--- trunk/man/gxemul.1	2007/10/08 16:19:37	22
+++ trunk/man/gxemul.1	2007/10/08 16:20:40	30
@@ -1,4 +1,4 @@
-.\" $Id: gxemul.1,v 1.49 2006/02/18 14:02:20 debug Exp $
+.\" $Id: gxemul.1,v 1.69 2006/08/11 17:43:29 debug Exp $
 .\"
 .\" Copyright (C) 2004-2006  Anders Gavare.  All rights reserved.
 .\"
@@ -29,7 +29,7 @@
 .\" This is a minimal man page for GXemul. Process this file with
 .\"     groff -man -Tascii gxemul.1    or    nroff -man gxemul.1
 .\"
-.Dd FEBRUARY 2006
+.Dd AUGUST 2006
 .Dt GXEMUL 1
 .Os
 .Sh NAME
@@ -42,9 +42,10 @@
 .Nm
 .Op general options
 .Ar @configfile
-.Nm
-.Op userland, other, and general options
-.Ar file Op Ar args ...
+.\" TODO: Reenable this once userland emulation works:
+.\" .Nm
+.\" .Op userland, other, and general options
+.\" .Ar file Op Ar args ...
 .Sh DESCRIPTION
 .Nm
 is an experimental instruction-level machine emulator. Several
@@ -53,32 +54,23 @@
 systems (e.g. NetBSD) run inside the emulator as if they were running on a 
 real machine.
 .Pp
-The processor architecture best emulated by GXemul is MIPS, but other
-architectures (ARM and PowerPC) are also partially emulated.
-.Pp
-MIPS processors are emulated using either a simple binary translation
-layer (recompilation into native code), which is used on Alpha and i386
-hosts, or by traditional interpretation (very very slow, but works on any
-host platform).
-.Pp
-Non-MIPS processors are emulated using a newer dynamic translation
-system (called dyntrans in the rest of this man page). Performance is 
-somewhere between traditional interpretation and recompilation into native 
-code. However, the dynamic translation system used in GXemul does NOT 
-generate native code, and thus doesn't require platform-specific 
-back-ends. In plain English, this means that the dyntrans system works on 
-any host platform.
+Processors (ARM, MIPS, PowerPC) are emulated using dynamic translation.
+However, unlike some other dynamically translating emulators, GXemul does
+not currently generate native code, only a "runnable intermediate
+representation", and will thus run on any host architecture, without the
+need to implement per-architecture backends.
 .Pp
-There are three ways to invoke the emulator:
+The emulator can be invoked in the following ways:
 .Pp
 1. When emulating a complete machine, configuration options can be entered
 directly on the command line.
 .Pp
 2. Options can be read from a configuration file.
-.Pp
-3. When emulating a userland environment (syscall-only emulation, not
-emulating complete machines), then the program name and its argument
-should be given on the command line. (This mode doesn't really work yet.)
+.\" .Pp
+.\" 3. When emulating a userland environment (syscall-only emulation, not
+.\" emulating complete machines), then the program name and its argument
+.\" should be given on the command line. (This mode doesn't really work yet,
+.\" and is disabled for stable release builds.)
 .Pp
 The easiest way to use the emulator is to supply settings directly on the 
 command line. The most important thing you need to supply is the
@@ -111,6 +103,12 @@
 option to indicate which file on the CDROM filesystem that should be 
 loaded into emulated memory.
 .Pp
+Gzipped kernels are automatically unzipped, by calling the external gunzip 
+program, both when specifying a gzipped file directly on the command line 
+and when loading such a file using the
+.Fl j
+option.
+.Pp
 Machine selection options:
 .Bl -tag -width Ds
 .It Fl E Ar t
@@ -132,18 +130,6 @@
 .Pp
 Other options:
 .Bl -tag -width Ds
-.It Fl A
-Disable load/store alignment checks in some cases. This might give a small
-increase in performance, but the emulator will not run correctly if the 
-emulated code actually tries to do unaligned loads or stores. (This option 
-is only meaningful when emulating MIPS CPUs, when the host architecture is 
-Alpha or i386, and binary translation is enabled.)
-.It Fl B
-Disable native translation backends. By default, translation backends are
-used if the host+target architecture combination is supported. Currently,
-the only supported host architecture for the old bintrans system (used
-when emulating MIPS processors) are Alpha and i386. The old bintrans
-system will hopefully be removed some day.
 .It Fl C Ar x
 Try to emulate a specific CPU type,
 .Ar "x".
@@ -151,12 +137,12 @@
 (Use
 .Fl H
 to get a list of available CPU types.)
-.It Fl d Ar name
+.It Fl d Ar [modifiers:]filename
 Add
-.Ar name
+.Ar filename
 as a disk image. By adding one or more modifier characters and then a
 colon (":") as a prefix to
-.Ar "name",
+.Ar filename,
 you can modify the way the disk image is treated. Available modifiers are:
 .Bl -tag -width Ds
 .It b
@@ -182,6 +168,19 @@
 Force a specific ID number.
 .El
 .Pp
+For SCSI devices, the ID number is the SCSI ID. For IDE harddisks, the ID 
+number has the following meaning:
+.Bl -tag -width Ds
+.It 0
+Primary master.
+.It 1
+Primary slave.
+.It 2
+Secondary master.
+.It 3
+Secondary slave.
+.El
+.Pp
 Unless otherwise specified, filenames ending with ".iso" or ".cdr" are 
 assumed to be CDROM images. Most others are assumed to be disks. Depending
 on which machine is being emulated, the default for disks can be either 
@@ -193,6 +192,11 @@
 heads and cylinders are assumed to be 2 and 80, respectively, and the 
 number of sectors per track is calculated automatically. (This works for 
 720KB, 1.2MB, 1.44MB, and 2.88MB floppies.)
+.It Fl G Ar port
+Pause at startup, and listen to TCP port
+.Ar port
+for incoming remote GDB connections. The emulator starts up in paused 
+mode, and it is up to the remote GDB instance to start the session.
 .It Fl I Ar x
 Emulate clock interrupts at
 .Ar x
@@ -200,36 +204,37 @@
 This disables automatic clock adjustments, which is otherwise turned on.)
 (This option is probably only valid for DECstation emulation.)
 .It Fl i
-Display each instruction as it is being executed.
+Enable instruction trace, i.e. display disassembly of each instruction as
+it is being executed.
 .It Fl J
-Disable some speed tricks. For MIPS emulation, these are mostly 
-timing-related. For non-MIPS emulation (i.e. modes using dyntrans), 
-this flag disables the use of "instruction combinations".
+Disable instruction combinations in the dynamic translator.
 .It Fl j Ar n
 Set the name of the kernel to
 .Ar "n".
 When booting from an ISO9660 filesystem, the emulator will try to boot 
 using this file. (In some emulation modes, eg. DECstation, this name is passed 
 along to the boot program. Useful names are "bsd" for OpenBSD/pmax, 
-or "vmunix" for Ultrix.)
+"vmunix" for Ultrix, or "vmsprite" for Sprite.)
 .It Fl M Ar m
 Emulate
 .Ar m
 MBs of physical RAM. This overrides the default amount of RAM for the 
 selected machine type.
-.It Fl m Ar nr
-Run at most
-.Ar nr
-instructions (on any cpu).
 .It Fl N
-Display nr of instructions/second average, at regular intervals.
+Display the number of executed instructions per second on average, at
+regular intervals.
 .It Fl n Ar nr
-Set nr of CPUs (for SMP experiments). Note: The emulator allocates quite a 
-lot of virtual memory for per-CPU translation tables. On 64-bit hosts, 
-this is normally not a problem. On 32-bit hosts, this can use up all 
-available virtual userspace memory. The solution is to either run the 
-emulator on a 64-bit host, or limit the number of emulated CPUs to a 
-reasonable number (say, less than 32).
+Set the number of processors in the machine, for SMP experiments.
+.Pp
+Note 1: The emulator allocates quite a lot of virtual memory for
+per-CPU translation tables. On 64-bit hosts, this is normally not a
+problem. On 32-bit hosts, this can use up all available virtual userspace
+memory. The solution is to either run the emulator on a 64-bit host,
+or limit the number of emulated CPUs to a reasonably low number.
+.Pp
+Note 2: SMP simulation is not working very well yet; multiple processors 
+are simulated, but synchronization between the processors does not map
+very well to how real-world SMP systems work.
 .It Fl O
 Force a "netboot" (tftp instead of disk), even when a disk image is
 present (for DECstation, SGI, and ARC emulation).
@@ -239,18 +244,73 @@
 .Ar arg
 for DEC is "-a", for ARC/SGI it is "-aN", and for CATS it is "-A".
 .It Fl p Ar pc
-Add a breakpoint. (Remember to use the "0x" prefix for hex.)
+Add a breakpoint.
+.Ar pc
+can be a symbol, or a numeric value. (Remember to use the "0x" prefix for
+hexadecimal values.)
 .It Fl Q
-Disable the built-in PROM emulation. This is useful for running raw ROM
-images from real machines.
+Disable the built-in (software-only) PROM emulation. This option is useful
+for experimenting with running raw ROM images from real machines. The default 
+behaviour of the emulator is to "fake" certain PROM calls used by guest 
+operating systems (e.g. NetBSD), so that no real PROM image is needed.
 .It Fl R
-Use a random bootstrap cpu, instead of CPU nr 0. (For SMP experiments.)
+Use a random bootstrap cpu, instead of CPU nr 0. (This option is only 
+meaningful together with the
+.Fl n
+option.)
 .It Fl r
 Dump register contents for every executed instruction.
 .It Fl S
-Initialize the emulated RAM to random data, instead of zeroes.
-.It Fl T
-Enter the single-step debugger on unimplemented memory accesses.
+Initialize emulated RAM to random data, instead of zeroes. This option
+is useful when trying to trigger bugs in a program that occur because the
+program assumed that uninitialized memory contains zeros. (Use with
+care.)
+.It Fl s Ar flags:filename
+Gather statistics based on the current emulated program counter value, 
+while the program executes. The statistics is actually just a raw dump of 
+all program counter values in sequence, suitable for post-analysis with 
+separate tools. Output is appended to
+.Ar filename.
+.Pp
+The
+.Ar flags
+should include one or more of the following type specifiers:
+.Bl -tag -width Ds
+.It v
+Virtual. This means that the program counter value is used.
+.It p
+Physical. This means that the physical address of where the program
+is actually running is used.
+.It i
+Instruction call. This type of statistics gathering is practically only 
+useful during development of the emulator itself. The output is a list of
+addresses of instruction call functions (ic->f), which after some
+post-processing can be used as a basis for deciding when to implement
+instruction combinations.
+.El
+.Pp
+The
+.Ar flags
+may also include the following optional modifiers:
+.Bl -tag -width Ds
+.It d
+Disabled at startup.
+.It o
+Overwrite the file, instead of appending to it.
+.El
+.Pp
+.\" Statistics gathering can be enabled/disabled at runtime by using the
+.\" "TODO" debugger command.
+.\" .Pp
+When gathering instruction statistics using the
+.Fl s
+option, instruction combinations are always disabled (i.e.
+an implicit
+.Fl J
+is added to the command line).
+.Pp
+If a value is missing (e.g. the end-of-page slot does not really have a 
+known physical address), it is written out as just a dash ("-").
 .It Fl t
 Show a trace tree of all function calls being made.
 .It Fl U
@@ -284,10 +344,6 @@
 .Ar -2
 with VGA text mode emulation will result in 80x25 character cells rendered 
 in a 1280x800 window, instead of the normal resolution of 640x400.
-.It Fl y Ar x
-Set max_random_cycles_per_chunk to
-.Ar x
-(experimental).
 .It Fl Z Ar n
 Set the number of graphics cards, for emulating a dual-head or tripple-head
 environment. (Only for DECstation emulation so far.)
@@ -297,16 +353,16 @@
 as an X11 display to use for framebuffers.
 .El
 .Pp
-Userland options:
-.Bl -tag -width Ds
-.It Fl u Ar emul-mode
-Userland-only (syscall) emulation. (Use
-.Fl H
-to get a list of available emulation modes.) Some (but not all) of the
-options listed under Other options above can also be used with userland
-emulation.
-.El
-.Pp
+.\" Userland options:
+.\" .Bl -tag -width Ds
+.\" .It Fl u Ar emul-mode
+.\" Userland-only (syscall) emulation. (Use
+.\" .Fl H
+.\" to get a list of available emulation modes.) Some (but not all) of the
+.\" options listed under Other options above can also be used with 
+.\" userland emulation.
+.\" .El
+.\" .Pp
 General options:
 .Bl -tag -width Ds
 .It Fl c Ar cmd
@@ -331,17 +387,19 @@
 emulation modes. (Most of these don't work. Please read the documentation
 included in the
 .Nm
-distribution for details on which modes that actually work.)
+distribution for details on which modes that actually work. Userland
+emulation is not included in stable release builds, since it doesn't work 
+yet.)
 .It Fl h
 Display a list of all available command line options.
 .It Fl K
 Force the single-step debugger to be entered at the end of a simulation.
 .It Fl q
 Quiet mode; this suppresses startup messages.
-.It Fl s
-For MIPS emulation: Show opcode usage statistics after the simulation.
-For non-MIPS emulation (i.e. using dyntrans): Save statistics to a file at 
-regular intervals of which physical addresses that were executed.
+.\".It Fl s
+.\"For MIPS emulation: Show opcode usage statistics after the simulation.
+.\"For non-MIPS emulation (i.e. using dyntrans): Save statistics to a file 
+.\"at regular intervals of which physical addresses that were executed.
 .It Fl V
 Start up in the single-step debugger, paused.
 .It Fl v
@@ -382,26 +440,36 @@
 .Pp
 .Dl "gxemul -E testmips -V hello_mips"
 .Pp
-(Paused mode means that you enter the interactive single-step debugger
-directly at startup, instead of launching the Hello World program.)
+Paused mode means that you enter the interactive single-step debugger
+directly at startup, instead of launching the Hello World program.
+.Pp
+The paused mode is also what should be used when running "unknown" files 
+for the first time in the emulator. E.g. if you have a binary which you 
+think is some kind of MIPS ROM image, then you can try the following:
+.Pp
+.Dl "gxemul -vv -E baremips -V 0xbfc00000:image.raw"
+.Pp
+You can then use the single-stepping functionality of the built-in 
+debugger to run the code in the ROM image, to see how it behaves. Based on 
+that, you can deduce what machine type it was actually from (the 
+baremips machine is not a real machine), and perhaps try again with 
+another emulation mode.
+.Pp
+In general, however, real ROM images require much more emulation detail 
+than GXemul provides, so they can usually not run.
 .Pp
 Please read the documentation for more details.
 .Sh BUGS
-There are many bugs. Some of the known bugs are listed in the BUGS
+There are many bugs. Some of the known bugs are mentioned in the TODO 
 file in the
 .Nm
-source distribution, some are indirectly mentioned in the TODO file,
-and some are mentioned in the source code itself.
-.Pp
-The binary translation subsystem used for emulating MIPS processors is
-really terrible, but it is less terrible than running without it. It will
-be removed once the newer MIPS dyntrans emulation mode works well enough.
+source distribution, some are marked as TODO in the source code itself.
 .Pp
 Userland (syscall-only) emulation doesn't really work yet.
 .Pp
-Emulation of MIPS CPUs is done differently from other emulation modes; the 
-documentation sometimes only reflects the way things work with MIPS 
-emulation, and it is incorrect when applied to e.g. ARM emulation.
+The documentation sometimes only reflects the way things worked with 
+the old MIPS emulation mode (prior to 0.4.0), and it is incorrect when
+applied to current releases.
 .Pp
 .Nm
 is in general not cycle-accurate; it does not simulate individual