QEMU is an open source machine emulator and virtualizer that can emulate various CPU architectures like x86, PowerPC, ARM, MIPS and SPARC. This document discusses extending QEMU to add support for a new I2C accelerometer hardware and simulating it in QEMU. It describes registering a new device type in QEMU to represent the accelerometer, implementing read/write callbacks to emulate the device behavior, and testing it works with a simple application both in QEMU and on a real Raspberry Pi board.

1. CONFIDENTIAL©2013 GlobalLogic Inc.
QEMU and Raspberry Pi
Instant embedded
development

2. ©2013 GlobalLogic Inc. CONFIDENTIAL
• What is QEMU
• QEMU Project structure
• Extending QEMU
• Raspberry Pi on QEMU
• Simulating Accelerometer on QEMU
• Verification on real platform

3. 3 CONFIDENTIAL
Goals:
• How to add support of new hardware to the QEMU (I2C
Accelerometer)
• How to simulate of the new hardware
• Write a simple application to work with Accelerometer
• Demonstrate that it works on the real platform as well as under
QEMU

4. 4 CONFIDENTIAL
Environment:
• Ubuntu Linux on Host PC
• QEMU for ARM architecture
• Raspbian Linux on Raspberry Pi and QEMU
• QEMU-ready Linux kernel 3.6.11 for the ARM1176JZF-S (RPi)
• Raspberry Pi rev.B
• I2C Accelerometer ADXL345

5. 5 CONFIDENTIAL
What is QEMU ?
− QEMU (short for "Quick EMUlator") is a free and open-source machine
emulator and virtualizer written originally by Fabrice Bellard
− Can emulate 80386, 80486, Pentium, Pentium Pro, AMD64 – from x86
architecture
− PowerPC, ARM, MIPS, SPARC, SPARC64
− Work on FreeBSD, FreeDOS, Linux, Windows 9x, Windows 2000, Mac
OS X, QNX, Android

6. 6 CONFIDENTIAL
− Available CPUs:
− arm1026
− arm1136
− arm1136-r2
− arm1176
− arm11mpcore
− arm926
− arm946
− cortex-a15
− cortex-a8
− cortex-a9
− cortex-m3
− pxa250
− pxa255
− pxa260
− pxa261
− pxa262
− pxa270-a0
− pxa270-a1
− pxa270
− pxa270-b0
− pxa270-b1
− pxa270-c0
− pxa270-c5
− sa1100
− sa1110
− ti925t
− any
List of supported CPUs (ARM)
$ qemu-system-arm –cpu ?

7. 7 CONFIDENTIAL
− smdkc210 Samsung SMDKC210 board (Exynos4210)
− connex Gumstix Connex (PXA255)
− verdex Gumstix Verdex (PXA270)
− highbank Calxeda Highbank (ECX-1000)
− midway Calxeda Midway (ECX-2000)
− integratorcp ARM Integrator/CP (ARM926EJ-S) (default)
− kzm ARM KZM Emulation Baseboard (ARM1136)
− mainstone Mainstone II (PXA27x)
− musicpal Marvell 88w8618 / MusicPal (ARM926EJ-S)
− n800 Nokia N800 tablet aka. RX-34 (OMAP2420)
− n810 Nokia N810 tablet aka. RX-44 (OMAP2420)
− sx1 Siemens SX1 (OMAP310) V2
− sx1-v1 Siemens SX1 (OMAP310) V1
− cheetah Palm Tungsten|E aka. Cheetah PDA (OMAP310)
− realview-eb ARM RealView Emulation Baseboard (ARM926EJ-
S)
− realview-eb-mpcore ARM RealView Emulation Baseboard
(ARM11MPCore)
− realview-pb-a8 ARM RealView Platform Baseboard for Cortex-
A8
− realview-pbx-a9 ARM RealView Platform Baseboard Explore for
Cortex-A9
− akita Akita PDA (PXA270)
− spitz Spitz PDA (PXA270)
− borzoi Borzoi PDA (PXA270)
− terrier Terrier PDA (PXA270)
− lm3s811evb Stellaris LM3S811EVB
− lm3s6965evb Stellaris LM3S6965EVB
− tosa Tosa PDA (PXA255)
− versatilepb ARM Versatile/PB (ARM926EJ-S)
− versatileab ARM Versatile/AB (ARM926EJ-S)
− vexpress-a9 ARM Versatile Express for Cortex-A9
− vexpress-a15 ARM Versatile Express for Cortex-A15
− xilinx-zynq-a9 Xilinx Zynq Platform Baseboard for Cortex-A9
− z2 Zipit Z2 (PXA27x)
List of Platforms (ARM)
$ qemu-system-arm -machine ?

8. 8 CONFIDENTIAL
− "gpio_i2c", bus System, "Controller/Bridge/Hub", desc "Virtual GPIO to I2C
bridge"
− "usb-host", bus usb-bus, "Controller/Bridge/Hub"
− "usb-ehci", bus PCI, "USB"
− "ich9-usb-ehci2", bus PCI, "USB"
− "ich9-usb-ehci1", bus PCI, "USB"
− "usb-storage", bus usb-bus, "Storage"
− "usb-uas", bus usb-bus, "Storage"
− "i82562", bus PCI, "Network", desc "Intel i82562 Ethernet"
− "virtio-serial-device", bus virtio-bus, "Input"
− "pci-serial", bus PCI, "Input"
− "virtio-serial-pci", bus PCI, alias "virtio-serial", "Input"
− "usb-serial", bus usb-bus, "Input"
− "virtserialport", bus virtio-serial-bus, "Input"
− "AC97", bus PCI, "Sound", desc "Intel 82801AA AC97 Audio"
− "usb-audio", bus usb-bus, "Sound"
− "ds1338", bus i2c-bus, "Misc"
− "ssd0303", bus i2c-bus, "Misc"
− "lm8323", bus i2c-bus, "Misc"
− "max7310", bus i2c-bus, "Misc"
− "tmp105", bus i2c-bus, "Misc"
− "pci-testdev", bus PCI, "Misc", desc "PCI Test Device"
− "smbus-eeprom", bus i2c-bus, "Misc“
− ….
− …
− …
Supported peripherals (ARM):
$ qemu-system-arm -device?
• Zynq-7000 ARM Cortex-A9 CPU
• Zynq-7000 ARM Cortex-A9 MPCore
• Triple Timer Counter
• DDR Memory Controller
• DMA Controller (PL330)
• Static Memory Controller (NAND/NOR Flash)
• SD/SDIO Peripheral Controller (SDHCI)
• Zynq Gigabit Ethernet Controller
• USB Controller (EHCI - Host support only)
• Zynq UART Controller
• SPI and QSPI Controllers
• I2C Controller

9. 9 CONFIDENTIAL
− http://qemu-project.org/Documentation/GettingStartedDevelopers
QEMU Project
“QEMU does not have a high level design description document - only the source
code tells the full story”
QEMU Cross Reference on Missing Link Electronics

10. 10 CONFIDENTIAL
Extending QEMU

11. 11 CONFIDENTIAL
QDev

12. 12 CONFIDENTIAL
 Add statically in platform description file.
hw/arm/versatilepb.c :
 Add dynamically at startup:
./qemu-system-arm -kernel zImage -cpu arm1176 -m 256 -M versatilepb -no-
reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw" -hda
wheezy-raspbian.img -device adxl345,bus=/versatile_i2c,address=0x53
QDev
Register new type Add new device

13. 13 CONFIDENTIAL
Qemu I2C slave device

14. 14 CONFIDENTIAL
 Read/write registers
 Emulate control registers behavior
 Create server socket
 Read data from socket and fill data registers
adxl345 emulation

15. 15 CONFIDENTIAL
− Python
− Linux user space ( python-smbus library)
− Linux kernel ( /dev/i2c-0 )
− Linux i2c protocol driver
− Linux i2c-versatile.c driver
− write to Memory Mapped I/O
− Qemu MMIO callback (versatile_i2c.c )
− Qemu i2c slave protocol implementation (bitbang_i2c.c )
− Qemu i2c core ( hw/i2c/core.c )
– For address=0x53 : call our callbacks. ( read, write, event )
adxl345 emulation process

16. 16 CONFIDENTIAL
Linux kernel
adxl345 emulation process
Qemu

17. 17 CONFIDENTIAL
Raspberry Pi
The Raspberry Pi is a credit-card-sized single-board computer
Raspberry Pi Model B
Target Price$35
SoCBroadcom BCM2835 (CPU, GPU, DSP, SDRAM, USB)
CPU700 MHz ARM1176JZF-S core (ARM11 family, ARMv6 instruction set)
GPUBroadcom VideoCore IV @ 250 MHz
SDRAM512 MB (shared with GPU)
USB 2.0 ports2 via 3-port USB hub
Video outComposite RCA (PAL and NTSC), HDMI, raw LCD Panels via DSI
Audio out3.5 mm jack, HDMI, and I²S audio
StorageSD / MMC / SDIO card slot
Network10/100 Ethernet
Peripherals8 × GPIO, UART, I²C bus, SPI, I²S audio, +3.3 V, +5 V, ground
Power700 mA (3.5 W)
Power Source5 volt via MicroUSB, GPIO header
Size86 x 54 mm
Weight45g
OS
Arch Linux ARM, Debian GNU/Linux, Gentoo, Fedora, FreeBSD,
NetBSD, Plan 9, Raspbian OS, RISC OS, Slackware Linux

18. 18 CONFIDENTIAL
Raspberry Pi on QEMU
Emulating Raspberry Pi – The easy way (XEC DESIGN)
http://xecdesign.com/qemu-emulating-raspberry-pi-the-easy-way

19. 19 CONFIDENTIAL
Simulating Accelerometer on QEMU
Netcat: $nc 10.0.2.15 7766 < data.txt

20. 20 CONFIDENTIAL
 QEMU: Open source processor emulator:
http://wiki.qemu.org/Manual
 QEMU – Compiling for ARM (1176) emulation (XEC DESIGN):
http://xecdesign.com/compiling-qemu/
 Compiling an ARM1176 kernel for QEMU (XEC DESIGN):
http://xecdesign.com/compiling-a-kernel/
 QEMU – Emulating Raspberry Pi the easy way (XEC DESIGN):
http://xecdesign.com/qemu-emulating-raspberry-pi-the-easy-way/
 Hardware virtualization with QEMU:
http://alien.slackbook.org/dokuwiki/doku.php?id=slackware:qemu
 KVM Forum 2013: Implementing New Block Drivers: A QEMU Developer Primer by Jeff Cody
https://www.youtube.com/watch?v=ybNaEeQ2jgo
 HOWTO: Virtual Raspbian on Qemu in Ubuntu Linux 12.10:
http://www.raspberrypi.org/phpBB3/viewtopic.php?f=29&t=37386
 Raspberry Pi Wiki:
http://elinux.org/RPi_Hub
Links:

21. CONFIDENTIAL©2013 GlobalLogic Inc.
Stuff
Igor Kaplinsky
Senior Embedded Software Developer
mail: igor.kaplinskyi@globallogic.com
Taras Protsiv
Embedded Software Developer
mail: taras.protsiv@globallogic.com
Volodymyr Shymanskyy
Embedded Software Developer
mail: volodymyr.shymanskyy@globallogic.com

22. ©2013 GlobalLogic Inc. CONFIDENTIAL
Thank you