www.plex86.org}). |
| 1028 | 1101 | |
| 1029 | 1102 | @end enumerate |
| 1030 | 1103 | |
| 1104 | +@node pcsys_usb | |
| 1031 | 1105 | @section USB emulation |
| 1032 | 1106 | |
| 1033 | 1107 | QEMU emulates a PCI UHCI USB controller and a 8 port USB hub connected |
| ... | ... | @@ -1111,7 +1185,8 @@ QEMU has a primitive support to work with gdb, so that you can do |
| 1111 | 1185 | In order to use gdb, launch qemu with the '-s' option. It will wait for a |
| 1112 | 1186 | gdb connection: |
| 1113 | 1187 | @example |
| 1114 | -> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda" | |
| 1188 | +> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \ | |
| 1189 | + -append "root=/dev/hda" | |
| 1115 | 1190 | Connected to host network interface: tun0 |
| 1116 | 1191 | Waiting gdb connection on port 1234 |
| 1117 | 1192 | @end example |
| ... | ... | @@ -1143,6 +1218,7 @@ Use @code{set architecture i8086} to dump 16 bit code. Then use |
| 1143 | 1218 | @code{x/10i $cs*16+*eip} to dump the code at the PC position. |
| 1144 | 1219 | @end enumerate |
| 1145 | 1220 | |
| 1221 | +@node pcsys_os_specific | |
| 1146 | 1222 | @section Target OS specific information |
| 1147 | 1223 | |
| 1148 | 1224 | @subsection Linux |
| ... | ... | @@ -1229,12 +1305,22 @@ it takes host CPU cycles even when idle. You can install the utility |
| 1229 | 1305 | from @url{http://www.vmware.com/software/dosidle210.zip} to solve this |
| 1230 | 1306 | problem. |
| 1231 | 1307 | |
| 1308 | +@node QEMU System emulator for non PC targets | |
| 1232 | 1309 | @chapter QEMU System emulator for non PC targets |
| 1233 | 1310 | |
| 1234 | 1311 | QEMU is a generic emulator and it emulates many non PC |
| 1235 | 1312 | machines. Most of the options are similar to the PC emulator. The |
| 1236 | 1313 | differences are mentionned in the following sections. |
| 1237 | 1314 | |
| 1315 | +@menu | |
| 1316 | +* QEMU PowerPC System emulator:: | |
| 1317 | +* Sparc32 System emulator invocation:: | |
| 1318 | +* Sparc64 System emulator invocation:: | |
| 1319 | +* MIPS System emulator invocation:: | |
| 1320 | +* ARM System emulator invocation:: | |
| 1321 | +@end menu | |
| 1322 | + | |
| 1323 | +@node QEMU PowerPC System emulator | |
| 1238 | 1324 | @section QEMU PowerPC System emulator |
| 1239 | 1325 | |
| 1240 | 1326 | Use the executable @file{qemu-system-ppc} to simulate a complete PREP |
| ... | ... | @@ -1299,6 +1385,7 @@ Set the initial VGA graphic mode. The default is 800x600x15. |
| 1299 | 1385 | More information is available at |
| 1300 | 1386 | @url{http://perso.magic.fr/l_indien/qemu-ppc/}. |
| 1301 | 1387 | |
| 1388 | +@node Sparc32 System emulator invocation | |
| 1302 | 1389 | @section Sparc32 System emulator invocation |
| 1303 | 1390 | |
| 1304 | 1391 | Use the executable @file{qemu-system-sparc} to simulate a JavaStation |
| ... | ... | @@ -1327,7 +1414,7 @@ Floppy drive |
| 1327 | 1414 | The number of peripherals is fixed in the architecture. |
| 1328 | 1415 | |
| 1329 | 1416 | QEMU uses the Proll, a PROM replacement available at |
| 1330 | -@url{http://people.redhat.com/zaitcev/linux/}. The required | |
| 1417 | +@url{http://people.redhat.com/@/zaitcev/linux/}. The required | |
| 1331 | 1418 | QEMU-specific patches are included with the sources. |
| 1332 | 1419 | |
| 1333 | 1420 | A sample Linux 2.6 series kernel and ram disk image are available on |
| ... | ... | @@ -1348,6 +1435,7 @@ Set the initial TCX graphic mode. The default is 1024x768. |
| 1348 | 1435 | |
| 1349 | 1436 | @c man end |
| 1350 | 1437 | |
| 1438 | +@node Sparc64 System emulator invocation | |
| 1351 | 1439 | @section Sparc64 System emulator invocation |
| 1352 | 1440 | |
| 1353 | 1441 | Use the executable @file{qemu-system-sparc64} to simulate a Sun4u machine. |
| ... | ... | @@ -1366,6 +1454,7 @@ Non Volatile RAM M48T59 |
| 1366 | 1454 | PC-compatible serial ports |
| 1367 | 1455 | @end itemize |
| 1368 | 1456 | |
| 1457 | +@node MIPS System emulator invocation | |
| 1369 | 1458 | @section MIPS System emulator invocation |
| 1370 | 1459 | |
| 1371 | 1460 | Use the executable @file{qemu-system-mips} to simulate a MIPS machine. |
| ... | ... | @@ -1383,6 +1472,7 @@ NE2000 network card |
| 1383 | 1472 | |
| 1384 | 1473 | More information is available in the QEMU mailing-list archive. |
| 1385 | 1474 | |
| 1475 | +@node ARM System emulator invocation | |
| 1386 | 1476 | @section ARM System emulator invocation |
| 1387 | 1477 | |
| 1388 | 1478 | Use the executable @file{qemu-system-arm} to simulate a ARM |
| ... | ... | @@ -1401,8 +1491,16 @@ SMC 91c111 Ethernet adapter |
| 1401 | 1491 | A Linux 2.6 test image is available on the QEMU web site. More |
| 1402 | 1492 | information is available in the QEMU mailing-list archive. |
| 1403 | 1493 | |
| 1494 | +@node QEMU Linux User space emulator | |
| 1404 | 1495 | @chapter QEMU Linux User space emulator |
| 1405 | 1496 | |
| 1497 | +@menu | |
| 1498 | +* Quick Start:: | |
| 1499 | +* Wine launch:: | |
| 1500 | +* Command line options:: | |
| 1501 | +@end menu | |
| 1502 | + | |
| 1503 | +@node Quick Start | |
| 1406 | 1504 | @section Quick Start |
| 1407 | 1505 | |
| 1408 | 1506 | In order to launch a Linux process, QEMU needs the process executable |
| ... | ... | @@ -1446,11 +1544,13 @@ Linux kernel. |
| 1446 | 1544 | |
| 1447 | 1545 | @item The x86 version of QEMU is also included. You can try weird things such as: |
| 1448 | 1546 | @example |
| 1449 | -qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | |
| 1547 | +qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \ | |
| 1548 | + /usr/local/qemu-i386/bin/ls-i386 | |
| 1450 | 1549 | @end example |
| 1451 | 1550 | |
| 1452 | 1551 | @end itemize |
| 1453 | 1552 | |
| 1553 | +@node Wine launch | |
| 1454 | 1554 | @section Wine launch |
| 1455 | 1555 | |
| 1456 | 1556 | @itemize |
| ... | ... | @@ -1467,17 +1567,19 @@ qemu-i386 /usr/local/qemu-i386/bin/ls-i386 |
| 1467 | 1567 | (@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page). |
| 1468 | 1568 | |
| 1469 | 1569 | @item Configure Wine on your account. Look at the provided script |
| 1470 | -@file{/usr/local/qemu-i386/bin/wine-conf.sh}. Your previous | |
| 1570 | +@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous | |
| 1471 | 1571 | @code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}. |
| 1472 | 1572 | |
| 1473 | 1573 | @item Then you can try the example @file{putty.exe}: |
| 1474 | 1574 | |
| 1475 | 1575 | @example |
| 1476 | -qemu-i386 /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | |
| 1576 | +qemu-i386 /usr/local/qemu-i386/wine/bin/wine \ | |
| 1577 | + /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | |
| 1477 | 1578 | @end example |
| 1478 | 1579 | |
| 1479 | 1580 | @end itemize |
| 1480 | 1581 | |
| 1582 | +@node Command line options | |
| 1481 | 1583 | @section Command line options |
| 1482 | 1584 | |
| 1483 | 1585 | @example |
| ... | ... | @@ -1505,6 +1607,14 @@ Act as if the host page size was 'pagesize' bytes |
| 1505 | 1607 | @node compilation |
| 1506 | 1608 | @chapter Compilation from the sources |
| 1507 | 1609 | |
| 1610 | +@menu | |
| 1611 | +* Linux/Unix:: | |
| 1612 | +* Windows:: | |
| 1613 | +* Cross compilation for Windows with Linux:: | |
| 1614 | +* Mac OS X:: | |
| 1615 | +@end menu | |
| 1616 | + | |
| 1617 | +@node Linux/Unix | |
| 1508 | 1618 | @section Linux/Unix |
| 1509 | 1619 | |
| 1510 | 1620 | @subsection Compilation |
| ... | ... | @@ -1562,6 +1672,7 @@ ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0 |
| 1562 | 1672 | variables. You must use gcc 3.x on PowerPC. |
| 1563 | 1673 | @end example |
| 1564 | 1674 | |
| 1675 | +@node Windows | |
| 1565 | 1676 | @section Windows |
| 1566 | 1677 | |
| 1567 | 1678 | @itemize |
| ... | ... | @@ -1571,7 +1682,7 @@ instructions in the download section and the FAQ. |
| 1571 | 1682 | |
| 1572 | 1683 | @item Download |
| 1573 | 1684 | the MinGW development library of SDL 1.2.x |
| 1574 | -(@file{SDL-devel-1.2.x-mingw32.tar.gz}) from | |
| 1685 | +(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from | |
| 1575 | 1686 | @url{http://www.libsdl.org}. Unpack it in a temporary place, and |
| 1576 | 1687 | unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool |
| 1577 | 1688 | directory. Edit the @file{sdl-config} script so that it gives the |
| ... | ... | @@ -1591,6 +1702,7 @@ correct SDL directory when invoked. |
| 1591 | 1702 | |
| 1592 | 1703 | @end itemize |
| 1593 | 1704 | |
| 1705 | +@node Cross compilation for Windows with Linux | |
| 1594 | 1706 | @section Cross compilation for Windows with Linux |
| 1595 | 1707 | |
| 1596 | 1708 | @itemize |
| ... | ... | @@ -1622,9 +1734,15 @@ installation directory. |
| 1622 | 1734 | Note: Currently, Wine does not seem able to launch |
| 1623 | 1735 | QEMU for Win32. |
| 1624 | 1736 | |
| 1737 | +@node Mac OS X | |
| 1625 | 1738 | @section Mac OS X |
| 1626 | 1739 | |
| 1627 | 1740 | The Mac OS X patches are not fully merged in QEMU, so you should look |
| 1628 | 1741 | at the QEMU mailing list archive to have all the necessary |
| 1629 | 1742 | information. |
| 1630 | 1743 | |
| 1744 | +@node Index | |
| 1745 | +@chapter Index | |
| 1746 | +@printindex cp | |
| 1747 | + | |
| 1748 | +@bye | ... | ... |
qemu-tech.texi
| 1 | 1 | \input texinfo @c -*- texinfo -*- |
| 2 | +@c %**start of header | |
| 3 | +@setfilename qemu-tech.info | |
| 4 | +@settitle QEMU Internals | |
| 5 | +@exampleindent 0 | |
| 6 | +@paragraphindent 0 | |
| 7 | +@c %**end of header | |
| 2 | 8 | |
| 3 | 9 | @iftex |
| 4 | -@settitle QEMU Internals | |
| 5 | 10 | @titlepage |
| 6 | 11 | @sp 7 |
| 7 | 12 | @center @titlefont{QEMU Internals} |
| ... | ... | @@ -9,8 +14,32 @@ |
| 9 | 14 | @end titlepage |
| 10 | 15 | @end iftex |
| 11 | 16 | |
| 17 | +@ifnottex | |
| 18 | +@node Top | |
| 19 | +@top | |
| 20 | + | |
| 21 | +@menu | |
| 22 | +* Introduction:: | |
| 23 | +* QEMU Internals:: | |
| 24 | +* Regression Tests:: | |
| 25 | +* Index:: | |
| 26 | +@end menu | |
| 27 | +@end ifnottex | |
| 28 | + | |
| 29 | +@contents | |
| 30 | + | |
| 31 | +@node Introduction | |
| 12 | 32 | @chapter Introduction |
| 13 | 33 | |
| 34 | +@menu | |
| 35 | +* intro_features:: Features | |
| 36 | +* intro_x86_emulation:: x86 emulation | |
| 37 | +* intro_arm_emulation:: ARM emulation | |
| 38 | +* intro_ppc_emulation:: PowerPC emulation | |
| 39 | +* intro_sparc_emulation:: SPARC emulation | |
| 40 | +@end menu | |
| 41 | + | |
| 42 | +@node intro_features | |
| 14 | 43 | @section Features |
| 15 | 44 | |
| 16 | 45 | QEMU is a FAST! processor emulator using a portable dynamic |
| ... | ... | @@ -43,7 +72,7 @@ QEMU generic features: |
| 43 | 72 | |
| 44 | 73 | @item User space only or full system emulation. |
| 45 | 74 | |
| 46 | -@item Using dynamic translation to native code for reasonnable speed. | |
| 75 | +@item Using dynamic translation to native code for reasonable speed. | |
| 47 | 76 | |
| 48 | 77 | @item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. |
| 49 | 78 | |
| ... | ... | @@ -65,13 +94,13 @@ QEMU user mode emulation features: |
| 65 | 94 | |
| 66 | 95 | @item Accurate signal handling by remapping host signals to target signals. |
| 67 | 96 | @end itemize |
| 68 | -@end itemize | |
| 69 | 97 | |
| 70 | 98 | QEMU full system emulation features: |
| 71 | 99 | @itemize |
| 72 | 100 | @item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU. |
| 73 | 101 | @end itemize |
| 74 | 102 | |
| 103 | +@node intro_x86_emulation | |
| 75 | 104 | @section x86 emulation |
| 76 | 105 | |
| 77 | 106 | QEMU x86 target features: |
| ... | ... | @@ -110,6 +139,7 @@ maximum performances. |
| 110 | 139 | |
| 111 | 140 | @end itemize |
| 112 | 141 | |
| 142 | +@node intro_arm_emulation | |
| 113 | 143 | @section ARM emulation |
| 114 | 144 | |
| 115 | 145 | @itemize |
| ... | ... | @@ -122,6 +152,7 @@ maximum performances. |
| 122 | 152 | |
| 123 | 153 | @end itemize |
| 124 | 154 | |
| 155 | +@node intro_ppc_emulation | |
| 125 | 156 | @section PowerPC emulation |
| 126 | 157 | |
| 127 | 158 | @itemize |
| ... | ... | @@ -133,6 +164,7 @@ FPU and MMU. |
| 133 | 164 | |
| 134 | 165 | @end itemize |
| 135 | 166 | |
| 167 | +@node intro_sparc_emulation | |
| 136 | 168 | @section SPARC emulation |
| 137 | 169 | |
| 138 | 170 | @itemize |
| ... | ... | @@ -166,8 +198,26 @@ implemented. Floating point exception support is untested. |
| 166 | 198 | |
| 167 | 199 | @end itemize |
| 168 | 200 | |
| 201 | +@node QEMU Internals | |
| 169 | 202 | @chapter QEMU Internals |
| 170 | 203 | |
| 204 | +@menu | |
| 205 | +* QEMU compared to other emulators:: | |
| 206 | +* Portable dynamic translation:: | |
| 207 | +* Register allocation:: | |
| 208 | +* Condition code optimisations:: | |
| 209 | +* CPU state optimisations:: | |
| 210 | +* Translation cache:: | |
| 211 | +* Direct block chaining:: | |
| 212 | +* Self-modifying code and translated code invalidation:: | |
| 213 | +* Exception support:: | |
| 214 | +* MMU emulation:: | |
| 215 | +* Hardware interrupts:: | |
| 216 | +* User emulation specific details:: | |
| 217 | +* Bibliography:: | |
| 218 | +@end menu | |
| 219 | + | |
| 220 | +@node QEMU compared to other emulators | |
| 171 | 221 | @section QEMU compared to other emulators |
| 172 | 222 | |
| 173 | 223 | Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than |
| ... | ... | @@ -214,6 +264,7 @@ The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo |
| 214 | 264 | and potentially unsafe host drivers. Moreover, they are unable to |
| 215 | 265 | provide cycle exact simulation as an emulator can. |
| 216 | 266 | |
| 267 | +@node Portable dynamic translation | |
| 217 | 268 | @section Portable dynamic translation |
| 218 | 269 | |
| 219 | 270 | QEMU is a dynamic translator. When it first encounters a piece of code, |
| ... | ... | @@ -243,6 +294,7 @@ That way, QEMU is no more difficult to port than a dynamic linker. |
| 243 | 294 | To go even faster, GCC static register variables are used to keep the |
| 244 | 295 | state of the virtual CPU. |
| 245 | 296 | |
| 297 | +@node Register allocation | |
| 246 | 298 | @section Register allocation |
| 247 | 299 | |
| 248 | 300 | Since QEMU uses fixed simple instructions, no efficient register |
| ... | ... | @@ -250,6 +302,7 @@ allocation can be done. However, because RISC CPUs have a lot of |
| 250 | 302 | register, most of the virtual CPU state can be put in registers without |
| 251 | 303 | doing complicated register allocation. |
| 252 | 304 | |
| 305 | +@node Condition code optimisations | |
| 253 | 306 | @section Condition code optimisations |
| 254 | 307 | |
| 255 | 308 | Good CPU condition codes emulation (@code{EFLAGS} register on x86) is a |
| ... | ... | @@ -268,6 +321,7 @@ generated simple instructions (see |
| 268 | 321 | the condition codes are not needed by the next instructions, no |
| 269 | 322 | condition codes are computed at all. |
| 270 | 323 | |
| 324 | +@node CPU state optimisations | |
| 271 | 325 | @section CPU state optimisations |
| 272 | 326 | |
| 273 | 327 | The x86 CPU has many internal states which change the way it evaluates |
| ... | ... | @@ -279,6 +333,7 @@ segment base. |
| 279 | 333 | |
| 280 | 334 | [The FPU stack pointer register is not handled that way yet]. |
| 281 | 335 | |
| 336 | +@node Translation cache | |
| 282 | 337 | @section Translation cache |
| 283 | 338 | |
| 284 | 339 | A 16 MByte cache holds the most recently used translations. For |
| ... | ... | @@ -287,6 +342,7 @@ contains just a single basic block (a block of x86 instructions |
| 287 | 342 | terminated by a jump or by a virtual CPU state change which the |
| 288 | 343 | translator cannot deduce statically). |
| 289 | 344 | |
| 345 | +@node Direct block chaining | |
| 290 | 346 | @section Direct block chaining |
| 291 | 347 | |
| 292 | 348 | After each translated basic block is executed, QEMU uses the simulated |
| ... | ... | @@ -302,6 +358,7 @@ it easier to make the jump target modification atomic. On some host |
| 302 | 358 | architectures (such as x86 or PowerPC), the @code{JUMP} opcode is |
| 303 | 359 | directly patched so that the block chaining has no overhead. |
| 304 | 360 | |
| 361 | +@node Self-modifying code and translated code invalidation | |
| 305 | 362 | @section Self-modifying code and translated code invalidation |
| 306 | 363 | |
| 307 | 364 | Self-modifying code is a special challenge in x86 emulation because no |
| ... | ... | @@ -332,6 +389,7 @@ built. Every store into that page checks the bitmap to see if the code |
| 332 | 389 | really needs to be invalidated. It avoids invalidating the code when |
| 333 | 390 | only data is modified in the page. |
| 334 | 391 | |
| 392 | +@node Exception support | |
| 335 | 393 | @section Exception support |
| 336 | 394 | |
| 337 | 395 | longjmp() is used when an exception such as division by zero is |
| ... | ... | @@ -348,6 +406,7 @@ in some cases it is not computed because of condition code |
| 348 | 406 | optimisations. It is not a big concern because the emulated code can |
| 349 | 407 | still be restarted in any cases. |
| 350 | 408 | |
| 409 | +@node MMU emulation | |
| 351 | 410 | @section MMU emulation |
| 352 | 411 | |
| 353 | 412 | For system emulation, QEMU uses the mmap() system call to emulate the |
| ... | ... | @@ -367,6 +426,7 @@ means that each basic block is indexed with its physical address. |
| 367 | 426 | When MMU mappings change, only the chaining of the basic blocks is |
| 368 | 427 | reset (i.e. a basic block can no longer jump directly to another one). |
| 369 | 428 | |
| 429 | +@node Hardware interrupts | |
| 370 | 430 | @section Hardware interrupts |
| 371 | 431 | |
| 372 | 432 | In order to be faster, QEMU does not check at every basic block if an |
| ... | ... | @@ -377,6 +437,7 @@ block. It ensures that the execution will return soon in the main loop |
| 377 | 437 | of the CPU emulator. Then the main loop can test if the interrupt is |
| 378 | 438 | pending and handle it. |
| 379 | 439 | |
| 440 | +@node User emulation specific details | |
| 380 | 441 | @section User emulation specific details |
| 381 | 442 | |
| 382 | 443 | @subsection Linux system call translation |
| ... | ... | @@ -434,6 +495,7 @@ space conflicts. QEMU solves this problem by being an executable ELF |
| 434 | 495 | shared object as the ld-linux.so ELF interpreter. That way, it can be |
| 435 | 496 | relocated at load time. |
| 436 | 497 | |
| 498 | +@node Bibliography | |
| 437 | 499 | @section Bibliography |
| 438 | 500 | |
| 439 | 501 | @table @asis |
| ... | ... | @@ -456,7 +518,7 @@ by Kevin Lawton et al. |
| 456 | 518 | x86 emulator on Alpha-Linux. |
| 457 | 519 | |
| 458 | 520 | @item [5] |
| 459 | -@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf}, | |
| 521 | +@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf}, | |
| 460 | 522 | DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton |
| 461 | 523 | Chernoff and Ray Hookway. |
| 462 | 524 | |
| ... | ... | @@ -486,11 +548,19 @@ The TwoOStwo PC virtualizer. |
| 486 | 548 | |
| 487 | 549 | @end table |
| 488 | 550 | |
| 551 | +@node Regression Tests | |
| 489 | 552 | @chapter Regression Tests |
| 490 | 553 | |
| 491 | 554 | In the directory @file{tests/}, various interesting testing programs |
| 492 | 555 | are available. There are used for regression testing. |
| 493 | 556 | |
| 557 | +@menu | |
| 558 | +* test-i386:: | |
| 559 | +* linux-test:: | |
| 560 | +* qruncom.c:: | |
| 561 | +@end menu | |
| 562 | + | |
| 563 | +@node test-i386 | |
| 494 | 564 | @section @file{test-i386} |
| 495 | 565 | |
| 496 | 566 | This program executes most of the 16 bit and 32 bit x86 instructions and |
| ... | ... | @@ -506,12 +576,20 @@ The Linux system call @code{vm86()} is used to test vm86 emulation. |
| 506 | 576 | Various exceptions are raised to test most of the x86 user space |
| 507 | 577 | exception reporting. |
| 508 | 578 | |
| 579 | +@node linux-test | |
| 509 | 580 | @section @file{linux-test} |
| 510 | 581 | |
| 511 | 582 | This program tests various Linux system calls. It is used to verify |
| 512 | 583 | that the system call parameters are correctly converted between target |
| 513 | 584 | and host CPUs. |
| 514 | 585 | |
| 586 | +@node qruncom.c | |
| 515 | 587 | @section @file{qruncom.c} |
| 516 | 588 | |
| 517 | 589 | Example of usage of @code{libqemu} to emulate a user mode i386 CPU. |
| 590 | + | |
| 591 | +@node Index | |
| 592 | +@chapter Index | |
| 593 | +@printindex cp | |
| 594 | + | |
| 595 | +@bye | ... | ... |