Xtensa on QEMU

Setting up and running Xtensa simulation on QEMU

QEMU is a free processor/machine emulator and virtualizer.

Starting with version 1.0 QEMU offers Xtensa architecture emulation. DC232B (LE) and fsf (BE) cores are supported on sim and LX60/LX200 platforms.

Getting and building QEMU

QEMU is developed using git. The main tree is located at git://git.qemu.org/qemu.git. Release tarballs and guest systems images are available at http://wiki.qemu.org/Download.

This will make a copy of master QEMU repository, configure, build and install QEMU binaries for little-endian and big-endian targets:

 $ git clone git://git.qemu.org/qemu.git
 $ mkdir qemu-xtensa ; cd qemu-xtensa
 $ ../qemu/configure --prefix=`pwd`/root --target-list=xtensa-softmmu,xtensaeb-softmmu
 $ make install

QEMU options

Option	Meaning	Example
-M <machine-name>	Emulate specific platform type. Use '?' to list all supported platform types.	-M lx60
-cpu <core-name>	Emulate specific core type. Use '?' to list all supported core types.	-cpu dc232b
-m megs	Set emulated RAM size to megs MB	-m 128
-semihosting	Enable SIMCALL instruction for the protection ring 0.	-semihosting
-kernel <elf-image>	Load elf-image and start emulation from its entry point. Note that image is loaded to virtual addresses it is linked for. For LX60/LX200 this option also chooses 'boot from SRAM' mode, mapping SRAM to the System ROM region at physical address 0xFE000000.	-kernel xtensa-2.6.29-smp/arch/xtensa/boot/Image.elf
-append <kernel arguments>	(Not for sim) Wrap kernel arguments into the bootparameters block and pass pointer to it to the elf-image in a2.	-append 'console=ttyS0 ip=dhcp root=/dev/nfs rw'
-pflash <flash-image>	(Not for sim) Mount flash-image as a system FLASH. Note that image size must match platform FLASH size (4MB for LX60, 16MB for LX200).	-pflash u-boot.dc232b_xtav200.flash
-net nic,<nic-parameters>	(Not for sim) Set network interface parameters.	-net nic,vlan=0
-net user,<SLIRP parameters>	(Not for sim) Use the user mode network stack. SLIRP parameters may be used to tune built-in DHCP and TFTP servers.	-net user,vlan=0,tftp=.,hostname=dc232b-lx200

sim platform

The sim platform is modelled after Tensilica ISS. It may run ELF images built for ISS, see e.g. Build and Run a Linux Kernel on the Instruction Set Simulator (ISS). There's only SIMCALL external interface available for the sim machine. To avoid console interference with QEMU monitor, monitor should be disabled with -monitor null or moved to network interface.

 $ qemu-system-xtensa -cpu dc232b -M sim -m 128M -semihosting -nographic -monitor null -kernel sim-2.6.29-smp/arch/xtensa/boot/Image.elf

LX60/LX200 platform

LX60/LX200 platform emulates system RAM, board-specific FPGA, UART, OpenCores 10/100 Mbit Ethernet MAC, National Semiconductors DP83848C 10/100 PHY and parallel FLASH. The platform may boot from either SRAM (when -kernel option is specified, SRAM is mapped to the System ROM region and ELF image is loaded) or from FLASH.

NFS root export record for user network (there's no way to specify root-path option for the QEMU builtin DHCP server. Unless kernel parameter 'rootpath' is given, you'll have to put the rootfs to /tftpboot/<hostname>):

 /tftpboot/      127.0.0.1(rw,no_root_squash,insecure)

Booting linux image from SRAM (FLASH not mapped):

 $ qemu-system-xtensa -cpu dc232b -M lx200 -m 96M -nographic -net nic,vlan=0 -net user,vlan=0,tftp=.,hostname=dc232b-lx200 -kernel lx60-2.6.29-smp/arch/xtensa/boot/Image.elf

Booting u-boot image from SRAM (empty FLASH image is created and mapped):

 $ head -c 16M /dev/zero > lx200.flash
 $ qemu-system-xtensa -cpu dc232b -M lx200 -m 96M -nographic -net nic,vlan=0 -net user,vlan=0,tftp=.,hostname=dc232b-lx200 -pflash lx200.flash -kernel u-boot-xtensa.git/u-boot.dc232b_xtav200

In this scenario binary u-boot image may be downloaded from TFTP and copied to the FLASH as described here.

Alternatively FLASH image containing u-boot may be preformatted and QEMU may be booted from it:

 $ cat u-boot-xtensa.git/u-boot.bin.dc232b_xtav200 /dev/zero | head -c 16M > lx200.flash
 $ qemu-system-xtensa -cpu dc232b -M lx200 -m 96M -nographic -net nic,vlan=0 -net user,vlan=0,tftp=.,hostname=dc232b-lx200 -pflash lx200.flash