[Top] | [Contents] | [Index] | [ ? ] |
1. Introduction | ||
2. Installation | ||
3. QEMU PC System emulator | ||
4. QEMU System emulator for non PC targets | ||
5. QEMU Linux User space emulator | ||
6. Compilation from the sources | ||
7. Index |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
1.1 Features |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
QEMU has two operating modes:
QEMU can run without an host kernel driver and yet gives acceptable performance.
For system emulation, the following hardware targets are supported:
For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
If you want to compile QEMU yourself, see 6. Compilation from the sources.
2.1 Linux | ||
2.2 Windows | ||
2.3 Mac OS X | Macintosh |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
If a precompiled package is available for your distribution - you just have to install it. Otherwise, see 6. Compilation from the sources.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Download the experimental binary installer at http://www.free.oszoo.org/@/download.html.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Download the experimental binary installer at http://www.free.oszoo.org/@/download.html.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
The QEMU PC System emulator simulates the following peripherals:
SMP is supported with up to 255 CPUs.
Note that adlib is only available when QEMU was configured with -enable-adlib
QEMU uses the PC BIOS from the Bochs project and the Plex86/Bochs LGPL VGA BIOS.
QEMU uses YM3812 emulation by Tatsuyuki Satoh.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Download and uncompress the linux image (`linux.img') and type:
qemu linux.img |
Linux should boot and give you a prompt.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
usage: qemu [options] [disk_image] |
disk_image is a raw hard disk image for IDE hard disk 0.
General options:
-M ?
for list)
Normally, QEMU uses SDL to display the VGA output. With this option, you can totally disable graphical output so that QEMU is a simple command line application. The emulated serial port is redirected on the console. Therefore, you can still use QEMU to debug a Linux kernel with a serial console.
Normally, QEMU uses SDL to display the VGA output. With this option, you can have QEMU listen on VNC display d and redirect the VGA display over the VNC session. It is very useful to enable the usb tablet device when using this option (option `-usbdevice tablet'). When using the VNC display, you must use the `-k' option to set the keyboard layout.
Use keyboard layout language (for example fr
for
French). This option is only needed where it is not easy to get raw PC
keycodes (e.g. on Macs, with some X11 servers or with a VNC
display). You don't normally need to use it on PC/Linux or PC/Windows
hosts.
The available layouts are:
ar de-ch es fo fr-ca hu ja mk no pt-br sv da en-gb et fr fr-ch is lt nl pl ru th de en-us fi fr-be hr it lv nl-be pt sl tr |
The default is en-us
.
Will show the audio subsystem help: list of drivers, tunable parameters.
Enable audio and selected sound hardware. Use ? to print all available sound hardware.
qemu -soundhw sb16,adlib hda qemu -soundhw es1370 hda qemu -soundhw all hda qemu -soundhw ? |
USB options:
Network options:
ne2k_pci
, ne2k_isa
, rtl8139
,
smc91c111
and lance
. Not all devices are supported on all
targets.
qemu linux.img -net nic -net tap |
More complicated example (two NICs, each one connected to a TAP device)
qemu linux.img -net nic,vlan=0 -net tap,vlan=0,ifname=tap0 \ -net nic,vlan=1 -net tap,vlan=1,ifname=tap1 |
Connect the VLAN n to a remote VLAN in another QEMU virtual machine using a TCP socket connection. If `listen' is specified, QEMU waits for incoming connections on port (host is optional). `connect' is used to connect to another QEMU instance using the `listen' option. `fd=h' specifies an already opened TCP socket.
Example:
# launch a first QEMU instance qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ -net socket,listen=:1234 # connect the VLAN 0 of this instance to the VLAN 0 # of the first instance qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ -net socket,connect=127.0.0.1:1234 |
Create a VLAN n shared with another QEMU virtual machines using a UDP multicast socket, effectively making a bus for every QEMU with same multicast address maddr and port. NOTES:
Example:
# launch one QEMU instance qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ -net socket,mcast=230.0.0.1:1234 # launch another QEMU instance on same "bus" qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \ -net socket,mcast=230.0.0.1:1234 # launch yet another QEMU instance on same "bus" qemu linux.img -net nic,macaddr=52:54:00:12:34:58 \ -net socket,mcast=230.0.0.1:1234 |
Example (User Mode Linux compat.):
# launch QEMU instance (note mcast address selected # is UML's default) qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \ -net socket,mcast=239.192.168.1:1102 # launch UML /path/to/linux ubd0=/path/to/root_fs eth0=mcast |
bin
of
the Unix TFTP client). The host IP address on the guest is as usual
10.0.2.2.
In the guest Windows OS, the line:
10.0.2.4 smbserver |
Then `dir' can be accessed in `\\smbserver\qemu'.
Note that a SAMBA server must be installed on the host OS in `/usr/sbin/smbd'. QEMU was tested succesfully with smbd version 2.2.7a from the Red Hat 9 and version 3.0.10-1.fc3 from Fedora Core 3.
When using the user mode network stack, redirect incoming TCP or UDP connections to the host port host-port to the guest guest-host on guest port guest-port. If guest-host is not specified, its value is 10.0.2.15 (default address given by the built-in DHCP server).
For example, to redirect host X11 connection from screen 1 to guest screen 0, use the following:
# on the host qemu -redir tcp:6001::6000 [...] # this host xterm should open in the guest X11 server xterm -display :1 |
To redirect telnet connections from host port 5555 to telnet port on the guest, use the following:
# on the host qemu -redir tcp:5555::23 [...] telnet localhost 5555 |
Then when you use on the host telnet localhost 5555
, you
connect to the guest telnet server.
Linux boot specific: When using these options, you can use a given Linux kernel without installing it in the disk image. It can be useful for easier testing of various kernels.
Debug/Expert options:
vc
in graphical mode and
stdio
in non graphical mode.
This option can be used several times to simulate up to 4 serials ports.
Available character devices are:
vc
pty
null
/dev/XXX
/dev/parportN
file:filename
stdio
pipe:filename
COMn
udp:[remote_host]:remote_port[@[src_ip]:src_port]
0.0.0.0
. When not using a specifed src_port a random port is automatically chosen.
If you just want a simple readonly console you can use netcat
or
nc
, by starting qemu with: -serial udp::4555
and nc as:
nc -u -l -p 4555
. Any time qemu writes something to that port it
will appear in the netconsole session.
If you plan to send characters back via netconsole or you want to stop
and start qemu a lot of times, you should have qemu use the same
source port each time by using something like -serial
udp::4555@:4556
to qemu. Another approach is to use a patched
version of netcat which can listen to a TCP port and send and receive
characters via udp. If you have a patched version of netcat which
activates telnet remote echo and single char transfer, then you can
use the following options to step up a netcat redirector to allow
telnet on port 5555 to access the qemu port.
Qemu Options:
netcat options:
telnet options:
tcp:[host]:port[,server][,nowait]
,nowait
option was specified. If host is omitted, 0.0.0.0 is assumed. Only
one TCP connection at a time is accepted. You can use telnet
to
connect to the corresponding character device.
Example to send tcp console to 192.168.0.2 port 4444
Example to listen and wait on port 4444 for connection
Example to not wait and listen on ip 192.168.0.100 port 4444
telnet:host:port[,server][,nowait]
-serial tcp
. The
difference is that the port acts like a telnet server or client using
telnet option negotiation. This will also allow you to send the
MAGIC_SYSRQ sequence if you use a telnet that supports sending the break
sequence. Typically in unix telnet you do it with Control-] and then
type "send break" followed by pressing the enter key.
This option can be used several times to simulate up to 3 parallel ports.
vc
in graphical mode and stdio
in
non graphical mode.
loadvm
in monitor)
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
During the graphical emulation, you can use the following keys:
In the virtual consoles, you can use Ctrl-Up, Ctrl-Down, Ctrl-PageUp and Ctrl-PageDown to move in the back log.
During emulation, if you are using the `-nographic' option, use Ctrl-a h to get terminal commands:
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
The QEMU monitor is used to give complex commands to the QEMU emulator. You can use it to:
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
The following commands are available:
Defaults:
info capture |
fmt is a format which tells the command how to format the data. Its syntax is: `/{count}{format}{size}'
h
or w
can be specified with the i
format to
respectively select 16 or 32 bit code instruction size.
Examples:
(qemu) x/10i $eip 0x90107063: ret 0x90107064: sti 0x90107065: lea 0x0(%esi,1),%esi 0x90107069: lea 0x0(%edi,1),%edi 0x90107070: ret 0x90107071: jmp 0x90107080 0x90107073: nop 0x90107074: nop 0x90107075: nop 0x90107076: nop |
(qemu) xp/80hx 0xb8000 0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42 0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41 0x000b8020: 0x0b42 0x0b69 0x0b6f 0x0b73 0x0b20 0x0b63 0x0b75 0x0b72 0x000b8030: 0x0b72 0x0b65 0x0b6e 0x0b74 0x0b2d 0x0b63 0x0b76 0x0b73 0x000b8040: 0x0b20 0x0b30 0x0b35 0x0b20 0x0b4e 0x0b6f 0x0b76 0x0b20 0x000b8050: 0x0b32 0x0b30 0x0b30 0x0b33 0x0720 0x0720 0x0720 0x0720 0x000b8060: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 |
Print expression value. Only the format part of fmt is used.
Send keys to the emulator. Use -
to press several keys
simultaneously. Example:
sendkey ctrl-alt-f1 |
This command is useful to send keys that your graphical user interface
intercepts at low level, such as ctrl-alt-f1
in X Window.
Reset the system.
Add the USB device devname. For details of available devices see 3.9.1 Connecting USB devices
Remove the USB device devname from the QEMU virtual USB
hub. devname has the syntax bus.addr
. Use the monitor
command info usb
to see the devices you can remove.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
The monitor understands integers expressions for every integer argument. You can use register names to get the value of specifics CPU registers by prefixing them with $.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Since version 0.6.1, QEMU supports many disk image formats, including growable disk images (their size increase as non empty sectors are written), compressed and encrypted disk images.
3.6.1 Quick start for disk image creation | ||
3.6.2 Snapshot mode | ||
3.6.3 qemu-img Invocation | qemu-img Invocation | |
3.6.4 Virtual FAT disk images |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
You can create a disk image with the command:
qemu-img create myimage.img mysize |
M
suffix to give the size in
megabytes and a G
suffix for gigabytes.
See 3.6.3 qemu-img
Invocation for more information.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
If you use the option `-snapshot', all disk images are
considered as read only. When sectors in written, they are written in
a temporary file created in `/tmp'. You can however force the
write back to the raw disk images by using the commit
monitor
command (or C-a s in the serial console).
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
qemu-img
Invocation
usage: qemu-img command [command options] |
The following commands are supported:
Command parameters:
raw
Raw disk image format (default). This format has the advantage of
being simple and easily exportable to all other emulators. If your file
system supports holes (for example in ext2 or ext3 on Linux),
then only the written sectors will reserve space. Use qemu-img
info
to know the real size used by the image or ls -ls
on
Unix/Linux.
qcow
cow
vmdk
cloop
M
(megabyte) and G
(gigabyte) are supported
Command description:
Create the new disk image filename of size size and format fmt.
If base_image is specified, then the image will record only the
differences from base_image. No size needs to be specified in
this case. base_image will never be modified unless you use the
commit
monitor command.
Commit the changes recorded in filename in its base image.
Convert the disk image filename to disk image output_filename
using format output_fmt. It can be optionnaly encrypted
(-e
option) or compressed (-c
option).
Only the format qcow
supports encryption or compression. The
compression is read-only. It means that if a compressed sector is
rewritten, then it is rewritten as uncompressed data.
Encryption uses the AES format which is very secure (128 bit keys). Use a long password (16 characters) to get maximum protection.
Image conversion is also useful to get smaller image when using a
growable format such as qcow
or cow
: the empty sectors
are detected and suppressed from the destination image.
Give information about the disk image filename. Use it in particular to know the size reserved on disk which can be different from the displayed size.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU can automatically create a virtual FAT disk image from a directory tree. In order to use it, just type:
qemu linux.img -hdb fat:/my_directory |
Then you access access to all the files in the `/my_directory' directory without having to copy them in a disk image or to export them via SAMBA or NFS. The default access is read-only.
Floppies can be emulated with the :floppy:
option:
qemu linux.img -fda fat:floppy:/my_directory |
A read/write support is available for testing (beta stage) with the
:rw:
option:
qemu linux.img -fda fat:floppy:rw:/my_directory |
What you should never do:
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU can simulate several networks cards (NE2000 boards on the PC target) and can connect them to an arbitrary number of Virtual Local Area Networks (VLANs). Host TAP devices can be connected to any QEMU VLAN. VLAN can be connected between separate instances of QEMU to simulate large networks. For simpler usage, a non priviledged user mode network stack can replace the TAP device to have a basic network connection.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU simulates several VLANs. A VLAN can be symbolised as a virtual connection between several network devices. These devices can be for example QEMU virtual Ethernet cards or virtual Host ethernet devices (TAP devices).
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
This is the standard way to connect QEMU to a real network. QEMU adds
a virtual network device on your host (called tapN
), and you
can then configure it as if it was a real ethernet card.
As an example, you can download the `linux-test-xxx.tar.gz'
archive and copy the script `qemu-ifup' in `/etc' and
configure properly sudo
so that the command ifconfig
contained in `qemu-ifup' can be executed as root. You must verify
that your host kernel supports the TAP network interfaces: the
device `/dev/net/tun' must be present.
See 3.8 Direct Linux Boot to have an example of network use with a Linux distribution and 3.3 Invocation to have examples of command lines using the TAP network interfaces.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
By using the option `-net user' (default configuration if no `-net' option is specified), QEMU uses a completely user mode network stack (you don't need root priviledge to use the virtual network). The virtual network configuration is the following:
QEMU VLAN <------> Firewall/DHCP server <-----> Internet | (10.0.2.2) | ----> DNS server (10.0.2.3) | ----> SMB server (10.0.2.4) |
The QEMU VM behaves as if it was behind a firewall which blocks all incoming connections. You can use a DHCP client to automatically configure the network in the QEMU VM. The DHCP server assign addresses to the hosts starting from 10.0.2.15.
In order to check that the user mode network is working, you can ping the address 10.0.2.2 and verify that you got an address in the range 10.0.2.x from the QEMU virtual DHCP server.
Note that ping
is not supported reliably to the internet as it
would require root priviledges. It means you can only ping the local
router (10.0.2.2).
When using the built-in TFTP server, the router is also the TFTP server.
When using the `-redir' option, TCP or UDP connections can be redirected from the host to the guest. It allows for example to redirect X11, telnet or SSH connections.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Using the `-net socket' option, it is possible to make VLANs that span several QEMU instances. See 3.3 Invocation to have a basic example.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
This section explains how to launch a Linux kernel inside QEMU without having to make a full bootable image. It is very useful for fast Linux kernel testing. The QEMU network configuration is also explained.
sudo
so that the command ifconfig
contained in
`qemu-ifup' can be executed as root. You must verify that your host
kernel supports the TUN/TAP network interfaces: the device
`/dev/net/tun' must be present.
When network is enabled, there is a virtual network connection between the host kernel and the emulated kernel. The emulated kernel is seen from the host kernel at IP address 172.20.0.2 and the host kernel is seen from the emulated kernel at IP address 172.20.0.1.
qemu.sh
. You should have the following output:
> ./qemu.sh Connected to host network interface: tun0 Linux version 2.4.21 (bellard@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 BIOS-provided physical RAM map: BIOS-e801: 0000000000000000 - 000000000009f000 (usable) BIOS-e801: 0000000000100000 - 0000000002000000 (usable) 32MB LOWMEM available. On node 0 totalpages: 8192 zone(0): 4096 pages. zone(1): 4096 pages. zone(2): 0 pages. Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe @/ide5=noprobe console=ttyS0 ide_setup: ide2=noprobe ide_setup: ide3=noprobe ide_setup: ide4=noprobe ide_setup: ide5=noprobe Initializing CPU#0 Detected 2399.621 MHz processor. Console: colour EGA 80x25 Calibrating delay loop... 4744.80 BogoMIPS Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, @/0k highmem) Dentry cache hash table entries: 4096 (order: 3, 32768 bytes) Inode cache hash table entries: 2048 (order: 2, 16384 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 8192 (order: 3, 32768 bytes) CPU: Intel Pentium Pro stepping 03 Checking 'hlt' instruction... OK. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket apm: BIOS not found. Starting kswapd Journalled Block Device driver loaded Detected PS/2 Mouse Port. pty: 256 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with no serial options enabled ttyS00 at 0x03f8 (irq = 4) is a 16450 ne.c:v1.10 9/23/94 Donald Becker (becker@scyld.com) Last modified Nov 1, 2000 by Paul Gortmaker NE*000 ethercard probe at 0x300: 52 54 00 12 34 56 eth0: NE2000 found at 0x300, using IRQ 9. RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4 ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx hda: QEMU HARDDISK, ATA DISK drive ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 hda: attached ide-disk driver. hda: 20480 sectors (10 MB) w/256KiB Cache, CHS=20/16/63 Partition check: hda: Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 2048 bind 4096) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended VFS: Mounted root (ext2 filesystem). Freeing unused kernel memory: 64k freed Linux version 2.4.21 (bellard@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003 QEMU Linux test distribution (based on Redhat 9) Type 'exit' to halt the system sh-2.05b# |
ls
for example. Type Ctrl-a h to have an help
about the keys you can type inside the virtual serial console. In
particular, use Ctrl-a x to exit QEMU and use Ctrl-a b as
the Magic SysRq key.
. /etc/linuxrc |
Then enable X11 connections on your PC from the emulated Linux:
xhost +172.20.0.2 |
You can now launch `xterm' or `xlogo' and verify that you have a real Virtual Linux system !
NOTES:
ide1=noprobe ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU emulates a PCI UHCI USB controller. You can virtually plug virtual USB devices or real host USB devices (experimental, works only on Linux hosts). Qemu will automatically create and connect virtual USB hubs as neccessary to connect multiple USB devices.
3.9.1 Connecting USB devices | ||
3.9.2 Using host USB devices on a Linux host |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
USB devices can be connected with the `-usbdevice' commandline option
or the usb_add
monitor command. Available devices are:
mouse
tablet
disk:file
host:bus.addr
host:vendor_id:product_id
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
WARNING: this is an experimental feature. QEMU will slow down when using it. USB devices requiring real time streaming (i.e. USB Video Cameras) are not supported yet.
ls /proc/bus/usb 001 devices drivers |
chown -R myuid /proc/bus/usb |
info usbhost Device 1.2, speed 480 Mb/s Class 00: USB device 1234:5678, USB DISK |
usb_add host:1234:5678 |
Normally the guest OS should report that a new USB device is plugged. You can use the option `-usbdevice' to do the same.
When relaunching QEMU, you may have to unplug and plug again the USB device to make it work again (this is a bug).
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU has a primitive support to work with gdb, so that you can do 'Ctrl-C' while the virtual machine is running and inspect its state.
In order to use gdb, launch qemu with the '-s' option. It will wait for a gdb connection:
> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \ -append "root=/dev/hda" Connected to host network interface: tun0 Waiting gdb connection on port 1234 |
Then launch gdb on the 'vmlinux' executable:
> gdb vmlinux |
In gdb, connect to QEMU:
(gdb) target remote localhost:1234 |
Then you can use gdb normally. For example, type 'c' to launch the kernel:
(gdb) c |
Here are some useful tips in order to use gdb on system code:
info reg
to display all the CPU registers.
x/10i $eip
to display the code at the PC position.
set architecture i8086
to dump 16 bit code. Then use
x/10i $cs*16+$eip
to dump the code at the PC position.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
To have access to SVGA graphic modes under X11, use the vesa
or
the cirrus
X11 driver. For optimal performances, use 16 bit
color depth in the guest and the host OS.
When using a 2.6 guest Linux kernel, you should add the option
clock=pit
on the kernel command line because the 2.6 Linux
kernels make very strict real time clock checks by default that QEMU
cannot simulate exactly.
When using a 2.6 guest Linux kernel, verify that the 4G/4G patch is not activated because QEMU is slower with this patch. The QEMU Accelerator Module is also much slower in this case. Earlier Fedora Core 3 Linux kernel (< 2.6.9-1.724_FC3) were known to incorporte this patch by default. Newer kernels don't have it.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
If you have a slow host, using Windows 95 is better as it gives the best speed. Windows 2000 is also a good choice.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU emulates a Cirrus Logic GD5446 Video card. All Windows versions starting from Windows 95 should recognize and use this graphic card. For optimal performances, use 16 bit color depth in the guest and the host OS.
If you are using Windows XP as guest OS and if you want to use high resolution modes which the Cirrus Logic BIOS does not support (i.e. >= 1280x1024x16), then you should use the VESA VBE virtual graphic card (option `-std-vga').
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Windows 9x does not correctly use the CPU HLT instruction. The result is that it takes host CPU cycles even when idle. You can install the utility from http://www.user.cityline.ru/~maxamn/amnhltm.zip to solve this problem. Note that no such tool is needed for NT, 2000 or XP.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Windows 2000 has a bug which gives a disk full problem during its installation. When installing it, use the `-win2k-hack' QEMU option to enable a specific workaround. After Windows 2000 is installed, you no longer need this option (this option slows down the IDE transfers).
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Windows 2000 cannot automatically shutdown in QEMU although Windows 98 can. It comes from the fact that Windows 2000 does not automatically use the APM driver provided by the BIOS.
In order to correct that, do the following (thanks to Struan Bartlett): go to the Control Panel => Add/Remove Hardware & Next => Add/Troubleshoot a device => Add a new device & Next => No, select the hardware from a list & Next => NT Apm/Legacy Support & Next => Next (again) a few times. Now the driver is installed and Windows 2000 now correctly instructs QEMU to shutdown at the appropriate moment.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
See 3.3 Invocation about the help of the option `-smb'.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Some releases of Windows XP install correctly but give a security error when booting:
A problem is preventing Windows from accurately checking the license for this computer. Error code: 0x800703e6. |
Future QEMU releases are likely to correct this bug.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
DOS does not correctly use the CPU HLT instruction. The result is that it takes host CPU cycles even when idle. You can install the utility from http://www.vmware.com/software/dosidle210.zip to solve this problem.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
QEMU is a generic emulator and it emulates many non PC machines. Most of the options are similar to the PC emulator. The differences are mentionned in the following sections.
4.1 QEMU PowerPC System emulator | ||
4.2 Sparc32 System emulator invocation | ||
4.3 Sparc64 System emulator invocation | ||
4.4 MIPS System emulator invocation | ||
4.5 ARM System emulator invocation |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Use the executable `qemu-system-ppc' to simulate a complete PREP or PowerMac PowerPC system.
QEMU emulates the following PowerMac peripherals:
QEMU emulates the following PREP peripherals:
QEMU uses the Open Hack'Ware Open Firmware Compatible BIOS available at http://perso.magic.fr/l_indien/OpenHackWare/index.htm.
The following options are specific to the PowerPC emulation:
Set the initial VGA graphic mode. The default is 800x600x15.
More information is available at http://perso.magic.fr/l_indien/qemu-ppc/.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Use the executable `qemu-system-sparc' to simulate a SparcStation 5 (sun4m architecture). The emulation is somewhat complete.
QEMU emulates the following sun4m peripherals:
The number of peripherals is fixed in the architecture.
Since version 0.8.2, QEMU uses OpenBIOS http://www.openbios.org/. OpenBIOS is a free (GPL v2) portable firmware implementation. The goal is to implement a 100% IEEE 1275-1994 (referred to as Open Firmware) compliant firmware.
A sample Linux 2.6 series kernel and ram disk image are available on the QEMU web site. Please note that currently NetBSD, OpenBSD or Solaris kernels don't work.
The following options are specific to the Sparc emulation:
Set the initial TCX graphic mode. The default is 1024x768.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Use the executable `qemu-system-sparc64' to simulate a Sun4u machine. The emulator is not usable for anything yet.
QEMU emulates the following sun4u peripherals:
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Use the executable `qemu-system-mips' to simulate a MIPS machine. The emulator is able to boot a Linux kernel and to run a Linux Debian installation from NFS. The following devices are emulated:
More information is available in the QEMU mailing-list archive.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
Use the executable `qemu-system-arm' to simulate a ARM machine. The ARM Integrator/CP board is emulated with the following devices:
The ARM Versatile baseboard is emulated with the following devices:
A Linux 2.6 test image is available on the QEMU web site. More information is available in the QEMU mailing-list archive.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
5.1 Quick Start | ||
5.2 Wine launch | ||
5.3 Command line options | ||
5.4 Other binaries |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
In order to launch a Linux process, QEMU needs the process executable itself and all the target (x86) dynamic libraries used by it.
qemu-i386 -L / /bin/ls |
-L /
tells that the x86 dynamic linker must be searched with a
`/' prefix.
qemu-i386 -L / qemu-i386 -L / /bin/ls |
LD_LIBRARY_PATH
is not set:
unset LD_LIBRARY_PATH |
Then you can launch the precompiled `ls' x86 executable:
qemu-i386 tests/i386/ls |
binfmt_misc
module in the
Linux kernel.
qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \ /usr/local/qemu-i386/bin/ls-i386 |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
qemu-i386 /usr/local/qemu-i386/bin/ls-i386 |
${HOME}/.wine
directory is saved to ${HOME}/.wine.org
.
qemu-i386 /usr/local/qemu-i386/wine/bin/wine \ /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
usage: qemu-i386 [-h] [-d] [-L path] [-s size] program [arguments...] |
Debug options:
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
qemu-arm
is also capable of running ARM "Angel" semihosted ELF
binaries (as implemented by the arm-elf and arm-eabi Newlib/GDB
configurations), and arm-uclinux bFLT format binaries.
The binary format is detected automatically.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
6.1 Linux/Unix | ||
6.2 Windows | ||
6.3 Cross compilation for Windows with Linux | ||
6.4 Mac OS X |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
First you must decompress the sources:
cd /tmp tar zxvf qemu-x.y.z.tar.gz cd qemu-x.y.z |
Then you configure QEMU and build it (usually no options are needed):
./configure make |
Then type as root user:
make install |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
In order to compile QEMU succesfully, it is very important that you have the right tools. The most important one is gcc. I cannot guaranty that QEMU works if you do not use a tested gcc version. Look at 'configure' and 'Makefile' if you want to make a different gcc version work.
host gcc binutils glibc linux distribution ---------------------------------------------------------------------- x86 3.2 2.13.2 2.1.3 2.4.18 2.96 2.11.93.0.2 2.2.5 2.4.18 Red Hat 7.3 3.2.2 2.13.90.0.18 2.3.2 2.4.20 Red Hat 9 PowerPC 3.3 [4] 2.13.90.0.18 2.3.1 2.4.20briq 3.2 Alpha 3.3 [1] 2.14.90.0.4 2.2.5 2.2.20 [2] Debian 3.0 Sparc32 2.95.4 2.12.90.0.1 2.2.5 2.4.18 Debian 3.0 ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0 [1] On Alpha, QEMU needs the gcc 'visibility' attribute only available for gcc version >= 3.3. [2] Linux >= 2.4.20 is necessary for precise exception support (untested). [3] 2.4.9-ac10-rmk2-np1-cerf2 [4] gcc 2.95.x generates invalid code when using too many register variables. You must use gcc 3.x on PowerPC. |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
./configure --enable-mingw32 |
Note: Currently, Wine does not seem able to launch QEMU for Win32.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
The Mac OS X patches are not fully merged in QEMU, so you should look at the QEMU mailing list archive to have all the necessary information.
[ < ] | [ > ] | [ << ] | [ Up ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
[Top] | [Contents] | [Index] | [ ? ] |
1. Introduction
1.1 Features2. Installation
2.1 Linux3. QEMU PC System emulator
2.2 Windows
2.3 Mac OS X
3.1 Introduction4. QEMU System emulator for non PC targets
3.2 Quick Start
3.3 Invocation
3.4 Keys
3.5 QEMU Monitor
3.5.1 Commands3.6 Disk Images
3.5.2 Integer expressions
3.6.1 Quick start for disk image creation3.7 Network emulation
3.6.2 Snapshot mode
3.6.3qemu-img
Invocation
3.6.4 Virtual FAT disk images
3.7.1 VLANs3.8 Direct Linux Boot
3.7.2 Using TAP network interfaces
3.7.3 Using the user mode network stack
3.7.4 Connecting VLANs between QEMU instances
3.9 USB emulation
3.9.1 Connecting USB devices3.10 GDB usage
3.9.2 Using host USB devices on a Linux host
3.11 Target OS specific information
3.11.1 Linux
3.11.2 Windows
3.11.2.1 SVGA graphic modes support3.11.3 MS-DOS and FreeDOS
3.11.2.2 CPU usage reduction
3.11.2.3 Windows 2000 disk full problem
3.11.2.4 Windows 2000 shutdown
3.11.2.5 Share a directory between Unix and Windows
3.11.2.6 Windows XP security problems
3.11.3.1 CPU usage reduction
4.1 QEMU PowerPC System emulator5. QEMU Linux User space emulator
4.2 Sparc32 System emulator invocation
4.3 Sparc64 System emulator invocation
4.4 MIPS System emulator invocation
4.5 ARM System emulator invocation
5.1 Quick Start6. Compilation from the sources
5.2 Wine launch
5.3 Command line options
5.4 Other binaries
6.1 Linux/Unix7. Index
6.1.1 Compilation6.2 Windows
6.1.2 Tested tool versions
6.3 Cross compilation for Windows with Linux
6.4 Mac OS X
[Top] | [Contents] | [Index] | [ ? ] |
1. Introduction
2. Installation
3. QEMU PC System emulator
4. QEMU System emulator for non PC targets
5. QEMU Linux User space emulator
6. Compilation from the sources
7. Index
[Top] | [Contents] | [Index] | [ ? ] |
Button | Name | Go to | From 1.2.3 go to |
---|---|---|---|
[ < ] | Back | previous section in reading order | 1.2.2 |
[ > ] | Forward | next section in reading order | 1.2.4 |
[ << ] | FastBack | beginning of this chapter or previous chapter | 1 |
[ Up ] | Up | up section | 1.2 |
[ >> ] | FastForward | next chapter | 2 |
[Top] | Top | cover (top) of document | |
[Contents] | Contents | table of contents | |
[Index] | Index | concept index | |
[ ? ] | About | this page |
where the Example assumes that the current position is at Subsubsection One-Two-Three of a document of the following structure: