qemu & qemu-system

1. Clone qemu source code and compile for linux

http://wiki.qemu-project.org/Download

git clone git://git.qemu-project.org/qemu.git

qemu compilation from the sources

http://qemu.weilnetz.de/qemu-doc.html#compilation

configure QEMU and build it (usually no options are needed):

./configure
make

Then type as root user:

make install

to install QEMU in /usr/local.

2. ARM cross-compile toolchain install

1. sudo apt-get install gcc-arm-linux-gnueabi
2. sudo apt-get install g++-arm-linux-gnueabi

3. qemu run user program

#include <stdio.h>

void main(int argc, char* argv[]) {
	printf("Hello world !");
}

$arm-linux-gnueabi-gcc -o main -static init.c 

$qemu-arm main 
Hello world !

$qemu-arm -strace main 
18472 gettid(0,1082003456,131072,0,264192,1082130672) = 18472
18472 open("/dev/urandom",O_RDONLY|O_LARGEFILE) = 3
18472 read(3,0x191dc,4) = 4
18472 close(3) = 0
18472 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40801000
18472 mprotect(0x40801000,4096,PROT_READ) = 0
18472 mprotect(0x40801000,4096,PROT_READ|PROT_WRITE) = 0
18472 mprotect(0x40801000,4096,PROT_READ) = 0
18472 fstat64(1,0x407ffd48) = 0
18472 brk(NULL) = 0x0001c000
18472 brk(0x0001c000) = 0x0001c000
18472 brk(0x0001d000) = 0x0001d000
18472 mprotect(0x40801000,4096,PROT_READ|PROT_WRITE) = 0
18472 mprotect(0x40801000,4096,PROT_READ) = 0
18472 ioctl(1,21505,1082129816,1082129812,102876,2176) = 0
18472 mprotect(0x40801000,4096,PROT_READ|PROT_WRITE) = 0
18472 mprotect(0x40801000,4096,PROT_READ) = 0
18472 mprotect(0x40801000,4096,PROT_READ|PROT_WRITE) = 0
18472 mprotect(0x40801000,4096,PROT_READ) = 0
18472 write(1,0x1c008,13)Hello world ! = 13
18472 munmap(0x40801000,4096) = 0
18472 exit_group(13)

4. qemu run linux kernel

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- vexpress_defconfig

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- -j4

$qemu-system-arm -kernel arch/arm/boot/zImage -serial stdio -M vexpress-a9 -append "root=/dev/mmcblk0 console=ttyAMA0"

audio: Could not init `oss' audio driver
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpuset
Linux version 3.18.0-rc4+ (qiang@qiang-Inspiron-1320) (gcc version 4.7.3 (Ubuntu/Linaro 4.7.3-1ubuntu1) ) #5 SMP Sat Nov 15 12:28:09 CST 2014
CPU: ARMv7 Processor [410fc090] revision 0 (ARMv7), cr=10c5387d
CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: ARM-Versatile Express
Memory policy: Data cache writeback
CPU: All CPU(s) started in SVC mode.
sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 178956969942ns
PERCPU: Embedded 9 pages/cpu @87eee000 s7616 r8192 d21056 u36864
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: root=/dev/mmcblk0 console=ttyAMA0
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 123032K/131072K available (4642K kernel code, 193K rwdata, 1316K rodata, 528K init, 153K bss, 8040K reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
    vmalloc : 0x88800000 - 0xff000000   (1896 MB)
    lowmem  : 0x80000000 - 0x88000000   ( 128 MB)
    modules : 0x7f000000 - 0x80000000   (  16 MB)
      .text : 0x80008000 - 0x805d9a90   (5959 kB)
      .init : 0x805da000 - 0x8065e000   ( 528 kB)
      .data : 0x8065e000 - 0x8068e560   ( 194 kB)
       .bss : 0x8068e560 - 0x806b4cfc   ( 154 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=1.
RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
NR_IRQS:16 nr_irqs:16 16
GIC CPU mask not found - kernel will fail to boot.
GIC CPU mask not found - kernel will fail to boot.
smp_twd: clock not found -2
L2C: DT/platform modifies aux control register: 0x02020000 -> 0x02420000
L2C-310 enabling early BRESP for Cortex-A9
L2C-310 full line of zeros enabled for Cortex-A9
L2C-310 dynamic clock gating disabled, standby mode disabled
L2C-310 cache controller enabled, 8 ways, 128 kB
L2C-310: CACHE_ID 0x410000c8, AUX_CTRL 0x46420001
Console: colour dummy device 80x30
Calibrating local timer... 90.10MHz.
Calibrating delay loop... 400.58 BogoMIPS (lpj=2002944)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
missing device node for CPU 0
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x60468238 - 0x60468290
Brought up 1 CPUs
SMP: Total of 1 processors activated.
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 0
regulator-dummy: no parameters
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
cpuidle: using governor ladder
cpuidle: using governor menu
hw-breakpoint: debug architecture 0x4 unsupported.
Serial: AMBA PL011 UART driver
uart-pl011 mb:uart0: ttyAMA0 at MMIO 0x10009000 (irq = 37, base_baud = 0) is a PL011 rev1
console [ttyAMA0] enabled
uart-pl011 mb:uart1: ttyAMA1 at MMIO 0x1000a000 (irq = 38, base_baud = 0) is a PL011 rev1
uart-pl011 mb:uart2: ttyAMA2 at MMIO 0x1000b000 (irq = 39, base_baud = 0) is a PL011 rev1
uart-pl011 mb:uart3: ttyAMA3 at MMIO 0x1000c000 (irq = 40, base_baud = 0) is a PL011 rev1
fixed-dummy: no parameters
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Advanced Linux Sound Architecture Driver Initialized.
Switched to clocksource v2m-timer1
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
CPU PMU: probing PMU on CPU 0
hw perfevents: enabled with armv7_cortex_a9 PMU driver, 1 counters available
futex hash table entries: 256 (order: 2, 16384 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
9p: Installing v9fs 9p2000 file system support
msgmni has been set to 240
io scheduler noop registered (default)
clcd-pl11x ct:clcd: PL111 rev2 at 0x10020000
clcd-pl11x ct:clcd: CT-CA9X4 hardware, XVGA display
Console: switching to colour frame buffer device 128x48
physmap platform flash device: 04000000 at 40000000
physmap-flash: Found 2 x16 devices at 0x0 in 32-bit bank. Manufacturer ID 0x000000 Chip ID 0x000000
Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
physmap platform flash device: 04000000 at 44000000
physmap-flash: Found 2 x16 devices at 0x0 in 32-bit bank. Manufacturer ID 0x000000 Chip ID 0x000000
Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
Concatenating MTD devices:
(0): "physmap-flash"
(1): "physmap-flash"
into device "physmap-flash"
libphy: smsc911x-mdio: probed
smsc911x smsc911x eth0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=smsc911x-fffffff:01, irq=-1)
smsc911x smsc911x eth0: MAC Address: 52:54:00:12:34:56
isp1760 isp1760: NXP ISP1760 USB Host Controller
isp1760 isp1760: new USB bus registered, assigned bus number 1
isp1760 isp1760: Scratch test failed.
isp1760 isp1760: can't setup: -19
isp1760 isp1760: USB bus 1 deregistered
isp1760: Failed to register the HCD device
usbcore: registered new interface driver usb-storage
mousedev: PS/2 mouse device common for all mice
rtc-pl031 mb:rtc: rtc core: registered pl031 as rtc0
mmci-pl18x mb:mmci: mmc0: PL181 manf 41 rev0 at 0x10005000 irq 41,42 (pio)
ledtrig-cpu: registered to indicate activity on CPUs
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
input: AT Raw Set 2 keyboard as /devices/mb:kmi0/serio0/input/input0
aaci-pl041 mb:aaci: ARM AC'97 Interface PL041 rev0 at 0x10004000, irq 43
aaci-pl041 mb:aaci: FIFO 512 entries
oprofile: using arm/armv7-ca9
TCP: cubic registered
NET: Registered protocol family 17
9pnet: Installing 9P2000 support
Registering SWP/SWPB emulation handler
rtc-pl031 mb:rtc: setting system clock to 2014-11-15 04:30:19 UTC (1416025819)
ALSA device list:
  #0: ARM AC'97 Interface PL041 rev0 at 0x10004000, irq 43
Freeing unused kernel memory: 528K (805da000 - 8065e000)
Hello world !Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000d00


CPU: 0 PID: 1 Comm: init Not tainted 3.18.0-rc4+ #5
[<800141e0>] (unwind_backtrace) from [<80010ff4>] (show_stack+0x10/0x14)
[<80010ff4>] (show_stack) from [<80463aa8>] (dump_stack+0x74/0x90)
[<80463aa8>] (dump_stack) from [<80460eac>] (panic+0x90/0x1fc)
[<80460eac>] (panic) from [<800243ec>] (do_exit+0x840/0x8e0)
[<800243ec>] (do_exit) from [<80024594>] (do_group_exit+0x3c/0xc4)
[<80024594>] (do_group_exit) from [<8002462c>] (__wake_up_parent+0x0/0x18)
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000d00

5. Busybox as initramfs

$git clone git://busybox.net/busybox.git

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- defconfig

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- menuconfig

Busybox Settings  ---> 

                                Build Options  ---> 

                                                          [*] Build BusyBox as a static binary (no shared libs)

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- -j4
$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- install

$mkdir ~/project/linux/initramfs/

$cp -r _install/* ~/project/linux/initramfs/

$cd ~/project/linux/initramfs/

$mkdir bin  dev  etc lib  mnt  proc  sbin  sys  tmp  usr  var

$cd dev/

$sudo mknod -m 666 console c 5 1

$sudo  mknod -m 666 null c 1 3

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- menuconfig

General setup  --->

                                 (/home/qiang/project/linux/initramfs) Initramfs source file(s) 

$make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- -j4

$qemu-system-arm -kernel arch/arm/boot/zImage -serial stdio -M vexpress-a9 -append "root=/dev/mmcblk0 console=ttyAMA0 rdinit=/bin/sh"

audio: Could not init `oss' audio driver
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpuset
Linux version 3.18.0-rc4+ (qiang@qiang-Inspiron-1320) (gcc version 4.7.3 (Ubuntu/Linaro 4.7.3-1ubuntu1) ) #8 SMP Sat Nov 15 12:40:39 CST 2014
CPU: ARMv7 Processor [410fc090] revision 0 (ARMv7), cr=10c5387d
CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: ARM-Versatile Express
Memory policy: Data cache writeback
CPU: All CPU(s) started in SVC mode.
sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 178956969942ns
PERCPU: Embedded 9 pages/cpu @87eee000 s7616 r8192 d21056 u36864
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: root=/dev/mmcblk0 console=ttyAMA0 rdinit=/bin/sh
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 121936K/131072K available (4642K kernel code, 193K rwdata, 1316K rodata, 1624K init, 153K bss, 9136K reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
    vmalloc : 0x88800000 - 0xff000000   (1896 MB)
    lowmem  : 0x80000000 - 0x88000000   ( 128 MB)
    modules : 0x7f000000 - 0x80000000   (  16 MB)
      .text : 0x80008000 - 0x805d9a90   (5959 kB)
      .init : 0x805da000 - 0x80770000   (1624 kB)
      .data : 0x80770000 - 0x807a0560   ( 194 kB)
       .bss : 0x807a0560 - 0x807c6cfc   ( 154 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=1.
RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
NR_IRQS:16 nr_irqs:16 16
GIC CPU mask not found - kernel will fail to boot.
GIC CPU mask not found - kernel will fail to boot.
smp_twd: clock not found -2
L2C: DT/platform modifies aux control register: 0x02020000 -> 0x02420000
L2C-310 enabling early BRESP for Cortex-A9
L2C-310 full line of zeros enabled for Cortex-A9
L2C-310 dynamic clock gating disabled, standby mode disabled
L2C-310 cache controller enabled, 8 ways, 128 kB
L2C-310: CACHE_ID 0x410000c8, AUX_CTRL 0x46420001
Console: colour dummy device 80x30
Calibrating local timer... 90.69MHz.
Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
missing device node for CPU 0
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x60468238 - 0x60468290
Brought up 1 CPUs
SMP: Total of 1 processors activated.
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 0
regulator-dummy: no parameters
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
cpuidle: using governor ladder
cpuidle: using governor menu
hw-breakpoint: debug architecture 0x4 unsupported.
Serial: AMBA PL011 UART driver
uart-pl011 mb:uart0: ttyAMA0 at MMIO 0x10009000 (irq = 37, base_baud = 0) is a PL011 rev1
console [ttyAMA0] enabled
uart-pl011 mb:uart1: ttyAMA1 at MMIO 0x1000a000 (irq = 38, base_baud = 0) is a PL011 rev1
uart-pl011 mb:uart2: ttyAMA2 at MMIO 0x1000b000 (irq = 39, base_baud = 0) is a PL011 rev1
uart-pl011 mb:uart3: ttyAMA3 at MMIO 0x1000c000 (irq = 40, base_baud = 0) is a PL011 rev1
fixed-dummy: no parameters
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Advanced Linux Sound Architecture Driver Initialized.
Switched to clocksource v2m-timer1
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
CPU PMU: probing PMU on CPU 0
hw perfevents: enabled with armv7_cortex_a9 PMU driver, 1 counters available
futex hash table entries: 256 (order: 2, 16384 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
9p: Installing v9fs 9p2000 file system support
msgmni has been set to 238
io scheduler noop registered (default)
clcd-pl11x ct:clcd: PL111 rev2 at 0x10020000
clcd-pl11x ct:clcd: CT-CA9X4 hardware, XVGA display
Console: switching to colour frame buffer device 128x48
physmap platform flash device: 04000000 at 40000000
physmap-flash: Found 2 x16 devices at 0x0 in 32-bit bank. Manufacturer ID 0x000000 Chip ID 0x000000
Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
physmap platform flash device: 04000000 at 44000000
physmap-flash: Found 2 x16 devices at 0x0 in 32-bit bank. Manufacturer ID 0x000000 Chip ID 0x000000
Intel/Sharp Extended Query Table at 0x0031
Using buffer write method
Concatenating MTD devices:
(0): "physmap-flash"
(1): "physmap-flash"
into device "physmap-flash"
libphy: smsc911x-mdio: probed
smsc911x smsc911x eth0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=smsc911x-fffffff:01, irq=-1)
smsc911x smsc911x eth0: MAC Address: 52:54:00:12:34:56
isp1760 isp1760: NXP ISP1760 USB Host Controller
isp1760 isp1760: new USB bus registered, assigned bus number 1
isp1760 isp1760: Scratch test failed.
isp1760 isp1760: can't setup: -19
isp1760 isp1760: USB bus 1 deregistered
isp1760: Failed to register the HCD device
usbcore: registered new interface driver usb-storage
mousedev: PS/2 mouse device common for all mice
rtc-pl031 mb:rtc: rtc core: registered pl031 as rtc0
mmci-pl18x mb:mmci: mmc0: PL181 manf 41 rev0 at 0x10005000 irq 41,42 (pio)
ledtrig-cpu: registered to indicate activity on CPUs
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
input: AT Raw Set 2 keyboard as /devices/mb:kmi0/serio0/input/input0
aaci-pl041 mb:aaci: ARM AC'97 Interface PL041 rev0 at 0x10004000, irq 43
aaci-pl041 mb:aaci: FIFO 512 entries
oprofile: using arm/armv7-ca9
TCP: cubic registered
NET: Registered protocol family 17
9pnet: Installing 9P2000 support
Registering SWP/SWPB emulation handler
rtc-pl031 mb:rtc: setting system clock to 2014-11-15 04:53:25 UTC (1416027205)
ALSA device list:
  #0: ARM AC'97 Interface PL041 rev0 at 0x10004000, irq 43
Freeing unused kernel memory: 1624K (805da000 - 80770000)
/bin/sh: can't access tty; job control turned off
/ # input: ImExPS/2 Generic Explorer Mouse as /devices/mb:kmi1/serio1/input/input2


/ # 

/ # mount -t proc proc /proc
/ # mount -t sysfs sys /sys

/ # mount -t debugfs nodev /sys/kernel/debug

Reference links:

http://www.cnblogs.com/coryxie/p/3329462.html

http://blog.chinaunix.net/uid-21273033-id-3276237.html

http://www.arm.com/zh/products/tools/development-boards/versatile-express/

That's All ! Enjoy QEMU debugging linux kernel !