Commit debc70650a973b0c67bd8ea69f8887cd41961ba8
1 parent
985d1742
Enhanced Documentation (Stefan Weil)
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1873 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
2 changed files
with
236 additions
and
40 deletions
qemu-doc.texi
| 1 | \input texinfo @c -*- texinfo -*- | 1 | \input texinfo @c -*- texinfo -*- |
| 2 | +@c %**start of header | ||
| 3 | +@setfilename qemu-doc.info | ||
| 4 | +@settitle QEMU CPU Emulator User Documentation | ||
| 5 | +@exampleindent 0 | ||
| 6 | +@paragraphindent 0 | ||
| 7 | +@c %**end of header | ||
| 2 | 8 | ||
| 3 | @iftex | 9 | @iftex |
| 4 | -@settitle QEMU CPU Emulator User Documentation | ||
| 5 | @titlepage | 10 | @titlepage |
| 6 | @sp 7 | 11 | @sp 7 |
| 7 | -@center @titlefont{QEMU CPU Emulator User Documentation} | 12 | +@center @titlefont{QEMU CPU Emulator} |
| 13 | +@sp 1 | ||
| 14 | +@center @titlefont{User Documentation} | ||
| 8 | @sp 3 | 15 | @sp 3 |
| 9 | @end titlepage | 16 | @end titlepage |
| 10 | @end iftex | 17 | @end iftex |
| 11 | 18 | ||
| 19 | +@ifnottex | ||
| 20 | +@node Top | ||
| 21 | +@top | ||
| 22 | + | ||
| 23 | +@menu | ||
| 24 | +* Introduction:: | ||
| 25 | +* Installation:: | ||
| 26 | +* QEMU PC System emulator:: | ||
| 27 | +* QEMU System emulator for non PC targets:: | ||
| 28 | +* QEMU Linux User space emulator:: | ||
| 29 | +* compilation:: Compilation from the sources | ||
| 30 | +* Index:: | ||
| 31 | +@end menu | ||
| 32 | +@end ifnottex | ||
| 33 | + | ||
| 34 | +@contents | ||
| 35 | + | ||
| 36 | +@node Introduction | ||
| 12 | @chapter Introduction | 37 | @chapter Introduction |
| 13 | 38 | ||
| 39 | +@menu | ||
| 40 | +* intro_features:: Features | ||
| 41 | +@end menu | ||
| 42 | + | ||
| 43 | +@node intro_features | ||
| 14 | @section Features | 44 | @section Features |
| 15 | 45 | ||
| 16 | QEMU is a FAST! processor emulator using dynamic translation to | 46 | QEMU is a FAST! processor emulator using dynamic translation to |
| @@ -52,27 +82,53 @@ For system emulation, the following hardware targets are supported: | @@ -52,27 +82,53 @@ For system emulation, the following hardware targets are supported: | ||
| 52 | 82 | ||
| 53 | For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported. | 83 | For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported. |
| 54 | 84 | ||
| 85 | +@node Installation | ||
| 55 | @chapter Installation | 86 | @chapter Installation |
| 56 | 87 | ||
| 57 | If you want to compile QEMU yourself, see @ref{compilation}. | 88 | If you want to compile QEMU yourself, see @ref{compilation}. |
| 58 | 89 | ||
| 90 | +@menu | ||
| 91 | +* install_linux:: Linux | ||
| 92 | +* install_windows:: Windows | ||
| 93 | +* install_mac:: Macintosh | ||
| 94 | +@end menu | ||
| 95 | + | ||
| 96 | +@node install_linux | ||
| 59 | @section Linux | 97 | @section Linux |
| 60 | 98 | ||
| 61 | If a precompiled package is available for your distribution - you just | 99 | If a precompiled package is available for your distribution - you just |
| 62 | have to install it. Otherwise, see @ref{compilation}. | 100 | have to install it. Otherwise, see @ref{compilation}. |
| 63 | 101 | ||
| 102 | +@node install_windows | ||
| 64 | @section Windows | 103 | @section Windows |
| 65 | 104 | ||
| 66 | Download the experimental binary installer at | 105 | Download the experimental binary installer at |
| 67 | -@url{http://www.free.oszoo.org/download.html}. | 106 | +@url{http://www.free.oszoo.org/@/download.html}. |
| 68 | 107 | ||
| 108 | +@node install_mac | ||
| 69 | @section Mac OS X | 109 | @section Mac OS X |
| 70 | 110 | ||
| 71 | Download the experimental binary installer at | 111 | Download the experimental binary installer at |
| 72 | -@url{http://www.free.oszoo.org/download.html}. | 112 | +@url{http://www.free.oszoo.org/@/download.html}. |
| 73 | 113 | ||
| 114 | +@node QEMU PC System emulator | ||
| 74 | @chapter QEMU PC System emulator | 115 | @chapter QEMU PC System emulator |
| 75 | 116 | ||
| 117 | +@menu | ||
| 118 | +* pcsys_introduction:: Introduction | ||
| 119 | +* pcsys_quickstart:: Quick Start | ||
| 120 | +* sec_invocation:: Invocation | ||
| 121 | +* pcsys_keys:: Keys | ||
| 122 | +* pcsys_monitor:: QEMU Monitor | ||
| 123 | +* disk_images:: Disk Images | ||
| 124 | +* pcsys_network:: Network emulation | ||
| 125 | +* direct_linux_boot:: Direct Linux Boot | ||
| 126 | +* pcsys_usb:: USB emulation | ||
| 127 | +* gdb_usage:: GDB usage | ||
| 128 | +* pcsys_os_specific:: Target OS specific information | ||
| 129 | +@end menu | ||
| 130 | + | ||
| 131 | +@node pcsys_introduction | ||
| 76 | @section Introduction | 132 | @section Introduction |
| 77 | 133 | ||
| 78 | @c man begin DESCRIPTION | 134 | @c man begin DESCRIPTION |
| @@ -118,6 +174,7 @@ QEMU uses YM3812 emulation by Tatsuyuki Satoh. | @@ -118,6 +174,7 @@ QEMU uses YM3812 emulation by Tatsuyuki Satoh. | ||
| 118 | 174 | ||
| 119 | @c man end | 175 | @c man end |
| 120 | 176 | ||
| 177 | +@node pcsys_quickstart | ||
| 121 | @section Quick Start | 178 | @section Quick Start |
| 122 | 179 | ||
| 123 | Download and uncompress the linux image (@file{linux.img}) and type: | 180 | Download and uncompress the linux image (@file{linux.img}) and type: |
| @@ -147,14 +204,14 @@ Select the emulated machine (@code{-M ?} for list) | @@ -147,14 +204,14 @@ Select the emulated machine (@code{-M ?} for list) | ||
| 147 | 204 | ||
| 148 | @item -fda file | 205 | @item -fda file |
| 149 | @item -fdb file | 206 | @item -fdb file |
| 150 | -Use @var{file} as floppy disk 0/1 image (@xref{disk_images}). You can | 207 | +Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can |
| 151 | use the host floppy by using @file{/dev/fd0} as filename. | 208 | use the host floppy by using @file{/dev/fd0} as filename. |
| 152 | 209 | ||
| 153 | @item -hda file | 210 | @item -hda file |
| 154 | @item -hdb file | 211 | @item -hdb file |
| 155 | @item -hdc file | 212 | @item -hdc file |
| 156 | @item -hdd file | 213 | @item -hdd file |
| 157 | -Use @var{file} as hard disk 0, 1, 2 or 3 image (@xref{disk_images}). | 214 | +Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}). |
| 158 | 215 | ||
| 159 | @item -cdrom file | 216 | @item -cdrom file |
| 160 | Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and | 217 | Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and |
| @@ -168,7 +225,7 @@ the default. | @@ -168,7 +225,7 @@ the default. | ||
| 168 | @item -snapshot | 225 | @item -snapshot |
| 169 | Write to temporary files instead of disk image files. In this case, | 226 | Write to temporary files instead of disk image files. In this case, |
| 170 | the raw disk image you use is not written back. You can however force | 227 | the raw disk image you use is not written back. You can however force |
| 171 | -the write back by pressing @key{C-a s} (@xref{disk_images}). | 228 | +the write back by pressing @key{C-a s} (@pxref{disk_images}). |
| 172 | 229 | ||
| 173 | @item -m megs | 230 | @item -m megs |
| 174 | Set virtual RAM size to @var{megs} megabytes. Default is 128 MB. | 231 | Set virtual RAM size to @var{megs} megabytes. Default is 128 MB. |
| @@ -304,9 +361,12 @@ specifies an already opened TCP socket. | @@ -304,9 +361,12 @@ specifies an already opened TCP socket. | ||
| 304 | Example: | 361 | Example: |
| 305 | @example | 362 | @example |
| 306 | # launch a first QEMU instance | 363 | # launch a first QEMU instance |
| 307 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,listen=:1234 | ||
| 308 | -# connect the VLAN 0 of this instance to the VLAN 0 of the first instance | ||
| 309 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,connect=127.0.0.1:1234 | 364 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ |
| 365 | + -net socket,listen=:1234 | ||
| 366 | +# connect the VLAN 0 of this instance to the VLAN 0 | ||
| 367 | +# of the first instance | ||
| 368 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ | ||
| 369 | + -net socket,connect=127.0.0.1:1234 | ||
| 310 | @end example | 370 | @end example |
| 311 | 371 | ||
| 312 | @item -net socket[,vlan=n][,fd=h][,mcast=maddr:port] | 372 | @item -net socket[,vlan=n][,fd=h][,mcast=maddr:port] |
| @@ -328,17 +388,22 @@ mcast support is compatible with User Mode Linux (argument @option{eth@var{N}=mc | @@ -328,17 +388,22 @@ mcast support is compatible with User Mode Linux (argument @option{eth@var{N}=mc | ||
| 328 | Example: | 388 | Example: |
| 329 | @example | 389 | @example |
| 330 | # launch one QEMU instance | 390 | # launch one QEMU instance |
| 331 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=230.0.0.1:1234 | 391 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ |
| 392 | + -net socket,mcast=230.0.0.1:1234 | ||
| 332 | # launch another QEMU instance on same "bus" | 393 | # launch another QEMU instance on same "bus" |
| 333 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:57 -net socket,mcast=230.0.0.1:1234 | 394 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ |
| 395 | + -net socket,mcast=230.0.0.1:1234 | ||
| 334 | # launch yet another QEMU instance on same "bus" | 396 | # launch yet another QEMU instance on same "bus" |
| 335 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:58 -net socket,mcast=230.0.0.1:1234 | 397 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:58 \ |
| 398 | + -net socket,mcast=230.0.0.1:1234 | ||
| 336 | @end example | 399 | @end example |
| 337 | 400 | ||
| 338 | Example (User Mode Linux compat.): | 401 | Example (User Mode Linux compat.): |
| 339 | @example | 402 | @example |
| 340 | -# launch QEMU instance (note mcast address selected is UML's default) | ||
| 341 | -qemu linux.img -net nic,macaddr=52:54:00:12:34:56 -net socket,mcast=239.192.168.1:1102 | 403 | +# launch QEMU instance (note mcast address selected |
| 404 | +# is UML's default) | ||
| 405 | +qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ | ||
| 406 | + -net socket,mcast=239.192.168.1:1102 | ||
| 342 | # launch UML | 407 | # launch UML |
| 343 | /path/to/linux ubd0=/path/to/root_fs eth0=mcast | 408 | /path/to/linux ubd0=/path/to/root_fs eth0=mcast |
| 344 | @end example | 409 | @end example |
| @@ -471,7 +536,7 @@ The default device is @code{vc} in graphical mode and @code{stdio} in | @@ -471,7 +536,7 @@ The default device is @code{vc} in graphical mode and @code{stdio} in | ||
| 471 | non graphical mode. | 536 | non graphical mode. |
| 472 | 537 | ||
| 473 | @item -s | 538 | @item -s |
| 474 | -Wait gdb connection to port 1234 (@xref{gdb_usage}). | 539 | +Wait gdb connection to port 1234 (@pxref{gdb_usage}). |
| 475 | @item -p port | 540 | @item -p port |
| 476 | Change gdb connection port. | 541 | Change gdb connection port. |
| 477 | @item -S | 542 | @item -S |
| @@ -494,6 +559,7 @@ Start right away with a saved state (@code{loadvm} in monitor) | @@ -494,6 +559,7 @@ Start right away with a saved state (@code{loadvm} in monitor) | ||
| 494 | 559 | ||
| 495 | @c man end | 560 | @c man end |
| 496 | 561 | ||
| 562 | +@node pcsys_keys | ||
| 497 | @section Keys | 563 | @section Keys |
| 498 | 564 | ||
| 499 | @c man begin OPTIONS | 565 | @c man begin OPTIONS |
| @@ -542,9 +608,6 @@ Send Ctrl-a | @@ -542,9 +608,6 @@ Send Ctrl-a | ||
| 542 | 608 | ||
| 543 | @ignore | 609 | @ignore |
| 544 | 610 | ||
| 545 | -@setfilename qemu | ||
| 546 | -@settitle QEMU System Emulator | ||
| 547 | - | ||
| 548 | @c man begin SEEALSO | 611 | @c man begin SEEALSO |
| 549 | The HTML documentation of QEMU for more precise information and Linux | 612 | The HTML documentation of QEMU for more precise information and Linux |
| 550 | user mode emulator invocation. | 613 | user mode emulator invocation. |
| @@ -556,8 +619,7 @@ Fabrice Bellard | @@ -556,8 +619,7 @@ Fabrice Bellard | ||
| 556 | 619 | ||
| 557 | @end ignore | 620 | @end ignore |
| 558 | 621 | ||
| 559 | -@end ignore | ||
| 560 | - | 622 | +@node pcsys_monitor |
| 561 | @section QEMU Monitor | 623 | @section QEMU Monitor |
| 562 | 624 | ||
| 563 | The QEMU monitor is used to give complex commands to the QEMU | 625 | The QEMU monitor is used to give complex commands to the QEMU |
| @@ -683,7 +745,7 @@ Dump 10 instructions at the current instruction pointer: | @@ -683,7 +745,7 @@ Dump 10 instructions at the current instruction pointer: | ||
| 683 | 745 | ||
| 684 | @item | 746 | @item |
| 685 | Dump 80 16 bit values at the start of the video memory. | 747 | Dump 80 16 bit values at the start of the video memory. |
| 686 | -@example | 748 | +@smallexample |
| 687 | (qemu) xp/80hx 0xb8000 | 749 | (qemu) xp/80hx 0xb8000 |
| 688 | 0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42 | 750 | 0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42 |
| 689 | 0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41 | 751 | 0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41 |
| @@ -695,7 +757,7 @@ Dump 80 16 bit values at the start of the video memory. | @@ -695,7 +757,7 @@ Dump 80 16 bit values at the start of the video memory. | ||
| 695 | 0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 | 757 | 0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
| 696 | 0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 | 758 | 0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
| 697 | 0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 | 759 | 0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
| 698 | -@end example | 760 | +@end smallexample |
| 699 | @end itemize | 761 | @end itemize |
| 700 | 762 | ||
| 701 | @item p or print/fmt expr | 763 | @item p or print/fmt expr |
| @@ -746,6 +808,14 @@ Since version 0.6.1, QEMU supports many disk image formats, including | @@ -746,6 +808,14 @@ Since version 0.6.1, QEMU supports many disk image formats, including | ||
| 746 | growable disk images (their size increase as non empty sectors are | 808 | growable disk images (their size increase as non empty sectors are |
| 747 | written), compressed and encrypted disk images. | 809 | written), compressed and encrypted disk images. |
| 748 | 810 | ||
| 811 | +@menu | ||
| 812 | +* disk_images_quickstart:: Quick start for disk image creation | ||
| 813 | +* disk_images_snapshot_mode:: Snapshot mode | ||
| 814 | +* qemu_img_invocation:: qemu-img Invocation | ||
| 815 | +* disk_images_fat_images:: Virtual FAT disk images | ||
| 816 | +@end menu | ||
| 817 | + | ||
| 818 | +@node disk_images_quickstart | ||
| 749 | @subsection Quick start for disk image creation | 819 | @subsection Quick start for disk image creation |
| 750 | 820 | ||
| 751 | You can create a disk image with the command: | 821 | You can create a disk image with the command: |
| @@ -756,8 +826,9 @@ where @var{myimage.img} is the disk image filename and @var{mysize} is its | @@ -756,8 +826,9 @@ where @var{myimage.img} is the disk image filename and @var{mysize} is its | ||
| 756 | size in kilobytes. You can add an @code{M} suffix to give the size in | 826 | size in kilobytes. You can add an @code{M} suffix to give the size in |
| 757 | megabytes and a @code{G} suffix for gigabytes. | 827 | megabytes and a @code{G} suffix for gigabytes. |
| 758 | 828 | ||
| 759 | -@xref{qemu_img_invocation} for more information. | 829 | +See @ref{qemu_img_invocation} for more information. |
| 760 | 830 | ||
| 831 | +@node disk_images_snapshot_mode | ||
| 761 | @subsection Snapshot mode | 832 | @subsection Snapshot mode |
| 762 | 833 | ||
| 763 | If you use the option @option{-snapshot}, all disk images are | 834 | If you use the option @option{-snapshot}, all disk images are |
| @@ -771,6 +842,7 @@ command (or @key{C-a s} in the serial console). | @@ -771,6 +842,7 @@ command (or @key{C-a s} in the serial console). | ||
| 771 | 842 | ||
| 772 | @include qemu-img.texi | 843 | @include qemu-img.texi |
| 773 | 844 | ||
| 845 | +@node disk_images_fat_images | ||
| 774 | @subsection Virtual FAT disk images | 846 | @subsection Virtual FAT disk images |
| 775 | 847 | ||
| 776 | QEMU can automatically create a virtual FAT disk image from a | 848 | QEMU can automatically create a virtual FAT disk image from a |
| @@ -805,6 +877,7 @@ What you should @emph{never} do: | @@ -805,6 +877,7 @@ What you should @emph{never} do: | ||
| 805 | @item write to the FAT directory on the host system while accessing it with the guest system. | 877 | @item write to the FAT directory on the host system while accessing it with the guest system. |
| 806 | @end itemize | 878 | @end itemize |
| 807 | 879 | ||
| 880 | +@node pcsys_network | ||
| 808 | @section Network emulation | 881 | @section Network emulation |
| 809 | 882 | ||
| 810 | QEMU can simulate several networks cards (NE2000 boards on the PC | 883 | QEMU can simulate several networks cards (NE2000 boards on the PC |
| @@ -908,10 +981,10 @@ seen from the emulated kernel at IP address 172.20.0.1. | @@ -908,10 +981,10 @@ seen from the emulated kernel at IP address 172.20.0.1. | ||
| 908 | 981 | ||
| 909 | @item Launch @code{qemu.sh}. You should have the following output: | 982 | @item Launch @code{qemu.sh}. You should have the following output: |
| 910 | 983 | ||
| 911 | -@example | 984 | +@smallexample |
| 912 | > ./qemu.sh | 985 | > ./qemu.sh |
| 913 | Connected to host network interface: tun0 | 986 | Connected to host network interface: tun0 |
| 914 | -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | 987 | +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 |
| 915 | BIOS-provided physical RAM map: | 988 | BIOS-provided physical RAM map: |
| 916 | BIOS-e801: 0000000000000000 - 000000000009f000 (usable) | 989 | BIOS-e801: 0000000000000000 - 000000000009f000 (usable) |
| 917 | BIOS-e801: 0000000000100000 - 0000000002000000 (usable) | 990 | BIOS-e801: 0000000000100000 - 0000000002000000 (usable) |
| @@ -920,7 +993,7 @@ On node 0 totalpages: 8192 | @@ -920,7 +993,7 @@ On node 0 totalpages: 8192 | ||
| 920 | zone(0): 4096 pages. | 993 | zone(0): 4096 pages. |
| 921 | zone(1): 4096 pages. | 994 | zone(1): 4096 pages. |
| 922 | zone(2): 0 pages. | 995 | zone(2): 0 pages. |
| 923 | -Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe console=ttyS0 | 996 | +Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe @/ide5=noprobe console=ttyS0 |
| 924 | ide_setup: ide2=noprobe | 997 | ide_setup: ide2=noprobe |
| 925 | ide_setup: ide3=noprobe | 998 | ide_setup: ide3=noprobe |
| 926 | ide_setup: ide4=noprobe | 999 | ide_setup: ide4=noprobe |
| @@ -929,7 +1002,7 @@ Initializing CPU#0 | @@ -929,7 +1002,7 @@ Initializing CPU#0 | ||
| 929 | Detected 2399.621 MHz processor. | 1002 | Detected 2399.621 MHz processor. |
| 930 | Console: colour EGA 80x25 | 1003 | Console: colour EGA 80x25 |
| 931 | Calibrating delay loop... 4744.80 BogoMIPS | 1004 | Calibrating delay loop... 4744.80 BogoMIPS |
| 932 | -Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, 0k highmem) | 1005 | +Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, @/0k highmem) |
| 933 | Dentry cache hash table entries: 4096 (order: 3, 32768 bytes) | 1006 | Dentry cache hash table entries: 4096 (order: 3, 32768 bytes) |
| 934 | Inode cache hash table entries: 2048 (order: 2, 16384 bytes) | 1007 | Inode cache hash table entries: 2048 (order: 2, 16384 bytes) |
| 935 | Mount cache hash table entries: 512 (order: 0, 4096 bytes) | 1008 | Mount cache hash table entries: 512 (order: 0, 4096 bytes) |
| @@ -971,14 +1044,14 @@ EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended | @@ -971,14 +1044,14 @@ EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended | ||
| 971 | VFS: Mounted root (ext2 filesystem). | 1044 | VFS: Mounted root (ext2 filesystem). |
| 972 | Freeing unused kernel memory: 64k freed | 1045 | Freeing unused kernel memory: 64k freed |
| 973 | 1046 | ||
| 974 | -Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 | 1047 | +Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 |
| 975 | 1048 | ||
| 976 | QEMU Linux test distribution (based on Redhat 9) | 1049 | QEMU Linux test distribution (based on Redhat 9) |
| 977 | 1050 | ||
| 978 | Type 'exit' to halt the system | 1051 | Type 'exit' to halt the system |
| 979 | 1052 | ||
| 980 | sh-2.05b# | 1053 | sh-2.05b# |
| 981 | -@end example | 1054 | +@end smallexample |
| 982 | 1055 | ||
| 983 | @item | 1056 | @item |
| 984 | Then you can play with the kernel inside the virtual serial console. You | 1057 | Then you can play with the kernel inside the virtual serial console. You |
| @@ -1028,6 +1101,7 @@ Lawton for the plex86 Project (@url{www.plex86.org}). | @@ -1028,6 +1101,7 @@ Lawton for the plex86 Project (@url{www.plex86.org}). | ||
| 1028 | 1101 | ||
| 1029 | @end enumerate | 1102 | @end enumerate |
| 1030 | 1103 | ||
| 1104 | +@node pcsys_usb | ||
| 1031 | @section USB emulation | 1105 | @section USB emulation |
| 1032 | 1106 | ||
| 1033 | QEMU emulates a PCI UHCI USB controller and a 8 port USB hub connected | 1107 | QEMU emulates a PCI UHCI USB controller and a 8 port USB hub connected |
| @@ -1111,7 +1185,8 @@ QEMU has a primitive support to work with gdb, so that you can do | @@ -1111,7 +1185,8 @@ QEMU has a primitive support to work with gdb, so that you can do | ||
| 1111 | In order to use gdb, launch qemu with the '-s' option. It will wait for a | 1185 | In order to use gdb, launch qemu with the '-s' option. It will wait for a |
| 1112 | gdb connection: | 1186 | gdb connection: |
| 1113 | @example | 1187 | @example |
| 1114 | -> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda" | 1188 | +> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \ |
| 1189 | + -append "root=/dev/hda" | ||
| 1115 | Connected to host network interface: tun0 | 1190 | Connected to host network interface: tun0 |
| 1116 | Waiting gdb connection on port 1234 | 1191 | Waiting gdb connection on port 1234 |
| 1117 | @end example | 1192 | @end example |
| @@ -1143,6 +1218,7 @@ Use @code{set architecture i8086} to dump 16 bit code. Then use | @@ -1143,6 +1218,7 @@ Use @code{set architecture i8086} to dump 16 bit code. Then use | ||
| 1143 | @code{x/10i $cs*16+*eip} to dump the code at the PC position. | 1218 | @code{x/10i $cs*16+*eip} to dump the code at the PC position. |
| 1144 | @end enumerate | 1219 | @end enumerate |
| 1145 | 1220 | ||
| 1221 | +@node pcsys_os_specific | ||
| 1146 | @section Target OS specific information | 1222 | @section Target OS specific information |
| 1147 | 1223 | ||
| 1148 | @subsection Linux | 1224 | @subsection Linux |
| @@ -1229,12 +1305,22 @@ it takes host CPU cycles even when idle. You can install the utility | @@ -1229,12 +1305,22 @@ it takes host CPU cycles even when idle. You can install the utility | ||
| 1229 | from @url{http://www.vmware.com/software/dosidle210.zip} to solve this | 1305 | from @url{http://www.vmware.com/software/dosidle210.zip} to solve this |
| 1230 | problem. | 1306 | problem. |
| 1231 | 1307 | ||
| 1308 | +@node QEMU System emulator for non PC targets | ||
| 1232 | @chapter QEMU System emulator for non PC targets | 1309 | @chapter QEMU System emulator for non PC targets |
| 1233 | 1310 | ||
| 1234 | QEMU is a generic emulator and it emulates many non PC | 1311 | QEMU is a generic emulator and it emulates many non PC |
| 1235 | machines. Most of the options are similar to the PC emulator. The | 1312 | machines. Most of the options are similar to the PC emulator. The |
| 1236 | differences are mentionned in the following sections. | 1313 | differences are mentionned in the following sections. |
| 1237 | 1314 | ||
| 1315 | +@menu | ||
| 1316 | +* QEMU PowerPC System emulator:: | ||
| 1317 | +* Sparc32 System emulator invocation:: | ||
| 1318 | +* Sparc64 System emulator invocation:: | ||
| 1319 | +* MIPS System emulator invocation:: | ||
| 1320 | +* ARM System emulator invocation:: | ||
| 1321 | +@end menu | ||
| 1322 | + | ||
| 1323 | +@node QEMU PowerPC System emulator | ||
| 1238 | @section QEMU PowerPC System emulator | 1324 | @section QEMU PowerPC System emulator |
| 1239 | 1325 | ||
| 1240 | Use the executable @file{qemu-system-ppc} to simulate a complete PREP | 1326 | Use the executable @file{qemu-system-ppc} to simulate a complete PREP |
| @@ -1299,6 +1385,7 @@ Set the initial VGA graphic mode. The default is 800x600x15. | @@ -1299,6 +1385,7 @@ Set the initial VGA graphic mode. The default is 800x600x15. | ||
| 1299 | More information is available at | 1385 | More information is available at |
| 1300 | @url{http://perso.magic.fr/l_indien/qemu-ppc/}. | 1386 | @url{http://perso.magic.fr/l_indien/qemu-ppc/}. |
| 1301 | 1387 | ||
| 1388 | +@node Sparc32 System emulator invocation | ||
| 1302 | @section Sparc32 System emulator invocation | 1389 | @section Sparc32 System emulator invocation |
| 1303 | 1390 | ||
| 1304 | Use the executable @file{qemu-system-sparc} to simulate a JavaStation | 1391 | Use the executable @file{qemu-system-sparc} to simulate a JavaStation |
| @@ -1327,7 +1414,7 @@ Floppy drive | @@ -1327,7 +1414,7 @@ Floppy drive | ||
| 1327 | The number of peripherals is fixed in the architecture. | 1414 | The number of peripherals is fixed in the architecture. |
| 1328 | 1415 | ||
| 1329 | QEMU uses the Proll, a PROM replacement available at | 1416 | QEMU uses the Proll, a PROM replacement available at |
| 1330 | -@url{http://people.redhat.com/zaitcev/linux/}. The required | 1417 | +@url{http://people.redhat.com/@/zaitcev/linux/}. The required |
| 1331 | QEMU-specific patches are included with the sources. | 1418 | QEMU-specific patches are included with the sources. |
| 1332 | 1419 | ||
| 1333 | A sample Linux 2.6 series kernel and ram disk image are available on | 1420 | A sample Linux 2.6 series kernel and ram disk image are available on |
| @@ -1348,6 +1435,7 @@ Set the initial TCX graphic mode. The default is 1024x768. | @@ -1348,6 +1435,7 @@ Set the initial TCX graphic mode. The default is 1024x768. | ||
| 1348 | 1435 | ||
| 1349 | @c man end | 1436 | @c man end |
| 1350 | 1437 | ||
| 1438 | +@node Sparc64 System emulator invocation | ||
| 1351 | @section Sparc64 System emulator invocation | 1439 | @section Sparc64 System emulator invocation |
| 1352 | 1440 | ||
| 1353 | Use the executable @file{qemu-system-sparc64} to simulate a Sun4u machine. | 1441 | Use the executable @file{qemu-system-sparc64} to simulate a Sun4u machine. |
| @@ -1366,6 +1454,7 @@ Non Volatile RAM M48T59 | @@ -1366,6 +1454,7 @@ Non Volatile RAM M48T59 | ||
| 1366 | PC-compatible serial ports | 1454 | PC-compatible serial ports |
| 1367 | @end itemize | 1455 | @end itemize |
| 1368 | 1456 | ||
| 1457 | +@node MIPS System emulator invocation | ||
| 1369 | @section MIPS System emulator invocation | 1458 | @section MIPS System emulator invocation |
| 1370 | 1459 | ||
| 1371 | Use the executable @file{qemu-system-mips} to simulate a MIPS machine. | 1460 | Use the executable @file{qemu-system-mips} to simulate a MIPS machine. |
| @@ -1383,6 +1472,7 @@ NE2000 network card | @@ -1383,6 +1472,7 @@ NE2000 network card | ||
| 1383 | 1472 | ||
| 1384 | More information is available in the QEMU mailing-list archive. | 1473 | More information is available in the QEMU mailing-list archive. |
| 1385 | 1474 | ||
| 1475 | +@node ARM System emulator invocation | ||
| 1386 | @section ARM System emulator invocation | 1476 | @section ARM System emulator invocation |
| 1387 | 1477 | ||
| 1388 | Use the executable @file{qemu-system-arm} to simulate a ARM | 1478 | Use the executable @file{qemu-system-arm} to simulate a ARM |
| @@ -1401,8 +1491,16 @@ SMC 91c111 Ethernet adapter | @@ -1401,8 +1491,16 @@ SMC 91c111 Ethernet adapter | ||
| 1401 | A Linux 2.6 test image is available on the QEMU web site. More | 1491 | A Linux 2.6 test image is available on the QEMU web site. More |
| 1402 | information is available in the QEMU mailing-list archive. | 1492 | information is available in the QEMU mailing-list archive. |
| 1403 | 1493 | ||
| 1494 | +@node QEMU Linux User space emulator | ||
| 1404 | @chapter QEMU Linux User space emulator | 1495 | @chapter QEMU Linux User space emulator |
| 1405 | 1496 | ||
| 1497 | +@menu | ||
| 1498 | +* Quick Start:: | ||
| 1499 | +* Wine launch:: | ||
| 1500 | +* Command line options:: | ||
| 1501 | +@end menu | ||
| 1502 | + | ||
| 1503 | +@node Quick Start | ||
| 1406 | @section Quick Start | 1504 | @section Quick Start |
| 1407 | 1505 | ||
| 1408 | In order to launch a Linux process, QEMU needs the process executable | 1506 | In order to launch a Linux process, QEMU needs the process executable |
| @@ -1446,11 +1544,13 @@ Linux kernel. | @@ -1446,11 +1544,13 @@ Linux kernel. | ||
| 1446 | 1544 | ||
| 1447 | @item The x86 version of QEMU is also included. You can try weird things such as: | 1545 | @item The x86 version of QEMU is also included. You can try weird things such as: |
| 1448 | @example | 1546 | @example |
| 1449 | -qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | 1547 | +qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \ |
| 1548 | + /usr/local/qemu-i386/bin/ls-i386 | ||
| 1450 | @end example | 1549 | @end example |
| 1451 | 1550 | ||
| 1452 | @end itemize | 1551 | @end itemize |
| 1453 | 1552 | ||
| 1553 | +@node Wine launch | ||
| 1454 | @section Wine launch | 1554 | @section Wine launch |
| 1455 | 1555 | ||
| 1456 | @itemize | 1556 | @itemize |
| @@ -1467,17 +1567,19 @@ qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | @@ -1467,17 +1567,19 @@ qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | ||
| 1467 | (@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page). | 1567 | (@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page). |
| 1468 | 1568 | ||
| 1469 | @item Configure Wine on your account. Look at the provided script | 1569 | @item Configure Wine on your account. Look at the provided script |
| 1470 | -@file{/usr/local/qemu-i386/bin/wine-conf.sh}. Your previous | 1570 | +@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous |
| 1471 | @code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}. | 1571 | @code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}. |
| 1472 | 1572 | ||
| 1473 | @item Then you can try the example @file{putty.exe}: | 1573 | @item Then you can try the example @file{putty.exe}: |
| 1474 | 1574 | ||
| 1475 | @example | 1575 | @example |
| 1476 | -qemu-i386 /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | 1576 | +qemu-i386 /usr/local/qemu-i386/wine/bin/wine \ |
| 1577 | + /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | ||
| 1477 | @end example | 1578 | @end example |
| 1478 | 1579 | ||
| 1479 | @end itemize | 1580 | @end itemize |
| 1480 | 1581 | ||
| 1582 | +@node Command line options | ||
| 1481 | @section Command line options | 1583 | @section Command line options |
| 1482 | 1584 | ||
| 1483 | @example | 1585 | @example |
| @@ -1505,6 +1607,14 @@ Act as if the host page size was 'pagesize' bytes | @@ -1505,6 +1607,14 @@ Act as if the host page size was 'pagesize' bytes | ||
| 1505 | @node compilation | 1607 | @node compilation |
| 1506 | @chapter Compilation from the sources | 1608 | @chapter Compilation from the sources |
| 1507 | 1609 | ||
| 1610 | +@menu | ||
| 1611 | +* Linux/Unix:: | ||
| 1612 | +* Windows:: | ||
| 1613 | +* Cross compilation for Windows with Linux:: | ||
| 1614 | +* Mac OS X:: | ||
| 1615 | +@end menu | ||
| 1616 | + | ||
| 1617 | +@node Linux/Unix | ||
| 1508 | @section Linux/Unix | 1618 | @section Linux/Unix |
| 1509 | 1619 | ||
| 1510 | @subsection Compilation | 1620 | @subsection Compilation |
| @@ -1562,6 +1672,7 @@ ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0 | @@ -1562,6 +1672,7 @@ ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0 | ||
| 1562 | variables. You must use gcc 3.x on PowerPC. | 1672 | variables. You must use gcc 3.x on PowerPC. |
| 1563 | @end example | 1673 | @end example |
| 1564 | 1674 | ||
| 1675 | +@node Windows | ||
| 1565 | @section Windows | 1676 | @section Windows |
| 1566 | 1677 | ||
| 1567 | @itemize | 1678 | @itemize |
| @@ -1571,7 +1682,7 @@ instructions in the download section and the FAQ. | @@ -1571,7 +1682,7 @@ instructions in the download section and the FAQ. | ||
| 1571 | 1682 | ||
| 1572 | @item Download | 1683 | @item Download |
| 1573 | the MinGW development library of SDL 1.2.x | 1684 | the MinGW development library of SDL 1.2.x |
| 1574 | -(@file{SDL-devel-1.2.x-mingw32.tar.gz}) from | 1685 | +(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from |
| 1575 | @url{http://www.libsdl.org}. Unpack it in a temporary place, and | 1686 | @url{http://www.libsdl.org}. Unpack it in a temporary place, and |
| 1576 | unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool | 1687 | unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool |
| 1577 | directory. Edit the @file{sdl-config} script so that it gives the | 1688 | directory. Edit the @file{sdl-config} script so that it gives the |
| @@ -1591,6 +1702,7 @@ correct SDL directory when invoked. | @@ -1591,6 +1702,7 @@ correct SDL directory when invoked. | ||
| 1591 | 1702 | ||
| 1592 | @end itemize | 1703 | @end itemize |
| 1593 | 1704 | ||
| 1705 | +@node Cross compilation for Windows with Linux | ||
| 1594 | @section Cross compilation for Windows with Linux | 1706 | @section Cross compilation for Windows with Linux |
| 1595 | 1707 | ||
| 1596 | @itemize | 1708 | @itemize |
| @@ -1622,9 +1734,15 @@ installation directory. | @@ -1622,9 +1734,15 @@ installation directory. | ||
| 1622 | Note: Currently, Wine does not seem able to launch | 1734 | Note: Currently, Wine does not seem able to launch |
| 1623 | QEMU for Win32. | 1735 | QEMU for Win32. |
| 1624 | 1736 | ||
| 1737 | +@node Mac OS X | ||
| 1625 | @section Mac OS X | 1738 | @section Mac OS X |
| 1626 | 1739 | ||
| 1627 | The Mac OS X patches are not fully merged in QEMU, so you should look | 1740 | The Mac OS X patches are not fully merged in QEMU, so you should look |
| 1628 | at the QEMU mailing list archive to have all the necessary | 1741 | at the QEMU mailing list archive to have all the necessary |
| 1629 | information. | 1742 | information. |
| 1630 | 1743 | ||
| 1744 | +@node Index | ||
| 1745 | +@chapter Index | ||
| 1746 | +@printindex cp | ||
| 1747 | + | ||
| 1748 | +@bye |
qemu-tech.texi
| 1 | \input texinfo @c -*- texinfo -*- | 1 | \input texinfo @c -*- texinfo -*- |
| 2 | +@c %**start of header | ||
| 3 | +@setfilename qemu-tech.info | ||
| 4 | +@settitle QEMU Internals | ||
| 5 | +@exampleindent 0 | ||
| 6 | +@paragraphindent 0 | ||
| 7 | +@c %**end of header | ||
| 2 | 8 | ||
| 3 | @iftex | 9 | @iftex |
| 4 | -@settitle QEMU Internals | ||
| 5 | @titlepage | 10 | @titlepage |
| 6 | @sp 7 | 11 | @sp 7 |
| 7 | @center @titlefont{QEMU Internals} | 12 | @center @titlefont{QEMU Internals} |
| @@ -9,8 +14,32 @@ | @@ -9,8 +14,32 @@ | ||
| 9 | @end titlepage | 14 | @end titlepage |
| 10 | @end iftex | 15 | @end iftex |
| 11 | 16 | ||
| 17 | +@ifnottex | ||
| 18 | +@node Top | ||
| 19 | +@top | ||
| 20 | + | ||
| 21 | +@menu | ||
| 22 | +* Introduction:: | ||
| 23 | +* QEMU Internals:: | ||
| 24 | +* Regression Tests:: | ||
| 25 | +* Index:: | ||
| 26 | +@end menu | ||
| 27 | +@end ifnottex | ||
| 28 | + | ||
| 29 | +@contents | ||
| 30 | + | ||
| 31 | +@node Introduction | ||
| 12 | @chapter Introduction | 32 | @chapter Introduction |
| 13 | 33 | ||
| 34 | +@menu | ||
| 35 | +* intro_features:: Features | ||
| 36 | +* intro_x86_emulation:: x86 emulation | ||
| 37 | +* intro_arm_emulation:: ARM emulation | ||
| 38 | +* intro_ppc_emulation:: PowerPC emulation | ||
| 39 | +* intro_sparc_emulation:: SPARC emulation | ||
| 40 | +@end menu | ||
| 41 | + | ||
| 42 | +@node intro_features | ||
| 14 | @section Features | 43 | @section Features |
| 15 | 44 | ||
| 16 | QEMU is a FAST! processor emulator using a portable dynamic | 45 | QEMU is a FAST! processor emulator using a portable dynamic |
| @@ -43,7 +72,7 @@ QEMU generic features: | @@ -43,7 +72,7 @@ QEMU generic features: | ||
| 43 | 72 | ||
| 44 | @item User space only or full system emulation. | 73 | @item User space only or full system emulation. |
| 45 | 74 | ||
| 46 | -@item Using dynamic translation to native code for reasonnable speed. | 75 | +@item Using dynamic translation to native code for reasonable speed. |
| 47 | 76 | ||
| 48 | @item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. | 77 | @item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. |
| 49 | 78 | ||
| @@ -65,13 +94,13 @@ QEMU user mode emulation features: | @@ -65,13 +94,13 @@ QEMU user mode emulation features: | ||
| 65 | 94 | ||
| 66 | @item Accurate signal handling by remapping host signals to target signals. | 95 | @item Accurate signal handling by remapping host signals to target signals. |
| 67 | @end itemize | 96 | @end itemize |
| 68 | -@end itemize | ||
| 69 | 97 | ||
| 70 | QEMU full system emulation features: | 98 | QEMU full system emulation features: |
| 71 | @itemize | 99 | @itemize |
| 72 | @item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU. | 100 | @item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU. |
| 73 | @end itemize | 101 | @end itemize |
| 74 | 102 | ||
| 103 | +@node intro_x86_emulation | ||
| 75 | @section x86 emulation | 104 | @section x86 emulation |
| 76 | 105 | ||
| 77 | QEMU x86 target features: | 106 | QEMU x86 target features: |
| @@ -110,6 +139,7 @@ maximum performances. | @@ -110,6 +139,7 @@ maximum performances. | ||
| 110 | 139 | ||
| 111 | @end itemize | 140 | @end itemize |
| 112 | 141 | ||
| 142 | +@node intro_arm_emulation | ||
| 113 | @section ARM emulation | 143 | @section ARM emulation |
| 114 | 144 | ||
| 115 | @itemize | 145 | @itemize |
| @@ -122,6 +152,7 @@ maximum performances. | @@ -122,6 +152,7 @@ maximum performances. | ||
| 122 | 152 | ||
| 123 | @end itemize | 153 | @end itemize |
| 124 | 154 | ||
| 155 | +@node intro_ppc_emulation | ||
| 125 | @section PowerPC emulation | 156 | @section PowerPC emulation |
| 126 | 157 | ||
| 127 | @itemize | 158 | @itemize |
| @@ -133,6 +164,7 @@ FPU and MMU. | @@ -133,6 +164,7 @@ FPU and MMU. | ||
| 133 | 164 | ||
| 134 | @end itemize | 165 | @end itemize |
| 135 | 166 | ||
| 167 | +@node intro_sparc_emulation | ||
| 136 | @section SPARC emulation | 168 | @section SPARC emulation |
| 137 | 169 | ||
| 138 | @itemize | 170 | @itemize |
| @@ -166,8 +198,26 @@ implemented. Floating point exception support is untested. | @@ -166,8 +198,26 @@ implemented. Floating point exception support is untested. | ||
| 166 | 198 | ||
| 167 | @end itemize | 199 | @end itemize |
| 168 | 200 | ||
| 201 | +@node QEMU Internals | ||
| 169 | @chapter QEMU Internals | 202 | @chapter QEMU Internals |
| 170 | 203 | ||
| 204 | +@menu | ||
| 205 | +* QEMU compared to other emulators:: | ||
| 206 | +* Portable dynamic translation:: | ||
| 207 | +* Register allocation:: | ||
| 208 | +* Condition code optimisations:: | ||
| 209 | +* CPU state optimisations:: | ||
| 210 | +* Translation cache:: | ||
| 211 | +* Direct block chaining:: | ||
| 212 | +* Self-modifying code and translated code invalidation:: | ||
| 213 | +* Exception support:: | ||
| 214 | +* MMU emulation:: | ||
| 215 | +* Hardware interrupts:: | ||
| 216 | +* User emulation specific details:: | ||
| 217 | +* Bibliography:: | ||
| 218 | +@end menu | ||
| 219 | + | ||
| 220 | +@node QEMU compared to other emulators | ||
| 171 | @section QEMU compared to other emulators | 221 | @section QEMU compared to other emulators |
| 172 | 222 | ||
| 173 | Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than | 223 | Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than |
| @@ -214,6 +264,7 @@ The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo | @@ -214,6 +264,7 @@ The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo | ||
| 214 | and potentially unsafe host drivers. Moreover, they are unable to | 264 | and potentially unsafe host drivers. Moreover, they are unable to |
| 215 | provide cycle exact simulation as an emulator can. | 265 | provide cycle exact simulation as an emulator can. |
| 216 | 266 | ||
| 267 | +@node Portable dynamic translation | ||
| 217 | @section Portable dynamic translation | 268 | @section Portable dynamic translation |
| 218 | 269 | ||
| 219 | QEMU is a dynamic translator. When it first encounters a piece of code, | 270 | QEMU is a dynamic translator. When it first encounters a piece of code, |
| @@ -243,6 +294,7 @@ That way, QEMU is no more difficult to port than a dynamic linker. | @@ -243,6 +294,7 @@ That way, QEMU is no more difficult to port than a dynamic linker. | ||
| 243 | To go even faster, GCC static register variables are used to keep the | 294 | To go even faster, GCC static register variables are used to keep the |
| 244 | state of the virtual CPU. | 295 | state of the virtual CPU. |
| 245 | 296 | ||
| 297 | +@node Register allocation | ||
| 246 | @section Register allocation | 298 | @section Register allocation |
| 247 | 299 | ||
| 248 | Since QEMU uses fixed simple instructions, no efficient register | 300 | Since QEMU uses fixed simple instructions, no efficient register |
| @@ -250,6 +302,7 @@ allocation can be done. However, because RISC CPUs have a lot of | @@ -250,6 +302,7 @@ allocation can be done. However, because RISC CPUs have a lot of | ||
| 250 | register, most of the virtual CPU state can be put in registers without | 302 | register, most of the virtual CPU state can be put in registers without |
| 251 | doing complicated register allocation. | 303 | doing complicated register allocation. |
| 252 | 304 | ||
| 305 | +@node Condition code optimisations | ||
| 253 | @section Condition code optimisations | 306 | @section Condition code optimisations |
| 254 | 307 | ||
| 255 | Good CPU condition codes emulation (@code{EFLAGS} register on x86) is a | 308 | Good CPU condition codes emulation (@code{EFLAGS} register on x86) is a |
| @@ -268,6 +321,7 @@ generated simple instructions (see | @@ -268,6 +321,7 @@ generated simple instructions (see | ||
| 268 | the condition codes are not needed by the next instructions, no | 321 | the condition codes are not needed by the next instructions, no |
| 269 | condition codes are computed at all. | 322 | condition codes are computed at all. |
| 270 | 323 | ||
| 324 | +@node CPU state optimisations | ||
| 271 | @section CPU state optimisations | 325 | @section CPU state optimisations |
| 272 | 326 | ||
| 273 | The x86 CPU has many internal states which change the way it evaluates | 327 | The x86 CPU has many internal states which change the way it evaluates |
| @@ -279,6 +333,7 @@ segment base. | @@ -279,6 +333,7 @@ segment base. | ||
| 279 | 333 | ||
| 280 | [The FPU stack pointer register is not handled that way yet]. | 334 | [The FPU stack pointer register is not handled that way yet]. |
| 281 | 335 | ||
| 336 | +@node Translation cache | ||
| 282 | @section Translation cache | 337 | @section Translation cache |
| 283 | 338 | ||
| 284 | A 16 MByte cache holds the most recently used translations. For | 339 | A 16 MByte cache holds the most recently used translations. For |
| @@ -287,6 +342,7 @@ contains just a single basic block (a block of x86 instructions | @@ -287,6 +342,7 @@ contains just a single basic block (a block of x86 instructions | ||
| 287 | terminated by a jump or by a virtual CPU state change which the | 342 | terminated by a jump or by a virtual CPU state change which the |
| 288 | translator cannot deduce statically). | 343 | translator cannot deduce statically). |
| 289 | 344 | ||
| 345 | +@node Direct block chaining | ||
| 290 | @section Direct block chaining | 346 | @section Direct block chaining |
| 291 | 347 | ||
| 292 | After each translated basic block is executed, QEMU uses the simulated | 348 | After each translated basic block is executed, QEMU uses the simulated |
| @@ -302,6 +358,7 @@ it easier to make the jump target modification atomic. On some host | @@ -302,6 +358,7 @@ it easier to make the jump target modification atomic. On some host | ||
| 302 | architectures (such as x86 or PowerPC), the @code{JUMP} opcode is | 358 | architectures (such as x86 or PowerPC), the @code{JUMP} opcode is |
| 303 | directly patched so that the block chaining has no overhead. | 359 | directly patched so that the block chaining has no overhead. |
| 304 | 360 | ||
| 361 | +@node Self-modifying code and translated code invalidation | ||
| 305 | @section Self-modifying code and translated code invalidation | 362 | @section Self-modifying code and translated code invalidation |
| 306 | 363 | ||
| 307 | Self-modifying code is a special challenge in x86 emulation because no | 364 | Self-modifying code is a special challenge in x86 emulation because no |
| @@ -332,6 +389,7 @@ built. Every store into that page checks the bitmap to see if the code | @@ -332,6 +389,7 @@ built. Every store into that page checks the bitmap to see if the code | ||
| 332 | really needs to be invalidated. It avoids invalidating the code when | 389 | really needs to be invalidated. It avoids invalidating the code when |
| 333 | only data is modified in the page. | 390 | only data is modified in the page. |
| 334 | 391 | ||
| 392 | +@node Exception support | ||
| 335 | @section Exception support | 393 | @section Exception support |
| 336 | 394 | ||
| 337 | longjmp() is used when an exception such as division by zero is | 395 | longjmp() is used when an exception such as division by zero is |
| @@ -348,6 +406,7 @@ in some cases it is not computed because of condition code | @@ -348,6 +406,7 @@ in some cases it is not computed because of condition code | ||
| 348 | optimisations. It is not a big concern because the emulated code can | 406 | optimisations. It is not a big concern because the emulated code can |
| 349 | still be restarted in any cases. | 407 | still be restarted in any cases. |
| 350 | 408 | ||
| 409 | +@node MMU emulation | ||
| 351 | @section MMU emulation | 410 | @section MMU emulation |
| 352 | 411 | ||
| 353 | For system emulation, QEMU uses the mmap() system call to emulate the | 412 | For system emulation, QEMU uses the mmap() system call to emulate the |
| @@ -367,6 +426,7 @@ means that each basic block is indexed with its physical address. | @@ -367,6 +426,7 @@ means that each basic block is indexed with its physical address. | ||
| 367 | When MMU mappings change, only the chaining of the basic blocks is | 426 | When MMU mappings change, only the chaining of the basic blocks is |
| 368 | reset (i.e. a basic block can no longer jump directly to another one). | 427 | reset (i.e. a basic block can no longer jump directly to another one). |
| 369 | 428 | ||
| 429 | +@node Hardware interrupts | ||
| 370 | @section Hardware interrupts | 430 | @section Hardware interrupts |
| 371 | 431 | ||
| 372 | In order to be faster, QEMU does not check at every basic block if an | 432 | In order to be faster, QEMU does not check at every basic block if an |
| @@ -377,6 +437,7 @@ block. It ensures that the execution will return soon in the main loop | @@ -377,6 +437,7 @@ block. It ensures that the execution will return soon in the main loop | ||
| 377 | of the CPU emulator. Then the main loop can test if the interrupt is | 437 | of the CPU emulator. Then the main loop can test if the interrupt is |
| 378 | pending and handle it. | 438 | pending and handle it. |
| 379 | 439 | ||
| 440 | +@node User emulation specific details | ||
| 380 | @section User emulation specific details | 441 | @section User emulation specific details |
| 381 | 442 | ||
| 382 | @subsection Linux system call translation | 443 | @subsection Linux system call translation |
| @@ -434,6 +495,7 @@ space conflicts. QEMU solves this problem by being an executable ELF | @@ -434,6 +495,7 @@ space conflicts. QEMU solves this problem by being an executable ELF | ||
| 434 | shared object as the ld-linux.so ELF interpreter. That way, it can be | 495 | shared object as the ld-linux.so ELF interpreter. That way, it can be |
| 435 | relocated at load time. | 496 | relocated at load time. |
| 436 | 497 | ||
| 498 | +@node Bibliography | ||
| 437 | @section Bibliography | 499 | @section Bibliography |
| 438 | 500 | ||
| 439 | @table @asis | 501 | @table @asis |
| @@ -456,7 +518,7 @@ by Kevin Lawton et al. | @@ -456,7 +518,7 @@ by Kevin Lawton et al. | ||
| 456 | x86 emulator on Alpha-Linux. | 518 | x86 emulator on Alpha-Linux. |
| 457 | 519 | ||
| 458 | @item [5] | 520 | @item [5] |
| 459 | -@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/full_papers/chernoff/chernoff.pdf}, | 521 | +@url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf}, |
| 460 | DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton | 522 | DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton |
| 461 | Chernoff and Ray Hookway. | 523 | Chernoff and Ray Hookway. |
| 462 | 524 | ||
| @@ -486,11 +548,19 @@ The TwoOStwo PC virtualizer. | @@ -486,11 +548,19 @@ The TwoOStwo PC virtualizer. | ||
| 486 | 548 | ||
| 487 | @end table | 549 | @end table |
| 488 | 550 | ||
| 551 | +@node Regression Tests | ||
| 489 | @chapter Regression Tests | 552 | @chapter Regression Tests |
| 490 | 553 | ||
| 491 | In the directory @file{tests/}, various interesting testing programs | 554 | In the directory @file{tests/}, various interesting testing programs |
| 492 | are available. There are used for regression testing. | 555 | are available. There are used for regression testing. |
| 493 | 556 | ||
| 557 | +@menu | ||
| 558 | +* test-i386:: | ||
| 559 | +* linux-test:: | ||
| 560 | +* qruncom.c:: | ||
| 561 | +@end menu | ||
| 562 | + | ||
| 563 | +@node test-i386 | ||
| 494 | @section @file{test-i386} | 564 | @section @file{test-i386} |
| 495 | 565 | ||
| 496 | This program executes most of the 16 bit and 32 bit x86 instructions and | 566 | This program executes most of the 16 bit and 32 bit x86 instructions and |
| @@ -506,12 +576,20 @@ The Linux system call @code{vm86()} is used to test vm86 emulation. | @@ -506,12 +576,20 @@ The Linux system call @code{vm86()} is used to test vm86 emulation. | ||
| 506 | Various exceptions are raised to test most of the x86 user space | 576 | Various exceptions are raised to test most of the x86 user space |
| 507 | exception reporting. | 577 | exception reporting. |
| 508 | 578 | ||
| 579 | +@node linux-test | ||
| 509 | @section @file{linux-test} | 580 | @section @file{linux-test} |
| 510 | 581 | ||
| 511 | This program tests various Linux system calls. It is used to verify | 582 | This program tests various Linux system calls. It is used to verify |
| 512 | that the system call parameters are correctly converted between target | 583 | that the system call parameters are correctly converted between target |
| 513 | and host CPUs. | 584 | and host CPUs. |
| 514 | 585 | ||
| 586 | +@node qruncom.c | ||
| 515 | @section @file{qruncom.c} | 587 | @section @file{qruncom.c} |
| 516 | 588 | ||
| 517 | Example of usage of @code{libqemu} to emulate a user mode i386 CPU. | 589 | Example of usage of @code{libqemu} to emulate a user mode i386 CPU. |
| 590 | + | ||
| 591 | +@node Index | ||
| 592 | +@chapter Index | ||
| 593 | +@printindex cp | ||
| 594 | + | ||
| 595 | +@bye |