Xilinx Quick Emulator: User Guide QEMU

1 Xilinx Quick Emulator UserGuideQEMUUG1169 ( ) June 3, 2020 See all versionsof this documentRevision HistoryThe following table shows the revision history for this Summary06/03/2020 Version Supported FeaturesUpdated CAN with Xilinx QEMUNew HistoryUG1169 ( ) June 3, 2020 User Guide 2 Send FeedbackTable of ContentsRevision 1: Using Xilinx 5 What is QEMU?..5 Chapter 2: Getting Started with Supported 6 Installing 3: QEMU Quick Reference UltraScale+ MPSoC Command Base SoC Command Base Processor Command Base Command Line 4: Using XDB with 5: Co-Simulating with with 6: Using Boot Images on SD for QSPI for TFTP for 44SD-Card Partitioning and Loading an Ubuntu-core File New Devices to the 7: Hangs on CPU Stall ( ) June 3, 2020 User Guide 3 Send FeedbackAppendix A: Additional Resources and Legal Navigator and Design Read: Important Legal 50UG1169 ( ) June 3, 2020 User Guide 4 Send FeedbackChapter 1 Using Xilinx QEMUWhat is QEMU?

2 Xilinx provides a Quick Emulator (QEMU) for software developers targeting Zynq -7000 SoC,Zynq UltraScale+ MPSoC, and MicroBlaze development platforms. This system-emulation-model runs on an Intel-compatible Linux or Windows host systems. To use this system emulationmodel you must be familiar with: Device architecture GNU debugger (GDB) for debugging QEMU remotely Generation of guest software application using Xilinx PetaLinux and Software DevelopmentKit (SDK) tools Device treesThis document provides the basic information to familiarize, use, and debug software 1: Using Xilinx QEMUUG1169 ( ) June 3, 2020 User Guide 5 Send FeedbackChapter 2 Getting Started with QEMUQEMU Supported FeaturesThe following table summarizes the status each element of the QEMU model according to 1: QEMU Supported FeaturesDescriptionQEMU StatusApplication Processing UnitsArm interrupt controller (GIC v2 and v3)YesArm v8 (A53 and A72) implementation.

3 Endian onlyArm v8 EL0 supportAArch64 and AArch32 Arm v8 EL1 supportAArch64 and AArch32 Arm v8 EL2 supportAArch64 Arm v8 EL3 supportAArch64 Arm v8 Crypto instruction supportSupportedVector Floating Point (VFP) supportAs maintained by mainline. No formal acceptance criteria to supportAs maintained by mainline. No formal acceptance criteria to v7 SupportA9, R5, R4 Processing UnitsDual core Cortex -R5 FIncomplete coverage of system register set, little endian core R5 CPU run-time configurationStatic dual core, no parallel/lock HandlingFaults can be externally coupled MemoriesNo R5 local view. Only globally accessible TCM memory region isaccessible. Flat memory only, no control register limited functionality. Only dummy registers, except SD Zynq UltraScale+ MPSoCIP IntegratorLimited Connectivity specific to PMU MicroBlaze Interrupt 2: Getting Started with QEMUUG1169 ( ) June 3, 2020 User Guide 6 Send FeedbackTable 1: QEMU Supported Features (cont'd)DescriptionQEMU StatusI/O Peripherals and DevicesI/O PeripheralsNot all peripherals are implemented.

4 Some standard peripherals areslight variations on the actual cores Gigabit Ethernet Controller1588 not Host Controller Interface ( ) Card modelNo controller (excludes Linear and Generic) linear regionNo XIP. Slow emulation NOR flash devicesIncomplete but reasonable selection of parts including many modernQSPI capable controllerMaster mode controllerMaster mode flat RAM model, no functionality: connects to remote and Ethernet PHYD ummy models, show link up on requested PHY using PortsDP modelAUX : DisplayPort Configuration some unexpected resolution Pixel formatsNot AXI BusAMBA/AXI bus interconnect systemSimple bus model, no AXI/AMBA-specific features (such as MIDs).Master IDs and Trustzone (secure versus non-secure) quality of service monitoring and controlN/AOn Chip MemoryYesChapter 2: Getting Started with QEMUUG1169 ( ) June 3, 2020 User Guide 7 Send FeedbackTable 1: QEMU Supported Features (cont'd)DescriptionQEMU StatusAXI Performance Monitor (APM)ATM AXI Trace Monitor (ATM)N/AAdditional Zynq UltraScale+ MPSoC CapabilitiesXMPUDoes not return Slave error; CPU does not recognize asynchronousaborts on failed not return Slave error; CPU does not recognize asynchronousaborts on failed supports 64-bit page tablesClock/reset controllers for low-power and highpower feature set specific to CPU Interrupt AMS QEMU Non-IP Related FeatureAbility to boot multiple software in QEMU Machine models from Linuxdevice tree binaries (DTB) to QEMU maintained DTBs only.

5 IPI/HSI generated FCI and no FCI and no and Clock GeneratorsTriple Timer , device. Dummy emulation of clock QEMUQEMU comes with the Xilinx PetaLinux Tools and Xilinx SDK installer. See the PetaLinux Toolsdocumentation for installation : Use which-qemu-system-aarch64 command to know where the QEMU binary is installed afterPetaLinux or SDK paths are : Xilinx QEMU Source is available at , for building QEMU manually refer to Chapter 3, QEMU Quick Reference QEMU Using PetaLinux CommandsQEMU is integrated with the PetaLinux 2: Getting Started with QEMUUG1169 ( ) June 3, 2020 User Guide 8 Send FeedbackIt is assumed that at this step you have already downloaded and installed Xilinx PetaLinux onyour Linux machine. If you have not done so, please see the PetaLinux Tools documentation forinstallation instructions, and install it this example, to get you started quickly without having to have a Vivado project ready, Xilinx recommends you to download a pre-built PetaLinux BSP.

6 Also, download the ZCU102 BSP (prod-silicon) BSP from the Petalinux Download use QEMU with a PetaLinux project, you need to create and build a PetaLinux project for theZynq UltraScale+ MPSoC platform (use the pre-built ZCU102 BSP).Open your favorite terminal and type the <petalinux-install-path> -t project -s <path to bsp> -n --qemu --prebuilt 3On completing step 4 you should see the QEMU boot sequence loading the prebuilt linux the prompt enter the username and passowrd as : On step 4 you can pass additional arguments to QEMU using the following option: --qemu-args"..". You can pass any additional argument within double DTBsThe QEMU tool uses device tree blobs (dtb) for machine creation. For MicroBlaze andZynq -7000, dtbs built for Linux kernels are used for emulation. Xilinx maintains device-treesources at for Zynq UltraScale+ MPSoC. For moreinformation on how to use device trees see Chapter 3, QEMU Quick Reference 2: Getting Started with QEMUUG1169 ( ) June 3, 2020 User Guide 9 Send FeedbackChapter 3 QEMU Quick Reference CardZynq UltraScale+ MPSoC Command BaseTemplateThis is a basic template for Zynq UltraScale+ MPSoC QEMU command lines:qemu-system-aarch64 -M arm-generic-fdt -nographic -dtb <hw-dtb> \-device loader,file=< >,cpu-num=<cpu-id> \-global xlnx, <cpu index> \[-device loader,addr=<cpu-reset-register-addr>,data=<value>,data-len=4] \[-global xlnx, ] \[-global xlnx, <false/true>] \[-boot mode=<boot-mode-id>] \[-m <ddr ram size>][-drive file=<image-path>, if=<( sd | mtd | pflash )>, format=raw,\index=<index_num> ]QEMU Command Options and DescriptionsThe following table lists the options and descriptions for QEMU 2: QEMU Command Options and DescriptionsOptionDescription-device loader,file=< >,cpu=<cpu-id>Specify the software to run (in ELF format).

7 -device loader,addr=<cpu-reset-register-addr>,data=<value>,data-len=4 Release CPU from command is optional because the next command canalso be used to release resets of : R5 resets can be released only with this xlnx, <cpu index>Release the specified A53 details regarding the CPU index, refer to xlnx, <true/false>Specify true if running with pmu : This option will be deprecated in future, when pmufwuses a default 3: QEMU Quick Reference CardUG1169 ( ) June 3, 2020 User Guide 10 Send FeedbackTable 2: QEMU Command Options and Descriptions (cont'd)OptionDescription-global xlnx, <false/true>Mention QEMU to use or not to use static pmufw configdata. true: loads static pmufw config data false: Do not use static data, FSBL populates it-boot mode=<boot-mode-id>Specify the boot mode file=<image-path>, if=<[ sd | mtd |pflash ]>, format=raw, index=<index_num>Specify files for persistent storage media (SD, QSPI, orNAND respectively).

8 <index_num> specifies the respective controller for eachmedia arm-generic-fdt -nographic -dtb <hw-dtb>Standard options. <hw-dtb> is the QEMU <ddr ram size>Mention size of ram to be emulated, default is : -m 4 GStandalone Hello World ExampleThis example runs a Hello-world ELF file on an A53 processor. Substitute with the location of your target software, as follows:qemu-system-aarch64 -nographic -M arm-generic-fdt \-dtb \-device loader,file=. ,cpu-num=0 \ -device loader,addr=0xfd1a0104,data=0x8000000e,d ata-len=4 Zynq-7000 SoC Command Base TemplateFollowing is the command base template for Zynq-7000 SoC -M arm-generic-fdt-7series \ [-machine linux=on] \-serial /dev/null -serial mon:stdio \ -display none \-kernel <guest image path> \-dtb <dtb path> \[-device loader,addr=0xf8000008,data=0xDF0D,data- len=4 \-device loader,addr=0xf8000140,data=0x00500801,d ata-len=4 \-device loader,addr=0xf800012c,data=0x1ed044d,da ta-len=4 \-device loader,addr=0xf8000108,data=0x0001e008,d ata-len=4 ]Table 3: Command Options for Zynq-7000 SoC DevicesOptionDescription-machine linux=onSpecifies if -kernel is provided an linux kernel 3: QEMU Quick Reference CardUG1169 ( ) June 3, 2020 User Guide 11 Send FeedbackTable 3.

9 Command Options for Zynq-7000 SoC Devices (cont'd)OptionDescription-kernel <guest image path>Specify path to guest image, such as kernel-dtb <dtb path>Specify the linux dtb path which is used by QEMU emulationMicroBlaze Processor Command BaseTemplateFollowing is the command base template for MicroBlaze -M microblaze-fdt-plnx \-m <ram_size> \-serial mon:stdio \-display none \-kernel <guest image path> \-dtb <path to the dtb>Table 4: Command Options for Zynq-7000 SoC DevicesOptionDescription-m <ram_size>Specifies the RAM needed to be <guest image path>Specifies the RAM needed to be <dtb path>Specifies the RAM needed to be Command Line OptionsThis section provides details of QEMU command line options. The following sections detail boot,network, serial, storage, and miscellaneous command line Extra QEMU Command Line Arguments withPetaLinuxThe petalinux-boot --qemu command has an argument --qemu-args that lets youspecify extra QEMU command line of the optional arguments specified in the section can be passed to the PetaLinux QEMU using this 3: QEMU Quick Reference CardUG1169 ( ) June 3, 2020 User Guide 12 Send FeedbackIMPORTANT!

10 Do not specify the standard, boot, or network options to petalinux-boot; those options arehandled transparently by the Boot Options[ -device loader,(file=<file_name>|data=<value>,data-len=4),\[addr=<value>],[cpu-num=<value>],[force-raw=true] ] ..This (repeatable) argument configures the QEMU machine for boot. The boot options performthe following tasks: Loads software or data into RAM sections Sets the CPU entry points Releases CPUs from resetBy default, theZynq UltraScale+ MPSoC has six Arm CPUs (four cores of Cortex -A53 and twocores of Cortex-R5F) are in reset by their respective reset controllers when no software is can use a combination of -device loader arguments to load software and setup the are two basic modes for the loader argument: file mode and single transaction one mode only. The following subsections describe these ModeIn file mode, the loader accepts a file as data to load. The file can be in any format and is passedusing the file=<file_name> sub-option.