Statistics
| Branch: | Revision:

root / qemu-doc.texi @ 795ca114

History | View | Annotate | Download (90.1 kB)

1 386405f7 bellard
\input texinfo @c -*- texinfo -*-
2 debc7065 bellard
@c %**start of header
3 debc7065 bellard
@setfilename qemu-doc.info
4 e080e785 Stefan Weil
5 e080e785 Stefan Weil
@documentlanguage en
6 e080e785 Stefan Weil
@documentencoding UTF-8
7 e080e785 Stefan Weil
8 8f40c388 bellard
@settitle QEMU Emulator User Documentation
9 debc7065 bellard
@exampleindent 0
10 debc7065 bellard
@paragraphindent 0
11 debc7065 bellard
@c %**end of header
12 386405f7 bellard
13 a1a32b05 Stefan Weil
@ifinfo
14 a1a32b05 Stefan Weil
@direntry
15 a1a32b05 Stefan Weil
* QEMU: (qemu-doc).    The QEMU Emulator User Documentation.
16 a1a32b05 Stefan Weil
@end direntry
17 a1a32b05 Stefan Weil
@end ifinfo
18 a1a32b05 Stefan Weil
19 0806e3f6 bellard
@iftex
20 386405f7 bellard
@titlepage
21 386405f7 bellard
@sp 7
22 8f40c388 bellard
@center @titlefont{QEMU Emulator}
23 debc7065 bellard
@sp 1
24 debc7065 bellard
@center @titlefont{User Documentation}
25 386405f7 bellard
@sp 3
26 386405f7 bellard
@end titlepage
27 0806e3f6 bellard
@end iftex
28 386405f7 bellard
29 debc7065 bellard
@ifnottex
30 debc7065 bellard
@node Top
31 debc7065 bellard
@top
32 debc7065 bellard
33 debc7065 bellard
@menu
34 debc7065 bellard
* Introduction::
35 debc7065 bellard
* Installation::
36 debc7065 bellard
* QEMU PC System emulator::
37 debc7065 bellard
* QEMU System emulator for non PC targets::
38 83195237 bellard
* QEMU User space emulator::
39 debc7065 bellard
* compilation:: Compilation from the sources
40 7544a042 Stefan Weil
* License::
41 debc7065 bellard
* Index::
42 debc7065 bellard
@end menu
43 debc7065 bellard
@end ifnottex
44 debc7065 bellard
45 debc7065 bellard
@contents
46 debc7065 bellard
47 debc7065 bellard
@node Introduction
48 386405f7 bellard
@chapter Introduction
49 386405f7 bellard
50 debc7065 bellard
@menu
51 debc7065 bellard
* intro_features:: Features
52 debc7065 bellard
@end menu
53 debc7065 bellard
54 debc7065 bellard
@node intro_features
55 322d0c66 bellard
@section Features
56 386405f7 bellard
57 1f673135 bellard
QEMU is a FAST! processor emulator using dynamic translation to
58 1f673135 bellard
achieve good emulation speed.
59 1eb20527 bellard
60 1eb20527 bellard
QEMU has two operating modes:
61 0806e3f6 bellard
62 d7e5edca Stefan Weil
@itemize
63 7544a042 Stefan Weil
@cindex operating modes
64 0806e3f6 bellard
65 5fafdf24 ths
@item
66 7544a042 Stefan Weil
@cindex system emulation
67 1f673135 bellard
Full system emulation. In this mode, QEMU emulates a full system (for
68 3f9f3aa1 bellard
example a PC), including one or several processors and various
69 3f9f3aa1 bellard
peripherals. It can be used to launch different Operating Systems
70 3f9f3aa1 bellard
without rebooting the PC or to debug system code.
71 1eb20527 bellard
72 5fafdf24 ths
@item
73 7544a042 Stefan Weil
@cindex user mode emulation
74 83195237 bellard
User mode emulation. In this mode, QEMU can launch
75 83195237 bellard
processes compiled for one CPU on another CPU. It can be used to
76 1f673135 bellard
launch the Wine Windows API emulator (@url{http://www.winehq.org}) or
77 1f673135 bellard
to ease cross-compilation and cross-debugging.
78 1eb20527 bellard
79 1eb20527 bellard
@end itemize
80 1eb20527 bellard
81 e1b4382c Stefan Weil
QEMU can run without a host kernel driver and yet gives acceptable
82 5fafdf24 ths
performance.
83 322d0c66 bellard
84 52c00a5f bellard
For system emulation, the following hardware targets are supported:
85 52c00a5f bellard
@itemize
86 7544a042 Stefan Weil
@cindex emulated target systems
87 7544a042 Stefan Weil
@cindex supported target systems
88 9d0a8e6f bellard
@item PC (x86 or x86_64 processor)
89 3f9f3aa1 bellard
@item ISA PC (old style PC without PCI bus)
90 52c00a5f bellard
@item PREP (PowerPC processor)
91 d45952a0 aurel32
@item G3 Beige PowerMac (PowerPC processor)
92 9d0a8e6f bellard
@item Mac99 PowerMac (PowerPC processor, in progress)
93 ee76f82e blueswir1
@item Sun4m/Sun4c/Sun4d (32-bit Sparc processor)
94 c7ba218d blueswir1
@item Sun4u/Sun4v (64-bit Sparc processor, in progress)
95 d9aedc32 ths
@item Malta board (32-bit and 64-bit MIPS processors)
96 88cb0a02 aurel32
@item MIPS Magnum (64-bit MIPS processor)
97 9ee6e8bb pbrook
@item ARM Integrator/CP (ARM)
98 9ee6e8bb pbrook
@item ARM Versatile baseboard (ARM)
99 0ef849d7 Paul Brook
@item ARM RealView Emulation/Platform baseboard (ARM)
100 ef4c3856 balrog
@item Spitz, Akita, Borzoi, Terrier and Tosa PDAs (PXA270 processor)
101 9ee6e8bb pbrook
@item Luminary Micro LM3S811EVB (ARM Cortex-M3)
102 9ee6e8bb pbrook
@item Luminary Micro LM3S6965EVB (ARM Cortex-M3)
103 707e011b pbrook
@item Freescale MCF5208EVB (ColdFire V2).
104 209a4e69 pbrook
@item Arnewsh MCF5206 evaluation board (ColdFire V2).
105 02645926 balrog
@item Palm Tungsten|E PDA (OMAP310 processor)
106 c30bb264 balrog
@item N800 and N810 tablets (OMAP2420 processor)
107 57cd6e97 balrog
@item MusicPal (MV88W8618 ARM processor)
108 ef4c3856 balrog
@item Gumstix "Connex" and "Verdex" motherboards (PXA255/270).
109 ef4c3856 balrog
@item Siemens SX1 smartphone (OMAP310 processor)
110 48c50a62 Edgar E. Iglesias
@item AXIS-Devboard88 (CRISv32 ETRAX-FS).
111 48c50a62 Edgar E. Iglesias
@item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
112 3aeaea65 Max Filippov
@item Avnet LX60/LX110/LX200 boards (Xtensa)
113 52c00a5f bellard
@end itemize
114 386405f7 bellard
115 7544a042 Stefan Weil
@cindex supported user mode targets
116 7544a042 Stefan Weil
For user emulation, x86 (32 and 64 bit), PowerPC (32 and 64 bit),
117 7544a042 Stefan Weil
ARM, MIPS (32 bit only), Sparc (32 and 64 bit),
118 7544a042 Stefan Weil
Alpha, ColdFire(m68k), CRISv32 and MicroBlaze CPUs are supported.
119 0806e3f6 bellard
120 debc7065 bellard
@node Installation
121 5b9f457a bellard
@chapter Installation
122 5b9f457a bellard
123 15a34c63 bellard
If you want to compile QEMU yourself, see @ref{compilation}.
124 15a34c63 bellard
125 debc7065 bellard
@menu
126 debc7065 bellard
* install_linux::   Linux
127 debc7065 bellard
* install_windows:: Windows
128 debc7065 bellard
* install_mac::     Macintosh
129 debc7065 bellard
@end menu
130 debc7065 bellard
131 debc7065 bellard
@node install_linux
132 1f673135 bellard
@section Linux
133 7544a042 Stefan Weil
@cindex installation (Linux)
134 1f673135 bellard
135 7c3fc84d bellard
If a precompiled package is available for your distribution - you just
136 7c3fc84d bellard
have to install it. Otherwise, see @ref{compilation}.
137 5b9f457a bellard
138 debc7065 bellard
@node install_windows
139 1f673135 bellard
@section Windows
140 7544a042 Stefan Weil
@cindex installation (Windows)
141 8cd0ac2f bellard
142 15a34c63 bellard
Download the experimental binary installer at
143 debc7065 bellard
@url{http://www.free.oszoo.org/@/download.html}.
144 7544a042 Stefan Weil
TODO (no longer available)
145 d691f669 bellard
146 debc7065 bellard
@node install_mac
147 1f673135 bellard
@section Mac OS X
148 d691f669 bellard
149 15a34c63 bellard
Download the experimental binary installer at
150 debc7065 bellard
@url{http://www.free.oszoo.org/@/download.html}.
151 7544a042 Stefan Weil
TODO (no longer available)
152 df0f11a0 bellard
153 debc7065 bellard
@node QEMU PC System emulator
154 3f9f3aa1 bellard
@chapter QEMU PC System emulator
155 7544a042 Stefan Weil
@cindex system emulation (PC)
156 1eb20527 bellard
157 debc7065 bellard
@menu
158 debc7065 bellard
* pcsys_introduction:: Introduction
159 debc7065 bellard
* pcsys_quickstart::   Quick Start
160 debc7065 bellard
* sec_invocation::     Invocation
161 debc7065 bellard
* pcsys_keys::         Keys
162 debc7065 bellard
* pcsys_monitor::      QEMU Monitor
163 debc7065 bellard
* disk_images::        Disk Images
164 debc7065 bellard
* pcsys_network::      Network emulation
165 576fd0a1 Stefan Weil
* pcsys_other_devs::   Other Devices
166 debc7065 bellard
* direct_linux_boot::  Direct Linux Boot
167 debc7065 bellard
* pcsys_usb::          USB emulation
168 f858dcae ths
* vnc_security::       VNC security
169 debc7065 bellard
* gdb_usage::          GDB usage
170 debc7065 bellard
* pcsys_os_specific::  Target OS specific information
171 debc7065 bellard
@end menu
172 debc7065 bellard
173 debc7065 bellard
@node pcsys_introduction
174 0806e3f6 bellard
@section Introduction
175 0806e3f6 bellard
176 0806e3f6 bellard
@c man begin DESCRIPTION
177 0806e3f6 bellard
178 3f9f3aa1 bellard
The QEMU PC System emulator simulates the
179 3f9f3aa1 bellard
following peripherals:
180 0806e3f6 bellard
181 0806e3f6 bellard
@itemize @minus
182 5fafdf24 ths
@item
183 15a34c63 bellard
i440FX host PCI bridge and PIIX3 PCI to ISA bridge
184 0806e3f6 bellard
@item
185 15a34c63 bellard
Cirrus CLGD 5446 PCI VGA card or dummy VGA card with Bochs VESA
186 15a34c63 bellard
extensions (hardware level, including all non standard modes).
187 0806e3f6 bellard
@item
188 0806e3f6 bellard
PS/2 mouse and keyboard
189 5fafdf24 ths
@item
190 15a34c63 bellard
2 PCI IDE interfaces with hard disk and CD-ROM support
191 1f673135 bellard
@item
192 1f673135 bellard
Floppy disk
193 5fafdf24 ths
@item
194 3a2eeac0 Stefan Weil
PCI and ISA network adapters
195 0806e3f6 bellard
@item
196 05d5818c bellard
Serial ports
197 05d5818c bellard
@item
198 c0fe3827 bellard
Creative SoundBlaster 16 sound card
199 c0fe3827 bellard
@item
200 c0fe3827 bellard
ENSONIQ AudioPCI ES1370 sound card
201 c0fe3827 bellard
@item
202 e5c9a13e balrog
Intel 82801AA AC97 Audio compatible sound card
203 e5c9a13e balrog
@item
204 7d72e762 Gerd Hoffmann
Intel HD Audio Controller and HDA codec
205 7d72e762 Gerd Hoffmann
@item
206 2d983446 Stefan Weil
Adlib (OPL2) - Yamaha YM3812 compatible chip
207 b389dbfb bellard
@item
208 26463dbc balrog
Gravis Ultrasound GF1 sound card
209 26463dbc balrog
@item
210 cc53d26d malc
CS4231A compatible sound card
211 cc53d26d malc
@item
212 b389dbfb bellard
PCI UHCI USB controller and a virtual USB hub.
213 0806e3f6 bellard
@end itemize
214 0806e3f6 bellard
215 3f9f3aa1 bellard
SMP is supported with up to 255 CPUs.
216 3f9f3aa1 bellard
217 a8ad4159 Michael Tokarev
QEMU uses the PC BIOS from the Seabios project and the Plex86/Bochs LGPL
218 15a34c63 bellard
VGA BIOS.
219 15a34c63 bellard
220 c0fe3827 bellard
QEMU uses YM3812 emulation by Tatsuyuki Satoh.
221 c0fe3827 bellard
222 2d983446 Stefan Weil
QEMU uses GUS emulation (GUSEMU32 @url{http://www.deinmeister.de/gusemu/})
223 26463dbc balrog
by Tibor "TS" Schรผtz.
224 423d65f4 balrog
225 1a1a0e20 Bernhard Reutner-Fischer
Note that, by default, GUS shares IRQ(7) with parallel ports and so
226 b65ee4fa Stefan Weil
QEMU must be told to not have parallel ports to have working GUS.
227 720036a5 malc
228 720036a5 malc
@example
229 3804da9d Stefan Weil
qemu-system-i386 dos.img -soundhw gus -parallel none
230 720036a5 malc
@end example
231 720036a5 malc
232 720036a5 malc
Alternatively:
233 720036a5 malc
@example
234 3804da9d Stefan Weil
qemu-system-i386 dos.img -device gus,irq=5
235 720036a5 malc
@end example
236 720036a5 malc
237 720036a5 malc
Or some other unclaimed IRQ.
238 720036a5 malc
239 cc53d26d malc
CS4231A is the chip used in Windows Sound System and GUSMAX products
240 cc53d26d malc
241 0806e3f6 bellard
@c man end
242 0806e3f6 bellard
243 debc7065 bellard
@node pcsys_quickstart
244 1eb20527 bellard
@section Quick Start
245 7544a042 Stefan Weil
@cindex quick start
246 1eb20527 bellard
247 285dc330 bellard
Download and uncompress the linux image (@file{linux.img}) and type:
248 0806e3f6 bellard
249 0806e3f6 bellard
@example
250 3804da9d Stefan Weil
qemu-system-i386 linux.img
251 0806e3f6 bellard
@end example
252 0806e3f6 bellard
253 0806e3f6 bellard
Linux should boot and give you a prompt.
254 0806e3f6 bellard
255 6cc721cf bellard
@node sec_invocation
256 ec410fc9 bellard
@section Invocation
257 ec410fc9 bellard
258 ec410fc9 bellard
@example
259 0806e3f6 bellard
@c man begin SYNOPSIS
260 3804da9d Stefan Weil
usage: qemu-system-i386 [options] [@var{disk_image}]
261 0806e3f6 bellard
@c man end
262 ec410fc9 bellard
@end example
263 ec410fc9 bellard
264 0806e3f6 bellard
@c man begin OPTIONS
265 d2c639d6 blueswir1
@var{disk_image} is a raw hard disk image for IDE hard disk 0. Some
266 d2c639d6 blueswir1
targets do not need a disk image.
267 ec410fc9 bellard
268 5824d651 blueswir1
@include qemu-options.texi
269 ec410fc9 bellard
270 3e11db9a bellard
@c man end
271 3e11db9a bellard
272 debc7065 bellard
@node pcsys_keys
273 3e11db9a bellard
@section Keys
274 3e11db9a bellard
275 3e11db9a bellard
@c man begin OPTIONS
276 3e11db9a bellard
277 de1db2a1 Brad Hards
During the graphical emulation, you can use special key combinations to change
278 de1db2a1 Brad Hards
modes. The default key mappings are shown below, but if you use @code{-alt-grab}
279 de1db2a1 Brad Hards
then the modifier is Ctrl-Alt-Shift (instead of Ctrl-Alt) and if you use
280 de1db2a1 Brad Hards
@code{-ctrl-grab} then the modifier is the right Ctrl key (instead of Ctrl-Alt):
281 de1db2a1 Brad Hards
282 a1b74fe8 bellard
@table @key
283 f9859310 bellard
@item Ctrl-Alt-f
284 7544a042 Stefan Weil
@kindex Ctrl-Alt-f
285 a1b74fe8 bellard
Toggle full screen
286 a0a821a4 bellard
287 d6a65ba3 Jan Kiszka
@item Ctrl-Alt-+
288 d6a65ba3 Jan Kiszka
@kindex Ctrl-Alt-+
289 d6a65ba3 Jan Kiszka
Enlarge the screen
290 d6a65ba3 Jan Kiszka
291 d6a65ba3 Jan Kiszka
@item Ctrl-Alt--
292 d6a65ba3 Jan Kiszka
@kindex Ctrl-Alt--
293 d6a65ba3 Jan Kiszka
Shrink the screen
294 d6a65ba3 Jan Kiszka
295 c4a735f9 malc
@item Ctrl-Alt-u
296 7544a042 Stefan Weil
@kindex Ctrl-Alt-u
297 c4a735f9 malc
Restore the screen's un-scaled dimensions
298 c4a735f9 malc
299 f9859310 bellard
@item Ctrl-Alt-n
300 7544a042 Stefan Weil
@kindex Ctrl-Alt-n
301 a0a821a4 bellard
Switch to virtual console 'n'. Standard console mappings are:
302 a0a821a4 bellard
@table @emph
303 a0a821a4 bellard
@item 1
304 a0a821a4 bellard
Target system display
305 a0a821a4 bellard
@item 2
306 a0a821a4 bellard
Monitor
307 a0a821a4 bellard
@item 3
308 a0a821a4 bellard
Serial port
309 a1b74fe8 bellard
@end table
310 a1b74fe8 bellard
311 f9859310 bellard
@item Ctrl-Alt
312 7544a042 Stefan Weil
@kindex Ctrl-Alt
313 a0a821a4 bellard
Toggle mouse and keyboard grab.
314 a0a821a4 bellard
@end table
315 a0a821a4 bellard
316 7544a042 Stefan Weil
@kindex Ctrl-Up
317 7544a042 Stefan Weil
@kindex Ctrl-Down
318 7544a042 Stefan Weil
@kindex Ctrl-PageUp
319 7544a042 Stefan Weil
@kindex Ctrl-PageDown
320 3e11db9a bellard
In the virtual consoles, you can use @key{Ctrl-Up}, @key{Ctrl-Down},
321 3e11db9a bellard
@key{Ctrl-PageUp} and @key{Ctrl-PageDown} to move in the back log.
322 3e11db9a bellard
323 7544a042 Stefan Weil
@kindex Ctrl-a h
324 a0a821a4 bellard
During emulation, if you are using the @option{-nographic} option, use
325 a0a821a4 bellard
@key{Ctrl-a h} to get terminal commands:
326 ec410fc9 bellard
327 ec410fc9 bellard
@table @key
328 a1b74fe8 bellard
@item Ctrl-a h
329 7544a042 Stefan Weil
@kindex Ctrl-a h
330 d2c639d6 blueswir1
@item Ctrl-a ?
331 7544a042 Stefan Weil
@kindex Ctrl-a ?
332 ec410fc9 bellard
Print this help
333 3b46e624 ths
@item Ctrl-a x
334 7544a042 Stefan Weil
@kindex Ctrl-a x
335 366dfc52 ths
Exit emulator
336 3b46e624 ths
@item Ctrl-a s
337 7544a042 Stefan Weil
@kindex Ctrl-a s
338 1f47a922 bellard
Save disk data back to file (if -snapshot)
339 20d8a3ed ths
@item Ctrl-a t
340 7544a042 Stefan Weil
@kindex Ctrl-a t
341 d2c639d6 blueswir1
Toggle console timestamps
342 a1b74fe8 bellard
@item Ctrl-a b
343 7544a042 Stefan Weil
@kindex Ctrl-a b
344 1f673135 bellard
Send break (magic sysrq in Linux)
345 a1b74fe8 bellard
@item Ctrl-a c
346 7544a042 Stefan Weil
@kindex Ctrl-a c
347 1f673135 bellard
Switch between console and monitor
348 a1b74fe8 bellard
@item Ctrl-a Ctrl-a
349 7544a042 Stefan Weil
@kindex Ctrl-a a
350 a1b74fe8 bellard
Send Ctrl-a
351 ec410fc9 bellard
@end table
352 0806e3f6 bellard
@c man end
353 0806e3f6 bellard
354 0806e3f6 bellard
@ignore
355 0806e3f6 bellard
356 1f673135 bellard
@c man begin SEEALSO
357 1f673135 bellard
The HTML documentation of QEMU for more precise information and Linux
358 1f673135 bellard
user mode emulator invocation.
359 1f673135 bellard
@c man end
360 1f673135 bellard
361 1f673135 bellard
@c man begin AUTHOR
362 1f673135 bellard
Fabrice Bellard
363 1f673135 bellard
@c man end
364 1f673135 bellard
365 1f673135 bellard
@end ignore
366 1f673135 bellard
367 debc7065 bellard
@node pcsys_monitor
368 1f673135 bellard
@section QEMU Monitor
369 7544a042 Stefan Weil
@cindex QEMU monitor
370 1f673135 bellard
371 1f673135 bellard
The QEMU monitor is used to give complex commands to the QEMU
372 1f673135 bellard
emulator. You can use it to:
373 1f673135 bellard
374 1f673135 bellard
@itemize @minus
375 1f673135 bellard
376 1f673135 bellard
@item
377 e598752a ths
Remove or insert removable media images
378 89dfe898 ths
(such as CD-ROM or floppies).
379 1f673135 bellard
380 5fafdf24 ths
@item
381 1f673135 bellard
Freeze/unfreeze the Virtual Machine (VM) and save or restore its state
382 1f673135 bellard
from a disk file.
383 1f673135 bellard
384 1f673135 bellard
@item Inspect the VM state without an external debugger.
385 1f673135 bellard
386 1f673135 bellard
@end itemize
387 1f673135 bellard
388 1f673135 bellard
@subsection Commands
389 1f673135 bellard
390 1f673135 bellard
The following commands are available:
391 1f673135 bellard
392 2313086a Blue Swirl
@include qemu-monitor.texi
393 0806e3f6 bellard
394 1f673135 bellard
@subsection Integer expressions
395 1f673135 bellard
396 1f673135 bellard
The monitor understands integers expressions for every integer
397 1f673135 bellard
argument. You can use register names to get the value of specifics
398 1f673135 bellard
CPU registers by prefixing them with @emph{$}.
399 ec410fc9 bellard
400 1f47a922 bellard
@node disk_images
401 1f47a922 bellard
@section Disk Images
402 1f47a922 bellard
403 acd935ef bellard
Since version 0.6.1, QEMU supports many disk image formats, including
404 acd935ef bellard
growable disk images (their size increase as non empty sectors are
405 13a2e80f bellard
written), compressed and encrypted disk images. Version 0.8.3 added
406 13a2e80f bellard
the new qcow2 disk image format which is essential to support VM
407 13a2e80f bellard
snapshots.
408 1f47a922 bellard
409 debc7065 bellard
@menu
410 debc7065 bellard
* disk_images_quickstart::    Quick start for disk image creation
411 debc7065 bellard
* disk_images_snapshot_mode:: Snapshot mode
412 13a2e80f bellard
* vm_snapshots::              VM snapshots
413 debc7065 bellard
* qemu_img_invocation::       qemu-img Invocation
414 975b092b ths
* qemu_nbd_invocation::       qemu-nbd Invocation
415 d3067b02 Kevin Wolf
* disk_images_formats::       Disk image file formats
416 19cb3738 bellard
* host_drives::               Using host drives
417 debc7065 bellard
* disk_images_fat_images::    Virtual FAT disk images
418 75818250 ths
* disk_images_nbd::           NBD access
419 42af9c30 MORITA Kazutaka
* disk_images_sheepdog::      Sheepdog disk images
420 00984e39 Ronnie Sahlberg
* disk_images_iscsi::         iSCSI LUNs
421 8809e289 Bharata B Rao
* disk_images_gluster::       GlusterFS disk images
422 0a12ec87 Richard W.M. Jones
* disk_images_ssh::           Secure Shell (ssh) disk images
423 debc7065 bellard
@end menu
424 debc7065 bellard
425 debc7065 bellard
@node disk_images_quickstart
426 acd935ef bellard
@subsection Quick start for disk image creation
427 acd935ef bellard
428 acd935ef bellard
You can create a disk image with the command:
429 1f47a922 bellard
@example
430 acd935ef bellard
qemu-img create myimage.img mysize
431 1f47a922 bellard
@end example
432 acd935ef bellard
where @var{myimage.img} is the disk image filename and @var{mysize} is its
433 acd935ef bellard
size in kilobytes. You can add an @code{M} suffix to give the size in
434 acd935ef bellard
megabytes and a @code{G} suffix for gigabytes.
435 acd935ef bellard
436 debc7065 bellard
See @ref{qemu_img_invocation} for more information.
437 1f47a922 bellard
438 debc7065 bellard
@node disk_images_snapshot_mode
439 1f47a922 bellard
@subsection Snapshot mode
440 1f47a922 bellard
441 1f47a922 bellard
If you use the option @option{-snapshot}, all disk images are
442 1f47a922 bellard
considered as read only. When sectors in written, they are written in
443 1f47a922 bellard
a temporary file created in @file{/tmp}. You can however force the
444 acd935ef bellard
write back to the raw disk images by using the @code{commit} monitor
445 acd935ef bellard
command (or @key{C-a s} in the serial console).
446 1f47a922 bellard
447 13a2e80f bellard
@node vm_snapshots
448 13a2e80f bellard
@subsection VM snapshots
449 13a2e80f bellard
450 13a2e80f bellard
VM snapshots are snapshots of the complete virtual machine including
451 13a2e80f bellard
CPU state, RAM, device state and the content of all the writable
452 13a2e80f bellard
disks. In order to use VM snapshots, you must have at least one non
453 13a2e80f bellard
removable and writable block device using the @code{qcow2} disk image
454 13a2e80f bellard
format. Normally this device is the first virtual hard drive.
455 13a2e80f bellard
456 13a2e80f bellard
Use the monitor command @code{savevm} to create a new VM snapshot or
457 13a2e80f bellard
replace an existing one. A human readable name can be assigned to each
458 19d36792 bellard
snapshot in addition to its numerical ID.
459 13a2e80f bellard
460 13a2e80f bellard
Use @code{loadvm} to restore a VM snapshot and @code{delvm} to remove
461 13a2e80f bellard
a VM snapshot. @code{info snapshots} lists the available snapshots
462 13a2e80f bellard
with their associated information:
463 13a2e80f bellard
464 13a2e80f bellard
@example
465 13a2e80f bellard
(qemu) info snapshots
466 13a2e80f bellard
Snapshot devices: hda
467 13a2e80f bellard
Snapshot list (from hda):
468 13a2e80f bellard
ID        TAG                 VM SIZE                DATE       VM CLOCK
469 13a2e80f bellard
1         start                   41M 2006-08-06 12:38:02   00:00:14.954
470 13a2e80f bellard
2                                 40M 2006-08-06 12:43:29   00:00:18.633
471 13a2e80f bellard
3         msys                    40M 2006-08-06 12:44:04   00:00:23.514
472 13a2e80f bellard
@end example
473 13a2e80f bellard
474 13a2e80f bellard
A VM snapshot is made of a VM state info (its size is shown in
475 13a2e80f bellard
@code{info snapshots}) and a snapshot of every writable disk image.
476 13a2e80f bellard
The VM state info is stored in the first @code{qcow2} non removable
477 13a2e80f bellard
and writable block device. The disk image snapshots are stored in
478 13a2e80f bellard
every disk image. The size of a snapshot in a disk image is difficult
479 13a2e80f bellard
to evaluate and is not shown by @code{info snapshots} because the
480 13a2e80f bellard
associated disk sectors are shared among all the snapshots to save
481 19d36792 bellard
disk space (otherwise each snapshot would need a full copy of all the
482 19d36792 bellard
disk images).
483 13a2e80f bellard
484 13a2e80f bellard
When using the (unrelated) @code{-snapshot} option
485 13a2e80f bellard
(@ref{disk_images_snapshot_mode}), you can always make VM snapshots,
486 13a2e80f bellard
but they are deleted as soon as you exit QEMU.
487 13a2e80f bellard
488 13a2e80f bellard
VM snapshots currently have the following known limitations:
489 13a2e80f bellard
@itemize
490 5fafdf24 ths
@item
491 13a2e80f bellard
They cannot cope with removable devices if they are removed or
492 13a2e80f bellard
inserted after a snapshot is done.
493 5fafdf24 ths
@item
494 13a2e80f bellard
A few device drivers still have incomplete snapshot support so their
495 13a2e80f bellard
state is not saved or restored properly (in particular USB).
496 13a2e80f bellard
@end itemize
497 13a2e80f bellard
498 acd935ef bellard
@node qemu_img_invocation
499 acd935ef bellard
@subsection @code{qemu-img} Invocation
500 1f47a922 bellard
501 acd935ef bellard
@include qemu-img.texi
502 05efe46e bellard
503 975b092b ths
@node qemu_nbd_invocation
504 975b092b ths
@subsection @code{qemu-nbd} Invocation
505 975b092b ths
506 975b092b ths
@include qemu-nbd.texi
507 975b092b ths
508 d3067b02 Kevin Wolf
@node disk_images_formats
509 d3067b02 Kevin Wolf
@subsection Disk image file formats
510 d3067b02 Kevin Wolf
511 d3067b02 Kevin Wolf
QEMU supports many image file formats that can be used with VMs as well as with
512 d3067b02 Kevin Wolf
any of the tools (like @code{qemu-img}). This includes the preferred formats
513 d3067b02 Kevin Wolf
raw and qcow2 as well as formats that are supported for compatibility with
514 d3067b02 Kevin Wolf
older QEMU versions or other hypervisors.
515 d3067b02 Kevin Wolf
516 d3067b02 Kevin Wolf
Depending on the image format, different options can be passed to
517 d3067b02 Kevin Wolf
@code{qemu-img create} and @code{qemu-img convert} using the @code{-o} option.
518 d3067b02 Kevin Wolf
This section describes each format and the options that are supported for it.
519 d3067b02 Kevin Wolf
520 d3067b02 Kevin Wolf
@table @option
521 d3067b02 Kevin Wolf
@item raw
522 d3067b02 Kevin Wolf
523 d3067b02 Kevin Wolf
Raw disk image format. This format has the advantage of
524 d3067b02 Kevin Wolf
being simple and easily exportable to all other emulators. If your
525 d3067b02 Kevin Wolf
file system supports @emph{holes} (for example in ext2 or ext3 on
526 d3067b02 Kevin Wolf
Linux or NTFS on Windows), then only the written sectors will reserve
527 d3067b02 Kevin Wolf
space. Use @code{qemu-img info} to know the real size used by the
528 d3067b02 Kevin Wolf
image or @code{ls -ls} on Unix/Linux.
529 d3067b02 Kevin Wolf
530 d3067b02 Kevin Wolf
@item qcow2
531 d3067b02 Kevin Wolf
QEMU image format, the most versatile format. Use it to have smaller
532 d3067b02 Kevin Wolf
images (useful if your filesystem does not supports holes, for example
533 d3067b02 Kevin Wolf
on Windows), optional AES encryption, zlib based compression and
534 d3067b02 Kevin Wolf
support of multiple VM snapshots.
535 d3067b02 Kevin Wolf
536 d3067b02 Kevin Wolf
Supported options:
537 d3067b02 Kevin Wolf
@table @code
538 d3067b02 Kevin Wolf
@item compat
539 7fa9e1f9 Stefan Hajnoczi
Determines the qcow2 version to use. @code{compat=0.10} uses the
540 7fa9e1f9 Stefan Hajnoczi
traditional image format that can be read by any QEMU since 0.10.
541 d3067b02 Kevin Wolf
@code{compat=1.1} enables image format extensions that only QEMU 1.1 and
542 7fa9e1f9 Stefan Hajnoczi
newer understand (this is the default). Amongst others, this includes
543 7fa9e1f9 Stefan Hajnoczi
zero clusters, which allow efficient copy-on-read for sparse images.
544 d3067b02 Kevin Wolf
545 d3067b02 Kevin Wolf
@item backing_file
546 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand)
547 d3067b02 Kevin Wolf
@item backing_fmt
548 d3067b02 Kevin Wolf
Image format of the base image
549 d3067b02 Kevin Wolf
@item encryption
550 d3067b02 Kevin Wolf
If this option is set to @code{on}, the image is encrypted.
551 d3067b02 Kevin Wolf
552 d3067b02 Kevin Wolf
Encryption uses the AES format which is very secure (128 bit keys). Use
553 d3067b02 Kevin Wolf
a long password (16 characters) to get maximum protection.
554 d3067b02 Kevin Wolf
555 d3067b02 Kevin Wolf
@item cluster_size
556 d3067b02 Kevin Wolf
Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
557 d3067b02 Kevin Wolf
sizes can improve the image file size whereas larger cluster sizes generally
558 d3067b02 Kevin Wolf
provide better performance.
559 d3067b02 Kevin Wolf
560 d3067b02 Kevin Wolf
@item preallocation
561 d3067b02 Kevin Wolf
Preallocation mode (allowed values: off, metadata). An image with preallocated
562 d3067b02 Kevin Wolf
metadata is initially larger but can improve performance when the image needs
563 d3067b02 Kevin Wolf
to grow.
564 d3067b02 Kevin Wolf
565 d3067b02 Kevin Wolf
@item lazy_refcounts
566 d3067b02 Kevin Wolf
If this option is set to @code{on}, reference count updates are postponed with
567 d3067b02 Kevin Wolf
the goal of avoiding metadata I/O and improving performance. This is
568 d3067b02 Kevin Wolf
particularly interesting with @option{cache=writethrough} which doesn't batch
569 d3067b02 Kevin Wolf
metadata updates. The tradeoff is that after a host crash, the reference count
570 d3067b02 Kevin Wolf
tables must be rebuilt, i.e. on the next open an (automatic) @code{qemu-img
571 d3067b02 Kevin Wolf
check -r all} is required, which may take some time.
572 d3067b02 Kevin Wolf
573 d3067b02 Kevin Wolf
This option can only be enabled if @code{compat=1.1} is specified.
574 d3067b02 Kevin Wolf
575 d3067b02 Kevin Wolf
@end table
576 d3067b02 Kevin Wolf
577 d3067b02 Kevin Wolf
@item qed
578 d3067b02 Kevin Wolf
Old QEMU image format with support for backing files and compact image files
579 d3067b02 Kevin Wolf
(when your filesystem or transport medium does not support holes).
580 d3067b02 Kevin Wolf
581 d3067b02 Kevin Wolf
When converting QED images to qcow2, you might want to consider using the
582 d3067b02 Kevin Wolf
@code{lazy_refcounts=on} option to get a more QED-like behaviour.
583 d3067b02 Kevin Wolf
584 d3067b02 Kevin Wolf
Supported options:
585 d3067b02 Kevin Wolf
@table @code
586 d3067b02 Kevin Wolf
@item backing_file
587 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand).
588 d3067b02 Kevin Wolf
@item backing_fmt
589 d3067b02 Kevin Wolf
Image file format of backing file (optional).  Useful if the format cannot be
590 d3067b02 Kevin Wolf
autodetected because it has no header, like some vhd/vpc files.
591 d3067b02 Kevin Wolf
@item cluster_size
592 d3067b02 Kevin Wolf
Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
593 d3067b02 Kevin Wolf
cluster sizes can improve the image file size whereas larger cluster sizes
594 d3067b02 Kevin Wolf
generally provide better performance.
595 d3067b02 Kevin Wolf
@item table_size
596 d3067b02 Kevin Wolf
Changes the number of clusters per L1/L2 table (must be power-of-2 between 1
597 d3067b02 Kevin Wolf
and 16).  There is normally no need to change this value but this option can be
598 d3067b02 Kevin Wolf
used for performance benchmarking.
599 d3067b02 Kevin Wolf
@end table
600 d3067b02 Kevin Wolf
601 d3067b02 Kevin Wolf
@item qcow
602 d3067b02 Kevin Wolf
Old QEMU image format with support for backing files, compact image files,
603 d3067b02 Kevin Wolf
encryption and compression.
604 d3067b02 Kevin Wolf
605 d3067b02 Kevin Wolf
Supported options:
606 d3067b02 Kevin Wolf
@table @code
607 d3067b02 Kevin Wolf
@item backing_file
608 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand)
609 d3067b02 Kevin Wolf
@item encryption
610 d3067b02 Kevin Wolf
If this option is set to @code{on}, the image is encrypted.
611 d3067b02 Kevin Wolf
@end table
612 d3067b02 Kevin Wolf
613 d3067b02 Kevin Wolf
@item cow
614 d3067b02 Kevin Wolf
User Mode Linux Copy On Write image format. It is supported only for
615 d3067b02 Kevin Wolf
compatibility with previous versions.
616 d3067b02 Kevin Wolf
Supported options:
617 d3067b02 Kevin Wolf
@table @code
618 d3067b02 Kevin Wolf
@item backing_file
619 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand)
620 d3067b02 Kevin Wolf
@end table
621 d3067b02 Kevin Wolf
622 d3067b02 Kevin Wolf
@item vdi
623 d3067b02 Kevin Wolf
VirtualBox 1.1 compatible image format.
624 d3067b02 Kevin Wolf
Supported options:
625 d3067b02 Kevin Wolf
@table @code
626 d3067b02 Kevin Wolf
@item static
627 d3067b02 Kevin Wolf
If this option is set to @code{on}, the image is created with metadata
628 d3067b02 Kevin Wolf
preallocation.
629 d3067b02 Kevin Wolf
@end table
630 d3067b02 Kevin Wolf
631 d3067b02 Kevin Wolf
@item vmdk
632 d3067b02 Kevin Wolf
VMware 3 and 4 compatible image format.
633 d3067b02 Kevin Wolf
634 d3067b02 Kevin Wolf
Supported options:
635 d3067b02 Kevin Wolf
@table @code
636 d3067b02 Kevin Wolf
@item backing_file
637 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand).
638 d3067b02 Kevin Wolf
@item compat6
639 d3067b02 Kevin Wolf
Create a VMDK version 6 image (instead of version 4)
640 d3067b02 Kevin Wolf
@item subformat
641 d3067b02 Kevin Wolf
Specifies which VMDK subformat to use. Valid options are
642 d3067b02 Kevin Wolf
@code{monolithicSparse} (default),
643 d3067b02 Kevin Wolf
@code{monolithicFlat},
644 d3067b02 Kevin Wolf
@code{twoGbMaxExtentSparse},
645 d3067b02 Kevin Wolf
@code{twoGbMaxExtentFlat} and
646 d3067b02 Kevin Wolf
@code{streamOptimized}.
647 d3067b02 Kevin Wolf
@end table
648 d3067b02 Kevin Wolf
649 d3067b02 Kevin Wolf
@item vpc
650 d3067b02 Kevin Wolf
VirtualPC compatible image format (VHD).
651 d3067b02 Kevin Wolf
Supported options:
652 d3067b02 Kevin Wolf
@table @code
653 d3067b02 Kevin Wolf
@item subformat
654 d3067b02 Kevin Wolf
Specifies which VHD subformat to use. Valid options are
655 d3067b02 Kevin Wolf
@code{dynamic} (default) and @code{fixed}.
656 d3067b02 Kevin Wolf
@end table
657 8282db1b Jeff Cody
658 8282db1b Jeff Cody
@item VHDX
659 8282db1b Jeff Cody
Hyper-V compatible image format (VHDX).
660 8282db1b Jeff Cody
Supported options:
661 8282db1b Jeff Cody
@table @code
662 8282db1b Jeff Cody
@item subformat
663 8282db1b Jeff Cody
Specifies which VHDX subformat to use. Valid options are
664 8282db1b Jeff Cody
@code{dynamic} (default) and @code{fixed}.
665 8282db1b Jeff Cody
@item block_state_zero
666 8282db1b Jeff Cody
Force use of payload blocks of type 'ZERO'.
667 8282db1b Jeff Cody
@item block_size
668 8282db1b Jeff Cody
Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on image size.
669 8282db1b Jeff Cody
@item log_size
670 8282db1b Jeff Cody
Log size; min 1 MB.
671 8282db1b Jeff Cody
@end table
672 d3067b02 Kevin Wolf
@end table
673 d3067b02 Kevin Wolf
674 d3067b02 Kevin Wolf
@subsubsection Read-only formats
675 d3067b02 Kevin Wolf
More disk image file formats are supported in a read-only mode.
676 d3067b02 Kevin Wolf
@table @option
677 d3067b02 Kevin Wolf
@item bochs
678 d3067b02 Kevin Wolf
Bochs images of @code{growing} type.
679 d3067b02 Kevin Wolf
@item cloop
680 d3067b02 Kevin Wolf
Linux Compressed Loop image, useful only to reuse directly compressed
681 d3067b02 Kevin Wolf
CD-ROM images present for example in the Knoppix CD-ROMs.
682 d3067b02 Kevin Wolf
@item dmg
683 d3067b02 Kevin Wolf
Apple disk image.
684 d3067b02 Kevin Wolf
@item parallels
685 d3067b02 Kevin Wolf
Parallels disk image format.
686 d3067b02 Kevin Wolf
@end table
687 d3067b02 Kevin Wolf
688 d3067b02 Kevin Wolf
689 19cb3738 bellard
@node host_drives
690 19cb3738 bellard
@subsection Using host drives
691 19cb3738 bellard
692 19cb3738 bellard
In addition to disk image files, QEMU can directly access host
693 19cb3738 bellard
devices. We describe here the usage for QEMU version >= 0.8.3.
694 19cb3738 bellard
695 19cb3738 bellard
@subsubsection Linux
696 19cb3738 bellard
697 19cb3738 bellard
On Linux, you can directly use the host device filename instead of a
698 4be456f1 ths
disk image filename provided you have enough privileges to access
699 19cb3738 bellard
it. For example, use @file{/dev/cdrom} to access to the CDROM or
700 19cb3738 bellard
@file{/dev/fd0} for the floppy.
701 19cb3738 bellard
702 f542086d bellard
@table @code
703 19cb3738 bellard
@item CD
704 19cb3738 bellard
You can specify a CDROM device even if no CDROM is loaded. QEMU has
705 19cb3738 bellard
specific code to detect CDROM insertion or removal. CDROM ejection by
706 19cb3738 bellard
the guest OS is supported. Currently only data CDs are supported.
707 19cb3738 bellard
@item Floppy
708 19cb3738 bellard
You can specify a floppy device even if no floppy is loaded. Floppy
709 19cb3738 bellard
removal is currently not detected accurately (if you change floppy
710 19cb3738 bellard
without doing floppy access while the floppy is not loaded, the guest
711 19cb3738 bellard
OS will think that the same floppy is loaded).
712 19cb3738 bellard
@item Hard disks
713 19cb3738 bellard
Hard disks can be used. Normally you must specify the whole disk
714 19cb3738 bellard
(@file{/dev/hdb} instead of @file{/dev/hdb1}) so that the guest OS can
715 19cb3738 bellard
see it as a partitioned disk. WARNING: unless you know what you do, it
716 19cb3738 bellard
is better to only make READ-ONLY accesses to the hard disk otherwise
717 19cb3738 bellard
you may corrupt your host data (use the @option{-snapshot} command
718 19cb3738 bellard
line option or modify the device permissions accordingly).
719 19cb3738 bellard
@end table
720 19cb3738 bellard
721 19cb3738 bellard
@subsubsection Windows
722 19cb3738 bellard
723 01781963 bellard
@table @code
724 01781963 bellard
@item CD
725 4be456f1 ths
The preferred syntax is the drive letter (e.g. @file{d:}). The
726 01781963 bellard
alternate syntax @file{\\.\d:} is supported. @file{/dev/cdrom} is
727 01781963 bellard
supported as an alias to the first CDROM drive.
728 19cb3738 bellard
729 e598752a ths
Currently there is no specific code to handle removable media, so it
730 19cb3738 bellard
is better to use the @code{change} or @code{eject} monitor commands to
731 19cb3738 bellard
change or eject media.
732 01781963 bellard
@item Hard disks
733 89dfe898 ths
Hard disks can be used with the syntax: @file{\\.\PhysicalDrive@var{N}}
734 01781963 bellard
where @var{N} is the drive number (0 is the first hard disk).
735 01781963 bellard
736 01781963 bellard
WARNING: unless you know what you do, it is better to only make
737 01781963 bellard
READ-ONLY accesses to the hard disk otherwise you may corrupt your
738 01781963 bellard
host data (use the @option{-snapshot} command line so that the
739 01781963 bellard
modifications are written in a temporary file).
740 01781963 bellard
@end table
741 01781963 bellard
742 19cb3738 bellard
743 19cb3738 bellard
@subsubsection Mac OS X
744 19cb3738 bellard
745 5fafdf24 ths
@file{/dev/cdrom} is an alias to the first CDROM.
746 19cb3738 bellard
747 e598752a ths
Currently there is no specific code to handle removable media, so it
748 19cb3738 bellard
is better to use the @code{change} or @code{eject} monitor commands to
749 19cb3738 bellard
change or eject media.
750 19cb3738 bellard
751 debc7065 bellard
@node disk_images_fat_images
752 2c6cadd4 bellard
@subsection Virtual FAT disk images
753 2c6cadd4 bellard
754 2c6cadd4 bellard
QEMU can automatically create a virtual FAT disk image from a
755 2c6cadd4 bellard
directory tree. In order to use it, just type:
756 2c6cadd4 bellard
757 5fafdf24 ths
@example
758 3804da9d Stefan Weil
qemu-system-i386 linux.img -hdb fat:/my_directory
759 2c6cadd4 bellard
@end example
760 2c6cadd4 bellard
761 2c6cadd4 bellard
Then you access access to all the files in the @file{/my_directory}
762 2c6cadd4 bellard
directory without having to copy them in a disk image or to export
763 2c6cadd4 bellard
them via SAMBA or NFS. The default access is @emph{read-only}.
764 2c6cadd4 bellard
765 2c6cadd4 bellard
Floppies can be emulated with the @code{:floppy:} option:
766 2c6cadd4 bellard
767 5fafdf24 ths
@example
768 3804da9d Stefan Weil
qemu-system-i386 linux.img -fda fat:floppy:/my_directory
769 2c6cadd4 bellard
@end example
770 2c6cadd4 bellard
771 2c6cadd4 bellard
A read/write support is available for testing (beta stage) with the
772 2c6cadd4 bellard
@code{:rw:} option:
773 2c6cadd4 bellard
774 5fafdf24 ths
@example
775 3804da9d Stefan Weil
qemu-system-i386 linux.img -fda fat:floppy:rw:/my_directory
776 2c6cadd4 bellard
@end example
777 2c6cadd4 bellard
778 2c6cadd4 bellard
What you should @emph{never} do:
779 2c6cadd4 bellard
@itemize
780 2c6cadd4 bellard
@item use non-ASCII filenames ;
781 2c6cadd4 bellard
@item use "-snapshot" together with ":rw:" ;
782 85b2c688 bellard
@item expect it to work when loadvm'ing ;
783 85b2c688 bellard
@item write to the FAT directory on the host system while accessing it with the guest system.
784 2c6cadd4 bellard
@end itemize
785 2c6cadd4 bellard
786 75818250 ths
@node disk_images_nbd
787 75818250 ths
@subsection NBD access
788 75818250 ths
789 75818250 ths
QEMU can access directly to block device exported using the Network Block Device
790 75818250 ths
protocol.
791 75818250 ths
792 75818250 ths
@example
793 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
794 75818250 ths
@end example
795 75818250 ths
796 75818250 ths
If the NBD server is located on the same host, you can use an unix socket instead
797 75818250 ths
of an inet socket:
798 75818250 ths
799 75818250 ths
@example
800 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux.img -hdb nbd+unix://?socket=/tmp/my_socket
801 75818250 ths
@end example
802 75818250 ths
803 75818250 ths
In this case, the block device must be exported using qemu-nbd:
804 75818250 ths
805 75818250 ths
@example
806 75818250 ths
qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
807 75818250 ths
@end example
808 75818250 ths
809 75818250 ths
The use of qemu-nbd allows to share a disk between several guests:
810 75818250 ths
@example
811 75818250 ths
qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
812 75818250 ths
@end example
813 75818250 ths
814 1d7d2a9d Paolo Bonzini
@noindent
815 75818250 ths
and then you can use it with two guests:
816 75818250 ths
@example
817 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
818 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
819 75818250 ths
@end example
820 75818250 ths
821 1d7d2a9d Paolo Bonzini
If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
822 1d7d2a9d Paolo Bonzini
own embedded NBD server), you must specify an export name in the URI:
823 1d45f8b5 Laurent Vivier
@example
824 1d7d2a9d Paolo Bonzini
qemu-system-i386 -cdrom nbd://localhost/debian-500-ppc-netinst
825 1d7d2a9d Paolo Bonzini
qemu-system-i386 -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
826 1d7d2a9d Paolo Bonzini
@end example
827 1d7d2a9d Paolo Bonzini
828 1d7d2a9d Paolo Bonzini
The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
829 1d7d2a9d Paolo Bonzini
also available.  Here are some example of the older syntax:
830 1d7d2a9d Paolo Bonzini
@example
831 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
832 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux2.img -hdb nbd:unix:/tmp/my_socket
833 1d7d2a9d Paolo Bonzini
qemu-system-i386 -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
834 1d45f8b5 Laurent Vivier
@end example
835 1d45f8b5 Laurent Vivier
836 42af9c30 MORITA Kazutaka
@node disk_images_sheepdog
837 42af9c30 MORITA Kazutaka
@subsection Sheepdog disk images
838 42af9c30 MORITA Kazutaka
839 42af9c30 MORITA Kazutaka
Sheepdog is a distributed storage system for QEMU.  It provides highly
840 42af9c30 MORITA Kazutaka
available block level storage volumes that can be attached to
841 42af9c30 MORITA Kazutaka
QEMU-based virtual machines.
842 42af9c30 MORITA Kazutaka
843 42af9c30 MORITA Kazutaka
You can create a Sheepdog disk image with the command:
844 42af9c30 MORITA Kazutaka
@example
845 5d6768e3 MORITA Kazutaka
qemu-img create sheepdog:///@var{image} @var{size}
846 42af9c30 MORITA Kazutaka
@end example
847 42af9c30 MORITA Kazutaka
where @var{image} is the Sheepdog image name and @var{size} is its
848 42af9c30 MORITA Kazutaka
size.
849 42af9c30 MORITA Kazutaka
850 42af9c30 MORITA Kazutaka
To import the existing @var{filename} to Sheepdog, you can use a
851 42af9c30 MORITA Kazutaka
convert command.
852 42af9c30 MORITA Kazutaka
@example
853 5d6768e3 MORITA Kazutaka
qemu-img convert @var{filename} sheepdog:///@var{image}
854 42af9c30 MORITA Kazutaka
@end example
855 42af9c30 MORITA Kazutaka
856 42af9c30 MORITA Kazutaka
You can boot from the Sheepdog disk image with the command:
857 42af9c30 MORITA Kazutaka
@example
858 5d6768e3 MORITA Kazutaka
qemu-system-i386 sheepdog:///@var{image}
859 42af9c30 MORITA Kazutaka
@end example
860 42af9c30 MORITA Kazutaka
861 42af9c30 MORITA Kazutaka
You can also create a snapshot of the Sheepdog image like qcow2.
862 42af9c30 MORITA Kazutaka
@example
863 5d6768e3 MORITA Kazutaka
qemu-img snapshot -c @var{tag} sheepdog:///@var{image}
864 42af9c30 MORITA Kazutaka
@end example
865 42af9c30 MORITA Kazutaka
where @var{tag} is a tag name of the newly created snapshot.
866 42af9c30 MORITA Kazutaka
867 42af9c30 MORITA Kazutaka
To boot from the Sheepdog snapshot, specify the tag name of the
868 42af9c30 MORITA Kazutaka
snapshot.
869 42af9c30 MORITA Kazutaka
@example
870 5d6768e3 MORITA Kazutaka
qemu-system-i386 sheepdog:///@var{image}#@var{tag}
871 42af9c30 MORITA Kazutaka
@end example
872 42af9c30 MORITA Kazutaka
873 42af9c30 MORITA Kazutaka
You can create a cloned image from the existing snapshot.
874 42af9c30 MORITA Kazutaka
@example
875 5d6768e3 MORITA Kazutaka
qemu-img create -b sheepdog:///@var{base}#@var{tag} sheepdog:///@var{image}
876 42af9c30 MORITA Kazutaka
@end example
877 42af9c30 MORITA Kazutaka
where @var{base} is a image name of the source snapshot and @var{tag}
878 42af9c30 MORITA Kazutaka
is its tag name.
879 42af9c30 MORITA Kazutaka
880 1b8bbb46 MORITA Kazutaka
You can use an unix socket instead of an inet socket:
881 1b8bbb46 MORITA Kazutaka
882 1b8bbb46 MORITA Kazutaka
@example
883 1b8bbb46 MORITA Kazutaka
qemu-system-i386 sheepdog+unix:///@var{image}?socket=@var{path}
884 1b8bbb46 MORITA Kazutaka
@end example
885 1b8bbb46 MORITA Kazutaka
886 42af9c30 MORITA Kazutaka
If the Sheepdog daemon doesn't run on the local host, you need to
887 42af9c30 MORITA Kazutaka
specify one of the Sheepdog servers to connect to.
888 42af9c30 MORITA Kazutaka
@example
889 5d6768e3 MORITA Kazutaka
qemu-img create sheepdog://@var{hostname}:@var{port}/@var{image} @var{size}
890 5d6768e3 MORITA Kazutaka
qemu-system-i386 sheepdog://@var{hostname}:@var{port}/@var{image}
891 42af9c30 MORITA Kazutaka
@end example
892 42af9c30 MORITA Kazutaka
893 00984e39 Ronnie Sahlberg
@node disk_images_iscsi
894 00984e39 Ronnie Sahlberg
@subsection iSCSI LUNs
895 00984e39 Ronnie Sahlberg
896 00984e39 Ronnie Sahlberg
iSCSI is a popular protocol used to access SCSI devices across a computer
897 00984e39 Ronnie Sahlberg
network.
898 00984e39 Ronnie Sahlberg
899 00984e39 Ronnie Sahlberg
There are two different ways iSCSI devices can be used by QEMU.
900 00984e39 Ronnie Sahlberg
901 00984e39 Ronnie Sahlberg
The first method is to mount the iSCSI LUN on the host, and make it appear as
902 00984e39 Ronnie Sahlberg
any other ordinary SCSI device on the host and then to access this device as a
903 00984e39 Ronnie Sahlberg
/dev/sd device from QEMU. How to do this differs between host OSes.
904 00984e39 Ronnie Sahlberg
905 00984e39 Ronnie Sahlberg
The second method involves using the iSCSI initiator that is built into
906 00984e39 Ronnie Sahlberg
QEMU. This provides a mechanism that works the same way regardless of which
907 00984e39 Ronnie Sahlberg
host OS you are running QEMU on. This section will describe this second method
908 00984e39 Ronnie Sahlberg
of using iSCSI together with QEMU.
909 00984e39 Ronnie Sahlberg
910 00984e39 Ronnie Sahlberg
In QEMU, iSCSI devices are described using special iSCSI URLs
911 00984e39 Ronnie Sahlberg
912 00984e39 Ronnie Sahlberg
@example
913 00984e39 Ronnie Sahlberg
URL syntax:
914 00984e39 Ronnie Sahlberg
iscsi://[<username>[%<password>]@@]<host>[:<port>]/<target-iqn-name>/<lun>
915 00984e39 Ronnie Sahlberg
@end example
916 00984e39 Ronnie Sahlberg
917 00984e39 Ronnie Sahlberg
Username and password are optional and only used if your target is set up
918 00984e39 Ronnie Sahlberg
using CHAP authentication for access control.
919 00984e39 Ronnie Sahlberg
Alternatively the username and password can also be set via environment
920 00984e39 Ronnie Sahlberg
variables to have these not show up in the process list
921 00984e39 Ronnie Sahlberg
922 00984e39 Ronnie Sahlberg
@example
923 00984e39 Ronnie Sahlberg
export LIBISCSI_CHAP_USERNAME=<username>
924 00984e39 Ronnie Sahlberg
export LIBISCSI_CHAP_PASSWORD=<password>
925 00984e39 Ronnie Sahlberg
iscsi://<host>/<target-iqn-name>/<lun>
926 00984e39 Ronnie Sahlberg
@end example
927 00984e39 Ronnie Sahlberg
928 f9dadc98 Ronnie Sahlberg
Various session related parameters can be set via special options, either
929 f9dadc98 Ronnie Sahlberg
in a configuration file provided via '-readconfig' or directly on the
930 f9dadc98 Ronnie Sahlberg
command line.
931 f9dadc98 Ronnie Sahlberg
932 31459f46 Ronnie Sahlberg
If the initiator-name is not specified qemu will use a default name
933 31459f46 Ronnie Sahlberg
of 'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
934 31459f46 Ronnie Sahlberg
virtual machine.
935 31459f46 Ronnie Sahlberg
936 31459f46 Ronnie Sahlberg
937 f9dadc98 Ronnie Sahlberg
@example
938 f9dadc98 Ronnie Sahlberg
Setting a specific initiator name to use when logging in to the target
939 f9dadc98 Ronnie Sahlberg
-iscsi initiator-name=iqn.qemu.test:my-initiator
940 f9dadc98 Ronnie Sahlberg
@end example
941 f9dadc98 Ronnie Sahlberg
942 f9dadc98 Ronnie Sahlberg
@example
943 f9dadc98 Ronnie Sahlberg
Controlling which type of header digest to negotiate with the target
944 f9dadc98 Ronnie Sahlberg
-iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
945 f9dadc98 Ronnie Sahlberg
@end example
946 f9dadc98 Ronnie Sahlberg
947 f9dadc98 Ronnie Sahlberg
These can also be set via a configuration file
948 f9dadc98 Ronnie Sahlberg
@example
949 f9dadc98 Ronnie Sahlberg
[iscsi]
950 f9dadc98 Ronnie Sahlberg
  user = "CHAP username"
951 f9dadc98 Ronnie Sahlberg
  password = "CHAP password"
952 f9dadc98 Ronnie Sahlberg
  initiator-name = "iqn.qemu.test:my-initiator"
953 f9dadc98 Ronnie Sahlberg
  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
954 f9dadc98 Ronnie Sahlberg
  header-digest = "CRC32C"
955 f9dadc98 Ronnie Sahlberg
@end example
956 f9dadc98 Ronnie Sahlberg
957 f9dadc98 Ronnie Sahlberg
958 f9dadc98 Ronnie Sahlberg
Setting the target name allows different options for different targets
959 f9dadc98 Ronnie Sahlberg
@example
960 f9dadc98 Ronnie Sahlberg
[iscsi "iqn.target.name"]
961 f9dadc98 Ronnie Sahlberg
  user = "CHAP username"
962 f9dadc98 Ronnie Sahlberg
  password = "CHAP password"
963 f9dadc98 Ronnie Sahlberg
  initiator-name = "iqn.qemu.test:my-initiator"
964 f9dadc98 Ronnie Sahlberg
  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
965 f9dadc98 Ronnie Sahlberg
  header-digest = "CRC32C"
966 f9dadc98 Ronnie Sahlberg
@end example
967 f9dadc98 Ronnie Sahlberg
968 f9dadc98 Ronnie Sahlberg
969 f9dadc98 Ronnie Sahlberg
Howto use a configuration file to set iSCSI configuration options:
970 f9dadc98 Ronnie Sahlberg
@example
971 f9dadc98 Ronnie Sahlberg
cat >iscsi.conf <<EOF
972 f9dadc98 Ronnie Sahlberg
[iscsi]
973 f9dadc98 Ronnie Sahlberg
  user = "me"
974 f9dadc98 Ronnie Sahlberg
  password = "my password"
975 f9dadc98 Ronnie Sahlberg
  initiator-name = "iqn.qemu.test:my-initiator"
976 f9dadc98 Ronnie Sahlberg
  header-digest = "CRC32C"
977 f9dadc98 Ronnie Sahlberg
EOF
978 f9dadc98 Ronnie Sahlberg
979 f9dadc98 Ronnie Sahlberg
qemu-system-i386 -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
980 f9dadc98 Ronnie Sahlberg
    -readconfig iscsi.conf
981 f9dadc98 Ronnie Sahlberg
@end example
982 f9dadc98 Ronnie Sahlberg
983 f9dadc98 Ronnie Sahlberg
984 00984e39 Ronnie Sahlberg
Howto set up a simple iSCSI target on loopback and accessing it via QEMU:
985 00984e39 Ronnie Sahlberg
@example
986 00984e39 Ronnie Sahlberg
This example shows how to set up an iSCSI target with one CDROM and one DISK
987 00984e39 Ronnie Sahlberg
using the Linux STGT software target. This target is available on Red Hat based
988 00984e39 Ronnie Sahlberg
systems as the package 'scsi-target-utils'.
989 00984e39 Ronnie Sahlberg
990 00984e39 Ronnie Sahlberg
tgtd --iscsi portal=127.0.0.1:3260
991 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
992 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \
993 00984e39 Ronnie Sahlberg
    -b /IMAGES/disk.img --device-type=disk
994 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \
995 00984e39 Ronnie Sahlberg
    -b /IMAGES/cd.iso --device-type=cd
996 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
997 00984e39 Ronnie Sahlberg
998 f9dadc98 Ronnie Sahlberg
qemu-system-i386 -iscsi initiator-name=iqn.qemu.test:my-initiator \
999 f9dadc98 Ronnie Sahlberg
    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
1000 00984e39 Ronnie Sahlberg
    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
1001 00984e39 Ronnie Sahlberg
@end example
1002 00984e39 Ronnie Sahlberg
1003 8809e289 Bharata B Rao
@node disk_images_gluster
1004 8809e289 Bharata B Rao
@subsection GlusterFS disk images
1005 00984e39 Ronnie Sahlberg
1006 8809e289 Bharata B Rao
GlusterFS is an user space distributed file system.
1007 8809e289 Bharata B Rao
1008 8809e289 Bharata B Rao
You can boot from the GlusterFS disk image with the command:
1009 8809e289 Bharata B Rao
@example
1010 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster[+@var{transport}]://[@var{server}[:@var{port}]]/@var{volname}/@var{image}[?socket=...]
1011 8809e289 Bharata B Rao
@end example
1012 8809e289 Bharata B Rao
1013 8809e289 Bharata B Rao
@var{gluster} is the protocol.
1014 8809e289 Bharata B Rao
1015 8809e289 Bharata B Rao
@var{transport} specifies the transport type used to connect to gluster
1016 8809e289 Bharata B Rao
management daemon (glusterd). Valid transport types are
1017 8809e289 Bharata B Rao
tcp, unix and rdma. If a transport type isn't specified, then tcp
1018 8809e289 Bharata B Rao
type is assumed.
1019 8809e289 Bharata B Rao
1020 8809e289 Bharata B Rao
@var{server} specifies the server where the volume file specification for
1021 8809e289 Bharata B Rao
the given volume resides. This can be either hostname, ipv4 address
1022 8809e289 Bharata B Rao
or ipv6 address. ipv6 address needs to be within square brackets [ ].
1023 8809e289 Bharata B Rao
If transport type is unix, then @var{server} field should not be specifed.
1024 8809e289 Bharata B Rao
Instead @var{socket} field needs to be populated with the path to unix domain
1025 8809e289 Bharata B Rao
socket.
1026 8809e289 Bharata B Rao
1027 8809e289 Bharata B Rao
@var{port} is the port number on which glusterd is listening. This is optional
1028 8809e289 Bharata B Rao
and if not specified, QEMU will send 0 which will make gluster to use the
1029 8809e289 Bharata B Rao
default port. If the transport type is unix, then @var{port} should not be
1030 8809e289 Bharata B Rao
specified.
1031 8809e289 Bharata B Rao
1032 8809e289 Bharata B Rao
@var{volname} is the name of the gluster volume which contains the disk image.
1033 8809e289 Bharata B Rao
1034 8809e289 Bharata B Rao
@var{image} is the path to the actual disk image that resides on gluster volume.
1035 8809e289 Bharata B Rao
1036 8809e289 Bharata B Rao
You can create a GlusterFS disk image with the command:
1037 8809e289 Bharata B Rao
@example
1038 8809e289 Bharata B Rao
qemu-img create gluster://@var{server}/@var{volname}/@var{image} @var{size}
1039 8809e289 Bharata B Rao
@end example
1040 8809e289 Bharata B Rao
1041 8809e289 Bharata B Rao
Examples
1042 8809e289 Bharata B Rao
@example
1043 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster://1.2.3.4/testvol/a.img
1044 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4/testvol/a.img
1045 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
1046 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
1047 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
1048 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
1049 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
1050 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
1051 8809e289 Bharata B Rao
@end example
1052 00984e39 Ronnie Sahlberg
1053 0a12ec87 Richard W.M. Jones
@node disk_images_ssh
1054 0a12ec87 Richard W.M. Jones
@subsection Secure Shell (ssh) disk images
1055 0a12ec87 Richard W.M. Jones
1056 0a12ec87 Richard W.M. Jones
You can access disk images located on a remote ssh server
1057 0a12ec87 Richard W.M. Jones
by using the ssh protocol:
1058 0a12ec87 Richard W.M. Jones
1059 0a12ec87 Richard W.M. Jones
@example
1060 0a12ec87 Richard W.M. Jones
qemu-system-x86_64 -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
1061 0a12ec87 Richard W.M. Jones
@end example
1062 0a12ec87 Richard W.M. Jones
1063 0a12ec87 Richard W.M. Jones
Alternative syntax using properties:
1064 0a12ec87 Richard W.M. Jones
1065 0a12ec87 Richard W.M. Jones
@example
1066 0a12ec87 Richard W.M. Jones
qemu-system-x86_64 -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
1067 0a12ec87 Richard W.M. Jones
@end example
1068 0a12ec87 Richard W.M. Jones
1069 0a12ec87 Richard W.M. Jones
@var{ssh} is the protocol.
1070 0a12ec87 Richard W.M. Jones
1071 0a12ec87 Richard W.M. Jones
@var{user} is the remote user.  If not specified, then the local
1072 0a12ec87 Richard W.M. Jones
username is tried.
1073 0a12ec87 Richard W.M. Jones
1074 0a12ec87 Richard W.M. Jones
@var{server} specifies the remote ssh server.  Any ssh server can be
1075 0a12ec87 Richard W.M. Jones
used, but it must implement the sftp-server protocol.  Most Unix/Linux
1076 0a12ec87 Richard W.M. Jones
systems should work without requiring any extra configuration.
1077 0a12ec87 Richard W.M. Jones
1078 0a12ec87 Richard W.M. Jones
@var{port} is the port number on which sshd is listening.  By default
1079 0a12ec87 Richard W.M. Jones
the standard ssh port (22) is used.
1080 0a12ec87 Richard W.M. Jones
1081 0a12ec87 Richard W.M. Jones
@var{path} is the path to the disk image.
1082 0a12ec87 Richard W.M. Jones
1083 0a12ec87 Richard W.M. Jones
The optional @var{host_key_check} parameter controls how the remote
1084 0a12ec87 Richard W.M. Jones
host's key is checked.  The default is @code{yes} which means to use
1085 0a12ec87 Richard W.M. Jones
the local @file{.ssh/known_hosts} file.  Setting this to @code{no}
1086 0a12ec87 Richard W.M. Jones
turns off known-hosts checking.  Or you can check that the host key
1087 0a12ec87 Richard W.M. Jones
matches a specific fingerprint:
1088 0a12ec87 Richard W.M. Jones
@code{host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8}
1089 0a12ec87 Richard W.M. Jones
(@code{sha1:} can also be used as a prefix, but note that OpenSSH
1090 0a12ec87 Richard W.M. Jones
tools only use MD5 to print fingerprints).
1091 0a12ec87 Richard W.M. Jones
1092 0a12ec87 Richard W.M. Jones
Currently authentication must be done using ssh-agent.  Other
1093 0a12ec87 Richard W.M. Jones
authentication methods may be supported in future.
1094 0a12ec87 Richard W.M. Jones
1095 9a2d462e Richard W.M. Jones
Note: Many ssh servers do not support an @code{fsync}-style operation.
1096 9a2d462e Richard W.M. Jones
The ssh driver cannot guarantee that disk flush requests are
1097 9a2d462e Richard W.M. Jones
obeyed, and this causes a risk of disk corruption if the remote
1098 9a2d462e Richard W.M. Jones
server or network goes down during writes.  The driver will
1099 9a2d462e Richard W.M. Jones
print a warning when @code{fsync} is not supported:
1100 9a2d462e Richard W.M. Jones
1101 9a2d462e Richard W.M. Jones
warning: ssh server @code{ssh.example.com:22} does not support fsync
1102 9a2d462e Richard W.M. Jones
1103 9a2d462e Richard W.M. Jones
With sufficiently new versions of libssh2 and OpenSSH, @code{fsync} is
1104 9a2d462e Richard W.M. Jones
supported.
1105 0a12ec87 Richard W.M. Jones
1106 debc7065 bellard
@node pcsys_network
1107 9d4fb82e bellard
@section Network emulation
1108 9d4fb82e bellard
1109 4be456f1 ths
QEMU can simulate several network cards (PCI or ISA cards on the PC
1110 41d03949 bellard
target) and can connect them to an arbitrary number of Virtual Local
1111 41d03949 bellard
Area Networks (VLANs). Host TAP devices can be connected to any QEMU
1112 41d03949 bellard
VLAN. VLAN can be connected between separate instances of QEMU to
1113 4be456f1 ths
simulate large networks. For simpler usage, a non privileged user mode
1114 41d03949 bellard
network stack can replace the TAP device to have a basic network
1115 41d03949 bellard
connection.
1116 41d03949 bellard
1117 41d03949 bellard
@subsection VLANs
1118 9d4fb82e bellard
1119 41d03949 bellard
QEMU simulates several VLANs. A VLAN can be symbolised as a virtual
1120 41d03949 bellard
connection between several network devices. These devices can be for
1121 41d03949 bellard
example QEMU virtual Ethernet cards or virtual Host ethernet devices
1122 41d03949 bellard
(TAP devices).
1123 9d4fb82e bellard
1124 41d03949 bellard
@subsection Using TAP network interfaces
1125 41d03949 bellard
1126 41d03949 bellard
This is the standard way to connect QEMU to a real network. QEMU adds
1127 41d03949 bellard
a virtual network device on your host (called @code{tapN}), and you
1128 41d03949 bellard
can then configure it as if it was a real ethernet card.
1129 9d4fb82e bellard
1130 8f40c388 bellard
@subsubsection Linux host
1131 8f40c388 bellard
1132 9d4fb82e bellard
As an example, you can download the @file{linux-test-xxx.tar.gz}
1133 9d4fb82e bellard
archive and copy the script @file{qemu-ifup} in @file{/etc} and
1134 9d4fb82e bellard
configure properly @code{sudo} so that the command @code{ifconfig}
1135 9d4fb82e bellard
contained in @file{qemu-ifup} can be executed as root. You must verify
1136 41d03949 bellard
that your host kernel supports the TAP network interfaces: the
1137 9d4fb82e bellard
device @file{/dev/net/tun} must be present.
1138 9d4fb82e bellard
1139 ee0f4751 bellard
See @ref{sec_invocation} to have examples of command lines using the
1140 ee0f4751 bellard
TAP network interfaces.
1141 9d4fb82e bellard
1142 8f40c388 bellard
@subsubsection Windows host
1143 8f40c388 bellard
1144 8f40c388 bellard
There is a virtual ethernet driver for Windows 2000/XP systems, called
1145 8f40c388 bellard
TAP-Win32. But it is not included in standard QEMU for Windows,
1146 8f40c388 bellard
so you will need to get it separately. It is part of OpenVPN package,
1147 8f40c388 bellard
so download OpenVPN from : @url{http://openvpn.net/}.
1148 8f40c388 bellard
1149 9d4fb82e bellard
@subsection Using the user mode network stack
1150 9d4fb82e bellard
1151 41d03949 bellard
By using the option @option{-net user} (default configuration if no
1152 41d03949 bellard
@option{-net} option is specified), QEMU uses a completely user mode
1153 4be456f1 ths
network stack (you don't need root privilege to use the virtual
1154 41d03949 bellard
network). The virtual network configuration is the following:
1155 9d4fb82e bellard
1156 9d4fb82e bellard
@example
1157 9d4fb82e bellard
1158 41d03949 bellard
         QEMU VLAN      <------>  Firewall/DHCP server <-----> Internet
1159 41d03949 bellard
                           |          (10.0.2.2)
1160 9d4fb82e bellard
                           |
1161 2518bd0d bellard
                           ---->  DNS server (10.0.2.3)
1162 3b46e624 ths
                           |
1163 2518bd0d bellard
                           ---->  SMB server (10.0.2.4)
1164 9d4fb82e bellard
@end example
1165 9d4fb82e bellard
1166 9d4fb82e bellard
The QEMU VM behaves as if it was behind a firewall which blocks all
1167 9d4fb82e bellard
incoming connections. You can use a DHCP client to automatically
1168 41d03949 bellard
configure the network in the QEMU VM. The DHCP server assign addresses
1169 41d03949 bellard
to the hosts starting from 10.0.2.15.
1170 9d4fb82e bellard
1171 9d4fb82e bellard
In order to check that the user mode network is working, you can ping
1172 9d4fb82e bellard
the address 10.0.2.2 and verify that you got an address in the range
1173 9d4fb82e bellard
10.0.2.x from the QEMU virtual DHCP server.
1174 9d4fb82e bellard
1175 b415a407 bellard
Note that @code{ping} is not supported reliably to the internet as it
1176 4be456f1 ths
would require root privileges. It means you can only ping the local
1177 b415a407 bellard
router (10.0.2.2).
1178 b415a407 bellard
1179 9bf05444 bellard
When using the built-in TFTP server, the router is also the TFTP
1180 9bf05444 bellard
server.
1181 9bf05444 bellard
1182 9bf05444 bellard
When using the @option{-redir} option, TCP or UDP connections can be
1183 9bf05444 bellard
redirected from the host to the guest. It allows for example to
1184 9bf05444 bellard
redirect X11, telnet or SSH connections.
1185 443f1376 bellard
1186 41d03949 bellard
@subsection Connecting VLANs between QEMU instances
1187 41d03949 bellard
1188 41d03949 bellard
Using the @option{-net socket} option, it is possible to make VLANs
1189 41d03949 bellard
that span several QEMU instances. See @ref{sec_invocation} to have a
1190 41d03949 bellard
basic example.
1191 41d03949 bellard
1192 576fd0a1 Stefan Weil
@node pcsys_other_devs
1193 6cbf4c8c Cam Macdonell
@section Other Devices
1194 6cbf4c8c Cam Macdonell
1195 6cbf4c8c Cam Macdonell
@subsection Inter-VM Shared Memory device
1196 6cbf4c8c Cam Macdonell
1197 6cbf4c8c Cam Macdonell
With KVM enabled on a Linux host, a shared memory device is available.  Guests
1198 6cbf4c8c Cam Macdonell
map a POSIX shared memory region into the guest as a PCI device that enables
1199 6cbf4c8c Cam Macdonell
zero-copy communication to the application level of the guests.  The basic
1200 6cbf4c8c Cam Macdonell
syntax is:
1201 6cbf4c8c Cam Macdonell
1202 6cbf4c8c Cam Macdonell
@example
1203 3804da9d Stefan Weil
qemu-system-i386 -device ivshmem,size=<size in format accepted by -m>[,shm=<shm name>]
1204 6cbf4c8c Cam Macdonell
@end example
1205 6cbf4c8c Cam Macdonell
1206 6cbf4c8c Cam Macdonell
If desired, interrupts can be sent between guest VMs accessing the same shared
1207 6cbf4c8c Cam Macdonell
memory region.  Interrupt support requires using a shared memory server and
1208 6cbf4c8c Cam Macdonell
using a chardev socket to connect to it.  The code for the shared memory server
1209 6cbf4c8c Cam Macdonell
is qemu.git/contrib/ivshmem-server.  An example syntax when using the shared
1210 6cbf4c8c Cam Macdonell
memory server is:
1211 6cbf4c8c Cam Macdonell
1212 6cbf4c8c Cam Macdonell
@example
1213 3804da9d Stefan Weil
qemu-system-i386 -device ivshmem,size=<size in format accepted by -m>[,chardev=<id>]
1214 3804da9d Stefan Weil
                 [,msi=on][,ioeventfd=on][,vectors=n][,role=peer|master]
1215 3804da9d Stefan Weil
qemu-system-i386 -chardev socket,path=<path>,id=<id>
1216 6cbf4c8c Cam Macdonell
@end example
1217 6cbf4c8c Cam Macdonell
1218 6cbf4c8c Cam Macdonell
When using the server, the guest will be assigned a VM ID (>=0) that allows guests
1219 6cbf4c8c Cam Macdonell
using the same server to communicate via interrupts.  Guests can read their
1220 6cbf4c8c Cam Macdonell
VM ID from a device register (see example code).  Since receiving the shared
1221 6cbf4c8c Cam Macdonell
memory region from the server is asynchronous, there is a (small) chance the
1222 6cbf4c8c Cam Macdonell
guest may boot before the shared memory is attached.  To allow an application
1223 6cbf4c8c Cam Macdonell
to ensure shared memory is attached, the VM ID register will return -1 (an
1224 6cbf4c8c Cam Macdonell
invalid VM ID) until the memory is attached.  Once the shared memory is
1225 6cbf4c8c Cam Macdonell
attached, the VM ID will return the guest's valid VM ID.  With these semantics,
1226 6cbf4c8c Cam Macdonell
the guest application can check to ensure the shared memory is attached to the
1227 6cbf4c8c Cam Macdonell
guest before proceeding.
1228 6cbf4c8c Cam Macdonell
1229 6cbf4c8c Cam Macdonell
The @option{role} argument can be set to either master or peer and will affect
1230 6cbf4c8c Cam Macdonell
how the shared memory is migrated.  With @option{role=master}, the guest will
1231 6cbf4c8c Cam Macdonell
copy the shared memory on migration to the destination host.  With
1232 6cbf4c8c Cam Macdonell
@option{role=peer}, the guest will not be able to migrate with the device attached.
1233 6cbf4c8c Cam Macdonell
With the @option{peer} case, the device should be detached and then reattached
1234 6cbf4c8c Cam Macdonell
after migration using the PCI hotplug support.
1235 6cbf4c8c Cam Macdonell
1236 9d4fb82e bellard
@node direct_linux_boot
1237 9d4fb82e bellard
@section Direct Linux Boot
1238 1f673135 bellard
1239 1f673135 bellard
This section explains how to launch a Linux kernel inside QEMU without
1240 1f673135 bellard
having to make a full bootable image. It is very useful for fast Linux
1241 ee0f4751 bellard
kernel testing.
1242 1f673135 bellard
1243 ee0f4751 bellard
The syntax is:
1244 1f673135 bellard
@example
1245 3804da9d Stefan Weil
qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
1246 1f673135 bellard
@end example
1247 1f673135 bellard
1248 ee0f4751 bellard
Use @option{-kernel} to provide the Linux kernel image and
1249 ee0f4751 bellard
@option{-append} to give the kernel command line arguments. The
1250 ee0f4751 bellard
@option{-initrd} option can be used to provide an INITRD image.
1251 1f673135 bellard
1252 ee0f4751 bellard
When using the direct Linux boot, a disk image for the first hard disk
1253 ee0f4751 bellard
@file{hda} is required because its boot sector is used to launch the
1254 ee0f4751 bellard
Linux kernel.
1255 1f673135 bellard
1256 ee0f4751 bellard
If you do not need graphical output, you can disable it and redirect
1257 ee0f4751 bellard
the virtual serial port and the QEMU monitor to the console with the
1258 ee0f4751 bellard
@option{-nographic} option. The typical command line is:
1259 1f673135 bellard
@example
1260 3804da9d Stefan Weil
qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
1261 3804da9d Stefan Weil
                 -append "root=/dev/hda console=ttyS0" -nographic
1262 1f673135 bellard
@end example
1263 1f673135 bellard
1264 ee0f4751 bellard
Use @key{Ctrl-a c} to switch between the serial console and the
1265 ee0f4751 bellard
monitor (@pxref{pcsys_keys}).
1266 1f673135 bellard
1267 debc7065 bellard
@node pcsys_usb
1268 b389dbfb bellard
@section USB emulation
1269 b389dbfb bellard
1270 0aff66b5 pbrook
QEMU emulates a PCI UHCI USB controller. You can virtually plug
1271 0aff66b5 pbrook
virtual USB devices or real host USB devices (experimental, works only
1272 071c9394 Stefan Weil
on Linux hosts).  QEMU will automatically create and connect virtual USB hubs
1273 f542086d bellard
as necessary to connect multiple USB devices.
1274 b389dbfb bellard
1275 0aff66b5 pbrook
@menu
1276 0aff66b5 pbrook
* usb_devices::
1277 0aff66b5 pbrook
* host_usb_devices::
1278 0aff66b5 pbrook
@end menu
1279 0aff66b5 pbrook
@node usb_devices
1280 0aff66b5 pbrook
@subsection Connecting USB devices
1281 b389dbfb bellard
1282 0aff66b5 pbrook
USB devices can be connected with the @option{-usbdevice} commandline option
1283 0aff66b5 pbrook
or the @code{usb_add} monitor command.  Available devices are:
1284 b389dbfb bellard
1285 db380c06 balrog
@table @code
1286 db380c06 balrog
@item mouse
1287 0aff66b5 pbrook
Virtual Mouse.  This will override the PS/2 mouse emulation when activated.
1288 db380c06 balrog
@item tablet
1289 c6d46c20 bellard
Pointer device that uses absolute coordinates (like a touchscreen).
1290 b65ee4fa Stefan Weil
This means QEMU is able to report the mouse position without having
1291 0aff66b5 pbrook
to grab the mouse.  Also overrides the PS/2 mouse emulation when activated.
1292 db380c06 balrog
@item disk:@var{file}
1293 0aff66b5 pbrook
Mass storage device based on @var{file} (@pxref{disk_images})
1294 db380c06 balrog
@item host:@var{bus.addr}
1295 0aff66b5 pbrook
Pass through the host device identified by @var{bus.addr}
1296 0aff66b5 pbrook
(Linux only)
1297 db380c06 balrog
@item host:@var{vendor_id:product_id}
1298 0aff66b5 pbrook
Pass through the host device identified by @var{vendor_id:product_id}
1299 0aff66b5 pbrook
(Linux only)
1300 db380c06 balrog
@item wacom-tablet
1301 f6d2a316 balrog
Virtual Wacom PenPartner tablet.  This device is similar to the @code{tablet}
1302 f6d2a316 balrog
above but it can be used with the tslib library because in addition to touch
1303 f6d2a316 balrog
coordinates it reports touch pressure.
1304 db380c06 balrog
@item keyboard
1305 47b2d338 balrog
Standard USB keyboard.  Will override the PS/2 keyboard (if present).
1306 db380c06 balrog
@item serial:[vendorid=@var{vendor_id}][,product_id=@var{product_id}]:@var{dev}
1307 db380c06 balrog
Serial converter. This emulates an FTDI FT232BM chip connected to host character
1308 db380c06 balrog
device @var{dev}. The available character devices are the same as for the
1309 db380c06 balrog
@code{-serial} option. The @code{vendorid} and @code{productid} options can be
1310 0d6753e5 Stefan Weil
used to override the default 0403:6001. For instance,
1311 db380c06 balrog
@example
1312 db380c06 balrog
usb_add serial:productid=FA00:tcp:192.168.0.2:4444
1313 db380c06 balrog
@end example
1314 db380c06 balrog
will connect to tcp port 4444 of ip 192.168.0.2, and plug that to the virtual
1315 db380c06 balrog
serial converter, faking a Matrix Orbital LCD Display (USB ID 0403:FA00).
1316 2e4d9fb1 aurel32
@item braille
1317 2e4d9fb1 aurel32
Braille device.  This will use BrlAPI to display the braille output on a real
1318 2e4d9fb1 aurel32
or fake device.
1319 9ad97e65 balrog
@item net:@var{options}
1320 9ad97e65 balrog
Network adapter that supports CDC ethernet and RNDIS protocols.  @var{options}
1321 9ad97e65 balrog
specifies NIC options as with @code{-net nic,}@var{options} (see description).
1322 9ad97e65 balrog
For instance, user-mode networking can be used with
1323 6c9f886c balrog
@example
1324 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -net user,vlan=0 -usbdevice net:vlan=0
1325 6c9f886c balrog
@end example
1326 6c9f886c balrog
Currently this cannot be used in machines that support PCI NICs.
1327 2d564691 balrog
@item bt[:@var{hci-type}]
1328 2d564691 balrog
Bluetooth dongle whose type is specified in the same format as with
1329 2d564691 balrog
the @option{-bt hci} option, @pxref{bt-hcis,,allowed HCI types}.  If
1330 2d564691 balrog
no type is given, the HCI logic corresponds to @code{-bt hci,vlan=0}.
1331 2d564691 balrog
This USB device implements the USB Transport Layer of HCI.  Example
1332 2d564691 balrog
usage:
1333 2d564691 balrog
@example
1334 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -usbdevice bt:hci,vlan=3 -bt device:keyboard,vlan=3
1335 2d564691 balrog
@end example
1336 0aff66b5 pbrook
@end table
1337 b389dbfb bellard
1338 0aff66b5 pbrook
@node host_usb_devices
1339 b389dbfb bellard
@subsection Using host USB devices on a Linux host
1340 b389dbfb bellard
1341 b389dbfb bellard
WARNING: this is an experimental feature. QEMU will slow down when
1342 b389dbfb bellard
using it. USB devices requiring real time streaming (i.e. USB Video
1343 b389dbfb bellard
Cameras) are not supported yet.
1344 b389dbfb bellard
1345 b389dbfb bellard
@enumerate
1346 5fafdf24 ths
@item If you use an early Linux 2.4 kernel, verify that no Linux driver
1347 b389dbfb bellard
is actually using the USB device. A simple way to do that is simply to
1348 b389dbfb bellard
disable the corresponding kernel module by renaming it from @file{mydriver.o}
1349 b389dbfb bellard
to @file{mydriver.o.disabled}.
1350 b389dbfb bellard
1351 b389dbfb bellard
@item Verify that @file{/proc/bus/usb} is working (most Linux distributions should enable it by default). You should see something like that:
1352 b389dbfb bellard
@example
1353 b389dbfb bellard
ls /proc/bus/usb
1354 b389dbfb bellard
001  devices  drivers
1355 b389dbfb bellard
@end example
1356 b389dbfb bellard
1357 b389dbfb bellard
@item Since only root can access to the USB devices directly, you can either launch QEMU as root or change the permissions of the USB devices you want to use. For testing, the following suffices:
1358 b389dbfb bellard
@example
1359 b389dbfb bellard
chown -R myuid /proc/bus/usb
1360 b389dbfb bellard
@end example
1361 b389dbfb bellard
1362 b389dbfb bellard
@item Launch QEMU and do in the monitor:
1363 5fafdf24 ths
@example
1364 b389dbfb bellard
info usbhost
1365 b389dbfb bellard
  Device 1.2, speed 480 Mb/s
1366 b389dbfb bellard
    Class 00: USB device 1234:5678, USB DISK
1367 b389dbfb bellard
@end example
1368 b389dbfb bellard
You should see the list of the devices you can use (Never try to use
1369 b389dbfb bellard
hubs, it won't work).
1370 b389dbfb bellard
1371 b389dbfb bellard
@item Add the device in QEMU by using:
1372 5fafdf24 ths
@example
1373 b389dbfb bellard
usb_add host:1234:5678
1374 b389dbfb bellard
@end example
1375 b389dbfb bellard
1376 b389dbfb bellard
Normally the guest OS should report that a new USB device is
1377 b389dbfb bellard
plugged. You can use the option @option{-usbdevice} to do the same.
1378 b389dbfb bellard
1379 b389dbfb bellard
@item Now you can try to use the host USB device in QEMU.
1380 b389dbfb bellard
1381 b389dbfb bellard
@end enumerate
1382 b389dbfb bellard
1383 b389dbfb bellard
When relaunching QEMU, you may have to unplug and plug again the USB
1384 b389dbfb bellard
device to make it work again (this is a bug).
1385 b389dbfb bellard
1386 f858dcae ths
@node vnc_security
1387 f858dcae ths
@section VNC security
1388 f858dcae ths
1389 f858dcae ths
The VNC server capability provides access to the graphical console
1390 f858dcae ths
of the guest VM across the network. This has a number of security
1391 f858dcae ths
considerations depending on the deployment scenarios.
1392 f858dcae ths
1393 f858dcae ths
@menu
1394 f858dcae ths
* vnc_sec_none::
1395 f858dcae ths
* vnc_sec_password::
1396 f858dcae ths
* vnc_sec_certificate::
1397 f858dcae ths
* vnc_sec_certificate_verify::
1398 f858dcae ths
* vnc_sec_certificate_pw::
1399 2f9606b3 aliguori
* vnc_sec_sasl::
1400 2f9606b3 aliguori
* vnc_sec_certificate_sasl::
1401 f858dcae ths
* vnc_generate_cert::
1402 2f9606b3 aliguori
* vnc_setup_sasl::
1403 f858dcae ths
@end menu
1404 f858dcae ths
@node vnc_sec_none
1405 f858dcae ths
@subsection Without passwords
1406 f858dcae ths
1407 f858dcae ths
The simplest VNC server setup does not include any form of authentication.
1408 f858dcae ths
For this setup it is recommended to restrict it to listen on a UNIX domain
1409 f858dcae ths
socket only. For example
1410 f858dcae ths
1411 f858dcae ths
@example
1412 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc unix:/home/joebloggs/.qemu-myvm-vnc
1413 f858dcae ths
@end example
1414 f858dcae ths
1415 f858dcae ths
This ensures that only users on local box with read/write access to that
1416 f858dcae ths
path can access the VNC server. To securely access the VNC server from a
1417 f858dcae ths
remote machine, a combination of netcat+ssh can be used to provide a secure
1418 f858dcae ths
tunnel.
1419 f858dcae ths
1420 f858dcae ths
@node vnc_sec_password
1421 f858dcae ths
@subsection With passwords
1422 f858dcae ths
1423 f858dcae ths
The VNC protocol has limited support for password based authentication. Since
1424 f858dcae ths
the protocol limits passwords to 8 characters it should not be considered
1425 f858dcae ths
to provide high security. The password can be fairly easily brute-forced by
1426 f858dcae ths
a client making repeat connections. For this reason, a VNC server using password
1427 f858dcae ths
authentication should be restricted to only listen on the loopback interface
1428 0f66998f Paul Moore
or UNIX domain sockets. Password authentication is not supported when operating
1429 0f66998f Paul Moore
in FIPS 140-2 compliance mode as it requires the use of the DES cipher. Password
1430 0f66998f Paul Moore
authentication is requested with the @code{password} option, and then once QEMU
1431 0f66998f Paul Moore
is running the password is set with the monitor. Until the monitor is used to
1432 0f66998f Paul Moore
set the password all clients will be rejected.
1433 f858dcae ths
1434 f858dcae ths
@example
1435 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,password -monitor stdio
1436 f858dcae ths
(qemu) change vnc password
1437 f858dcae ths
Password: ********
1438 f858dcae ths
(qemu)
1439 f858dcae ths
@end example
1440 f858dcae ths
1441 f858dcae ths
@node vnc_sec_certificate
1442 f858dcae ths
@subsection With x509 certificates
1443 f858dcae ths
1444 f858dcae ths
The QEMU VNC server also implements the VeNCrypt extension allowing use of
1445 f858dcae ths
TLS for encryption of the session, and x509 certificates for authentication.
1446 f858dcae ths
The use of x509 certificates is strongly recommended, because TLS on its
1447 f858dcae ths
own is susceptible to man-in-the-middle attacks. Basic x509 certificate
1448 f858dcae ths
support provides a secure session, but no authentication. This allows any
1449 f858dcae ths
client to connect, and provides an encrypted session.
1450 f858dcae ths
1451 f858dcae ths
@example
1452 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio
1453 f858dcae ths
@end example
1454 f858dcae ths
1455 f858dcae ths
In the above example @code{/etc/pki/qemu} should contain at least three files,
1456 f858dcae ths
@code{ca-cert.pem}, @code{server-cert.pem} and @code{server-key.pem}. Unprivileged
1457 f858dcae ths
users will want to use a private directory, for example @code{$HOME/.pki/qemu}.
1458 f858dcae ths
NB the @code{server-key.pem} file should be protected with file mode 0600 to
1459 f858dcae ths
only be readable by the user owning it.
1460 f858dcae ths
1461 f858dcae ths
@node vnc_sec_certificate_verify
1462 f858dcae ths
@subsection With x509 certificates and client verification
1463 f858dcae ths
1464 f858dcae ths
Certificates can also provide a means to authenticate the client connecting.
1465 f858dcae ths
The server will request that the client provide a certificate, which it will
1466 f858dcae ths
then validate against the CA certificate. This is a good choice if deploying
1467 f858dcae ths
in an environment with a private internal certificate authority.
1468 f858dcae ths
1469 f858dcae ths
@example
1470 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor stdio
1471 f858dcae ths
@end example
1472 f858dcae ths
1473 f858dcae ths
1474 f858dcae ths
@node vnc_sec_certificate_pw
1475 f858dcae ths
@subsection With x509 certificates, client verification and passwords
1476 f858dcae ths
1477 f858dcae ths
Finally, the previous method can be combined with VNC password authentication
1478 f858dcae ths
to provide two layers of authentication for clients.
1479 f858dcae ths
1480 f858dcae ths
@example
1481 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,password,tls,x509verify=/etc/pki/qemu -monitor stdio
1482 f858dcae ths
(qemu) change vnc password
1483 f858dcae ths
Password: ********
1484 f858dcae ths
(qemu)
1485 f858dcae ths
@end example
1486 f858dcae ths
1487 2f9606b3 aliguori
1488 2f9606b3 aliguori
@node vnc_sec_sasl
1489 2f9606b3 aliguori
@subsection With SASL authentication
1490 2f9606b3 aliguori
1491 2f9606b3 aliguori
The SASL authentication method is a VNC extension, that provides an
1492 2f9606b3 aliguori
easily extendable, pluggable authentication method. This allows for
1493 2f9606b3 aliguori
integration with a wide range of authentication mechanisms, such as
1494 2f9606b3 aliguori
PAM, GSSAPI/Kerberos, LDAP, SQL databases, one-time keys and more.
1495 2f9606b3 aliguori
The strength of the authentication depends on the exact mechanism
1496 2f9606b3 aliguori
configured. If the chosen mechanism also provides a SSF layer, then
1497 2f9606b3 aliguori
it will encrypt the datastream as well.
1498 2f9606b3 aliguori
1499 2f9606b3 aliguori
Refer to the later docs on how to choose the exact SASL mechanism
1500 2f9606b3 aliguori
used for authentication, but assuming use of one supporting SSF,
1501 2f9606b3 aliguori
then QEMU can be launched with:
1502 2f9606b3 aliguori
1503 2f9606b3 aliguori
@example
1504 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,sasl -monitor stdio
1505 2f9606b3 aliguori
@end example
1506 2f9606b3 aliguori
1507 2f9606b3 aliguori
@node vnc_sec_certificate_sasl
1508 2f9606b3 aliguori
@subsection With x509 certificates and SASL authentication
1509 2f9606b3 aliguori
1510 2f9606b3 aliguori
If the desired SASL authentication mechanism does not supported
1511 2f9606b3 aliguori
SSF layers, then it is strongly advised to run it in combination
1512 2f9606b3 aliguori
with TLS and x509 certificates. This provides securely encrypted
1513 2f9606b3 aliguori
data stream, avoiding risk of compromising of the security
1514 2f9606b3 aliguori
credentials. This can be enabled, by combining the 'sasl' option
1515 2f9606b3 aliguori
with the aforementioned TLS + x509 options:
1516 2f9606b3 aliguori
1517 2f9606b3 aliguori
@example
1518 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509,sasl -monitor stdio
1519 2f9606b3 aliguori
@end example
1520 2f9606b3 aliguori
1521 2f9606b3 aliguori
1522 f858dcae ths
@node vnc_generate_cert
1523 f858dcae ths
@subsection Generating certificates for VNC
1524 f858dcae ths
1525 f858dcae ths
The GNU TLS packages provides a command called @code{certtool} which can
1526 f858dcae ths
be used to generate certificates and keys in PEM format. At a minimum it
1527 40c5c6cd Stefan Weil
is necessary to setup a certificate authority, and issue certificates to
1528 f858dcae ths
each server. If using certificates for authentication, then each client
1529 f858dcae ths
will also need to be issued a certificate. The recommendation is for the
1530 f858dcae ths
server to keep its certificates in either @code{/etc/pki/qemu} or for
1531 f858dcae ths
unprivileged users in @code{$HOME/.pki/qemu}.
1532 f858dcae ths
1533 f858dcae ths
@menu
1534 f858dcae ths
* vnc_generate_ca::
1535 f858dcae ths
* vnc_generate_server::
1536 f858dcae ths
* vnc_generate_client::
1537 f858dcae ths
@end menu
1538 f858dcae ths
@node vnc_generate_ca
1539 f858dcae ths
@subsubsection Setup the Certificate Authority
1540 f858dcae ths
1541 f858dcae ths
This step only needs to be performed once per organization / organizational
1542 f858dcae ths
unit. First the CA needs a private key. This key must be kept VERY secret
1543 f858dcae ths
and secure. If this key is compromised the entire trust chain of the certificates
1544 f858dcae ths
issued with it is lost.
1545 f858dcae ths
1546 f858dcae ths
@example
1547 f858dcae ths
# certtool --generate-privkey > ca-key.pem
1548 f858dcae ths
@end example
1549 f858dcae ths
1550 f858dcae ths
A CA needs to have a public certificate. For simplicity it can be a self-signed
1551 f858dcae ths
certificate, or one issue by a commercial certificate issuing authority. To
1552 f858dcae ths
generate a self-signed certificate requires one core piece of information, the
1553 f858dcae ths
name of the organization.
1554 f858dcae ths
1555 f858dcae ths
@example
1556 f858dcae ths
# cat > ca.info <<EOF
1557 f858dcae ths
cn = Name of your organization
1558 f858dcae ths
ca
1559 f858dcae ths
cert_signing_key
1560 f858dcae ths
EOF
1561 f858dcae ths
# certtool --generate-self-signed \
1562 f858dcae ths
           --load-privkey ca-key.pem
1563 f858dcae ths
           --template ca.info \
1564 f858dcae ths
           --outfile ca-cert.pem
1565 f858dcae ths
@end example
1566 f858dcae ths
1567 f858dcae ths
The @code{ca-cert.pem} file should be copied to all servers and clients wishing to utilize
1568 f858dcae ths
TLS support in the VNC server. The @code{ca-key.pem} must not be disclosed/copied at all.
1569 f858dcae ths
1570 f858dcae ths
@node vnc_generate_server
1571 f858dcae ths
@subsubsection Issuing server certificates
1572 f858dcae ths
1573 f858dcae ths
Each server (or host) needs to be issued with a key and certificate. When connecting
1574 f858dcae ths
the certificate is sent to the client which validates it against the CA certificate.
1575 f858dcae ths
The core piece of information for a server certificate is the hostname. This should
1576 f858dcae ths
be the fully qualified hostname that the client will connect with, since the client
1577 f858dcae ths
will typically also verify the hostname in the certificate. On the host holding the
1578 f858dcae ths
secure CA private key:
1579 f858dcae ths
1580 f858dcae ths
@example
1581 f858dcae ths
# cat > server.info <<EOF
1582 f858dcae ths
organization = Name  of your organization
1583 f858dcae ths
cn = server.foo.example.com
1584 f858dcae ths
tls_www_server
1585 f858dcae ths
encryption_key
1586 f858dcae ths
signing_key
1587 f858dcae ths
EOF
1588 f858dcae ths
# certtool --generate-privkey > server-key.pem
1589 f858dcae ths
# certtool --generate-certificate \
1590 f858dcae ths
           --load-ca-certificate ca-cert.pem \
1591 f858dcae ths
           --load-ca-privkey ca-key.pem \
1592 f858dcae ths
           --load-privkey server server-key.pem \
1593 f858dcae ths
           --template server.info \
1594 f858dcae ths
           --outfile server-cert.pem
1595 f858dcae ths
@end example
1596 f858dcae ths
1597 f858dcae ths
The @code{server-key.pem} and @code{server-cert.pem} files should now be securely copied
1598 f858dcae ths
to the server for which they were generated. The @code{server-key.pem} is security
1599 f858dcae ths
sensitive and should be kept protected with file mode 0600 to prevent disclosure.
1600 f858dcae ths
1601 f858dcae ths
@node vnc_generate_client
1602 f858dcae ths
@subsubsection Issuing client certificates
1603 f858dcae ths
1604 f858dcae ths
If the QEMU VNC server is to use the @code{x509verify} option to validate client
1605 f858dcae ths
certificates as its authentication mechanism, each client also needs to be issued
1606 f858dcae ths
a certificate. The client certificate contains enough metadata to uniquely identify
1607 f858dcae ths
the client, typically organization, state, city, building, etc. On the host holding
1608 f858dcae ths
the secure CA private key:
1609 f858dcae ths
1610 f858dcae ths
@example
1611 f858dcae ths
# cat > client.info <<EOF
1612 f858dcae ths
country = GB
1613 f858dcae ths
state = London
1614 f858dcae ths
locality = London
1615 f858dcae ths
organiazation = Name of your organization
1616 f858dcae ths
cn = client.foo.example.com
1617 f858dcae ths
tls_www_client
1618 f858dcae ths
encryption_key
1619 f858dcae ths
signing_key
1620 f858dcae ths
EOF
1621 f858dcae ths
# certtool --generate-privkey > client-key.pem
1622 f858dcae ths
# certtool --generate-certificate \
1623 f858dcae ths
           --load-ca-certificate ca-cert.pem \
1624 f858dcae ths
           --load-ca-privkey ca-key.pem \
1625 f858dcae ths
           --load-privkey client-key.pem \
1626 f858dcae ths
           --template client.info \
1627 f858dcae ths
           --outfile client-cert.pem
1628 f858dcae ths
@end example
1629 f858dcae ths
1630 f858dcae ths
The @code{client-key.pem} and @code{client-cert.pem} files should now be securely
1631 f858dcae ths
copied to the client for which they were generated.
1632 f858dcae ths
1633 2f9606b3 aliguori
1634 2f9606b3 aliguori
@node vnc_setup_sasl
1635 2f9606b3 aliguori
1636 2f9606b3 aliguori
@subsection Configuring SASL mechanisms
1637 2f9606b3 aliguori
1638 2f9606b3 aliguori
The following documentation assumes use of the Cyrus SASL implementation on a
1639 2f9606b3 aliguori
Linux host, but the principals should apply to any other SASL impl. When SASL
1640 2f9606b3 aliguori
is enabled, the mechanism configuration will be loaded from system default
1641 2f9606b3 aliguori
SASL service config /etc/sasl2/qemu.conf. If running QEMU as an
1642 2f9606b3 aliguori
unprivileged user, an environment variable SASL_CONF_PATH can be used
1643 2f9606b3 aliguori
to make it search alternate locations for the service config.
1644 2f9606b3 aliguori
1645 2f9606b3 aliguori
The default configuration might contain
1646 2f9606b3 aliguori
1647 2f9606b3 aliguori
@example
1648 2f9606b3 aliguori
mech_list: digest-md5
1649 2f9606b3 aliguori
sasldb_path: /etc/qemu/passwd.db
1650 2f9606b3 aliguori
@end example
1651 2f9606b3 aliguori
1652 2f9606b3 aliguori
This says to use the 'Digest MD5' mechanism, which is similar to the HTTP
1653 2f9606b3 aliguori
Digest-MD5 mechanism. The list of valid usernames & passwords is maintained
1654 2f9606b3 aliguori
in the /etc/qemu/passwd.db file, and can be updated using the saslpasswd2
1655 2f9606b3 aliguori
command. While this mechanism is easy to configure and use, it is not
1656 2f9606b3 aliguori
considered secure by modern standards, so only suitable for developers /
1657 2f9606b3 aliguori
ad-hoc testing.
1658 2f9606b3 aliguori
1659 2f9606b3 aliguori
A more serious deployment might use Kerberos, which is done with the 'gssapi'
1660 2f9606b3 aliguori
mechanism
1661 2f9606b3 aliguori
1662 2f9606b3 aliguori
@example
1663 2f9606b3 aliguori
mech_list: gssapi
1664 2f9606b3 aliguori
keytab: /etc/qemu/krb5.tab
1665 2f9606b3 aliguori
@end example
1666 2f9606b3 aliguori
1667 2f9606b3 aliguori
For this to work the administrator of your KDC must generate a Kerberos
1668 2f9606b3 aliguori
principal for the server, with a name of  'qemu/somehost.example.com@@EXAMPLE.COM'
1669 2f9606b3 aliguori
replacing 'somehost.example.com' with the fully qualified host name of the
1670 40c5c6cd Stefan Weil
machine running QEMU, and 'EXAMPLE.COM' with the Kerberos Realm.
1671 2f9606b3 aliguori
1672 2f9606b3 aliguori
Other configurations will be left as an exercise for the reader. It should
1673 2f9606b3 aliguori
be noted that only Digest-MD5 and GSSAPI provides a SSF layer for data
1674 2f9606b3 aliguori
encryption. For all other mechanisms, VNC should always be configured to
1675 2f9606b3 aliguori
use TLS and x509 certificates to protect security credentials from snooping.
1676 2f9606b3 aliguori
1677 0806e3f6 bellard
@node gdb_usage
1678 da415d54 bellard
@section GDB usage
1679 da415d54 bellard
1680 da415d54 bellard
QEMU has a primitive support to work with gdb, so that you can do
1681 0806e3f6 bellard
'Ctrl-C' while the virtual machine is running and inspect its state.
1682 da415d54 bellard
1683 b65ee4fa Stefan Weil
In order to use gdb, launch QEMU with the '-s' option. It will wait for a
1684 da415d54 bellard
gdb connection:
1685 da415d54 bellard
@example
1686 3804da9d Stefan Weil
qemu-system-i386 -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
1687 3804da9d Stefan Weil
                    -append "root=/dev/hda"
1688 da415d54 bellard
Connected to host network interface: tun0
1689 da415d54 bellard
Waiting gdb connection on port 1234
1690 da415d54 bellard
@end example
1691 da415d54 bellard
1692 da415d54 bellard
Then launch gdb on the 'vmlinux' executable:
1693 da415d54 bellard
@example
1694 da415d54 bellard
> gdb vmlinux
1695 da415d54 bellard
@end example
1696 da415d54 bellard
1697 da415d54 bellard
In gdb, connect to QEMU:
1698 da415d54 bellard
@example
1699 6c9bf893 bellard
(gdb) target remote localhost:1234
1700 da415d54 bellard
@end example
1701 da415d54 bellard
1702 da415d54 bellard
Then you can use gdb normally. For example, type 'c' to launch the kernel:
1703 da415d54 bellard
@example
1704 da415d54 bellard
(gdb) c
1705 da415d54 bellard
@end example
1706 da415d54 bellard
1707 0806e3f6 bellard
Here are some useful tips in order to use gdb on system code:
1708 0806e3f6 bellard
1709 0806e3f6 bellard
@enumerate
1710 0806e3f6 bellard
@item
1711 0806e3f6 bellard
Use @code{info reg} to display all the CPU registers.
1712 0806e3f6 bellard
@item
1713 0806e3f6 bellard
Use @code{x/10i $eip} to display the code at the PC position.
1714 0806e3f6 bellard
@item
1715 0806e3f6 bellard
Use @code{set architecture i8086} to dump 16 bit code. Then use
1716 294e8637 bellard
@code{x/10i $cs*16+$eip} to dump the code at the PC position.
1717 0806e3f6 bellard
@end enumerate
1718 0806e3f6 bellard
1719 60897d36 edgar_igl
Advanced debugging options:
1720 60897d36 edgar_igl
1721 60897d36 edgar_igl
The default single stepping behavior is step with the IRQs and timer service routines off.  It is set this way because when gdb executes a single step it expects to advance beyond the current instruction.  With the IRQs and and timer service routines on, a single step might jump into the one of the interrupt or exception vectors instead of executing the current instruction. This means you may hit the same breakpoint a number of times before executing the instruction gdb wants to have executed.  Because there are rare circumstances where you want to single step into an interrupt vector the behavior can be controlled from GDB.  There are three commands you can query and set the single step behavior:
1722 94d45e44 edgar_igl
@table @code
1723 60897d36 edgar_igl
@item maintenance packet qqemu.sstepbits
1724 60897d36 edgar_igl
1725 60897d36 edgar_igl
This will display the MASK bits used to control the single stepping IE:
1726 60897d36 edgar_igl
@example
1727 60897d36 edgar_igl
(gdb) maintenance packet qqemu.sstepbits
1728 60897d36 edgar_igl
sending: "qqemu.sstepbits"
1729 60897d36 edgar_igl
received: "ENABLE=1,NOIRQ=2,NOTIMER=4"
1730 60897d36 edgar_igl
@end example
1731 60897d36 edgar_igl
@item maintenance packet qqemu.sstep
1732 60897d36 edgar_igl
1733 60897d36 edgar_igl
This will display the current value of the mask used when single stepping IE:
1734 60897d36 edgar_igl
@example
1735 60897d36 edgar_igl
(gdb) maintenance packet qqemu.sstep
1736 60897d36 edgar_igl
sending: "qqemu.sstep"
1737 60897d36 edgar_igl
received: "0x7"
1738 60897d36 edgar_igl
@end example
1739 60897d36 edgar_igl
@item maintenance packet Qqemu.sstep=HEX_VALUE
1740 60897d36 edgar_igl
1741 60897d36 edgar_igl
This will change the single step mask, so if wanted to enable IRQs on the single step, but not timers, you would use:
1742 60897d36 edgar_igl
@example
1743 60897d36 edgar_igl
(gdb) maintenance packet Qqemu.sstep=0x5
1744 60897d36 edgar_igl
sending: "qemu.sstep=0x5"
1745 60897d36 edgar_igl
received: "OK"
1746 60897d36 edgar_igl
@end example
1747 94d45e44 edgar_igl
@end table
1748 60897d36 edgar_igl
1749 debc7065 bellard
@node pcsys_os_specific
1750 1a084f3d bellard
@section Target OS specific information
1751 1a084f3d bellard
1752 1a084f3d bellard
@subsection Linux
1753 1a084f3d bellard
1754 15a34c63 bellard
To have access to SVGA graphic modes under X11, use the @code{vesa} or
1755 15a34c63 bellard
the @code{cirrus} X11 driver. For optimal performances, use 16 bit
1756 15a34c63 bellard
color depth in the guest and the host OS.
1757 1a084f3d bellard
1758 e3371e62 bellard
When using a 2.6 guest Linux kernel, you should add the option
1759 e3371e62 bellard
@code{clock=pit} on the kernel command line because the 2.6 Linux
1760 e3371e62 bellard
kernels make very strict real time clock checks by default that QEMU
1761 e3371e62 bellard
cannot simulate exactly.
1762 e3371e62 bellard
1763 7c3fc84d bellard
When using a 2.6 guest Linux kernel, verify that the 4G/4G patch is
1764 7c3fc84d bellard
not activated because QEMU is slower with this patch. The QEMU
1765 7c3fc84d bellard
Accelerator Module is also much slower in this case. Earlier Fedora
1766 4be456f1 ths
Core 3 Linux kernel (< 2.6.9-1.724_FC3) were known to incorporate this
1767 7c3fc84d bellard
patch by default. Newer kernels don't have it.
1768 7c3fc84d bellard
1769 1a084f3d bellard
@subsection Windows
1770 1a084f3d bellard
1771 1a084f3d bellard
If you have a slow host, using Windows 95 is better as it gives the
1772 1a084f3d bellard
best speed. Windows 2000 is also a good choice.
1773 1a084f3d bellard
1774 e3371e62 bellard
@subsubsection SVGA graphic modes support
1775 e3371e62 bellard
1776 e3371e62 bellard
QEMU emulates a Cirrus Logic GD5446 Video
1777 15a34c63 bellard
card. All Windows versions starting from Windows 95 should recognize
1778 15a34c63 bellard
and use this graphic card. For optimal performances, use 16 bit color
1779 15a34c63 bellard
depth in the guest and the host OS.
1780 1a084f3d bellard
1781 3cb0853a bellard
If you are using Windows XP as guest OS and if you want to use high
1782 3cb0853a bellard
resolution modes which the Cirrus Logic BIOS does not support (i.e. >=
1783 3cb0853a bellard
1280x1024x16), then you should use the VESA VBE virtual graphic card
1784 3cb0853a bellard
(option @option{-std-vga}).
1785 3cb0853a bellard
1786 e3371e62 bellard
@subsubsection CPU usage reduction
1787 e3371e62 bellard
1788 e3371e62 bellard
Windows 9x does not correctly use the CPU HLT
1789 15a34c63 bellard
instruction. The result is that it takes host CPU cycles even when
1790 15a34c63 bellard
idle. You can install the utility from
1791 15a34c63 bellard
@url{http://www.user.cityline.ru/~maxamn/amnhltm.zip} to solve this
1792 15a34c63 bellard
problem. Note that no such tool is needed for NT, 2000 or XP.
1793 1a084f3d bellard
1794 9d0a8e6f bellard
@subsubsection Windows 2000 disk full problem
1795 e3371e62 bellard
1796 9d0a8e6f bellard
Windows 2000 has a bug which gives a disk full problem during its
1797 9d0a8e6f bellard
installation. When installing it, use the @option{-win2k-hack} QEMU
1798 9d0a8e6f bellard
option to enable a specific workaround. After Windows 2000 is
1799 9d0a8e6f bellard
installed, you no longer need this option (this option slows down the
1800 9d0a8e6f bellard
IDE transfers).
1801 e3371e62 bellard
1802 6cc721cf bellard
@subsubsection Windows 2000 shutdown
1803 6cc721cf bellard
1804 6cc721cf bellard
Windows 2000 cannot automatically shutdown in QEMU although Windows 98
1805 6cc721cf bellard
can. It comes from the fact that Windows 2000 does not automatically
1806 6cc721cf bellard
use the APM driver provided by the BIOS.
1807 6cc721cf bellard
1808 6cc721cf bellard
In order to correct that, do the following (thanks to Struan
1809 6cc721cf bellard
Bartlett): go to the Control Panel => Add/Remove Hardware & Next =>
1810 6cc721cf bellard
Add/Troubleshoot a device => Add a new device & Next => No, select the
1811 6cc721cf bellard
hardware from a list & Next => NT Apm/Legacy Support & Next => Next
1812 6cc721cf bellard
(again) a few times. Now the driver is installed and Windows 2000 now
1813 5fafdf24 ths
correctly instructs QEMU to shutdown at the appropriate moment.
1814 6cc721cf bellard
1815 6cc721cf bellard
@subsubsection Share a directory between Unix and Windows
1816 6cc721cf bellard
1817 6cc721cf bellard
See @ref{sec_invocation} about the help of the option @option{-smb}.
1818 6cc721cf bellard
1819 2192c332 bellard
@subsubsection Windows XP security problem
1820 e3371e62 bellard
1821 e3371e62 bellard
Some releases of Windows XP install correctly but give a security
1822 e3371e62 bellard
error when booting:
1823 e3371e62 bellard
@example
1824 e3371e62 bellard
A problem is preventing Windows from accurately checking the
1825 e3371e62 bellard
license for this computer. Error code: 0x800703e6.
1826 e3371e62 bellard
@end example
1827 e3371e62 bellard
1828 2192c332 bellard
The workaround is to install a service pack for XP after a boot in safe
1829 2192c332 bellard
mode. Then reboot, and the problem should go away. Since there is no
1830 2192c332 bellard
network while in safe mode, its recommended to download the full
1831 2192c332 bellard
installation of SP1 or SP2 and transfer that via an ISO or using the
1832 2192c332 bellard
vvfat block device ("-hdb fat:directory_which_holds_the_SP").
1833 e3371e62 bellard
1834 a0a821a4 bellard
@subsection MS-DOS and FreeDOS
1835 a0a821a4 bellard
1836 a0a821a4 bellard
@subsubsection CPU usage reduction
1837 a0a821a4 bellard
1838 a0a821a4 bellard
DOS does not correctly use the CPU HLT instruction. The result is that
1839 a0a821a4 bellard
it takes host CPU cycles even when idle. You can install the utility
1840 a0a821a4 bellard
from @url{http://www.vmware.com/software/dosidle210.zip} to solve this
1841 a0a821a4 bellard
problem.
1842 a0a821a4 bellard
1843 debc7065 bellard
@node QEMU System emulator for non PC targets
1844 3f9f3aa1 bellard
@chapter QEMU System emulator for non PC targets
1845 3f9f3aa1 bellard
1846 3f9f3aa1 bellard
QEMU is a generic emulator and it emulates many non PC
1847 3f9f3aa1 bellard
machines. Most of the options are similar to the PC emulator. The
1848 4be456f1 ths
differences are mentioned in the following sections.
1849 3f9f3aa1 bellard
1850 debc7065 bellard
@menu
1851 7544a042 Stefan Weil
* PowerPC System emulator::
1852 24d4de45 ths
* Sparc32 System emulator::
1853 24d4de45 ths
* Sparc64 System emulator::
1854 24d4de45 ths
* MIPS System emulator::
1855 24d4de45 ths
* ARM System emulator::
1856 24d4de45 ths
* ColdFire System emulator::
1857 7544a042 Stefan Weil
* Cris System emulator::
1858 7544a042 Stefan Weil
* Microblaze System emulator::
1859 7544a042 Stefan Weil
* SH4 System emulator::
1860 3aeaea65 Max Filippov
* Xtensa System emulator::
1861 debc7065 bellard
@end menu
1862 debc7065 bellard
1863 7544a042 Stefan Weil
@node PowerPC System emulator
1864 7544a042 Stefan Weil
@section PowerPC System emulator
1865 7544a042 Stefan Weil
@cindex system emulation (PowerPC)
1866 1a084f3d bellard
1867 15a34c63 bellard
Use the executable @file{qemu-system-ppc} to simulate a complete PREP
1868 15a34c63 bellard
or PowerMac PowerPC system.
1869 1a084f3d bellard
1870 b671f9ed bellard
QEMU emulates the following PowerMac peripherals:
1871 1a084f3d bellard
1872 15a34c63 bellard
@itemize @minus
1873 5fafdf24 ths
@item
1874 006f3a48 blueswir1
UniNorth or Grackle PCI Bridge
1875 15a34c63 bellard
@item
1876 15a34c63 bellard
PCI VGA compatible card with VESA Bochs Extensions
1877 5fafdf24 ths
@item
1878 15a34c63 bellard
2 PMAC IDE interfaces with hard disk and CD-ROM support
1879 5fafdf24 ths
@item
1880 15a34c63 bellard
NE2000 PCI adapters
1881 15a34c63 bellard
@item
1882 15a34c63 bellard
Non Volatile RAM
1883 15a34c63 bellard
@item
1884 15a34c63 bellard
VIA-CUDA with ADB keyboard and mouse.
1885 1a084f3d bellard
@end itemize
1886 1a084f3d bellard
1887 b671f9ed bellard
QEMU emulates the following PREP peripherals:
1888 52c00a5f bellard
1889 52c00a5f bellard
@itemize @minus
1890 5fafdf24 ths
@item
1891 15a34c63 bellard
PCI Bridge
1892 15a34c63 bellard
@item
1893 15a34c63 bellard
PCI VGA compatible card with VESA Bochs Extensions
1894 5fafdf24 ths
@item
1895 52c00a5f bellard
2 IDE interfaces with hard disk and CD-ROM support
1896 52c00a5f bellard
@item
1897 52c00a5f bellard
Floppy disk
1898 5fafdf24 ths
@item
1899 15a34c63 bellard
NE2000 network adapters
1900 52c00a5f bellard
@item
1901 52c00a5f bellard
Serial port
1902 52c00a5f bellard
@item
1903 52c00a5f bellard
PREP Non Volatile RAM
1904 15a34c63 bellard
@item
1905 15a34c63 bellard
PC compatible keyboard and mouse.
1906 52c00a5f bellard
@end itemize
1907 52c00a5f bellard
1908 15a34c63 bellard
QEMU uses the Open Hack'Ware Open Firmware Compatible BIOS available at
1909 3f9f3aa1 bellard
@url{http://perso.magic.fr/l_indien/OpenHackWare/index.htm}.
1910 52c00a5f bellard
1911 992e5acd blueswir1
Since version 0.9.1, QEMU uses OpenBIOS @url{http://www.openbios.org/}
1912 006f3a48 blueswir1
for the g3beige and mac99 PowerMac machines. OpenBIOS is a free (GPL
1913 006f3a48 blueswir1
v2) portable firmware implementation. The goal is to implement a 100%
1914 006f3a48 blueswir1
IEEE 1275-1994 (referred to as Open Firmware) compliant firmware.
1915 992e5acd blueswir1
1916 15a34c63 bellard
@c man begin OPTIONS
1917 15a34c63 bellard
1918 15a34c63 bellard
The following options are specific to the PowerPC emulation:
1919 15a34c63 bellard
1920 15a34c63 bellard
@table @option
1921 15a34c63 bellard
1922 4e257e5e Kevin Wolf
@item -g @var{W}x@var{H}[x@var{DEPTH}]
1923 15a34c63 bellard
1924 15a34c63 bellard
Set the initial VGA graphic mode. The default is 800x600x15.
1925 15a34c63 bellard
1926 4e257e5e Kevin Wolf
@item -prom-env @var{string}
1927 95efd11c blueswir1
1928 95efd11c blueswir1
Set OpenBIOS variables in NVRAM, for example:
1929 95efd11c blueswir1
1930 95efd11c blueswir1
@example
1931 95efd11c blueswir1
qemu-system-ppc -prom-env 'auto-boot?=false' \
1932 95efd11c blueswir1
 -prom-env 'boot-device=hd:2,\yaboot' \
1933 95efd11c blueswir1
 -prom-env 'boot-args=conf=hd:2,\yaboot.conf'
1934 95efd11c blueswir1
@end example
1935 95efd11c blueswir1
1936 95efd11c blueswir1
These variables are not used by Open Hack'Ware.
1937 95efd11c blueswir1
1938 15a34c63 bellard
@end table
1939 15a34c63 bellard
1940 5fafdf24 ths
@c man end
1941 15a34c63 bellard
1942 15a34c63 bellard
1943 52c00a5f bellard
More information is available at
1944 3f9f3aa1 bellard
@url{http://perso.magic.fr/l_indien/qemu-ppc/}.
1945 52c00a5f bellard
1946 24d4de45 ths
@node Sparc32 System emulator
1947 24d4de45 ths
@section Sparc32 System emulator
1948 7544a042 Stefan Weil
@cindex system emulation (Sparc32)
1949 e80cfcfc bellard
1950 34a3d239 blueswir1
Use the executable @file{qemu-system-sparc} to simulate the following
1951 34a3d239 blueswir1
Sun4m architecture machines:
1952 34a3d239 blueswir1
@itemize @minus
1953 34a3d239 blueswir1
@item
1954 34a3d239 blueswir1
SPARCstation 4
1955 34a3d239 blueswir1
@item
1956 34a3d239 blueswir1
SPARCstation 5
1957 34a3d239 blueswir1
@item
1958 34a3d239 blueswir1
SPARCstation 10
1959 34a3d239 blueswir1
@item
1960 34a3d239 blueswir1
SPARCstation 20
1961 34a3d239 blueswir1
@item
1962 34a3d239 blueswir1
SPARCserver 600MP
1963 34a3d239 blueswir1
@item
1964 34a3d239 blueswir1
SPARCstation LX
1965 34a3d239 blueswir1
@item
1966 34a3d239 blueswir1
SPARCstation Voyager
1967 34a3d239 blueswir1
@item
1968 34a3d239 blueswir1
SPARCclassic
1969 34a3d239 blueswir1
@item
1970 34a3d239 blueswir1
SPARCbook
1971 34a3d239 blueswir1
@end itemize
1972 34a3d239 blueswir1
1973 34a3d239 blueswir1
The emulation is somewhat complete. SMP up to 16 CPUs is supported,
1974 34a3d239 blueswir1
but Linux limits the number of usable CPUs to 4.
1975 e80cfcfc bellard
1976 6a4e1771 Blue Swirl
QEMU emulates the following sun4m peripherals:
1977 e80cfcfc bellard
1978 e80cfcfc bellard
@itemize @minus
1979 3475187d bellard
@item
1980 6a4e1771 Blue Swirl
IOMMU
1981 e80cfcfc bellard
@item
1982 e80cfcfc bellard
TCX Frame buffer
1983 5fafdf24 ths
@item
1984 e80cfcfc bellard
Lance (Am7990) Ethernet
1985 e80cfcfc bellard
@item
1986 34a3d239 blueswir1
Non Volatile RAM M48T02/M48T08
1987 e80cfcfc bellard
@item
1988 3475187d bellard
Slave I/O: timers, interrupt controllers, Zilog serial ports, keyboard
1989 3475187d bellard
and power/reset logic
1990 3475187d bellard
@item
1991 3475187d bellard
ESP SCSI controller with hard disk and CD-ROM support
1992 3475187d bellard
@item
1993 6a3b9cc9 blueswir1
Floppy drive (not on SS-600MP)
1994 a2502b58 blueswir1
@item
1995 a2502b58 blueswir1
CS4231 sound device (only on SS-5, not working yet)
1996 e80cfcfc bellard
@end itemize
1997 e80cfcfc bellard
1998 6a3b9cc9 blueswir1
The number of peripherals is fixed in the architecture.  Maximum
1999 6a3b9cc9 blueswir1
memory size depends on the machine type, for SS-5 it is 256MB and for
2000 7d85892b blueswir1
others 2047MB.
2001 3475187d bellard
2002 30a604f3 bellard
Since version 0.8.2, QEMU uses OpenBIOS
2003 0986ac3b bellard
@url{http://www.openbios.org/}. OpenBIOS is a free (GPL v2) portable
2004 0986ac3b bellard
firmware implementation. The goal is to implement a 100% IEEE
2005 0986ac3b bellard
1275-1994 (referred to as Open Firmware) compliant firmware.
2006 3475187d bellard
2007 3475187d bellard
A sample Linux 2.6 series kernel and ram disk image are available on
2008 34a3d239 blueswir1
the QEMU web site. There are still issues with NetBSD and OpenBSD, but
2009 34a3d239 blueswir1
some kernel versions work. Please note that currently Solaris kernels
2010 34a3d239 blueswir1
don't work probably due to interface issues between OpenBIOS and
2011 34a3d239 blueswir1
Solaris.
2012 3475187d bellard
2013 3475187d bellard
@c man begin OPTIONS
2014 3475187d bellard
2015 a2502b58 blueswir1
The following options are specific to the Sparc32 emulation:
2016 3475187d bellard
2017 3475187d bellard
@table @option
2018 3475187d bellard
2019 4e257e5e Kevin Wolf
@item -g @var{W}x@var{H}x[x@var{DEPTH}]
2020 3475187d bellard
2021 a2502b58 blueswir1
Set the initial TCX graphic mode. The default is 1024x768x8, currently
2022 a2502b58 blueswir1
the only other possible mode is 1024x768x24.
2023 3475187d bellard
2024 4e257e5e Kevin Wolf
@item -prom-env @var{string}
2025 66508601 blueswir1
2026 66508601 blueswir1
Set OpenBIOS variables in NVRAM, for example:
2027 66508601 blueswir1
2028 66508601 blueswir1
@example
2029 66508601 blueswir1
qemu-system-sparc -prom-env 'auto-boot?=false' \
2030 66508601 blueswir1
 -prom-env 'boot-device=sd(0,2,0):d' -prom-env 'boot-args=linux single'
2031 66508601 blueswir1
@end example
2032 66508601 blueswir1
2033 6a4e1771 Blue Swirl
@item -M [SS-4|SS-5|SS-10|SS-20|SS-600MP|LX|Voyager|SPARCClassic] [|SPARCbook]
2034 a2502b58 blueswir1
2035 a2502b58 blueswir1
Set the emulated machine type. Default is SS-5.
2036 a2502b58 blueswir1
2037 3475187d bellard
@end table
2038 3475187d bellard
2039 5fafdf24 ths
@c man end
2040 3475187d bellard
2041 24d4de45 ths
@node Sparc64 System emulator
2042 24d4de45 ths
@section Sparc64 System emulator
2043 7544a042 Stefan Weil
@cindex system emulation (Sparc64)
2044 e80cfcfc bellard
2045 34a3d239 blueswir1
Use the executable @file{qemu-system-sparc64} to simulate a Sun4u
2046 34a3d239 blueswir1
(UltraSPARC PC-like machine), Sun4v (T1 PC-like machine), or generic
2047 34a3d239 blueswir1
Niagara (T1) machine. The emulator is not usable for anything yet, but
2048 34a3d239 blueswir1
it can launch some kernels.
2049 b756921a bellard
2050 c7ba218d blueswir1
QEMU emulates the following peripherals:
2051 83469015 bellard
2052 83469015 bellard
@itemize @minus
2053 83469015 bellard
@item
2054 5fafdf24 ths
UltraSparc IIi APB PCI Bridge
2055 83469015 bellard
@item
2056 83469015 bellard
PCI VGA compatible card with VESA Bochs Extensions
2057 83469015 bellard
@item
2058 34a3d239 blueswir1
PS/2 mouse and keyboard
2059 34a3d239 blueswir1
@item
2060 83469015 bellard
Non Volatile RAM M48T59
2061 83469015 bellard
@item
2062 83469015 bellard
PC-compatible serial ports
2063 c7ba218d blueswir1
@item
2064 c7ba218d blueswir1
2 PCI IDE interfaces with hard disk and CD-ROM support
2065 34a3d239 blueswir1
@item
2066 34a3d239 blueswir1
Floppy disk
2067 83469015 bellard
@end itemize
2068 83469015 bellard
2069 c7ba218d blueswir1
@c man begin OPTIONS
2070 c7ba218d blueswir1
2071 c7ba218d blueswir1
The following options are specific to the Sparc64 emulation:
2072 c7ba218d blueswir1
2073 c7ba218d blueswir1
@table @option
2074 c7ba218d blueswir1
2075 4e257e5e Kevin Wolf
@item -prom-env @var{string}
2076 34a3d239 blueswir1
2077 34a3d239 blueswir1
Set OpenBIOS variables in NVRAM, for example:
2078 34a3d239 blueswir1
2079 34a3d239 blueswir1
@example
2080 34a3d239 blueswir1
qemu-system-sparc64 -prom-env 'auto-boot?=false'
2081 34a3d239 blueswir1
@end example
2082 34a3d239 blueswir1
2083 34a3d239 blueswir1
@item -M [sun4u|sun4v|Niagara]
2084 c7ba218d blueswir1
2085 c7ba218d blueswir1
Set the emulated machine type. The default is sun4u.
2086 c7ba218d blueswir1
2087 c7ba218d blueswir1
@end table
2088 c7ba218d blueswir1
2089 c7ba218d blueswir1
@c man end
2090 c7ba218d blueswir1
2091 24d4de45 ths
@node MIPS System emulator
2092 24d4de45 ths
@section MIPS System emulator
2093 7544a042 Stefan Weil
@cindex system emulation (MIPS)
2094 9d0a8e6f bellard
2095 d9aedc32 ths
Four executables cover simulation of 32 and 64-bit MIPS systems in
2096 d9aedc32 ths
both endian options, @file{qemu-system-mips}, @file{qemu-system-mipsel}
2097 d9aedc32 ths
@file{qemu-system-mips64} and @file{qemu-system-mips64el}.
2098 88cb0a02 aurel32
Five different machine types are emulated:
2099 24d4de45 ths
2100 24d4de45 ths
@itemize @minus
2101 24d4de45 ths
@item
2102 24d4de45 ths
A generic ISA PC-like machine "mips"
2103 24d4de45 ths
@item
2104 24d4de45 ths
The MIPS Malta prototype board "malta"
2105 24d4de45 ths
@item
2106 d9aedc32 ths
An ACER Pica "pica61". This machine needs the 64-bit emulator.
2107 6bf5b4e8 ths
@item
2108 f0fc6f8f ths
MIPS emulator pseudo board "mipssim"
2109 88cb0a02 aurel32
@item
2110 88cb0a02 aurel32
A MIPS Magnum R4000 machine "magnum". This machine needs the 64-bit emulator.
2111 24d4de45 ths
@end itemize
2112 24d4de45 ths
2113 24d4de45 ths
The generic emulation is supported by Debian 'Etch' and is able to
2114 24d4de45 ths
install Debian into a virtual disk image. The following devices are
2115 24d4de45 ths
emulated:
2116 3f9f3aa1 bellard
2117 3f9f3aa1 bellard
@itemize @minus
2118 5fafdf24 ths
@item
2119 6bf5b4e8 ths
A range of MIPS CPUs, default is the 24Kf
2120 3f9f3aa1 bellard
@item
2121 3f9f3aa1 bellard
PC style serial port
2122 3f9f3aa1 bellard
@item
2123 24d4de45 ths
PC style IDE disk
2124 24d4de45 ths
@item
2125 3f9f3aa1 bellard
NE2000 network card
2126 3f9f3aa1 bellard
@end itemize
2127 3f9f3aa1 bellard
2128 24d4de45 ths
The Malta emulation supports the following devices:
2129 24d4de45 ths
2130 24d4de45 ths
@itemize @minus
2131 24d4de45 ths
@item
2132 0b64d008 ths
Core board with MIPS 24Kf CPU and Galileo system controller
2133 24d4de45 ths
@item
2134 24d4de45 ths
PIIX4 PCI/USB/SMbus controller
2135 24d4de45 ths
@item
2136 24d4de45 ths
The Multi-I/O chip's serial device
2137 24d4de45 ths
@item
2138 3a2eeac0 Stefan Weil
PCI network cards (PCnet32 and others)
2139 24d4de45 ths
@item
2140 24d4de45 ths
Malta FPGA serial device
2141 24d4de45 ths
@item
2142 1f605a76 aurel32
Cirrus (default) or any other PCI VGA graphics card
2143 24d4de45 ths
@end itemize
2144 24d4de45 ths
2145 24d4de45 ths
The ACER Pica emulation supports:
2146 24d4de45 ths
2147 24d4de45 ths
@itemize @minus
2148 24d4de45 ths
@item
2149 24d4de45 ths
MIPS R4000 CPU
2150 24d4de45 ths
@item
2151 24d4de45 ths
PC-style IRQ and DMA controllers
2152 24d4de45 ths
@item
2153 24d4de45 ths
PC Keyboard
2154 24d4de45 ths
@item
2155 24d4de45 ths
IDE controller
2156 24d4de45 ths
@end itemize
2157 3f9f3aa1 bellard
2158 b5e4946f Stefan Weil
The mipssim pseudo board emulation provides an environment similar
2159 f0fc6f8f ths
to what the proprietary MIPS emulator uses for running Linux.
2160 f0fc6f8f ths
It supports:
2161 6bf5b4e8 ths
2162 6bf5b4e8 ths
@itemize @minus
2163 6bf5b4e8 ths
@item
2164 6bf5b4e8 ths
A range of MIPS CPUs, default is the 24Kf
2165 6bf5b4e8 ths
@item
2166 6bf5b4e8 ths
PC style serial port
2167 6bf5b4e8 ths
@item
2168 6bf5b4e8 ths
MIPSnet network emulation
2169 6bf5b4e8 ths
@end itemize
2170 6bf5b4e8 ths
2171 88cb0a02 aurel32
The MIPS Magnum R4000 emulation supports:
2172 88cb0a02 aurel32
2173 88cb0a02 aurel32
@itemize @minus
2174 88cb0a02 aurel32
@item
2175 88cb0a02 aurel32
MIPS R4000 CPU
2176 88cb0a02 aurel32
@item
2177 88cb0a02 aurel32
PC-style IRQ controller
2178 88cb0a02 aurel32
@item
2179 88cb0a02 aurel32
PC Keyboard
2180 88cb0a02 aurel32
@item
2181 88cb0a02 aurel32
SCSI controller
2182 88cb0a02 aurel32
@item
2183 88cb0a02 aurel32
G364 framebuffer
2184 88cb0a02 aurel32
@end itemize
2185 88cb0a02 aurel32
2186 88cb0a02 aurel32
2187 24d4de45 ths
@node ARM System emulator
2188 24d4de45 ths
@section ARM System emulator
2189 7544a042 Stefan Weil
@cindex system emulation (ARM)
2190 3f9f3aa1 bellard
2191 3f9f3aa1 bellard
Use the executable @file{qemu-system-arm} to simulate a ARM
2192 3f9f3aa1 bellard
machine. The ARM Integrator/CP board is emulated with the following
2193 3f9f3aa1 bellard
devices:
2194 3f9f3aa1 bellard
2195 3f9f3aa1 bellard
@itemize @minus
2196 3f9f3aa1 bellard
@item
2197 9ee6e8bb pbrook
ARM926E, ARM1026E, ARM946E, ARM1136 or Cortex-A8 CPU
2198 3f9f3aa1 bellard
@item
2199 3f9f3aa1 bellard
Two PL011 UARTs
2200 5fafdf24 ths
@item
2201 3f9f3aa1 bellard
SMC 91c111 Ethernet adapter
2202 00a9bf19 pbrook
@item
2203 00a9bf19 pbrook
PL110 LCD controller
2204 00a9bf19 pbrook
@item
2205 00a9bf19 pbrook
PL050 KMI with PS/2 keyboard and mouse.
2206 a1bb27b1 pbrook
@item
2207 a1bb27b1 pbrook
PL181 MultiMedia Card Interface with SD card.
2208 00a9bf19 pbrook
@end itemize
2209 00a9bf19 pbrook
2210 00a9bf19 pbrook
The ARM Versatile baseboard is emulated with the following devices:
2211 00a9bf19 pbrook
2212 00a9bf19 pbrook
@itemize @minus
2213 00a9bf19 pbrook
@item
2214 9ee6e8bb pbrook
ARM926E, ARM1136 or Cortex-A8 CPU
2215 00a9bf19 pbrook
@item
2216 00a9bf19 pbrook
PL190 Vectored Interrupt Controller
2217 00a9bf19 pbrook
@item
2218 00a9bf19 pbrook
Four PL011 UARTs
2219 5fafdf24 ths
@item
2220 00a9bf19 pbrook
SMC 91c111 Ethernet adapter
2221 00a9bf19 pbrook
@item
2222 00a9bf19 pbrook
PL110 LCD controller
2223 00a9bf19 pbrook
@item
2224 00a9bf19 pbrook
PL050 KMI with PS/2 keyboard and mouse.
2225 00a9bf19 pbrook
@item
2226 00a9bf19 pbrook
PCI host bridge.  Note the emulated PCI bridge only provides access to
2227 00a9bf19 pbrook
PCI memory space.  It does not provide access to PCI IO space.
2228 4be456f1 ths
This means some devices (eg. ne2k_pci NIC) are not usable, and others
2229 4be456f1 ths
(eg. rtl8139 NIC) are only usable when the guest drivers use the memory
2230 00a9bf19 pbrook
mapped control registers.
2231 e6de1bad pbrook
@item
2232 e6de1bad pbrook
PCI OHCI USB controller.
2233 e6de1bad pbrook
@item
2234 e6de1bad pbrook
LSI53C895A PCI SCSI Host Bus Adapter with hard disk and CD-ROM devices.
2235 a1bb27b1 pbrook
@item
2236 a1bb27b1 pbrook
PL181 MultiMedia Card Interface with SD card.
2237 3f9f3aa1 bellard
@end itemize
2238 3f9f3aa1 bellard
2239 21a88941 Paul Brook
Several variants of the ARM RealView baseboard are emulated,
2240 21a88941 Paul Brook
including the EB, PB-A8 and PBX-A9.  Due to interactions with the
2241 21a88941 Paul Brook
bootloader, only certain Linux kernel configurations work out
2242 21a88941 Paul Brook
of the box on these boards.
2243 21a88941 Paul Brook
2244 21a88941 Paul Brook
Kernels for the PB-A8 board should have CONFIG_REALVIEW_HIGH_PHYS_OFFSET
2245 21a88941 Paul Brook
enabled in the kernel, and expect 512M RAM.  Kernels for The PBX-A9 board
2246 21a88941 Paul Brook
should have CONFIG_SPARSEMEM enabled, CONFIG_REALVIEW_HIGH_PHYS_OFFSET
2247 21a88941 Paul Brook
disabled and expect 1024M RAM.
2248 21a88941 Paul Brook
2249 40c5c6cd Stefan Weil
The following devices are emulated:
2250 d7739d75 pbrook
2251 d7739d75 pbrook
@itemize @minus
2252 d7739d75 pbrook
@item
2253 f7c70325 Paul Brook
ARM926E, ARM1136, ARM11MPCore, Cortex-A8 or Cortex-A9 MPCore CPU
2254 d7739d75 pbrook
@item
2255 d7739d75 pbrook
ARM AMBA Generic/Distributed Interrupt Controller
2256 d7739d75 pbrook
@item
2257 d7739d75 pbrook
Four PL011 UARTs
2258 5fafdf24 ths
@item
2259 0ef849d7 Paul Brook
SMC 91c111 or SMSC LAN9118 Ethernet adapter
2260 d7739d75 pbrook
@item
2261 d7739d75 pbrook
PL110 LCD controller
2262 d7739d75 pbrook
@item
2263 d7739d75 pbrook
PL050 KMI with PS/2 keyboard and mouse
2264 d7739d75 pbrook
@item
2265 d7739d75 pbrook
PCI host bridge
2266 d7739d75 pbrook
@item
2267 d7739d75 pbrook
PCI OHCI USB controller
2268 d7739d75 pbrook
@item
2269 d7739d75 pbrook
LSI53C895A PCI SCSI Host Bus Adapter with hard disk and CD-ROM devices
2270 a1bb27b1 pbrook
@item
2271 a1bb27b1 pbrook
PL181 MultiMedia Card Interface with SD card.
2272 d7739d75 pbrook
@end itemize
2273 d7739d75 pbrook
2274 b00052e4 balrog
The XScale-based clamshell PDA models ("Spitz", "Akita", "Borzoi"
2275 b00052e4 balrog
and "Terrier") emulation includes the following peripherals:
2276 b00052e4 balrog
2277 b00052e4 balrog
@itemize @minus
2278 b00052e4 balrog
@item
2279 b00052e4 balrog
Intel PXA270 System-on-chip (ARM V5TE core)
2280 b00052e4 balrog
@item
2281 b00052e4 balrog
NAND Flash memory
2282 b00052e4 balrog
@item
2283 b00052e4 balrog
IBM/Hitachi DSCM microdrive in a PXA PCMCIA slot - not in "Akita"
2284 b00052e4 balrog
@item
2285 b00052e4 balrog
On-chip OHCI USB controller
2286 b00052e4 balrog
@item
2287 b00052e4 balrog
On-chip LCD controller
2288 b00052e4 balrog
@item
2289 b00052e4 balrog
On-chip Real Time Clock
2290 b00052e4 balrog
@item
2291 b00052e4 balrog
TI ADS7846 touchscreen controller on SSP bus
2292 b00052e4 balrog
@item
2293 b00052e4 balrog
Maxim MAX1111 analog-digital converter on I@math{^2}C bus
2294 b00052e4 balrog
@item
2295 b00052e4 balrog
GPIO-connected keyboard controller and LEDs
2296 b00052e4 balrog
@item
2297 549444e1 balrog
Secure Digital card connected to PXA MMC/SD host
2298 b00052e4 balrog
@item
2299 b00052e4 balrog
Three on-chip UARTs
2300 b00052e4 balrog
@item
2301 b00052e4 balrog
WM8750 audio CODEC on I@math{^2}C and I@math{^2}S busses
2302 b00052e4 balrog
@end itemize
2303 b00052e4 balrog
2304 02645926 balrog
The Palm Tungsten|E PDA (codename "Cheetah") emulation includes the
2305 02645926 balrog
following elements:
2306 02645926 balrog
2307 02645926 balrog
@itemize @minus
2308 02645926 balrog
@item
2309 02645926 balrog
Texas Instruments OMAP310 System-on-chip (ARM 925T core)
2310 02645926 balrog
@item
2311 02645926 balrog
ROM and RAM memories (ROM firmware image can be loaded with -option-rom)
2312 02645926 balrog
@item
2313 02645926 balrog
On-chip LCD controller
2314 02645926 balrog
@item
2315 02645926 balrog
On-chip Real Time Clock
2316 02645926 balrog
@item
2317 02645926 balrog
TI TSC2102i touchscreen controller / analog-digital converter / Audio
2318 02645926 balrog
CODEC, connected through MicroWire and I@math{^2}S busses
2319 02645926 balrog
@item
2320 02645926 balrog
GPIO-connected matrix keypad
2321 02645926 balrog
@item
2322 02645926 balrog
Secure Digital card connected to OMAP MMC/SD host
2323 02645926 balrog
@item
2324 02645926 balrog
Three on-chip UARTs
2325 02645926 balrog
@end itemize
2326 02645926 balrog
2327 c30bb264 balrog
Nokia N800 and N810 internet tablets (known also as RX-34 and RX-44 / 48)
2328 c30bb264 balrog
emulation supports the following elements:
2329 c30bb264 balrog
2330 c30bb264 balrog
@itemize @minus
2331 c30bb264 balrog
@item
2332 c30bb264 balrog
Texas Instruments OMAP2420 System-on-chip (ARM 1136 core)
2333 c30bb264 balrog
@item
2334 c30bb264 balrog
RAM and non-volatile OneNAND Flash memories
2335 c30bb264 balrog
@item
2336 c30bb264 balrog
Display connected to EPSON remote framebuffer chip and OMAP on-chip
2337 c30bb264 balrog
display controller and a LS041y3 MIPI DBI-C controller
2338 c30bb264 balrog
@item
2339 c30bb264 balrog
TI TSC2301 (in N800) and TI TSC2005 (in N810) touchscreen controllers
2340 c30bb264 balrog
driven through SPI bus
2341 c30bb264 balrog
@item
2342 c30bb264 balrog
National Semiconductor LM8323-controlled qwerty keyboard driven
2343 c30bb264 balrog
through I@math{^2}C bus
2344 c30bb264 balrog
@item
2345 c30bb264 balrog
Secure Digital card connected to OMAP MMC/SD host
2346 c30bb264 balrog
@item
2347 c30bb264 balrog
Three OMAP on-chip UARTs and on-chip STI debugging console
2348 c30bb264 balrog
@item
2349 40c5c6cd Stefan Weil
A Bluetooth(R) transceiver and HCI connected to an UART
2350 2d564691 balrog
@item
2351 c30bb264 balrog
Mentor Graphics "Inventra" dual-role USB controller embedded in a TI
2352 c30bb264 balrog
TUSB6010 chip - only USB host mode is supported
2353 c30bb264 balrog
@item
2354 c30bb264 balrog
TI TMP105 temperature sensor driven through I@math{^2}C bus
2355 c30bb264 balrog
@item
2356 c30bb264 balrog
TI TWL92230C power management companion with an RTC on I@math{^2}C bus
2357 c30bb264 balrog
@item
2358 c30bb264 balrog
Nokia RETU and TAHVO multi-purpose chips with an RTC, connected
2359 c30bb264 balrog
through CBUS
2360 c30bb264 balrog
@end itemize
2361 c30bb264 balrog
2362 9ee6e8bb pbrook
The Luminary Micro Stellaris LM3S811EVB emulation includes the following
2363 9ee6e8bb pbrook
devices:
2364 9ee6e8bb pbrook
2365 9ee6e8bb pbrook
@itemize @minus
2366 9ee6e8bb pbrook
@item
2367 9ee6e8bb pbrook
Cortex-M3 CPU core.
2368 9ee6e8bb pbrook
@item
2369 9ee6e8bb pbrook
64k Flash and 8k SRAM.
2370 9ee6e8bb pbrook
@item
2371 9ee6e8bb pbrook
Timers, UARTs, ADC and I@math{^2}C interface.
2372 9ee6e8bb pbrook
@item
2373 9ee6e8bb pbrook
OSRAM Pictiva 96x16 OLED with SSD0303 controller on I@math{^2}C bus.
2374 9ee6e8bb pbrook
@end itemize
2375 9ee6e8bb pbrook
2376 9ee6e8bb pbrook
The Luminary Micro Stellaris LM3S6965EVB emulation includes the following
2377 9ee6e8bb pbrook
devices:
2378 9ee6e8bb pbrook
2379 9ee6e8bb pbrook
@itemize @minus
2380 9ee6e8bb pbrook
@item
2381 9ee6e8bb pbrook
Cortex-M3 CPU core.
2382 9ee6e8bb pbrook
@item
2383 9ee6e8bb pbrook
256k Flash and 64k SRAM.
2384 9ee6e8bb pbrook
@item
2385 9ee6e8bb pbrook
Timers, UARTs, ADC, I@math{^2}C and SSI interfaces.
2386 9ee6e8bb pbrook
@item
2387 9ee6e8bb pbrook
OSRAM Pictiva 128x64 OLED with SSD0323 controller connected via SSI.
2388 9ee6e8bb pbrook
@end itemize
2389 9ee6e8bb pbrook
2390 57cd6e97 balrog
The Freecom MusicPal internet radio emulation includes the following
2391 57cd6e97 balrog
elements:
2392 57cd6e97 balrog
2393 57cd6e97 balrog
@itemize @minus
2394 57cd6e97 balrog
@item
2395 57cd6e97 balrog
Marvell MV88W8618 ARM core.
2396 57cd6e97 balrog
@item
2397 57cd6e97 balrog
32 MB RAM, 256 KB SRAM, 8 MB flash.
2398 57cd6e97 balrog
@item
2399 57cd6e97 balrog
Up to 2 16550 UARTs
2400 57cd6e97 balrog
@item
2401 57cd6e97 balrog
MV88W8xx8 Ethernet controller
2402 57cd6e97 balrog
@item
2403 57cd6e97 balrog
MV88W8618 audio controller, WM8750 CODEC and mixer
2404 57cd6e97 balrog
@item
2405 e080e785 Stefan Weil
128ร—64 display with brightness control
2406 57cd6e97 balrog
@item
2407 57cd6e97 balrog
2 buttons, 2 navigation wheels with button function
2408 57cd6e97 balrog
@end itemize
2409 57cd6e97 balrog
2410 997641a8 balrog
The Siemens SX1 models v1 and v2 (default) basic emulation.
2411 40c5c6cd Stefan Weil
The emulation includes the following elements:
2412 997641a8 balrog
2413 997641a8 balrog
@itemize @minus
2414 997641a8 balrog
@item
2415 997641a8 balrog
Texas Instruments OMAP310 System-on-chip (ARM 925T core)
2416 997641a8 balrog
@item
2417 997641a8 balrog
ROM and RAM memories (ROM firmware image can be loaded with -pflash)
2418 997641a8 balrog
V1
2419 997641a8 balrog
1 Flash of 16MB and 1 Flash of 8MB
2420 997641a8 balrog
V2
2421 997641a8 balrog
1 Flash of 32MB
2422 997641a8 balrog
@item
2423 997641a8 balrog
On-chip LCD controller
2424 997641a8 balrog
@item
2425 997641a8 balrog
On-chip Real Time Clock
2426 997641a8 balrog
@item
2427 997641a8 balrog
Secure Digital card connected to OMAP MMC/SD host
2428 997641a8 balrog
@item
2429 997641a8 balrog
Three on-chip UARTs
2430 997641a8 balrog
@end itemize
2431 997641a8 balrog
2432 3f9f3aa1 bellard
A Linux 2.6 test image is available on the QEMU web site. More
2433 3f9f3aa1 bellard
information is available in the QEMU mailing-list archive.
2434 9d0a8e6f bellard
2435 d2c639d6 blueswir1
@c man begin OPTIONS
2436 d2c639d6 blueswir1
2437 d2c639d6 blueswir1
The following options are specific to the ARM emulation:
2438 d2c639d6 blueswir1
2439 d2c639d6 blueswir1
@table @option
2440 d2c639d6 blueswir1
2441 d2c639d6 blueswir1
@item -semihosting
2442 d2c639d6 blueswir1
Enable semihosting syscall emulation.
2443 d2c639d6 blueswir1
2444 d2c639d6 blueswir1
On ARM this implements the "Angel" interface.
2445 d2c639d6 blueswir1
2446 d2c639d6 blueswir1
Note that this allows guest direct access to the host filesystem,
2447 d2c639d6 blueswir1
so should only be used with trusted guest OS.
2448 d2c639d6 blueswir1
2449 d2c639d6 blueswir1
@end table
2450 d2c639d6 blueswir1
2451 24d4de45 ths
@node ColdFire System emulator
2452 24d4de45 ths
@section ColdFire System emulator
2453 7544a042 Stefan Weil
@cindex system emulation (ColdFire)
2454 7544a042 Stefan Weil
@cindex system emulation (M68K)
2455 209a4e69 pbrook
2456 209a4e69 pbrook
Use the executable @file{qemu-system-m68k} to simulate a ColdFire machine.
2457 209a4e69 pbrook
The emulator is able to boot a uClinux kernel.
2458 707e011b pbrook
2459 707e011b pbrook
The M5208EVB emulation includes the following devices:
2460 707e011b pbrook
2461 707e011b pbrook
@itemize @minus
2462 5fafdf24 ths
@item
2463 707e011b pbrook
MCF5208 ColdFire V2 Microprocessor (ISA A+ with EMAC).
2464 707e011b pbrook
@item
2465 707e011b pbrook
Three Two on-chip UARTs.
2466 707e011b pbrook
@item
2467 707e011b pbrook
Fast Ethernet Controller (FEC)
2468 707e011b pbrook
@end itemize
2469 707e011b pbrook
2470 707e011b pbrook
The AN5206 emulation includes the following devices:
2471 209a4e69 pbrook
2472 209a4e69 pbrook
@itemize @minus
2473 5fafdf24 ths
@item
2474 209a4e69 pbrook
MCF5206 ColdFire V2 Microprocessor.
2475 209a4e69 pbrook
@item
2476 209a4e69 pbrook
Two on-chip UARTs.
2477 209a4e69 pbrook
@end itemize
2478 209a4e69 pbrook
2479 d2c639d6 blueswir1
@c man begin OPTIONS
2480 d2c639d6 blueswir1
2481 7544a042 Stefan Weil
The following options are specific to the ColdFire emulation:
2482 d2c639d6 blueswir1
2483 d2c639d6 blueswir1
@table @option
2484 d2c639d6 blueswir1
2485 d2c639d6 blueswir1
@item -semihosting
2486 d2c639d6 blueswir1
Enable semihosting syscall emulation.
2487 d2c639d6 blueswir1
2488 d2c639d6 blueswir1
On M68K this implements the "ColdFire GDB" interface used by libgloss.
2489 d2c639d6 blueswir1
2490 d2c639d6 blueswir1
Note that this allows guest direct access to the host filesystem,
2491 d2c639d6 blueswir1
so should only be used with trusted guest OS.
2492 d2c639d6 blueswir1
2493 d2c639d6 blueswir1
@end table
2494 d2c639d6 blueswir1
2495 7544a042 Stefan Weil
@node Cris System emulator
2496 7544a042 Stefan Weil
@section Cris System emulator
2497 7544a042 Stefan Weil
@cindex system emulation (Cris)
2498 7544a042 Stefan Weil
2499 7544a042 Stefan Weil
TODO
2500 7544a042 Stefan Weil
2501 7544a042 Stefan Weil
@node Microblaze System emulator
2502 7544a042 Stefan Weil
@section Microblaze System emulator
2503 7544a042 Stefan Weil
@cindex system emulation (Microblaze)
2504 7544a042 Stefan Weil
2505 7544a042 Stefan Weil
TODO
2506 7544a042 Stefan Weil
2507 7544a042 Stefan Weil
@node SH4 System emulator
2508 7544a042 Stefan Weil
@section SH4 System emulator
2509 7544a042 Stefan Weil
@cindex system emulation (SH4)
2510 7544a042 Stefan Weil
2511 7544a042 Stefan Weil
TODO
2512 7544a042 Stefan Weil
2513 3aeaea65 Max Filippov
@node Xtensa System emulator
2514 3aeaea65 Max Filippov
@section Xtensa System emulator
2515 3aeaea65 Max Filippov
@cindex system emulation (Xtensa)
2516 3aeaea65 Max Filippov
2517 3aeaea65 Max Filippov
Two executables cover simulation of both Xtensa endian options,
2518 3aeaea65 Max Filippov
@file{qemu-system-xtensa} and @file{qemu-system-xtensaeb}.
2519 3aeaea65 Max Filippov
Two different machine types are emulated:
2520 3aeaea65 Max Filippov
2521 3aeaea65 Max Filippov
@itemize @minus
2522 3aeaea65 Max Filippov
@item
2523 3aeaea65 Max Filippov
Xtensa emulator pseudo board "sim"
2524 3aeaea65 Max Filippov
@item
2525 3aeaea65 Max Filippov
Avnet LX60/LX110/LX200 board
2526 3aeaea65 Max Filippov
@end itemize
2527 3aeaea65 Max Filippov
2528 b5e4946f Stefan Weil
The sim pseudo board emulation provides an environment similar
2529 3aeaea65 Max Filippov
to one provided by the proprietary Tensilica ISS.
2530 3aeaea65 Max Filippov
It supports:
2531 3aeaea65 Max Filippov
2532 3aeaea65 Max Filippov
@itemize @minus
2533 3aeaea65 Max Filippov
@item
2534 3aeaea65 Max Filippov
A range of Xtensa CPUs, default is the DC232B
2535 3aeaea65 Max Filippov
@item
2536 3aeaea65 Max Filippov
Console and filesystem access via semihosting calls
2537 3aeaea65 Max Filippov
@end itemize
2538 3aeaea65 Max Filippov
2539 3aeaea65 Max Filippov
The Avnet LX60/LX110/LX200 emulation supports:
2540 3aeaea65 Max Filippov
2541 3aeaea65 Max Filippov
@itemize @minus
2542 3aeaea65 Max Filippov
@item
2543 3aeaea65 Max Filippov
A range of Xtensa CPUs, default is the DC232B
2544 3aeaea65 Max Filippov
@item
2545 3aeaea65 Max Filippov
16550 UART
2546 3aeaea65 Max Filippov
@item
2547 3aeaea65 Max Filippov
OpenCores 10/100 Mbps Ethernet MAC
2548 3aeaea65 Max Filippov
@end itemize
2549 3aeaea65 Max Filippov
2550 3aeaea65 Max Filippov
@c man begin OPTIONS
2551 3aeaea65 Max Filippov
2552 3aeaea65 Max Filippov
The following options are specific to the Xtensa emulation:
2553 3aeaea65 Max Filippov
2554 3aeaea65 Max Filippov
@table @option
2555 3aeaea65 Max Filippov
2556 3aeaea65 Max Filippov
@item -semihosting
2557 3aeaea65 Max Filippov
Enable semihosting syscall emulation.
2558 3aeaea65 Max Filippov
2559 3aeaea65 Max Filippov
Xtensa semihosting provides basic file IO calls, such as open/read/write/seek/select.
2560 3aeaea65 Max Filippov
Tensilica baremetal libc for ISS and linux platform "sim" use this interface.
2561 3aeaea65 Max Filippov
2562 3aeaea65 Max Filippov
Note that this allows guest direct access to the host filesystem,
2563 3aeaea65 Max Filippov
so should only be used with trusted guest OS.
2564 3aeaea65 Max Filippov
2565 3aeaea65 Max Filippov
@end table
2566 5fafdf24 ths
@node QEMU User space emulator
2567 5fafdf24 ths
@chapter QEMU User space emulator
2568 83195237 bellard
2569 83195237 bellard
@menu
2570 83195237 bellard
* Supported Operating Systems ::
2571 83195237 bellard
* Linux User space emulator::
2572 84778508 blueswir1
* BSD User space emulator ::
2573 83195237 bellard
@end menu
2574 83195237 bellard
2575 83195237 bellard
@node Supported Operating Systems
2576 83195237 bellard
@section Supported Operating Systems
2577 83195237 bellard
2578 83195237 bellard
The following OS are supported in user space emulation:
2579 83195237 bellard
2580 83195237 bellard
@itemize @minus
2581 83195237 bellard
@item
2582 4be456f1 ths
Linux (referred as qemu-linux-user)
2583 83195237 bellard
@item
2584 84778508 blueswir1
BSD (referred as qemu-bsd-user)
2585 83195237 bellard
@end itemize
2586 83195237 bellard
2587 83195237 bellard
@node Linux User space emulator
2588 83195237 bellard
@section Linux User space emulator
2589 386405f7 bellard
2590 debc7065 bellard
@menu
2591 debc7065 bellard
* Quick Start::
2592 debc7065 bellard
* Wine launch::
2593 debc7065 bellard
* Command line options::
2594 79737e4a pbrook
* Other binaries::
2595 debc7065 bellard
@end menu
2596 debc7065 bellard
2597 debc7065 bellard
@node Quick Start
2598 83195237 bellard
@subsection Quick Start
2599 df0f11a0 bellard
2600 1f673135 bellard
In order to launch a Linux process, QEMU needs the process executable
2601 5fafdf24 ths
itself and all the target (x86) dynamic libraries used by it.
2602 386405f7 bellard
2603 1f673135 bellard
@itemize
2604 386405f7 bellard
2605 1f673135 bellard
@item On x86, you can just try to launch any process by using the native
2606 1f673135 bellard
libraries:
2607 386405f7 bellard
2608 5fafdf24 ths
@example
2609 1f673135 bellard
qemu-i386 -L / /bin/ls
2610 1f673135 bellard
@end example
2611 386405f7 bellard
2612 1f673135 bellard
@code{-L /} tells that the x86 dynamic linker must be searched with a
2613 1f673135 bellard
@file{/} prefix.
2614 386405f7 bellard
2615 b65ee4fa Stefan Weil
@item Since QEMU is also a linux process, you can launch QEMU with
2616 b65ee4fa Stefan Weil
QEMU (NOTE: you can only do that if you compiled QEMU from the sources):
2617 386405f7 bellard
2618 5fafdf24 ths
@example
2619 1f673135 bellard
qemu-i386 -L / qemu-i386 -L / /bin/ls
2620 1f673135 bellard
@end example
2621 386405f7 bellard
2622 1f673135 bellard
@item On non x86 CPUs, you need first to download at least an x86 glibc
2623 1f673135 bellard
(@file{qemu-runtime-i386-XXX-.tar.gz} on the QEMU web page). Ensure that
2624 1f673135 bellard
@code{LD_LIBRARY_PATH} is not set:
2625 df0f11a0 bellard
2626 1f673135 bellard
@example
2627 5fafdf24 ths
unset LD_LIBRARY_PATH
2628 1f673135 bellard
@end example
2629 1eb87257 bellard
2630 1f673135 bellard
Then you can launch the precompiled @file{ls} x86 executable:
2631 1eb87257 bellard
2632 1f673135 bellard
@example
2633 1f673135 bellard
qemu-i386 tests/i386/ls
2634 1f673135 bellard
@end example
2635 4c3b5a48 Blue Swirl
You can look at @file{scripts/qemu-binfmt-conf.sh} so that
2636 1f673135 bellard
QEMU is automatically launched by the Linux kernel when you try to
2637 1f673135 bellard
launch x86 executables. It requires the @code{binfmt_misc} module in the
2638 1f673135 bellard
Linux kernel.
2639 1eb87257 bellard
2640 1f673135 bellard
@item The x86 version of QEMU is also included. You can try weird things such as:
2641 1f673135 bellard
@example
2642 debc7065 bellard
qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \
2643 debc7065 bellard
          /usr/local/qemu-i386/bin/ls-i386
2644 1f673135 bellard
@end example
2645 1eb20527 bellard
2646 1f673135 bellard
@end itemize
2647 1eb20527 bellard
2648 debc7065 bellard
@node Wine launch
2649 83195237 bellard
@subsection Wine launch
2650 1eb20527 bellard
2651 1f673135 bellard
@itemize
2652 386405f7 bellard
2653 1f673135 bellard
@item Ensure that you have a working QEMU with the x86 glibc
2654 1f673135 bellard
distribution (see previous section). In order to verify it, you must be
2655 1f673135 bellard
able to do:
2656 386405f7 bellard
2657 1f673135 bellard
@example
2658 1f673135 bellard
qemu-i386 /usr/local/qemu-i386/bin/ls-i386
2659 1f673135 bellard
@end example
2660 386405f7 bellard
2661 1f673135 bellard
@item Download the binary x86 Wine install
2662 5fafdf24 ths
(@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page).
2663 386405f7 bellard
2664 1f673135 bellard
@item Configure Wine on your account. Look at the provided script
2665 debc7065 bellard
@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous
2666 1f673135 bellard
@code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}.
2667 386405f7 bellard
2668 1f673135 bellard
@item Then you can try the example @file{putty.exe}:
2669 386405f7 bellard
2670 1f673135 bellard
@example
2671 debc7065 bellard
qemu-i386 /usr/local/qemu-i386/wine/bin/wine \
2672 debc7065 bellard
          /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe
2673 1f673135 bellard
@end example
2674 386405f7 bellard
2675 1f673135 bellard
@end itemize
2676 fd429f2f bellard
2677 debc7065 bellard
@node Command line options
2678 83195237 bellard
@subsection Command line options
2679 1eb20527 bellard
2680 1f673135 bellard
@example
2681 68a1c816 Paul Brook
usage: qemu-i386 [-h] [-d] [-L path] [-s size] [-cpu model] [-g port] [-B offset] [-R size] program [arguments...]
2682 1f673135 bellard
@end example
2683 1eb20527 bellard
2684 1f673135 bellard
@table @option
2685 1f673135 bellard
@item -h
2686 1f673135 bellard
Print the help
2687 3b46e624 ths
@item -L path
2688 1f673135 bellard
Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)
2689 1f673135 bellard
@item -s size
2690 1f673135 bellard
Set the x86 stack size in bytes (default=524288)
2691 34a3d239 blueswir1
@item -cpu model
2692 c8057f95 Peter Maydell
Select CPU model (-cpu help for list and additional feature selection)
2693 f66724c9 Stefan Weil
@item -E @var{var}=@var{value}
2694 f66724c9 Stefan Weil
Set environment @var{var} to @var{value}.
2695 f66724c9 Stefan Weil
@item -U @var{var}
2696 f66724c9 Stefan Weil
Remove @var{var} from the environment.
2697 379f6698 Paul Brook
@item -B offset
2698 379f6698 Paul Brook
Offset guest address by the specified number of bytes.  This is useful when
2699 1f5c3f8c Stefan Weil
the address region required by guest applications is reserved on the host.
2700 1f5c3f8c Stefan Weil
This option is currently only supported on some hosts.
2701 68a1c816 Paul Brook
@item -R size
2702 68a1c816 Paul Brook
Pre-allocate a guest virtual address space of the given size (in bytes).
2703 0d6753e5 Stefan Weil
"G", "M", and "k" suffixes may be used when specifying the size.
2704 386405f7 bellard
@end table
2705 386405f7 bellard
2706 1f673135 bellard
Debug options:
2707 386405f7 bellard
2708 1f673135 bellard
@table @option
2709 989b697d Peter Maydell
@item -d item1,...
2710 989b697d Peter Maydell
Activate logging of the specified items (use '-d help' for a list of log items)
2711 1f673135 bellard
@item -p pagesize
2712 1f673135 bellard
Act as if the host page size was 'pagesize' bytes
2713 34a3d239 blueswir1
@item -g port
2714 34a3d239 blueswir1
Wait gdb connection to port
2715 1b530a6d aurel32
@item -singlestep
2716 1b530a6d aurel32
Run the emulation in single step mode.
2717 1f673135 bellard
@end table
2718 386405f7 bellard
2719 b01bcae6 balrog
Environment variables:
2720 b01bcae6 balrog
2721 b01bcae6 balrog
@table @env
2722 b01bcae6 balrog
@item QEMU_STRACE
2723 b01bcae6 balrog
Print system calls and arguments similar to the 'strace' program
2724 b01bcae6 balrog
(NOTE: the actual 'strace' program will not work because the user
2725 b01bcae6 balrog
space emulator hasn't implemented ptrace).  At the moment this is
2726 b01bcae6 balrog
incomplete.  All system calls that don't have a specific argument
2727 b01bcae6 balrog
format are printed with information for six arguments.  Many
2728 b01bcae6 balrog
flag-style arguments don't have decoders and will show up as numbers.
2729 5cfdf930 ths
@end table
2730 b01bcae6 balrog
2731 79737e4a pbrook
@node Other binaries
2732 83195237 bellard
@subsection Other binaries
2733 79737e4a pbrook
2734 7544a042 Stefan Weil
@cindex user mode (Alpha)
2735 7544a042 Stefan Weil
@command{qemu-alpha} TODO.
2736 7544a042 Stefan Weil
2737 7544a042 Stefan Weil
@cindex user mode (ARM)
2738 7544a042 Stefan Weil
@command{qemu-armeb} TODO.
2739 7544a042 Stefan Weil
2740 7544a042 Stefan Weil
@cindex user mode (ARM)
2741 79737e4a pbrook
@command{qemu-arm} is also capable of running ARM "Angel" semihosted ELF
2742 79737e4a pbrook
binaries (as implemented by the arm-elf and arm-eabi Newlib/GDB
2743 79737e4a pbrook
configurations), and arm-uclinux bFLT format binaries.
2744 79737e4a pbrook
2745 7544a042 Stefan Weil
@cindex user mode (ColdFire)
2746 7544a042 Stefan Weil
@cindex user mode (M68K)
2747 e6e5906b pbrook
@command{qemu-m68k} is capable of running semihosted binaries using the BDM
2748 e6e5906b pbrook
(m5xxx-ram-hosted.ld) or m68k-sim (sim.ld) syscall interfaces, and
2749 e6e5906b pbrook
coldfire uClinux bFLT format binaries.
2750 e6e5906b pbrook
2751 79737e4a pbrook
The binary format is detected automatically.
2752 79737e4a pbrook
2753 7544a042 Stefan Weil
@cindex user mode (Cris)
2754 7544a042 Stefan Weil
@command{qemu-cris} TODO.
2755 7544a042 Stefan Weil
2756 7544a042 Stefan Weil
@cindex user mode (i386)
2757 7544a042 Stefan Weil
@command{qemu-i386} TODO.
2758 7544a042 Stefan Weil
@command{qemu-x86_64} TODO.
2759 7544a042 Stefan Weil
2760 7544a042 Stefan Weil
@cindex user mode (Microblaze)
2761 7544a042 Stefan Weil
@command{qemu-microblaze} TODO.
2762 7544a042 Stefan Weil
2763 7544a042 Stefan Weil
@cindex user mode (MIPS)
2764 7544a042 Stefan Weil
@command{qemu-mips} TODO.
2765 7544a042 Stefan Weil
@command{qemu-mipsel} TODO.
2766 7544a042 Stefan Weil
2767 7544a042 Stefan Weil
@cindex user mode (PowerPC)
2768 7544a042 Stefan Weil
@command{qemu-ppc64abi32} TODO.
2769 7544a042 Stefan Weil
@command{qemu-ppc64} TODO.
2770 7544a042 Stefan Weil
@command{qemu-ppc} TODO.
2771 7544a042 Stefan Weil
2772 7544a042 Stefan Weil
@cindex user mode (SH4)
2773 7544a042 Stefan Weil
@command{qemu-sh4eb} TODO.
2774 7544a042 Stefan Weil
@command{qemu-sh4} TODO.
2775 7544a042 Stefan Weil
2776 7544a042 Stefan Weil
@cindex user mode (SPARC)
2777 34a3d239 blueswir1
@command{qemu-sparc} can execute Sparc32 binaries (Sparc32 CPU, 32 bit ABI).
2778 34a3d239 blueswir1
2779 a785e42e blueswir1
@command{qemu-sparc32plus} can execute Sparc32 and SPARC32PLUS binaries
2780 a785e42e blueswir1
(Sparc64 CPU, 32 bit ABI).
2781 a785e42e blueswir1
2782 a785e42e blueswir1
@command{qemu-sparc64} can execute some Sparc64 (Sparc64 CPU, 64 bit ABI) and
2783 a785e42e blueswir1
SPARC32PLUS binaries (Sparc64 CPU, 32 bit ABI).
2784 a785e42e blueswir1
2785 84778508 blueswir1
@node BSD User space emulator
2786 84778508 blueswir1
@section BSD User space emulator
2787 84778508 blueswir1
2788 84778508 blueswir1
@menu
2789 84778508 blueswir1
* BSD Status::
2790 84778508 blueswir1
* BSD Quick Start::
2791 84778508 blueswir1
* BSD Command line options::
2792 84778508 blueswir1
@end menu
2793 84778508 blueswir1
2794 84778508 blueswir1
@node BSD Status
2795 84778508 blueswir1
@subsection BSD Status
2796 84778508 blueswir1
2797 84778508 blueswir1
@itemize @minus
2798 84778508 blueswir1
@item
2799 84778508 blueswir1
target Sparc64 on Sparc64: Some trivial programs work.
2800 84778508 blueswir1
@end itemize
2801 84778508 blueswir1
2802 84778508 blueswir1
@node BSD Quick Start
2803 84778508 blueswir1
@subsection Quick Start
2804 84778508 blueswir1
2805 84778508 blueswir1
In order to launch a BSD process, QEMU needs the process executable
2806 84778508 blueswir1
itself and all the target dynamic libraries used by it.
2807 84778508 blueswir1
2808 84778508 blueswir1
@itemize
2809 84778508 blueswir1
2810 84778508 blueswir1
@item On Sparc64, you can just try to launch any process by using the native
2811 84778508 blueswir1
libraries:
2812 84778508 blueswir1
2813 84778508 blueswir1
@example
2814 84778508 blueswir1
qemu-sparc64 /bin/ls
2815 84778508 blueswir1
@end example
2816 84778508 blueswir1
2817 84778508 blueswir1
@end itemize
2818 84778508 blueswir1
2819 84778508 blueswir1
@node BSD Command line options
2820 84778508 blueswir1
@subsection Command line options
2821 84778508 blueswir1
2822 84778508 blueswir1
@example
2823 84778508 blueswir1
usage: qemu-sparc64 [-h] [-d] [-L path] [-s size] [-bsd type] program [arguments...]
2824 84778508 blueswir1
@end example
2825 84778508 blueswir1
2826 84778508 blueswir1
@table @option
2827 84778508 blueswir1
@item -h
2828 84778508 blueswir1
Print the help
2829 84778508 blueswir1
@item -L path
2830 84778508 blueswir1
Set the library root path (default=/)
2831 84778508 blueswir1
@item -s size
2832 84778508 blueswir1
Set the stack size in bytes (default=524288)
2833 f66724c9 Stefan Weil
@item -ignore-environment
2834 f66724c9 Stefan Weil
Start with an empty environment. Without this option,
2835 40c5c6cd Stefan Weil
the initial environment is a copy of the caller's environment.
2836 f66724c9 Stefan Weil
@item -E @var{var}=@var{value}
2837 f66724c9 Stefan Weil
Set environment @var{var} to @var{value}.
2838 f66724c9 Stefan Weil
@item -U @var{var}
2839 f66724c9 Stefan Weil
Remove @var{var} from the environment.
2840 84778508 blueswir1
@item -bsd type
2841 84778508 blueswir1
Set the type of the emulated BSD Operating system. Valid values are
2842 84778508 blueswir1
FreeBSD, NetBSD and OpenBSD (default).
2843 84778508 blueswir1
@end table
2844 84778508 blueswir1
2845 84778508 blueswir1
Debug options:
2846 84778508 blueswir1
2847 84778508 blueswir1
@table @option
2848 989b697d Peter Maydell
@item -d item1,...
2849 989b697d Peter Maydell
Activate logging of the specified items (use '-d help' for a list of log items)
2850 84778508 blueswir1
@item -p pagesize
2851 84778508 blueswir1
Act as if the host page size was 'pagesize' bytes
2852 1b530a6d aurel32
@item -singlestep
2853 1b530a6d aurel32
Run the emulation in single step mode.
2854 84778508 blueswir1
@end table
2855 84778508 blueswir1
2856 15a34c63 bellard
@node compilation
2857 15a34c63 bellard
@chapter Compilation from the sources
2858 15a34c63 bellard
2859 debc7065 bellard
@menu
2860 debc7065 bellard
* Linux/Unix::
2861 debc7065 bellard
* Windows::
2862 debc7065 bellard
* Cross compilation for Windows with Linux::
2863 debc7065 bellard
* Mac OS X::
2864 47eacb4f Stefan Weil
* Make targets::
2865 debc7065 bellard
@end menu
2866 debc7065 bellard
2867 debc7065 bellard
@node Linux/Unix
2868 7c3fc84d bellard
@section Linux/Unix
2869 7c3fc84d bellard
2870 7c3fc84d bellard
@subsection Compilation
2871 7c3fc84d bellard
2872 7c3fc84d bellard
First you must decompress the sources:
2873 7c3fc84d bellard
@example
2874 7c3fc84d bellard
cd /tmp
2875 7c3fc84d bellard
tar zxvf qemu-x.y.z.tar.gz
2876 7c3fc84d bellard
cd qemu-x.y.z
2877 7c3fc84d bellard
@end example
2878 7c3fc84d bellard
2879 7c3fc84d bellard
Then you configure QEMU and build it (usually no options are needed):
2880 7c3fc84d bellard
@example
2881 7c3fc84d bellard
./configure
2882 7c3fc84d bellard
make
2883 7c3fc84d bellard
@end example
2884 7c3fc84d bellard
2885 7c3fc84d bellard
Then type as root user:
2886 7c3fc84d bellard
@example
2887 7c3fc84d bellard
make install
2888 7c3fc84d bellard
@end example
2889 7c3fc84d bellard
to install QEMU in @file{/usr/local}.
2890 7c3fc84d bellard
2891 debc7065 bellard
@node Windows
2892 15a34c63 bellard
@section Windows
2893 15a34c63 bellard
2894 15a34c63 bellard
@itemize
2895 15a34c63 bellard
@item Install the current versions of MSYS and MinGW from
2896 15a34c63 bellard
@url{http://www.mingw.org/}. You can find detailed installation
2897 15a34c63 bellard
instructions in the download section and the FAQ.
2898 15a34c63 bellard
2899 5fafdf24 ths
@item Download
2900 15a34c63 bellard
the MinGW development library of SDL 1.2.x
2901 debc7065 bellard
(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from
2902 d0a96f3d Scott Tsai
@url{http://www.libsdl.org}. Unpack it in a temporary place and
2903 d0a96f3d Scott Tsai
edit the @file{sdl-config} script so that it gives the
2904 15a34c63 bellard
correct SDL directory when invoked.
2905 15a34c63 bellard
2906 d0a96f3d Scott Tsai
@item Install the MinGW version of zlib and make sure
2907 d0a96f3d Scott Tsai
@file{zlib.h} and @file{libz.dll.a} are in
2908 40c5c6cd Stefan Weil
MinGW's default header and linker search paths.
2909 d0a96f3d Scott Tsai
2910 15a34c63 bellard
@item Extract the current version of QEMU.
2911 5fafdf24 ths
2912 15a34c63 bellard
@item Start the MSYS shell (file @file{msys.bat}).
2913 15a34c63 bellard
2914 5fafdf24 ths
@item Change to the QEMU directory. Launch @file{./configure} and
2915 15a34c63 bellard
@file{make}.  If you have problems using SDL, verify that
2916 15a34c63 bellard
@file{sdl-config} can be launched from the MSYS command line.
2917 15a34c63 bellard
2918 c5ec15ea Stefan Weil
@item You can install QEMU in @file{Program Files/QEMU} by typing
2919 15a34c63 bellard
@file{make install}. Don't forget to copy @file{SDL.dll} in
2920 c5ec15ea Stefan Weil
@file{Program Files/QEMU}.
2921 15a34c63 bellard
2922 15a34c63 bellard
@end itemize
2923 15a34c63 bellard
2924 debc7065 bellard
@node Cross compilation for Windows with Linux
2925 15a34c63 bellard
@section Cross compilation for Windows with Linux
2926 15a34c63 bellard
2927 15a34c63 bellard
@itemize
2928 15a34c63 bellard
@item
2929 15a34c63 bellard
Install the MinGW cross compilation tools available at
2930 15a34c63 bellard
@url{http://www.mingw.org/}.
2931 15a34c63 bellard
2932 d0a96f3d Scott Tsai
@item Download
2933 d0a96f3d Scott Tsai
the MinGW development library of SDL 1.2.x
2934 d0a96f3d Scott Tsai
(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from
2935 d0a96f3d Scott Tsai
@url{http://www.libsdl.org}. Unpack it in a temporary place and
2936 d0a96f3d Scott Tsai
edit the @file{sdl-config} script so that it gives the
2937 d0a96f3d Scott Tsai
correct SDL directory when invoked.  Set up the @code{PATH} environment
2938 d0a96f3d Scott Tsai
variable so that @file{sdl-config} can be launched by
2939 15a34c63 bellard
the QEMU configuration script.
2940 15a34c63 bellard
2941 d0a96f3d Scott Tsai
@item Install the MinGW version of zlib and make sure
2942 d0a96f3d Scott Tsai
@file{zlib.h} and @file{libz.dll.a} are in
2943 40c5c6cd Stefan Weil
MinGW's default header and linker search paths.
2944 d0a96f3d Scott Tsai
2945 5fafdf24 ths
@item
2946 15a34c63 bellard
Configure QEMU for Windows cross compilation:
2947 15a34c63 bellard
@example
2948 d0a96f3d Scott Tsai
PATH=/usr/i686-pc-mingw32/sys-root/mingw/bin:$PATH ./configure --cross-prefix='i686-pc-mingw32-'
2949 d0a96f3d Scott Tsai
@end example
2950 d0a96f3d Scott Tsai
The example assumes @file{sdl-config} is installed under @file{/usr/i686-pc-mingw32/sys-root/mingw/bin} and
2951 d0a96f3d Scott Tsai
MinGW cross compilation tools have names like @file{i686-pc-mingw32-gcc} and @file{i686-pc-mingw32-strip}.
2952 40c5c6cd Stefan Weil
We set the @code{PATH} environment variable to ensure the MinGW version of @file{sdl-config} is used and
2953 d0a96f3d Scott Tsai
use --cross-prefix to specify the name of the cross compiler.
2954 c5ec15ea Stefan Weil
You can also use --prefix to set the Win32 install path which defaults to @file{c:/Program Files/QEMU}.
2955 d0a96f3d Scott Tsai
2956 d0a96f3d Scott Tsai
Under Fedora Linux, you can run:
2957 d0a96f3d Scott Tsai
@example
2958 d0a96f3d Scott Tsai
yum -y install mingw32-gcc mingw32-SDL mingw32-zlib
2959 15a34c63 bellard
@end example
2960 d0a96f3d Scott Tsai
to get a suitable cross compilation environment.
2961 15a34c63 bellard
2962 5fafdf24 ths
@item You can install QEMU in the installation directory by typing
2963 d0a96f3d Scott Tsai
@code{make install}. Don't forget to copy @file{SDL.dll} and @file{zlib1.dll} into the
2964 5fafdf24 ths
installation directory.
2965 15a34c63 bellard
2966 15a34c63 bellard
@end itemize
2967 15a34c63 bellard
2968 3804da9d Stefan Weil
Wine can be used to launch the resulting qemu-system-i386.exe
2969 3804da9d Stefan Weil
and all other qemu-system-@var{target}.exe compiled for Win32.
2970 15a34c63 bellard
2971 debc7065 bellard
@node Mac OS X
2972 15a34c63 bellard
@section Mac OS X
2973 15a34c63 bellard
2974 15a34c63 bellard
The Mac OS X patches are not fully merged in QEMU, so you should look
2975 15a34c63 bellard
at the QEMU mailing list archive to have all the necessary
2976 15a34c63 bellard
information.
2977 15a34c63 bellard
2978 47eacb4f Stefan Weil
@node Make targets
2979 47eacb4f Stefan Weil
@section Make targets
2980 47eacb4f Stefan Weil
2981 47eacb4f Stefan Weil
@table @code
2982 47eacb4f Stefan Weil
2983 47eacb4f Stefan Weil
@item make
2984 47eacb4f Stefan Weil
@item make all
2985 47eacb4f Stefan Weil
Make everything which is typically needed.
2986 47eacb4f Stefan Weil
2987 47eacb4f Stefan Weil
@item install
2988 47eacb4f Stefan Weil
TODO
2989 47eacb4f Stefan Weil
2990 47eacb4f Stefan Weil
@item install-doc
2991 47eacb4f Stefan Weil
TODO
2992 47eacb4f Stefan Weil
2993 47eacb4f Stefan Weil
@item make clean
2994 47eacb4f Stefan Weil
Remove most files which were built during make.
2995 47eacb4f Stefan Weil
2996 47eacb4f Stefan Weil
@item make distclean
2997 47eacb4f Stefan Weil
Remove everything which was built during make.
2998 47eacb4f Stefan Weil
2999 47eacb4f Stefan Weil
@item make dvi
3000 47eacb4f Stefan Weil
@item make html
3001 47eacb4f Stefan Weil
@item make info
3002 47eacb4f Stefan Weil
@item make pdf
3003 47eacb4f Stefan Weil
Create documentation in dvi, html, info or pdf format.
3004 47eacb4f Stefan Weil
3005 47eacb4f Stefan Weil
@item make cscope
3006 47eacb4f Stefan Weil
TODO
3007 47eacb4f Stefan Weil
3008 47eacb4f Stefan Weil
@item make defconfig
3009 47eacb4f Stefan Weil
(Re-)create some build configuration files.
3010 47eacb4f Stefan Weil
User made changes will be overwritten.
3011 47eacb4f Stefan Weil
3012 47eacb4f Stefan Weil
@item tar
3013 47eacb4f Stefan Weil
@item tarbin
3014 47eacb4f Stefan Weil
TODO
3015 47eacb4f Stefan Weil
3016 47eacb4f Stefan Weil
@end table
3017 47eacb4f Stefan Weil
3018 7544a042 Stefan Weil
@node License
3019 7544a042 Stefan Weil
@appendix License
3020 7544a042 Stefan Weil
3021 7544a042 Stefan Weil
QEMU is a trademark of Fabrice Bellard.
3022 7544a042 Stefan Weil
3023 7544a042 Stefan Weil
QEMU is released under the GNU General Public License (TODO: add link).
3024 7544a042 Stefan Weil
Parts of QEMU have specific licenses, see file LICENSE.
3025 7544a042 Stefan Weil
3026 7544a042 Stefan Weil
TODO (refer to file LICENSE, include it, include the GPL?)
3027 7544a042 Stefan Weil
3028 debc7065 bellard
@node Index
3029 7544a042 Stefan Weil
@appendix Index
3030 7544a042 Stefan Weil
@menu
3031 7544a042 Stefan Weil
* Concept Index::
3032 7544a042 Stefan Weil
* Function Index::
3033 7544a042 Stefan Weil
* Keystroke Index::
3034 7544a042 Stefan Weil
* Program Index::
3035 7544a042 Stefan Weil
* Data Type Index::
3036 7544a042 Stefan Weil
* Variable Index::
3037 7544a042 Stefan Weil
@end menu
3038 7544a042 Stefan Weil
3039 7544a042 Stefan Weil
@node Concept Index
3040 7544a042 Stefan Weil
@section Concept Index
3041 7544a042 Stefan Weil
This is the main index. Should we combine all keywords in one index? TODO
3042 debc7065 bellard
@printindex cp
3043 debc7065 bellard
3044 7544a042 Stefan Weil
@node Function Index
3045 7544a042 Stefan Weil
@section Function Index
3046 7544a042 Stefan Weil
This index could be used for command line options and monitor functions.
3047 7544a042 Stefan Weil
@printindex fn
3048 7544a042 Stefan Weil
3049 7544a042 Stefan Weil
@node Keystroke Index
3050 7544a042 Stefan Weil
@section Keystroke Index
3051 7544a042 Stefan Weil
3052 7544a042 Stefan Weil
This is a list of all keystrokes which have a special function
3053 7544a042 Stefan Weil
in system emulation.
3054 7544a042 Stefan Weil
3055 7544a042 Stefan Weil
@printindex ky
3056 7544a042 Stefan Weil
3057 7544a042 Stefan Weil
@node Program Index
3058 7544a042 Stefan Weil
@section Program Index
3059 7544a042 Stefan Weil
@printindex pg
3060 7544a042 Stefan Weil
3061 7544a042 Stefan Weil
@node Data Type Index
3062 7544a042 Stefan Weil
@section Data Type Index
3063 7544a042 Stefan Weil
3064 7544a042 Stefan Weil
This index could be used for qdev device names and options.
3065 7544a042 Stefan Weil
3066 7544a042 Stefan Weil
@printindex tp
3067 7544a042 Stefan Weil
3068 7544a042 Stefan Weil
@node Variable Index
3069 7544a042 Stefan Weil
@section Variable Index
3070 7544a042 Stefan Weil
@printindex vr
3071 7544a042 Stefan Weil
3072 debc7065 bellard
@bye