Developer Information

This section of the manual documents various parts of the internals of QEMU. You only need to read it if you are interested in reading or modifying QEMU’s source code.

• Code of Conduct
  • Sources
• Conflict Resolution Policy
  • How we resolve conflicts
  • Remedies
  • Sources
• The QEMU build system architecture
  • Stage 1: configure
  • Stage 2: Meson
  • Stage 3: makefiles
  • Important files for the build system
• QEMU Coding Style
  • Formatting and style
  • Language usage
  • QEMU Specific Idioms
• QEMU and Kconfig
  • The Kconfig language
  • Guidelines for writing Kconfig files
  • Writing and modifying default configurations
  • Kconfig.host
• Testing in QEMU
  • Testing with “make check”
  • QEMU iotests
  • Container based tests
  • Thread Sanitizer
  • VM testing
  • Image fuzzer testing
  • Integration tests using the Avocado Framework
  • Testing with “make check-tcg”
  • Other TCG Tests
  • GCC gcov support
• Fuzzing
  • Basics
  • Building the fuzzers
  • Useful libFuzzer flags
  • Generating Coverage Reports
  • Adding a new fuzzer
  • The Generic Fuzzer
  • OSS-Fuzz
  • Building Crash Reproducers
  • Implementation Details / Fuzzer Lifecycle
• Control-Flow Integrity (CFI)
  • Basics
  • Building with CFI
  • Using QEMU built with CFI
  • Incompatible code with CFI
  • Disabling CFI for a specific function
  • CFI and fuzzing
• Load and Store APIs
  • ld*_p and st*_p
  • cpu_{ld,st}*_mmu
  • cpu_{ld,st}*_mmuidx_ra
  • cpu_{ld,st}*_data_ra
  • cpu_{ld,st}*_data
  • cpu_ld*_code
  • translator_ld*
  • helper_*_{ld,st}*_mmu
  • address_space_*
  • address_space_write_rom
  • {ld,st}*_phys
  • cpu_physical_memory_*
  • cpu_memory_rw_debug
  • dma_memory_*
  • pci_dma_* and {ld,st}*_pci_dma
• The memory API
  • Types of regions
  • Migration
  • Region names
  • Region lifecycle
  • Overlapping regions and priority
  • Visibility
  • Example memory map
  • MMIO Operations
  • API Reference
• Migration
  • Transports
  • Debugging
  • Common infrastructure
  • Saving the state of one device
  • Stream structure
  • Postcopy
  • Firmware
• Atomic operations in QEMU
  • Compiler memory barrier
  • Sequentially consistent atomic access
  • Weak atomic access and manual memory barriers
  • Comparison with Linux kernel primitives
  • Sources
• QEMU and the stable process
  • QEMU stable releases
  • What should go into a stable release?
  • How to get a patch into QEMU stable
  • Stable release process
• CI
  • Definition of terms
  • Custom CI/CD variables
  • Jobs on Custom Runners
• QTest Device Emulation Testing Framework
  • Qtest Driver Framework
  • QTest Protocol
  • libqtest API reference
• Decodetree Specification
  • Fields
  • Argument Sets
  • Formats
  • Patterns
  • Pattern Groups
• Secure Coding Practices
  • Reporting Security Bugs
  • General Secure C Coding Practices
  • Input Validation
  • Unexpected Device Accesses
  • Live Migration
  • Guest Memory Access Races
  • Use of null-co block drivers
• Translator Internals
  • CPU state optimisations
  • Direct block chaining
  • Self-modifying code and translated code invalidation
  • Exception support
  • MMU emulation
• TCG Instruction Counting
  • Core Concepts
• Tracing
  • Introduction
  • Quickstart
  • Trace events
  • Generic interface and monitor commands
  • Trace backends
  • Trace event properties
• Multi-threaded TCG
  • vCPU Scheduling
  • Shared Data Structures
  • Memory Consistency
• QEMU TCG Plugins
  • Usage
  • Writing plugins
  • Internals
  • Example Plugins
• Bitwise operations
• QEMU UI subsystem
  • QEMU Clipboard
• Reset in QEMU: the Resettable interface
  • Triggering reset
  • Multi-phase mechanism
  • Handling reset in a resettable object
  • Base class handling of reset
• Booting from real channel-attached devices on s390x
  • s390 hardware IPL
  • How this all pertains to QEMU (and the kernel)
  • What QEMU does
• Modelling a clock tree in QEMU
  • What are clocks?
  • The clock state
  • Adding a new clock
  • Clock callbacks
  • Retrieving clocks from a device
  • Connecting two clocks together
  • Clock multiplier and divider settings
  • Unconnected input clocks
  • Fetching clock frequency/period
  • Calculating expiry deadlines
  • Obtaining tick counts
  • Changing a clock period
  • Aliasing clocks
  • Migration
• The QEMU Object Model (QOM)
  • Class Initialization
  • Interfaces
  • Methods
  • Standard type declaration and definition macros
• QEMU modules
• block-coroutine-wrapper
  • Usage
  • Links
• Multi-process QEMU
  • QEMU services
  • Separating IO services
  • New separation model based on proxy objects
  • Disaggregated CPU emulation
  • Host access controls
• eBPF RSS virtio-net support
  • RSS eBPF program
  • eBPF RSS implementation
• VFIO device Migration
  • System memory dirty pages tracking
  • System memory dirty pages tracking when vIOMMU is enabled
  • Live migration save path
  • Live migration resume path
• How to use the QAPI code generator
  • Introduction
  • The QAPI schema language
  • Client JSON Protocol introspection
  • Compatibility considerations
  • Code generation
• How to write monitor commands
  • Overview
  • Testing
  • Writing a simple command: hello-world
  • Writing more complex commands
  • Writing a debugging aid returning unstructured text
• Trivial Patches
  • Overview
  • Repositories
  • Workflow
  • Team
• Submitting a Patch
  • Writing your Patches
  • Submitting your Patches
  • Participating in Code Review
  • Tips and Tricks
• Submitting a Pull Request