X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=qemu-tech.texi;h=022017d55d55e3eb87dd7333fc923d50ffdb9d00;hb=5602b39ff346cf18f50dce05e1c09db17b229445;hp=2e2a081d927c2c458058fe9fc86b84eb78d6d4ec;hpb=c730256b331cc0494793a7b9b45d3e7496a3ebad;p=mirror_qemu.git diff --git a/qemu-tech.texi b/qemu-tech.texi index 2e2a081d92..022017d55d 100644 --- a/qemu-tech.texi +++ b/qemu-tech.texi @@ -42,13 +42,14 @@ @chapter Introduction @menu -* intro_features:: Features -* intro_x86_emulation:: x86 and x86-64 emulation -* intro_arm_emulation:: ARM emulation -* intro_mips_emulation:: MIPS emulation -* intro_ppc_emulation:: PowerPC emulation -* intro_sparc_emulation:: Sparc32 and Sparc64 emulation -* intro_other_emulation:: Other CPU emulation +* intro_features:: Features +* intro_x86_emulation:: x86 and x86-64 emulation +* intro_arm_emulation:: ARM emulation +* intro_mips_emulation:: MIPS emulation +* intro_ppc_emulation:: PowerPC emulation +* intro_sparc_emulation:: Sparc32 and Sparc64 emulation +* intro_xtensa_emulation:: Xtensa emulation +* intro_other_emulation:: Other CPU emulation @end menu @node intro_features @@ -95,10 +96,6 @@ Alpha and S390 hosts, but TCG (see below) doesn't support those yet. @item Precise exceptions support. -@item The virtual CPU is a library (@code{libqemu}) which can be used -in other projects (look at @file{qemu/tests/qruncom.c} to have an -example of user mode @code{libqemu} usage). - @item Floating point library supporting both full software emulation and native host FPU instructions. @@ -115,8 +112,7 @@ QEMU user mode emulation features: @end itemize Linux user emulator (Linux host only) can be used to launch the Wine -Windows API emulator (@url{http://www.winehq.org}). A Darwin user -emulator (Darwin hosts only) exists and a BSD user emulator for BSD +Windows API emulator (@url{http://www.winehq.org}). A BSD user emulator for BSD hosts is under development. It would also be possible to develop a similar user emulator for Solaris. @@ -259,6 +255,31 @@ Current QEMU limitations: @end itemize +@node intro_xtensa_emulation +@section Xtensa emulation + +@itemize + +@item Core Xtensa ISA emulation, including most options: code density, +loop, extended L32R, 16- and 32-bit multiplication, 32-bit division, +MAC16, miscellaneous operations, boolean, FP coprocessor, coprocessor +context, debug, multiprocessor synchronization, +conditional store, exceptions, relocatable vectors, unaligned exception, +interrupts (including high priority and timer), hardware alignment, +region protection, region translation, MMU, windowed registers, thread +pointer, processor ID. + +@item Not implemented options: data/instruction cache (including cache +prefetch and locking), XLMI, processor interface. Also options not +covered by the core ISA (e.g. FLIX, wide branches) are not implemented. + +@item Can run most Xtensa Linux binaries. + +@item New core configuration that requires no additional instructions +may be created from overlay with minimal amount of hand-written code. + +@end itemize + @node intro_other_emulation @section Other CPU emulation @@ -299,7 +320,7 @@ SH4 @node QEMU compared to other emulators @section QEMU compared to other emulators -Like bochs [3], QEMU emulates an x86 CPU. But QEMU is much faster than +Like bochs [1], QEMU emulates an x86 CPU. But QEMU is much faster than bochs as it uses dynamic compilation. Bochs is closely tied to x86 PC emulation while QEMU can emulate several processors. @@ -312,25 +333,25 @@ than QEMU (in particular it does register allocation) but it is closely tied to an x86 host and target and has no support for precise exceptions and system emulation. -EM86 [4] is the closest project to user space QEMU (and QEMU still uses +EM86 [3] is the closest project to user space QEMU (and QEMU still uses some of its code, in particular the ELF file loader). EM86 was limited to an alpha host and used a proprietary and slow interpreter (the -interpreter part of the FX!32 Digital Win32 code translator [5]). +interpreter part of the FX!32 Digital Win32 code translator [4]). -TWIN [6] is a Windows API emulator like Wine. It is less accurate than -Wine but includes a protected mode x86 interpreter to launch x86 Windows -executables. Such an approach has greater potential because most of the -Windows API is executed natively but it is far more difficult to develop -because all the data structures and function parameters exchanged +TWIN from Willows Software was a Windows API emulator like Wine. It is less +accurate than Wine but includes a protected mode x86 interpreter to launch +x86 Windows executables. Such an approach has greater potential because most +of the Windows API is executed natively but it is far more difficult to +develop because all the data structures and function parameters exchanged between the API and the x86 code must be converted. -User mode Linux [7] was the only solution before QEMU to launch a +User mode Linux [5] was the only solution before QEMU to launch a Linux kernel as a process while not needing any host kernel patches. However, user mode Linux requires heavy kernel patches while QEMU accepts unpatched Linux kernels. The price to pay is that QEMU is slower. -The Plex86 [8] PC virtualizer is done in the same spirit as the now +The Plex86 [6] PC virtualizer is done in the same spirit as the now obsolete qemu-fast system emulator. It requires a patched Linux kernel to work (you cannot launch the same kernel on your PC), but the patches are really small. As it is a PC virtualizer (no emulation is @@ -338,13 +359,13 @@ done except for some privileged instructions), it has the potential of being faster than QEMU. The downside is that a complicated (and potentially unsafe) host kernel patch is needed. -The commercial PC Virtualizers (VMWare [9], VirtualPC [10], TwoOStwo -[11]) are faster than QEMU, but they all need specific, proprietary +The commercial PC Virtualizers (VMWare [7], VirtualPC [8]) are faster +than QEMU (without virtualization), but they all need specific, proprietary and potentially unsafe host drivers. Moreover, they are unable to provide cycle exact simulation as an emulator can. -VirtualBox [12], Xen [13] and KVM [14] are based on QEMU. QEMU-SystemC -[15] uses QEMU to simulate a system where some hardware devices are +VirtualBox [9], Xen [10] and KVM [11] are based on QEMU. QEMU-SystemC +[12] uses QEMU to simulate a system where some hardware devices are developed in SystemC. @node Portable dynamic translation @@ -409,7 +430,7 @@ generate an addition for the segment base. @node Translation cache @section Translation cache -A 16 MByte cache holds the most recently used translations. For +A 32 MByte cache holds the most recently used translations. For simplicity, it is completely flushed when it is full. A translation unit contains just a single basic block (a block of x86 instructions terminated by a jump or by a virtual CPU state change which the @@ -419,7 +440,7 @@ translator cannot deduce statically). @section Direct block chaining After each translated basic block is executed, QEMU uses the simulated -Program Counter (PC) and other cpu state informations (such as the CS +Program Counter (PC) and other cpu state information (such as the CS segment base value) to find the next basic block. In order to accelerate the most common cases where the new simulated PC @@ -515,8 +536,8 @@ timers, especially together with the use of bottom halves (BHs). @node Hardware interrupts @section Hardware interrupts -In order to be faster, QEMU does not check at every basic block if an -hardware interrupt is pending. Instead, the user must asynchrously +In order to be faster, QEMU does not check at every basic block if a +hardware interrupt is pending. Instead, the user must asynchronously call a specific function to tell that an interrupt is pending. This function resets the chaining of the currently executing basic block. It ensures that the execution will return soon in the main loop @@ -548,7 +569,7 @@ Linux kernel does. The @code{sigreturn()} system call is emulated to return from the virtual signal handler. Some signals (such as SIGALRM) directly come from the host. Other -signals are synthetized from the virtual CPU exceptions such as SIGFPE +signals are synthesized from the virtual CPU exceptions such as SIGFPE when a division by zero is done (see @code{main.c:cpu_loop()}). The blocked signal mask is still handled by the host Linux kernel so @@ -587,64 +608,51 @@ way, it can be relocated at load time. @table @asis @item [1] -@url{http://citeseer.nj.nec.com/piumarta98optimizing.html}, Optimizing -direct threaded code by selective inlining (1998) by Ian Piumarta, Fabio -Riccardi. +@url{http://bochs.sourceforge.net/}, the Bochs IA-32 Emulator Project, +by Kevin Lawton et al. @item [2] -@url{http://developer.kde.org/~sewardj/}, Valgrind, an open-source -memory debugger for x86-GNU/Linux, by Julian Seward. +@url{http://www.valgrind.org/}, Valgrind, an open-source memory debugger +for GNU/Linux. @item [3] -@url{http://bochs.sourceforge.net/}, the Bochs IA-32 Emulator Project, -by Kevin Lawton et al. +@url{http://ftp.dreamtime.org/pub/linux/Linux-Alpha/em86/v0.2/docs/em86.html}, +the EM86 x86 emulator on Alpha-Linux. @item [4] -@url{http://www.cs.rose-hulman.edu/~donaldlf/em86/index.html}, the EM86 -x86 emulator on Alpha-Linux. - -@item [5] @url{http://www.usenix.org/publications/library/proceedings/usenix-nt97/@/full_papers/chernoff/chernoff.pdf}, DIGITAL FX!32: Running 32-Bit x86 Applications on Alpha NT, by Anton Chernoff and Ray Hookway. -@item [6] -@url{http://www.willows.com/}, Windows API library emulation from -Willows Software. - -@item [7] +@item [5] @url{http://user-mode-linux.sourceforge.net/}, The User-mode Linux Kernel. -@item [8] +@item [6] @url{http://www.plex86.org/}, The new Plex86 project. -@item [9] +@item [7] @url{http://www.vmware.com/}, The VMWare PC virtualizer. -@item [10] -@url{http://www.microsoft.com/windowsxp/virtualpc/}, +@item [8] +@url{https://www.microsoft.com/download/details.aspx?id=3702}, The VirtualPC PC virtualizer. -@item [11] -@url{http://www.twoostwo.org/}, -The TwoOStwo PC virtualizer. - -@item [12] +@item [9] @url{http://virtualbox.org/}, The VirtualBox PC virtualizer. -@item [13] +@item [10] @url{http://www.xen.org/}, The Xen hypervisor. -@item [14] -@url{http://kvm.qumranet.com/kvmwiki/Front_Page}, +@item [11] +@url{http://www.linux-kvm.org/}, Kernel Based Virtual Machine (KVM). -@item [15] +@item [12] @url{http://www.greensocs.com/projects/QEMUSystemC}, QEMU-SystemC, a hardware co-simulator. @@ -659,7 +667,6 @@ are available. They are used for regression testing. @menu * test-i386:: * linux-test:: -* qruncom.c:: @end menu @node test-i386 @@ -685,11 +692,6 @@ This program tests various Linux system calls. It is used to verify that the system call parameters are correctly converted between target and host CPUs. -@node qruncom.c -@section @file{qruncom.c} - -Example of usage of @code{libqemu} to emulate a user mode i386 CPU. - @node Index @chapter Index @printindex cp