Developer Information

This manual documents various parts of the internals of QEMU. You only need to read it if you are interested in reading or modifying QEMU’s source code.

Contents:

• Code of Conduct
  • Sources
• Conflict Resolution Policy
  • How we resolve conflicts
  • Remedies
  • Sources
• The QEMU build system architecture
  • Stage 1: configure
  • Stage 2: Meson
  • Stage 3: makefiles
  • Important files for the build system
• QEMU Coding Style
  • Formatting and style
  • Language usage
  • QEMU Specific Idioms
• QEMU and Kconfig
  • The Kconfig language
  • Guidelines for writing Kconfig files
  • Writing and modifying default configurations
  • Kconfig.host
• Testing in QEMU
  • Testing with “make check”
  • QEMU iotests
  • Container based tests
  • Thread Sanitizer
  • VM testing
  • Image fuzzer testing
  • Acceptance tests using the Avocado Framework
  • Testing with “make check-tcg”
• Fuzzing
  • Basics
  • Building the fuzzers
  • Useful libFuzzer flags
  • Generating Coverage Reports
  • Adding a new fuzzer
  • The Generic Fuzzer
  • OSS-Fuzz
  • Building Crash Reproducers
  • Implementation Details / Fuzzer Lifecycle
• Control-Flow Integrity (CFI)
  • Basics
  • Building with CFI
  • Using QEMU built with CFI
  • Incompatible code with CFI
  • Disabling CFI for a specific function
  • CFI and fuzzing
• Load and Store APIs
  • ld*_p and st*_p
  • cpu_{ld,st}*_mmuidx_ra
  • cpu_{ld,st}*_data_ra
  • cpu_{ld,st}*_data
  • cpu_ld*_code
  • translator_ld*
  • helper_*_{ld,st}*_mmu
  • address_space_*
  • address_space_write_rom
  • {ld,st}*_phys
  • cpu_physical_memory_*
  • cpu_memory_rw_debug
  • dma_memory_*
  • pci_dma_* and {ld,st}*_pci_dma
• The memory API
  • Types of regions
  • Migration
  • Region names
  • Region lifecycle
  • Overlapping regions and priority
  • Visibility
  • Example memory map
  • MMIO Operations
  • API Reference
• Migration
  • Transports
  • Debugging
  • Common infrastructure
  • Saving the state of one device
  • Stream structure
  • Postcopy
  • Firmware
• Atomic operations in QEMU
  • Compiler memory barrier
  • Sequentially consistent atomic access
  • Weak atomic access and manual memory barriers
  • Comparison with Linux kernel primitives
  • Sources
• QEMU and the stable process
  • QEMU stable releases
  • What should go into a stable release?
  • How to get a patch into QEMU stable
  • Stable release process
• QTest Device Emulation Testing Framework
  • Qtest Driver Framework
  • QTest Protocol
  • libqtest API reference
• Decodetree Specification
  • Fields
  • Argument Sets
  • Formats
  • Patterns
  • Pattern Groups
• Secure Coding Practices
  • Reporting Security Bugs
  • General Secure C Coding Practices
  • Input Validation
  • Unexpected Device Accesses
  • Live Migration
  • Guest Memory Access Races
• Translator Internals
  • CPU state optimisations
  • Direct block chaining
  • Self-modifying code and translated code invalidation
  • Exception support
  • MMU emulation
• TCG Instruction Counting
  • Core Concepts
• Tracing
  • Introduction
  • Quickstart
  • Trace events
  • Generic interface and monitor commands
  • Trace backends
  • Trace event properties
• Introduction
• vCPU Scheduling
• Shared Data Structures
  • Main Run Loop
  • Global TCG State
  • Translation Blocks
  • Memory maps and TLBs
  • Emulated hardware state
• Memory Consistency
  • Memory Barriers
  • Memory Control and Maintenance
  • Synchronisation Primitives
• QEMU TCG Plugins
  • API Stability
  • API
  • Usage
  • Plugin Life cycle
  • Internals
  • Example Plugins
• Bitwise operations
• Reset in QEMU: the Resettable interface
  • Triggering reset
  • Multi-phase mechanism
  • Handling reset in a resettable object
  • Base class handling of reset
• Booting from real channel-attached devices on s390x
  • s390 hardware IPL
  • How this all pertains to QEMU (and the kernel)
  • What QEMU does
• Modelling a clock tree in QEMU
  • What are clocks?
  • The clock state
  • Adding a new clock
  • Clock callbacks
  • Retrieving clocks from a device
  • Connecting two clocks together
  • Unconnected input clocks
  • Fetching clock frequency/period
  • Calculating expiry deadlines
  • Obtaining tick counts
  • Changing a clock period
  • Aliasing clocks
  • Migration
• The QEMU Object Model (QOM)
  • Class Initialization
  • Interfaces
  • Methods
  • Standard type declaration and definition macros
• block-coroutine-wrapper
  • Usage
  • Links
• Multi-process QEMU
  • QEMU services
  • Separating IO services
  • New separation model based on proxy objects
  • Disaggregated CPU emulation
  • Host access controls