1 |
\input texinfo @c -*- texinfo -*- |
\input texinfo @c -*- texinfo -*- |
2 |
|
|
3 |
@settitle QEMU x86 Emulator Reference Documentation |
@settitle QEMU CPU Emulator Reference Documentation |
4 |
@titlepage |
@titlepage |
5 |
@sp 7 |
@sp 7 |
6 |
@center @titlefont{QEMU x86 Emulator Reference Documentation} |
@center @titlefont{QEMU CPU Emulator Reference Documentation} |
7 |
@sp 3 |
@sp 3 |
8 |
@end titlepage |
@end titlepage |
9 |
|
|
10 |
@chapter Introduction |
@chapter Introduction |
11 |
|
|
12 |
QEMU is an x86 processor emulator. Its purpose is to run x86 Linux |
@section Features |
|
processes on non-x86 Linux architectures such as PowerPC. By using |
|
|
dynamic translation it achieves a reasonnable speed while being easy to |
|
|
port on new host CPUs. Its main goal is to be able to launch the |
|
|
@code{Wine} Windows API emulator (@url{http://www.winehq.org}) or |
|
|
@code{DOSEMU} (@url{http://www.dosemu.org}) on non-x86 CPUs. |
|
13 |
|
|
14 |
QEMU features: |
QEMU is a FAST! processor emulator. Its purpose is to run Linux executables |
15 |
|
compiled for one architecture on another. For example, x86 Linux |
16 |
|
processes can be ran on PowerPC Linux architectures. By using dynamic |
17 |
|
translation it achieves a reasonnable speed while being easy to port on |
18 |
|
new host CPUs. Its main goal is to be able to launch the @code{Wine} |
19 |
|
Windows API emulator (@url{http://www.winehq.org}) or @code{DOSEMU} |
20 |
|
(@url{http://www.dosemu.org}) on non-x86 CPUs. |
21 |
|
|
22 |
|
QEMU generic features: |
23 |
|
|
24 |
@itemize |
@itemize |
25 |
|
|
26 |
@item User space only x86 emulator. |
@item User space only emulation. |
27 |
|
|
28 |
@item Currently ported on i386, PowerPC. Work in progress for S390, Alpha and Sparc. |
@item Working on x86 and PowerPC hosts. Being tested on ARM, Sparc32, Alpha and S390. |
29 |
|
|
30 |
@item Using dynamic translation to native code for reasonnable speed. |
@item Using dynamic translation to native code for reasonnable speed. |
31 |
|
|
|
@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
|
|
User space LDT and GDT are emulated. VM86 mode is also supported. |
|
|
|
|
32 |
@item Generic Linux system call converter, including most ioctls. |
@item Generic Linux system call converter, including most ioctls. |
33 |
|
|
34 |
@item clone() emulation using native CPU clone() to use Linux scheduler for threads. |
@item clone() emulation using native CPU clone() to use Linux scheduler for threads. |
35 |
|
|
36 |
@item Accurate signal handling by remapping host signals to virtual x86 signals. |
@item Accurate signal handling by remapping host signals to target signals. |
|
|
|
|
@item Precise user space x86 exceptions. |
|
37 |
|
|
38 |
@item Self-modifying code support. |
@item Self-modifying code support. |
39 |
|
|
40 |
|
@item The virtual CPU is a library (@code{libqemu}) which can be used |
41 |
|
in other projects. |
42 |
|
|
43 |
|
@end itemize |
44 |
|
|
45 |
|
@section x86 emulation |
46 |
|
|
47 |
|
QEMU x86 target features: |
48 |
|
|
49 |
|
@itemize |
50 |
|
|
51 |
|
@item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
52 |
|
User space LDT and GDT are emulated. VM86 mode is also supported to run DOSEMU. |
53 |
|
|
54 |
|
@item Precise user space x86 exceptions. |
55 |
|
|
56 |
@item Support of host page sizes bigger than 4KB. |
@item Support of host page sizes bigger than 4KB. |
57 |
|
|
58 |
@item QEMU can emulate itself on x86. |
@item QEMU can emulate itself on x86. |
59 |
|
|
|
@item The virtual x86 CPU is a library (@code{libqemu}) which can be used |
|
|
in other projects. |
|
|
|
|
60 |
@item An extensive Linux x86 CPU test program is included @file{tests/test-i386}. |
@item An extensive Linux x86 CPU test program is included @file{tests/test-i386}. |
61 |
It can be used to test other x86 virtual CPUs. |
It can be used to test other x86 virtual CPUs. |
62 |
|
|
81 |
|
|
82 |
@end itemize |
@end itemize |
83 |
|
|
84 |
|
@section ARM emulation |
85 |
|
|
86 |
|
@itemize |
87 |
|
|
88 |
|
@item ARM emulation can currently launch small programs while using the |
89 |
|
generic dynamic code generation architecture of QEMU. |
90 |
|
|
91 |
|
@item No FPU support (yet). |
92 |
|
|
93 |
|
@item No automatic regression testing (yet). |
94 |
|
|
95 |
|
@end itemize |
96 |
|
|
97 |
@chapter Invocation |
@chapter Invocation |
98 |
|
|
99 |
@section Quick Start |
@section Quick Start |
100 |
|
|
101 |
|
If you need to compile QEMU, please read the @file{README} which gives |
102 |
|
the related information. |
103 |
|
|
104 |
In order to launch a Linux process, QEMU needs the process executable |
In order to launch a Linux process, QEMU needs the process executable |
105 |
itself and all the target (x86) dynamic libraries used by it. |
itself and all the target (x86) dynamic libraries used by it. |
106 |
|
|
213 |
as Valgrind, but it has no support to track uninitialised data as |
as Valgrind, but it has no support to track uninitialised data as |
214 |
Valgrind does). Valgrind dynamic translator generates better code than |
Valgrind does). Valgrind dynamic translator generates better code than |
215 |
QEMU (in particular it does register allocation) but it is closely tied |
QEMU (in particular it does register allocation) but it is closely tied |
216 |
to an x86 host. |
to an x86 host and target. |
217 |
|
|
218 |
EM86 [4] is the closest project to QEMU (and QEMU still uses some of its |
EM86 [4] is the closest project to QEMU (and QEMU still uses some of its |
219 |
code, in particular the ELF file loader). EM86 was limited to an alpha |
code, in particular the ELF file loader). EM86 was limited to an alpha |
231 |
|
|
232 |
QEMU is a dynamic translator. When it first encounters a piece of code, |
QEMU is a dynamic translator. When it first encounters a piece of code, |
233 |
it converts it to the host instruction set. Usually dynamic translators |
it converts it to the host instruction set. Usually dynamic translators |
234 |
are very complicated and highly CPU dependant. QEMU uses some tricks |
are very complicated and highly CPU dependent. QEMU uses some tricks |
235 |
which make it relatively easily portable and simple while achieving good |
which make it relatively easily portable and simple while achieving good |
236 |
performances. |
performances. |
237 |
|
|
443 |
|
|
444 |
@chapter Regression Tests |
@chapter Regression Tests |
445 |
|
|
446 |
In the directory @file{tests/}, various interesting x86 testing programs |
In the directory @file{tests/}, various interesting testing programs |
447 |
are available. There are used for regression testing. |
are available. There are used for regression testing. |
448 |
|
|
449 |
@section @file{hello} |
@section @file{hello-i386} |
450 |
|
|
451 |
Very simple statically linked x86 program, just to test QEMU during a |
Very simple statically linked x86 program, just to test QEMU during a |
452 |
port to a new host CPU. |
port to a new host CPU. |
453 |
|
|
454 |
|
@section @file{hello-arm} |
455 |
|
|
456 |
|
Very simple statically linked ARM program, just to test QEMU during a |
457 |
|
port to a new host CPU. |
458 |
|
|
459 |
@section @file{test-i386} |
@section @file{test-i386} |
460 |
|
|
461 |
This program executes most of the 16 bit and 32 bit x86 instructions and |
This program executes most of the 16 bit and 32 bit x86 instructions and |