0.4.0/man/gxemul.1

.\" $Id: gxemul.1,v 1.65 2006/06/22 13:22:40 debug Exp $
.\"
.\" Copyright (C) 2004-2006  Anders Gavare.  All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions are met:
.\"
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. The name of the author may not be used to endorse or promote products
.\"    derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\" 
.\" 
.\" This is a minimal man page for GXemul. Process this file with
.\"     groff -man -Tascii gxemul.1    or    nroff -man gxemul.1
.\"
.Dd JUNE 2006
.Dt GXEMUL 1
.Os
.Sh NAME
.Nm gxemul
.Nd an experimental machine emulator
.Sh SYNOPSIS
.Nm
.Op machine, other, and general options
.Op file Ar ...
.Nm
.Op general options
.Ar @configfile
.\" TODO: Reenable this once userland emulation works:
.\" .Nm
.\" .Op userland, other, and general options
.\" .Ar file Op Ar args ...
.Sh DESCRIPTION
.Nm
is an experimental instruction-level machine emulator. Several
emulation modes are available. In some modes, processors and surrounding
hardware components are emulated well enough to let unmodified operating
systems (e.g. NetBSD) run inside the emulator as if they were running on a 
real machine.
.Pp
Processors (ARM, MIPS, PowerPC) are emulated using a kind of dynamic
translation system. Performance is somewhere between traditional
interpretation and recompilation into native code. However, the dynamic
translation system used in GXemul does not (currently) generate native
code, and thus does not require platform-specific back-ends. In plain
English, this means that the dyntrans system works on any host architecture.
.Pp
The emulator can be invoked in the following ways:
.Pp
1. When emulating a complete machine, configuration options can be entered
directly on the command line.
.Pp
2. Options can be read from a configuration file.
.\" .Pp
.\" 3. When emulating a userland environment (syscall-only emulation, not
.\" emulating complete machines), then the program name and its argument
.\" should be given on the command line. (This mode doesn't really work yet,
.\" and is disabled for stable release builds.)
.Pp
The easiest way to use the emulator is to supply settings directly on the 
command line. The most important thing you need to supply is the
file argument. This is the name of a binary file (an ELF, a.out, COFF/ECOFF,
SREC, or a raw binary image) which you wish to run in the emulator. This file
might be an operating system kernel, or perhaps a ROM image file.
.Pp
If more than one filename is supplied, all files are loaded into memory, 
and the entry point (if available) is taken from the last file.
.Pp
Apart from the name of a binary file, it is also necessary to select
which specific emulation mode to use. For example, a MIPS-based machine
from DEC (a DECstation) is very different from a MIPS-based machine
from SGI. Use
.Nm
.Fl H
to get a list of available emulation modes.
.Pp
There are two exceptions to the normal invocation usage mentioned above.
The first is for DECstation emulation: if you have a bootable
DECstation harddisk or CDROM image, then just supplying the diskimage via 
the
.Fl d
option is sufficient. (The filename of the kernel can then be 
skipped, as the emulator runs the bootblocks from the diskimage directly and 
doesn't need the kernel as a separate file.)
The second is if you supply an ISO9660 CDROM disk image. You may then use 
the
.Fl j
option to indicate which file on the CDROM filesystem that should be 
loaded into emulated memory.
.Pp
Machine selection options:
.Bl -tag -width Ds
.It Fl E Ar t
Try to emulate machine type
.Ar "t".
This option is not always needed, if the
.Fl e
option uniquely selects a machine.
(Use
.Fl H
to get a list of types.)
.It Fl e Ar st
Try to emulate machine subtype
.Ar "st".
Use this together with
.Fl E .
(This option is not always needed, if a machine type has no subtypes.)
.El
.Pp
Other options:
.Bl -tag -width Ds
.\" The -A command line option is DEPRECATED and will be removed soon.
.\" .It Fl A
.\" Disable load/store alignment checks in some cases. This might give a small
.\" increase in performance, but the emulator will not run correctly if the 
.\" emulated code actually tries to do unaligned loads or stores. (This option 
.\" is only meaningful when emulating MIPS CPUs, when the host architecture is 
.\" Alpha or i386, and binary translation is enabled.)
.\" .It Fl B
.\" Disable native translation backends. By default, translation backends are
.\" used if the host+target architecture combination is supported. Currently,
.\" the only supported host architecture for the old bintrans system (used
.\" when emulating MIPS processors) are Alpha and i386. The old bintrans
.\" system will hopefully be removed some day.
.It Fl C Ar x
Try to emulate a specific CPU type,
.Ar "x".
This overrides the default CPU type for the machine being emulated.
(Use
.Fl H
to get a list of available CPU types.)
.It Fl d Ar [modifiers:]filename
Add
.Ar filename
as a disk image. By adding one or more modifier characters and then a
colon (":") as a prefix to
.Ar filename,
you can modify the way the disk image is treated. Available modifiers are:
.Bl -tag -width Ds
.It b
Specifies that this is a boot device.
.It c
CD-ROM.
.It d
DISK (this is the default).
.It f
FLOPPY.
.It gH;S;
Override the default geometry; use H heads and S sectors-per-track.
(The number of cylinders is calculated automatically.)
.It i
IDE. (This is the default for most machine types.)
.It r
Read-only (don't allow changes to be written to the file).
.It s
SCSI.
.It t
Tape.
.It 0-7
Force a specific ID number.
.El
.Pp
For SCSI devices, the ID number is the SCSI ID. For IDE harddisks, the ID 
number has the following meaning:
.Bl -tag -width Ds
.It 0
Primary master.
.It 1
Primary slave.
.It 2
Secondary master.
.It 3
Secondary slave.
.El
.Pp
Unless otherwise specified, filenames ending with ".iso" or ".cdr" are 
assumed to be CDROM images. Most others are assumed to be disks. Depending
on which machine is being emulated, the default for disks can be either 
SCSI or IDE. Some disk images that are very small are assumed to be floppy 
disks. (If you are not happy with the way a disk image is detected, then 
you need to use explicit prefixes to force a specific type.)
.Pp
For floppies, the gH;S; prefix is ignored. Instead, the number of 
heads and cylinders are assumed to be 2 and 80, respectively, and the 
number of sectors per track is calculated automatically. (This works for 
720KB, 1.2MB, 1.44MB, and 2.88MB floppies.)
.It Fl G Ar port
Pause at startup, and listen to TCP port
.Ar port
for incoming remote GDB connections. The emulator starts up in paused 
mode, and it is up to the remote GDB instance to start the session.
.It Fl I Ar x
Emulate clock interrupts at
.Ar x
Hz. (This affects emulated clock devices only, not actual runtime speed.
This disables automatic clock adjustments, which is otherwise turned on.)
(This option is probably only valid for DECstation emulation.)
.It Fl i
Display each instruction as it is being executed.
.It Fl J
Disable some speed tricks. This usually means disabling the use of
dyntrans "instruction combinations".
.It Fl j Ar n
Set the name of the kernel to
.Ar "n".
When booting from an ISO9660 filesystem, the emulator will try to boot 
using this file. (In some emulation modes, eg. DECstation, this name is passed 
along to the boot program. Useful names are "bsd" for OpenBSD/pmax, 
"vmunix" for Ultrix, or "vmsprite" for Sprite.)
.It Fl M Ar m
Emulate
.Ar m
MBs of physical RAM. This overrides the default amount of RAM for the 
selected machine type.
.It Fl N
Display the number of executed instructions per second on average, at
regular intervals.
.It Fl n Ar nr
Set the number of processors in the machine, for SMP experiments.
.Pp
Note: The emulator allocates quite a 
lot of virtual memory for per-CPU translation tables. On 64-bit hosts, 
this is normally not a problem. On 32-bit hosts, this can use up all 
available virtual userspace memory. The solution is to either run the 
emulator on a 64-bit host, or limit the number of emulated CPUs to a 
reasonable number (say, less than 32).
.Pp
Note 2: SMP simulation is not working very well yet; multiple processors 
are simulated, but synchronization between the processors does not map
very well to how real-world SMP systems work.
.It Fl O
Force a "netboot" (tftp instead of disk), even when a disk image is
present (for DECstation, SGI, and ARC emulation).
.It Fl o Ar arg
Set the boot argument (mostly useful for DEC, ARC, or SGI emulation).
Default
.Ar arg
for DEC is "-a", for ARC/SGI it is "-aN", and for CATS it is "-A".
.It Fl p Ar pc
Add a breakpoint.
.Ar pc
can be a symbol, or a numeric value. (Remember to use the "0x" prefix for
hexadecimal values.)
.It Fl Q
Disable the built-in PROM emulation. This is useful for 
experimenting with running raw ROM images from real machines.
.It Fl R
Use a random bootstrap cpu, instead of CPU nr 0. (For SMP experiments.)
.It Fl r
Dump register contents for every executed instruction.
.It Fl S
Initialize emulated RAM to random data, instead of zeroes. This option
is useful when trying to trigger bugs in a program that occur because the
program assumed that uninitialized memory contains zeros. (Use with
care.)
.It Fl t
Show a trace tree of all function calls being made.
.It Fl U
Enable slow_serial_interrupts_hack_for_linux.
.It Fl X
Use X11. This option enables graphical framebuffers.
.It Fl x
Open up new xterms for emulated serial ports. The default behaviour is to 
open up xterms when using configuration files, or if X11 is enabled. When 
starting up a simple emulation session with settings directly on the 
command line, and neither
.Fl X
nor
.Fl x
is used, then all output is confined to the terminal that
.Nm
started in.
.It Fl Y Ar n
Scale down framebuffer windows by
.Ar n
x
.Ar n
times. This option is useful when emulating a very large framebuffer, and 
the actual display is of lower resolution. If
.Ar n
is negative, then there will be no scaledown, but emulation of certain 
graphic controllers will be scaled up
by
.Ar -n
times instead. E.g. Using
.Ar -2
with VGA text mode emulation will result in 80x25 character cells rendered 
in a 1280x800 window, instead of the normal resolution of 640x400.
.It Fl Z Ar n
Set the number of graphics cards, for emulating a dual-head or tripple-head
environment. (Only for DECstation emulation so far.)
.It Fl z Ar disp
Add
.Ar disp
as an X11 display to use for framebuffers.
.El
.Pp
.\" Userland options:
.\" .Bl -tag -width Ds
.\" .It Fl u Ar emul-mode
.\" Userland-only (syscall) emulation. (Use
.\" .Fl H
.\" to get a list of available emulation modes.) Some (but not all) of the
.\" options listed under Other options above can also be used with 
.\" userland emulation.
.\" .El
.\" .Pp
General options:
.Bl -tag -width Ds
.It Fl c Ar cmd
Add
.Ar cmd
as a command to run before starting the simulation. A similar effect can 
be achieved by using the
.Fl V
option, and entering the commands manually.
.It Fl D
Guarantee fully deterministic behavior. Normally, the emulator calls
srandom() with a seed based on the current time at startup. When the
.Fl D
option is used, the srandom() call is skipped, which should cause two 
subsequent invocations of the emulator to be identical, if all other 
settings are identical and no user input is taking place. (If this option 
is used, then
.Fl I
must also be used.)
.It Fl H
Display a list of available CPU types, machine types, and userland
emulation modes. (Most of these don't work. Please read the documentation
included in the
.Nm
distribution for details on which modes that actually work. Userland
emulation is not included in stable release builds, since it doesn't work 
yet.)
.It Fl h
Display a list of all available command line options.
.It Fl K
Force the single-step debugger to be entered at the end of a simulation.
.It Fl q
Quiet mode; this suppresses startup messages.
.\".It Fl s
.\"For MIPS emulation: Show opcode usage statistics after the simulation.
.\"For non-MIPS emulation (i.e. using dyntrans): Save statistics to a file 
.\"at regular intervals of which physical addresses that were executed.
.It Fl V
Start up in the single-step debugger, paused.
.It Fl v
Increase verbosity (show more debug messages). This option can be used
multiple times.
.El
.Pp
Configuration file startup:
.Bl -tag -width Ds
.It @ Ar configfile
Start an emulation based on the contents of
.Ar "configfile".
.El
.Pp
For more information, please read the documentation in the doc/
subdirectory of the
.Nm
distribution.
.Sh EXAMPLES
The following command will start NetBSD/pmax on an emulated DECstation 
5000/200 (3MAX):
.Pp
.Dl "gxemul -e 3max -d nbsd_pmax.img"
.Pp
nbsd_pmax.img should be a raw disk image containing a bootable 
NetBSD/pmax filesystem.
.Pp
The following command will start an emulation session based on settings in 
the configuration file "mysession". The -v option tells gxemul to be
verbose.
.Pp
.Dl "gxemul -v @mysession"
.Pp
If you have compiled the small Hello World program mentioned in the
.Nm
documentation, the following command will start up an
emulated test machine in "paused" mode:
.Pp
.Dl "gxemul -E testmips -V hello_mips"
.Pp
Paused mode means that you enter the interactive single-step debugger
directly at startup, instead of launching the Hello World program.
.Pp
The paused mode is also what should be used when running "unknown" files 
for the first time in the emulator. E.g. if you have a binary which you 
think is some kind of MIPS ROM image, then you can try the following:
.Pp
.Dl "gxemul -vv -E baremips -V 0xbfc00000:image.raw"
.Pp
You can then use the single-stepping functionality of the built-in 
debugger to run the code in the ROM image, to see how it behaves. Based on 
that, you can deduce what machine type it was actually from (the 
baremips machine is not a real machine), and perhaps try again with 
another emulation mode.
.Pp
In general, however, real ROM images require much more emulation detail 
than GXemul provides, so they can usually not run.
.Pp
Please read the documentation for more details.
.Sh BUGS
There are many bugs. Some of the known bugs are mentioned in the TODO 
file in the
.Nm
source distribution, some are marked as TODO in the source code itself.
.Pp
Userland (syscall-only) emulation doesn't really work yet.
.Pp
The documentation sometimes only reflects the way things worked with 
the old MIPS emulation mode (prior to 0.4.0), and it is incorrect when
applied to current releases.
.Pp
.Nm
is in general not cycle-accurate; it does not simulate individual
pipe-line stages or penalties caused by branch-prediction misses or
cache misses, so it cannot be used for accurate simulation of any actual
real-world processor.
.Pp
.Nm
is not timing-accurate, i.e. clocks inside the emulator are in general
not at all synched with clocks in the real world. There are a few
exceptions to this rule (the mc146818 device tries to automagically
adjust emulated timer ticks to actual emulation speed).
.Sh AUTHOR
GXemul is Copyright (C) 2003-2006 Anders Gavare <anders@gavare.se>
.Pp
See http://gavare.se/gxemul/ for more information. For other Copyright
messages, see the corresponding parts of the source code and/or
documentation.
1	dpavlin	24	.\" $Id: gxemul.1,v 1.65 2006/06/22 13:22:40 debug Exp $
2	dpavlin	2	.\"
3	dpavlin	22	.\" Copyright (C) 2004-2006 Anders Gavare. All rights reserved.
4	dpavlin	2	.\"
5			.\" Redistribution and use in source and binary forms, with or without
6			.\" modification, are permitted provided that the following conditions are met:
7			.\"
8			.\" 1. Redistributions of source code must retain the above copyright
9			.\" notice, this list of conditions and the following disclaimer.
10			.\" 2. Redistributions in binary form must reproduce the above copyright
11			.\" notice, this list of conditions and the following disclaimer in the
12			.\" documentation and/or other materials provided with the distribution.
13			.\" 3. The name of the author may not be used to endorse or promote products
14			.\" derived from this software without specific prior written permission.
15			.\"
16			.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17			.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18			.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19			.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20			.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21			.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22			.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23			.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24			.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25			.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26			.\" SUCH DAMAGE.
27			.\"
28			.\"
29			.\" This is a minimal man page for GXemul. Process this file with
30			.\" groff -man -Tascii gxemul.1 or nroff -man gxemul.1
31			.\"
32	dpavlin	24	.Dd JUNE 2006
33	dpavlin	2	.Dt GXEMUL 1
34			.Os
35			.Sh NAME
36			.Nm gxemul
37			.Nd an experimental machine emulator
38			.Sh SYNOPSIS
39			.Nm
40			.Op machine, other, and general options
41			.Op file Ar ...
42			.Nm
43			.Op general options
44	dpavlin	14	.Ar @configfile
45	dpavlin	24	.\" TODO: Reenable this once userland emulation works:
46			.\" .Nm
47			.\" .Op userland, other, and general options
48			.\" .Ar file Op Ar args ...
49	dpavlin	2	.Sh DESCRIPTION
50			.Nm
51	dpavlin	14	is an experimental instruction-level machine emulator. Several
52			emulation modes are available. In some modes, processors and surrounding
53			hardware components are emulated well enough to let unmodified operating
54	dpavlin	20	systems (e.g. NetBSD) run inside the emulator as if they were running on a
55			real machine.
56	dpavlin	2	.Pp
57	dpavlin	24	Processors (ARM, MIPS, PowerPC) are emulated using a kind of dynamic
58			translation system. Performance is somewhere between traditional
59			interpretation and recompilation into native code. However, the dynamic
60			translation system used in GXemul does not (currently) generate native
61			code, and thus does not require platform-specific back-ends. In plain
62			English, this means that the dyntrans system works on any host architecture.
63	dpavlin	12	.Pp
64	dpavlin	24	The emulator can be invoked in the following ways:
65	dpavlin	18	.Pp
66	dpavlin	14	1. When emulating a complete machine, configuration options can be entered
67			directly on the command line.
68			.Pp
69			2. Options can be read from a configuration file.
70	dpavlin	24	.\" .Pp
71			.\" 3. When emulating a userland environment (syscall-only emulation, not
72			.\" emulating complete machines), then the program name and its argument
73			.\" should be given on the command line. (This mode doesn't really work yet,
74			.\" and is disabled for stable release builds.)
75	dpavlin	14	.Pp
76	dpavlin	2	The easiest way to use the emulator is to supply settings directly on the
77			command line. The most important thing you need to supply is the
78	dpavlin	14	file argument. This is the name of a binary file (an ELF, a.out, COFF/ECOFF,
79	dpavlin	2	SREC, or a raw binary image) which you wish to run in the emulator. This file
80			might be an operating system kernel, or perhaps a ROM image file.
81			.Pp
82			If more than one filename is supplied, all files are loaded into memory,
83			and the entry point (if available) is taken from the last file.
84			.Pp
85			Apart from the name of a binary file, it is also necessary to select
86			which specific emulation mode to use. For example, a MIPS-based machine
87			from DEC (a DECstation) is very different from a MIPS-based machine
88			from SGI. Use
89			.Nm
90			.Fl H
91			to get a list of available emulation modes.
92			.Pp
93	dpavlin	6	There are two exceptions to the normal invocation usage mentioned above.
94			The first is for DECstation emulation: if you have a bootable
95	dpavlin	2	DECstation harddisk or CDROM image, then just supplying the diskimage via
96			the
97			.Fl d
98	dpavlin	6	option is sufficient. (The filename of the kernel can then be
99	dpavlin	2	skipped, as the emulator runs the bootblocks from the diskimage directly and
100			doesn't need the kernel as a separate file.)
101	dpavlin	6	The second is if you supply an ISO9660 CDROM disk image. You may then use
102			the
103			.Fl j
104			option to indicate which file on the CDROM filesystem that should be
105			loaded into emulated memory.
106	dpavlin	2	.Pp
107			Machine selection options:
108			.Bl -tag -width Ds
109			.It Fl E Ar t
110			Try to emulate machine type
111			.Ar "t".
112	dpavlin	12	This option is not always needed, if the
113			.Fl e
114			option uniquely selects a machine.
115	dpavlin	2	(Use
116			.Fl H
117			to get a list of types.)
118			.It Fl e Ar st
119			Try to emulate machine subtype
120			.Ar "st".
121			Use this together with
122			.Fl E .
123			(This option is not always needed, if a machine type has no subtypes.)
124			.El
125			.Pp
126			Other options:
127			.Bl -tag -width Ds
128	dpavlin	24	.\" The -A command line option is DEPRECATED and will be removed soon.
129			.\" .It Fl A
130			.\" Disable load/store alignment checks in some cases. This might give a small
131			.\" increase in performance, but the emulator will not run correctly if the
132			.\" emulated code actually tries to do unaligned loads or stores. (This option
133			.\" is only meaningful when emulating MIPS CPUs, when the host architecture is
134			.\" Alpha or i386, and binary translation is enabled.)
135			.\" .It Fl B
136			.\" Disable native translation backends. By default, translation backends are
137			.\" used if the host+target architecture combination is supported. Currently,
138			.\" the only supported host architecture for the old bintrans system (used
139			.\" when emulating MIPS processors) are Alpha and i386. The old bintrans
140			.\" system will hopefully be removed some day.
141	dpavlin	2	.It Fl C Ar x
142			Try to emulate a specific CPU type,
143			.Ar "x".
144			This overrides the default CPU type for the machine being emulated.
145			(Use
146			.Fl H
147			to get a list of available CPU types.)
148	dpavlin	24	.It Fl d Ar [modifiers:]filename
149	dpavlin	2	Add
150	dpavlin	24	.Ar filename
151	dpavlin	2	as a disk image. By adding one or more modifier characters and then a
152			colon (":") as a prefix to
153	dpavlin	24	.Ar filename,
154	dpavlin	6	you can modify the way the disk image is treated. Available modifiers are:
155	dpavlin	2	.Bl -tag -width Ds
156			.It b
157			Specifies that this is a boot device.
158			.It c
159	dpavlin	4	CD-ROM.
160	dpavlin	2	.It d
161	dpavlin	4	DISK (this is the default).
162			.It f
163			FLOPPY.
164	dpavlin	6	.It gH;S;
165			Override the default geometry; use H heads and S sectors-per-track.
166			(The number of cylinders is calculated automatically.)
167	dpavlin	2	.It i
168	dpavlin	22	IDE. (This is the default for most machine types.)
169	dpavlin	2	.It r
170			Read-only (don't allow changes to be written to the file).
171	dpavlin	4	.It s
172	dpavlin	22	SCSI.
173	dpavlin	2	.It t
174	dpavlin	4	Tape.
175	dpavlin	2	.It 0-7
176	dpavlin	6	Force a specific ID number.
177	dpavlin	2	.El
178			.Pp
179	dpavlin	24	For SCSI devices, the ID number is the SCSI ID. For IDE harddisks, the ID
180			number has the following meaning:
181			.Bl -tag -width Ds
182			.It 0
183			Primary master.
184			.It 1
185			Primary slave.
186			.It 2
187			Secondary master.
188			.It 3
189			Secondary slave.
190			.El
191			.Pp
192	dpavlin	14	Unless otherwise specified, filenames ending with ".iso" or ".cdr" are
193			assumed to be CDROM images. Most others are assumed to be disks. Depending
194			on which machine is being emulated, the default for disks can be either
195			SCSI or IDE. Some disk images that are very small are assumed to be floppy
196			disks. (If you are not happy with the way a disk image is detected, then
197			you need to use explicit prefixes to force a specific type.)
198	dpavlin	6	.Pp
199			For floppies, the gH;S; prefix is ignored. Instead, the number of
200			heads and cylinders are assumed to be 2 and 80, respectively, and the
201			number of sectors per track is calculated automatically. (This works for
202			720KB, 1.2MB, 1.44MB, and 2.88MB floppies.)
203	dpavlin	24	.It Fl G Ar port
204			Pause at startup, and listen to TCP port
205			.Ar port
206			for incoming remote GDB connections. The emulator starts up in paused
207			mode, and it is up to the remote GDB instance to start the session.
208	dpavlin	2	.It Fl I Ar x
209			Emulate clock interrupts at
210			.Ar x
211			Hz. (This affects emulated clock devices only, not actual runtime speed.
212			This disables automatic clock adjustments, which is otherwise turned on.)
213			(This option is probably only valid for DECstation emulation.)
214			.It Fl i
215			Display each instruction as it is being executed.
216			.It Fl J
217	dpavlin	24	Disable some speed tricks. This usually means disabling the use of
218			dyntrans "instruction combinations".
219	dpavlin	2	.It Fl j Ar n
220			Set the name of the kernel to
221			.Ar "n".
222	dpavlin	10	When booting from an ISO9660 filesystem, the emulator will try to boot
223			using this file. (In some emulation modes, eg. DECstation, this name is passed
224	dpavlin	6	along to the boot program. Useful names are "bsd" for OpenBSD/pmax,
225	dpavlin	24	"vmunix" for Ultrix, or "vmsprite" for Sprite.)
226	dpavlin	2	.It Fl M Ar m
227			Emulate
228			.Ar m
229			MBs of physical RAM. This overrides the default amount of RAM for the
230			selected machine type.
231			.It Fl N
232	dpavlin	24	Display the number of executed instructions per second on average, at
233			regular intervals.
234	dpavlin	2	.It Fl n Ar nr
235	dpavlin	24	Set the number of processors in the machine, for SMP experiments.
236			.Pp
237			Note: The emulator allocates quite a
238	dpavlin	22	lot of virtual memory for per-CPU translation tables. On 64-bit hosts,
239			this is normally not a problem. On 32-bit hosts, this can use up all
240			available virtual userspace memory. The solution is to either run the
241			emulator on a 64-bit host, or limit the number of emulated CPUs to a
242			reasonable number (say, less than 32).
243	dpavlin	24	.Pp
244			Note 2: SMP simulation is not working very well yet; multiple processors
245			are simulated, but synchronization between the processors does not map
246			very well to how real-world SMP systems work.
247	dpavlin	2	.It Fl O
248			Force a "netboot" (tftp instead of disk), even when a disk image is
249			present (for DECstation, SGI, and ARC emulation).
250			.It Fl o Ar arg
251	dpavlin	16	Set the boot argument (mostly useful for DEC, ARC, or SGI emulation).
252	dpavlin	2	Default
253			.Ar arg
254	dpavlin	16	for DEC is "-a", for ARC/SGI it is "-aN", and for CATS it is "-A".
255	dpavlin	2	.It Fl p Ar pc
256	dpavlin	24	Add a breakpoint.
257			.Ar pc
258			can be a symbol, or a numeric value. (Remember to use the "0x" prefix for
259			hexadecimal values.)
260	dpavlin	2	.It Fl Q
261	dpavlin	24	Disable the built-in PROM emulation. This is useful for
262			experimenting with running raw ROM images from real machines.
263	dpavlin	2	.It Fl R
264			Use a random bootstrap cpu, instead of CPU nr 0. (For SMP experiments.)
265			.It Fl r
266			Dump register contents for every executed instruction.
267			.It Fl S
268	dpavlin	24	Initialize emulated RAM to random data, instead of zeroes. This option
269			is useful when trying to trigger bugs in a program that occur because the
270			program assumed that uninitialized memory contains zeros. (Use with
271			care.)
272	dpavlin	2	.It Fl t
273			Show a trace tree of all function calls being made.
274			.It Fl U
275			Enable slow_serial_interrupts_hack_for_linux.
276			.It Fl X
277	dpavlin	22	Use X11. This option enables graphical framebuffers.
278	dpavlin	2	.It Fl x
279	dpavlin	22	Open up new xterms for emulated serial ports. The default behaviour is to
280			open up xterms when using configuration files, or if X11 is enabled. When
281			starting up a simple emulation session with settings directly on the
282			command line, and neither
283			.Fl X
284			nor
285			.Fl x
286			is used, then all output is confined to the terminal that
287			.Nm
288			started in.
289	dpavlin	2	.It Fl Y Ar n
290			Scale down framebuffer windows by
291			.Ar n
292			x
293			.Ar n
294	dpavlin	20	times. This option is useful when emulating a very large framebuffer, and
295			the actual display is of lower resolution. If
296			.Ar n
297			is negative, then there will be no scaledown, but emulation of certain
298			graphic controllers will be scaled up
299			by
300			.Ar -n
301			times instead. E.g. Using
302			.Ar -2
303			with VGA text mode emulation will result in 80x25 character cells rendered
304			in a 1280x800 window, instead of the normal resolution of 640x400.
305	dpavlin	2	.It Fl Z Ar n
306			Set the number of graphics cards, for emulating a dual-head or tripple-head
307			environment. (Only for DECstation emulation so far.)
308			.It Fl z Ar disp
309			Add
310			.Ar disp
311			as an X11 display to use for framebuffers.
312			.El
313			.Pp
314	dpavlin	24	.\" Userland options:
315			.\" .Bl -tag -width Ds
316			.\" .It Fl u Ar emul-mode
317			.\" Userland-only (syscall) emulation. (Use
318			.\" .Fl H
319			.\" to get a list of available emulation modes.) Some (but not all) of the
320			.\" options listed under Other options above can also be used with
321			.\" userland emulation.
322			.\" .El
323			.\" .Pp
324	dpavlin	2	General options:
325			.Bl -tag -width Ds
326	dpavlin	22	.It Fl c Ar cmd
327			Add
328			.Ar cmd
329			as a command to run before starting the simulation. A similar effect can
330			be achieved by using the
331			.Fl V
332			option, and entering the commands manually.
333	dpavlin	2	.It Fl D
334	dpavlin	6	Guarantee fully deterministic behavior. Normally, the emulator calls
335	dpavlin	2	srandom() with a seed based on the current time at startup. When the
336			.Fl D
337			option is used, the srandom() call is skipped, which should cause two
338	dpavlin	6	subsequent invocations of the emulator to be identical, if all other
339			settings are identical and no user input is taking place. (If this option
340			is used, then
341	dpavlin	2	.Fl I
342			must also be used.)
343			.It Fl H
344			Display a list of available CPU types, machine types, and userland
345			emulation modes. (Most of these don't work. Please read the documentation
346			included in the
347			.Nm
348	dpavlin	24	distribution for details on which modes that actually work. Userland
349			emulation is not included in stable release builds, since it doesn't work
350			yet.)
351	dpavlin	2	.It Fl h
352			Display a list of all available command line options.
353			.It Fl K
354			Force the single-step debugger to be entered at the end of a simulation.
355			.It Fl q
356			Quiet mode; this suppresses startup messages.
357	dpavlin	24	.\".It Fl s
358			.\"For MIPS emulation: Show opcode usage statistics after the simulation.
359			.\"For non-MIPS emulation (i.e. using dyntrans): Save statistics to a file
360			.\"at regular intervals of which physical addresses that were executed.
361	dpavlin	2	.It Fl V
362			Start up in the single-step debugger, paused.
363			.It Fl v
364	dpavlin	22	Increase verbosity (show more debug messages). This option can be used
365			multiple times.
366	dpavlin	2	.El
367			.Pp
368			Configuration file startup:
369			.Bl -tag -width Ds
370			.It @ Ar configfile
371			Start an emulation based on the contents of
372			.Ar "configfile".
373			.El
374			.Pp
375			For more information, please read the documentation in the doc/
376			subdirectory of the
377			.Nm
378			distribution.
379			.Sh EXAMPLES
380			The following command will start NetBSD/pmax on an emulated DECstation
381	dpavlin	10	5000/200 (3MAX):
382	dpavlin	2	.Pp
383	dpavlin	12	.Dl "gxemul -e 3max -d nbsd_pmax.img"
384	dpavlin	2	.Pp
385	dpavlin	10	nbsd_pmax.img should be a raw disk image containing a bootable
386	dpavlin	2	NetBSD/pmax filesystem.
387			.Pp
388			The following command will start an emulation session based on settings in
389			the configuration file "mysession". The -v option tells gxemul to be
390			verbose.
391			.Pp
392			.Dl "gxemul -v @mysession"
393			.Pp
394			If you have compiled the small Hello World program mentioned in the
395			.Nm
396			documentation, the following command will start up an
397			emulated test machine in "paused" mode:
398			.Pp
399			.Dl "gxemul -E testmips -V hello_mips"
400			.Pp
401	dpavlin	24	Paused mode means that you enter the interactive single-step debugger
402			directly at startup, instead of launching the Hello World program.
403	dpavlin	2	.Pp
404	dpavlin	24	The paused mode is also what should be used when running "unknown" files
405			for the first time in the emulator. E.g. if you have a binary which you
406			think is some kind of MIPS ROM image, then you can try the following:
407			.Pp
408			.Dl "gxemul -vv -E baremips -V 0xbfc00000:image.raw"
409			.Pp
410			You can then use the single-stepping functionality of the built-in
411			debugger to run the code in the ROM image, to see how it behaves. Based on
412			that, you can deduce what machine type it was actually from (the
413			baremips machine is not a real machine), and perhaps try again with
414			another emulation mode.
415			.Pp
416			In general, however, real ROM images require much more emulation detail
417			than GXemul provides, so they can usually not run.
418			.Pp
419	dpavlin	2	Please read the documentation for more details.
420			.Sh BUGS
421	dpavlin	24	There are many bugs. Some of the known bugs are mentioned in the TODO
422	dpavlin	2	file in the
423			.Nm
424	dpavlin	24	source distribution, some are marked as TODO in the source code itself.
425	dpavlin	2	.Pp
426	dpavlin	12	Userland (syscall-only) emulation doesn't really work yet.
427			.Pp
428	dpavlin	24	The documentation sometimes only reflects the way things worked with
429			the old MIPS emulation mode (prior to 0.4.0), and it is incorrect when
430			applied to current releases.
431	dpavlin	16	.Pp
432	dpavlin	2	.Nm
433	dpavlin	22	is in general not cycle-accurate; it does not simulate individual
434			pipe-line stages or penalties caused by branch-prediction misses or
435			cache misses, so it cannot be used for accurate simulation of any actual
436			real-world processor.
437	dpavlin	6	.Pp
438			.Nm
439	dpavlin	22	is not timing-accurate, i.e. clocks inside the emulator are in general
440			not at all synched with clocks in the real world. There are a few
441			exceptions to this rule (the mc146818 device tries to automagically
442			adjust emulated timer ticks to actual emulation speed).
443	dpavlin	2	.Sh AUTHOR
444	dpavlin	22	GXemul is Copyright (C) 2003-2006 Anders Gavare <anders@gavare.se>
445	dpavlin	2	.Pp
446	dpavlin	22	See http://gavare.se/gxemul/ for more information. For other Copyright
447			messages, see the corresponding parts of the source code and/or
448			documentation.