Lines Matching +full:qemu +full:- +full:system +full:-
4 QEMU's Tiny Code Generator (TCG) provides the ability to emulate a
6 :ref:`System Emulation` and :ref:`User Mode Emulation` are supported
9 .. list-table:: Supported Guest Architectures for Emulation
11 :header-rows: 1
13 * - Architecture (qemu name)
14 - System
15 - User
16 - Notes
17 * - Alpha
18 - Yes
19 - Yes
20 - Legacy 64 bit RISC ISA developed by DEC
21 * - Arm (arm, aarch64)
22 - :ref:`Yes<ARM-System-emulator>`
23 - Yes
24 - Wide range of features, see :ref:`Arm Emulation` for details
25 * - AVR
26 - :ref:`Yes<AVR-System-emulator>`
27 - No
28 - 8 bit micro controller, often used in maker projects
29 * - Hexagon
30 - No
31 - Yes
32 - Family of DSPs by Qualcomm
33 * - PA-RISC (hppa)
34 - Yes
35 - Yes
36 - A legacy RISC system used in HP's old minicomputers
37 * - x86 (i386, x86_64)
38 - :ref:`Yes<QEMU-PC-System-emulator>`
39 - Yes
40 - The ubiquitous desktop PC CPU architecture, 32 and 64 bit.
41 * - LoongArch
42 - Yes
43 - Yes
44 - A MIPS-like 64bit RISC architecture developed in China
45 * - m68k
46 - :ref:`Yes<ColdFire-System-emulator>`
47 - Yes
48 - Motorola 68000 variants and ColdFire
49 * - Microblaze
50 - Yes
51 - Yes
52 - RISC based soft-core by Xilinx
53 * - MIPS (mips*)
54 - :ref:`Yes<MIPS-System-emulator>`
55 - Yes
56 - Venerable RISC architecture originally out of Stanford University
57 * - OpenRISC
58 - :ref:`Yes<OpenRISC-System-emulator>`
59 - Yes
60 - Open source RISC architecture developed by the OpenRISC community
61 * - Power (ppc, ppc64)
62 - :ref:`Yes<PowerPC-System-emulator>`
63 - Yes
64 - A general purpose RISC architecture now managed by IBM
65 * - RISC-V
66 - :ref:`Yes<RISC-V-System-emulator>`
67 - Yes
68 - An open standard RISC ISA maintained by RISC-V International
69 * - RX
70 - :ref:`Yes<RX-System-emulator>`
71 - No
72 - A 32 bit micro controller developed by Renesas
73 * - s390x
74 - :ref:`Yes<s390x-System-emulator>`
75 - Yes
76 - A 64 bit CPU found in IBM's System Z mainframes
77 * - sh4
78 - Yes
79 - Yes
80 - A 32 bit RISC embedded CPU developed by Hitachi
81 * - SPARC (sparc, sparc64)
82 - :ref:`Yes<Sparc32-System-emulator>`
83 - Yes
84 - A RISC ISA originally developed by Sun Microsystems
85 * - Tricore
86 - Yes
87 - No
88 - A 32 bit RISC/uController/DSP developed by Infineon
89 * - Xtensa
90 - :ref:`Yes<Xtensa-System-emulator>`
91 - Yes
92 - A configurable 32 bit soft core now owned by Cadence
97 -----------
100 allow programs to interact with a debugging host system. On real
101 hardware this is usually provided by an In-circuit emulator (ICE)
102 hooked directly to the board. QEMU's implementation allows for
103 semihosting calls to be passed to the host system or via the
107 more fully functional operating system has been enabled. On QEMU it
108 also allows for embedded micro-controller code which typically doesn't
109 have a full libc to be run as "bare-metal" code under QEMU's user-mode
111 number of compiler suites as well as QEMU itself use semihosting calls
121 happily trash your host system. Some semihosting calls (e.g.
128 Semihosting calls can be re-directed to a (potentially remote) gdb
140 presents a simple POSIX-like API which allows your program to read and
148 QEMU makes an implementation decision to implement all file
149 access in ``O_BINARY`` mode. The user-visible effect of this is
150 regardless of the text/binary mode the program sets QEMU will
151 always select a binary mode ensuring no line-terminator conversion
156 .. list-table:: Guest Architectures supporting Semihosting
158 :header-rows: 1
160 * - Architecture
161 - Modes
162 - Specification
163 * - Arm
164 - System and User-mode
165 - https://github.com/ARM-software/abi-aa/blob/main/semihosting/semihosting.rst
166 * - m68k
167 - System
168 - https://sourceware.org/git/?p=newlib-cygwin.git;a=blob;f=libgloss/m68k/m68k-semi.txt;hb=HEAD
169 * - MIPS
170 - System
171 - Unified Hosting Interface (MD01069)
172 * - RISC-V
173 - System and User-mode
174 - https://github.com/riscv-non-isa/riscv-semihosting/blob/main/riscv-semihosting.adoc
175 * - Xtensa
176 - System
177 - Tensilica ISS SIMCALL
179 .. _tcg-plugins:
182 -----------
184 QEMU TCG plugins provide a way for users to run experiments taking
185 advantage of the total system control emulation can have over a guest.
188 during these events. TCG plugins are unable to change the system state
199 Any QEMU binary with TCG support has plugins enabled by default.
202 configure --enable-plugins
207 $QEMU $OTHER_QEMU_ARGS \
208 -plugin contrib/plugins/libhowvec.so,inline=on,count=hint \
209 -plugin contrib/plugins/libhotblocks.so
215 Linux user-mode emulation also evaluates the environment variable
218 QEMU_PLUGIN="file=contrib/plugins/libhowvec.so,inline=on,count=hint" $QEMU
220 QEMU plugins avoid to write directly to stdin/stderr, and use the log provided
224 $QEMU $OTHER_QEMU_ARGS \
225 -d plugin \
226 -plugin contrib/plugins/libhowvec.so,inline=on,count=hint
231 There are a number of plugins included with QEMU and you are
235 ``make check-tcg`` target in ``tests/tcg/plugins`` that are never the
243 Purely a test plugin for measuring the overhead of the plugins system
255 $ qemu-aarch64 -plugin tests/plugin/libbb.so \
256 -d plugin ./tests/tcg/aarch64-linux-user/sha1
262 .. list-table:: Basic Block plugin arguments
264 :header-rows: 1
266 * - Option
267 - Description
268 * - inline=true|false
269 - Use faster inline addition of a single counter.
270 * - idle=true|false
271 - Dump the current execution stats whenever the guest vCPU idles
281 .. list-table:: Basic block vectors arguments
283 :header-rows: 1
285 * - Option
286 - Description
287 * - interval=N
288 - The interval to generate a basic block vector specified by the number of
290 * - outfile=PATH
291 - The path to output files.
296 $ qemu-aarch64 \
297 -plugin contrib/plugins/libbbv.so,interval=100,outfile=sha1 \
298 tests/tcg/aarch64-linux-user/sha1
311 $ qemu-aarch64 -plugin tests/plugin/libinsn.so \
312 -d plugin ./tests/tcg/aarch64-linux-user/threadcount
327 .. list-table:: Instruction plugin arguments
329 :header-rows: 1
331 * - Option
332 - Description
333 * - inline=true|false
334 - Use faster inline addition of a single counter.
335 * - sizes=true|false
336 - Give a summary of the instruction sizes for the execution
337 * - match=<string>
338 - Only instrument instructions matching the string prefix
344 $ qemu-aarch64 -plugin tests/plugin/libinsn.so,match=bl \
345 -d plugin ./tests/tcg/aarch64-linux-user/sha512-vector
366 $ qemu-aarch64 -plugin tests/plugin/libmem.so,inline=true \
367 -d plugin ./tests/tcg/aarch64-linux-user/sha1
373 .. list-table:: Memory plugin arguments
375 :header-rows: 1
377 * - Option
378 - Description
379 * - inline=true|false
380 - Use faster inline addition of a single counter
381 * - callback=true|false
382 - Use callbacks on each memory instrumentation.
383 * - hwaddr=true|false
384 - Count IO accesses (only for system emulation)
386 System Calls
391 A basic syscall tracing plugin. This only works for user-mode. By
395 $ qemu-aarch64 -plugin tests/plugin/libsyscall \
396 -d plugin ./tests/tcg/aarch64-linux-user/threadcount
421 .. list-table:: Syscall plugin arguments
423 :header-rows: 1
425 * - Option
426 - Description
427 * - print=true|false
428 - Print the number of times each syscall is called
429 * - log_writes=true|false
430 - Log the buffer of each write syscall in hexdump format
438 scoreboard. It prints a per-cpu summary of all events.
450 with linux-user execution as system emulation tends to generate
451 re-translations as blocks from different programs get swapped in and
452 out of system memory.
456 $ qemu-aarch64 \
457 -plugin contrib/plugins/libhotblocks.so -d plugin \
458 ./tests/tcg/aarch64-linux-user/sha1
474 $ qemu-aarch64 \
475 -plugin contrib/plugins/libhotpages.so -d plugin \
476 ./tests/tcg/aarch64-linux-user/sha1
487 .. list-table:: Hot pages arguments
489 :header-rows: 1
491 * - Option
492 - Description
493 * - sortby=reads|writes|address
494 - Log the data sorted by either the number of reads, the number of writes, or
496 * - io=on
497 - Track IO addresses. Only relevant to full system emulation. (Default: off)
498 * - pagesize=N
499 - The page size used. (Default: N = 4096)
509 instructions to break it down fully, so for example to see all the system
512 $ qemu-system-aarch64 $(QEMU_ARGS) \
513 -append "root=/dev/sda2 systemd.unit=benchmark.service" \
514 -smp 4 -plugin ./contrib/plugins/libhowvec.so,count=sreg -d plugin
533 Class: System Insn (6385349 hits)
534 Class: System Reg counted individually
549 Instr: mrs x0, sp_el0 (2682661 hits) (op=0xd5384100/ System Reg)
550 Instr: mrs x1, tpidr_el2 (1789339 hits) (op=0xd53cd041/ System Reg)
551 Instr: mrs x2, tpidr_el2 (1513494 hits) (op=0xd53cd042/ System Reg)
552 Instr: mrs x0, tpidr_el2 (1490823 hits) (op=0xd53cd040/ System Reg)
553 Instr: mrs x1, sp_el0 (933793 hits) (op=0xd5384101/ System Reg)
554 Instr: mrs x2, sp_el0 (699516 hits) (op=0xd5384102/ System Reg)
555 Instr: mrs x4, tpidr_el2 (528437 hits) (op=0xd53cd044/ System Reg)
556 Instr: mrs x30, ttbr1_el1 (480776 hits) (op=0xd538203e/ System Reg)
557 Instr: msr ttbr1_el1, x30 (480713 hits) (op=0xd518203e/ System Reg)
558 Instr: msr vbar_el1, x30 (480671 hits) (op=0xd518c01e/ System Reg)
573 asynchronous events are introduced. While the use of -icount can
583 $ qemu-system-sparc -monitor none -parallel none \
584 -net none -M SS-20 -m 256 -kernel day11/zImage.elf \
585 -plugin ./contrib/plugins/liblockstep.so,sockpath=lockstep-sparc.sock \
586 -d plugin,nochain
590 qemu-system-sparc: warning: nic lance.0 has no peer
606 The hwprofile tool can only be used with system emulation and allows
609 .. list-table:: Hardware Profile arguments
611 :header-rows: 1
613 * - Option
614 - Description
615 * - track=[read|write]
616 - By default the plugin tracks both reads and writes. You can use
618 * - source
619 - Will include a detailed break down of what the guest PC that made the
622 cirrus-low-memory @ 0xfffffd00000a0000
627 * - pattern
628 - Instead break down the accesses based on the offset into the HW
632 pci0-conf @ 0xfffffd01fe000000
653 $ qemu-system-arm $(QEMU_ARGS) \
654 -plugin ./contrib/plugins/libexeclog.so -d plugin
669 Please note that you need to configure QEMU with Capstone support to get disassembly.
675 $ qemu-system-arm $(QEMU_ARGS) \
676 -plugin ./contrib/plugins/libexeclog.so,ifilter=st1w,afilter=0x40001808 -d plugin
681 $ qemu-system-arm $(QEMU_ARGS) \
682 -plugin ./contrib/plugins/libexeclog.so,reg=\*_el2,reg=sp -d plugin
691 $ qemu-system-arm $(QEMU_ARGS) \
692 -plugin ./contrib/plugins/libexeclog.so,ifilter=msr,ifilter=blr,reg=x30,reg=\*_el1,rdisas=on
700 configuration, and optionally a unified L2 per-core cache when a given working
703 $ qemu-x86_64 -plugin ./contrib/plugins/libcache.so \
704 -d plugin -D cache.log ./tests/tcg/x86_64-linux-user/float_convs
727 .. list-table:: Cache modelling arguments
729 :header-rows: 1
731 * - Option
732 - Description
733 * - limit=N
734 - Print top N icache and dcache thrashing instructions along with
736 * - icachesize=N
739 - Instruction cache configuration arguments. They specify the
742 * - dcachesize=N
743 - Data cache size (default: 16834)
744 * - dblksize=B
745 - Data cache block size (default: 64)
746 * - dassoc=A
747 - Data cache associativity (default: 8)
748 * - evict=POLICY
749 - Sets the eviction policy to POLICY. Available policies are:
753 * - cores=N
754 - Sets the number of cores for which we maintain separate icache
755 and dcache. (default: for linux-user, N = 1, for full system
757 * - l2=on
758 - Simulates a unified L2 cache (stores blocks for both
760 size = 2MB, associativity = 16-way, block size = 64B).
761 * - l2cachesize=N
762 - L2 cache size (default: 2097152 (2MB)), implies ``l2=on``
763 * - l2blksize=B
764 - L2 cache block size (default: 64), implies ``l2=on``
765 * - l2assoc=A
766 - L2 cache associativity (default: 16), implies ``l2=on``
780 By default, QEMU will exit with return code 0. A custom return code can be
783 For example, to stop at the 20-th instruction with return code 41, at address
786 $ qemu-system-aarch64 $(QEMU_ARGS) \
787 -plugin ./contrib/plugins/libstoptrigger.so,icount=20:41,addr=0xd4,addr=0xd8:42 -d plugin
799 …$ num_insn=$(./build/qemu-x86_64 -plugin ./build/tests/plugin/libinsn.so -d plugin /bin/true |& gr…
801 …$ time ./build/qemu-x86_64 -plugin ./build/contrib/plugins/libips.so,ips=$(($num_insn/10)) /bin/tr…
805 .. list-table:: IPS arguments
807 :header-rows: 1
809 * - Option
810 - Description
811 * - ips=N
812 - Maximum number of instructions per cpu that can be executed in one second.
814 * - ipq=N
815 - Instructions per quantum. How many instructions before we re-calculate time.
820 ------------------------
822 When running system emulation you can also enable deterministic