/[gxemul]/trunk/doc/experiments.html
This is repository of my old source code which isn't updated any more. Go to git.rot13.org for current projects!
ViewVC logotype

Diff of /trunk/doc/experiments.html

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 4 by dpavlin, Mon Oct 8 16:18:00 2007 UTC revision 44 by dpavlin, Mon Oct 8 16:22:56 2007 UTC
# Line 1  Line 1 
1  <html>  <html><head><title>Gavare's eXperimental Emulator:&nbsp;&nbsp;&nbsp;Experimenting with GXemul</title>
2  <head><title>GXemul documentation: Experimenting with GXemul</title>  <meta name="robots" content="noarchive,nofollow,noindex"></head>
 </head>  
3  <body bgcolor="#f8f8f8" text="#000000" link="#4040f0" vlink="#404040" alink="#ff0000">  <body bgcolor="#f8f8f8" text="#000000" link="#4040f0" vlink="#404040" alink="#ff0000">
4  <table border=0 width=100% bgcolor="#d0d0d0"><tr>  <table border=0 width=100% bgcolor="#d0d0d0"><tr>
5  <td width=100% align=center valign=center><table border=0 width=100%><tr>  <td width=100% align=center valign=center><table border=0 width=100%><tr>
6  <td align="left" valign=center bgcolor="#d0efff"><font color="#6060e0" size="6">  <td align="left" valign=center bgcolor="#d0efff"><font color="#6060e0" size="6">
7  <b>GXemul documentation:</b></font>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  <b>GXemul:</b></font>&nbsp;&nbsp;
8  <font color="#000000" size="6"><b>Experimenting with GXemul</b>  <font color="#000000" size="6"><b>Experimenting with GXemul</b>
9  </font></td></tr></table></td></tr></table><p>  </font></td></tr></table></td></tr></table><p>
 <!-- The first 10 lines are cut away by the homepage updating script.  -->  
   
10    
11  <!--  <!--
12    
13  $Id: experiments.html,v 1.60 2005/04/16 00:29:45 debug Exp $  $Id: experiments.html,v 1.112 2007/06/23 16:59:35 debug Exp $
14    
15  Copyright (C) 2003-2005  Anders Gavare.  All rights reserved.  Copyright (C) 2003-2007  Anders Gavare.  All rights reserved.
16    
17  Redistribution and use in source and binary forms, with or without  Redistribution and use in source and binary forms, with or without
18  modification, are permitted provided that the following conditions are met:  modification, are permitted provided that the following conditions are met:
# Line 51  SUCH DAMAGE. Line 48  SUCH DAMAGE.
48  <ul>  <ul>
49    <li><a href="#hello">Hello world</a>    <li><a href="#hello">Hello world</a>
50    <li><a href="#expdevices">Experimental devices</a>    <li><a href="#expdevices">Experimental devices</a>
   <li><a href="#experiments">Experiments with other kernels and guest OSes</a>  
51  </ul>  </ul>
52    
53    
# Line 69  that you do two things: Line 65  that you do two things:
65    
66  <p>  <p>
67  <ul>  <ul>
68    <li>Build and install a cross-compiler for MIPS.    <li>Build and install a cross-compiler for your chosen target,
69    <li>Compile this hello world program, and run it in the emulator.          e.g. <tt>mips64-unknown-elf</tt>.
70            <a href="http://gcc.gnu.org/">GCC</a> is usually a good compiler
71            choice, because it is portable and in wide-spread use.
72            (Other compilers should work too.)
73      <p>
74      <li>Compile the Hello World demo program for your chosen target, and run
75            it in the emulator.
76  </ul>  </ul>
77    
78  <p>  <p>The Hello World demo program is included in the GXemul source
79  The emulator has several modes where it doesn't emulate any real machine.  code distribution, in the <a href="../demos/hello/"><tt>demos/hello/</tt></a>
80  It can either run in "bare" mode, where no devices are included by default  subdirectory. The README files in the demo directories have several
81  (just the CPU), or in a "test" mode where some simple devices are  examples of how the demo programs can be built.
82  emulated.  
83    <p>Once you have tried running the Hello World program from the command
84  <p>  line, e.g.<pre>
85  <table border="0"><tr><td width="40">&nbsp;</td><td>          <b>gxemul -E testmips hello_mips</b>
 <pre>  
 <font color=#f00000>/*  Hello world for GXemul  */  
   
 /*  Note: The cast to a signed int causes the address to be sign-extended  
     correctly to 0xffffffffb00000xx when compiled in 64-bit mode  */  
 </font><font color=#a0a0a0>#define      PUTCHAR_ADDRESS         ((signed int)0xb0000000)  
 #define HALT_ADDRESS            ((signed int)0xb0000010)  
   
 </font><font color=#c000c0>void </font><font color=#000000><a name="printchar">printchar</a>(</font><font color=#c000c0>char </font><font color=#000000>ch)  
 {  
         *((</font><font color=#c000c0>volatile unsigned char </font><font color=#000000>*) PUTCHAR_ADDRESS) = ch;  
 }  
   
 </font><font color=#c000c0>void </font><font color=#000000><a name="halt">halt</a>(</font><font color=#c000c0>void</font><font color=#000000>)  
 {  
         *((</font><font color=#c000c0>volatile unsigned char </font><font color=#000000>*) HALT_ADDRESS) = 0;  
 }  
   
 </font><font color=#c000c0>void </font><font color=#000000><a name="printstr">printstr</a>(</font><font color=#c000c0>char </font><font color=#000000>*s)  
 {  
         </font><font color=#c000c0>while </font><font color=#000000>(*s)  
                 printchar(*s++);  
 }  
   
 </font><font color=#c000c0>void </font><font color=#000000>f(</font><font color=#c000c0>void</font><font color=#000000>)  
 {  
         printstr(</font><font color=#00c000>"Hello world\n"</font><font color=#000000>);  
         halt();  
 }  
 </font></pre>  
 </td></tr></table>  
   
 This hello world program is available here as well:  
 <a href="hello_mips.c">hello_mips.c</a>  
 <p>  
 I recommend that you build a GCC cross compiler for the  
 <b>mips64-unknown-elf</b> target, and install it. Other compilers could  
 work too, but GCC is good because of its portability. Then try to compile  
 the hello world program:  
 <pre>  
         $ <b>mips64-unknown-elf-gcc -O2 hello_mips.c -mips4 -mabi=64 -c</b>  
         $ <b>mips64-unknown-elf-ld -Ttext 0xa800000000030000 -e f hello_mips.o -o hello_mips --oformat=elf64-bigmips</b>  
         $ <b>file hello_mips</b>  
         hello_mips: ELF 64-bit MSB mips-4 executable, MIPS R3000_BE, version 1 (SYSV), statically linked, not stripped  
         $ <b>gxemul -q -E testmips hello_mips</b>  
         Hello world  
   
         $ <b>mips64-unknown-elf-gcc -O2 hello_mips.c -c</b>  
         $ <b>mips64-unknown-elf-ld -Ttext 0x80030000 -e f hello_mips.o -o hello_mips</b>  
         $ <b>file hello_mips</b>  
         hello_mips: ELF 32-bit MSB mips-3 executable, MIPS R3000_BE, version 1 (SYSV), statically linked, not stripped  
         $ <b>gxemul -q -E testmips hello_mips</b>  
         Hello world  
 </pre>  
   
 <p>  
 As you can see above, a GCC configured for mips64-unknown-elf can produce  
 both 64-bit and 32-bit binaries. If you don't want to run the entire  
 Hello World program, but want to single-step through the execution to  
 learn more about how MIPS programs run, then add -V to the command line:  
   
 <p>  
 <pre>  
         $ <b>gxemul -V -E testmips hello_mips</b>  
         ..  
         GXemul&gt; <b>r</b>  
         cpu0:    pc = a800000000030078    <f>  
         cpu0:    hi = 0000000000000000    lo = 0000000000000000  
         cpu0:    zr = 0000000000000000    at = 0000000000000000  
         cpu0:    v0 = 0000000000000000    v1 = 0000000000000000  
         ..  
         cpu0:    gp = a8000000000780c0    sp = ffffffffa0007f00  
         cpu0:    fp = 0000000000000000    ra = 0000000000000000  
         GXemul&gt; <b>s 15</b>  
         &lt;f&gt;  
         a800000000030078: 67bdfff0      daddiu  sp,sp,-16  
         a80000000003007c: 3c04a800      lui     a0,0xa800  
         a800000000030080: 3c010003      lui     at,0x3  
         a800000000030084: 64840000      daddiu  a0,a0,0  
         a800000000030088: 642100b8      daddiu  at,at,184  
         a80000000003008c: 0004203c      dsll32  a0,a0,0  
         a800000000030090: 0081202d      daddu   a0,a0,at  
         a800000000030094: ffbf0000      sd      ra,0(sp)  [0xffffffffa0007ef0, data=0x0000000000000000]  
         a800000000030098: 0c00c00a      jal     0xa800000000030028 &lt;printstr&gt;  
         a80000000003009c: 00000000 (d)  nop  
           &lt;printstr("Hello world\n",0,0,0,..)&gt;  
         &lt;printstr&gt;  
         a800000000030028: 67bdfff0      daddiu  sp,sp,-16  
         a80000000003002c: ffb00000      sd      s0,0(sp)  [0xffffffffa0007ee0, data=0x0000000000000000]  
         a800000000030030: ffbf0008      sd      ra,8(sp)  [0xffffffffa0007ee8, data=0xa8000000000300a0]  
         a800000000030034: 90820000      lbu     v0,0(a0)  [0xa8000000000300b8 = $LC0, data=0x48]  
         a800000000030038: 00021600      sll     v0,v0,24  
         GXemul&gt; <b>print v0</b>  
         v0 = 0x0000000048000000  
         GXemul&gt; <b><blink>_</blink></b>  
86  </pre>  </pre>
87    you can experiment with adding one or more of the following command line
88    options:
89    
90  <p>  <p><ul>
91  The syntax of the single-step debugger shouldn't be too hard to grasp.    <li><b><tt>-t</tt></b>, to show a function call trace,
92  Type 's' to single-step one instruction. Just pressing enter after that    <li><b><tt>-i</tt></b>, to show instruction disassembly (for each
93  will repeat the 's' command. Type 'quit' to quit.          executed instruction),
94      <li>and finally <b><tt>-V</tt></b> to start the emulator in a "paused"
95  <p>          state.
96  Hopefully this is enough to get you inspired. :-)  </ul>
   
   
97    
98  <p><br>  <p>If you start the emulator in the paused state, or if you press CTRL-C
99  <h4>Hello World for GXemul's PPC mode</h4>  during normal execution, you will end up with a <tt><b>GXemul></b></tt>
100    prompt. This is the built-in debugger.
101    
102    <p>Using the built-in debugger, you can single step (<tt><b>s</b></tt>),
103    show the current contents of the emulated registers (<tt><b>r</b></tt>),
104    turn on/off the function call trace mode (<tt><b>trace</b></tt>), or
105    continue at full speed (<tt><b>c</b></tt>). Typing <tt><b>quit</b></tt>
106    exits the emulator.
107    
108  GXemul also has an experimental PowerPC emulation mode.  <p>Hopefully this is enough to get you inspired. :-)
 <a href="hello_ppc.c">hello_ppc.c</a> is similar to hello_mips.c, but  
 should be compiled and run as follows:  
 <p>  
 <pre>  
         $ <b>ppc-unknown-elf-gcc -O2 hello_ppc.c -c</b>  
         $ <b>ppc-unknown-elf-ld -e f hello_ppc.o -o hello_ppc</b>  
         $ <b>file hello_ppc</b>  
         hello_ppc: ELF 32-bit MSB executable, PowerPC or cisco 4500,  
           version 1 (SYSV), statically linked, not stripped  
         $ <b>gxemul -q -E testppc hello_ppc</b>  
         Hello world  
 </pre>  
   
 <p>  
 [&nbsp;2005-02-18: I haven't yet been able to build a GCC for ppc64 (only the  
 binutils toolchain), because the gcc sources seem to include Linux header files  
 that aren't present on my FreeBSD system. 32-bit PPC works ok, though.&nbsp;]  
109    
110    
111    
# Line 219  that aren't present on my FreeBSD system Line 116  that aren't present on my FreeBSD system
116  <a name="expdevices"></a>  <a name="expdevices"></a>
117  <h3>Experimental devices:</h3>  <h3>Experimental devices:</h3>
118    
119  The "test" MIPS machine has the following experimental devices:  The emulator has several modes where it doesn't emulate any real machine.
120    It can either run in "bare" mode, where no devices are included by default
121    (just the CPU), or in a "test" mode where some simple devices are
122    emulated.
123    
124    <p>The test machines (<tt>testmips</tt>, <tt>testppc</tt>, etc) have the
125    following experimental devices:
126    
127  <p>  <p>
128  <center><table border="0" width="80%">  <center><table border="0" width="80%">
129    
130    <tr>    <tr>
131      <td align="left" valign="top" width="200">      <td align="left" valign="top" width="200">
132          <b>cons:</b>          <a name="expdevices_cons"><b><tt>cons</tt>:</b></a>
133          <p>This is a simple console device, for writing          <p>A simple console device, for writing
134          characters to the controlling terminal.          characters to the controlling terminal
135          <p>Source code:&nbsp;&nbsp;<font color="#0000f0">devices/dev_cons.c</font>          and receiving keypresses.
136            <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_cons.c</tt></font>
137            <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_cons.h</tt></font>
138          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x10000000</font>          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x10000000</font>
139      </td>      </td>
140      <td align="left" valign="top" width="25">&nbsp;</td>      <td align="left" valign="top" width="25">&nbsp;</td>
# Line 240  The "test" MIPS machine has the followin Line 145  The "test" MIPS machine has the followin
145              <td align="left" valign="top"><i><u>Effect:</u></i></td>              <td align="left" valign="top"><i><u>Effect:</u></i></td>
146            </tr>            </tr>
147            <tr>            <tr>
148              <td align="left" valign="top">0x0000</td>              <td align="left" valign="top"><tt>0x00</tt></td>
149              <td align="left" valign="top">              <td align="left" valign="top">
150                  Read: <b>getchar()</b> (non-blocking)<br>                  Read: <b><tt>getchar()</tt></b> (non-blocking; returns
151                  Write: <b>putchar(ch)</b></td>                  <tt>0</tt> if no char was available)<br>
152                    Write: <b><tt>putchar(ch)</tt></b></td>
153            </tr>            </tr>
154            <tr>            <tr>
155              <td align="left" valign="top">0x0010</td>              <td align="left" valign="top"><tt>0x10</tt></td>
156              <td align="left" valign="top">Read or write: <b>halt()</b><br>              <td align="left" valign="top">Read or write: <b><tt>halt()</tt></b><br>
157                  (Useful for exiting the emulator.)</td>                  (Useful for exiting the emulator.)</td>
158            </tr>            </tr>
159          </table>          </table>
# Line 260  The "test" MIPS machine has the followin Line 166  The "test" MIPS machine has the followin
166    
167    <tr>    <tr>
168      <td align="left" valign="top">      <td align="left" valign="top">
169          <b>mp:</b>          <a name="expdevices_mp"><b><tt>mp</tt>:</b></a>
170          <p>This device controls the behaviour of CPUs in an emulated          <p>This device controls the behaviour of CPUs in an emulated
171          multi-processor system.          multi-processor system.
172          <p>Source code:&nbsp;&nbsp;<font color="#0000f0">devices/dev_mp.c</font>          <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_mp.c</tt></font>
173            <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_mp.h</tt></font>
174          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x11000000</font>          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x11000000</font>
175      </td>      </td>
176      <td></td>      <td></td>
# Line 274  The "test" MIPS machine has the followin Line 181  The "test" MIPS machine has the followin
181              <td align="left" valign="top"><i><u>Effect:</u></i></td>              <td align="left" valign="top"><i><u>Effect:</u></i></td>
182            </tr>            </tr>
183            <tr>            <tr>
184              <td align="left" valign="top">0x0000</td>              <td align="left" valign="top"><tt>0x0000</tt></td>
185              <td align="left" valign="top">Read: <b>whoami()</b>.              <td align="left" valign="top">Read: <b><tt>whoami()</tt></b>.
186                  Returns the id of the CPU doing the read.</td>                  Returns the id of the CPU doing the read.</td>
187            </tr>            </tr>
188            <tr>            <tr>
189              <td align="left" valign="top">0x0010</td>              <td align="left" valign="top"><tt>0x0010</tt></td>
190              <td align="left" valign="top">Read: <b>ncpus()</b>.              <td align="left" valign="top">Read: <b><tt>ncpus()</tt></b>.
191                  Returns the number of CPUs in the system.</td>                  Returns the number of CPUs in the system.</td>
192            </tr>            </tr>
193            <tr>            <tr>
194              <td align="left" valign="top">0x0020</td>              <td align="left" valign="top"><tt>0x0020</tt></td>
195              <td align="left" valign="top">Write: <b>startupcpu(i)</b>.              <td align="left" valign="top">Write: <b><tt>startupcpu(i)</tt></b>.
196                  Starts CPU i. It begins execution at the address                  Starts CPU i. It begins execution at the address
197                  set by a write to startupaddr (see below).</td>                  set by a write to startupaddr (see below).</td>
198            </tr>            </tr>
199            <tr>            <tr>
200              <td align="left" valign="top">0x0030</td>              <td align="left" valign="top"><tt>0x0030</tt></td>
201              <td align="left" valign="top">Write: <b>startupaddr(addr)</b>.              <td align="left" valign="top">Write: <b><tt>startupaddr(addr)</tt></b>.
202                  Sets the starting address for CPUs.</td>                  Sets the starting address for CPUs.</td>
203            </tr>            </tr>
204            <tr>            <tr>
205              <td align="left" valign="top">0x0040</td>              <td align="left" valign="top"><tt>0x0040</tt></td>
206              <td align="left" valign="top">Write: <b>pause_addr(addr)</b>.              <td align="left" valign="top">Write: <b><tt>pause_addr(addr)</tt></b>.
207                  Sets the pause address. (TODO: This is not                  Sets the pause address. (NOTE: This is not
208                  used anymore?)</td>                  used anymore.)</td>
209            </tr>            </tr>
210            <tr>            <tr>
211              <td align="left" valign="top">0x0050</td>              <td align="left" valign="top"><tt>0x0050</tt></td>
212              <td align="left" valign="top">Write: <b>pause_cpu(i)</b>.              <td align="left" valign="top">Write: <b><tt>pause_cpu(i)</tt></b>.
213                  Stops all CPUs <i>except</i> CPU i.</td>                  Pauses all CPUs <i>except</i> CPU i.</td>
214            </tr>            </tr>
215            <tr>            <tr>
216              <td align="left" valign="top">0x0060</td>              <td align="left" valign="top"><tt>0x0060</tt></td>
217              <td align="left" valign="top">Write: <b>unpause_cpu(i)</b>.              <td align="left" valign="top">Write: <b><tt>unpause_cpu(i)</tt></b>.
218                  Unpauses all CPUs <i>except</i> CPU i.</td>                  Unpauses CPU i.</td>
219            </tr>            </tr>
220            <tr>            <tr>
221              <td align="left" valign="top">0x0070</td>              <td align="left" valign="top"><tt>0x0070</tt></td>
222              <td align="left" valign="top">Write: <b>startupstack(addr)</b>.              <td align="left" valign="top">Write: <b><tt>startupstack(addr)</tt></b>.
223                  Sets the startup stack address. (CPUs started with                  Sets the startup stack address. (CPUs started with
224                  startupcpu() above will have their stack pointer                  startupcpu() above will have their stack pointer
225                  set to this value.)</td>                  set to this value.)</td>
226            </tr>            </tr>
227            <tr>            <tr>
228              <td align="left" valign="top">0x0080</td>              <td align="left" valign="top"><tt>0x0080</tt></td>
229              <td align="left" valign="top">Read: <b>hardware_random()</b>.              <td align="left" valign="top">Read: <b><tt>hardware_random()</tt></b>.
230                  This produces a "random" number.</td>                  This produces a "random" number.</td>
231            </tr>            </tr>
232            <tr>            <tr>
233              <td align="left" valign="top">0x0090</td>              <td align="left" valign="top"><tt>0x0090</tt></td>
234              <td align="left" valign="top">Read: <b>memory()</b>.              <td align="left" valign="top">Read: <b><tt>memory()</tt></b>.
235                  Returns the number of bytes of RAM in the system.</td>                  Returns the number of bytes of RAM in the system.</td>
236            </tr>            </tr>
237              <tr>
238                <td align="left" valign="top"><tt>0x00a0</tt></td>
239                <td align="left" valign="top">Write: <b><tt>ipi_one((nr &lt;&lt; 16) + cpuid)</tt></b>.
240                    Sends IPI <tt>nr</tt> to a specific CPU.</td>
241              </tr>
242              <tr>
243                <td align="left" valign="top"><tt>0x00b0</tt></td>
244                <td align="left" valign="top">Write: <b><tt>ipi_many((nr &lt;&lt; 16) + cpuid)</tt></b>.
245                    Sends IPI <tt>nr</tt> to all CPUs <i>except</i>
246                    the specified one.</td>
247              </tr>
248              <tr>
249                <td align="left" valign="top"><tt>0x00c0</tt></td>
250                <td align="left" valign="top">Read: <b><tt>ipi_read()</tt></b>.
251                    Returns the next pending IPI. 0 is returned if there is no
252                    pending IPI (so 0 shouldn't be used for valid IPIs).
253                    Hardware int 6 is deasserted when the IPI queue is empty.
254                <br>Write: <b><tt>ipi_flush()</tt></b>.
255                    Clears the IPI queue, discarding any pending IPIs.</td>
256              </tr>
257              <tr>
258                <td align="left" valign="top"><tt>0x00d0</tt></td>
259                <td align="left" valign="top">Read: <b><tt>ncycles()</tt></b>.
260                    Returns approximately the number of cycles executed on
261                    this CPU. Note: this value is not updated for every instruction,
262                    so it cannot be used for small measurements.</td>
263              </tr>
264          </table>          </table>
265      </td>      </td>
266    </tr>    </tr>
# Line 337  The "test" MIPS machine has the followin Line 271  The "test" MIPS machine has the followin
271    
272    <tr>    <tr>
273      <td align="left" valign="top">      <td align="left" valign="top">
274          <b>fb:</b>          <a name="expdevices_fb"><b><tt>fb</tt>:</b></a>
275          <p>A simple linear framebuffer, for graphics output.          <p>A simple linear framebuffer, for graphics output.
276          640 x 480 pixels, 3 bytes per pixel (red, green, blue, 8 bits each).          640 x 480 pixels, 3 bytes per pixel (red, green, blue, 8 bits each).
277          <p>Source code:&nbsp;&nbsp;<font color="#0000f0">devices/dev_fb.c</font>          <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_fb.c</tt></font>
278            <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_fb.h</tt></font>
279          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x12000000</font>          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x12000000</font>
280      </td>      </td>
281      <td></td>      <td></td>
# Line 351  The "test" MIPS machine has the followin Line 286  The "test" MIPS machine has the followin
286              <td align="left" valign="top"><i><u>Effect:</u></i></td>              <td align="left" valign="top"><i><u>Effect:</u></i></td>
287            </tr>            </tr>
288            <tr>            <tr>
289              <td align="left" valign="top">...</td>              <td align="left" valign="top"><tt>0x00000-</tt><br><tt>0xe0fff</tt></td>
290              <td align="left" valign="top">Read: read pixel values.              <td align="left" valign="top">Read: read pixel values.
291                  <br>Write: write pixel values.</td>                  <br>Write: write pixel values.</td>
292            </tr>            </tr>
# Line 359  The "test" MIPS machine has the followin Line 294  The "test" MIPS machine has the followin
294      </td>      </td>
295    </tr>    </tr>
296    
297  </table></center>    <tr height="15">
298        <td height="15">&nbsp;</td>
299  <p>    </tr>
 While these devices may resemble real-world hardware, they are  
 intentionally made simpler to use. (An exception is the framebuffer;  
 some machines actually have simple linear framebuffers like this.)  
   
 <p>  
 If the physical address is 0x10000000, then for MIPS that means that it  
 can be accessed at virtual address 0xffffffffb0000000. (Actually it can be  
 accessed at 0xffffffff90000000 too, but devices should usually be accessed  
 in a non-cached manner.)  
   
 <p>  
 (When using the PPC test machine, "testppc", the addresses are  
 0x10000000, 0x11000000 etc., so no need to add any virtual displacement.)  
   
 <p>  
 The <b>mp</b> device is agnostic when it comes to  
 word-length. For example, when reading offset 0x0000 of the <b>mp</b>  
 device, you may use any kind of read (an 8-bit read will work just as well  
 as a 64-bit read, although the value will be truncated to 8 bits in the  
 first case).  
   
 <p>  
 The <b>cons</b> device should be accessed using 8-bit reads and writes.  
 Doing a getchar() (ie reading from offset 0x0000) returns 0x00 if no  
 character was available.  
   
 <p>  
 On MIPS, the <b>cons</b> device is hardwired to interrupt 2 (the lowest  
 hardware interrupt). Whenever a character is available, the interrupt is  
 asserted. When there are no more available characters, the interrupt is  
 deasserted. (Remember that the interrupt has to be enabled in the status  
 register of the system coprocessor.)  
   
   
   
   
   
   
 <p><br>  
 <a name="experiments"></a>  
 <h3>Experiments with other kernels and guest OSes:</h3>  
   
 <p>  
 Operating system kernels and other test programs can be downloaded from  
 various places. Here are links to some of the kernels that I usually  
 experiment with.  
   
 <p>  
 <font color="#ff0000">  
 NOTE: This is <i>not</i> a list of kernels that work in the emulator.  
 It is a list of kernels that I experiment with.  
 </font>  
   
 <p>  
 For more information about which of these that actually work, read the  
 <a href="intro.html#guestos">section in the Introduction chapter</a>  
 that lists guest operating systems. If a system is not listed there, it  
 probably doesn't work in GXemul.  
   
 <p>  
 <ul>  
   <li>DECstation:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/pmax/">NetBSD/pmax</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/pmax/binary/kernel/netbsd-INSTALL.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/pmax/binary/kernel/netbsd-INSTALL.gz</a>  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/pmax/binary/kernel/netbsd-INSTALL.symbols.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/pmax/binary/kernel/netbsd-INSTALL.symbols.gz</a>  
         <br>gunzip the files, and run the emulator with <b>-E dec -e 3max -q -N -XY2</b>  
         for a graphical framebuffer console. Remove <b>-XY2</b> and <b>-N</b> to use serial (stdin/stdout) console.  
         Read <a href="guestoses.html#netbsdinstall">this section</a> about how to install NetBSD/pmax onto a harddisk image.  
       <p>  
       <li><a href="http://www.openbsd.org/pmax.html">OpenBSD/pmax</a>:  
         <br><a href="ftp://ftp.se.openbsd.org/pub/OpenBSD/2.8/pmax/bsd">ftp://ftp.se.openbsd.org/pub/OpenBSD/2.8/pmax/bsd</a>  
         <br>This is an old OpenBSD kernel in a.out format. Try <b>-E dec -e 3max</b>.  
         <br>Read <a href="guestoses.html#openbsdinstall">this section</a> about how to install OpenBSD/pmax onto a harddisk image.  
         It's a bit more complicated than installing NetBSD/pmax, but might work.  
       <p>  
       <li>Linux for DECstation:  
         <br>Here is a Debian package containing a Linux 2.4.26 kernel for  
                 DECstation which supports framebuffer!  
         <br><a href="http://ftp.debian.org/debian/pool/main/k/kernel-patch-2.4.26-mips/kernel-image-2.4.26-r3k-kn02_2.4.26-0.040505.1_mipsel.deb">http://ftp.debian.org/debian/pool/main/k/kernel-patch-2.4.26-mips/  
         <br>kernel-image-2.4.26-r3k-kn02_2.4.26-0.040505.1_mipsel.deb</a>  
         <br>Run the following commands to extract the kernel:<pre>  
         <b>ar x kernel-image-2.4.26-r3k-kn02_2.4.26-0.040505.1_mipsel.deb data.tar.gz</b>  
         <b>tar xfzv data.tar.gz ./boot/vmlinux-2.4.26-r3k-kn02</b>  
         <b>mv boot/vmlinux-* .; rmdir boot</b>  
 </pre>  
         <br>To try with the framebuffer: <b>-E dec -e 3max -X vmlinux-2.4.26-r3k-kn02</b>  
         <br>To try with serial console: <b>-E dec -e 3max -o 'console=ttyS3' vmlinux-2.4.26-r3k-kn02</b>  
         <br>Read <a href="guestoses.html#declinux">this section</a> about how to run a Debian Linux install kernel.  
         <br>Here are some older kernels (these don't support framebuffer, I think):  
                 <a href="http://www.xs4all.nl/~vhouten/mipsel/kernels.html">http://www.xs4all.nl/~vhouten/mipsel/kernels.html</a>  
         <br>Note: Make sure you add <b>-CR4400</b> to the command line for  
                 R4000 kernels, as Linux doesn't autodetect CPU type at runtime.  
       <p>  
       <li>Sprite:  
         <br>The Unix Heritage Society (TUHS, <a href="http://www.tuhs.org">www.tuhs.org</a>)  
                 has preserved a copy of a harddisk image for a DECstation 5000/200:  
                 <a href="http://www.es.embnet.org/Services/ftp/misc/TUHS/other_os/Sprite/">http://www.es.embnet.org/Services/ftp/misc/TUHS/other_os/Sprite</a>/<a href="http://www.es.embnet.org/Services/ftp/misc/TUHS/other_os/Sprite/ds5000.bt">ds5000.bt</a>  
         <br>(MD5 (ds5000.bt) = ec84eeeb20fe77b758370d5e312e4a5e)  
         <br>Read <a href="guestoses.html#sprite">this section</a> for more information  
                 about running this harddisk image in the emulator.  
       <p>  
       <li><a href="http://www-2.cs.cmu.edu/afs/cs/project/mach/public/www/mach.html">Mach</a>:  
         <br>Important! Run <b>./configure --caches; make</b>  
         <br>Download <a href="http://lost-contact.mit.edu/afs/athena/user/d/a/daveg/Info/Links/Mach/src/release/">http://lost-contact.mit.edu/afs/athena/user/d/a/daveg/Info/Links/Mach/src/release</a>/<a href="http://lost-contact.mit.edu/afs/athena/user/d/a/daveg/Info/Links/Mach/src/release/pmax.tar.Z">pmax.tar.Z</a>  
         <br>tar xfvz pmax.tar.Z pmax_mach/special/mach.boot.MK83.STD+ANY  
         <br><b>gxemul -E dec -e 3max -X pmax_mach/special/mach.boot.MK83.STD+ANY</b>  
     </ul>  
   </li>  
   
   <p>  
   
   <li>SGI:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/sgimips/">NetBSD/sgimips</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP3x.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP3x.gz</a>  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP3x.symbols.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP3x.symbols.gz</a>  
         <br>gunzip, and try running with <b>-E sgi -e ip32</b>.  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP2x.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP2x.gz</a>  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP2x.symbols.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sgimips/binary/kernel/netbsd-INSTALL32_IP2x.symbols.gz</a>  
         <br>gunzip, and try running with <b>-E sgi -e ip22</b> (or <b>-e ip24</b> or <b>-e ip20</b>).  
       <p>  
       <li>Linux/SGI:  
         <br>Some kernels are available here: <a href="http://www.linux-mips.org/~glaurung/">http://www.linux-mips.org/~glaurung/</a>  
         <br>Try running with <b>-E sgi -e ip32 -X</b> for a graphical framebuffer, or  
                 <b>-E sgi -e ip32 -o 'console=ttyS0'</b> for serial console.  
         <br>Adding -b (bintrans) might work sometimes.  
         <br>(You need to add <b>-CR5000</b> if you're trying to run  
                 a kernel compiled for R5000, because Linux  
                 doesn't autodetect CPU at runtime.)  
         <br>Also: <a href="http://www.tal.org/~milang/o2/kernels/">http://www.tal.org/~milang/o2/kernels</a>/<a href="http://home.tal.org/~milang/o2/kernels/vmlinux64-2.6.8.1-IP32">vmlinux64-2.6.8.1-IP32</a>  
         <br>Try <b>-E sgi -e ip32 -b -X -CR5000 vmlinux64-2.6.8.1-IP32</b>.  
         <br>And also some IP27 kernels:  
                 <a href="http://www.total-knowledge.com/progs/mips/kernels/vmlinux.ip27-20040428">http://www.total-knowledge.com/progs/mips/kernels/vmlinux.ip27-20040428</a>  
                 and  
                 <a href="http://www.total-knowledge.com/progs/mips/kernels/vmlinux.ip27-20040528.bz2">http://www.total-knowledge.com/progs/mips/kernels/vmlinux.ip27-20040528.bz2</a>  
                 (but unfortunately these lack symbols).  
         <br>Try the IP27 kernels with <b>-E sgi -e ip27 -t</b>.  
       <p>  
       <li><a href="http://www.openbsd.org/sgi.html">OpenBSD/sgi</a>:  
         <br>Snapshots can be found at <a href="ftp://ftp.OpenBSD.org/pub/OpenBSD/snapshots/sgi/">ftp://ftp.OpenBSD.org/pub/OpenBSD/snapshots/sgi/</a>.  
         <br>Try <b>gxemul -b -E sgi -e ip32 bsd.rd</b>  
       <p>  
       <li><a href="http://www.freebsd.org/platforms/mips.html">FreeBSD/MIPS</a>:  
                 I don't think public binary snapshots are available yet.  
       <p>  
       <li>arcdiag:  
         <br>The NetBSD people have also made available an "arcdiag" for SGI-IP22:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/arch/sgimips/arcdiag.ip22">ftp://ftp.netbsd.org/pub/NetBSD/arch/sgimips/arcdiag.ip22</a>  
         <br>Try running <b>gxemul -E sgi -e ip22 -x arcdiag.ip22</b>.  
     </ul>  
   </li>  
   
   <p>  
   
   <li>ARC:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/arc/">NetBSD/arc</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/arc/binary/kernel/netbsd-RAMDISK.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/arc/binary/kernel/netbsd-RAMDISK.gz</a>  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/arc/binary/kernel/netbsd-RAMDISK.symbols.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/arc/binary/kernel/netbsd-RAMDISK.symbols.gz</a>  
         <br>gunzip, and try with <b>-E arc -e rd94</b>.  
         <br>(You may also try other ARC models.)  
         <br>Read <a href="guestoses.html#netbsdarcinstall">this section</a> about how  
                 to install NetBSD/arc onto a harddisk image.  
       <p>  
       <li><a href="http://www.openbsd.org/arc.html">OpenBSD/arc</a>:  
         <br><a href="ftp://ftp.se.openbsd.org/pub/OpenBSD/2.3/arc/bsd.rd.elf">ftp://ftp.se.openbsd.org/pub/OpenBSD/2.3/arc/bsd.rd.elf</a>  
         <br>Try running with <b>-X -E arc -e pica</b> or <b>-X -E arc -e tyne</b>.  
         <br>Read <a href="guestoses.html#openbsdarcinstall">this section</a> about how  
                 to install OpenBSD/arc onto a harddisk image.  
       <p>  
       <li>Linux:  
         <br><a href="ftp://ftp.linux-mips.org/pub/linux/mips/mipsel-linux/boot/vmlinux-m700-2.1.131.gz">ftp://ftp.linux-mips.org/pub/linux/mips/mipsel-linux/boot/vmlinux-m700-2.1.131.gz</a>  
         <br>gunzip, and run with <b>-v -J -X -N -E arc -e m700</b> (Olivetti M700)  
       <p>  
       <li>Pandora:  
         <br><a href="ftp://ftp.linux-mips.org/pub/linux/mips/ancient/milo/">ftp://ftp.linux-mips.org/pub/linux/mips/ancient/milo</a>/<a href="ftp://ftp.linux-mips.org/pub/linux/mips/ancient/milo/milo-0.27.1.tar.gz">milo-0.27.1.tar.gz</a>  
         <br>A generic test/diagnostics program for ARC-based machines.  
         <br>Run with <b>-E arc -e r94 milo-0.27.1/pandora</b>  
       <p>  
       <li>arcdiag:  
         <br>Precompiled binary:<a href="ftp://ftp.netbsd.org/pub/NetBSD/arch/arc/arcdiag">ftp://ftp.netbsd.org/pub/NetBSD/arch/arc/arcdiag</a>  
         <br>(alternative: <a href="http://www.sensi.org/~alec/mips/arcdiag">http://www.sensi.org/~alec/mips/arcdiag</a>)  
         <br>A generic test/diagnostics program for ARC-based machines.  
         <br>Run with <b>-E arc -e pica arcdiag</b> (or some other ARC mode).  
         <br>Example arcdiag output (from real machines):  
         <br><a href="http://mail-index.netbsd.org/port-arc/2000/10/18/0001.html">http://mail-index.netbsd.org/port-arc/2000/10/18/0001.html</a> (Olivetti M700-10)  
         <br><a href="http://www.sensi.org/~alec/mips/arcdiag.txt">http://www.sensi.org/~alec/mips/arcdiag.txt</a> (PICA-61)  
         <br><a href="http://mail-index.netbsd.org/port-arc/2000/10/14/0000.html">http://mail-index.netbsd.org/port-arc/2000/10/14/0000.html</a> (Deskstation Tyne)  
         <br><a href="http://mail-index.netbsd.org/port-arc/2004/02/01/0001.html">http://mail-index.netbsd.org/port-arc/2004/02/01/0001.html</a> (NEC RISCserver 4200)  
         <br><a href="http://mirror.aarnet.edu.au/pub/NetBSD/misc/chs/arcdiag.out">http://mirror.aarnet.edu.au/pub/NetBSD/misc/chs/arcdiag.out</a> (NEC-R96)  
     </ul>  
   </li>  
   
   <p>  
   
   <li>HPCmips:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/hpcmips/">NetBSD/hpcmips</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/hpcmips/installation/">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/hpcmips/installation</a>/<a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/hpcmips/installation/netbsd.gz">netbsd.gz</a>  
         <br>Try <b>gxemul -X -b -E hpc -e mobilepro770 netbsd</b>  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/hpcmips/binary/kernel/netbsd-GENERIC.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/hpcmips/binary/kernel/netbsd-GENERIC.gz</a>  
         <br>Try <b>gxemul -X -b -E hpc -e mobilepro770 netbsd-GENERIC</b>  
       <p>  
       <li>Linux for BE300:  
         <br><a href="http://www.linux4.be/2004/linux4be20040908.zip">http://www.linux4.be/2004/linux4be20040908.zip</a>  
         <br>Try <b>gxemul -X -b -E hpc -e be300 vmlinux</b>  
       <p>  
       <li>Linux for Agenda VR3:  
         <br>Download <a href="http://agenda-snow.sourceforge.net/kernel-old-versions/binary/">http://agenda-snow.sourceforge.net/kernel-old-versions/binary</a>/<a href="http://agenda-snow.sourceforge.net/kernel-old-versions/binary/root1.2.6.kernel-8.00">root1.2.6.kernel-8.00</a>  
         <br>and <a href="http://vr3.uid0.sk/cd/Software/VR3_Distributions/H2O/">http://vr3.uid0.sk/cd/Software/VR3_Distributions/H2O</a>/<a href="http://vr3.uid0.sk/cd/Software/VR3_Distributions/H2O/root1.2.6.cramfs">root1.2.6.cramfs</a>.  
         <br>(or <a href="http://www.ipsec.info/~www/agenda/dream-1-noxip.cramfs">http://www.ipsec.info/~www/agenda/dream-1-noxip.cramfs</a>)  
         <br>Try <b>gxemul -b -X -E hpc -e vr3 -x 0xbf200000:root1.2.6.cramfs 0xbf000000:0:0xbf0005e0:root1.2.6.kernel-8.00</b>  
         <br>(or replace root1.2.6.cramfs with dream-1-noxip.cramfs)  
         <br>Remove <b>-X</b> to try with serial console instead of X, and  
                 remove <b>-b</b> to try without (old) bintrans.  
         <br>Add <b>-o 'init=/bin/sh'</b> to boot into a single-user shell.  
         <br>Add <b>-o 'init=/sbin/restore_defaults'</b> to run  
                 a /sbin/restore_defaults (attempt to initialize the flash  
                 memory).  
       <p>  
       <li>Linux for MobilePro etc.:  
         <br><a href="http://pc1.peanuts.gr.jp/~kei/Hard-Float/Kernels/">http://pc1.peanuts.gr.jp/~kei/Hard-Float/Kernels/</a>  
         <br>Uncompress the archive to get a kernel, vmlinux-800 for example.  
         <br>Try <b>./gxemul -b -X -o 'root=/dev/hda1' -d r:disk.img -d r:disk.img -Ehpc -e mobilepro800 vmlinux-800</b>  
         <br>where disk.img is an ext2fs filesystem with contents from  
         <a href="http://pc1.peanuts.gr.jp/~kei/Hard-Float/Miniroots/miniroot-20010330.tar.bz2">http://pc1.peanuts.gr.jp/~kei/Hard-Float/Miniroots/miniroot-20010330.tar.bz2</a>  
         <br>(Note the double disk arguments.)  
         <br>Note 2: This doesn't work yet.  
       <p>  
       <li><a href="http://www.disorder.ru/openbsd/be300/">OpenBSD/be300</a>:  
         <br><a href="http://www.disorder.ru/openbsd/be300/bsd.rd">http://www.disorder.ru/openbsd/be300/bsd.rd</a>  
         <br>Try <b>gxemul -X -b -E hpc -e be300 bsd.rd</b>  
         <br>Note: -b might be buggy, so you can try without that if you want to.  
     </ul>  
   </li>  
   
   <p>  
   
   <li>Playstation 2:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/playstation2/">NetBSD/playstation2</a>:  
         <br>NetBSD/playstation2 snapshot kernels are available here: (RAMDISK and GENERIC)  
         <br><a href="ftp://ftp.NetBSD.org/pub/NetBSD/arch/playstation2/snapshot/20020327/installation/netbsd.gz">ftp://ftp.NetBSD.org/pub/NetBSD/arch/playstation2/snapshot/20020327/installation/netbsd.gz</a>  
         <br><a href="ftp://ftp.NetBSD.org/pub/NetBSD/arch/playstation2/snapshot/20020327/binary/kernel/netbsd-GENERIC.gz">ftp://ftp.NetBSD.org/pub/NetBSD/arch/playstation2/snapshot/20020327/binary/kernel/netbsd-GENERIC.gz</a>  
         <br>Try running with <b>-X -E playstation2</b>  (<b>-X</b> is required, for the framebuffer).  
   
       <p>  
       <li>Linux:  
         <br>A Linux kernel (2.2.21-pre1-xr7) is available from  
         <a href="http://playstation2-linux.com/projects/xrhino-kernel/">http://playstation2-linux.com/projects/xrhino-kernel/</a>  
         <br>Try running with <b>-X -E playstation2</b>  (<b>-X</b> is required, for the framebuffer).  
     </ul>  
   </li>  
   
 </ul>  
   
 <p>  
 The following work even less than the ones listed above:  
   
 <p>  
 <ul>  
   <li>Cobalt:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/cobalt/">NetBSD/cobalt</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-1.6.2/cobalt/binary/kernel/netbsd-GENERIC.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-1.6.2/cobalt/binary/kernel/netbsd-GENERIC.gz</a>  
         <br>gunzip, and run with <b>-E cobalt</b>  
       <p>  
       <li>Linux:  
         <br><a href="http://people.debian.org/~pm/mips-cobalt/nfsroot/vmlinux_raq-2800.gz">http://people.debian.org/~pm/mips-cobalt/nfsroot/vmlinux_raq-2800.gz</a>  
         <br>gunzip, and run with <b>-E cobalt</b>  
     </ul>  
   </li>  
   
   <p>  
   
   <li>Sony NeWS:  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/newsmips/">NetBSD/newsmips</a>:  
         <br>A NetBSD/newsmips kernel and corresponding symbols are  
                 available here:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/newsmips/binary/kernel/netbsd-INSTALL.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/newsmips/binary/kernel/netbsd-INSTALL.gz</a>  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/newsmips/binary/kernel/netbsd-INSTALL.symbols.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/newsmips/binary/kernel/netbsd-INSTALL.symbols.gz</a>  
         <br>Try running with <b>-E sonynews</b>.  
         <br>There's also a boot floppy available, but the emulator currently  
                 doesn't support booting from it:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-1.6/newsmips/installation/floppy/boot.fs">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-1.6/newsmips/installation/floppy/boot.fs</a>  
     </ul>  
   </li>  
   
   <p>  
   
   <li><a href="http://www.meshcube.org/">MeshCube</a>:  
     <ul>  
       <li>Linux:  
         <br>A Linux kernel is available from  
         <a href="http://www.meshcube.org/feed/stable/">http://www.meshcube.org/feed/stable</a>/<a href="http://www.meshcube.org/feed/stable/kernel-image-mtx_2.4.24-3_mipsel.ipk">kernel-image-mtx_2.4.24-3_mipsel.ipk</a>  
         <br>(This is a Debian package, you can use <b>ar</b> and <b>tar</b>  
                 to extract kernel.img from it.)  
         <br>Try running with <b>-E meshcube 0x80800000:kernel.img</b>.  
     </ul>  
   </li>  
   
   <p>  
   
   <li><a href="http://www.seattlewireless.net/index.cgi/NetgearWG602">NetGear WG602</a>:  
     <ul>  
       <li>Linux:  
         <br>A Linux kernel is available from  
         <a href="ftp://downloads.netgear.com/files/wg602_v1715.zip">ftp://downloads.netgear.com/files/wg602_v1715.zip</a>  
         <br>(Unzip wg602_v1715.zip to get WG602_V1715.img.)  
         <br>Try running with <b>-E netgear 0xbfc80000:0x40:WG602_V1715.img</b>.  
         <br>(It takes some time to decompress the kernel, so be patient.)  
     </ul>  
   </li>  
   
   <p>  
   
   <li>Linksys WRT54G:  
     <ul>  
       <li>Linux:  
         <br><a href="http://openwrt.org/">OpenWRT</a> is a Linux  
                 distribution for the WRT54G.  
         <br><a href="http://www.batbox.org/wrt54g-linux.html">BatBox</a>  
                 is another distribution.  
         <br>Download <a href="http://pjf.dotgeek.org/downloads/openwrt/openwrt-g-code.bin">http://pjf.dotgeek.org/downloads/openwrt/openwrt-g-code.bin</a>  
                 (or a similar .bin file).  
         <br>From offset 60 and forward in the bin file, there is a gzip file.  
         <br>$ <b>dd if=openwrt-g-code.bin of=piggy.gz bs=60 iseek=1 oseek=0</b>  
         <br>$ <b>gunzip piggy.gz</b>  
         <br>$ <b>gxemul -E linksys -t 0x80001000:piggy</b>  
         <br>There's also a .bin file available from linksys:  
                 <a href="ftp://ftp.linksys.com/pub/network/WRT54G_1.30.7_US_code.bin">ftp://ftp.linksys.com/pub/network/WRT54G_1.30.7_US_code.bin</a>  
     </ul>  
   </li>  
 </ul>  
   
 <p>  
 The following don't work at all, actually, because the PPC and SPARC  
 modes are just skeletons so far.  
   
 <p>  
 <ul>  
   
   <li>Walnut (evbppc):  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/evbppc/">NetBSD/evbppc</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/evbppc/binary/kernel/netbsd-INSTALL_WALNUT.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/evbppc/binary/kernel/netbsd-INSTALL_WALNUT.gz</a>  
         <br>gunzip, and try the following:  
         <br>$ <b>gxemul -E walnut -v -t netbsd-INSTALL_WALNUT</b>  
     </ul>  
   </li>  
   
   <p>  
   
   <li>Artesyn's PM/PPC board (pmppc):  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/pmppc/">NetBSD/pmppc</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/pmppc/binary/kernel/netbsd-INSTALL.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/pmppc/binary/kernel/netbsd-INSTALL.gz</a>  
         <br>gunzip, and try the following:  
         <br>$ <b>gxemul -E pmppc netbsd-INSTALL</b>  
     </ul>  
   </li>  
   
   <p>  
   
   <li>Motorola Sandpoint (sandpoint):  
     <ul>  
       <li><a href="http://www.netbsd.org/Ports/sandpoint/">NetBSD/sandpoint</a>:  
         <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sandpoint/binary/kernel/netbsd-INSTALL.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sandpoint/binary/kernel/netbsd-INSTALL.gz</a>  
         <br>gunzip, and try the following:  
         <br>$ <b>gxemul -E sandpoint -v -t netbsd-INSTALL</b>  
     </ul>  
   </li>  
   
   <p>  
300    
301    <li>PReP:    <tr>
302      <ul>      <td align="left" valign="top">
303        <li><a href="http://www.netbsd.org/Ports/prep/">NetBSD/prep</a>:          <a name="expdevices_disk"><b><tt>disk</tt>:</b></a>
304          <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/prep/binary/kernel/netbsd-INSTALL.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/prep/binary/kernel/netbsd-INSTALL.gz</a>          <p>Disk controller, which can read from and write
305          <br>gunzip, and try the following:          to emulated IDE disks. It does not use interrupts; read and
306          <br>$ <b>gxemul -E prep -v -t netbsd-INSTALL</b>          write operations finish instantaneously.
307        <p>          <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_disk.c</tt></font>
308        <li>Linux:          <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_disk.h</tt></font>
309          <br><a href="http://jocelyn.mayer.free.fr/qemu-ppc/linux_images/2.4.25-PPC/vmlinux">http://jocelyn.mayer.free.fr/qemu-ppc/linux_images/2.4.25-PPC/vmlinux</a>          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x13000000</font>
310          <br>$ <b>gxemul -E prep -v -t vmlinux</b>      </td>
311      </ul>      <td></td>
312    </li>      <td align="left" valign="top">
313            <table border="0">
314              <tr>
315                <td align="left" valign="top"><i><u>Offset:</u></i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
316                <td align="left" valign="top"><i><u>Effect:</u></i></td>
317              </tr>
318              <tr>
319                <td align="left" valign="top"><tt>0x0000</tt></td>
320                <td align="left" valign="top">Write: Set the offset (in bytes) from the beginning
321                    of the disk image. This offset will be used for the next read/write operation.</td>
322              </tr>
323              <tr>
324                <td align="left" valign="top"><tt>0x0010</tt></td>
325                <td align="left" valign="top">Write: Select the IDE ID to be used in the next
326                    read/write operation.</td>
327              </tr>
328              <tr>
329                <td align="left" valign="top"><tt>0x0020</tt></td>
330                <td align="left" valign="top">Write: Start a read or write operation.
331                    (Writing <tt>0</tt> means a Read operation, a <tt>1</tt> means a
332                    Write operation.)</td>
333              </tr>
334              <tr>
335                <td align="left" valign="top"><tt>0x0030</tt></td>
336                <td align="left" valign="top">Read: Get status of the last operation.
337                    (Status 0 means failure, non-zero means success.)</td>
338              </tr>
339              <tr>
340                <td align="left" valign="top"><tt>0x4000-</tt><br><tt>0x41ff</tt>&nbsp;&nbsp;&nbsp;</td>
341                <td align="left" valign="top">Read/Write: 512 bytes data buffer.</td>
342              </tr>
343            </table>
344        </td>
345      </tr>
346    
347    <p>    <tr height="15">
348        <td height="15">&nbsp;</td>
349      </tr>
350    
351    <li>MacPPC:    <tr>
352      <ul>      <td align="left" valign="top">
353        <li><a href="http://www.netbsd.org/Ports/macppc/">NetBSD/macppc</a>:          <a name="expdevices_ether"><b><tt>ether</tt>:</b></a>
354          <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/macppc/binary/kernel/">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/macppc/binary/kernel</a>/<a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/macppc/binary/kernel/netbsd-INSTALL.gz">netbsd-INSTALL.gz</a>          <p>A simple ethernet controller, enough to send
355          <br>$ <b>gxemul -E macppc -e g4 -t netbsd-INSTALL</b>          and receive packets on a simulated network.
356        <p>          <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_ether.c</tt></font>
357        <li><a href="http://www.openbsd.org/macppc.html">OpenBSD/macppc</a>:          <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_ether.h</tt></font>
358          <br><a href="ftp://ftp.openbsd.org/pub/OpenBSD/3.6/macppc/">ftp://ftp.openbsd.org/pub/OpenBSD/3.6/macppc</a>/<a href="ftp://ftp.openbsd.org/pub/OpenBSD/3.6/macppc/bsd.rd">bsd.rd</a>          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x14000000</font>
359          <br>$ <b>gxemul -E macppc -e g4 -t bsd.rd</b>      </td>
360      </ul>      <td></td>
361    </li>      <td align="left" valign="top">
362            <table border="0">
363              <tr>
364                <td align="left" valign="top"><i><u>Offset:</u></i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
365                <td align="left" valign="top"><i><u>Effect:</u></i></td>
366              </tr>
367              <tr>
368                <td align="left" valign="top"><tt>0x0000-</tt><br><tt>0x3fff</tt></td>
369                <td align="left" valign="top">Read/write buffer for the packet to be sent/received.</td>
370              </tr>
371              <tr>
372                <td align="left" valign="top"><tt>0x4000</tt></td>
373                <td align="left" valign="top">Read: status word, one or more of these:
374                    <br><tt>0x01</tt>&nbsp;=&nbsp;something was received (because of
375                    the last command)
376                    <br><tt>0x02</tt>&nbsp;=&nbsp;more packets are available
377                    <br><i>NOTE:</i> Whenever the status word is non-zero,
378                            an interrupt is asserted. Reading the status word
379                            clears it, and deasserts the interrupt.</td>
380              </tr>
381              <tr>
382                <td align="left" valign="top"><tt>0x4010</tt></td>
383                <td align="left" valign="top">Read: get the Length of the received packet
384                    <br>Write: set the Length of the next packet to transmit</td>
385              </tr>
386              <tr>
387                <td align="left" valign="top"><tt>0x4020</tt></td>
388                <td align="left" valign="top">Write: command:
389                    <br><tt>0x00:</tt>&nbsp;receive a packet
390                    <br><tt>0x01:</tt>&nbsp;send a packet</td>
391              </tr>
392            </table>
393        </td>
394      </tr>
395    
396    <p>    <tr height="15">
397        <td height="15">&nbsp;</td>
398      </tr>
399    
400    <li>BeBox:    <tr>
401      <ul>      <td align="left" valign="top">
402        <li><a href="http://www.netbsd.org/Ports/bebox/">NetBSD/bebox</a>:          <a name="expdevices_rtc"><b><tt>rtc</tt>:</b></a>
403          <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/arch/bebox/snapshot/19981119/">ftp://ftp.netbsd.org/pub/NetBSD/arch/bebox/snapshot/19981119</a>/<a href="ftp://ftp.netbsd.org/pub/NetBSD/arch/bebox/snapshot/19981119/kern.tgz">kern.tgz</a>          <p>A Real-Time Clock, used to retrieve the current time
404          <br>$ <b>tar tvzf kern.tgz</b>          and to cause periodic interrupts.
405          <br>$ <b>gxemul -E bebox netbsd</b>          <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_rtc.c</tt></font>
406        <p>          <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_rtc.h</tt></font>
407        <li><a href="http://www.bebox.nu/os.php?s=os/linux/index">Linux/bebox</a>:          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x15000000</font>
408          <br><a href="http://www.bebox.nu/files/linux/BeBox-scsi-980610.gz">http://www.bebox.nu/files/linux/BeBox-scsi-980610.gz</a>      </td>
409          <br>$ <b>gunzip BeBox-scsi-980610.gz</b>      <td></td>
410          <br>$ <b>gxemul -E bebox 0x3100:0x400:BeBox-scsi-980610</b>      <td align="left" valign="top">
411      </ul>          <table border="0">
412    </li>            <tr>
413                <td align="left" valign="top"><i><u>Offset:</u></i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
414                <td align="left" valign="top"><i><u>Effect:</u></i></td>
415              </tr>
416              <tr>
417                <td align="left" valign="top"><tt>0x0000</tt></td>
418                <td align="left" valign="top">Read or Write: Trigger a clock update (a gettimeofday() on the host).</td>
419              </tr>
420              <tr>
421                <td align="left" valign="top"><tt>0x0010</tt></td>
422                <td align="left" valign="top">Read: Seconds since 1st January 1970</td>
423              </tr>
424              <tr>
425                <td align="left" valign="top"><tt>0x0020</tt></td>
426                <td align="left" valign="top">Read: Microseconds</td>
427              </tr>
428              <tr>
429                <td align="left" valign="top"><tt>0x0100</tt></td>
430                <td align="left" valign="top">Read: Get the current
431                    timer interrupt frequency.<br>Write: Set the timer
432                    interrupt frequency. (Writing 0 disables the timer.)</td>
433              </tr>
434              <tr>
435                <td align="left" valign="top"><tt>0x0110</tt></td>
436                <td align="left" valign="top">Read or Write: Acknowledge
437                    one timer interrupt. (Note that if multiple interrupts
438                    are pending, only one is acknowledged.)</td>
439              </tr>
440            </table>
441        </td>
442      </tr>
443    
444    <p>    <tr height="15">
445        <td height="15">&nbsp;</td>
446      </tr>
447    
448    <li>SPARC64:    <tr>
449      <ul>      <td align="left" valign="top">
450        <li><a href="http://www.netbsd.org/Ports/sparc64/">NetBSD/sparc64</a>:          <a name="expdevices_irqc"><b><tt>irqc</tt>:</b></a>
451          <br><a href="ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sparc64/binary/kernel/netbsd-INSTALL.gz">ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/sparc64/binary/kernel/netbsd-INSTALL.gz</a>          <p>An Interrupt Controller. (Note: Not used for the MIPS test machine.)
452          <br>gunzip, and try the following:          <p>Source code:&nbsp;&nbsp;<font color="#0000f0"><tt>src/devices/dev_irqc.c</tt></font>
453          <br>$ <b>gxemul -E ultra1 -v -i netbsd-INSTALL</b>          <p>Include file:&nbsp;&nbsp;<font color="#0000f0"><tt>dev_irqc.h</tt></font>
454        <p>          <br>Default physical address:&nbsp&nbsp;<font color="#0000f0">0x16000000</font>
455        <li><a href="http://www.openbsd.org/sparc64.html">OpenBSD/sparc64</a>:      </td>
456          <br><a href="ftp://ftp.openbsd.org/pub/OpenBSD/3.6/sparc64/bsd.rd">ftp://ftp.openbsd.org/pub/OpenBSD/3.6/sparc64/bsd.rd</a>      <td></td>
457          <br>rename to bsd.rd.gz, gunzip, and try the following:      <td align="left" valign="top">
458          <br>$ <b>gxemul -E ultra1 -v -i bsd.rd</b>          <table border="0">
459      </ul>            <tr>
460    </li>              <td align="left" valign="top"><i><u>Offset:</u></i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
461  </ul>              <td align="left" valign="top"><i><u>Effect:</u></i></td>
462              </tr>
463              <tr>
464                <td align="left" valign="top"><tt>0x0</tt></td>
465                <td align="left" valign="top">Read: IRQ status as a 32-bit word, one bit per interrupt source.</td>
466              </tr>
467              <tr>
468                <td align="left" valign="top"><tt>0x4</tt></td>
469                <td align="left" valign="top">Write: Mask one interrupt source. Value should be an integer 0..31.</td>
470              </tr>
471              <tr>
472                <td align="left" valign="top"><tt>0x8</tt></td>
473                <td align="left" valign="top">Write: Unmask one interrupt source. Value should be an integer 0..31.</td>
474              </tr>
475            </table>
476        </td>
477      </tr>
478    
479  <p>  </table></center>
 The URISC emulation mode is just for fun. (Read  
 <a href="http://en.wikipedia.org/wiki/URISC">http://en.wikipedia.org/wiki/URISC</a>  
 for more info.)  
480    
481  <p>  <p>The include files for the test machine devices are found in
482  <ul>  <a href="../src/include/testmachine/"><tt>src/include/testmachine/</tt></a>.
483    
484    <li>URISC:  <p>While these devices may resemble real-world hardware, they are
485      <ul>  intentionally made simpler to use. (An exception is the framebuffer;
486        <li>I've placed a small test program in the experiments directory.  some machines actually have simple linear framebuffers like this.)
         <br>Start like this: <b>gxemul -E testurisc 0:urisc_test.bin</b>  
         <br>or, if you want to single-step:  
                 <b>gxemul -V -E testurisc 0:urisc_test.bin</b>  
         <br>2005-03-01: All outputed characters are printed twice. I'll  
         try to make a pseudo-device for outputing to "normal" devices  
         later.  
     </ul>  
   </li>  
487    
488  </ul>  <p>If the physical address is <tt>0x10000000</tt>, then for MIPS that
489    means that it can be accessed at virtual address
490    <tt>0xffffffffb0000000</tt>. (Actually it can be accessed at
491    <tt>0xffffffff90000000</tt> too, but devices should usually be accessed in
492    a non-cached manner.)
493    
494    <p>When using the ARM or PPC test machines, the addresses are
495    <tt>0x10000000</tt>, <tt>0x11000000</tt> etc., so no need to add any
496    virtual displacement.
497    
498    <p>The <tt>mp</tt>, <tt>disk</tt>, and <tt>ether</tt> devices are agnostic
499    when it comes to word-length. For example, when reading offset
500    <tt>0x0000</tt> of the <tt>mp</tt> device, you may use any kind of read
501    (an 8-bit read will work just as well as a 64-bit read, although the value
502    will be truncated to 8 bits in the first case). You can <i>not</i>,
503    however, read one byte from <tt>0x0000</tt> and one from <tt>0x0001</tt>,
504    and combine the result. The read from <tt>0x0001</tt> will be invalid.
505    
506    <p>The <tt>cons</tt> device should be accessed using 8-bit reads
507    and writes. Doing a getchar() (ie reading from offset <tt>0x00</tt>)  
508    returns <tt>0</tt> if no character was available. Whenever a character is
509    available, the <tt>cons</tt> device' interrupt is asserted. When there are
510    no more available characters, the interrupt is deasserted. (Remember that
511    the interrupt has to be unmasked to be able to actually cause an
512    interrupt.)
513    
514    <p>IPIs (inter-processor interrupts) are controlled by the <tt>mp</tt>
515    device. Whenever an IPI is "sent" from a source to one or more target
516    CPUs, the interrupt is asserted on the target CPUs, and the IPI number is
517    added last in the IPI queue for each of the target CPUs. It is then up to
518    those CPUs to individually read from offset <tt>0x00c0</tt>, to figure out
519    what kind of IPI it was.
520    
521    
522    
523    <p>Interrupt mappings are as follows:
524    
525    <p><center>
526    <table border="1">
527            <tr><td align="center">
528                    <b><tt>testmips</tt></b> (as native MIPS interrupts)
529            </td></tr>
530            <tr><td>
531                    <table border="0">
532                    <tr><td align="center">IRQ:</td><td>&nbsp;</td>
533                            <td>Used for:</td></tr>
534                    <tr><td align="center">7</td><td></td>
535                            <td>MIPS count/compare interrupt</td></tr>
536                    <tr><td align="center">6</td><td></td>
537                            <td><tt>mp</tt> (inter-processor interrupts)</td></tr>
538                    <tr><td align="center">4</td><td></td>
539                            <td><tt>rtc</tt></td></tr>
540                    <tr><td align="center">3</td><td></td>
541                            <td><tt>ether</tt></td></tr>
542                    <tr><td align="center">2</td><td></td>
543                            <td><tt>cons</tt></td></tr>
544                    </table>
545            </td></tr>
546    </table>
547    
548    <p><table border="1">
549            <tr><td align="center">
550                    <b><tt>testarm</tt> and others</b> (via the <tt>irqc</tt> device)
551            </td></tr>
552            <tr><td>
553                    <table border="0">
554                    <tr><td align="center">IRQ:</td><td>&nbsp;</td>
555                            <td>Used for:</td></tr>
556                    <tr><td align="center">6</td><td></td>
557                            <td><tt>mp</tt> (inter-processor interrupts)</td></tr>
558                    <tr><td align="center">4</td><td></td>
559                            <td><tt>rtc</tt></td></tr>
560                    <tr><td align="center">3</td><td></td>
561                            <td><tt>ether</tt></td></tr>
562                    <tr><td align="center">2</td><td></td>
563                            <td><tt>cons</tt></td></tr>
564                    </table>
565            </td></tr>
566    </table>
567    </center>
568    
569    
570    
571    <p><br>
572    
573    
574    
Legend:
Removed from v.4  
changed lines
  Added in v.44
  ViewVC Help
Powered by ViewVC 1.1.26