Statistics
| Branch: | Revision:

root / qemu-doc.texi @ feature-archipelago

History | View | Annotate | Download (91 kB)

1 386405f7 bellard
\input texinfo @c -*- texinfo -*-
2 debc7065 bellard
@c %**start of header
3 debc7065 bellard
@setfilename qemu-doc.info
4 e080e785 Stefan Weil
5 e080e785 Stefan Weil
@documentlanguage en
6 e080e785 Stefan Weil
@documentencoding UTF-8
7 e080e785 Stefan Weil
8 8f40c388 bellard
@settitle QEMU Emulator User Documentation
9 debc7065 bellard
@exampleindent 0
10 debc7065 bellard
@paragraphindent 0
11 debc7065 bellard
@c %**end of header
12 386405f7 bellard
13 a1a32b05 Stefan Weil
@ifinfo
14 a1a32b05 Stefan Weil
@direntry
15 a1a32b05 Stefan Weil
* QEMU: (qemu-doc).    The QEMU Emulator User Documentation.
16 a1a32b05 Stefan Weil
@end direntry
17 a1a32b05 Stefan Weil
@end ifinfo
18 a1a32b05 Stefan Weil
19 0806e3f6 bellard
@iftex
20 386405f7 bellard
@titlepage
21 386405f7 bellard
@sp 7
22 8f40c388 bellard
@center @titlefont{QEMU Emulator}
23 debc7065 bellard
@sp 1
24 debc7065 bellard
@center @titlefont{User Documentation}
25 386405f7 bellard
@sp 3
26 386405f7 bellard
@end titlepage
27 0806e3f6 bellard
@end iftex
28 386405f7 bellard
29 debc7065 bellard
@ifnottex
30 debc7065 bellard
@node Top
31 debc7065 bellard
@top
32 debc7065 bellard
33 debc7065 bellard
@menu
34 debc7065 bellard
* Introduction::
35 debc7065 bellard
* Installation::
36 debc7065 bellard
* QEMU PC System emulator::
37 debc7065 bellard
* QEMU System emulator for non PC targets::
38 83195237 bellard
* QEMU User space emulator::
39 debc7065 bellard
* compilation:: Compilation from the sources
40 7544a042 Stefan Weil
* License::
41 debc7065 bellard
* Index::
42 debc7065 bellard
@end menu
43 debc7065 bellard
@end ifnottex
44 debc7065 bellard
45 debc7065 bellard
@contents
46 debc7065 bellard
47 debc7065 bellard
@node Introduction
48 386405f7 bellard
@chapter Introduction
49 386405f7 bellard
50 debc7065 bellard
@menu
51 debc7065 bellard
* intro_features:: Features
52 debc7065 bellard
@end menu
53 debc7065 bellard
54 debc7065 bellard
@node intro_features
55 322d0c66 bellard
@section Features
56 386405f7 bellard
57 1f673135 bellard
QEMU is a FAST! processor emulator using dynamic translation to
58 1f673135 bellard
achieve good emulation speed.
59 1eb20527 bellard
60 1eb20527 bellard
QEMU has two operating modes:
61 0806e3f6 bellard
62 d7e5edca Stefan Weil
@itemize
63 7544a042 Stefan Weil
@cindex operating modes
64 0806e3f6 bellard
65 5fafdf24 ths
@item
66 7544a042 Stefan Weil
@cindex system emulation
67 1f673135 bellard
Full system emulation. In this mode, QEMU emulates a full system (for
68 3f9f3aa1 bellard
example a PC), including one or several processors and various
69 3f9f3aa1 bellard
peripherals. It can be used to launch different Operating Systems
70 3f9f3aa1 bellard
without rebooting the PC or to debug system code.
71 1eb20527 bellard
72 5fafdf24 ths
@item
73 7544a042 Stefan Weil
@cindex user mode emulation
74 83195237 bellard
User mode emulation. In this mode, QEMU can launch
75 83195237 bellard
processes compiled for one CPU on another CPU. It can be used to
76 1f673135 bellard
launch the Wine Windows API emulator (@url{http://www.winehq.org}) or
77 1f673135 bellard
to ease cross-compilation and cross-debugging.
78 1eb20527 bellard
79 1eb20527 bellard
@end itemize
80 1eb20527 bellard
81 e1b4382c Stefan Weil
QEMU can run without a host kernel driver and yet gives acceptable
82 5fafdf24 ths
performance.
83 322d0c66 bellard
84 52c00a5f bellard
For system emulation, the following hardware targets are supported:
85 52c00a5f bellard
@itemize
86 7544a042 Stefan Weil
@cindex emulated target systems
87 7544a042 Stefan Weil
@cindex supported target systems
88 9d0a8e6f bellard
@item PC (x86 or x86_64 processor)
89 3f9f3aa1 bellard
@item ISA PC (old style PC without PCI bus)
90 52c00a5f bellard
@item PREP (PowerPC processor)
91 d45952a0 aurel32
@item G3 Beige PowerMac (PowerPC processor)
92 9d0a8e6f bellard
@item Mac99 PowerMac (PowerPC processor, in progress)
93 ee76f82e blueswir1
@item Sun4m/Sun4c/Sun4d (32-bit Sparc processor)
94 c7ba218d blueswir1
@item Sun4u/Sun4v (64-bit Sparc processor, in progress)
95 d9aedc32 ths
@item Malta board (32-bit and 64-bit MIPS processors)
96 88cb0a02 aurel32
@item MIPS Magnum (64-bit MIPS processor)
97 9ee6e8bb pbrook
@item ARM Integrator/CP (ARM)
98 9ee6e8bb pbrook
@item ARM Versatile baseboard (ARM)
99 0ef849d7 Paul Brook
@item ARM RealView Emulation/Platform baseboard (ARM)
100 ef4c3856 balrog
@item Spitz, Akita, Borzoi, Terrier and Tosa PDAs (PXA270 processor)
101 9ee6e8bb pbrook
@item Luminary Micro LM3S811EVB (ARM Cortex-M3)
102 9ee6e8bb pbrook
@item Luminary Micro LM3S6965EVB (ARM Cortex-M3)
103 707e011b pbrook
@item Freescale MCF5208EVB (ColdFire V2).
104 209a4e69 pbrook
@item Arnewsh MCF5206 evaluation board (ColdFire V2).
105 02645926 balrog
@item Palm Tungsten|E PDA (OMAP310 processor)
106 c30bb264 balrog
@item N800 and N810 tablets (OMAP2420 processor)
107 57cd6e97 balrog
@item MusicPal (MV88W8618 ARM processor)
108 ef4c3856 balrog
@item Gumstix "Connex" and "Verdex" motherboards (PXA255/270).
109 ef4c3856 balrog
@item Siemens SX1 smartphone (OMAP310 processor)
110 48c50a62 Edgar E. Iglesias
@item AXIS-Devboard88 (CRISv32 ETRAX-FS).
111 48c50a62 Edgar E. Iglesias
@item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
112 3aeaea65 Max Filippov
@item Avnet LX60/LX110/LX200 boards (Xtensa)
113 52c00a5f bellard
@end itemize
114 386405f7 bellard
115 7544a042 Stefan Weil
@cindex supported user mode targets
116 7544a042 Stefan Weil
For user emulation, x86 (32 and 64 bit), PowerPC (32 and 64 bit),
117 7544a042 Stefan Weil
ARM, MIPS (32 bit only), Sparc (32 and 64 bit),
118 7544a042 Stefan Weil
Alpha, ColdFire(m68k), CRISv32 and MicroBlaze CPUs are supported.
119 0806e3f6 bellard
120 debc7065 bellard
@node Installation
121 5b9f457a bellard
@chapter Installation
122 5b9f457a bellard
123 15a34c63 bellard
If you want to compile QEMU yourself, see @ref{compilation}.
124 15a34c63 bellard
125 debc7065 bellard
@menu
126 debc7065 bellard
* install_linux::   Linux
127 debc7065 bellard
* install_windows:: Windows
128 debc7065 bellard
* install_mac::     Macintosh
129 debc7065 bellard
@end menu
130 debc7065 bellard
131 debc7065 bellard
@node install_linux
132 1f673135 bellard
@section Linux
133 7544a042 Stefan Weil
@cindex installation (Linux)
134 1f673135 bellard
135 7c3fc84d bellard
If a precompiled package is available for your distribution - you just
136 7c3fc84d bellard
have to install it. Otherwise, see @ref{compilation}.
137 5b9f457a bellard
138 debc7065 bellard
@node install_windows
139 1f673135 bellard
@section Windows
140 7544a042 Stefan Weil
@cindex installation (Windows)
141 8cd0ac2f bellard
142 15a34c63 bellard
Download the experimental binary installer at
143 debc7065 bellard
@url{http://www.free.oszoo.org/@/download.html}.
144 7544a042 Stefan Weil
TODO (no longer available)
145 d691f669 bellard
146 debc7065 bellard
@node install_mac
147 1f673135 bellard
@section Mac OS X
148 d691f669 bellard
149 15a34c63 bellard
Download the experimental binary installer at
150 debc7065 bellard
@url{http://www.free.oszoo.org/@/download.html}.
151 7544a042 Stefan Weil
TODO (no longer available)
152 df0f11a0 bellard
153 debc7065 bellard
@node QEMU PC System emulator
154 3f9f3aa1 bellard
@chapter QEMU PC System emulator
155 7544a042 Stefan Weil
@cindex system emulation (PC)
156 1eb20527 bellard
157 debc7065 bellard
@menu
158 debc7065 bellard
* pcsys_introduction:: Introduction
159 debc7065 bellard
* pcsys_quickstart::   Quick Start
160 debc7065 bellard
* sec_invocation::     Invocation
161 debc7065 bellard
* pcsys_keys::         Keys
162 debc7065 bellard
* pcsys_monitor::      QEMU Monitor
163 debc7065 bellard
* disk_images::        Disk Images
164 debc7065 bellard
* pcsys_network::      Network emulation
165 576fd0a1 Stefan Weil
* pcsys_other_devs::   Other Devices
166 debc7065 bellard
* direct_linux_boot::  Direct Linux Boot
167 debc7065 bellard
* pcsys_usb::          USB emulation
168 f858dcae ths
* vnc_security::       VNC security
169 debc7065 bellard
* gdb_usage::          GDB usage
170 debc7065 bellard
* pcsys_os_specific::  Target OS specific information
171 debc7065 bellard
@end menu
172 debc7065 bellard
173 debc7065 bellard
@node pcsys_introduction
174 0806e3f6 bellard
@section Introduction
175 0806e3f6 bellard
176 0806e3f6 bellard
@c man begin DESCRIPTION
177 0806e3f6 bellard
178 3f9f3aa1 bellard
The QEMU PC System emulator simulates the
179 3f9f3aa1 bellard
following peripherals:
180 0806e3f6 bellard
181 0806e3f6 bellard
@itemize @minus
182 5fafdf24 ths
@item
183 15a34c63 bellard
i440FX host PCI bridge and PIIX3 PCI to ISA bridge
184 0806e3f6 bellard
@item
185 15a34c63 bellard
Cirrus CLGD 5446 PCI VGA card or dummy VGA card with Bochs VESA
186 15a34c63 bellard
extensions (hardware level, including all non standard modes).
187 0806e3f6 bellard
@item
188 0806e3f6 bellard
PS/2 mouse and keyboard
189 5fafdf24 ths
@item
190 15a34c63 bellard
2 PCI IDE interfaces with hard disk and CD-ROM support
191 1f673135 bellard
@item
192 1f673135 bellard
Floppy disk
193 5fafdf24 ths
@item
194 3a2eeac0 Stefan Weil
PCI and ISA network adapters
195 0806e3f6 bellard
@item
196 05d5818c bellard
Serial ports
197 05d5818c bellard
@item
198 c0fe3827 bellard
Creative SoundBlaster 16 sound card
199 c0fe3827 bellard
@item
200 c0fe3827 bellard
ENSONIQ AudioPCI ES1370 sound card
201 c0fe3827 bellard
@item
202 e5c9a13e balrog
Intel 82801AA AC97 Audio compatible sound card
203 e5c9a13e balrog
@item
204 7d72e762 Gerd Hoffmann
Intel HD Audio Controller and HDA codec
205 7d72e762 Gerd Hoffmann
@item
206 2d983446 Stefan Weil
Adlib (OPL2) - Yamaha YM3812 compatible chip
207 b389dbfb bellard
@item
208 26463dbc balrog
Gravis Ultrasound GF1 sound card
209 26463dbc balrog
@item
210 cc53d26d malc
CS4231A compatible sound card
211 cc53d26d malc
@item
212 b389dbfb bellard
PCI UHCI USB controller and a virtual USB hub.
213 0806e3f6 bellard
@end itemize
214 0806e3f6 bellard
215 3f9f3aa1 bellard
SMP is supported with up to 255 CPUs.
216 3f9f3aa1 bellard
217 a8ad4159 Michael Tokarev
QEMU uses the PC BIOS from the Seabios project and the Plex86/Bochs LGPL
218 15a34c63 bellard
VGA BIOS.
219 15a34c63 bellard
220 c0fe3827 bellard
QEMU uses YM3812 emulation by Tatsuyuki Satoh.
221 c0fe3827 bellard
222 2d983446 Stefan Weil
QEMU uses GUS emulation (GUSEMU32 @url{http://www.deinmeister.de/gusemu/})
223 26463dbc balrog
by Tibor "TS" Schรผtz.
224 423d65f4 balrog
225 1a1a0e20 Bernhard Reutner-Fischer
Note that, by default, GUS shares IRQ(7) with parallel ports and so
226 b65ee4fa Stefan Weil
QEMU must be told to not have parallel ports to have working GUS.
227 720036a5 malc
228 720036a5 malc
@example
229 3804da9d Stefan Weil
qemu-system-i386 dos.img -soundhw gus -parallel none
230 720036a5 malc
@end example
231 720036a5 malc
232 720036a5 malc
Alternatively:
233 720036a5 malc
@example
234 3804da9d Stefan Weil
qemu-system-i386 dos.img -device gus,irq=5
235 720036a5 malc
@end example
236 720036a5 malc
237 720036a5 malc
Or some other unclaimed IRQ.
238 720036a5 malc
239 cc53d26d malc
CS4231A is the chip used in Windows Sound System and GUSMAX products
240 cc53d26d malc
241 0806e3f6 bellard
@c man end
242 0806e3f6 bellard
243 debc7065 bellard
@node pcsys_quickstart
244 1eb20527 bellard
@section Quick Start
245 7544a042 Stefan Weil
@cindex quick start
246 1eb20527 bellard
247 285dc330 bellard
Download and uncompress the linux image (@file{linux.img}) and type:
248 0806e3f6 bellard
249 0806e3f6 bellard
@example
250 3804da9d Stefan Weil
qemu-system-i386 linux.img
251 0806e3f6 bellard
@end example
252 0806e3f6 bellard
253 0806e3f6 bellard
Linux should boot and give you a prompt.
254 0806e3f6 bellard
255 6cc721cf bellard
@node sec_invocation
256 ec410fc9 bellard
@section Invocation
257 ec410fc9 bellard
258 ec410fc9 bellard
@example
259 0806e3f6 bellard
@c man begin SYNOPSIS
260 3804da9d Stefan Weil
usage: qemu-system-i386 [options] [@var{disk_image}]
261 0806e3f6 bellard
@c man end
262 ec410fc9 bellard
@end example
263 ec410fc9 bellard
264 0806e3f6 bellard
@c man begin OPTIONS
265 d2c639d6 blueswir1
@var{disk_image} is a raw hard disk image for IDE hard disk 0. Some
266 d2c639d6 blueswir1
targets do not need a disk image.
267 ec410fc9 bellard
268 5824d651 blueswir1
@include qemu-options.texi
269 ec410fc9 bellard
270 3e11db9a bellard
@c man end
271 3e11db9a bellard
272 debc7065 bellard
@node pcsys_keys
273 3e11db9a bellard
@section Keys
274 3e11db9a bellard
275 3e11db9a bellard
@c man begin OPTIONS
276 3e11db9a bellard
277 de1db2a1 Brad Hards
During the graphical emulation, you can use special key combinations to change
278 de1db2a1 Brad Hards
modes. The default key mappings are shown below, but if you use @code{-alt-grab}
279 de1db2a1 Brad Hards
then the modifier is Ctrl-Alt-Shift (instead of Ctrl-Alt) and if you use
280 de1db2a1 Brad Hards
@code{-ctrl-grab} then the modifier is the right Ctrl key (instead of Ctrl-Alt):
281 de1db2a1 Brad Hards
282 a1b74fe8 bellard
@table @key
283 f9859310 bellard
@item Ctrl-Alt-f
284 7544a042 Stefan Weil
@kindex Ctrl-Alt-f
285 a1b74fe8 bellard
Toggle full screen
286 a0a821a4 bellard
287 d6a65ba3 Jan Kiszka
@item Ctrl-Alt-+
288 d6a65ba3 Jan Kiszka
@kindex Ctrl-Alt-+
289 d6a65ba3 Jan Kiszka
Enlarge the screen
290 d6a65ba3 Jan Kiszka
291 d6a65ba3 Jan Kiszka
@item Ctrl-Alt--
292 d6a65ba3 Jan Kiszka
@kindex Ctrl-Alt--
293 d6a65ba3 Jan Kiszka
Shrink the screen
294 d6a65ba3 Jan Kiszka
295 c4a735f9 malc
@item Ctrl-Alt-u
296 7544a042 Stefan Weil
@kindex Ctrl-Alt-u
297 c4a735f9 malc
Restore the screen's un-scaled dimensions
298 c4a735f9 malc
299 f9859310 bellard
@item Ctrl-Alt-n
300 7544a042 Stefan Weil
@kindex Ctrl-Alt-n
301 a0a821a4 bellard
Switch to virtual console 'n'. Standard console mappings are:
302 a0a821a4 bellard
@table @emph
303 a0a821a4 bellard
@item 1
304 a0a821a4 bellard
Target system display
305 a0a821a4 bellard
@item 2
306 a0a821a4 bellard
Monitor
307 a0a821a4 bellard
@item 3
308 a0a821a4 bellard
Serial port
309 a1b74fe8 bellard
@end table
310 a1b74fe8 bellard
311 f9859310 bellard
@item Ctrl-Alt
312 7544a042 Stefan Weil
@kindex Ctrl-Alt
313 a0a821a4 bellard
Toggle mouse and keyboard grab.
314 a0a821a4 bellard
@end table
315 a0a821a4 bellard
316 7544a042 Stefan Weil
@kindex Ctrl-Up
317 7544a042 Stefan Weil
@kindex Ctrl-Down
318 7544a042 Stefan Weil
@kindex Ctrl-PageUp
319 7544a042 Stefan Weil
@kindex Ctrl-PageDown
320 3e11db9a bellard
In the virtual consoles, you can use @key{Ctrl-Up}, @key{Ctrl-Down},
321 3e11db9a bellard
@key{Ctrl-PageUp} and @key{Ctrl-PageDown} to move in the back log.
322 3e11db9a bellard
323 7544a042 Stefan Weil
@kindex Ctrl-a h
324 a0a821a4 bellard
During emulation, if you are using the @option{-nographic} option, use
325 a0a821a4 bellard
@key{Ctrl-a h} to get terminal commands:
326 ec410fc9 bellard
327 ec410fc9 bellard
@table @key
328 a1b74fe8 bellard
@item Ctrl-a h
329 7544a042 Stefan Weil
@kindex Ctrl-a h
330 d2c639d6 blueswir1
@item Ctrl-a ?
331 7544a042 Stefan Weil
@kindex Ctrl-a ?
332 ec410fc9 bellard
Print this help
333 3b46e624 ths
@item Ctrl-a x
334 7544a042 Stefan Weil
@kindex Ctrl-a x
335 366dfc52 ths
Exit emulator
336 3b46e624 ths
@item Ctrl-a s
337 7544a042 Stefan Weil
@kindex Ctrl-a s
338 1f47a922 bellard
Save disk data back to file (if -snapshot)
339 20d8a3ed ths
@item Ctrl-a t
340 7544a042 Stefan Weil
@kindex Ctrl-a t
341 d2c639d6 blueswir1
Toggle console timestamps
342 a1b74fe8 bellard
@item Ctrl-a b
343 7544a042 Stefan Weil
@kindex Ctrl-a b
344 1f673135 bellard
Send break (magic sysrq in Linux)
345 a1b74fe8 bellard
@item Ctrl-a c
346 7544a042 Stefan Weil
@kindex Ctrl-a c
347 1f673135 bellard
Switch between console and monitor
348 a1b74fe8 bellard
@item Ctrl-a Ctrl-a
349 7544a042 Stefan Weil
@kindex Ctrl-a a
350 a1b74fe8 bellard
Send Ctrl-a
351 ec410fc9 bellard
@end table
352 0806e3f6 bellard
@c man end
353 0806e3f6 bellard
354 0806e3f6 bellard
@ignore
355 0806e3f6 bellard
356 1f673135 bellard
@c man begin SEEALSO
357 1f673135 bellard
The HTML documentation of QEMU for more precise information and Linux
358 1f673135 bellard
user mode emulator invocation.
359 1f673135 bellard
@c man end
360 1f673135 bellard
361 1f673135 bellard
@c man begin AUTHOR
362 1f673135 bellard
Fabrice Bellard
363 1f673135 bellard
@c man end
364 1f673135 bellard
365 1f673135 bellard
@end ignore
366 1f673135 bellard
367 debc7065 bellard
@node pcsys_monitor
368 1f673135 bellard
@section QEMU Monitor
369 7544a042 Stefan Weil
@cindex QEMU monitor
370 1f673135 bellard
371 1f673135 bellard
The QEMU monitor is used to give complex commands to the QEMU
372 1f673135 bellard
emulator. You can use it to:
373 1f673135 bellard
374 1f673135 bellard
@itemize @minus
375 1f673135 bellard
376 1f673135 bellard
@item
377 e598752a ths
Remove or insert removable media images
378 89dfe898 ths
(such as CD-ROM or floppies).
379 1f673135 bellard
380 5fafdf24 ths
@item
381 1f673135 bellard
Freeze/unfreeze the Virtual Machine (VM) and save or restore its state
382 1f673135 bellard
from a disk file.
383 1f673135 bellard
384 1f673135 bellard
@item Inspect the VM state without an external debugger.
385 1f673135 bellard
386 1f673135 bellard
@end itemize
387 1f673135 bellard
388 1f673135 bellard
@subsection Commands
389 1f673135 bellard
390 1f673135 bellard
The following commands are available:
391 1f673135 bellard
392 2313086a Blue Swirl
@include qemu-monitor.texi
393 0806e3f6 bellard
394 1f673135 bellard
@subsection Integer expressions
395 1f673135 bellard
396 1f673135 bellard
The monitor understands integers expressions for every integer
397 1f673135 bellard
argument. You can use register names to get the value of specifics
398 1f673135 bellard
CPU registers by prefixing them with @emph{$}.
399 ec410fc9 bellard
400 1f47a922 bellard
@node disk_images
401 1f47a922 bellard
@section Disk Images
402 1f47a922 bellard
403 acd935ef bellard
Since version 0.6.1, QEMU supports many disk image formats, including
404 acd935ef bellard
growable disk images (their size increase as non empty sectors are
405 13a2e80f bellard
written), compressed and encrypted disk images. Version 0.8.3 added
406 13a2e80f bellard
the new qcow2 disk image format which is essential to support VM
407 13a2e80f bellard
snapshots.
408 1f47a922 bellard
409 debc7065 bellard
@menu
410 debc7065 bellard
* disk_images_quickstart::    Quick start for disk image creation
411 debc7065 bellard
* disk_images_snapshot_mode:: Snapshot mode
412 13a2e80f bellard
* vm_snapshots::              VM snapshots
413 debc7065 bellard
* qemu_img_invocation::       qemu-img Invocation
414 975b092b ths
* qemu_nbd_invocation::       qemu-nbd Invocation
415 d3067b02 Kevin Wolf
* disk_images_formats::       Disk image file formats
416 19cb3738 bellard
* host_drives::               Using host drives
417 debc7065 bellard
* disk_images_fat_images::    Virtual FAT disk images
418 75818250 ths
* disk_images_nbd::           NBD access
419 42af9c30 MORITA Kazutaka
* disk_images_sheepdog::      Sheepdog disk images
420 00984e39 Ronnie Sahlberg
* disk_images_iscsi::         iSCSI LUNs
421 8809e289 Bharata B Rao
* disk_images_gluster::       GlusterFS disk images
422 0a12ec87 Richard W.M. Jones
* disk_images_ssh::           Secure Shell (ssh) disk images
423 debc7065 bellard
@end menu
424 debc7065 bellard
425 debc7065 bellard
@node disk_images_quickstart
426 acd935ef bellard
@subsection Quick start for disk image creation
427 acd935ef bellard
428 acd935ef bellard
You can create a disk image with the command:
429 1f47a922 bellard
@example
430 acd935ef bellard
qemu-img create myimage.img mysize
431 1f47a922 bellard
@end example
432 acd935ef bellard
where @var{myimage.img} is the disk image filename and @var{mysize} is its
433 acd935ef bellard
size in kilobytes. You can add an @code{M} suffix to give the size in
434 acd935ef bellard
megabytes and a @code{G} suffix for gigabytes.
435 acd935ef bellard
436 debc7065 bellard
See @ref{qemu_img_invocation} for more information.
437 1f47a922 bellard
438 debc7065 bellard
@node disk_images_snapshot_mode
439 1f47a922 bellard
@subsection Snapshot mode
440 1f47a922 bellard
441 1f47a922 bellard
If you use the option @option{-snapshot}, all disk images are
442 1f47a922 bellard
considered as read only. When sectors in written, they are written in
443 1f47a922 bellard
a temporary file created in @file{/tmp}. You can however force the
444 acd935ef bellard
write back to the raw disk images by using the @code{commit} monitor
445 acd935ef bellard
command (or @key{C-a s} in the serial console).
446 1f47a922 bellard
447 13a2e80f bellard
@node vm_snapshots
448 13a2e80f bellard
@subsection VM snapshots
449 13a2e80f bellard
450 13a2e80f bellard
VM snapshots are snapshots of the complete virtual machine including
451 13a2e80f bellard
CPU state, RAM, device state and the content of all the writable
452 13a2e80f bellard
disks. In order to use VM snapshots, you must have at least one non
453 13a2e80f bellard
removable and writable block device using the @code{qcow2} disk image
454 13a2e80f bellard
format. Normally this device is the first virtual hard drive.
455 13a2e80f bellard
456 13a2e80f bellard
Use the monitor command @code{savevm} to create a new VM snapshot or
457 13a2e80f bellard
replace an existing one. A human readable name can be assigned to each
458 19d36792 bellard
snapshot in addition to its numerical ID.
459 13a2e80f bellard
460 13a2e80f bellard
Use @code{loadvm} to restore a VM snapshot and @code{delvm} to remove
461 13a2e80f bellard
a VM snapshot. @code{info snapshots} lists the available snapshots
462 13a2e80f bellard
with their associated information:
463 13a2e80f bellard
464 13a2e80f bellard
@example
465 13a2e80f bellard
(qemu) info snapshots
466 13a2e80f bellard
Snapshot devices: hda
467 13a2e80f bellard
Snapshot list (from hda):
468 13a2e80f bellard
ID        TAG                 VM SIZE                DATE       VM CLOCK
469 13a2e80f bellard
1         start                   41M 2006-08-06 12:38:02   00:00:14.954
470 13a2e80f bellard
2                                 40M 2006-08-06 12:43:29   00:00:18.633
471 13a2e80f bellard
3         msys                    40M 2006-08-06 12:44:04   00:00:23.514
472 13a2e80f bellard
@end example
473 13a2e80f bellard
474 13a2e80f bellard
A VM snapshot is made of a VM state info (its size is shown in
475 13a2e80f bellard
@code{info snapshots}) and a snapshot of every writable disk image.
476 13a2e80f bellard
The VM state info is stored in the first @code{qcow2} non removable
477 13a2e80f bellard
and writable block device. The disk image snapshots are stored in
478 13a2e80f bellard
every disk image. The size of a snapshot in a disk image is difficult
479 13a2e80f bellard
to evaluate and is not shown by @code{info snapshots} because the
480 13a2e80f bellard
associated disk sectors are shared among all the snapshots to save
481 19d36792 bellard
disk space (otherwise each snapshot would need a full copy of all the
482 19d36792 bellard
disk images).
483 13a2e80f bellard
484 13a2e80f bellard
When using the (unrelated) @code{-snapshot} option
485 13a2e80f bellard
(@ref{disk_images_snapshot_mode}), you can always make VM snapshots,
486 13a2e80f bellard
but they are deleted as soon as you exit QEMU.
487 13a2e80f bellard
488 13a2e80f bellard
VM snapshots currently have the following known limitations:
489 13a2e80f bellard
@itemize
490 5fafdf24 ths
@item
491 13a2e80f bellard
They cannot cope with removable devices if they are removed or
492 13a2e80f bellard
inserted after a snapshot is done.
493 5fafdf24 ths
@item
494 13a2e80f bellard
A few device drivers still have incomplete snapshot support so their
495 13a2e80f bellard
state is not saved or restored properly (in particular USB).
496 13a2e80f bellard
@end itemize
497 13a2e80f bellard
498 acd935ef bellard
@node qemu_img_invocation
499 acd935ef bellard
@subsection @code{qemu-img} Invocation
500 1f47a922 bellard
501 acd935ef bellard
@include qemu-img.texi
502 05efe46e bellard
503 975b092b ths
@node qemu_nbd_invocation
504 975b092b ths
@subsection @code{qemu-nbd} Invocation
505 975b092b ths
506 975b092b ths
@include qemu-nbd.texi
507 975b092b ths
508 d3067b02 Kevin Wolf
@node disk_images_formats
509 d3067b02 Kevin Wolf
@subsection Disk image file formats
510 d3067b02 Kevin Wolf
511 d3067b02 Kevin Wolf
QEMU supports many image file formats that can be used with VMs as well as with
512 d3067b02 Kevin Wolf
any of the tools (like @code{qemu-img}). This includes the preferred formats
513 d3067b02 Kevin Wolf
raw and qcow2 as well as formats that are supported for compatibility with
514 d3067b02 Kevin Wolf
older QEMU versions or other hypervisors.
515 d3067b02 Kevin Wolf
516 d3067b02 Kevin Wolf
Depending on the image format, different options can be passed to
517 d3067b02 Kevin Wolf
@code{qemu-img create} and @code{qemu-img convert} using the @code{-o} option.
518 d3067b02 Kevin Wolf
This section describes each format and the options that are supported for it.
519 d3067b02 Kevin Wolf
520 d3067b02 Kevin Wolf
@table @option
521 d3067b02 Kevin Wolf
@item raw
522 d3067b02 Kevin Wolf
523 d3067b02 Kevin Wolf
Raw disk image format. This format has the advantage of
524 d3067b02 Kevin Wolf
being simple and easily exportable to all other emulators. If your
525 d3067b02 Kevin Wolf
file system supports @emph{holes} (for example in ext2 or ext3 on
526 d3067b02 Kevin Wolf
Linux or NTFS on Windows), then only the written sectors will reserve
527 d3067b02 Kevin Wolf
space. Use @code{qemu-img info} to know the real size used by the
528 d3067b02 Kevin Wolf
image or @code{ls -ls} on Unix/Linux.
529 d3067b02 Kevin Wolf
530 d3067b02 Kevin Wolf
@item qcow2
531 d3067b02 Kevin Wolf
QEMU image format, the most versatile format. Use it to have smaller
532 d3067b02 Kevin Wolf
images (useful if your filesystem does not supports holes, for example
533 d3067b02 Kevin Wolf
on Windows), optional AES encryption, zlib based compression and
534 d3067b02 Kevin Wolf
support of multiple VM snapshots.
535 d3067b02 Kevin Wolf
536 d3067b02 Kevin Wolf
Supported options:
537 d3067b02 Kevin Wolf
@table @code
538 d3067b02 Kevin Wolf
@item compat
539 7fa9e1f9 Stefan Hajnoczi
Determines the qcow2 version to use. @code{compat=0.10} uses the
540 7fa9e1f9 Stefan Hajnoczi
traditional image format that can be read by any QEMU since 0.10.
541 d3067b02 Kevin Wolf
@code{compat=1.1} enables image format extensions that only QEMU 1.1 and
542 7fa9e1f9 Stefan Hajnoczi
newer understand (this is the default). Amongst others, this includes
543 7fa9e1f9 Stefan Hajnoczi
zero clusters, which allow efficient copy-on-read for sparse images.
544 d3067b02 Kevin Wolf
545 d3067b02 Kevin Wolf
@item backing_file
546 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand)
547 d3067b02 Kevin Wolf
@item backing_fmt
548 d3067b02 Kevin Wolf
Image format of the base image
549 d3067b02 Kevin Wolf
@item encryption
550 136cd19d Daniel P. Berrange
If this option is set to @code{on}, the image is encrypted with 128-bit AES-CBC.
551 d3067b02 Kevin Wolf
552 136cd19d Daniel P. Berrange
The use of encryption in qcow and qcow2 images is considered to be flawed by
553 136cd19d Daniel P. Berrange
modern cryptography standards, suffering from a number of design problems:
554 136cd19d Daniel P. Berrange
555 136cd19d Daniel P. Berrange
@itemize @minus
556 136cd19d Daniel P. Berrange
@item The AES-CBC cipher is used with predictable initialization vectors based
557 136cd19d Daniel P. Berrange
on the sector number. This makes it vulnerable to chosen plaintext attacks
558 136cd19d Daniel P. Berrange
which can reveal the existence of encrypted data.
559 136cd19d Daniel P. Berrange
@item The user passphrase is directly used as the encryption key. A poorly
560 136cd19d Daniel P. Berrange
chosen or short passphrase will compromise the security of the encryption.
561 136cd19d Daniel P. Berrange
@item In the event of the passphrase being compromised there is no way to
562 136cd19d Daniel P. Berrange
change the passphrase to protect data in any qcow images. The files must
563 136cd19d Daniel P. Berrange
be cloned, using a different encryption passphrase in the new file. The
564 136cd19d Daniel P. Berrange
original file must then be securely erased using a program like shred,
565 136cd19d Daniel P. Berrange
though even this is ineffective with many modern storage technologies.
566 136cd19d Daniel P. Berrange
@end itemize
567 136cd19d Daniel P. Berrange
568 136cd19d Daniel P. Berrange
Use of qcow / qcow2 encryption is thus strongly discouraged. Users are
569 136cd19d Daniel P. Berrange
recommended to use an alternative encryption technology such as the
570 136cd19d Daniel P. Berrange
Linux dm-crypt / LUKS system.
571 d3067b02 Kevin Wolf
572 d3067b02 Kevin Wolf
@item cluster_size
573 d3067b02 Kevin Wolf
Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
574 d3067b02 Kevin Wolf
sizes can improve the image file size whereas larger cluster sizes generally
575 d3067b02 Kevin Wolf
provide better performance.
576 d3067b02 Kevin Wolf
577 d3067b02 Kevin Wolf
@item preallocation
578 d3067b02 Kevin Wolf
Preallocation mode (allowed values: off, metadata). An image with preallocated
579 d3067b02 Kevin Wolf
metadata is initially larger but can improve performance when the image needs
580 d3067b02 Kevin Wolf
to grow.
581 d3067b02 Kevin Wolf
582 d3067b02 Kevin Wolf
@item lazy_refcounts
583 d3067b02 Kevin Wolf
If this option is set to @code{on}, reference count updates are postponed with
584 d3067b02 Kevin Wolf
the goal of avoiding metadata I/O and improving performance. This is
585 d3067b02 Kevin Wolf
particularly interesting with @option{cache=writethrough} which doesn't batch
586 d3067b02 Kevin Wolf
metadata updates. The tradeoff is that after a host crash, the reference count
587 d3067b02 Kevin Wolf
tables must be rebuilt, i.e. on the next open an (automatic) @code{qemu-img
588 d3067b02 Kevin Wolf
check -r all} is required, which may take some time.
589 d3067b02 Kevin Wolf
590 d3067b02 Kevin Wolf
This option can only be enabled if @code{compat=1.1} is specified.
591 d3067b02 Kevin Wolf
592 d3067b02 Kevin Wolf
@end table
593 d3067b02 Kevin Wolf
594 d3067b02 Kevin Wolf
@item qed
595 d3067b02 Kevin Wolf
Old QEMU image format with support for backing files and compact image files
596 d3067b02 Kevin Wolf
(when your filesystem or transport medium does not support holes).
597 d3067b02 Kevin Wolf
598 d3067b02 Kevin Wolf
When converting QED images to qcow2, you might want to consider using the
599 d3067b02 Kevin Wolf
@code{lazy_refcounts=on} option to get a more QED-like behaviour.
600 d3067b02 Kevin Wolf
601 d3067b02 Kevin Wolf
Supported options:
602 d3067b02 Kevin Wolf
@table @code
603 d3067b02 Kevin Wolf
@item backing_file
604 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand).
605 d3067b02 Kevin Wolf
@item backing_fmt
606 d3067b02 Kevin Wolf
Image file format of backing file (optional).  Useful if the format cannot be
607 d3067b02 Kevin Wolf
autodetected because it has no header, like some vhd/vpc files.
608 d3067b02 Kevin Wolf
@item cluster_size
609 d3067b02 Kevin Wolf
Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
610 d3067b02 Kevin Wolf
cluster sizes can improve the image file size whereas larger cluster sizes
611 d3067b02 Kevin Wolf
generally provide better performance.
612 d3067b02 Kevin Wolf
@item table_size
613 d3067b02 Kevin Wolf
Changes the number of clusters per L1/L2 table (must be power-of-2 between 1
614 d3067b02 Kevin Wolf
and 16).  There is normally no need to change this value but this option can be
615 d3067b02 Kevin Wolf
used for performance benchmarking.
616 d3067b02 Kevin Wolf
@end table
617 d3067b02 Kevin Wolf
618 d3067b02 Kevin Wolf
@item qcow
619 d3067b02 Kevin Wolf
Old QEMU image format with support for backing files, compact image files,
620 d3067b02 Kevin Wolf
encryption and compression.
621 d3067b02 Kevin Wolf
622 d3067b02 Kevin Wolf
Supported options:
623 d3067b02 Kevin Wolf
@table @code
624 d3067b02 Kevin Wolf
@item backing_file
625 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand)
626 d3067b02 Kevin Wolf
@item encryption
627 d3067b02 Kevin Wolf
If this option is set to @code{on}, the image is encrypted.
628 d3067b02 Kevin Wolf
@end table
629 d3067b02 Kevin Wolf
630 d3067b02 Kevin Wolf
@item cow
631 d3067b02 Kevin Wolf
User Mode Linux Copy On Write image format. It is supported only for
632 d3067b02 Kevin Wolf
compatibility with previous versions.
633 d3067b02 Kevin Wolf
Supported options:
634 d3067b02 Kevin Wolf
@table @code
635 d3067b02 Kevin Wolf
@item backing_file
636 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand)
637 d3067b02 Kevin Wolf
@end table
638 d3067b02 Kevin Wolf
639 d3067b02 Kevin Wolf
@item vdi
640 d3067b02 Kevin Wolf
VirtualBox 1.1 compatible image format.
641 d3067b02 Kevin Wolf
Supported options:
642 d3067b02 Kevin Wolf
@table @code
643 d3067b02 Kevin Wolf
@item static
644 d3067b02 Kevin Wolf
If this option is set to @code{on}, the image is created with metadata
645 d3067b02 Kevin Wolf
preallocation.
646 d3067b02 Kevin Wolf
@end table
647 d3067b02 Kevin Wolf
648 d3067b02 Kevin Wolf
@item vmdk
649 d3067b02 Kevin Wolf
VMware 3 and 4 compatible image format.
650 d3067b02 Kevin Wolf
651 d3067b02 Kevin Wolf
Supported options:
652 d3067b02 Kevin Wolf
@table @code
653 d3067b02 Kevin Wolf
@item backing_file
654 d3067b02 Kevin Wolf
File name of a base image (see @option{create} subcommand).
655 d3067b02 Kevin Wolf
@item compat6
656 d3067b02 Kevin Wolf
Create a VMDK version 6 image (instead of version 4)
657 d3067b02 Kevin Wolf
@item subformat
658 d3067b02 Kevin Wolf
Specifies which VMDK subformat to use. Valid options are
659 d3067b02 Kevin Wolf
@code{monolithicSparse} (default),
660 d3067b02 Kevin Wolf
@code{monolithicFlat},
661 d3067b02 Kevin Wolf
@code{twoGbMaxExtentSparse},
662 d3067b02 Kevin Wolf
@code{twoGbMaxExtentFlat} and
663 d3067b02 Kevin Wolf
@code{streamOptimized}.
664 d3067b02 Kevin Wolf
@end table
665 d3067b02 Kevin Wolf
666 d3067b02 Kevin Wolf
@item vpc
667 d3067b02 Kevin Wolf
VirtualPC compatible image format (VHD).
668 d3067b02 Kevin Wolf
Supported options:
669 d3067b02 Kevin Wolf
@table @code
670 d3067b02 Kevin Wolf
@item subformat
671 d3067b02 Kevin Wolf
Specifies which VHD subformat to use. Valid options are
672 d3067b02 Kevin Wolf
@code{dynamic} (default) and @code{fixed}.
673 d3067b02 Kevin Wolf
@end table
674 8282db1b Jeff Cody
675 8282db1b Jeff Cody
@item VHDX
676 8282db1b Jeff Cody
Hyper-V compatible image format (VHDX).
677 8282db1b Jeff Cody
Supported options:
678 8282db1b Jeff Cody
@table @code
679 8282db1b Jeff Cody
@item subformat
680 8282db1b Jeff Cody
Specifies which VHDX subformat to use. Valid options are
681 8282db1b Jeff Cody
@code{dynamic} (default) and @code{fixed}.
682 8282db1b Jeff Cody
@item block_state_zero
683 8282db1b Jeff Cody
Force use of payload blocks of type 'ZERO'.
684 8282db1b Jeff Cody
@item block_size
685 8282db1b Jeff Cody
Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on image size.
686 8282db1b Jeff Cody
@item log_size
687 8282db1b Jeff Cody
Log size; min 1 MB.
688 8282db1b Jeff Cody
@end table
689 d3067b02 Kevin Wolf
@end table
690 d3067b02 Kevin Wolf
691 d3067b02 Kevin Wolf
@subsubsection Read-only formats
692 d3067b02 Kevin Wolf
More disk image file formats are supported in a read-only mode.
693 d3067b02 Kevin Wolf
@table @option
694 d3067b02 Kevin Wolf
@item bochs
695 d3067b02 Kevin Wolf
Bochs images of @code{growing} type.
696 d3067b02 Kevin Wolf
@item cloop
697 d3067b02 Kevin Wolf
Linux Compressed Loop image, useful only to reuse directly compressed
698 d3067b02 Kevin Wolf
CD-ROM images present for example in the Knoppix CD-ROMs.
699 d3067b02 Kevin Wolf
@item dmg
700 d3067b02 Kevin Wolf
Apple disk image.
701 d3067b02 Kevin Wolf
@item parallels
702 d3067b02 Kevin Wolf
Parallels disk image format.
703 d3067b02 Kevin Wolf
@end table
704 d3067b02 Kevin Wolf
705 d3067b02 Kevin Wolf
706 19cb3738 bellard
@node host_drives
707 19cb3738 bellard
@subsection Using host drives
708 19cb3738 bellard
709 19cb3738 bellard
In addition to disk image files, QEMU can directly access host
710 19cb3738 bellard
devices. We describe here the usage for QEMU version >= 0.8.3.
711 19cb3738 bellard
712 19cb3738 bellard
@subsubsection Linux
713 19cb3738 bellard
714 19cb3738 bellard
On Linux, you can directly use the host device filename instead of a
715 4be456f1 ths
disk image filename provided you have enough privileges to access
716 19cb3738 bellard
it. For example, use @file{/dev/cdrom} to access to the CDROM or
717 19cb3738 bellard
@file{/dev/fd0} for the floppy.
718 19cb3738 bellard
719 f542086d bellard
@table @code
720 19cb3738 bellard
@item CD
721 19cb3738 bellard
You can specify a CDROM device even if no CDROM is loaded. QEMU has
722 19cb3738 bellard
specific code to detect CDROM insertion or removal. CDROM ejection by
723 19cb3738 bellard
the guest OS is supported. Currently only data CDs are supported.
724 19cb3738 bellard
@item Floppy
725 19cb3738 bellard
You can specify a floppy device even if no floppy is loaded. Floppy
726 19cb3738 bellard
removal is currently not detected accurately (if you change floppy
727 19cb3738 bellard
without doing floppy access while the floppy is not loaded, the guest
728 19cb3738 bellard
OS will think that the same floppy is loaded).
729 19cb3738 bellard
@item Hard disks
730 19cb3738 bellard
Hard disks can be used. Normally you must specify the whole disk
731 19cb3738 bellard
(@file{/dev/hdb} instead of @file{/dev/hdb1}) so that the guest OS can
732 19cb3738 bellard
see it as a partitioned disk. WARNING: unless you know what you do, it
733 19cb3738 bellard
is better to only make READ-ONLY accesses to the hard disk otherwise
734 19cb3738 bellard
you may corrupt your host data (use the @option{-snapshot} command
735 19cb3738 bellard
line option or modify the device permissions accordingly).
736 19cb3738 bellard
@end table
737 19cb3738 bellard
738 19cb3738 bellard
@subsubsection Windows
739 19cb3738 bellard
740 01781963 bellard
@table @code
741 01781963 bellard
@item CD
742 4be456f1 ths
The preferred syntax is the drive letter (e.g. @file{d:}). The
743 01781963 bellard
alternate syntax @file{\\.\d:} is supported. @file{/dev/cdrom} is
744 01781963 bellard
supported as an alias to the first CDROM drive.
745 19cb3738 bellard
746 e598752a ths
Currently there is no specific code to handle removable media, so it
747 19cb3738 bellard
is better to use the @code{change} or @code{eject} monitor commands to
748 19cb3738 bellard
change or eject media.
749 01781963 bellard
@item Hard disks
750 89dfe898 ths
Hard disks can be used with the syntax: @file{\\.\PhysicalDrive@var{N}}
751 01781963 bellard
where @var{N} is the drive number (0 is the first hard disk).
752 01781963 bellard
753 01781963 bellard
WARNING: unless you know what you do, it is better to only make
754 01781963 bellard
READ-ONLY accesses to the hard disk otherwise you may corrupt your
755 01781963 bellard
host data (use the @option{-snapshot} command line so that the
756 01781963 bellard
modifications are written in a temporary file).
757 01781963 bellard
@end table
758 01781963 bellard
759 19cb3738 bellard
760 19cb3738 bellard
@subsubsection Mac OS X
761 19cb3738 bellard
762 5fafdf24 ths
@file{/dev/cdrom} is an alias to the first CDROM.
763 19cb3738 bellard
764 e598752a ths
Currently there is no specific code to handle removable media, so it
765 19cb3738 bellard
is better to use the @code{change} or @code{eject} monitor commands to
766 19cb3738 bellard
change or eject media.
767 19cb3738 bellard
768 debc7065 bellard
@node disk_images_fat_images
769 2c6cadd4 bellard
@subsection Virtual FAT disk images
770 2c6cadd4 bellard
771 2c6cadd4 bellard
QEMU can automatically create a virtual FAT disk image from a
772 2c6cadd4 bellard
directory tree. In order to use it, just type:
773 2c6cadd4 bellard
774 5fafdf24 ths
@example
775 3804da9d Stefan Weil
qemu-system-i386 linux.img -hdb fat:/my_directory
776 2c6cadd4 bellard
@end example
777 2c6cadd4 bellard
778 2c6cadd4 bellard
Then you access access to all the files in the @file{/my_directory}
779 2c6cadd4 bellard
directory without having to copy them in a disk image or to export
780 2c6cadd4 bellard
them via SAMBA or NFS. The default access is @emph{read-only}.
781 2c6cadd4 bellard
782 2c6cadd4 bellard
Floppies can be emulated with the @code{:floppy:} option:
783 2c6cadd4 bellard
784 5fafdf24 ths
@example
785 3804da9d Stefan Weil
qemu-system-i386 linux.img -fda fat:floppy:/my_directory
786 2c6cadd4 bellard
@end example
787 2c6cadd4 bellard
788 2c6cadd4 bellard
A read/write support is available for testing (beta stage) with the
789 2c6cadd4 bellard
@code{:rw:} option:
790 2c6cadd4 bellard
791 5fafdf24 ths
@example
792 3804da9d Stefan Weil
qemu-system-i386 linux.img -fda fat:floppy:rw:/my_directory
793 2c6cadd4 bellard
@end example
794 2c6cadd4 bellard
795 2c6cadd4 bellard
What you should @emph{never} do:
796 2c6cadd4 bellard
@itemize
797 2c6cadd4 bellard
@item use non-ASCII filenames ;
798 2c6cadd4 bellard
@item use "-snapshot" together with ":rw:" ;
799 85b2c688 bellard
@item expect it to work when loadvm'ing ;
800 85b2c688 bellard
@item write to the FAT directory on the host system while accessing it with the guest system.
801 2c6cadd4 bellard
@end itemize
802 2c6cadd4 bellard
803 75818250 ths
@node disk_images_nbd
804 75818250 ths
@subsection NBD access
805 75818250 ths
806 75818250 ths
QEMU can access directly to block device exported using the Network Block Device
807 75818250 ths
protocol.
808 75818250 ths
809 75818250 ths
@example
810 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
811 75818250 ths
@end example
812 75818250 ths
813 75818250 ths
If the NBD server is located on the same host, you can use an unix socket instead
814 75818250 ths
of an inet socket:
815 75818250 ths
816 75818250 ths
@example
817 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux.img -hdb nbd+unix://?socket=/tmp/my_socket
818 75818250 ths
@end example
819 75818250 ths
820 75818250 ths
In this case, the block device must be exported using qemu-nbd:
821 75818250 ths
822 75818250 ths
@example
823 75818250 ths
qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
824 75818250 ths
@end example
825 75818250 ths
826 75818250 ths
The use of qemu-nbd allows to share a disk between several guests:
827 75818250 ths
@example
828 75818250 ths
qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
829 75818250 ths
@end example
830 75818250 ths
831 1d7d2a9d Paolo Bonzini
@noindent
832 75818250 ths
and then you can use it with two guests:
833 75818250 ths
@example
834 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
835 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
836 75818250 ths
@end example
837 75818250 ths
838 1d7d2a9d Paolo Bonzini
If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
839 1d7d2a9d Paolo Bonzini
own embedded NBD server), you must specify an export name in the URI:
840 1d45f8b5 Laurent Vivier
@example
841 1d7d2a9d Paolo Bonzini
qemu-system-i386 -cdrom nbd://localhost/debian-500-ppc-netinst
842 1d7d2a9d Paolo Bonzini
qemu-system-i386 -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
843 1d7d2a9d Paolo Bonzini
@end example
844 1d7d2a9d Paolo Bonzini
845 1d7d2a9d Paolo Bonzini
The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
846 1d7d2a9d Paolo Bonzini
also available.  Here are some example of the older syntax:
847 1d7d2a9d Paolo Bonzini
@example
848 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
849 1d7d2a9d Paolo Bonzini
qemu-system-i386 linux2.img -hdb nbd:unix:/tmp/my_socket
850 1d7d2a9d Paolo Bonzini
qemu-system-i386 -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
851 1d45f8b5 Laurent Vivier
@end example
852 1d45f8b5 Laurent Vivier
853 42af9c30 MORITA Kazutaka
@node disk_images_sheepdog
854 42af9c30 MORITA Kazutaka
@subsection Sheepdog disk images
855 42af9c30 MORITA Kazutaka
856 42af9c30 MORITA Kazutaka
Sheepdog is a distributed storage system for QEMU.  It provides highly
857 42af9c30 MORITA Kazutaka
available block level storage volumes that can be attached to
858 42af9c30 MORITA Kazutaka
QEMU-based virtual machines.
859 42af9c30 MORITA Kazutaka
860 42af9c30 MORITA Kazutaka
You can create a Sheepdog disk image with the command:
861 42af9c30 MORITA Kazutaka
@example
862 5d6768e3 MORITA Kazutaka
qemu-img create sheepdog:///@var{image} @var{size}
863 42af9c30 MORITA Kazutaka
@end example
864 42af9c30 MORITA Kazutaka
where @var{image} is the Sheepdog image name and @var{size} is its
865 42af9c30 MORITA Kazutaka
size.
866 42af9c30 MORITA Kazutaka
867 42af9c30 MORITA Kazutaka
To import the existing @var{filename} to Sheepdog, you can use a
868 42af9c30 MORITA Kazutaka
convert command.
869 42af9c30 MORITA Kazutaka
@example
870 5d6768e3 MORITA Kazutaka
qemu-img convert @var{filename} sheepdog:///@var{image}
871 42af9c30 MORITA Kazutaka
@end example
872 42af9c30 MORITA Kazutaka
873 42af9c30 MORITA Kazutaka
You can boot from the Sheepdog disk image with the command:
874 42af9c30 MORITA Kazutaka
@example
875 5d6768e3 MORITA Kazutaka
qemu-system-i386 sheepdog:///@var{image}
876 42af9c30 MORITA Kazutaka
@end example
877 42af9c30 MORITA Kazutaka
878 42af9c30 MORITA Kazutaka
You can also create a snapshot of the Sheepdog image like qcow2.
879 42af9c30 MORITA Kazutaka
@example
880 5d6768e3 MORITA Kazutaka
qemu-img snapshot -c @var{tag} sheepdog:///@var{image}
881 42af9c30 MORITA Kazutaka
@end example
882 42af9c30 MORITA Kazutaka
where @var{tag} is a tag name of the newly created snapshot.
883 42af9c30 MORITA Kazutaka
884 42af9c30 MORITA Kazutaka
To boot from the Sheepdog snapshot, specify the tag name of the
885 42af9c30 MORITA Kazutaka
snapshot.
886 42af9c30 MORITA Kazutaka
@example
887 5d6768e3 MORITA Kazutaka
qemu-system-i386 sheepdog:///@var{image}#@var{tag}
888 42af9c30 MORITA Kazutaka
@end example
889 42af9c30 MORITA Kazutaka
890 42af9c30 MORITA Kazutaka
You can create a cloned image from the existing snapshot.
891 42af9c30 MORITA Kazutaka
@example
892 5d6768e3 MORITA Kazutaka
qemu-img create -b sheepdog:///@var{base}#@var{tag} sheepdog:///@var{image}
893 42af9c30 MORITA Kazutaka
@end example
894 42af9c30 MORITA Kazutaka
where @var{base} is a image name of the source snapshot and @var{tag}
895 42af9c30 MORITA Kazutaka
is its tag name.
896 42af9c30 MORITA Kazutaka
897 1b8bbb46 MORITA Kazutaka
You can use an unix socket instead of an inet socket:
898 1b8bbb46 MORITA Kazutaka
899 1b8bbb46 MORITA Kazutaka
@example
900 1b8bbb46 MORITA Kazutaka
qemu-system-i386 sheepdog+unix:///@var{image}?socket=@var{path}
901 1b8bbb46 MORITA Kazutaka
@end example
902 1b8bbb46 MORITA Kazutaka
903 42af9c30 MORITA Kazutaka
If the Sheepdog daemon doesn't run on the local host, you need to
904 42af9c30 MORITA Kazutaka
specify one of the Sheepdog servers to connect to.
905 42af9c30 MORITA Kazutaka
@example
906 5d6768e3 MORITA Kazutaka
qemu-img create sheepdog://@var{hostname}:@var{port}/@var{image} @var{size}
907 5d6768e3 MORITA Kazutaka
qemu-system-i386 sheepdog://@var{hostname}:@var{port}/@var{image}
908 42af9c30 MORITA Kazutaka
@end example
909 42af9c30 MORITA Kazutaka
910 00984e39 Ronnie Sahlberg
@node disk_images_iscsi
911 00984e39 Ronnie Sahlberg
@subsection iSCSI LUNs
912 00984e39 Ronnie Sahlberg
913 00984e39 Ronnie Sahlberg
iSCSI is a popular protocol used to access SCSI devices across a computer
914 00984e39 Ronnie Sahlberg
network.
915 00984e39 Ronnie Sahlberg
916 00984e39 Ronnie Sahlberg
There are two different ways iSCSI devices can be used by QEMU.
917 00984e39 Ronnie Sahlberg
918 00984e39 Ronnie Sahlberg
The first method is to mount the iSCSI LUN on the host, and make it appear as
919 00984e39 Ronnie Sahlberg
any other ordinary SCSI device on the host and then to access this device as a
920 00984e39 Ronnie Sahlberg
/dev/sd device from QEMU. How to do this differs between host OSes.
921 00984e39 Ronnie Sahlberg
922 00984e39 Ronnie Sahlberg
The second method involves using the iSCSI initiator that is built into
923 00984e39 Ronnie Sahlberg
QEMU. This provides a mechanism that works the same way regardless of which
924 00984e39 Ronnie Sahlberg
host OS you are running QEMU on. This section will describe this second method
925 00984e39 Ronnie Sahlberg
of using iSCSI together with QEMU.
926 00984e39 Ronnie Sahlberg
927 00984e39 Ronnie Sahlberg
In QEMU, iSCSI devices are described using special iSCSI URLs
928 00984e39 Ronnie Sahlberg
929 00984e39 Ronnie Sahlberg
@example
930 00984e39 Ronnie Sahlberg
URL syntax:
931 00984e39 Ronnie Sahlberg
iscsi://[<username>[%<password>]@@]<host>[:<port>]/<target-iqn-name>/<lun>
932 00984e39 Ronnie Sahlberg
@end example
933 00984e39 Ronnie Sahlberg
934 00984e39 Ronnie Sahlberg
Username and password are optional and only used if your target is set up
935 00984e39 Ronnie Sahlberg
using CHAP authentication for access control.
936 00984e39 Ronnie Sahlberg
Alternatively the username and password can also be set via environment
937 00984e39 Ronnie Sahlberg
variables to have these not show up in the process list
938 00984e39 Ronnie Sahlberg
939 00984e39 Ronnie Sahlberg
@example
940 00984e39 Ronnie Sahlberg
export LIBISCSI_CHAP_USERNAME=<username>
941 00984e39 Ronnie Sahlberg
export LIBISCSI_CHAP_PASSWORD=<password>
942 00984e39 Ronnie Sahlberg
iscsi://<host>/<target-iqn-name>/<lun>
943 00984e39 Ronnie Sahlberg
@end example
944 00984e39 Ronnie Sahlberg
945 f9dadc98 Ronnie Sahlberg
Various session related parameters can be set via special options, either
946 f9dadc98 Ronnie Sahlberg
in a configuration file provided via '-readconfig' or directly on the
947 f9dadc98 Ronnie Sahlberg
command line.
948 f9dadc98 Ronnie Sahlberg
949 31459f46 Ronnie Sahlberg
If the initiator-name is not specified qemu will use a default name
950 31459f46 Ronnie Sahlberg
of 'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
951 31459f46 Ronnie Sahlberg
virtual machine.
952 31459f46 Ronnie Sahlberg
953 31459f46 Ronnie Sahlberg
954 f9dadc98 Ronnie Sahlberg
@example
955 f9dadc98 Ronnie Sahlberg
Setting a specific initiator name to use when logging in to the target
956 f9dadc98 Ronnie Sahlberg
-iscsi initiator-name=iqn.qemu.test:my-initiator
957 f9dadc98 Ronnie Sahlberg
@end example
958 f9dadc98 Ronnie Sahlberg
959 f9dadc98 Ronnie Sahlberg
@example
960 f9dadc98 Ronnie Sahlberg
Controlling which type of header digest to negotiate with the target
961 f9dadc98 Ronnie Sahlberg
-iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
962 f9dadc98 Ronnie Sahlberg
@end example
963 f9dadc98 Ronnie Sahlberg
964 f9dadc98 Ronnie Sahlberg
These can also be set via a configuration file
965 f9dadc98 Ronnie Sahlberg
@example
966 f9dadc98 Ronnie Sahlberg
[iscsi]
967 f9dadc98 Ronnie Sahlberg
  user = "CHAP username"
968 f9dadc98 Ronnie Sahlberg
  password = "CHAP password"
969 f9dadc98 Ronnie Sahlberg
  initiator-name = "iqn.qemu.test:my-initiator"
970 f9dadc98 Ronnie Sahlberg
  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
971 f9dadc98 Ronnie Sahlberg
  header-digest = "CRC32C"
972 f9dadc98 Ronnie Sahlberg
@end example
973 f9dadc98 Ronnie Sahlberg
974 f9dadc98 Ronnie Sahlberg
975 f9dadc98 Ronnie Sahlberg
Setting the target name allows different options for different targets
976 f9dadc98 Ronnie Sahlberg
@example
977 f9dadc98 Ronnie Sahlberg
[iscsi "iqn.target.name"]
978 f9dadc98 Ronnie Sahlberg
  user = "CHAP username"
979 f9dadc98 Ronnie Sahlberg
  password = "CHAP password"
980 f9dadc98 Ronnie Sahlberg
  initiator-name = "iqn.qemu.test:my-initiator"
981 f9dadc98 Ronnie Sahlberg
  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
982 f9dadc98 Ronnie Sahlberg
  header-digest = "CRC32C"
983 f9dadc98 Ronnie Sahlberg
@end example
984 f9dadc98 Ronnie Sahlberg
985 f9dadc98 Ronnie Sahlberg
986 f9dadc98 Ronnie Sahlberg
Howto use a configuration file to set iSCSI configuration options:
987 f9dadc98 Ronnie Sahlberg
@example
988 f9dadc98 Ronnie Sahlberg
cat >iscsi.conf <<EOF
989 f9dadc98 Ronnie Sahlberg
[iscsi]
990 f9dadc98 Ronnie Sahlberg
  user = "me"
991 f9dadc98 Ronnie Sahlberg
  password = "my password"
992 f9dadc98 Ronnie Sahlberg
  initiator-name = "iqn.qemu.test:my-initiator"
993 f9dadc98 Ronnie Sahlberg
  header-digest = "CRC32C"
994 f9dadc98 Ronnie Sahlberg
EOF
995 f9dadc98 Ronnie Sahlberg
996 f9dadc98 Ronnie Sahlberg
qemu-system-i386 -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
997 f9dadc98 Ronnie Sahlberg
    -readconfig iscsi.conf
998 f9dadc98 Ronnie Sahlberg
@end example
999 f9dadc98 Ronnie Sahlberg
1000 f9dadc98 Ronnie Sahlberg
1001 00984e39 Ronnie Sahlberg
Howto set up a simple iSCSI target on loopback and accessing it via QEMU:
1002 00984e39 Ronnie Sahlberg
@example
1003 00984e39 Ronnie Sahlberg
This example shows how to set up an iSCSI target with one CDROM and one DISK
1004 00984e39 Ronnie Sahlberg
using the Linux STGT software target. This target is available on Red Hat based
1005 00984e39 Ronnie Sahlberg
systems as the package 'scsi-target-utils'.
1006 00984e39 Ronnie Sahlberg
1007 00984e39 Ronnie Sahlberg
tgtd --iscsi portal=127.0.0.1:3260
1008 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
1009 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \
1010 00984e39 Ronnie Sahlberg
    -b /IMAGES/disk.img --device-type=disk
1011 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \
1012 00984e39 Ronnie Sahlberg
    -b /IMAGES/cd.iso --device-type=cd
1013 00984e39 Ronnie Sahlberg
tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
1014 00984e39 Ronnie Sahlberg
1015 f9dadc98 Ronnie Sahlberg
qemu-system-i386 -iscsi initiator-name=iqn.qemu.test:my-initiator \
1016 f9dadc98 Ronnie Sahlberg
    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
1017 00984e39 Ronnie Sahlberg
    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
1018 00984e39 Ronnie Sahlberg
@end example
1019 00984e39 Ronnie Sahlberg
1020 8809e289 Bharata B Rao
@node disk_images_gluster
1021 8809e289 Bharata B Rao
@subsection GlusterFS disk images
1022 00984e39 Ronnie Sahlberg
1023 8809e289 Bharata B Rao
GlusterFS is an user space distributed file system.
1024 8809e289 Bharata B Rao
1025 8809e289 Bharata B Rao
You can boot from the GlusterFS disk image with the command:
1026 8809e289 Bharata B Rao
@example
1027 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster[+@var{transport}]://[@var{server}[:@var{port}]]/@var{volname}/@var{image}[?socket=...]
1028 8809e289 Bharata B Rao
@end example
1029 8809e289 Bharata B Rao
1030 8809e289 Bharata B Rao
@var{gluster} is the protocol.
1031 8809e289 Bharata B Rao
1032 8809e289 Bharata B Rao
@var{transport} specifies the transport type used to connect to gluster
1033 8809e289 Bharata B Rao
management daemon (glusterd). Valid transport types are
1034 8809e289 Bharata B Rao
tcp, unix and rdma. If a transport type isn't specified, then tcp
1035 8809e289 Bharata B Rao
type is assumed.
1036 8809e289 Bharata B Rao
1037 8809e289 Bharata B Rao
@var{server} specifies the server where the volume file specification for
1038 8809e289 Bharata B Rao
the given volume resides. This can be either hostname, ipv4 address
1039 8809e289 Bharata B Rao
or ipv6 address. ipv6 address needs to be within square brackets [ ].
1040 8809e289 Bharata B Rao
If transport type is unix, then @var{server} field should not be specifed.
1041 8809e289 Bharata B Rao
Instead @var{socket} field needs to be populated with the path to unix domain
1042 8809e289 Bharata B Rao
socket.
1043 8809e289 Bharata B Rao
1044 8809e289 Bharata B Rao
@var{port} is the port number on which glusterd is listening. This is optional
1045 8809e289 Bharata B Rao
and if not specified, QEMU will send 0 which will make gluster to use the
1046 8809e289 Bharata B Rao
default port. If the transport type is unix, then @var{port} should not be
1047 8809e289 Bharata B Rao
specified.
1048 8809e289 Bharata B Rao
1049 8809e289 Bharata B Rao
@var{volname} is the name of the gluster volume which contains the disk image.
1050 8809e289 Bharata B Rao
1051 8809e289 Bharata B Rao
@var{image} is the path to the actual disk image that resides on gluster volume.
1052 8809e289 Bharata B Rao
1053 8809e289 Bharata B Rao
You can create a GlusterFS disk image with the command:
1054 8809e289 Bharata B Rao
@example
1055 8809e289 Bharata B Rao
qemu-img create gluster://@var{server}/@var{volname}/@var{image} @var{size}
1056 8809e289 Bharata B Rao
@end example
1057 8809e289 Bharata B Rao
1058 8809e289 Bharata B Rao
Examples
1059 8809e289 Bharata B Rao
@example
1060 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster://1.2.3.4/testvol/a.img
1061 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4/testvol/a.img
1062 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
1063 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
1064 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
1065 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
1066 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
1067 8809e289 Bharata B Rao
qemu-system-x86_64 -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
1068 8809e289 Bharata B Rao
@end example
1069 00984e39 Ronnie Sahlberg
1070 0a12ec87 Richard W.M. Jones
@node disk_images_ssh
1071 0a12ec87 Richard W.M. Jones
@subsection Secure Shell (ssh) disk images
1072 0a12ec87 Richard W.M. Jones
1073 0a12ec87 Richard W.M. Jones
You can access disk images located on a remote ssh server
1074 0a12ec87 Richard W.M. Jones
by using the ssh protocol:
1075 0a12ec87 Richard W.M. Jones
1076 0a12ec87 Richard W.M. Jones
@example
1077 0a12ec87 Richard W.M. Jones
qemu-system-x86_64 -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
1078 0a12ec87 Richard W.M. Jones
@end example
1079 0a12ec87 Richard W.M. Jones
1080 0a12ec87 Richard W.M. Jones
Alternative syntax using properties:
1081 0a12ec87 Richard W.M. Jones
1082 0a12ec87 Richard W.M. Jones
@example
1083 0a12ec87 Richard W.M. Jones
qemu-system-x86_64 -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
1084 0a12ec87 Richard W.M. Jones
@end example
1085 0a12ec87 Richard W.M. Jones
1086 0a12ec87 Richard W.M. Jones
@var{ssh} is the protocol.
1087 0a12ec87 Richard W.M. Jones
1088 0a12ec87 Richard W.M. Jones
@var{user} is the remote user.  If not specified, then the local
1089 0a12ec87 Richard W.M. Jones
username is tried.
1090 0a12ec87 Richard W.M. Jones
1091 0a12ec87 Richard W.M. Jones
@var{server} specifies the remote ssh server.  Any ssh server can be
1092 0a12ec87 Richard W.M. Jones
used, but it must implement the sftp-server protocol.  Most Unix/Linux
1093 0a12ec87 Richard W.M. Jones
systems should work without requiring any extra configuration.
1094 0a12ec87 Richard W.M. Jones
1095 0a12ec87 Richard W.M. Jones
@var{port} is the port number on which sshd is listening.  By default
1096 0a12ec87 Richard W.M. Jones
the standard ssh port (22) is used.
1097 0a12ec87 Richard W.M. Jones
1098 0a12ec87 Richard W.M. Jones
@var{path} is the path to the disk image.
1099 0a12ec87 Richard W.M. Jones
1100 0a12ec87 Richard W.M. Jones
The optional @var{host_key_check} parameter controls how the remote
1101 0a12ec87 Richard W.M. Jones
host's key is checked.  The default is @code{yes} which means to use
1102 0a12ec87 Richard W.M. Jones
the local @file{.ssh/known_hosts} file.  Setting this to @code{no}
1103 0a12ec87 Richard W.M. Jones
turns off known-hosts checking.  Or you can check that the host key
1104 0a12ec87 Richard W.M. Jones
matches a specific fingerprint:
1105 0a12ec87 Richard W.M. Jones
@code{host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8}
1106 0a12ec87 Richard W.M. Jones
(@code{sha1:} can also be used as a prefix, but note that OpenSSH
1107 0a12ec87 Richard W.M. Jones
tools only use MD5 to print fingerprints).
1108 0a12ec87 Richard W.M. Jones
1109 0a12ec87 Richard W.M. Jones
Currently authentication must be done using ssh-agent.  Other
1110 0a12ec87 Richard W.M. Jones
authentication methods may be supported in future.
1111 0a12ec87 Richard W.M. Jones
1112 9a2d462e Richard W.M. Jones
Note: Many ssh servers do not support an @code{fsync}-style operation.
1113 9a2d462e Richard W.M. Jones
The ssh driver cannot guarantee that disk flush requests are
1114 9a2d462e Richard W.M. Jones
obeyed, and this causes a risk of disk corruption if the remote
1115 9a2d462e Richard W.M. Jones
server or network goes down during writes.  The driver will
1116 9a2d462e Richard W.M. Jones
print a warning when @code{fsync} is not supported:
1117 9a2d462e Richard W.M. Jones
1118 9a2d462e Richard W.M. Jones
warning: ssh server @code{ssh.example.com:22} does not support fsync
1119 9a2d462e Richard W.M. Jones
1120 9a2d462e Richard W.M. Jones
With sufficiently new versions of libssh2 and OpenSSH, @code{fsync} is
1121 9a2d462e Richard W.M. Jones
supported.
1122 0a12ec87 Richard W.M. Jones
1123 debc7065 bellard
@node pcsys_network
1124 9d4fb82e bellard
@section Network emulation
1125 9d4fb82e bellard
1126 4be456f1 ths
QEMU can simulate several network cards (PCI or ISA cards on the PC
1127 41d03949 bellard
target) and can connect them to an arbitrary number of Virtual Local
1128 41d03949 bellard
Area Networks (VLANs). Host TAP devices can be connected to any QEMU
1129 41d03949 bellard
VLAN. VLAN can be connected between separate instances of QEMU to
1130 4be456f1 ths
simulate large networks. For simpler usage, a non privileged user mode
1131 41d03949 bellard
network stack can replace the TAP device to have a basic network
1132 41d03949 bellard
connection.
1133 41d03949 bellard
1134 41d03949 bellard
@subsection VLANs
1135 9d4fb82e bellard
1136 41d03949 bellard
QEMU simulates several VLANs. A VLAN can be symbolised as a virtual
1137 41d03949 bellard
connection between several network devices. These devices can be for
1138 41d03949 bellard
example QEMU virtual Ethernet cards or virtual Host ethernet devices
1139 41d03949 bellard
(TAP devices).
1140 9d4fb82e bellard
1141 41d03949 bellard
@subsection Using TAP network interfaces
1142 41d03949 bellard
1143 41d03949 bellard
This is the standard way to connect QEMU to a real network. QEMU adds
1144 41d03949 bellard
a virtual network device on your host (called @code{tapN}), and you
1145 41d03949 bellard
can then configure it as if it was a real ethernet card.
1146 9d4fb82e bellard
1147 8f40c388 bellard
@subsubsection Linux host
1148 8f40c388 bellard
1149 9d4fb82e bellard
As an example, you can download the @file{linux-test-xxx.tar.gz}
1150 9d4fb82e bellard
archive and copy the script @file{qemu-ifup} in @file{/etc} and
1151 9d4fb82e bellard
configure properly @code{sudo} so that the command @code{ifconfig}
1152 9d4fb82e bellard
contained in @file{qemu-ifup} can be executed as root. You must verify
1153 41d03949 bellard
that your host kernel supports the TAP network interfaces: the
1154 9d4fb82e bellard
device @file{/dev/net/tun} must be present.
1155 9d4fb82e bellard
1156 ee0f4751 bellard
See @ref{sec_invocation} to have examples of command lines using the
1157 ee0f4751 bellard
TAP network interfaces.
1158 9d4fb82e bellard
1159 8f40c388 bellard
@subsubsection Windows host
1160 8f40c388 bellard
1161 8f40c388 bellard
There is a virtual ethernet driver for Windows 2000/XP systems, called
1162 8f40c388 bellard
TAP-Win32. But it is not included in standard QEMU for Windows,
1163 8f40c388 bellard
so you will need to get it separately. It is part of OpenVPN package,
1164 8f40c388 bellard
so download OpenVPN from : @url{http://openvpn.net/}.
1165 8f40c388 bellard
1166 9d4fb82e bellard
@subsection Using the user mode network stack
1167 9d4fb82e bellard
1168 41d03949 bellard
By using the option @option{-net user} (default configuration if no
1169 41d03949 bellard
@option{-net} option is specified), QEMU uses a completely user mode
1170 4be456f1 ths
network stack (you don't need root privilege to use the virtual
1171 41d03949 bellard
network). The virtual network configuration is the following:
1172 9d4fb82e bellard
1173 9d4fb82e bellard
@example
1174 9d4fb82e bellard
1175 41d03949 bellard
         QEMU VLAN      <------>  Firewall/DHCP server <-----> Internet
1176 41d03949 bellard
                           |          (10.0.2.2)
1177 9d4fb82e bellard
                           |
1178 2518bd0d bellard
                           ---->  DNS server (10.0.2.3)
1179 3b46e624 ths
                           |
1180 2518bd0d bellard
                           ---->  SMB server (10.0.2.4)
1181 9d4fb82e bellard
@end example
1182 9d4fb82e bellard
1183 9d4fb82e bellard
The QEMU VM behaves as if it was behind a firewall which blocks all
1184 9d4fb82e bellard
incoming connections. You can use a DHCP client to automatically
1185 41d03949 bellard
configure the network in the QEMU VM. The DHCP server assign addresses
1186 41d03949 bellard
to the hosts starting from 10.0.2.15.
1187 9d4fb82e bellard
1188 9d4fb82e bellard
In order to check that the user mode network is working, you can ping
1189 9d4fb82e bellard
the address 10.0.2.2 and verify that you got an address in the range
1190 9d4fb82e bellard
10.0.2.x from the QEMU virtual DHCP server.
1191 9d4fb82e bellard
1192 b415a407 bellard
Note that @code{ping} is not supported reliably to the internet as it
1193 4be456f1 ths
would require root privileges. It means you can only ping the local
1194 b415a407 bellard
router (10.0.2.2).
1195 b415a407 bellard
1196 9bf05444 bellard
When using the built-in TFTP server, the router is also the TFTP
1197 9bf05444 bellard
server.
1198 9bf05444 bellard
1199 9bf05444 bellard
When using the @option{-redir} option, TCP or UDP connections can be
1200 9bf05444 bellard
redirected from the host to the guest. It allows for example to
1201 9bf05444 bellard
redirect X11, telnet or SSH connections.
1202 443f1376 bellard
1203 41d03949 bellard
@subsection Connecting VLANs between QEMU instances
1204 41d03949 bellard
1205 41d03949 bellard
Using the @option{-net socket} option, it is possible to make VLANs
1206 41d03949 bellard
that span several QEMU instances. See @ref{sec_invocation} to have a
1207 41d03949 bellard
basic example.
1208 41d03949 bellard
1209 576fd0a1 Stefan Weil
@node pcsys_other_devs
1210 6cbf4c8c Cam Macdonell
@section Other Devices
1211 6cbf4c8c Cam Macdonell
1212 6cbf4c8c Cam Macdonell
@subsection Inter-VM Shared Memory device
1213 6cbf4c8c Cam Macdonell
1214 6cbf4c8c Cam Macdonell
With KVM enabled on a Linux host, a shared memory device is available.  Guests
1215 6cbf4c8c Cam Macdonell
map a POSIX shared memory region into the guest as a PCI device that enables
1216 6cbf4c8c Cam Macdonell
zero-copy communication to the application level of the guests.  The basic
1217 6cbf4c8c Cam Macdonell
syntax is:
1218 6cbf4c8c Cam Macdonell
1219 6cbf4c8c Cam Macdonell
@example
1220 3804da9d Stefan Weil
qemu-system-i386 -device ivshmem,size=<size in format accepted by -m>[,shm=<shm name>]
1221 6cbf4c8c Cam Macdonell
@end example
1222 6cbf4c8c Cam Macdonell
1223 6cbf4c8c Cam Macdonell
If desired, interrupts can be sent between guest VMs accessing the same shared
1224 6cbf4c8c Cam Macdonell
memory region.  Interrupt support requires using a shared memory server and
1225 6cbf4c8c Cam Macdonell
using a chardev socket to connect to it.  The code for the shared memory server
1226 6cbf4c8c Cam Macdonell
is qemu.git/contrib/ivshmem-server.  An example syntax when using the shared
1227 6cbf4c8c Cam Macdonell
memory server is:
1228 6cbf4c8c Cam Macdonell
1229 6cbf4c8c Cam Macdonell
@example
1230 3804da9d Stefan Weil
qemu-system-i386 -device ivshmem,size=<size in format accepted by -m>[,chardev=<id>]
1231 3804da9d Stefan Weil
                 [,msi=on][,ioeventfd=on][,vectors=n][,role=peer|master]
1232 3804da9d Stefan Weil
qemu-system-i386 -chardev socket,path=<path>,id=<id>
1233 6cbf4c8c Cam Macdonell
@end example
1234 6cbf4c8c Cam Macdonell
1235 6cbf4c8c Cam Macdonell
When using the server, the guest will be assigned a VM ID (>=0) that allows guests
1236 6cbf4c8c Cam Macdonell
using the same server to communicate via interrupts.  Guests can read their
1237 6cbf4c8c Cam Macdonell
VM ID from a device register (see example code).  Since receiving the shared
1238 6cbf4c8c Cam Macdonell
memory region from the server is asynchronous, there is a (small) chance the
1239 6cbf4c8c Cam Macdonell
guest may boot before the shared memory is attached.  To allow an application
1240 6cbf4c8c Cam Macdonell
to ensure shared memory is attached, the VM ID register will return -1 (an
1241 6cbf4c8c Cam Macdonell
invalid VM ID) until the memory is attached.  Once the shared memory is
1242 6cbf4c8c Cam Macdonell
attached, the VM ID will return the guest's valid VM ID.  With these semantics,
1243 6cbf4c8c Cam Macdonell
the guest application can check to ensure the shared memory is attached to the
1244 6cbf4c8c Cam Macdonell
guest before proceeding.
1245 6cbf4c8c Cam Macdonell
1246 6cbf4c8c Cam Macdonell
The @option{role} argument can be set to either master or peer and will affect
1247 6cbf4c8c Cam Macdonell
how the shared memory is migrated.  With @option{role=master}, the guest will
1248 6cbf4c8c Cam Macdonell
copy the shared memory on migration to the destination host.  With
1249 6cbf4c8c Cam Macdonell
@option{role=peer}, the guest will not be able to migrate with the device attached.
1250 6cbf4c8c Cam Macdonell
With the @option{peer} case, the device should be detached and then reattached
1251 6cbf4c8c Cam Macdonell
after migration using the PCI hotplug support.
1252 6cbf4c8c Cam Macdonell
1253 9d4fb82e bellard
@node direct_linux_boot
1254 9d4fb82e bellard
@section Direct Linux Boot
1255 1f673135 bellard
1256 1f673135 bellard
This section explains how to launch a Linux kernel inside QEMU without
1257 1f673135 bellard
having to make a full bootable image. It is very useful for fast Linux
1258 ee0f4751 bellard
kernel testing.
1259 1f673135 bellard
1260 ee0f4751 bellard
The syntax is:
1261 1f673135 bellard
@example
1262 3804da9d Stefan Weil
qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
1263 1f673135 bellard
@end example
1264 1f673135 bellard
1265 ee0f4751 bellard
Use @option{-kernel} to provide the Linux kernel image and
1266 ee0f4751 bellard
@option{-append} to give the kernel command line arguments. The
1267 ee0f4751 bellard
@option{-initrd} option can be used to provide an INITRD image.
1268 1f673135 bellard
1269 ee0f4751 bellard
When using the direct Linux boot, a disk image for the first hard disk
1270 ee0f4751 bellard
@file{hda} is required because its boot sector is used to launch the
1271 ee0f4751 bellard
Linux kernel.
1272 1f673135 bellard
1273 ee0f4751 bellard
If you do not need graphical output, you can disable it and redirect
1274 ee0f4751 bellard
the virtual serial port and the QEMU monitor to the console with the
1275 ee0f4751 bellard
@option{-nographic} option. The typical command line is:
1276 1f673135 bellard
@example
1277 3804da9d Stefan Weil
qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
1278 3804da9d Stefan Weil
                 -append "root=/dev/hda console=ttyS0" -nographic
1279 1f673135 bellard
@end example
1280 1f673135 bellard
1281 ee0f4751 bellard
Use @key{Ctrl-a c} to switch between the serial console and the
1282 ee0f4751 bellard
monitor (@pxref{pcsys_keys}).
1283 1f673135 bellard
1284 debc7065 bellard
@node pcsys_usb
1285 b389dbfb bellard
@section USB emulation
1286 b389dbfb bellard
1287 0aff66b5 pbrook
QEMU emulates a PCI UHCI USB controller. You can virtually plug
1288 0aff66b5 pbrook
virtual USB devices or real host USB devices (experimental, works only
1289 071c9394 Stefan Weil
on Linux hosts).  QEMU will automatically create and connect virtual USB hubs
1290 f542086d bellard
as necessary to connect multiple USB devices.
1291 b389dbfb bellard
1292 0aff66b5 pbrook
@menu
1293 0aff66b5 pbrook
* usb_devices::
1294 0aff66b5 pbrook
* host_usb_devices::
1295 0aff66b5 pbrook
@end menu
1296 0aff66b5 pbrook
@node usb_devices
1297 0aff66b5 pbrook
@subsection Connecting USB devices
1298 b389dbfb bellard
1299 0aff66b5 pbrook
USB devices can be connected with the @option{-usbdevice} commandline option
1300 0aff66b5 pbrook
or the @code{usb_add} monitor command.  Available devices are:
1301 b389dbfb bellard
1302 db380c06 balrog
@table @code
1303 db380c06 balrog
@item mouse
1304 0aff66b5 pbrook
Virtual Mouse.  This will override the PS/2 mouse emulation when activated.
1305 db380c06 balrog
@item tablet
1306 c6d46c20 bellard
Pointer device that uses absolute coordinates (like a touchscreen).
1307 b65ee4fa Stefan Weil
This means QEMU is able to report the mouse position without having
1308 0aff66b5 pbrook
to grab the mouse.  Also overrides the PS/2 mouse emulation when activated.
1309 db380c06 balrog
@item disk:@var{file}
1310 0aff66b5 pbrook
Mass storage device based on @var{file} (@pxref{disk_images})
1311 db380c06 balrog
@item host:@var{bus.addr}
1312 0aff66b5 pbrook
Pass through the host device identified by @var{bus.addr}
1313 0aff66b5 pbrook
(Linux only)
1314 db380c06 balrog
@item host:@var{vendor_id:product_id}
1315 0aff66b5 pbrook
Pass through the host device identified by @var{vendor_id:product_id}
1316 0aff66b5 pbrook
(Linux only)
1317 db380c06 balrog
@item wacom-tablet
1318 f6d2a316 balrog
Virtual Wacom PenPartner tablet.  This device is similar to the @code{tablet}
1319 f6d2a316 balrog
above but it can be used with the tslib library because in addition to touch
1320 f6d2a316 balrog
coordinates it reports touch pressure.
1321 db380c06 balrog
@item keyboard
1322 47b2d338 balrog
Standard USB keyboard.  Will override the PS/2 keyboard (if present).
1323 db380c06 balrog
@item serial:[vendorid=@var{vendor_id}][,product_id=@var{product_id}]:@var{dev}
1324 db380c06 balrog
Serial converter. This emulates an FTDI FT232BM chip connected to host character
1325 db380c06 balrog
device @var{dev}. The available character devices are the same as for the
1326 db380c06 balrog
@code{-serial} option. The @code{vendorid} and @code{productid} options can be
1327 0d6753e5 Stefan Weil
used to override the default 0403:6001. For instance,
1328 db380c06 balrog
@example
1329 db380c06 balrog
usb_add serial:productid=FA00:tcp:192.168.0.2:4444
1330 db380c06 balrog
@end example
1331 db380c06 balrog
will connect to tcp port 4444 of ip 192.168.0.2, and plug that to the virtual
1332 db380c06 balrog
serial converter, faking a Matrix Orbital LCD Display (USB ID 0403:FA00).
1333 2e4d9fb1 aurel32
@item braille
1334 2e4d9fb1 aurel32
Braille device.  This will use BrlAPI to display the braille output on a real
1335 2e4d9fb1 aurel32
or fake device.
1336 9ad97e65 balrog
@item net:@var{options}
1337 9ad97e65 balrog
Network adapter that supports CDC ethernet and RNDIS protocols.  @var{options}
1338 9ad97e65 balrog
specifies NIC options as with @code{-net nic,}@var{options} (see description).
1339 9ad97e65 balrog
For instance, user-mode networking can be used with
1340 6c9f886c balrog
@example
1341 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -net user,vlan=0 -usbdevice net:vlan=0
1342 6c9f886c balrog
@end example
1343 6c9f886c balrog
Currently this cannot be used in machines that support PCI NICs.
1344 2d564691 balrog
@item bt[:@var{hci-type}]
1345 2d564691 balrog
Bluetooth dongle whose type is specified in the same format as with
1346 2d564691 balrog
the @option{-bt hci} option, @pxref{bt-hcis,,allowed HCI types}.  If
1347 2d564691 balrog
no type is given, the HCI logic corresponds to @code{-bt hci,vlan=0}.
1348 2d564691 balrog
This USB device implements the USB Transport Layer of HCI.  Example
1349 2d564691 balrog
usage:
1350 2d564691 balrog
@example
1351 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -usbdevice bt:hci,vlan=3 -bt device:keyboard,vlan=3
1352 2d564691 balrog
@end example
1353 0aff66b5 pbrook
@end table
1354 b389dbfb bellard
1355 0aff66b5 pbrook
@node host_usb_devices
1356 b389dbfb bellard
@subsection Using host USB devices on a Linux host
1357 b389dbfb bellard
1358 b389dbfb bellard
WARNING: this is an experimental feature. QEMU will slow down when
1359 b389dbfb bellard
using it. USB devices requiring real time streaming (i.e. USB Video
1360 b389dbfb bellard
Cameras) are not supported yet.
1361 b389dbfb bellard
1362 b389dbfb bellard
@enumerate
1363 5fafdf24 ths
@item If you use an early Linux 2.4 kernel, verify that no Linux driver
1364 b389dbfb bellard
is actually using the USB device. A simple way to do that is simply to
1365 b389dbfb bellard
disable the corresponding kernel module by renaming it from @file{mydriver.o}
1366 b389dbfb bellard
to @file{mydriver.o.disabled}.
1367 b389dbfb bellard
1368 b389dbfb bellard
@item Verify that @file{/proc/bus/usb} is working (most Linux distributions should enable it by default). You should see something like that:
1369 b389dbfb bellard
@example
1370 b389dbfb bellard
ls /proc/bus/usb
1371 b389dbfb bellard
001  devices  drivers
1372 b389dbfb bellard
@end example
1373 b389dbfb bellard
1374 b389dbfb bellard
@item Since only root can access to the USB devices directly, you can either launch QEMU as root or change the permissions of the USB devices you want to use. For testing, the following suffices:
1375 b389dbfb bellard
@example
1376 b389dbfb bellard
chown -R myuid /proc/bus/usb
1377 b389dbfb bellard
@end example
1378 b389dbfb bellard
1379 b389dbfb bellard
@item Launch QEMU and do in the monitor:
1380 5fafdf24 ths
@example
1381 b389dbfb bellard
info usbhost
1382 b389dbfb bellard
  Device 1.2, speed 480 Mb/s
1383 b389dbfb bellard
    Class 00: USB device 1234:5678, USB DISK
1384 b389dbfb bellard
@end example
1385 b389dbfb bellard
You should see the list of the devices you can use (Never try to use
1386 b389dbfb bellard
hubs, it won't work).
1387 b389dbfb bellard
1388 b389dbfb bellard
@item Add the device in QEMU by using:
1389 5fafdf24 ths
@example
1390 b389dbfb bellard
usb_add host:1234:5678
1391 b389dbfb bellard
@end example
1392 b389dbfb bellard
1393 b389dbfb bellard
Normally the guest OS should report that a new USB device is
1394 b389dbfb bellard
plugged. You can use the option @option{-usbdevice} to do the same.
1395 b389dbfb bellard
1396 b389dbfb bellard
@item Now you can try to use the host USB device in QEMU.
1397 b389dbfb bellard
1398 b389dbfb bellard
@end enumerate
1399 b389dbfb bellard
1400 b389dbfb bellard
When relaunching QEMU, you may have to unplug and plug again the USB
1401 b389dbfb bellard
device to make it work again (this is a bug).
1402 b389dbfb bellard
1403 f858dcae ths
@node vnc_security
1404 f858dcae ths
@section VNC security
1405 f858dcae ths
1406 f858dcae ths
The VNC server capability provides access to the graphical console
1407 f858dcae ths
of the guest VM across the network. This has a number of security
1408 f858dcae ths
considerations depending on the deployment scenarios.
1409 f858dcae ths
1410 f858dcae ths
@menu
1411 f858dcae ths
* vnc_sec_none::
1412 f858dcae ths
* vnc_sec_password::
1413 f858dcae ths
* vnc_sec_certificate::
1414 f858dcae ths
* vnc_sec_certificate_verify::
1415 f858dcae ths
* vnc_sec_certificate_pw::
1416 2f9606b3 aliguori
* vnc_sec_sasl::
1417 2f9606b3 aliguori
* vnc_sec_certificate_sasl::
1418 f858dcae ths
* vnc_generate_cert::
1419 2f9606b3 aliguori
* vnc_setup_sasl::
1420 f858dcae ths
@end menu
1421 f858dcae ths
@node vnc_sec_none
1422 f858dcae ths
@subsection Without passwords
1423 f858dcae ths
1424 f858dcae ths
The simplest VNC server setup does not include any form of authentication.
1425 f858dcae ths
For this setup it is recommended to restrict it to listen on a UNIX domain
1426 f858dcae ths
socket only. For example
1427 f858dcae ths
1428 f858dcae ths
@example
1429 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc unix:/home/joebloggs/.qemu-myvm-vnc
1430 f858dcae ths
@end example
1431 f858dcae ths
1432 f858dcae ths
This ensures that only users on local box with read/write access to that
1433 f858dcae ths
path can access the VNC server. To securely access the VNC server from a
1434 f858dcae ths
remote machine, a combination of netcat+ssh can be used to provide a secure
1435 f858dcae ths
tunnel.
1436 f858dcae ths
1437 f858dcae ths
@node vnc_sec_password
1438 f858dcae ths
@subsection With passwords
1439 f858dcae ths
1440 f858dcae ths
The VNC protocol has limited support for password based authentication. Since
1441 f858dcae ths
the protocol limits passwords to 8 characters it should not be considered
1442 f858dcae ths
to provide high security. The password can be fairly easily brute-forced by
1443 f858dcae ths
a client making repeat connections. For this reason, a VNC server using password
1444 f858dcae ths
authentication should be restricted to only listen on the loopback interface
1445 0f66998f Paul Moore
or UNIX domain sockets. Password authentication is not supported when operating
1446 0f66998f Paul Moore
in FIPS 140-2 compliance mode as it requires the use of the DES cipher. Password
1447 0f66998f Paul Moore
authentication is requested with the @code{password} option, and then once QEMU
1448 0f66998f Paul Moore
is running the password is set with the monitor. Until the monitor is used to
1449 0f66998f Paul Moore
set the password all clients will be rejected.
1450 f858dcae ths
1451 f858dcae ths
@example
1452 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,password -monitor stdio
1453 f858dcae ths
(qemu) change vnc password
1454 f858dcae ths
Password: ********
1455 f858dcae ths
(qemu)
1456 f858dcae ths
@end example
1457 f858dcae ths
1458 f858dcae ths
@node vnc_sec_certificate
1459 f858dcae ths
@subsection With x509 certificates
1460 f858dcae ths
1461 f858dcae ths
The QEMU VNC server also implements the VeNCrypt extension allowing use of
1462 f858dcae ths
TLS for encryption of the session, and x509 certificates for authentication.
1463 f858dcae ths
The use of x509 certificates is strongly recommended, because TLS on its
1464 f858dcae ths
own is susceptible to man-in-the-middle attacks. Basic x509 certificate
1465 f858dcae ths
support provides a secure session, but no authentication. This allows any
1466 f858dcae ths
client to connect, and provides an encrypted session.
1467 f858dcae ths
1468 f858dcae ths
@example
1469 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio
1470 f858dcae ths
@end example
1471 f858dcae ths
1472 f858dcae ths
In the above example @code{/etc/pki/qemu} should contain at least three files,
1473 f858dcae ths
@code{ca-cert.pem}, @code{server-cert.pem} and @code{server-key.pem}. Unprivileged
1474 f858dcae ths
users will want to use a private directory, for example @code{$HOME/.pki/qemu}.
1475 f858dcae ths
NB the @code{server-key.pem} file should be protected with file mode 0600 to
1476 f858dcae ths
only be readable by the user owning it.
1477 f858dcae ths
1478 f858dcae ths
@node vnc_sec_certificate_verify
1479 f858dcae ths
@subsection With x509 certificates and client verification
1480 f858dcae ths
1481 f858dcae ths
Certificates can also provide a means to authenticate the client connecting.
1482 f858dcae ths
The server will request that the client provide a certificate, which it will
1483 f858dcae ths
then validate against the CA certificate. This is a good choice if deploying
1484 f858dcae ths
in an environment with a private internal certificate authority.
1485 f858dcae ths
1486 f858dcae ths
@example
1487 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor stdio
1488 f858dcae ths
@end example
1489 f858dcae ths
1490 f858dcae ths
1491 f858dcae ths
@node vnc_sec_certificate_pw
1492 f858dcae ths
@subsection With x509 certificates, client verification and passwords
1493 f858dcae ths
1494 f858dcae ths
Finally, the previous method can be combined with VNC password authentication
1495 f858dcae ths
to provide two layers of authentication for clients.
1496 f858dcae ths
1497 f858dcae ths
@example
1498 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,password,tls,x509verify=/etc/pki/qemu -monitor stdio
1499 f858dcae ths
(qemu) change vnc password
1500 f858dcae ths
Password: ********
1501 f858dcae ths
(qemu)
1502 f858dcae ths
@end example
1503 f858dcae ths
1504 2f9606b3 aliguori
1505 2f9606b3 aliguori
@node vnc_sec_sasl
1506 2f9606b3 aliguori
@subsection With SASL authentication
1507 2f9606b3 aliguori
1508 2f9606b3 aliguori
The SASL authentication method is a VNC extension, that provides an
1509 2f9606b3 aliguori
easily extendable, pluggable authentication method. This allows for
1510 2f9606b3 aliguori
integration with a wide range of authentication mechanisms, such as
1511 2f9606b3 aliguori
PAM, GSSAPI/Kerberos, LDAP, SQL databases, one-time keys and more.
1512 2f9606b3 aliguori
The strength of the authentication depends on the exact mechanism
1513 2f9606b3 aliguori
configured. If the chosen mechanism also provides a SSF layer, then
1514 2f9606b3 aliguori
it will encrypt the datastream as well.
1515 2f9606b3 aliguori
1516 2f9606b3 aliguori
Refer to the later docs on how to choose the exact SASL mechanism
1517 2f9606b3 aliguori
used for authentication, but assuming use of one supporting SSF,
1518 2f9606b3 aliguori
then QEMU can be launched with:
1519 2f9606b3 aliguori
1520 2f9606b3 aliguori
@example
1521 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,sasl -monitor stdio
1522 2f9606b3 aliguori
@end example
1523 2f9606b3 aliguori
1524 2f9606b3 aliguori
@node vnc_sec_certificate_sasl
1525 2f9606b3 aliguori
@subsection With x509 certificates and SASL authentication
1526 2f9606b3 aliguori
1527 2f9606b3 aliguori
If the desired SASL authentication mechanism does not supported
1528 2f9606b3 aliguori
SSF layers, then it is strongly advised to run it in combination
1529 2f9606b3 aliguori
with TLS and x509 certificates. This provides securely encrypted
1530 2f9606b3 aliguori
data stream, avoiding risk of compromising of the security
1531 2f9606b3 aliguori
credentials. This can be enabled, by combining the 'sasl' option
1532 2f9606b3 aliguori
with the aforementioned TLS + x509 options:
1533 2f9606b3 aliguori
1534 2f9606b3 aliguori
@example
1535 3804da9d Stefan Weil
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509,sasl -monitor stdio
1536 2f9606b3 aliguori
@end example
1537 2f9606b3 aliguori
1538 2f9606b3 aliguori
1539 f858dcae ths
@node vnc_generate_cert
1540 f858dcae ths
@subsection Generating certificates for VNC
1541 f858dcae ths
1542 f858dcae ths
The GNU TLS packages provides a command called @code{certtool} which can
1543 f858dcae ths
be used to generate certificates and keys in PEM format. At a minimum it
1544 40c5c6cd Stefan Weil
is necessary to setup a certificate authority, and issue certificates to
1545 f858dcae ths
each server. If using certificates for authentication, then each client
1546 f858dcae ths
will also need to be issued a certificate. The recommendation is for the
1547 f858dcae ths
server to keep its certificates in either @code{/etc/pki/qemu} or for
1548 f858dcae ths
unprivileged users in @code{$HOME/.pki/qemu}.
1549 f858dcae ths
1550 f858dcae ths
@menu
1551 f858dcae ths
* vnc_generate_ca::
1552 f858dcae ths
* vnc_generate_server::
1553 f858dcae ths
* vnc_generate_client::
1554 f858dcae ths
@end menu
1555 f858dcae ths
@node vnc_generate_ca
1556 f858dcae ths
@subsubsection Setup the Certificate Authority
1557 f858dcae ths
1558 f858dcae ths
This step only needs to be performed once per organization / organizational
1559 f858dcae ths
unit. First the CA needs a private key. This key must be kept VERY secret
1560 f858dcae ths
and secure. If this key is compromised the entire trust chain of the certificates
1561 f858dcae ths
issued with it is lost.
1562 f858dcae ths
1563 f858dcae ths
@example
1564 f858dcae ths
# certtool --generate-privkey > ca-key.pem
1565 f858dcae ths
@end example
1566 f858dcae ths
1567 f858dcae ths
A CA needs to have a public certificate. For simplicity it can be a self-signed
1568 f858dcae ths
certificate, or one issue by a commercial certificate issuing authority. To
1569 f858dcae ths
generate a self-signed certificate requires one core piece of information, the
1570 f858dcae ths
name of the organization.
1571 f858dcae ths
1572 f858dcae ths
@example
1573 f858dcae ths
# cat > ca.info <<EOF
1574 f858dcae ths
cn = Name of your organization
1575 f858dcae ths
ca
1576 f858dcae ths
cert_signing_key
1577 f858dcae ths
EOF
1578 f858dcae ths
# certtool --generate-self-signed \
1579 f858dcae ths
           --load-privkey ca-key.pem
1580 f858dcae ths
           --template ca.info \
1581 f858dcae ths
           --outfile ca-cert.pem
1582 f858dcae ths
@end example
1583 f858dcae ths
1584 f858dcae ths
The @code{ca-cert.pem} file should be copied to all servers and clients wishing to utilize
1585 f858dcae ths
TLS support in the VNC server. The @code{ca-key.pem} must not be disclosed/copied at all.
1586 f858dcae ths
1587 f858dcae ths
@node vnc_generate_server
1588 f858dcae ths
@subsubsection Issuing server certificates
1589 f858dcae ths
1590 f858dcae ths
Each server (or host) needs to be issued with a key and certificate. When connecting
1591 f858dcae ths
the certificate is sent to the client which validates it against the CA certificate.
1592 f858dcae ths
The core piece of information for a server certificate is the hostname. This should
1593 f858dcae ths
be the fully qualified hostname that the client will connect with, since the client
1594 f858dcae ths
will typically also verify the hostname in the certificate. On the host holding the
1595 f858dcae ths
secure CA private key:
1596 f858dcae ths
1597 f858dcae ths
@example
1598 f858dcae ths
# cat > server.info <<EOF
1599 f858dcae ths
organization = Name  of your organization
1600 f858dcae ths
cn = server.foo.example.com
1601 f858dcae ths
tls_www_server
1602 f858dcae ths
encryption_key
1603 f858dcae ths
signing_key
1604 f858dcae ths
EOF
1605 f858dcae ths
# certtool --generate-privkey > server-key.pem
1606 f858dcae ths
# certtool --generate-certificate \
1607 f858dcae ths
           --load-ca-certificate ca-cert.pem \
1608 f858dcae ths
           --load-ca-privkey ca-key.pem \
1609 f858dcae ths
           --load-privkey server server-key.pem \
1610 f858dcae ths
           --template server.info \
1611 f858dcae ths
           --outfile server-cert.pem
1612 f858dcae ths
@end example
1613 f858dcae ths
1614 f858dcae ths
The @code{server-key.pem} and @code{server-cert.pem} files should now be securely copied
1615 f858dcae ths
to the server for which they were generated. The @code{server-key.pem} is security
1616 f858dcae ths
sensitive and should be kept protected with file mode 0600 to prevent disclosure.
1617 f858dcae ths
1618 f858dcae ths
@node vnc_generate_client
1619 f858dcae ths
@subsubsection Issuing client certificates
1620 f858dcae ths
1621 f858dcae ths
If the QEMU VNC server is to use the @code{x509verify} option to validate client
1622 f858dcae ths
certificates as its authentication mechanism, each client also needs to be issued
1623 f858dcae ths
a certificate. The client certificate contains enough metadata to uniquely identify
1624 f858dcae ths
the client, typically organization, state, city, building, etc. On the host holding
1625 f858dcae ths
the secure CA private key:
1626 f858dcae ths
1627 f858dcae ths
@example
1628 f858dcae ths
# cat > client.info <<EOF
1629 f858dcae ths
country = GB
1630 f858dcae ths
state = London
1631 f858dcae ths
locality = London
1632 f858dcae ths
organiazation = Name of your organization
1633 f858dcae ths
cn = client.foo.example.com
1634 f858dcae ths
tls_www_client
1635 f858dcae ths
encryption_key
1636 f858dcae ths
signing_key
1637 f858dcae ths
EOF
1638 f858dcae ths
# certtool --generate-privkey > client-key.pem
1639 f858dcae ths
# certtool --generate-certificate \
1640 f858dcae ths
           --load-ca-certificate ca-cert.pem \
1641 f858dcae ths
           --load-ca-privkey ca-key.pem \
1642 f858dcae ths
           --load-privkey client-key.pem \
1643 f858dcae ths
           --template client.info \
1644 f858dcae ths
           --outfile client-cert.pem
1645 f858dcae ths
@end example
1646 f858dcae ths
1647 f858dcae ths
The @code{client-key.pem} and @code{client-cert.pem} files should now be securely
1648 f858dcae ths
copied to the client for which they were generated.
1649 f858dcae ths
1650 2f9606b3 aliguori
1651 2f9606b3 aliguori
@node vnc_setup_sasl
1652 2f9606b3 aliguori
1653 2f9606b3 aliguori
@subsection Configuring SASL mechanisms
1654 2f9606b3 aliguori
1655 2f9606b3 aliguori
The following documentation assumes use of the Cyrus SASL implementation on a
1656 2f9606b3 aliguori
Linux host, but the principals should apply to any other SASL impl. When SASL
1657 2f9606b3 aliguori
is enabled, the mechanism configuration will be loaded from system default
1658 2f9606b3 aliguori
SASL service config /etc/sasl2/qemu.conf. If running QEMU as an
1659 2f9606b3 aliguori
unprivileged user, an environment variable SASL_CONF_PATH can be used
1660 2f9606b3 aliguori
to make it search alternate locations for the service config.
1661 2f9606b3 aliguori
1662 2f9606b3 aliguori
The default configuration might contain
1663 2f9606b3 aliguori
1664 2f9606b3 aliguori
@example
1665 2f9606b3 aliguori
mech_list: digest-md5
1666 2f9606b3 aliguori
sasldb_path: /etc/qemu/passwd.db
1667 2f9606b3 aliguori
@end example
1668 2f9606b3 aliguori
1669 2f9606b3 aliguori
This says to use the 'Digest MD5' mechanism, which is similar to the HTTP
1670 2f9606b3 aliguori
Digest-MD5 mechanism. The list of valid usernames & passwords is maintained
1671 2f9606b3 aliguori
in the /etc/qemu/passwd.db file, and can be updated using the saslpasswd2
1672 2f9606b3 aliguori
command. While this mechanism is easy to configure and use, it is not
1673 2f9606b3 aliguori
considered secure by modern standards, so only suitable for developers /
1674 2f9606b3 aliguori
ad-hoc testing.
1675 2f9606b3 aliguori
1676 2f9606b3 aliguori
A more serious deployment might use Kerberos, which is done with the 'gssapi'
1677 2f9606b3 aliguori
mechanism
1678 2f9606b3 aliguori
1679 2f9606b3 aliguori
@example
1680 2f9606b3 aliguori
mech_list: gssapi
1681 2f9606b3 aliguori
keytab: /etc/qemu/krb5.tab
1682 2f9606b3 aliguori
@end example
1683 2f9606b3 aliguori
1684 2f9606b3 aliguori
For this to work the administrator of your KDC must generate a Kerberos
1685 2f9606b3 aliguori
principal for the server, with a name of  'qemu/somehost.example.com@@EXAMPLE.COM'
1686 2f9606b3 aliguori
replacing 'somehost.example.com' with the fully qualified host name of the
1687 40c5c6cd Stefan Weil
machine running QEMU, and 'EXAMPLE.COM' with the Kerberos Realm.
1688 2f9606b3 aliguori
1689 2f9606b3 aliguori
Other configurations will be left as an exercise for the reader. It should
1690 2f9606b3 aliguori
be noted that only Digest-MD5 and GSSAPI provides a SSF layer for data
1691 2f9606b3 aliguori
encryption. For all other mechanisms, VNC should always be configured to
1692 2f9606b3 aliguori
use TLS and x509 certificates to protect security credentials from snooping.
1693 2f9606b3 aliguori
1694 0806e3f6 bellard
@node gdb_usage
1695 da415d54 bellard
@section GDB usage
1696 da415d54 bellard
1697 da415d54 bellard
QEMU has a primitive support to work with gdb, so that you can do
1698 0806e3f6 bellard
'Ctrl-C' while the virtual machine is running and inspect its state.
1699 da415d54 bellard
1700 b65ee4fa Stefan Weil
In order to use gdb, launch QEMU with the '-s' option. It will wait for a
1701 da415d54 bellard
gdb connection:
1702 da415d54 bellard
@example
1703 3804da9d Stefan Weil
qemu-system-i386 -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
1704 3804da9d Stefan Weil
                    -append "root=/dev/hda"
1705 da415d54 bellard
Connected to host network interface: tun0
1706 da415d54 bellard
Waiting gdb connection on port 1234
1707 da415d54 bellard
@end example
1708 da415d54 bellard
1709 da415d54 bellard
Then launch gdb on the 'vmlinux' executable:
1710 da415d54 bellard
@example
1711 da415d54 bellard
> gdb vmlinux
1712 da415d54 bellard
@end example
1713 da415d54 bellard
1714 da415d54 bellard
In gdb, connect to QEMU:
1715 da415d54 bellard
@example
1716 6c9bf893 bellard
(gdb) target remote localhost:1234
1717 da415d54 bellard
@end example
1718 da415d54 bellard
1719 da415d54 bellard
Then you can use gdb normally. For example, type 'c' to launch the kernel:
1720 da415d54 bellard
@example
1721 da415d54 bellard
(gdb) c
1722 da415d54 bellard
@end example
1723 da415d54 bellard
1724 0806e3f6 bellard
Here are some useful tips in order to use gdb on system code:
1725 0806e3f6 bellard
1726 0806e3f6 bellard
@enumerate
1727 0806e3f6 bellard
@item
1728 0806e3f6 bellard
Use @code{info reg} to display all the CPU registers.
1729 0806e3f6 bellard
@item
1730 0806e3f6 bellard
Use @code{x/10i $eip} to display the code at the PC position.
1731 0806e3f6 bellard
@item
1732 0806e3f6 bellard
Use @code{set architecture i8086} to dump 16 bit code. Then use
1733 294e8637 bellard
@code{x/10i $cs*16+$eip} to dump the code at the PC position.
1734 0806e3f6 bellard
@end enumerate
1735 0806e3f6 bellard
1736 60897d36 edgar_igl
Advanced debugging options:
1737 60897d36 edgar_igl
1738 60897d36 edgar_igl
The default single stepping behavior is step with the IRQs and timer service routines off.  It is set this way because when gdb executes a single step it expects to advance beyond the current instruction.  With the IRQs and and timer service routines on, a single step might jump into the one of the interrupt or exception vectors instead of executing the current instruction. This means you may hit the same breakpoint a number of times before executing the instruction gdb wants to have executed.  Because there are rare circumstances where you want to single step into an interrupt vector the behavior can be controlled from GDB.  There are three commands you can query and set the single step behavior:
1739 94d45e44 edgar_igl
@table @code
1740 60897d36 edgar_igl
@item maintenance packet qqemu.sstepbits
1741 60897d36 edgar_igl
1742 60897d36 edgar_igl
This will display the MASK bits used to control the single stepping IE:
1743 60897d36 edgar_igl
@example
1744 60897d36 edgar_igl
(gdb) maintenance packet qqemu.sstepbits
1745 60897d36 edgar_igl
sending: "qqemu.sstepbits"
1746 60897d36 edgar_igl
received: "ENABLE=1,NOIRQ=2,NOTIMER=4"
1747 60897d36 edgar_igl
@end example
1748 60897d36 edgar_igl
@item maintenance packet qqemu.sstep
1749 60897d36 edgar_igl
1750 60897d36 edgar_igl
This will display the current value of the mask used when single stepping IE:
1751 60897d36 edgar_igl
@example
1752 60897d36 edgar_igl
(gdb) maintenance packet qqemu.sstep
1753 60897d36 edgar_igl
sending: "qqemu.sstep"
1754 60897d36 edgar_igl
received: "0x7"
1755 60897d36 edgar_igl
@end example
1756 60897d36 edgar_igl
@item maintenance packet Qqemu.sstep=HEX_VALUE
1757 60897d36 edgar_igl
1758 60897d36 edgar_igl
This will change the single step mask, so if wanted to enable IRQs on the single step, but not timers, you would use:
1759 60897d36 edgar_igl
@example
1760 60897d36 edgar_igl
(gdb) maintenance packet Qqemu.sstep=0x5
1761 60897d36 edgar_igl
sending: "qemu.sstep=0x5"
1762 60897d36 edgar_igl
received: "OK"
1763 60897d36 edgar_igl
@end example
1764 94d45e44 edgar_igl
@end table
1765 60897d36 edgar_igl
1766 debc7065 bellard
@node pcsys_os_specific
1767 1a084f3d bellard
@section Target OS specific information
1768 1a084f3d bellard
1769 1a084f3d bellard
@subsection Linux
1770 1a084f3d bellard
1771 15a34c63 bellard
To have access to SVGA graphic modes under X11, use the @code{vesa} or
1772 15a34c63 bellard
the @code{cirrus} X11 driver. For optimal performances, use 16 bit
1773 15a34c63 bellard
color depth in the guest and the host OS.
1774 1a084f3d bellard
1775 e3371e62 bellard
When using a 2.6 guest Linux kernel, you should add the option
1776 e3371e62 bellard
@code{clock=pit} on the kernel command line because the 2.6 Linux
1777 e3371e62 bellard
kernels make very strict real time clock checks by default that QEMU
1778 e3371e62 bellard
cannot simulate exactly.
1779 e3371e62 bellard
1780 7c3fc84d bellard
When using a 2.6 guest Linux kernel, verify that the 4G/4G patch is
1781 7c3fc84d bellard
not activated because QEMU is slower with this patch. The QEMU
1782 7c3fc84d bellard
Accelerator Module is also much slower in this case. Earlier Fedora
1783 4be456f1 ths
Core 3 Linux kernel (< 2.6.9-1.724_FC3) were known to incorporate this
1784 7c3fc84d bellard
patch by default. Newer kernels don't have it.
1785 7c3fc84d bellard
1786 1a084f3d bellard
@subsection Windows
1787 1a084f3d bellard
1788 1a084f3d bellard
If you have a slow host, using Windows 95 is better as it gives the
1789 1a084f3d bellard
best speed. Windows 2000 is also a good choice.
1790 1a084f3d bellard
1791 e3371e62 bellard
@subsubsection SVGA graphic modes support
1792 e3371e62 bellard
1793 e3371e62 bellard
QEMU emulates a Cirrus Logic GD5446 Video
1794 15a34c63 bellard
card. All Windows versions starting from Windows 95 should recognize
1795 15a34c63 bellard
and use this graphic card. For optimal performances, use 16 bit color
1796 15a34c63 bellard
depth in the guest and the host OS.
1797 1a084f3d bellard
1798 3cb0853a bellard
If you are using Windows XP as guest OS and if you want to use high
1799 3cb0853a bellard
resolution modes which the Cirrus Logic BIOS does not support (i.e. >=
1800 3cb0853a bellard
1280x1024x16), then you should use the VESA VBE virtual graphic card
1801 3cb0853a bellard
(option @option{-std-vga}).
1802 3cb0853a bellard
1803 e3371e62 bellard
@subsubsection CPU usage reduction
1804 e3371e62 bellard
1805 e3371e62 bellard
Windows 9x does not correctly use the CPU HLT
1806 15a34c63 bellard
instruction. The result is that it takes host CPU cycles even when
1807 15a34c63 bellard
idle. You can install the utility from
1808 15a34c63 bellard
@url{http://www.user.cityline.ru/~maxamn/amnhltm.zip} to solve this
1809 15a34c63 bellard
problem. Note that no such tool is needed for NT, 2000 or XP.
1810 1a084f3d bellard
1811 9d0a8e6f bellard
@subsubsection Windows 2000 disk full problem
1812 e3371e62 bellard
1813 9d0a8e6f bellard
Windows 2000 has a bug which gives a disk full problem during its
1814 9d0a8e6f bellard
installation. When installing it, use the @option{-win2k-hack} QEMU
1815 9d0a8e6f bellard
option to enable a specific workaround. After Windows 2000 is
1816 9d0a8e6f bellard
installed, you no longer need this option (this option slows down the
1817 9d0a8e6f bellard
IDE transfers).
1818 e3371e62 bellard
1819 6cc721cf bellard
@subsubsection Windows 2000 shutdown
1820 6cc721cf bellard
1821 6cc721cf bellard
Windows 2000 cannot automatically shutdown in QEMU although Windows 98
1822 6cc721cf bellard
can. It comes from the fact that Windows 2000 does not automatically
1823 6cc721cf bellard
use the APM driver provided by the BIOS.
1824 6cc721cf bellard
1825 6cc721cf bellard
In order to correct that, do the following (thanks to Struan
1826 6cc721cf bellard
Bartlett): go to the Control Panel => Add/Remove Hardware & Next =>
1827 6cc721cf bellard
Add/Troubleshoot a device => Add a new device & Next => No, select the
1828 6cc721cf bellard
hardware from a list & Next => NT Apm/Legacy Support & Next => Next
1829 6cc721cf bellard
(again) a few times. Now the driver is installed and Windows 2000 now
1830 5fafdf24 ths
correctly instructs QEMU to shutdown at the appropriate moment.
1831 6cc721cf bellard
1832 6cc721cf bellard
@subsubsection Share a directory between Unix and Windows
1833 6cc721cf bellard
1834 6cc721cf bellard
See @ref{sec_invocation} about the help of the option @option{-smb}.
1835 6cc721cf bellard
1836 2192c332 bellard
@subsubsection Windows XP security problem
1837 e3371e62 bellard
1838 e3371e62 bellard
Some releases of Windows XP install correctly but give a security
1839 e3371e62 bellard
error when booting:
1840 e3371e62 bellard
@example
1841 e3371e62 bellard
A problem is preventing Windows from accurately checking the
1842 e3371e62 bellard
license for this computer. Error code: 0x800703e6.
1843 e3371e62 bellard
@end example
1844 e3371e62 bellard
1845 2192c332 bellard
The workaround is to install a service pack for XP after a boot in safe
1846 2192c332 bellard
mode. Then reboot, and the problem should go away. Since there is no
1847 2192c332 bellard
network while in safe mode, its recommended to download the full
1848 2192c332 bellard
installation of SP1 or SP2 and transfer that via an ISO or using the
1849 2192c332 bellard
vvfat block device ("-hdb fat:directory_which_holds_the_SP").
1850 e3371e62 bellard
1851 a0a821a4 bellard
@subsection MS-DOS and FreeDOS
1852 a0a821a4 bellard
1853 a0a821a4 bellard
@subsubsection CPU usage reduction
1854 a0a821a4 bellard
1855 a0a821a4 bellard
DOS does not correctly use the CPU HLT instruction. The result is that
1856 a0a821a4 bellard
it takes host CPU cycles even when idle. You can install the utility
1857 a0a821a4 bellard
from @url{http://www.vmware.com/software/dosidle210.zip} to solve this
1858 a0a821a4 bellard
problem.
1859 a0a821a4 bellard
1860 debc7065 bellard
@node QEMU System emulator for non PC targets
1861 3f9f3aa1 bellard
@chapter QEMU System emulator for non PC targets
1862 3f9f3aa1 bellard
1863 3f9f3aa1 bellard
QEMU is a generic emulator and it emulates many non PC
1864 3f9f3aa1 bellard
machines. Most of the options are similar to the PC emulator. The
1865 4be456f1 ths
differences are mentioned in the following sections.
1866 3f9f3aa1 bellard
1867 debc7065 bellard
@menu
1868 7544a042 Stefan Weil
* PowerPC System emulator::
1869 24d4de45 ths
* Sparc32 System emulator::
1870 24d4de45 ths
* Sparc64 System emulator::
1871 24d4de45 ths
* MIPS System emulator::
1872 24d4de45 ths
* ARM System emulator::
1873 24d4de45 ths
* ColdFire System emulator::
1874 7544a042 Stefan Weil
* Cris System emulator::
1875 7544a042 Stefan Weil
* Microblaze System emulator::
1876 7544a042 Stefan Weil
* SH4 System emulator::
1877 3aeaea65 Max Filippov
* Xtensa System emulator::
1878 debc7065 bellard
@end menu
1879 debc7065 bellard
1880 7544a042 Stefan Weil
@node PowerPC System emulator
1881 7544a042 Stefan Weil
@section PowerPC System emulator
1882 7544a042 Stefan Weil
@cindex system emulation (PowerPC)
1883 1a084f3d bellard
1884 15a34c63 bellard
Use the executable @file{qemu-system-ppc} to simulate a complete PREP
1885 15a34c63 bellard
or PowerMac PowerPC system.
1886 1a084f3d bellard
1887 b671f9ed bellard
QEMU emulates the following PowerMac peripherals:
1888 1a084f3d bellard
1889 15a34c63 bellard
@itemize @minus
1890 5fafdf24 ths
@item
1891 006f3a48 blueswir1
UniNorth or Grackle PCI Bridge
1892 15a34c63 bellard
@item
1893 15a34c63 bellard
PCI VGA compatible card with VESA Bochs Extensions
1894 5fafdf24 ths
@item
1895 15a34c63 bellard
2 PMAC IDE interfaces with hard disk and CD-ROM support
1896 5fafdf24 ths
@item
1897 15a34c63 bellard
NE2000 PCI adapters
1898 15a34c63 bellard
@item
1899 15a34c63 bellard
Non Volatile RAM
1900 15a34c63 bellard
@item
1901 15a34c63 bellard
VIA-CUDA with ADB keyboard and mouse.
1902 1a084f3d bellard
@end itemize
1903 1a084f3d bellard
1904 b671f9ed bellard
QEMU emulates the following PREP peripherals:
1905 52c00a5f bellard
1906 52c00a5f bellard
@itemize @minus
1907 5fafdf24 ths
@item
1908 15a34c63 bellard
PCI Bridge
1909 15a34c63 bellard
@item
1910 15a34c63 bellard
PCI VGA compatible card with VESA Bochs Extensions
1911 5fafdf24 ths
@item
1912 52c00a5f bellard
2 IDE interfaces with hard disk and CD-ROM support
1913 52c00a5f bellard
@item
1914 52c00a5f bellard
Floppy disk
1915 5fafdf24 ths
@item
1916 15a34c63 bellard
NE2000 network adapters
1917 52c00a5f bellard
@item
1918 52c00a5f bellard
Serial port
1919 52c00a5f bellard
@item
1920 52c00a5f bellard
PREP Non Volatile RAM
1921 15a34c63 bellard
@item
1922 15a34c63 bellard
PC compatible keyboard and mouse.
1923 52c00a5f bellard
@end itemize
1924 52c00a5f bellard
1925 15a34c63 bellard
QEMU uses the Open Hack'Ware Open Firmware Compatible BIOS available at
1926 3f9f3aa1 bellard
@url{http://perso.magic.fr/l_indien/OpenHackWare/index.htm}.
1927 52c00a5f bellard
1928 992e5acd blueswir1
Since version 0.9.1, QEMU uses OpenBIOS @url{http://www.openbios.org/}
1929 006f3a48 blueswir1
for the g3beige and mac99 PowerMac machines. OpenBIOS is a free (GPL
1930 006f3a48 blueswir1
v2) portable firmware implementation. The goal is to implement a 100%
1931 006f3a48 blueswir1
IEEE 1275-1994 (referred to as Open Firmware) compliant firmware.
1932 992e5acd blueswir1
1933 15a34c63 bellard
@c man begin OPTIONS
1934 15a34c63 bellard
1935 15a34c63 bellard
The following options are specific to the PowerPC emulation:
1936 15a34c63 bellard
1937 15a34c63 bellard
@table @option
1938 15a34c63 bellard
1939 4e257e5e Kevin Wolf
@item -g @var{W}x@var{H}[x@var{DEPTH}]
1940 15a34c63 bellard
1941 15a34c63 bellard
Set the initial VGA graphic mode. The default is 800x600x15.
1942 15a34c63 bellard
1943 4e257e5e Kevin Wolf
@item -prom-env @var{string}
1944 95efd11c blueswir1
1945 95efd11c blueswir1
Set OpenBIOS variables in NVRAM, for example:
1946 95efd11c blueswir1
1947 95efd11c blueswir1
@example
1948 95efd11c blueswir1
qemu-system-ppc -prom-env 'auto-boot?=false' \
1949 95efd11c blueswir1
 -prom-env 'boot-device=hd:2,\yaboot' \
1950 95efd11c blueswir1
 -prom-env 'boot-args=conf=hd:2,\yaboot.conf'
1951 95efd11c blueswir1
@end example
1952 95efd11c blueswir1
1953 95efd11c blueswir1
These variables are not used by Open Hack'Ware.
1954 95efd11c blueswir1
1955 15a34c63 bellard
@end table
1956 15a34c63 bellard
1957 5fafdf24 ths
@c man end
1958 15a34c63 bellard
1959 15a34c63 bellard
1960 52c00a5f bellard
More information is available at
1961 3f9f3aa1 bellard
@url{http://perso.magic.fr/l_indien/qemu-ppc/}.
1962 52c00a5f bellard
1963 24d4de45 ths
@node Sparc32 System emulator
1964 24d4de45 ths
@section Sparc32 System emulator
1965 7544a042 Stefan Weil
@cindex system emulation (Sparc32)
1966 e80cfcfc bellard
1967 34a3d239 blueswir1
Use the executable @file{qemu-system-sparc} to simulate the following
1968 34a3d239 blueswir1
Sun4m architecture machines:
1969 34a3d239 blueswir1
@itemize @minus
1970 34a3d239 blueswir1
@item
1971 34a3d239 blueswir1
SPARCstation 4
1972 34a3d239 blueswir1
@item
1973 34a3d239 blueswir1
SPARCstation 5
1974 34a3d239 blueswir1
@item
1975 34a3d239 blueswir1
SPARCstation 10
1976 34a3d239 blueswir1
@item
1977 34a3d239 blueswir1
SPARCstation 20
1978 34a3d239 blueswir1
@item
1979 34a3d239 blueswir1
SPARCserver 600MP
1980 34a3d239 blueswir1
@item
1981 34a3d239 blueswir1
SPARCstation LX
1982 34a3d239 blueswir1
@item
1983 34a3d239 blueswir1
SPARCstation Voyager
1984 34a3d239 blueswir1
@item
1985 34a3d239 blueswir1
SPARCclassic
1986 34a3d239 blueswir1
@item
1987 34a3d239 blueswir1
SPARCbook
1988 34a3d239 blueswir1
@end itemize
1989 34a3d239 blueswir1
1990 34a3d239 blueswir1
The emulation is somewhat complete. SMP up to 16 CPUs is supported,
1991 34a3d239 blueswir1
but Linux limits the number of usable CPUs to 4.
1992 e80cfcfc bellard
1993 6a4e1771 Blue Swirl
QEMU emulates the following sun4m peripherals:
1994 e80cfcfc bellard
1995 e80cfcfc bellard
@itemize @minus
1996 3475187d bellard
@item
1997 6a4e1771 Blue Swirl
IOMMU
1998 e80cfcfc bellard
@item
1999 e80cfcfc bellard
TCX Frame buffer
2000 5fafdf24 ths
@item
2001 e80cfcfc bellard
Lance (Am7990) Ethernet
2002 e80cfcfc bellard
@item
2003 34a3d239 blueswir1
Non Volatile RAM M48T02/M48T08
2004 e80cfcfc bellard
@item
2005 3475187d bellard
Slave I/O: timers, interrupt controllers, Zilog serial ports, keyboard
2006 3475187d bellard
and power/reset logic
2007 3475187d bellard
@item
2008 3475187d bellard
ESP SCSI controller with hard disk and CD-ROM support
2009 3475187d bellard
@item
2010 6a3b9cc9 blueswir1
Floppy drive (not on SS-600MP)
2011 a2502b58 blueswir1
@item
2012 a2502b58 blueswir1
CS4231 sound device (only on SS-5, not working yet)
2013 e80cfcfc bellard
@end itemize
2014 e80cfcfc bellard
2015 6a3b9cc9 blueswir1
The number of peripherals is fixed in the architecture.  Maximum
2016 6a3b9cc9 blueswir1
memory size depends on the machine type, for SS-5 it is 256MB and for
2017 7d85892b blueswir1
others 2047MB.
2018 3475187d bellard
2019 30a604f3 bellard
Since version 0.8.2, QEMU uses OpenBIOS
2020 0986ac3b bellard
@url{http://www.openbios.org/}. OpenBIOS is a free (GPL v2) portable
2021 0986ac3b bellard
firmware implementation. The goal is to implement a 100% IEEE
2022 0986ac3b bellard
1275-1994 (referred to as Open Firmware) compliant firmware.
2023 3475187d bellard
2024 3475187d bellard
A sample Linux 2.6 series kernel and ram disk image are available on
2025 34a3d239 blueswir1
the QEMU web site. There are still issues with NetBSD and OpenBSD, but
2026 34a3d239 blueswir1
some kernel versions work. Please note that currently Solaris kernels
2027 34a3d239 blueswir1
don't work probably due to interface issues between OpenBIOS and
2028 34a3d239 blueswir1
Solaris.
2029 3475187d bellard
2030 3475187d bellard
@c man begin OPTIONS
2031 3475187d bellard
2032 a2502b58 blueswir1
The following options are specific to the Sparc32 emulation:
2033 3475187d bellard
2034 3475187d bellard
@table @option
2035 3475187d bellard
2036 4e257e5e Kevin Wolf
@item -g @var{W}x@var{H}x[x@var{DEPTH}]
2037 3475187d bellard
2038 a2502b58 blueswir1
Set the initial TCX graphic mode. The default is 1024x768x8, currently
2039 a2502b58 blueswir1
the only other possible mode is 1024x768x24.
2040 3475187d bellard
2041 4e257e5e Kevin Wolf
@item -prom-env @var{string}
2042 66508601 blueswir1
2043 66508601 blueswir1
Set OpenBIOS variables in NVRAM, for example:
2044 66508601 blueswir1
2045 66508601 blueswir1
@example
2046 66508601 blueswir1
qemu-system-sparc -prom-env 'auto-boot?=false' \
2047 66508601 blueswir1
 -prom-env 'boot-device=sd(0,2,0):d' -prom-env 'boot-args=linux single'
2048 66508601 blueswir1
@end example
2049 66508601 blueswir1
2050 6a4e1771 Blue Swirl
@item -M [SS-4|SS-5|SS-10|SS-20|SS-600MP|LX|Voyager|SPARCClassic] [|SPARCbook]
2051 a2502b58 blueswir1
2052 a2502b58 blueswir1
Set the emulated machine type. Default is SS-5.
2053 a2502b58 blueswir1
2054 3475187d bellard
@end table
2055 3475187d bellard
2056 5fafdf24 ths
@c man end
2057 3475187d bellard
2058 24d4de45 ths
@node Sparc64 System emulator
2059 24d4de45 ths
@section Sparc64 System emulator
2060 7544a042 Stefan Weil
@cindex system emulation (Sparc64)
2061 e80cfcfc bellard
2062 34a3d239 blueswir1
Use the executable @file{qemu-system-sparc64} to simulate a Sun4u
2063 34a3d239 blueswir1
(UltraSPARC PC-like machine), Sun4v (T1 PC-like machine), or generic
2064 34a3d239 blueswir1
Niagara (T1) machine. The emulator is not usable for anything yet, but
2065 34a3d239 blueswir1
it can launch some kernels.
2066 b756921a bellard
2067 c7ba218d blueswir1
QEMU emulates the following peripherals:
2068 83469015 bellard
2069 83469015 bellard
@itemize @minus
2070 83469015 bellard
@item
2071 5fafdf24 ths
UltraSparc IIi APB PCI Bridge
2072 83469015 bellard
@item
2073 83469015 bellard
PCI VGA compatible card with VESA Bochs Extensions
2074 83469015 bellard
@item
2075 34a3d239 blueswir1
PS/2 mouse and keyboard
2076 34a3d239 blueswir1
@item
2077 83469015 bellard
Non Volatile RAM M48T59
2078 83469015 bellard
@item
2079 83469015 bellard
PC-compatible serial ports
2080 c7ba218d blueswir1
@item
2081 c7ba218d blueswir1
2 PCI IDE interfaces with hard disk and CD-ROM support
2082 34a3d239 blueswir1
@item
2083 34a3d239 blueswir1
Floppy disk
2084 83469015 bellard
@end itemize
2085 83469015 bellard
2086 c7ba218d blueswir1
@c man begin OPTIONS
2087 c7ba218d blueswir1
2088 c7ba218d blueswir1
The following options are specific to the Sparc64 emulation:
2089 c7ba218d blueswir1
2090 c7ba218d blueswir1
@table @option
2091 c7ba218d blueswir1
2092 4e257e5e Kevin Wolf
@item -prom-env @var{string}
2093 34a3d239 blueswir1
2094 34a3d239 blueswir1
Set OpenBIOS variables in NVRAM, for example:
2095 34a3d239 blueswir1
2096 34a3d239 blueswir1
@example
2097 34a3d239 blueswir1
qemu-system-sparc64 -prom-env 'auto-boot?=false'
2098 34a3d239 blueswir1
@end example
2099 34a3d239 blueswir1
2100 34a3d239 blueswir1
@item -M [sun4u|sun4v|Niagara]
2101 c7ba218d blueswir1
2102 c7ba218d blueswir1
Set the emulated machine type. The default is sun4u.
2103 c7ba218d blueswir1
2104 c7ba218d blueswir1
@end table
2105 c7ba218d blueswir1
2106 c7ba218d blueswir1
@c man end
2107 c7ba218d blueswir1
2108 24d4de45 ths
@node MIPS System emulator
2109 24d4de45 ths
@section MIPS System emulator
2110 7544a042 Stefan Weil
@cindex system emulation (MIPS)
2111 9d0a8e6f bellard
2112 d9aedc32 ths
Four executables cover simulation of 32 and 64-bit MIPS systems in
2113 d9aedc32 ths
both endian options, @file{qemu-system-mips}, @file{qemu-system-mipsel}
2114 d9aedc32 ths
@file{qemu-system-mips64} and @file{qemu-system-mips64el}.
2115 88cb0a02 aurel32
Five different machine types are emulated:
2116 24d4de45 ths
2117 24d4de45 ths
@itemize @minus
2118 24d4de45 ths
@item
2119 24d4de45 ths
A generic ISA PC-like machine "mips"
2120 24d4de45 ths
@item
2121 24d4de45 ths
The MIPS Malta prototype board "malta"
2122 24d4de45 ths
@item
2123 d9aedc32 ths
An ACER Pica "pica61". This machine needs the 64-bit emulator.
2124 6bf5b4e8 ths
@item
2125 f0fc6f8f ths
MIPS emulator pseudo board "mipssim"
2126 88cb0a02 aurel32
@item
2127 88cb0a02 aurel32
A MIPS Magnum R4000 machine "magnum". This machine needs the 64-bit emulator.
2128 24d4de45 ths
@end itemize
2129 24d4de45 ths
2130 24d4de45 ths
The generic emulation is supported by Debian 'Etch' and is able to
2131 24d4de45 ths
install Debian into a virtual disk image. The following devices are
2132 24d4de45 ths
emulated:
2133 3f9f3aa1 bellard
2134 3f9f3aa1 bellard
@itemize @minus
2135 5fafdf24 ths
@item
2136 6bf5b4e8 ths
A range of MIPS CPUs, default is the 24Kf
2137 3f9f3aa1 bellard
@item
2138 3f9f3aa1 bellard
PC style serial port
2139 3f9f3aa1 bellard
@item
2140 24d4de45 ths
PC style IDE disk
2141 24d4de45 ths
@item
2142 3f9f3aa1 bellard
NE2000 network card
2143 3f9f3aa1 bellard
@end itemize
2144 3f9f3aa1 bellard
2145 24d4de45 ths
The Malta emulation supports the following devices:
2146 24d4de45 ths
2147 24d4de45 ths
@itemize @minus
2148 24d4de45 ths
@item
2149 0b64d008 ths
Core board with MIPS 24Kf CPU and Galileo system controller
2150 24d4de45 ths
@item
2151 24d4de45 ths
PIIX4 PCI/USB/SMbus controller
2152 24d4de45 ths
@item
2153 24d4de45 ths
The Multi-I/O chip's serial device
2154 24d4de45 ths
@item
2155 3a2eeac0 Stefan Weil
PCI network cards (PCnet32 and others)
2156 24d4de45 ths
@item
2157 24d4de45 ths
Malta FPGA serial device
2158 24d4de45 ths
@item
2159 1f605a76 aurel32
Cirrus (default) or any other PCI VGA graphics card
2160 24d4de45 ths
@end itemize
2161 24d4de45 ths
2162 24d4de45 ths
The ACER Pica emulation supports:
2163 24d4de45 ths
2164 24d4de45 ths
@itemize @minus
2165 24d4de45 ths
@item
2166 24d4de45 ths
MIPS R4000 CPU
2167 24d4de45 ths
@item
2168 24d4de45 ths
PC-style IRQ and DMA controllers
2169 24d4de45 ths
@item
2170 24d4de45 ths
PC Keyboard
2171 24d4de45 ths
@item
2172 24d4de45 ths
IDE controller
2173 24d4de45 ths
@end itemize
2174 3f9f3aa1 bellard
2175 b5e4946f Stefan Weil
The mipssim pseudo board emulation provides an environment similar
2176 f0fc6f8f ths
to what the proprietary MIPS emulator uses for running Linux.
2177 f0fc6f8f ths
It supports:
2178 6bf5b4e8 ths
2179 6bf5b4e8 ths
@itemize @minus
2180 6bf5b4e8 ths
@item
2181 6bf5b4e8 ths
A range of MIPS CPUs, default is the 24Kf
2182 6bf5b4e8 ths
@item
2183 6bf5b4e8 ths
PC style serial port
2184 6bf5b4e8 ths
@item
2185 6bf5b4e8 ths
MIPSnet network emulation
2186 6bf5b4e8 ths
@end itemize
2187 6bf5b4e8 ths
2188 88cb0a02 aurel32
The MIPS Magnum R4000 emulation supports:
2189 88cb0a02 aurel32
2190 88cb0a02 aurel32
@itemize @minus
2191 88cb0a02 aurel32
@item
2192 88cb0a02 aurel32
MIPS R4000 CPU
2193 88cb0a02 aurel32
@item
2194 88cb0a02 aurel32
PC-style IRQ controller
2195 88cb0a02 aurel32
@item
2196 88cb0a02 aurel32
PC Keyboard
2197 88cb0a02 aurel32
@item
2198 88cb0a02 aurel32
SCSI controller
2199 88cb0a02 aurel32
@item
2200 88cb0a02 aurel32
G364 framebuffer
2201 88cb0a02 aurel32
@end itemize
2202 88cb0a02 aurel32
2203 88cb0a02 aurel32
2204 24d4de45 ths
@node ARM System emulator
2205 24d4de45 ths
@section ARM System emulator
2206 7544a042 Stefan Weil
@cindex system emulation (ARM)
2207 3f9f3aa1 bellard
2208 3f9f3aa1 bellard
Use the executable @file{qemu-system-arm} to simulate a ARM
2209 3f9f3aa1 bellard
machine. The ARM Integrator/CP board is emulated with the following
2210 3f9f3aa1 bellard
devices:
2211 3f9f3aa1 bellard
2212 3f9f3aa1 bellard
@itemize @minus
2213 3f9f3aa1 bellard
@item
2214 9ee6e8bb pbrook
ARM926E, ARM1026E, ARM946E, ARM1136 or Cortex-A8 CPU
2215 3f9f3aa1 bellard
@item
2216 3f9f3aa1 bellard
Two PL011 UARTs
2217 5fafdf24 ths
@item
2218 3f9f3aa1 bellard
SMC 91c111 Ethernet adapter
2219 00a9bf19 pbrook
@item
2220 00a9bf19 pbrook
PL110 LCD controller
2221 00a9bf19 pbrook
@item
2222 00a9bf19 pbrook
PL050 KMI with PS/2 keyboard and mouse.
2223 a1bb27b1 pbrook
@item
2224 a1bb27b1 pbrook
PL181 MultiMedia Card Interface with SD card.
2225 00a9bf19 pbrook
@end itemize
2226 00a9bf19 pbrook
2227 00a9bf19 pbrook
The ARM Versatile baseboard is emulated with the following devices:
2228 00a9bf19 pbrook
2229 00a9bf19 pbrook
@itemize @minus
2230 00a9bf19 pbrook
@item
2231 9ee6e8bb pbrook
ARM926E, ARM1136 or Cortex-A8 CPU
2232 00a9bf19 pbrook
@item
2233 00a9bf19 pbrook
PL190 Vectored Interrupt Controller
2234 00a9bf19 pbrook
@item
2235 00a9bf19 pbrook
Four PL011 UARTs
2236 5fafdf24 ths
@item
2237 00a9bf19 pbrook
SMC 91c111 Ethernet adapter
2238 00a9bf19 pbrook
@item
2239 00a9bf19 pbrook
PL110 LCD controller
2240 00a9bf19 pbrook
@item
2241 00a9bf19 pbrook
PL050 KMI with PS/2 keyboard and mouse.
2242 00a9bf19 pbrook
@item
2243 00a9bf19 pbrook
PCI host bridge.  Note the emulated PCI bridge only provides access to
2244 00a9bf19 pbrook
PCI memory space.  It does not provide access to PCI IO space.
2245 4be456f1 ths
This means some devices (eg. ne2k_pci NIC) are not usable, and others
2246 4be456f1 ths
(eg. rtl8139 NIC) are only usable when the guest drivers use the memory
2247 00a9bf19 pbrook
mapped control registers.
2248 e6de1bad pbrook
@item
2249 e6de1bad pbrook
PCI OHCI USB controller.
2250 e6de1bad pbrook
@item
2251 e6de1bad pbrook
LSI53C895A PCI SCSI Host Bus Adapter with hard disk and CD-ROM devices.
2252 a1bb27b1 pbrook
@item
2253 a1bb27b1 pbrook
PL181 MultiMedia Card Interface with SD card.
2254 3f9f3aa1 bellard
@end itemize
2255 3f9f3aa1 bellard
2256 21a88941 Paul Brook
Several variants of the ARM RealView baseboard are emulated,
2257 21a88941 Paul Brook
including the EB, PB-A8 and PBX-A9.  Due to interactions with the
2258 21a88941 Paul Brook
bootloader, only certain Linux kernel configurations work out
2259 21a88941 Paul Brook
of the box on these boards.
2260 21a88941 Paul Brook
2261 21a88941 Paul Brook
Kernels for the PB-A8 board should have CONFIG_REALVIEW_HIGH_PHYS_OFFSET
2262 21a88941 Paul Brook
enabled in the kernel, and expect 512M RAM.  Kernels for The PBX-A9 board
2263 21a88941 Paul Brook
should have CONFIG_SPARSEMEM enabled, CONFIG_REALVIEW_HIGH_PHYS_OFFSET
2264 21a88941 Paul Brook
disabled and expect 1024M RAM.
2265 21a88941 Paul Brook
2266 40c5c6cd Stefan Weil
The following devices are emulated:
2267 d7739d75 pbrook
2268 d7739d75 pbrook
@itemize @minus
2269 d7739d75 pbrook
@item
2270 f7c70325 Paul Brook
ARM926E, ARM1136, ARM11MPCore, Cortex-A8 or Cortex-A9 MPCore CPU
2271 d7739d75 pbrook
@item
2272 d7739d75 pbrook
ARM AMBA Generic/Distributed Interrupt Controller
2273 d7739d75 pbrook
@item
2274 d7739d75 pbrook
Four PL011 UARTs
2275 5fafdf24 ths
@item
2276 0ef849d7 Paul Brook
SMC 91c111 or SMSC LAN9118 Ethernet adapter
2277 d7739d75 pbrook
@item
2278 d7739d75 pbrook
PL110 LCD controller
2279 d7739d75 pbrook
@item
2280 d7739d75 pbrook
PL050 KMI with PS/2 keyboard and mouse
2281 d7739d75 pbrook
@item
2282 d7739d75 pbrook
PCI host bridge
2283 d7739d75 pbrook
@item
2284 d7739d75 pbrook
PCI OHCI USB controller
2285 d7739d75 pbrook
@item
2286 d7739d75 pbrook
LSI53C895A PCI SCSI Host Bus Adapter with hard disk and CD-ROM devices
2287 a1bb27b1 pbrook
@item
2288 a1bb27b1 pbrook
PL181 MultiMedia Card Interface with SD card.
2289 d7739d75 pbrook
@end itemize
2290 d7739d75 pbrook
2291 b00052e4 balrog
The XScale-based clamshell PDA models ("Spitz", "Akita", "Borzoi"
2292 b00052e4 balrog
and "Terrier") emulation includes the following peripherals:
2293 b00052e4 balrog
2294 b00052e4 balrog
@itemize @minus
2295 b00052e4 balrog
@item
2296 b00052e4 balrog
Intel PXA270 System-on-chip (ARM V5TE core)
2297 b00052e4 balrog
@item
2298 b00052e4 balrog
NAND Flash memory
2299 b00052e4 balrog
@item
2300 b00052e4 balrog
IBM/Hitachi DSCM microdrive in a PXA PCMCIA slot - not in "Akita"
2301 b00052e4 balrog
@item
2302 b00052e4 balrog
On-chip OHCI USB controller
2303 b00052e4 balrog
@item
2304 b00052e4 balrog
On-chip LCD controller
2305 b00052e4 balrog
@item
2306 b00052e4 balrog
On-chip Real Time Clock
2307 b00052e4 balrog
@item
2308 b00052e4 balrog
TI ADS7846 touchscreen controller on SSP bus
2309 b00052e4 balrog
@item
2310 b00052e4 balrog
Maxim MAX1111 analog-digital converter on I@math{^2}C bus
2311 b00052e4 balrog
@item
2312 b00052e4 balrog
GPIO-connected keyboard controller and LEDs
2313 b00052e4 balrog
@item
2314 549444e1 balrog
Secure Digital card connected to PXA MMC/SD host
2315 b00052e4 balrog
@item
2316 b00052e4 balrog
Three on-chip UARTs
2317 b00052e4 balrog
@item
2318 b00052e4 balrog
WM8750 audio CODEC on I@math{^2}C and I@math{^2}S busses
2319 b00052e4 balrog
@end itemize
2320 b00052e4 balrog
2321 02645926 balrog
The Palm Tungsten|E PDA (codename "Cheetah") emulation includes the
2322 02645926 balrog
following elements:
2323 02645926 balrog
2324 02645926 balrog
@itemize @minus
2325 02645926 balrog
@item
2326 02645926 balrog
Texas Instruments OMAP310 System-on-chip (ARM 925T core)
2327 02645926 balrog
@item
2328 02645926 balrog
ROM and RAM memories (ROM firmware image can be loaded with -option-rom)
2329 02645926 balrog
@item
2330 02645926 balrog
On-chip LCD controller
2331 02645926 balrog
@item
2332 02645926 balrog
On-chip Real Time Clock
2333 02645926 balrog
@item
2334 02645926 balrog
TI TSC2102i touchscreen controller / analog-digital converter / Audio
2335 02645926 balrog
CODEC, connected through MicroWire and I@math{^2}S busses
2336 02645926 balrog
@item
2337 02645926 balrog
GPIO-connected matrix keypad
2338 02645926 balrog
@item
2339 02645926 balrog
Secure Digital card connected to OMAP MMC/SD host
2340 02645926 balrog
@item
2341 02645926 balrog
Three on-chip UARTs
2342 02645926 balrog
@end itemize
2343 02645926 balrog
2344 c30bb264 balrog
Nokia N800 and N810 internet tablets (known also as RX-34 and RX-44 / 48)
2345 c30bb264 balrog
emulation supports the following elements:
2346 c30bb264 balrog
2347 c30bb264 balrog
@itemize @minus
2348 c30bb264 balrog
@item
2349 c30bb264 balrog
Texas Instruments OMAP2420 System-on-chip (ARM 1136 core)
2350 c30bb264 balrog
@item
2351 c30bb264 balrog
RAM and non-volatile OneNAND Flash memories
2352 c30bb264 balrog
@item
2353 c30bb264 balrog
Display connected to EPSON remote framebuffer chip and OMAP on-chip
2354 c30bb264 balrog
display controller and a LS041y3 MIPI DBI-C controller
2355 c30bb264 balrog
@item
2356 c30bb264 balrog
TI TSC2301 (in N800) and TI TSC2005 (in N810) touchscreen controllers
2357 c30bb264 balrog
driven through SPI bus
2358 c30bb264 balrog
@item
2359 c30bb264 balrog
National Semiconductor LM8323-controlled qwerty keyboard driven
2360 c30bb264 balrog
through I@math{^2}C bus
2361 c30bb264 balrog
@item
2362 c30bb264 balrog
Secure Digital card connected to OMAP MMC/SD host
2363 c30bb264 balrog
@item
2364 c30bb264 balrog
Three OMAP on-chip UARTs and on-chip STI debugging console
2365 c30bb264 balrog
@item
2366 40c5c6cd Stefan Weil
A Bluetooth(R) transceiver and HCI connected to an UART
2367 2d564691 balrog
@item
2368 c30bb264 balrog
Mentor Graphics "Inventra" dual-role USB controller embedded in a TI
2369 c30bb264 balrog
TUSB6010 chip - only USB host mode is supported
2370 c30bb264 balrog
@item
2371 c30bb264 balrog
TI TMP105 temperature sensor driven through I@math{^2}C bus
2372 c30bb264 balrog
@item
2373 c30bb264 balrog
TI TWL92230C power management companion with an RTC on I@math{^2}C bus
2374 c30bb264 balrog
@item
2375 c30bb264 balrog
Nokia RETU and TAHVO multi-purpose chips with an RTC, connected
2376 c30bb264 balrog
through CBUS
2377 c30bb264 balrog
@end itemize
2378 c30bb264 balrog
2379 9ee6e8bb pbrook
The Luminary Micro Stellaris LM3S811EVB emulation includes the following
2380 9ee6e8bb pbrook
devices:
2381 9ee6e8bb pbrook
2382 9ee6e8bb pbrook
@itemize @minus
2383 9ee6e8bb pbrook
@item
2384 9ee6e8bb pbrook
Cortex-M3 CPU core.
2385 9ee6e8bb pbrook
@item
2386 9ee6e8bb pbrook
64k Flash and 8k SRAM.
2387 9ee6e8bb pbrook
@item
2388 9ee6e8bb pbrook
Timers, UARTs, ADC and I@math{^2}C interface.
2389 9ee6e8bb pbrook
@item
2390 9ee6e8bb pbrook
OSRAM Pictiva 96x16 OLED with SSD0303 controller on I@math{^2}C bus.
2391 9ee6e8bb pbrook
@end itemize
2392 9ee6e8bb pbrook
2393 9ee6e8bb pbrook
The Luminary Micro Stellaris LM3S6965EVB emulation includes the following
2394 9ee6e8bb pbrook
devices:
2395 9ee6e8bb pbrook
2396 9ee6e8bb pbrook
@itemize @minus
2397 9ee6e8bb pbrook
@item
2398 9ee6e8bb pbrook
Cortex-M3 CPU core.
2399 9ee6e8bb pbrook
@item
2400 9ee6e8bb pbrook
256k Flash and 64k SRAM.
2401 9ee6e8bb pbrook
@item
2402 9ee6e8bb pbrook
Timers, UARTs, ADC, I@math{^2}C and SSI interfaces.
2403 9ee6e8bb pbrook
@item
2404 9ee6e8bb pbrook
OSRAM Pictiva 128x64 OLED with SSD0323 controller connected via SSI.
2405 9ee6e8bb pbrook
@end itemize
2406 9ee6e8bb pbrook
2407 57cd6e97 balrog
The Freecom MusicPal internet radio emulation includes the following
2408 57cd6e97 balrog
elements:
2409 57cd6e97 balrog
2410 57cd6e97 balrog
@itemize @minus
2411 57cd6e97 balrog
@item
2412 57cd6e97 balrog
Marvell MV88W8618 ARM core.
2413 57cd6e97 balrog
@item
2414 57cd6e97 balrog
32 MB RAM, 256 KB SRAM, 8 MB flash.
2415 57cd6e97 balrog
@item
2416 57cd6e97 balrog
Up to 2 16550 UARTs
2417 57cd6e97 balrog
@item
2418 57cd6e97 balrog
MV88W8xx8 Ethernet controller
2419 57cd6e97 balrog
@item
2420 57cd6e97 balrog
MV88W8618 audio controller, WM8750 CODEC and mixer
2421 57cd6e97 balrog
@item
2422 e080e785 Stefan Weil
128ร—64 display with brightness control
2423 57cd6e97 balrog
@item
2424 57cd6e97 balrog
2 buttons, 2 navigation wheels with button function
2425 57cd6e97 balrog
@end itemize
2426 57cd6e97 balrog
2427 997641a8 balrog
The Siemens SX1 models v1 and v2 (default) basic emulation.
2428 40c5c6cd Stefan Weil
The emulation includes the following elements:
2429 997641a8 balrog
2430 997641a8 balrog
@itemize @minus
2431 997641a8 balrog
@item
2432 997641a8 balrog
Texas Instruments OMAP310 System-on-chip (ARM 925T core)
2433 997641a8 balrog
@item
2434 997641a8 balrog
ROM and RAM memories (ROM firmware image can be loaded with -pflash)
2435 997641a8 balrog
V1
2436 997641a8 balrog
1 Flash of 16MB and 1 Flash of 8MB
2437 997641a8 balrog
V2
2438 997641a8 balrog
1 Flash of 32MB
2439 997641a8 balrog
@item
2440 997641a8 balrog
On-chip LCD controller
2441 997641a8 balrog
@item
2442 997641a8 balrog
On-chip Real Time Clock
2443 997641a8 balrog
@item
2444 997641a8 balrog
Secure Digital card connected to OMAP MMC/SD host
2445 997641a8 balrog
@item
2446 997641a8 balrog
Three on-chip UARTs
2447 997641a8 balrog
@end itemize
2448 997641a8 balrog
2449 3f9f3aa1 bellard
A Linux 2.6 test image is available on the QEMU web site. More
2450 3f9f3aa1 bellard
information is available in the QEMU mailing-list archive.
2451 9d0a8e6f bellard
2452 d2c639d6 blueswir1
@c man begin OPTIONS
2453 d2c639d6 blueswir1
2454 d2c639d6 blueswir1
The following options are specific to the ARM emulation:
2455 d2c639d6 blueswir1
2456 d2c639d6 blueswir1
@table @option
2457 d2c639d6 blueswir1
2458 d2c639d6 blueswir1
@item -semihosting
2459 d2c639d6 blueswir1
Enable semihosting syscall emulation.
2460 d2c639d6 blueswir1
2461 d2c639d6 blueswir1
On ARM this implements the "Angel" interface.
2462 d2c639d6 blueswir1
2463 d2c639d6 blueswir1
Note that this allows guest direct access to the host filesystem,
2464 d2c639d6 blueswir1
so should only be used with trusted guest OS.
2465 d2c639d6 blueswir1
2466 d2c639d6 blueswir1
@end table
2467 d2c639d6 blueswir1
2468 24d4de45 ths
@node ColdFire System emulator
2469 24d4de45 ths
@section ColdFire System emulator
2470 7544a042 Stefan Weil
@cindex system emulation (ColdFire)
2471 7544a042 Stefan Weil
@cindex system emulation (M68K)
2472 209a4e69 pbrook
2473 209a4e69 pbrook
Use the executable @file{qemu-system-m68k} to simulate a ColdFire machine.
2474 209a4e69 pbrook
The emulator is able to boot a uClinux kernel.
2475 707e011b pbrook
2476 707e011b pbrook
The M5208EVB emulation includes the following devices:
2477 707e011b pbrook
2478 707e011b pbrook
@itemize @minus
2479 5fafdf24 ths
@item
2480 707e011b pbrook
MCF5208 ColdFire V2 Microprocessor (ISA A+ with EMAC).
2481 707e011b pbrook
@item
2482 707e011b pbrook
Three Two on-chip UARTs.
2483 707e011b pbrook
@item
2484 707e011b pbrook
Fast Ethernet Controller (FEC)
2485 707e011b pbrook
@end itemize
2486 707e011b pbrook
2487 707e011b pbrook
The AN5206 emulation includes the following devices:
2488 209a4e69 pbrook
2489 209a4e69 pbrook
@itemize @minus
2490 5fafdf24 ths
@item
2491 209a4e69 pbrook
MCF5206 ColdFire V2 Microprocessor.
2492 209a4e69 pbrook
@item
2493 209a4e69 pbrook
Two on-chip UARTs.
2494 209a4e69 pbrook
@end itemize
2495 209a4e69 pbrook
2496 d2c639d6 blueswir1
@c man begin OPTIONS
2497 d2c639d6 blueswir1
2498 7544a042 Stefan Weil
The following options are specific to the ColdFire emulation:
2499 d2c639d6 blueswir1
2500 d2c639d6 blueswir1
@table @option
2501 d2c639d6 blueswir1
2502 d2c639d6 blueswir1
@item -semihosting
2503 d2c639d6 blueswir1
Enable semihosting syscall emulation.
2504 d2c639d6 blueswir1
2505 d2c639d6 blueswir1
On M68K this implements the "ColdFire GDB" interface used by libgloss.
2506 d2c639d6 blueswir1
2507 d2c639d6 blueswir1
Note that this allows guest direct access to the host filesystem,
2508 d2c639d6 blueswir1
so should only be used with trusted guest OS.
2509 d2c639d6 blueswir1
2510 d2c639d6 blueswir1
@end table
2511 d2c639d6 blueswir1
2512 7544a042 Stefan Weil
@node Cris System emulator
2513 7544a042 Stefan Weil
@section Cris System emulator
2514 7544a042 Stefan Weil
@cindex system emulation (Cris)
2515 7544a042 Stefan Weil
2516 7544a042 Stefan Weil
TODO
2517 7544a042 Stefan Weil
2518 7544a042 Stefan Weil
@node Microblaze System emulator
2519 7544a042 Stefan Weil
@section Microblaze System emulator
2520 7544a042 Stefan Weil
@cindex system emulation (Microblaze)
2521 7544a042 Stefan Weil
2522 7544a042 Stefan Weil
TODO
2523 7544a042 Stefan Weil
2524 7544a042 Stefan Weil
@node SH4 System emulator
2525 7544a042 Stefan Weil
@section SH4 System emulator
2526 7544a042 Stefan Weil
@cindex system emulation (SH4)
2527 7544a042 Stefan Weil
2528 7544a042 Stefan Weil
TODO
2529 7544a042 Stefan Weil
2530 3aeaea65 Max Filippov
@node Xtensa System emulator
2531 3aeaea65 Max Filippov
@section Xtensa System emulator
2532 3aeaea65 Max Filippov
@cindex system emulation (Xtensa)
2533 3aeaea65 Max Filippov
2534 3aeaea65 Max Filippov
Two executables cover simulation of both Xtensa endian options,
2535 3aeaea65 Max Filippov
@file{qemu-system-xtensa} and @file{qemu-system-xtensaeb}.
2536 3aeaea65 Max Filippov
Two different machine types are emulated:
2537 3aeaea65 Max Filippov
2538 3aeaea65 Max Filippov
@itemize @minus
2539 3aeaea65 Max Filippov
@item
2540 3aeaea65 Max Filippov
Xtensa emulator pseudo board "sim"
2541 3aeaea65 Max Filippov
@item
2542 3aeaea65 Max Filippov
Avnet LX60/LX110/LX200 board
2543 3aeaea65 Max Filippov
@end itemize
2544 3aeaea65 Max Filippov
2545 b5e4946f Stefan Weil
The sim pseudo board emulation provides an environment similar
2546 3aeaea65 Max Filippov
to one provided by the proprietary Tensilica ISS.
2547 3aeaea65 Max Filippov
It supports:
2548 3aeaea65 Max Filippov
2549 3aeaea65 Max Filippov
@itemize @minus
2550 3aeaea65 Max Filippov
@item
2551 3aeaea65 Max Filippov
A range of Xtensa CPUs, default is the DC232B
2552 3aeaea65 Max Filippov
@item
2553 3aeaea65 Max Filippov
Console and filesystem access via semihosting calls
2554 3aeaea65 Max Filippov
@end itemize
2555 3aeaea65 Max Filippov
2556 3aeaea65 Max Filippov
The Avnet LX60/LX110/LX200 emulation supports:
2557 3aeaea65 Max Filippov
2558 3aeaea65 Max Filippov
@itemize @minus
2559 3aeaea65 Max Filippov
@item
2560 3aeaea65 Max Filippov
A range of Xtensa CPUs, default is the DC232B
2561 3aeaea65 Max Filippov
@item
2562 3aeaea65 Max Filippov
16550 UART
2563 3aeaea65 Max Filippov
@item
2564 3aeaea65 Max Filippov
OpenCores 10/100 Mbps Ethernet MAC
2565 3aeaea65 Max Filippov
@end itemize
2566 3aeaea65 Max Filippov
2567 3aeaea65 Max Filippov
@c man begin OPTIONS
2568 3aeaea65 Max Filippov
2569 3aeaea65 Max Filippov
The following options are specific to the Xtensa emulation:
2570 3aeaea65 Max Filippov
2571 3aeaea65 Max Filippov
@table @option
2572 3aeaea65 Max Filippov
2573 3aeaea65 Max Filippov
@item -semihosting
2574 3aeaea65 Max Filippov
Enable semihosting syscall emulation.
2575 3aeaea65 Max Filippov
2576 3aeaea65 Max Filippov
Xtensa semihosting provides basic file IO calls, such as open/read/write/seek/select.
2577 3aeaea65 Max Filippov
Tensilica baremetal libc for ISS and linux platform "sim" use this interface.
2578 3aeaea65 Max Filippov
2579 3aeaea65 Max Filippov
Note that this allows guest direct access to the host filesystem,
2580 3aeaea65 Max Filippov
so should only be used with trusted guest OS.
2581 3aeaea65 Max Filippov
2582 3aeaea65 Max Filippov
@end table
2583 5fafdf24 ths
@node QEMU User space emulator
2584 5fafdf24 ths
@chapter QEMU User space emulator
2585 83195237 bellard
2586 83195237 bellard
@menu
2587 83195237 bellard
* Supported Operating Systems ::
2588 83195237 bellard
* Linux User space emulator::
2589 84778508 blueswir1
* BSD User space emulator ::
2590 83195237 bellard
@end menu
2591 83195237 bellard
2592 83195237 bellard
@node Supported Operating Systems
2593 83195237 bellard
@section Supported Operating Systems
2594 83195237 bellard
2595 83195237 bellard
The following OS are supported in user space emulation:
2596 83195237 bellard
2597 83195237 bellard
@itemize @minus
2598 83195237 bellard
@item
2599 4be456f1 ths
Linux (referred as qemu-linux-user)
2600 83195237 bellard
@item
2601 84778508 blueswir1
BSD (referred as qemu-bsd-user)
2602 83195237 bellard
@end itemize
2603 83195237 bellard
2604 83195237 bellard
@node Linux User space emulator
2605 83195237 bellard
@section Linux User space emulator
2606 386405f7 bellard
2607 debc7065 bellard
@menu
2608 debc7065 bellard
* Quick Start::
2609 debc7065 bellard
* Wine launch::
2610 debc7065 bellard
* Command line options::
2611 79737e4a pbrook
* Other binaries::
2612 debc7065 bellard
@end menu
2613 debc7065 bellard
2614 debc7065 bellard
@node Quick Start
2615 83195237 bellard
@subsection Quick Start
2616 df0f11a0 bellard
2617 1f673135 bellard
In order to launch a Linux process, QEMU needs the process executable
2618 5fafdf24 ths
itself and all the target (x86) dynamic libraries used by it.
2619 386405f7 bellard
2620 1f673135 bellard
@itemize
2621 386405f7 bellard
2622 1f673135 bellard
@item On x86, you can just try to launch any process by using the native
2623 1f673135 bellard
libraries:
2624 386405f7 bellard
2625 5fafdf24 ths
@example
2626 1f673135 bellard
qemu-i386 -L / /bin/ls
2627 1f673135 bellard
@end example
2628 386405f7 bellard
2629 1f673135 bellard
@code{-L /} tells that the x86 dynamic linker must be searched with a
2630 1f673135 bellard
@file{/} prefix.
2631 386405f7 bellard
2632 b65ee4fa Stefan Weil
@item Since QEMU is also a linux process, you can launch QEMU with
2633 b65ee4fa Stefan Weil
QEMU (NOTE: you can only do that if you compiled QEMU from the sources):
2634 386405f7 bellard
2635 5fafdf24 ths
@example
2636 1f673135 bellard
qemu-i386 -L / qemu-i386 -L / /bin/ls
2637 1f673135 bellard
@end example
2638 386405f7 bellard
2639 1f673135 bellard
@item On non x86 CPUs, you need first to download at least an x86 glibc
2640 1f673135 bellard
(@file{qemu-runtime-i386-XXX-.tar.gz} on the QEMU web page). Ensure that
2641 1f673135 bellard
@code{LD_LIBRARY_PATH} is not set:
2642 df0f11a0 bellard
2643 1f673135 bellard
@example
2644 5fafdf24 ths
unset LD_LIBRARY_PATH
2645 1f673135 bellard
@end example
2646 1eb87257 bellard
2647 1f673135 bellard
Then you can launch the precompiled @file{ls} x86 executable:
2648 1eb87257 bellard
2649 1f673135 bellard
@example
2650 1f673135 bellard
qemu-i386 tests/i386/ls
2651 1f673135 bellard
@end example
2652 4c3b5a48 Blue Swirl
You can look at @file{scripts/qemu-binfmt-conf.sh} so that
2653 1f673135 bellard
QEMU is automatically launched by the Linux kernel when you try to
2654 1f673135 bellard
launch x86 executables. It requires the @code{binfmt_misc} module in the
2655 1f673135 bellard
Linux kernel.
2656 1eb87257 bellard
2657 1f673135 bellard
@item The x86 version of QEMU is also included. You can try weird things such as:
2658 1f673135 bellard
@example
2659 debc7065 bellard
qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \
2660 debc7065 bellard
          /usr/local/qemu-i386/bin/ls-i386
2661 1f673135 bellard
@end example
2662 1eb20527 bellard
2663 1f673135 bellard
@end itemize
2664 1eb20527 bellard
2665 debc7065 bellard
@node Wine launch
2666 83195237 bellard
@subsection Wine launch
2667 1eb20527 bellard
2668 1f673135 bellard
@itemize
2669 386405f7 bellard
2670 1f673135 bellard
@item Ensure that you have a working QEMU with the x86 glibc
2671 1f673135 bellard
distribution (see previous section). In order to verify it, you must be
2672 1f673135 bellard
able to do:
2673 386405f7 bellard
2674 1f673135 bellard
@example
2675 1f673135 bellard
qemu-i386 /usr/local/qemu-i386/bin/ls-i386
2676 1f673135 bellard
@end example
2677 386405f7 bellard
2678 1f673135 bellard
@item Download the binary x86 Wine install
2679 5fafdf24 ths
(@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page).
2680 386405f7 bellard
2681 1f673135 bellard
@item Configure Wine on your account. Look at the provided script
2682 debc7065 bellard
@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous
2683 1f673135 bellard
@code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}.
2684 386405f7 bellard
2685 1f673135 bellard
@item Then you can try the example @file{putty.exe}:
2686 386405f7 bellard
2687 1f673135 bellard
@example
2688 debc7065 bellard
qemu-i386 /usr/local/qemu-i386/wine/bin/wine \
2689 debc7065 bellard
          /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe
2690 1f673135 bellard
@end example
2691 386405f7 bellard
2692 1f673135 bellard
@end itemize
2693 fd429f2f bellard
2694 debc7065 bellard
@node Command line options
2695 83195237 bellard
@subsection Command line options
2696 1eb20527 bellard
2697 1f673135 bellard
@example
2698 68a1c816 Paul Brook
usage: qemu-i386 [-h] [-d] [-L path] [-s size] [-cpu model] [-g port] [-B offset] [-R size] program [arguments...]
2699 1f673135 bellard
@end example
2700 1eb20527 bellard
2701 1f673135 bellard
@table @option
2702 1f673135 bellard
@item -h
2703 1f673135 bellard
Print the help
2704 3b46e624 ths
@item -L path
2705 1f673135 bellard
Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)
2706 1f673135 bellard
@item -s size
2707 1f673135 bellard
Set the x86 stack size in bytes (default=524288)
2708 34a3d239 blueswir1
@item -cpu model
2709 c8057f95 Peter Maydell
Select CPU model (-cpu help for list and additional feature selection)
2710 f66724c9 Stefan Weil
@item -E @var{var}=@var{value}
2711 f66724c9 Stefan Weil
Set environment @var{var} to @var{value}.
2712 f66724c9 Stefan Weil
@item -U @var{var}
2713 f66724c9 Stefan Weil
Remove @var{var} from the environment.
2714 379f6698 Paul Brook
@item -B offset
2715 379f6698 Paul Brook
Offset guest address by the specified number of bytes.  This is useful when
2716 1f5c3f8c Stefan Weil
the address region required by guest applications is reserved on the host.
2717 1f5c3f8c Stefan Weil
This option is currently only supported on some hosts.
2718 68a1c816 Paul Brook
@item -R size
2719 68a1c816 Paul Brook
Pre-allocate a guest virtual address space of the given size (in bytes).
2720 0d6753e5 Stefan Weil
"G", "M", and "k" suffixes may be used when specifying the size.
2721 386405f7 bellard
@end table
2722 386405f7 bellard
2723 1f673135 bellard
Debug options:
2724 386405f7 bellard
2725 1f673135 bellard
@table @option
2726 989b697d Peter Maydell
@item -d item1,...
2727 989b697d Peter Maydell
Activate logging of the specified items (use '-d help' for a list of log items)
2728 1f673135 bellard
@item -p pagesize
2729 1f673135 bellard
Act as if the host page size was 'pagesize' bytes
2730 34a3d239 blueswir1
@item -g port
2731 34a3d239 blueswir1
Wait gdb connection to port
2732 1b530a6d aurel32
@item -singlestep
2733 1b530a6d aurel32
Run the emulation in single step mode.
2734 1f673135 bellard
@end table
2735 386405f7 bellard
2736 b01bcae6 balrog
Environment variables:
2737 b01bcae6 balrog
2738 b01bcae6 balrog
@table @env
2739 b01bcae6 balrog
@item QEMU_STRACE
2740 b01bcae6 balrog
Print system calls and arguments similar to the 'strace' program
2741 b01bcae6 balrog
(NOTE: the actual 'strace' program will not work because the user
2742 b01bcae6 balrog
space emulator hasn't implemented ptrace).  At the moment this is
2743 b01bcae6 balrog
incomplete.  All system calls that don't have a specific argument
2744 b01bcae6 balrog
format are printed with information for six arguments.  Many
2745 b01bcae6 balrog
flag-style arguments don't have decoders and will show up as numbers.
2746 5cfdf930 ths
@end table
2747 b01bcae6 balrog
2748 79737e4a pbrook
@node Other binaries
2749 83195237 bellard
@subsection Other binaries
2750 79737e4a pbrook
2751 7544a042 Stefan Weil
@cindex user mode (Alpha)
2752 7544a042 Stefan Weil
@command{qemu-alpha} TODO.
2753 7544a042 Stefan Weil
2754 7544a042 Stefan Weil
@cindex user mode (ARM)
2755 7544a042 Stefan Weil
@command{qemu-armeb} TODO.
2756 7544a042 Stefan Weil
2757 7544a042 Stefan Weil
@cindex user mode (ARM)
2758 79737e4a pbrook
@command{qemu-arm} is also capable of running ARM "Angel" semihosted ELF
2759 79737e4a pbrook
binaries (as implemented by the arm-elf and arm-eabi Newlib/GDB
2760 79737e4a pbrook
configurations), and arm-uclinux bFLT format binaries.
2761 79737e4a pbrook
2762 7544a042 Stefan Weil
@cindex user mode (ColdFire)
2763 7544a042 Stefan Weil
@cindex user mode (M68K)
2764 e6e5906b pbrook
@command{qemu-m68k} is capable of running semihosted binaries using the BDM
2765 e6e5906b pbrook
(m5xxx-ram-hosted.ld) or m68k-sim (sim.ld) syscall interfaces, and
2766 e6e5906b pbrook
coldfire uClinux bFLT format binaries.
2767 e6e5906b pbrook
2768 79737e4a pbrook
The binary format is detected automatically.
2769 79737e4a pbrook
2770 7544a042 Stefan Weil
@cindex user mode (Cris)
2771 7544a042 Stefan Weil
@command{qemu-cris} TODO.
2772 7544a042 Stefan Weil
2773 7544a042 Stefan Weil
@cindex user mode (i386)
2774 7544a042 Stefan Weil
@command{qemu-i386} TODO.
2775 7544a042 Stefan Weil
@command{qemu-x86_64} TODO.
2776 7544a042 Stefan Weil
2777 7544a042 Stefan Weil
@cindex user mode (Microblaze)
2778 7544a042 Stefan Weil
@command{qemu-microblaze} TODO.
2779 7544a042 Stefan Weil
2780 7544a042 Stefan Weil
@cindex user mode (MIPS)
2781 7544a042 Stefan Weil
@command{qemu-mips} TODO.
2782 7544a042 Stefan Weil
@command{qemu-mipsel} TODO.
2783 7544a042 Stefan Weil
2784 7544a042 Stefan Weil
@cindex user mode (PowerPC)
2785 7544a042 Stefan Weil
@command{qemu-ppc64abi32} TODO.
2786 7544a042 Stefan Weil
@command{qemu-ppc64} TODO.
2787 7544a042 Stefan Weil
@command{qemu-ppc} TODO.
2788 7544a042 Stefan Weil
2789 7544a042 Stefan Weil
@cindex user mode (SH4)
2790 7544a042 Stefan Weil
@command{qemu-sh4eb} TODO.
2791 7544a042 Stefan Weil
@command{qemu-sh4} TODO.
2792 7544a042 Stefan Weil
2793 7544a042 Stefan Weil
@cindex user mode (SPARC)
2794 34a3d239 blueswir1
@command{qemu-sparc} can execute Sparc32 binaries (Sparc32 CPU, 32 bit ABI).
2795 34a3d239 blueswir1
2796 a785e42e blueswir1
@command{qemu-sparc32plus} can execute Sparc32 and SPARC32PLUS binaries
2797 a785e42e blueswir1
(Sparc64 CPU, 32 bit ABI).
2798 a785e42e blueswir1
2799 a785e42e blueswir1
@command{qemu-sparc64} can execute some Sparc64 (Sparc64 CPU, 64 bit ABI) and
2800 a785e42e blueswir1
SPARC32PLUS binaries (Sparc64 CPU, 32 bit ABI).
2801 a785e42e blueswir1
2802 84778508 blueswir1
@node BSD User space emulator
2803 84778508 blueswir1
@section BSD User space emulator
2804 84778508 blueswir1
2805 84778508 blueswir1
@menu
2806 84778508 blueswir1
* BSD Status::
2807 84778508 blueswir1
* BSD Quick Start::
2808 84778508 blueswir1
* BSD Command line options::
2809 84778508 blueswir1
@end menu
2810 84778508 blueswir1
2811 84778508 blueswir1
@node BSD Status
2812 84778508 blueswir1
@subsection BSD Status
2813 84778508 blueswir1
2814 84778508 blueswir1
@itemize @minus
2815 84778508 blueswir1
@item
2816 84778508 blueswir1
target Sparc64 on Sparc64: Some trivial programs work.
2817 84778508 blueswir1
@end itemize
2818 84778508 blueswir1
2819 84778508 blueswir1
@node BSD Quick Start
2820 84778508 blueswir1
@subsection Quick Start
2821 84778508 blueswir1
2822 84778508 blueswir1
In order to launch a BSD process, QEMU needs the process executable
2823 84778508 blueswir1
itself and all the target dynamic libraries used by it.
2824 84778508 blueswir1
2825 84778508 blueswir1
@itemize
2826 84778508 blueswir1
2827 84778508 blueswir1
@item On Sparc64, you can just try to launch any process by using the native
2828 84778508 blueswir1
libraries:
2829 84778508 blueswir1
2830 84778508 blueswir1
@example
2831 84778508 blueswir1
qemu-sparc64 /bin/ls
2832 84778508 blueswir1
@end example
2833 84778508 blueswir1
2834 84778508 blueswir1
@end itemize
2835 84778508 blueswir1
2836 84778508 blueswir1
@node BSD Command line options
2837 84778508 blueswir1
@subsection Command line options
2838 84778508 blueswir1
2839 84778508 blueswir1
@example
2840 84778508 blueswir1
usage: qemu-sparc64 [-h] [-d] [-L path] [-s size] [-bsd type] program [arguments...]
2841 84778508 blueswir1
@end example
2842 84778508 blueswir1
2843 84778508 blueswir1
@table @option
2844 84778508 blueswir1
@item -h
2845 84778508 blueswir1
Print the help
2846 84778508 blueswir1
@item -L path
2847 84778508 blueswir1
Set the library root path (default=/)
2848 84778508 blueswir1
@item -s size
2849 84778508 blueswir1
Set the stack size in bytes (default=524288)
2850 f66724c9 Stefan Weil
@item -ignore-environment
2851 f66724c9 Stefan Weil
Start with an empty environment. Without this option,
2852 40c5c6cd Stefan Weil
the initial environment is a copy of the caller's environment.
2853 f66724c9 Stefan Weil
@item -E @var{var}=@var{value}
2854 f66724c9 Stefan Weil
Set environment @var{var} to @var{value}.
2855 f66724c9 Stefan Weil
@item -U @var{var}
2856 f66724c9 Stefan Weil
Remove @var{var} from the environment.
2857 84778508 blueswir1
@item -bsd type
2858 84778508 blueswir1
Set the type of the emulated BSD Operating system. Valid values are
2859 84778508 blueswir1
FreeBSD, NetBSD and OpenBSD (default).
2860 84778508 blueswir1
@end table
2861 84778508 blueswir1
2862 84778508 blueswir1
Debug options:
2863 84778508 blueswir1
2864 84778508 blueswir1
@table @option
2865 989b697d Peter Maydell
@item -d item1,...
2866 989b697d Peter Maydell
Activate logging of the specified items (use '-d help' for a list of log items)
2867 84778508 blueswir1
@item -p pagesize
2868 84778508 blueswir1
Act as if the host page size was 'pagesize' bytes
2869 1b530a6d aurel32
@item -singlestep
2870 1b530a6d aurel32
Run the emulation in single step mode.
2871 84778508 blueswir1
@end table
2872 84778508 blueswir1
2873 15a34c63 bellard
@node compilation
2874 15a34c63 bellard
@chapter Compilation from the sources
2875 15a34c63 bellard
2876 debc7065 bellard
@menu
2877 debc7065 bellard
* Linux/Unix::
2878 debc7065 bellard
* Windows::
2879 debc7065 bellard
* Cross compilation for Windows with Linux::
2880 debc7065 bellard
* Mac OS X::
2881 47eacb4f Stefan Weil
* Make targets::
2882 debc7065 bellard
@end menu
2883 debc7065 bellard
2884 debc7065 bellard
@node Linux/Unix
2885 7c3fc84d bellard
@section Linux/Unix
2886 7c3fc84d bellard
2887 7c3fc84d bellard
@subsection Compilation
2888 7c3fc84d bellard
2889 7c3fc84d bellard
First you must decompress the sources:
2890 7c3fc84d bellard
@example
2891 7c3fc84d bellard
cd /tmp
2892 7c3fc84d bellard
tar zxvf qemu-x.y.z.tar.gz
2893 7c3fc84d bellard
cd qemu-x.y.z
2894 7c3fc84d bellard
@end example
2895 7c3fc84d bellard
2896 7c3fc84d bellard
Then you configure QEMU and build it (usually no options are needed):
2897 7c3fc84d bellard
@example
2898 7c3fc84d bellard
./configure
2899 7c3fc84d bellard
make
2900 7c3fc84d bellard
@end example
2901 7c3fc84d bellard
2902 7c3fc84d bellard
Then type as root user:
2903 7c3fc84d bellard
@example
2904 7c3fc84d bellard
make install
2905 7c3fc84d bellard
@end example
2906 7c3fc84d bellard
to install QEMU in @file{/usr/local}.
2907 7c3fc84d bellard
2908 debc7065 bellard
@node Windows
2909 15a34c63 bellard
@section Windows
2910 15a34c63 bellard
2911 15a34c63 bellard
@itemize
2912 15a34c63 bellard
@item Install the current versions of MSYS and MinGW from
2913 15a34c63 bellard
@url{http://www.mingw.org/}. You can find detailed installation
2914 15a34c63 bellard
instructions in the download section and the FAQ.
2915 15a34c63 bellard
2916 5fafdf24 ths
@item Download
2917 15a34c63 bellard
the MinGW development library of SDL 1.2.x
2918 debc7065 bellard
(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from
2919 d0a96f3d Scott Tsai
@url{http://www.libsdl.org}. Unpack it in a temporary place and
2920 d0a96f3d Scott Tsai
edit the @file{sdl-config} script so that it gives the
2921 15a34c63 bellard
correct SDL directory when invoked.
2922 15a34c63 bellard
2923 d0a96f3d Scott Tsai
@item Install the MinGW version of zlib and make sure
2924 d0a96f3d Scott Tsai
@file{zlib.h} and @file{libz.dll.a} are in
2925 40c5c6cd Stefan Weil
MinGW's default header and linker search paths.
2926 d0a96f3d Scott Tsai
2927 15a34c63 bellard
@item Extract the current version of QEMU.
2928 5fafdf24 ths
2929 15a34c63 bellard
@item Start the MSYS shell (file @file{msys.bat}).
2930 15a34c63 bellard
2931 5fafdf24 ths
@item Change to the QEMU directory. Launch @file{./configure} and
2932 15a34c63 bellard
@file{make}.  If you have problems using SDL, verify that
2933 15a34c63 bellard
@file{sdl-config} can be launched from the MSYS command line.
2934 15a34c63 bellard
2935 c5ec15ea Stefan Weil
@item You can install QEMU in @file{Program Files/QEMU} by typing
2936 15a34c63 bellard
@file{make install}. Don't forget to copy @file{SDL.dll} in
2937 c5ec15ea Stefan Weil
@file{Program Files/QEMU}.
2938 15a34c63 bellard
2939 15a34c63 bellard
@end itemize
2940 15a34c63 bellard
2941 debc7065 bellard
@node Cross compilation for Windows with Linux
2942 15a34c63 bellard
@section Cross compilation for Windows with Linux
2943 15a34c63 bellard
2944 15a34c63 bellard
@itemize
2945 15a34c63 bellard
@item
2946 15a34c63 bellard
Install the MinGW cross compilation tools available at
2947 15a34c63 bellard
@url{http://www.mingw.org/}.
2948 15a34c63 bellard
2949 d0a96f3d Scott Tsai
@item Download
2950 d0a96f3d Scott Tsai
the MinGW development library of SDL 1.2.x
2951 d0a96f3d Scott Tsai
(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from
2952 d0a96f3d Scott Tsai
@url{http://www.libsdl.org}. Unpack it in a temporary place and
2953 d0a96f3d Scott Tsai
edit the @file{sdl-config} script so that it gives the
2954 d0a96f3d Scott Tsai
correct SDL directory when invoked.  Set up the @code{PATH} environment
2955 d0a96f3d Scott Tsai
variable so that @file{sdl-config} can be launched by
2956 15a34c63 bellard
the QEMU configuration script.
2957 15a34c63 bellard
2958 d0a96f3d Scott Tsai
@item Install the MinGW version of zlib and make sure
2959 d0a96f3d Scott Tsai
@file{zlib.h} and @file{libz.dll.a} are in
2960 40c5c6cd Stefan Weil
MinGW's default header and linker search paths.
2961 d0a96f3d Scott Tsai
2962 5fafdf24 ths
@item
2963 15a34c63 bellard
Configure QEMU for Windows cross compilation:
2964 15a34c63 bellard
@example
2965 d0a96f3d Scott Tsai
PATH=/usr/i686-pc-mingw32/sys-root/mingw/bin:$PATH ./configure --cross-prefix='i686-pc-mingw32-'
2966 d0a96f3d Scott Tsai
@end example
2967 d0a96f3d Scott Tsai
The example assumes @file{sdl-config} is installed under @file{/usr/i686-pc-mingw32/sys-root/mingw/bin} and
2968 d0a96f3d Scott Tsai
MinGW cross compilation tools have names like @file{i686-pc-mingw32-gcc} and @file{i686-pc-mingw32-strip}.
2969 40c5c6cd Stefan Weil
We set the @code{PATH} environment variable to ensure the MinGW version of @file{sdl-config} is used and
2970 d0a96f3d Scott Tsai
use --cross-prefix to specify the name of the cross compiler.
2971 c5ec15ea Stefan Weil
You can also use --prefix to set the Win32 install path which defaults to @file{c:/Program Files/QEMU}.
2972 d0a96f3d Scott Tsai
2973 d0a96f3d Scott Tsai
Under Fedora Linux, you can run:
2974 d0a96f3d Scott Tsai
@example
2975 d0a96f3d Scott Tsai
yum -y install mingw32-gcc mingw32-SDL mingw32-zlib
2976 15a34c63 bellard
@end example
2977 d0a96f3d Scott Tsai
to get a suitable cross compilation environment.
2978 15a34c63 bellard
2979 5fafdf24 ths
@item You can install QEMU in the installation directory by typing
2980 d0a96f3d Scott Tsai
@code{make install}. Don't forget to copy @file{SDL.dll} and @file{zlib1.dll} into the
2981 5fafdf24 ths
installation directory.
2982 15a34c63 bellard
2983 15a34c63 bellard
@end itemize
2984 15a34c63 bellard
2985 3804da9d Stefan Weil
Wine can be used to launch the resulting qemu-system-i386.exe
2986 3804da9d Stefan Weil
and all other qemu-system-@var{target}.exe compiled for Win32.
2987 15a34c63 bellard
2988 debc7065 bellard
@node Mac OS X
2989 15a34c63 bellard
@section Mac OS X
2990 15a34c63 bellard
2991 15a34c63 bellard
The Mac OS X patches are not fully merged in QEMU, so you should look
2992 15a34c63 bellard
at the QEMU mailing list archive to have all the necessary
2993 15a34c63 bellard
information.
2994 15a34c63 bellard
2995 47eacb4f Stefan Weil
@node Make targets
2996 47eacb4f Stefan Weil
@section Make targets
2997 47eacb4f Stefan Weil
2998 47eacb4f Stefan Weil
@table @code
2999 47eacb4f Stefan Weil
3000 47eacb4f Stefan Weil
@item make
3001 47eacb4f Stefan Weil
@item make all
3002 47eacb4f Stefan Weil
Make everything which is typically needed.
3003 47eacb4f Stefan Weil
3004 47eacb4f Stefan Weil
@item install
3005 47eacb4f Stefan Weil
TODO
3006 47eacb4f Stefan Weil
3007 47eacb4f Stefan Weil
@item install-doc
3008 47eacb4f Stefan Weil
TODO
3009 47eacb4f Stefan Weil
3010 47eacb4f Stefan Weil
@item make clean
3011 47eacb4f Stefan Weil
Remove most files which were built during make.
3012 47eacb4f Stefan Weil
3013 47eacb4f Stefan Weil
@item make distclean
3014 47eacb4f Stefan Weil
Remove everything which was built during make.
3015 47eacb4f Stefan Weil
3016 47eacb4f Stefan Weil
@item make dvi
3017 47eacb4f Stefan Weil
@item make html
3018 47eacb4f Stefan Weil
@item make info
3019 47eacb4f Stefan Weil
@item make pdf
3020 47eacb4f Stefan Weil
Create documentation in dvi, html, info or pdf format.
3021 47eacb4f Stefan Weil
3022 47eacb4f Stefan Weil
@item make cscope
3023 47eacb4f Stefan Weil
TODO
3024 47eacb4f Stefan Weil
3025 47eacb4f Stefan Weil
@item make defconfig
3026 47eacb4f Stefan Weil
(Re-)create some build configuration files.
3027 47eacb4f Stefan Weil
User made changes will be overwritten.
3028 47eacb4f Stefan Weil
3029 47eacb4f Stefan Weil
@item tar
3030 47eacb4f Stefan Weil
@item tarbin
3031 47eacb4f Stefan Weil
TODO
3032 47eacb4f Stefan Weil
3033 47eacb4f Stefan Weil
@end table
3034 47eacb4f Stefan Weil
3035 7544a042 Stefan Weil
@node License
3036 7544a042 Stefan Weil
@appendix License
3037 7544a042 Stefan Weil
3038 7544a042 Stefan Weil
QEMU is a trademark of Fabrice Bellard.
3039 7544a042 Stefan Weil
3040 7544a042 Stefan Weil
QEMU is released under the GNU General Public License (TODO: add link).
3041 7544a042 Stefan Weil
Parts of QEMU have specific licenses, see file LICENSE.
3042 7544a042 Stefan Weil
3043 7544a042 Stefan Weil
TODO (refer to file LICENSE, include it, include the GPL?)
3044 7544a042 Stefan Weil
3045 debc7065 bellard
@node Index
3046 7544a042 Stefan Weil
@appendix Index
3047 7544a042 Stefan Weil
@menu
3048 7544a042 Stefan Weil
* Concept Index::
3049 7544a042 Stefan Weil
* Function Index::
3050 7544a042 Stefan Weil
* Keystroke Index::
3051 7544a042 Stefan Weil
* Program Index::
3052 7544a042 Stefan Weil
* Data Type Index::
3053 7544a042 Stefan Weil
* Variable Index::
3054 7544a042 Stefan Weil
@end menu
3055 7544a042 Stefan Weil
3056 7544a042 Stefan Weil
@node Concept Index
3057 7544a042 Stefan Weil
@section Concept Index
3058 7544a042 Stefan Weil
This is the main index. Should we combine all keywords in one index? TODO
3059 debc7065 bellard
@printindex cp
3060 debc7065 bellard
3061 7544a042 Stefan Weil
@node Function Index
3062 7544a042 Stefan Weil
@section Function Index
3063 7544a042 Stefan Weil
This index could be used for command line options and monitor functions.
3064 7544a042 Stefan Weil
@printindex fn
3065 7544a042 Stefan Weil
3066 7544a042 Stefan Weil
@node Keystroke Index
3067 7544a042 Stefan Weil
@section Keystroke Index
3068 7544a042 Stefan Weil
3069 7544a042 Stefan Weil
This is a list of all keystrokes which have a special function
3070 7544a042 Stefan Weil
in system emulation.
3071 7544a042 Stefan Weil
3072 7544a042 Stefan Weil
@printindex ky
3073 7544a042 Stefan Weil
3074 7544a042 Stefan Weil
@node Program Index
3075 7544a042 Stefan Weil
@section Program Index
3076 7544a042 Stefan Weil
@printindex pg
3077 7544a042 Stefan Weil
3078 7544a042 Stefan Weil
@node Data Type Index
3079 7544a042 Stefan Weil
@section Data Type Index
3080 7544a042 Stefan Weil
3081 7544a042 Stefan Weil
This index could be used for qdev device names and options.
3082 7544a042 Stefan Weil
3083 7544a042 Stefan Weil
@printindex tp
3084 7544a042 Stefan Weil
3085 7544a042 Stefan Weil
@node Variable Index
3086 7544a042 Stefan Weil
@section Variable Index
3087 7544a042 Stefan Weil
@printindex vr
3088 7544a042 Stefan Weil
3089 debc7065 bellard
@bye