qemu-system-riscv64 -M help在执行哪块代码运行下面的命令./output/qemu/bin/qemu-system-riscv64-Mhelp显示Supported machines are: microchip-icicle-kit Microchip PolarFire SoC Icicle Kit none empty machine quard-star RISC-V Quard Star board sifive_e RISC-V Board compatible with SiFive E SDK sifive_u RISC-V Board compatible with SiFive U SDK spike RISC-V Spike board (default) virt RISC-V VirtIO board抓一下字符串findqemu-6.0.0/-name*.[ch]|xargsgrepSupported machines are一堆报错grep: shared: No such file or directory grep: module/subprojects/cmMod/module/module.c: No such file or directory grep: qemu-6.0.0/meson/test: No such file or directory grep: cases/cmake/21: No such file or directory grep: shared: No such file or directory grep: module/runtime.c: No such file or directory grep: qemu-6.0.0/meson/test: No such file or directory grep: cases/d/5: No such file or directory grep: mixed/libstuff.c: No such file or directory经过诊断是部分文件/文件夹名字包含空格需要特殊处理findqemu-6.0.0/-name*.[ch]-print0|xargs-0grepSupported machines are得到结果qemu-6.0.0/softmmu/vl.c: printf(Supported machines are:\n);进去看到位于函数 machine_parse。在刚刚抓到的行下面加 printf(“yoooooo!!!\n”);再次编译执行得到如下日志hello from MEEEE!!! Supported machines are: yoooooo!!! microchip-icicle-kit Microchip PolarFire SoC Icicle Kit none empty machine quard-star RISC-V Quard Star board ......说明我们找对了。此时我们已经知道 qemu-system-riscv64 -M help 会执行 machine_parse 函数。不过如果能知道 softmmu/main.c : main 是怎么走到这里的就更好了。从 main 到 machine_parse运行gdb qemu-6.0.0/build/qemu-system-riscv64breakmachine_parse run-Mhelp会停在 …/softmmu/vl.c:1540运行bt得到#0 machine_parse (machines0x5555566143a0 {...}, name0x55555647fde0 help) at ../softmmu/vl.c:1540 #1 select_machine () at ../softmmu/vl.c:1630 #2 qemu_init (argcargcentry3, argvargventry0x7fffffffde28, envpenvpentry0x7fffffffde48) at ../softmmu/vl.c:3546 #3 0x000055555581044b in main (argc3, argv0x7fffffffde28, envp0x7fffffffde48) at ../softmmu/main.c:50基本知道调用路径 这不是精确的 call graph但已经帮大忙了为什么叫 vl.c 这个奇怪的名字softmmu/vl.c 的vl是 Virtual Linux 的缩写。早期 QEMU 有两种运行模式用户态模拟器的可执行文件叫qemu全系统模拟器的可执行文件叫vl时代遗留产物