Commit debc70650a973b0c67bd8ea69f8887cd41961ba8

Authored by bellard
1 parent 985d1742

Enhanced Documentation (Stefan Weil)


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1873 c046a42c-6fe2-441c-8c8c-71466251a162
Showing 2 changed files with 236 additions and 40 deletions
qemu-doc.texi
1 1 \input texinfo @c -*- texinfo -*-
  2 +@c %**start of header
  3 +@setfilename qemu-doc.info
  4 +@settitle QEMU CPU Emulator User Documentation
  5 +@exampleindent 0
  6 +@paragraphindent 0
  7 +@c %**end of header
2 8  
3 9 @iftex
4   -@settitle QEMU CPU Emulator User Documentation
5 10 @titlepage
6 11 @sp 7
7   -@center @titlefont{QEMU CPU Emulator User Documentation}
  12 +@center @titlefont{QEMU CPU Emulator}
  13 +@sp 1
  14 +@center @titlefont{User Documentation}
8 15 @sp 3
9 16 @end titlepage
10 17 @end iftex
11 18  
  19 +@ifnottex
  20 +@node Top
  21 +@top
  22 +
  23 +@menu
  24 +* Introduction::
  25 +* Installation::
  26 +* QEMU PC System emulator::
  27 +* QEMU System emulator for non PC targets::
  28 +* QEMU Linux User space emulator::
  29 +* compilation:: Compilation from the sources
  30 +* Index::
  31 +@end menu
  32 +@end ifnottex
  33 +
  34 +@contents
  35 +
  36 +@node Introduction
12 37 @chapter Introduction
13 38  
  39 +@menu
  40 +* intro_features:: Features
  41 +@end menu
  42 +
  43 +@node intro_features
14 44 @section Features
15 45  
16 46 QEMU is a FAST! processor emulator using dynamic translation to
... ... @@ -52,27 +82,53 @@ For system emulation, the following hardware targets are supported:
52 82  
53 83 For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported.
54 84  
  85 +@node Installation
55 86 @chapter Installation
56 87  
57 88 If you want to compile QEMU yourself, see @ref{compilation}.
58 89  
  90 +@menu
  91 +* install_linux:: Linux
  92 +* install_windows:: Windows
  93 +* install_mac:: Macintosh
  94 +@end menu
  95 +
  96 +@node install_linux
59 97 @section Linux
60 98  
61 99 If a precompiled package is available for your distribution - you just
62 100 have to install it. Otherwise, see @ref{compilation}.
63 101  
  102 +@node install_windows
64 103 @section Windows
65 104  
66 105 Download the experimental binary installer at
67   -@url{http://www.free.oszoo.org/download.html}.
  106 +@url{http://www.free.oszoo.org/@/download.html}.
68 107  
  108 +@node install_mac
69 109 @section Mac OS X
70 110  
71 111 Download the experimental binary installer at
72   -@url{http://www.free.oszoo.org/download.html}.
  112 +@url{http://www.free.oszoo.org/@/download.html}.
73 113  
  114 +@node QEMU PC System emulator
74 115 @chapter QEMU PC System emulator
75 116  
  117 +@menu
  118 +* pcsys_introduction:: Introduction
  119 +* pcsys_quickstart:: Quick Start
  120 +* sec_invocation:: Invocation
  121 +* pcsys_keys:: Keys
  122 +* pcsys_monitor:: QEMU Monitor
  123 +* disk_images:: Disk Images
  124 +* pcsys_network:: Network emulation
  125 +* direct_linux_boot:: Direct Linux Boot
  126 +* pcsys_usb:: USB emulation
  127 +* gdb_usage:: GDB usage
  128 +* pcsys_os_specific:: Target OS specific information
  129 +@end menu
  130 +
  131 +@node pcsys_introduction
76 132 @section Introduction
77 133  
78 134 @c man begin DESCRIPTION
... ... @@ -118,6 +174,7 @@ QEMU uses YM3812 emulation by Tatsuyuki Satoh.
118 174  
119 175 @c man end
120 176  
  177 +@node pcsys_quickstart
121 178 @section Quick Start
122 179  
123 180 Download and uncompress the linux image (@file{linux.img}) and type:
... ... @@ -147,14 +204,14 @@ Select the emulated machine (@code{-M ?} for list)
147 204  
148 205 @item -fda file
149 206 @item -fdb file
150   -Use @var{file} as floppy disk 0/1 image (@xref{disk_images}). You can
  207 +Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can
151 208 use the host floppy by using @file{/dev/fd0} as filename.
152 209  
153 210 @item -hda file
154 211 @item -hdb file
155 212 @item -hdc file
156 213 @item -hdd file
157   -Use @var{file} as hard disk 0, 1, 2 or 3 image (@xref{disk_images}).
  214 +Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}).
158 215  
159 216 @item -cdrom file
160 217 Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and
... ... @@ -168,7 +225,7 @@ the default.
168 225 @item -snapshot
169 226 Write to temporary files instead of disk image files. In this case,
170 227 the raw disk image you use is not written back. You can however force
171   -the write back by pressing @key{C-a s} (@xref{disk_images}).
  228 +the write back by pressing @key{C-a s} (@pxref{disk_images}).
172 229  
173 230 @item -m megs
174 231 Set virtual RAM size to @var{megs} megabytes. Default is 128 MB.
... ... @@ -304,9 +361,12 @@ specifies an already opened TCP socket.
304 361 Example:
305 362 @example
306 363 # launch a first QEMU instance
307   -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,listen=:1234
308   -# connect the VLAN 0 of this instance to the VLAN 0 of the first instance
309   -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,connect=127.0.0.1:1234
  364 +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \
  365 + -net socket,listen=:1234
  366 +# connect the VLAN 0 of this instance to the VLAN 0
  367 +# of the first instance
  368 +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \
  369 + -net socket,connect=127.0.0.1:1234
310 370 @end example
311 371  
312 372 @item -net socket[,vlan=n][,fd=h][,mcast=maddr:port]
... ... @@ -328,17 +388,22 @@ mcast support is compatible with User Mode Linux (argument @option{eth@var{N}=mc
328 388 Example:
329 389 @example
330 390 # launch one QEMU instance
331   -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=230.0.0.1:1234
  391 +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \
  392 + -net socket,mcast=230.0.0.1:1234
332 393 # launch another QEMU instance on same "bus"
333   -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,mcast=230.0.0.1:1234
  394 +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \
  395 + -net socket,mcast=230.0.0.1:1234
334 396 # launch yet another QEMU instance on same "bus"
335   -qemu linux.img -net nic,macaddr=52:54:00:12:34:58 -net socket,mcast=230.0.0.1:1234
  397 +qemu linux.img -net nic,macaddr=52:54:00:12:34:58 \
  398 + -net socket,mcast=230.0.0.1:1234
336 399 @end example
337 400  
338 401 Example (User Mode Linux compat.):
339 402 @example
340   -# launch QEMU instance (note mcast address selected is UML's default)
341   -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=239.192.168.1:1102
  403 +# launch QEMU instance (note mcast address selected
  404 +# is UML's default)
  405 +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \
  406 + -net socket,mcast=239.192.168.1:1102
342 407 # launch UML
343 408 /path/to/linux ubd0=/path/to/root_fs eth0=mcast
344 409 @end example
... ... @@ -471,7 +536,7 @@ The default device is @code{vc} in graphical mode and @code{stdio} in
471 536 non graphical mode.
472 537  
473 538 @item -s
474   -Wait gdb connection to port 1234 (@xref{gdb_usage}).
  539 +Wait gdb connection to port 1234 (@pxref{gdb_usage}).
475 540 @item -p port
476 541 Change gdb connection port.
477 542 @item -S
... ... @@ -494,6 +559,7 @@ Start right away with a saved state (@code{loadvm} in monitor)
494 559  
495 560 @c man end
496 561  
  562 +@node pcsys_keys
497 563 @section Keys
498 564  
499 565 @c man begin OPTIONS
... ... @@ -542,9 +608,6 @@ Send Ctrl-a
542 608  
543 609 @ignore
544 610  
545   -@setfilename qemu
546   -@settitle QEMU System Emulator
547   -
548 611 @c man begin SEEALSO
549 612 The HTML documentation of QEMU for more precise information and Linux
550 613 user mode emulator invocation.
... ... @@ -556,8 +619,7 @@ Fabrice Bellard
556 619  
557 620 @end ignore
558 621  
559   -@end ignore
560   -
  622 +@node pcsys_monitor
561 623 @section QEMU Monitor
562 624  
563 625 The QEMU monitor is used to give complex commands to the QEMU
... ... @@ -683,7 +745,7 @@ Dump 10 instructions at the current instruction pointer:
683 745  
684 746 @item
685 747 Dump 80 16 bit values at the start of the video memory.
686   -@example
  748 +@smallexample
687 749 (qemu) xp/80hx 0xb8000
688 750 0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42
689 751 0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41
... ... @@ -695,7 +757,7 @@ Dump 80 16 bit values at the start of the video memory.
695 757 0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
696 758 0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
697 759 0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
698   -@end example
  760 +@end smallexample
699 761 @end itemize
700 762  
701 763 @item p or print/fmt expr
... ... @@ -746,6 +808,14 @@ Since version 0.6.1, QEMU supports many disk image formats, including
746 808 growable disk images (their size increase as non empty sectors are
747 809 written), compressed and encrypted disk images.
748 810  
  811 +@menu
  812 +* disk_images_quickstart:: Quick start for disk image creation
  813 +* disk_images_snapshot_mode:: Snapshot mode
  814 +* qemu_img_invocation:: qemu-img Invocation
  815 +* disk_images_fat_images:: Virtual FAT disk images
  816 +@end menu
  817 +
  818 +@node disk_images_quickstart
749 819 @subsection Quick start for disk image creation
750 820  
751 821 You can create a disk image with the command:
... ... @@ -756,8 +826,9 @@ where @var{myimage.img} is the disk image filename and @var{mysize} is its
756 826 size in kilobytes. You can add an @code{M} suffix to give the size in
757 827 megabytes and a @code{G} suffix for gigabytes.
758 828  
759   -@xref{qemu_img_invocation} for more information.
  829 +See @ref{qemu_img_invocation} for more information.
760 830  
  831 +@node disk_images_snapshot_mode
761 832 @subsection Snapshot mode
762 833  
763 834 If you use the option @option{-snapshot}, all disk images are
... ... @@ -771,6 +842,7 @@ command (or @key{C-a s} in the serial console).
771 842  
772 843 @include qemu-img.texi
773 844  
  845 +@node disk_images_fat_images
774 846 @subsection Virtual FAT disk images
775 847  
776 848 QEMU can automatically create a virtual FAT disk image from a
... ... @@ -805,6 +877,7 @@ What you should @emph{never} do:
805 877 @item write to the FAT directory on the host system while accessing it with the guest system.
806 878 @end itemize
807 879  
  880 +@node pcsys_network
808 881 @section Network emulation
809 882  
810 883 QEMU can simulate several networks cards (NE2000 boards on the PC
... ... @@ -908,10 +981,10 @@ seen from the emulated kernel at IP address 172.20.0.1.
908 981  
909 982 @item Launch @code{qemu.sh}. You should have the following output:
910 983  
911   -@example
  984 +@smallexample
912 985 > ./qemu.sh
913 986 Connected to host network interface: tun0
914   -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
  987 +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
915 988 BIOS-provided physical RAM map:
916 989 BIOS-e801: 0000000000000000 - 000000000009f000 (usable)
917 990 BIOS-e801: 0000000000100000 - 0000000002000000 (usable)
... ... @@ -920,7 +993,7 @@ On node 0 totalpages: 8192
920 993 zone(0): 4096 pages.
921 994 zone(1): 4096 pages.
922 995 zone(2): 0 pages.
923   -Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe console=ttyS0
  996 +Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe @/ide5=noprobe console=ttyS0
924 997 ide_setup: ide2=noprobe
925 998 ide_setup: ide3=noprobe
926 999 ide_setup: ide4=noprobe
... ... @@ -929,7 +1002,7 @@ Initializing CPU#0
929 1002 Detected 2399.621 MHz processor.
930 1003 Console: colour EGA 80x25
931 1004 Calibrating delay loop... 4744.80 BogoMIPS
932   -Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, 0k highmem)
  1005 +Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, @/0k highmem)
933 1006 Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
934 1007 Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
935 1008 Mount cache hash table entries: 512 (order: 0, 4096 bytes)
... ... @@ -971,14 +1044,14 @@ EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
971 1044 VFS: Mounted root (ext2 filesystem).
972 1045 Freeing unused kernel memory: 64k freed
973 1046  
974   -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
  1047 +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
975 1048  
976 1049 QEMU Linux test distribution (based on Redhat 9)
977 1050  
978 1051 Type 'exit' to halt the system
979 1052  
980 1053 sh-2.05b#
981   -@end example
  1054 +@end smallexample
982 1055  
983 1056 @item
984 1057 Then you can play with the kernel inside the virtual serial console. You
... ... @@ -1028,6 +1101,7 @@ Lawton for the plex86 Project (@url{www.plex86.org}).
1028 1101  
1029 1102 @end enumerate
1030 1103  
  1104 +@node pcsys_usb
1031 1105 @section USB emulation
1032 1106  
1033 1107 QEMU emulates a PCI UHCI USB controller and a 8 port USB hub connected
... ... @@ -1111,7 +1185,8 @@ QEMU has a primitive support to work with gdb, so that you can do
1111 1185 In order to use gdb, launch qemu with the '-s' option. It will wait for a
1112 1186 gdb connection:
1113 1187 @example
1114   -> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
  1188 +> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
  1189 + -append "root=/dev/hda"
1115 1190 Connected to host network interface: tun0
1116 1191 Waiting gdb connection on port 1234
1117 1192 @end example
... ... @@ -1143,6 +1218,7 @@ Use @code{set architecture i8086} to dump 16 bit code. Then use
1143 1218 @code{x/10i $cs*16+*eip} to dump the code at the PC position.
1144 1219 @end enumerate
1145 1220  
  1221 +@node pcsys_os_specific
1146 1222 @section Target OS specific information
1147 1223  
1148 1224 @subsection Linux
... ... @@ -1229,12 +1305,22 @@ it takes host CPU cycles even when idle. You can install the utility
1229 1305 from @url{http://www.vmware.com/software/dosidle210.zip} to solve this
1230 1306 problem.
1231 1307  
  1308 +@node QEMU System emulator for non PC targets
1232 1309 @chapter QEMU System emulator for non PC targets
1233 1310  
1234 1311 QEMU is a generic emulator and it emulates many non PC
1235 1312 machines. Most of the options are similar to the PC emulator. The
1236 1313 differences are mentionned in the following sections.
1237 1314  
  1315 +@menu
  1316 +* QEMU PowerPC System emulator::
  1317 +* Sparc32 System emulator invocation::
  1318 +* Sparc64 System emulator invocation::
  1319 +* MIPS System emulator invocation::
  1320 +* ARM System emulator invocation::
  1321 +@end menu
  1322 +
  1323 +@node QEMU PowerPC System emulator
1238 1324 @section QEMU PowerPC System emulator
1239 1325  
1240 1326 Use the executable @file{qemu-system-ppc} to simulate a complete PREP
... ... @@ -1299,6 +1385,7 @@ Set the initial VGA graphic mode. The default is 800x600x15.
1299 1385 More information is available at
1300 1386 @url{http://perso.magic.fr/l_indien/qemu-ppc/}.
1301 1387  
  1388 +@node Sparc32 System emulator invocation
1302 1389 @section Sparc32 System emulator invocation
1303 1390  
1304 1391 Use the executable @file{qemu-system-sparc} to simulate a JavaStation
... ... @@ -1327,7 +1414,7 @@ Floppy drive
1327 1414 The number of peripherals is fixed in the architecture.
1328 1415  
1329 1416 QEMU uses the Proll, a PROM replacement available at
1330   -@url{http://people.redhat.com/zaitcev/linux/}. The required
  1417 +@url{http://people.redhat.com/@/zaitcev/linux/}. The required
1331 1418 QEMU-specific patches are included with the sources.
1332 1419  
1333 1420 A sample Linux 2.6 series kernel and ram disk image are available on
... ... @@ -1348,6 +1435,7 @@ Set the initial TCX graphic mode. The default is 1024x768.
1348 1435  
1349 1436 @c man end
1350 1437  
  1438 +@node Sparc64 System emulator invocation
1351 1439 @section Sparc64 System emulator invocation
1352 1440  
1353 1441 Use the executable @file{qemu-system-sparc64} to simulate a Sun4u machine.
... ... @@ -1366,6 +1454,7 @@ Non Volatile RAM M48T59
1366 1454 PC-compatible serial ports
1367 1455 @end itemize
1368 1456  
  1457 +@node MIPS System emulator invocation
1369 1458 @section MIPS System emulator invocation
1370 1459  
1371 1460 Use the executable @file{qemu-system-mips} to simulate a MIPS machine.
... ... @@ -1383,6 +1472,7 @@ NE2000 network card
1383 1472  
1384 1473 More information is available in the QEMU mailing-list archive.
1385 1474  
  1475 +@node ARM System emulator invocation
1386 1476 @section ARM System emulator invocation
1387 1477  
1388 1478 Use the executable @file{qemu-system-arm} to simulate a ARM
... ... @@ -1401,8 +1491,16 @@ SMC 91c111 Ethernet adapter
1401 1491 A Linux 2.6 test image is available on the QEMU web site. More
1402 1492 information is available in the QEMU mailing-list archive.
1403 1493  
  1494 +@node QEMU Linux User space emulator
1404 1495 @chapter QEMU Linux User space emulator
1405 1496  
  1497 +@menu
  1498 +* Quick Start::
  1499 +* Wine launch::
  1500 +* Command line options::
  1501 +@end menu
  1502 +
  1503 +@node Quick Start
1406 1504 @section Quick Start
1407 1505  
1408 1506 In order to launch a Linux process, QEMU needs the process executable
... ... @@ -1446,11 +1544,13 @@ Linux kernel.
1446 1544  
1447 1545 @item The x86 version of QEMU is also included. You can try weird things such as:
1448 1546 @example
1449   -qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386
  1547 +qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \
  1548 + /usr/local/qemu-i386/bin/ls-i386
1450 1549 @end example
1451 1550  
1452 1551 @end itemize
1453 1552  
  1553 +@node Wine launch
1454 1554 @section Wine launch
1455 1555  
1456 1556 @itemize
... ... @@ -1467,17 +1567,19 @@ qemu-i386 /usr/local/qemu-i386/bin/ls-i386
1467 1567 (@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page).
1468 1568  
1469 1569 @item Configure Wine on your account. Look at the provided script
1470   -@file{/usr/local/qemu-i386/bin/wine-conf.sh}. Your previous
  1570 +@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous
1471 1571 @code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}.
1472 1572  
1473 1573 @item Then you can try the example @file{putty.exe}:
1474 1574  
1475 1575 @example
1476   -qemu-i386 /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe
  1576 +qemu-i386 /usr/local/qemu-i386/wine/bin/wine \
  1577 + /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe
1477 1578 @end example
1478 1579  
1479 1580 @end itemize
1480 1581  
  1582 +@node Command line options
1481 1583 @section Command line options
1482 1584  
1483 1585 @example
... ... @@ -1505,6 +1607,14 @@ Act as if the host page size was 'pagesize' bytes
1505 1607 @node compilation
1506 1608 @chapter Compilation from the sources
1507 1609  
  1610 +@menu
  1611 +* Linux/Unix::
  1612 +* Windows::
  1613 +* Cross compilation for Windows with Linux::
  1614 +* Mac OS X::
  1615 +@end menu
  1616 +
  1617 +@node Linux/Unix
1508 1618 @section Linux/Unix
1509 1619  
1510 1620 @subsection Compilation
... ... @@ -1562,6 +1672,7 @@ ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0
1562 1672 variables. You must use gcc 3.x on PowerPC.
1563 1673 @end example
1564 1674  
  1675 +@node Windows
1565 1676 @section Windows
1566 1677  
1567 1678 @itemize
... ... @@ -1571,7 +1682,7 @@ instructions in the download section and the FAQ.
1571 1682  
1572 1683 @item Download
1573 1684 the MinGW development library of SDL 1.2.x
1574   -(@file{SDL-devel-1.2.x-mingw32.tar.gz}) from
  1685 +(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from
1575 1686 @url{http://www.libsdl.org}. Unpack it in a temporary place, and
1576 1687 unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool
1577 1688 directory. Edit the @file{sdl-config} script so that it gives the
... ... @@ -1591,6 +1702,7 @@ correct SDL directory when invoked.
1591 1702  
1592 1703 @end itemize
1593 1704  
  1705 +@node Cross compilation for Windows with Linux
1594 1706 @section Cross compilation for Windows with Linux
1595 1707  
1596 1708 @itemize
... ... @@ -1622,9 +1734,15 @@ installation directory.
1622 1734 Note: Currently, Wine does not seem able to launch
1623 1735 QEMU for Win32.
1624 1736  
  1737 +@node Mac OS X
1625 1738 @section Mac OS X
1626 1739  
1627 1740 The Mac OS X patches are not fully merged in QEMU, so you should look
1628 1741 at the QEMU mailing list archive to have all the necessary
1629 1742 information.
1630 1743  
  1744 +@node Index
  1745 +@chapter Index
  1746 +@printindex cp
  1747 +
  1748 +@bye
... ...
qemu-tech.texi
1 1 \input texinfo @c -*- texinfo -*-
  2 +@c %**start of header
  3 +@setfilename qemu-tech.info
  4 +@settitle QEMU Internals
  5 +@exampleindent 0
  6 +@paragraphindent 0
  7 +@c %**end of header
2 8  
3 9 @iftex
4   -@settitle QEMU Internals
5 10 @titlepage
6 11 @sp 7
7 12 @center @titlefont{QEMU Internals}
... ... @@ -9,8 +14,32 @@
9 14 @end titlepage
10 15 @end iftex
11 16  
  17 +@ifnottex
  18 +@node Top
  19 +@top
  20 +
  21 +@menu
  22 +* Introduction::
  23 +* QEMU Internals::
  24 +* Regression Tests::
  25 +* Index::
  26 +@end menu
  27 +@end ifnottex
  28 +
  29 +@contents
  30 +
  31 +@node Introduction
12 32 @chapter Introduction
13 33  
  34 +@menu
  35 +* intro_features:: Features
  36 +* intro_x86_emulation:: x86 emulation
  37 +* intro_arm_emulation:: ARM emulation
  38 +* intro_ppc_emulation:: PowerPC emulation
  39 +* intro_sparc_emulation:: SPARC emulation
  40 +@end menu
  41 +
  42 +@node intro_features
14 43 @section Features
15 44  
16 45 QEMU is a FAST! processor emulator using a portable dynamic
... ... @@ -43,7 +72,7 @@ QEMU generic features:
43 72  
44 73 @item User space only or full system emulation.
45 74  
46   -@item Using dynamic translation to native code for reasonnable speed.
  75 +@item Using dynamic translation to native code for reasonable speed.
47 76  
48 77 @item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390.
49 78  
... ... @@ -65,13 +94,13 @@ QEMU user mode emulation features:
65 94  
66 95 @item Accurate signal handling by remapping host signals to target signals.
67 96 @end itemize
68   -@end itemize
69 97  
70 98 QEMU full system emulation features:
71 99 @itemize
72 100 @item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU.
73 101 @end itemize
74 102  
  103 +@node intro_x86_emulation
75 104 @section x86 emulation
76 105  
77 106 QEMU x86 target features:
... ... @@ -110,6 +139,7 @@ maximum performances.
110 139  
111 140 @end itemize
112 141  
  142 +@node intro_arm_emulation
113 143 @section ARM emulation
114 144  
115 145 @itemize
... ... @@ -122,6 +152,7 @@ maximum performances.
122 152  
123 153 @end itemize
124 154  
  155 +@node intro_ppc_emulation
125 156 @section PowerPC emulation
126 157  
127 158 @itemize
... ... @@ -133,6 +164,7 @@ FPU and MMU.
133 164  
134 165 @end itemize
135 166  
  167 +@node intro_sparc_emulation
136 168 @section SPARC emulation
137 169  
138 170 @itemize
... ... @@ -166,8 +198,26 @@ implemented. Floating point exception support is untested.
166 198  
167 199 @end itemize
168 200  
  201 +@node QEMU Internals
169 202 @chapter QEMU Internals
170 203  
  204 +@menu
  205 +* QEMU compared to other emulators::
  206 +* Portable dynamic translation::
  207 +* Register allocation::
  208 +* Condition code optimisations::
  209 +* CPU state optimisations::
  210 +* Translation cache::
  211 +* Direct block chaining::
  212 +* Self-modifying code and translated code invalidation::
  213 +* Exception support::
  214 +* MMU emulation::
  215 +* Hardware interrupts::
  216 +* User emulation specific details::
  217 +* Bibliography::
  218 +@end menu
  219 +
  220 +@node QEMU compared to other emulators
171 221 @section QEMU compared to other emulators
172 222  
173 223 Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than
... ... @@ -214,6 +264,7 @@ The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo
214 264 and potentially unsafe host drivers. Moreover, they are unable to
215 265 provide cycle exact simulation as an emulator can.
216 266  
  267 +@node Portable dynamic translation
217 268 @section Portable dynamic translation
218 269  
219 270 QEMU is a dynamic translator. When it first encounters a piece of code,
... ... @@ -243,6 +294,7 @@ That way, QEMU is no more difficult to port than a dynamic linker.
243 294 To go even faster, GCC static register variables are used to keep the
244 295 state of the virtual CPU.
245 296  
  297 +@node Register allocation
246 298 @section Register allocation
247 299  
248 300 Since QEMU uses fixed simple instructions, no efficient register
... ... @@ -250,6 +302,7 @@ allocation can be done. However, because RISC CPUs have a lot of
250 302 register, most of the virtual CPU state can be put in registers without
251 303 doing complicated register allocation.
252 304  
  305 +@node Condition code optimisations
253 306 @section Condition code optimisations
254 307  
255 308 Good CPU condition codes emulation (@code{EFLAGS} register on x86) is a
... ... @@ -268,6 +321,7 @@ generated simple instructions (see
268 321 the condition codes are not needed by the next instructions, no
269 322 condition codes are computed at all.
270 323  
  324 +@node CPU state optimisations
271 325 @section CPU state optimisations
272 326  
273 327 The x86 CPU has many internal states which change the way it evaluates
... ... @@ -279,6 +333,7 @@ segment base.
279 333  
280 334 [The FPU stack pointer register is not handled that way yet].
281 335  
  336 +@node Translation cache
282 337 @section Translation cache
283 338  
284 339 A 16 MByte cache holds the most recently used translations. For
... ... @@ -287,6 +342,7 @@ contains just a single basic block (a block of x86 instructions
287 342 terminated by a jump or by a virtual CPU state change which the
288 343 translator cannot deduce statically).
289 344  
  345 +@node Direct block chaining
290 346 @section Direct block chaining
291 347  
292 348 After each translated basic block is executed, QEMU uses the simulated
... ... @@ -302,6 +358,7 @@ it easier to make the jump target modification atomic. On some host
302 358 architectures (such as x86 or PowerPC), the @code{JUMP} opcode is
303 359 directly patched so that the block chaining has no overhead.
304 360  
  361 +@node Self-modifying code and translated code invalidation
305 362 @section Self-modifying code and translated code invalidation
306 363  
307 364 Self-modifying code is a special challenge in x86 emulation because no
... ... @@ -332,6 +389,7 @@ built. Every store into that page checks the bitmap to see if the code
332 389 really needs to be invalidated. It avoids invalidating the code when
333 390 only data is modified in the page.
334 391  
  392 +@node Exception support
335 393 @section Exception support
336 394  
337 395 longjmp() is used when an exception such as division by zero is
... ... @@ -348,6 +406,7 @@ in some cases it is not computed because of condition code
348 406 optimisations. It is not a big concern because the emulated code can
349 407 still be restarted in any cases.
350 408  
  409 +@node MMU emulation
351 410 @section MMU emulation
352 411  
353 412 For system emulation, QEMU uses the mmap() system call to emulate the
... ... @@ -367,6 +426,7 @@ means that each basic block is indexed with its physical address.
367 426 When MMU mappings change, only the chaining of the basic blocks is
368 427 reset (i.e. a basic block can no longer jump directly to another one).
369 428  
  429 +@node Hardware interrupts
370 430 @section Hardware interrupts
371 431  
372 432 In order to be faster, QEMU does not check at every basic block if an
... ... @@ -377,6 +437,7 @@ block. It ensures that the execution will return soon in the main loop
377 437 of the CPU emulator. Then the main loop can test if the interrupt is
378 438 pending and handle it.
379 439  
  440 +@node User emulation specific details
380 441 @section User emulation specific details
381 442  
382 443 @subsection Linux system call translation
... ... @@ -434,6 +495,7 @@ space conflicts. QEMU solves this problem by being an executable ELF
434 495 shared object as the ld-linux.so ELF interpreter. That way, it can be
435 496 relocated at load time.
436 497  
  498 +@node Bibliography
437 499 @section Bibliography
438 500  
439 501 @table @asis
... ... @@ -456,7 +518,7 @@ by Kevin Lawton et al.
456 518 x86 emulator on Alpha-Linux.
457 519  
458 520 @item [5]
459   -@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf},
  521 +@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf},
460 522 DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton
461 523 Chernoff and Ray Hookway.
462 524  
... ... @@ -486,11 +548,19 @@ The TwoOStwo PC virtualizer.
486 548  
487 549 @end table
488 550  
  551 +@node Regression Tests
489 552 @chapter Regression Tests
490 553  
491 554 In the directory @file{tests/}, various interesting testing programs
492 555 are available. There are used for regression testing.
493 556  
  557 +@menu
  558 +* test-i386::
  559 +* linux-test::
  560 +* qruncom.c::
  561 +@end menu
  562 +
  563 +@node test-i386
494 564 @section @file{test-i386}
495 565  
496 566 This program executes most of the 16 bit and 32 bit x86 instructions and
... ... @@ -506,12 +576,20 @@ The Linux system call @code{vm86()} is used to test vm86 emulation.
506 576 Various exceptions are raised to test most of the x86 user space
507 577 exception reporting.
508 578  
  579 +@node linux-test
509 580 @section @file{linux-test}
510 581  
511 582 This program tests various Linux system calls. It is used to verify
512 583 that the system call parameters are correctly converted between target
513 584 and host CPUs.
514 585  
  586 +@node qruncom.c
515 587 @section @file{qruncom.c}
516 588  
517 589 Example of usage of @code{libqemu} to emulate a user mode i386 CPU.
  590 +
  591 +@node Index
  592 +@chapter Index
  593 +@printindex cp
  594 +
  595 +@bye
... ...