]>
Commit | Line | Data |
---|---|---|
78e87797 PB |
1 | @node Implementation notes |
2 | @appendix Implementation notes | |
debc7065 FB |
3 | |
4 | @menu | |
77d47e16 PB |
5 | * CPU emulation:: |
6 | * Translator Internals:: | |
77d47e16 | 7 | * QEMU compared to other emulators:: |
047f7038 | 8 | * Managed start up options:: |
77d47e16 | 9 | * Bibliography:: |
debc7065 | 10 | @end menu |
debc7065 | 11 | |
77d47e16 | 12 | @node CPU emulation |
78e87797 | 13 | @section CPU emulation |
1f673135 | 14 | |
debc7065 | 15 | @menu |
77d47e16 PB |
16 | * x86:: x86 and x86-64 emulation |
17 | * ARM:: ARM emulation | |
18 | * MIPS:: MIPS emulation | |
19 | * PPC:: PowerPC emulation | |
20 | * SPARC:: Sparc32 and Sparc64 emulation | |
21 | * Xtensa:: Xtensa emulation | |
debc7065 FB |
22 | @end menu |
23 | ||
77d47e16 | 24 | @node x86 |
78e87797 | 25 | @subsection x86 and x86-64 emulation |
1f673135 FB |
26 | |
27 | QEMU x86 target features: | |
28 | ||
5fafdf24 | 29 | @itemize |
1f673135 | 30 | |
5fafdf24 | 31 | @item The virtual x86 CPU supports 16 bit and 32 bit addressing with segmentation. |
998a0501 BS |
32 | LDT/GDT and IDT are emulated. VM86 mode is also supported to run |
33 | DOSEMU. There is some support for MMX/3DNow!, SSE, SSE2, SSE3, SSSE3, | |
34 | and SSE4 as well as x86-64 SVM. | |
1f673135 FB |
35 | |
36 | @item Support of host page sizes bigger than 4KB in user mode emulation. | |
37 | ||
38 | @item QEMU can emulate itself on x86. | |
39 | ||
5fafdf24 | 40 | @item An extensive Linux x86 CPU test program is included @file{tests/test-i386}. |
1f673135 FB |
41 | It can be used to test other x86 virtual CPUs. |
42 | ||
43 | @end itemize | |
44 | ||
45 | Current QEMU limitations: | |
46 | ||
5fafdf24 | 47 | @itemize |
1f673135 | 48 | |
998a0501 | 49 | @item Limited x86-64 support. |
1f673135 FB |
50 | |
51 | @item IPC syscalls are missing. | |
52 | ||
5fafdf24 | 53 | @item The x86 segment limits and access rights are not tested at every |
1f673135 FB |
54 | memory access (yet). Hopefully, very few OSes seem to rely on that for |
55 | normal use. | |
56 | ||
1f673135 FB |
57 | @end itemize |
58 | ||
77d47e16 | 59 | @node ARM |
78e87797 | 60 | @subsection ARM emulation |
1f673135 FB |
61 | |
62 | @itemize | |
63 | ||
64 | @item Full ARM 7 user emulation. | |
65 | ||
66 | @item NWFPE FPU support included in user Linux emulation. | |
67 | ||
68 | @item Can run most ARM Linux binaries. | |
69 | ||
70 | @end itemize | |
71 | ||
77d47e16 | 72 | @node MIPS |
78e87797 | 73 | @subsection MIPS emulation |
24d4de45 TS |
74 | |
75 | @itemize | |
76 | ||
77 | @item The system emulation allows full MIPS32/MIPS64 Release 2 emulation, | |
78 | including privileged instructions, FPU and MMU, in both little and big | |
79 | endian modes. | |
80 | ||
81 | @item The Linux userland emulation can run many 32 bit MIPS Linux binaries. | |
82 | ||
83 | @end itemize | |
84 | ||
85 | Current QEMU limitations: | |
86 | ||
87 | @itemize | |
88 | ||
89 | @item Self-modifying code is not always handled correctly. | |
90 | ||
91 | @item 64 bit userland emulation is not implemented. | |
92 | ||
93 | @item The system emulation is not complete enough to run real firmware. | |
94 | ||
b1f45238 TS |
95 | @item The watchpoint debug facility is not implemented. |
96 | ||
24d4de45 TS |
97 | @end itemize |
98 | ||
77d47e16 | 99 | @node PPC |
78e87797 | 100 | @subsection PowerPC emulation |
1f673135 FB |
101 | |
102 | @itemize | |
103 | ||
5fafdf24 | 104 | @item Full PowerPC 32 bit emulation, including privileged instructions, |
1f673135 FB |
105 | FPU and MMU. |
106 | ||
107 | @item Can run most PowerPC Linux binaries. | |
108 | ||
109 | @end itemize | |
110 | ||
77d47e16 | 111 | @node SPARC |
78e87797 | 112 | @subsection Sparc32 and Sparc64 emulation |
1f673135 FB |
113 | |
114 | @itemize | |
115 | ||
f6b647cd | 116 | @item Full SPARC V8 emulation, including privileged |
3475187d | 117 | instructions, FPU and MMU. SPARC V9 emulation includes most privileged |
a785e42e | 118 | and VIS instructions, FPU and I/D MMU. Alignment is fully enforced. |
1f673135 | 119 | |
a785e42e BS |
120 | @item Can run most 32-bit SPARC Linux binaries, SPARC32PLUS Linux binaries and |
121 | some 64-bit SPARC Linux binaries. | |
3475187d FB |
122 | |
123 | @end itemize | |
124 | ||
125 | Current QEMU limitations: | |
126 | ||
5fafdf24 | 127 | @itemize |
3475187d | 128 | |
3475187d FB |
129 | @item IPC syscalls are missing. |
130 | ||
1f587329 | 131 | @item Floating point exception support is buggy. |
3475187d FB |
132 | |
133 | @item Atomic instructions are not correctly implemented. | |
134 | ||
998a0501 BS |
135 | @item There are still some problems with Sparc64 emulators. |
136 | ||
137 | @end itemize | |
138 | ||
77d47e16 | 139 | @node Xtensa |
78e87797 | 140 | @subsection Xtensa emulation |
3aeaea65 MF |
141 | |
142 | @itemize | |
143 | ||
144 | @item Core Xtensa ISA emulation, including most options: code density, | |
145 | loop, extended L32R, 16- and 32-bit multiplication, 32-bit division, | |
044d003d MF |
146 | MAC16, miscellaneous operations, boolean, FP coprocessor, coprocessor |
147 | context, debug, multiprocessor synchronization, | |
3aeaea65 MF |
148 | conditional store, exceptions, relocatable vectors, unaligned exception, |
149 | interrupts (including high priority and timer), hardware alignment, | |
150 | region protection, region translation, MMU, windowed registers, thread | |
151 | pointer, processor ID. | |
152 | ||
044d003d MF |
153 | @item Not implemented options: data/instruction cache (including cache |
154 | prefetch and locking), XLMI, processor interface. Also options not | |
155 | covered by the core ISA (e.g. FLIX, wide branches) are not implemented. | |
3aeaea65 MF |
156 | |
157 | @item Can run most Xtensa Linux binaries. | |
158 | ||
159 | @item New core configuration that requires no additional instructions | |
160 | may be created from overlay with minimal amount of hand-written code. | |
161 | ||
162 | @end itemize | |
163 | ||
047f7038 IM |
164 | @node Managed start up options |
165 | @section Managed start up options | |
166 | ||
167 | In system mode emulation, it's possible to create a VM in a paused state using | |
168 | the -S command line option. In this state the machine is completely initialized | |
169 | according to command line options and ready to execute VM code but VCPU threads | |
170 | are not executing any code. The VM state in this paused state depends on the way | |
171 | QEMU was started. It could be in: | |
172 | @table @asis | |
173 | @item initial state (after reset/power on state) | |
174 | @item with direct kernel loading, the initial state could be amended to execute | |
175 | code loaded by QEMU in the VM's RAM and with incoming migration | |
176 | @item with incoming migration, initial state will by amended with the migrated | |
177 | machine state after migration completes. | |
178 | @end table | |
179 | ||
180 | This paused state is typically used by users to query machine state and/or | |
181 | additionally configure the machine (by hotplugging devices) in runtime before | |
182 | allowing VM code to run. | |
183 | ||
184 | However, at the -S pause point, it's impossible to configure options that affect | |
361ac948 MA |
185 | initial VM creation (like: -smp/-m/-numa ...) or cold plug devices. The |
186 | experimental --preconfig command line option allows pausing QEMU | |
187 | before the initial VM creation, in a ``preconfig'' state, where additional | |
047f7038 IM |
188 | queries and configuration can be performed via QMP before moving on to |
189 | the resulting configuration startup. In the preconfig state, QEMU only allows | |
190 | a limited set of commands over the QMP monitor, where the commands do not | |
191 | depend on an initialized machine, including but not limited to: | |
192 | @table @asis | |
193 | @item qmp_capabilities | |
194 | @item query-qmp-schema | |
195 | @item query-commands | |
196 | @item query-status | |
361ac948 | 197 | @item x-exit-preconfig |
047f7038 | 198 | @end table |