qemu-doc.texi 27.5 KB
Newer Older
bellard's avatar
bellard committed
1
2
\input texinfo @c -*- texinfo -*-

bellard's avatar
updated    
bellard committed
3
@iftex
bellard's avatar
bellard committed
4
@settitle QEMU CPU Emulator User Documentation
bellard's avatar
bellard committed
5
6
@titlepage
@sp 7
bellard's avatar
bellard committed
7
@center @titlefont{QEMU CPU Emulator User Documentation}
bellard's avatar
bellard committed
8
9
@sp 3
@end titlepage
bellard's avatar
updated    
bellard committed
10
@end iftex
bellard's avatar
bellard committed
11
12
13

@chapter Introduction

bellard's avatar
update    
bellard committed
14
@section Features
bellard's avatar
bellard committed
15

bellard's avatar
bellard committed
16
17
QEMU is a FAST! processor emulator using dynamic translation to
achieve good emulation speed.
bellard's avatar
update    
bellard committed
18
19

QEMU has two operating modes:
bellard's avatar
updated    
bellard committed
20
21
22
23

@itemize @minus

@item 
bellard's avatar
bellard committed
24
25
26
27
Full system emulation. In this mode, QEMU emulates a full system (for
example a PC), including a processor and various peripherials. It can
be used to launch different Operating Systems without rebooting the
PC or to debug system code.
bellard's avatar
update    
bellard committed
28

bellard's avatar
updated    
bellard committed
29
@item 
bellard's avatar
bellard committed
30
31
32
33
User mode emulation (Linux host only). In this mode, QEMU can launch
Linux processes compiled for one CPU on another CPU. It can be used to
launch the Wine Windows API emulator (@url{http://www.winehq.org}) or
to ease cross-compilation and cross-debugging.
bellard's avatar
update    
bellard committed
34
35
36

@end itemize

bellard's avatar
bellard committed
37
As QEMU requires no host kernel driver to run, it is very safe and
bellard's avatar
update    
bellard committed
38
easy to use.
bellard's avatar
update    
bellard committed
39

bellard's avatar
update    
bellard committed
40
41
42
43
44
For system emulation, the following hardware targets are supported:
@itemize
@item PC (x86 processor)
@item PREP (PowerPC processor)
@end itemize
bellard's avatar
bellard committed
45

bellard's avatar
bellard committed
46
For user emulation, x86, PowerPC, ARM, and SPARC CPUs are supported.
bellard's avatar
updated    
bellard committed
47

bellard's avatar
update    
bellard committed
48
49
@chapter Installation

bellard's avatar
bellard committed
50
51
@section Linux

bellard's avatar
update    
bellard committed
52
53
54
55
56
57
58
59
60
61
62
If you want to compile QEMU, please read the @file{README} which gives
the related information. Otherwise just download the binary
distribution (@file{qemu-XXX-i386.tar.gz}) and untar it as root in
@file{/}:

@example
su
cd /
tar zxvf /tmp/qemu-XXX-i386.tar.gz
@end example

bellard's avatar
bellard committed
63
64
@section Windows
w
65
@itemize
bellard's avatar
bellard committed
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
@item Install the current versions of MSYS and MinGW from
@url{http://www.mingw.org/}. You can find detailed installation
instructions in the download section and the FAQ.

@item Download 
the MinGW development library of SDL 1.2.x
(@file{SDL-devel-1.2.x-mingw32.tar.gz}) from
@url{http://www.libsdl.org}. Unpack it in a temporary place, and
unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool
directory. Edit the @file{sdl-config} script so that it gives the
correct SDL directory when invoked.

@item Extract the current version of QEMU.
 
@item Start the MSYS shell (file @file{msys.bat}).
bellard's avatar
bellard committed
81

bellard's avatar
bellard committed
82
83
84
@item Change to the QEMU directory. Launch @file{./configure} and 
@file{make}.  If you have problems using SDL, verify that
@file{sdl-config} can be launched from the MSYS command line.
bellard's avatar
bellard committed
85

bellard's avatar
bellard committed
86
87
88
@item You can install QEMU in @file{Program Files/Qemu} by typing 
@file{make install}. Don't forget to copy @file{SDL.dll} in
@file{Program Files/Qemu}.
bellard's avatar
update    
bellard committed
89

bellard's avatar
bellard committed
90
91
@end itemize

bellard's avatar
bellard committed
92
@section Cross compilation for Windows with Linux
bellard's avatar
bellard committed
93
94

@itemize
bellard's avatar
bellard committed
95
96
97
@item
Install the MinGW cross compilation tools available at
@url{http://www.mingw.org/}.
bellard's avatar
bellard committed
98

bellard's avatar
bellard committed
99
100
101
102
103
@item 
Install the Win32 version of SDL (@url{http://www.libsdl.org}) by
unpacking @file{i386-mingw32msvc.tar.gz}. Set up the PATH environment
variable so that @file{i386-mingw32msvc-sdl-config} can be launched by
the QEMU configuration script.
bellard's avatar
bellard committed
104

bellard's avatar
bellard committed
105
106
@item 
Configure QEMU for Windows cross compilation:
bellard's avatar
bellard committed
107
@example
bellard's avatar
bellard committed
108
./configure --enable-mingw32
bellard's avatar
bellard committed
109
@end example
bellard's avatar
bellard committed
110
111
112
If necessary, you can change the cross-prefix according to the prefix
choosen for the MinGW tools with --cross-prefix. You can also use
--prefix to set the Win32 install path.
bellard's avatar
bellard committed
113

bellard's avatar
bellard committed
114
115
116
@item You can install QEMU in the installation directory by typing 
@file{make install}. Don't forget to copy @file{SDL.dll} in the
installation directory. 
117
118
119

@end itemize

bellard's avatar
bellard committed
120
121
Note: Currently, Wine does not seem able to launch
QEMU for Win32.
122

bellard's avatar
bellard committed
123
@section Mac OS X
124

bellard's avatar
bellard committed
125
Mac OS X is currently not supported.
bellard's avatar
update    
bellard committed
126

bellard's avatar
update    
bellard committed
127
@chapter QEMU PC System emulator invocation
bellard's avatar
update    
bellard committed
128

bellard's avatar
updated    
bellard committed
129
130
131
132
@section Introduction

@c man begin DESCRIPTION

bellard's avatar
update    
bellard committed
133
The QEMU System emulator simulates a complete PC.
bellard's avatar
updated    
bellard committed
134
135
136
137
138
139
140

In order to meet specific user needs, two versions of QEMU are
available:

@enumerate

@item 
bellard's avatar
update    
bellard committed
141
@code{qemu-fast} uses the host Memory Management Unit (MMU) to simulate 
bellard's avatar
updated    
bellard committed
142
143
144
145
146
147
the x86 MMU. It is @emph{fast} but has limitations because the whole 4 GB
address space cannot be used and some memory mapped peripherials
cannot be emulated accurately yet. Therefore, a specific Linux kernel
must be used (@xref{linux_compile}).

@item 
bellard's avatar
update    
bellard committed
148
149
@code{qemu} uses a software MMU. It is about @emph{two times 
slower} but gives a more accurate emulation. 
bellard's avatar
updated    
bellard committed
150
151
152
153
154
155
156
157
158
159
160

@end enumerate

QEMU emulates the following PC peripherials:

@itemize @minus
@item
VGA (hardware level, including all non standard modes)
@item
PS/2 mouse and keyboard
@item 
bellard's avatar
update    
bellard committed
161
2 IDE interfaces with hard disk and CD-ROM support
bellard's avatar
bellard committed
162
163
@item
Floppy disk
bellard's avatar
updated    
bellard committed
164
@item 
bellard's avatar
bellard committed
165
up to 6 NE2000 network adapters
bellard's avatar
updated    
bellard committed
166
@item
bellard's avatar
update    
bellard committed
167
168
169
Serial port
@item 
Soundblaster 16 card
bellard's avatar
updated    
bellard committed
170
171
172
173
@end itemize

@c man end

bellard's avatar
update    
bellard committed
174
175
@section Quick Start

bellard's avatar
update    
bellard committed
176
Download and uncompress the linux image (@file{linux.img}) and type:
bellard's avatar
updated    
bellard committed
177
178

@example
bellard's avatar
update    
bellard committed
179
qemu linux.img
bellard's avatar
updated    
bellard committed
180
181
182
183
@end example

Linux should boot and give you a prompt.

bellard's avatar
update    
bellard committed
184
185
186
@section Invocation

@example
bellard's avatar
updated    
bellard committed
187
188
189
@c man begin SYNOPSIS
usage: qemu [options] [disk_image]
@c man end
bellard's avatar
update    
bellard committed
190
191
@end example

bellard's avatar
updated    
bellard committed
192
@c man begin OPTIONS
bellard's avatar
update    
bellard committed
193
@var{disk_image} is a raw hard disk image for IDE hard disk 0.
bellard's avatar
update    
bellard committed
194
195
196

General options:
@table @option
bellard's avatar
update    
bellard committed
197
198
199
200
@item -fda file
@item -fdb file
Use @var{file} as floppy disk 0/1 image (@xref{disk_images}).

bellard's avatar
update    
bellard committed
201
202
@item -hda file
@item -hdb file
bellard's avatar
update    
bellard committed
203
204
@item -hdc file
@item -hdd file
bellard's avatar
update    
bellard committed
205
Use @var{file} as hard disk 0, 1, 2 or 3 image (@xref{disk_images}).
bellard's avatar
bellard committed
206

bellard's avatar
update    
bellard committed
207
208
209
210
@item -cdrom file
Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and
@option{-cdrom} at the same time).

bellard's avatar
bellard committed
211
212
@item -boot [a|c|d]
Boot on floppy (a), hard disk (c) or CD-ROM (d). Hard disk boot is
bellard's avatar
update    
bellard committed
213
the default.
bellard's avatar
bellard committed
214

bellard's avatar
update    
bellard committed
215
@item -snapshot
bellard's avatar
bellard committed
216
217
218
Write to temporary files instead of disk image files. In this case,
the raw disk image you use is not written back. You can however force
the write back by pressing @key{C-a s} (@xref{disk_images}). 
bellard's avatar
update    
bellard committed
219
220
221
222

@item -m megs
Set virtual RAM size to @var{megs} megabytes.

bellard's avatar
update    
bellard committed
223
@item -initrd file
bellard's avatar
updated    
bellard committed
224
225
226
227
228
229
230
231
232
233
Use @var{file} as initial ram disk.

@item -nographic

Normally, QEMU uses SDL to display the VGA output. With this option,
you can totally disable graphical output so that QEMU is a simple
command line application. The emulated serial port is redirected on
the console. Therefore, you can still use QEMU to debug a Linux kernel
with a serial console.

bellard's avatar
update    
bellard committed
234
235
236
237
238
@item -enable-audio

The SB16 emulation is disabled by default as it may give problems with
Windows. You can enable it manually with this option.

bellard's avatar
updated    
bellard committed
239
240
@end table

bellard's avatar
bellard committed
241
242
243
244
245
Network options:

@table @option

@item -n script      
bellard's avatar
update    
bellard committed
246
247
Set TUN/TAP network init script [default=/etc/qemu-ifup]. This script
is launched to configure the host network interface (usually tun0)
bellard's avatar
bellard committed
248
249
250
251
252
253
254
255
corresponding to the virtual NE2000 card.

@item -macaddr addr   

Set the mac address of the first interface (the format is
aa:bb:cc:dd:ee:ff in hexa). The mac address is incremented for each
new network interface.

bellard's avatar
update    
bellard committed
256
257
258
259
260
261
262
263
264
265
266
267
@item -tun-fd fd
Assumes @var{fd} talks to a tap/tun host network interface and use
it. Read @url{http://bellard.org/qemu/tetrinet.html} to have an
example of its use.

@item -user-net 
(Experimental) Use the user mode network stack. This is the default if
no tun/tap network init script is found.

@item -dummy-net 
Use the dummy network stack: no packet will be received on the network
cards.
bellard's avatar
bellard committed
268
269
270
271
272
273
274

@end table

Linux boot specific. When using this options, you can use a given
Linux kernel without installing it in the disk image. It can be useful
for easier testing of various kernels.

bellard's avatar
updated    
bellard committed
275
276
277
278
279
280
281
282
283
284
285
@table @option

@item -kernel bzImage 
Use @var{bzImage} as kernel image.

@item -append cmdline 
Use @var{cmdline} as kernel command line

@item -initrd file
Use @var{file} as initial ram disk.

bellard's avatar
update    
bellard committed
286
287
288
289
290
@end table

Debug options:
@table @option
@item -s
bellard's avatar
updated    
bellard committed
291
Wait gdb connection to port 1234 (@xref{gdb_usage}). 
bellard's avatar
update    
bellard committed
292
293
@item -p port
Change gdb connection port.
bellard's avatar
update    
bellard committed
294
295
@item -S
Do not start CPU at startup (you must type 'c' in the monitor).
bellard's avatar
update    
bellard committed
296
@item -d             
bellard's avatar
update    
bellard committed
297
Output log in /tmp/qemu.log
bellard's avatar
update    
bellard committed
298
299
@end table

bellard's avatar
update    
bellard committed
300
301
During the graphical emulation, you can use the following keys:
@table @key
bellard's avatar
update    
bellard committed
302
@item Ctrl-Shift
bellard's avatar
update    
bellard committed
303
Toggle mouse and keyboard grab.
bellard's avatar
update    
bellard committed
304
@item Ctrl-Shift-f
bellard's avatar
update    
bellard committed
305
306
307
Toggle full screen
@end table

bellard's avatar
bellard committed
308
309
During emulation, if you are using the serial console, use @key{C-a h}
to get terminal commands:
bellard's avatar
update    
bellard committed
310
311

@table @key
bellard's avatar
update    
bellard committed
312
@item Ctrl-a h
bellard's avatar
update    
bellard committed
313
Print this help
bellard's avatar
update    
bellard committed
314
@item Ctrl-a x    
bellard's avatar
update    
bellard committed
315
Exit emulatior
bellard's avatar
update    
bellard committed
316
@item Ctrl-a s    
bellard's avatar
bellard committed
317
Save disk data back to file (if -snapshot)
bellard's avatar
update    
bellard committed
318
@item Ctrl-a b
bellard's avatar
bellard committed
319
Send break (magic sysrq in Linux)
bellard's avatar
update    
bellard committed
320
@item Ctrl-a c
bellard's avatar
bellard committed
321
Switch between console and monitor
bellard's avatar
update    
bellard committed
322
323
@item Ctrl-a Ctrl-a
Send Ctrl-a
bellard's avatar
update    
bellard committed
324
@end table
bellard's avatar
updated    
bellard committed
325
326
327
328
329
330
331
@c man end

@ignore

@setfilename qemu 
@settitle QEMU System Emulator

bellard's avatar
bellard committed
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
@c man begin SEEALSO
The HTML documentation of QEMU for more precise information and Linux
user mode emulator invocation.
@c man end

@c man begin AUTHOR
Fabrice Bellard
@c man end

@end ignore

@end ignore


@section QEMU Monitor

The QEMU monitor is used to give complex commands to the QEMU
emulator. You can use it to:

@itemize @minus

@item
Remove or insert removable medias images
(such as CD-ROM or floppies)

@item 
Freeze/unfreeze the Virtual Machine (VM) and save or restore its state
from a disk file.

@item Inspect the VM state without an external debugger.

@end itemize

@subsection Commands

The following commands are available:

@table @option

@item help or ? [cmd]
Show the help for all commands or just for command @var{cmd}.

@item commit  
Commit changes to the disk images (if -snapshot is used)

@item info subcommand 
show various information about the system state

@table @option
@item info network
show the network state
@item info block
show the block devices
@item info registers
show the cpu registers
@item info history
show the command line history
@end table

@item q or quit
Quit the emulator.

@item eject [-f] device
Eject a removable media (use -f to force it).

@item change device filename
Change a removable media.

@item screendump filename
Save screen into PPM image @var{filename}.

@item log item1[,...]
Activate logging of the specified items to @file{/tmp/qemu.log}.

@item savevm filename
Save the whole virtual machine state to @var{filename}.

@item loadvm filename
Restore the whole virtual machine state from @var{filename}.

@item stop
Stop emulation.

@item c or cont
Resume emulation.

@item gdbserver [port]
Start gdbserver session (default port=1234)

@item x/fmt addr
Virtual memory dump starting at @var{addr}.

@item xp /fmt addr
Physical memory dump starting at @var{addr}.

@var{fmt} is a format which tells the command how to format the
data. Its syntax is: @option{/@{count@}@{format@}@{size@}}

@table @var
@item count 
is the number of items to be dumped.

@item format
can be x (hexa), d (signed decimal), u (unsigned decimal), o (octal),
c (char) or i (asm instruction).

@item size
bellard's avatar
update    
bellard committed
439
440
441
can be b (8 bits), h (16 bits), w (32 bits) or g (64 bits). On x86,
@code{h} or @code{w} can be specified with the @code{i} format to
respectively select 16 or 32 bit code instruction size.
bellard's avatar
bellard committed
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483

@end table

Examples: 
@itemize
@item
Dump 10 instructions at the current instruction pointer:
@example 
(qemu) x/10i $eip
0x90107063:  ret
0x90107064:  sti
0x90107065:  lea    0x0(%esi,1),%esi
0x90107069:  lea    0x0(%edi,1),%edi
0x90107070:  ret
0x90107071:  jmp    0x90107080
0x90107073:  nop
0x90107074:  nop
0x90107075:  nop
0x90107076:  nop
@end example

@item
Dump 80 16 bit values at the start of the video memory.
@example 
(qemu) xp/80hx 0xb8000
0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42
0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41
0x000b8020: 0x0b42 0x0b69 0x0b6f 0x0b73 0x0b20 0x0b63 0x0b75 0x0b72
0x000b8030: 0x0b72 0x0b65 0x0b6e 0x0b74 0x0b2d 0x0b63 0x0b76 0x0b73
0x000b8040: 0x0b20 0x0b30 0x0b35 0x0b20 0x0b4e 0x0b6f 0x0b76 0x0b20
0x000b8050: 0x0b32 0x0b30 0x0b30 0x0b33 0x0720 0x0720 0x0720 0x0720
0x000b8060: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
@end example
@end itemize

@item p or print/fmt expr

Print expression value. Only the @var{format} part of @var{fmt} is
used.
bellard's avatar
updated    
bellard committed
484

bellard's avatar
bellard committed
485
@end table
bellard's avatar
updated    
bellard committed
486

bellard's avatar
bellard committed
487
488
489
490
491
@subsection Integer expressions

The monitor understands integers expressions for every integer
argument. You can use register names to get the value of specifics
CPU registers by prefixing them with @emph{$}.
bellard's avatar
update    
bellard committed
492

bellard's avatar
bellard committed
493
494
495
496
497
498
499
500
@node disk_images
@section Disk Images

@subsection Raw disk images

The disk images can simply be raw images of the hard disk. You can
create them with the command:
@example
bellard's avatar
update    
bellard committed
501
dd of=myimage bs=1024 seek=mysize count=0
bellard's avatar
bellard committed
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
@end example
where @var{myimage} is the image filename and @var{mysize} is its size
in kilobytes.

@subsection Snapshot mode

If you use the option @option{-snapshot}, all disk images are
considered as read only. When sectors in written, they are written in
a temporary file created in @file{/tmp}. You can however force the
write back to the raw disk images by pressing @key{C-a s}.

NOTE: The snapshot mode only works with raw disk images.

@subsection Copy On Write disk images

QEMU also supports user mode Linux
(@url{http://user-mode-linux.sourceforge.net/}) Copy On Write (COW)
disk images. The COW disk images are much smaller than normal images
as they store only modified sectors. They also permit the use of the
same disk image template for many users.

To create a COW disk images, use the command:

@example
bellard's avatar
updated    
bellard committed
526
qemu-mkcow -f myrawimage.bin mycowimage.cow
bellard's avatar
bellard committed
527
528
529
530
531
532
@end example

@file{myrawimage.bin} is a raw image you want to use as original disk
image. It will never be written to.

@file{mycowimage.cow} is the COW disk image which is created by
bellard's avatar
updated    
bellard committed
533
@code{qemu-mkcow}. You can use it directly with the @option{-hdx}
bellard's avatar
bellard committed
534
535
536
537
538
539
options. You must not modify the original raw disk image if you use
COW images, as COW images only store the modified sectors from the raw
disk image. QEMU stores the original raw disk image name and its
modified time in the COW disk image so that chances of mistakes are
reduced.

bellard's avatar
update    
bellard committed
540
541
542
If the raw disk image is not read-only, by pressing @key{C-a s} you
can flush the COW disk image back into the raw disk image, as in
snapshot mode.
bellard's avatar
bellard committed
543
544
545
546
547
548

COW disk images can also be created without a corresponding raw disk
image. It is useful to have a big initial virtual disk image without
using much disk space. Use:

@example
bellard's avatar
updated    
bellard committed
549
qemu-mkcow mycowimage.cow 1024
bellard's avatar
bellard committed
550
551
552
553
554
555
556
557
558
559
560
561
562
563
@end example

to create a 1 gigabyte empty COW disk image.

NOTES: 
@enumerate
@item
COW disk images must be created on file systems supporting
@emph{holes} such as ext2 or ext3.
@item 
Since holes are used, the displayed size of the COW disk image is not
the real one. To know it, use the @code{ls -ls} command.
@end enumerate

bellard's avatar
update    
bellard committed
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
@section Network emulation

QEMU simulates up to 6 networks cards (NE2000 boards). Each card can
be connected to a specific host network interface.

@subsection Using tun/tap network interface

This is the standard way to emulate network. QEMU adds a virtual
network device on your host (called @code{tun0}), and you can then
configure it as if it was a real ethernet card.

As an example, you can download the @file{linux-test-xxx.tar.gz}
archive and copy the script @file{qemu-ifup} in @file{/etc} and
configure properly @code{sudo} so that the command @code{ifconfig}
contained in @file{qemu-ifup} can be executed as root. You must verify
that your host kernel supports the TUN/TAP network interfaces: the
device @file{/dev/net/tun} must be present.

See @ref{direct_linux_boot} to have an example of network use with a
Linux distribution.

@subsection Using the user mode network stack

This is @emph{experimental} (version 0.5.4). You must configure qemu
with @code{--enable-slirp}. Then by using the option
@option{-user-net} or if you have no tun/tap init script, QEMU uses a
completely user mode network stack (you don't need root priviledge to
use the virtual network). The virtual network configuration is the
following:

@example

QEMU Virtual Machine    <------>  Firewall/DHCP server <-----> Internet
     (10.0.2.x)            |          (10.0.2.2)
                           |
                           ---->  DNS 
                              (10.0.2.3)
@end example

The QEMU VM behaves as if it was behind a firewall which blocks all
incoming connections. You can use a DHCP client to automatically
configure the network in the QEMU VM.

In order to check that the user mode network is working, you can ping
the address 10.0.2.2 and verify that you got an address in the range
10.0.2.x from the QEMU virtual DHCP server.

@node direct_linux_boot
@section Direct Linux Boot
bellard's avatar
bellard committed
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762

This section explains how to launch a Linux kernel inside QEMU without
having to make a full bootable image. It is very useful for fast Linux
kernel testing. The QEMU network configuration is also explained.

@enumerate
@item
Download the archive @file{linux-test-xxx.tar.gz} containing a Linux
kernel and a disk image. 

@item Optional: If you want network support (for example to launch X11 examples), you
must copy the script @file{qemu-ifup} in @file{/etc} and configure
properly @code{sudo} so that the command @code{ifconfig} contained in
@file{qemu-ifup} can be executed as root. You must verify that your host
kernel supports the TUN/TAP network interfaces: the device
@file{/dev/net/tun} must be present.

When network is enabled, there is a virtual network connection between
the host kernel and the emulated kernel. The emulated kernel is seen
from the host kernel at IP address 172.20.0.2 and the host kernel is
seen from the emulated kernel at IP address 172.20.0.1.

@item Launch @code{qemu.sh}. You should have the following output:

@example
> ./qemu.sh 
Connected to host network interface: tun0
Linux version 2.4.21 (bellard@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
BIOS-provided physical RAM map:
 BIOS-e801: 0000000000000000 - 000000000009f000 (usable)
 BIOS-e801: 0000000000100000 - 0000000002000000 (usable)
32MB LOWMEM available.
On node 0 totalpages: 8192
zone(0): 4096 pages.
zone(1): 4096 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe console=ttyS0
ide_setup: ide2=noprobe
ide_setup: ide3=noprobe
ide_setup: ide4=noprobe
ide_setup: ide5=noprobe
Initializing CPU#0
Detected 2399.621 MHz processor.
Console: colour EGA 80x25
Calibrating delay loop... 4744.80 BogoMIPS
Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Intel Pentium Pro stepping 03
Checking 'hlt' instruction... OK.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
apm: BIOS not found.
Starting kswapd
Journalled Block Device driver loaded
Detected PS/2 Mouse Port.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0x03f8 (irq = 4) is a 16450
ne.c:v1.10 9/23/94 Donald Becker (becker@scyld.com)
Last modified Nov 1, 2000 by Paul Gortmaker
NE*000 ethercard probe at 0x300: 52 54 00 12 34 56
eth0: NE2000 found at 0x300, using IRQ 9.
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
hda: QEMU HARDDISK, ATA DISK drive
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
hda: attached ide-disk driver.
hda: 20480 sectors (10 MB) w/256KiB Cache, CHS=20/16/63
Partition check:
 hda:
Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 64k freed
 
Linux version 2.4.21 (bellard@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
 
QEMU Linux test distribution (based on Redhat 9)
 
Type 'exit' to halt the system
 
sh-2.05b# 
@end example

@item
Then you can play with the kernel inside the virtual serial console. You
can launch @code{ls} for example. Type @key{Ctrl-a h} to have an help
about the keys you can type inside the virtual serial console. In
particular, use @key{Ctrl-a x} to exit QEMU and use @key{Ctrl-a b} as
the Magic SysRq key.

@item 
If the network is enabled, launch the script @file{/etc/linuxrc} in the
emulator (don't forget the leading dot):
@example
. /etc/linuxrc
@end example

Then enable X11 connections on your PC from the emulated Linux: 
@example
xhost +172.20.0.2
@end example

You can now launch @file{xterm} or @file{xlogo} and verify that you have
a real Virtual Linux system !

@end enumerate

NOTES:
@enumerate
@item 
A 2.5.74 kernel is also included in the archive. Just
replace the bzImage in qemu.sh to try it.

@item 
qemu-fast creates a temporary file in @var{$QEMU_TMPDIR} (@file{/tmp} is the
default) containing all the simulated PC memory. If possible, try to use
a temporary directory using the tmpfs filesystem to avoid too many
unnecessary disk accesses.

@item 
In order to exit cleanly from qemu, you can do a @emph{shutdown} inside
qemu. qemu will automatically exit when the Linux shutdown is done.

@item 
You can boot slightly faster by disabling the probe of non present IDE
interfaces. To do so, add the following options on the kernel command
line:
@example
ide1=noprobe ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe
@end example

@item 
The example disk image is a modified version of the one made by Kevin
Lawton for the plex86 Project (@url{www.plex86.org}).

@end enumerate

bellard's avatar
updated    
bellard committed
763
@node linux_compile
bellard's avatar
update    
bellard committed
764
765
@section Linux Kernel Compilation

bellard's avatar
update    
bellard committed
766
You can use any linux kernel with QEMU. However, if you want to use
bellard's avatar
bellard committed
767
768
769
770
771
@code{qemu-fast} to get maximum performances, you must use a modified
guest kernel. If you are using a 2.6 guest kernel, you can use
directly the patch @file{linux-2.6-qemu-fast.patch} made by Rusty
Russel available in the QEMU source archive. Otherwise, you can make the
following changes @emph{by hand} to the Linux kernel:
bellard's avatar
update    
bellard committed
772

bellard's avatar
update    
bellard committed
773
774
775
776
@enumerate
@item
The kernel must be mapped at 0x90000000 (the default is
0xc0000000). You must modify only two lines in the kernel source:
bellard's avatar
update    
bellard committed
777

bellard's avatar
update    
bellard committed
778
In @file{include/asm/page.h}, replace
bellard's avatar
update    
bellard committed
779
780
781
782
783
784
785
786
@example
#define __PAGE_OFFSET           (0xc0000000)
@end example
by
@example
#define __PAGE_OFFSET           (0x90000000)
@end example

bellard's avatar
update    
bellard committed
787
And in @file{arch/i386/vmlinux.lds}, replace
bellard's avatar
update    
bellard committed
788
789
790
791
792
793
794
795
@example
  . = 0xc0000000 + 0x100000;
@end example
by 
@example
  . = 0x90000000 + 0x100000;
@end example

bellard's avatar
update    
bellard committed
796
797
798
@item
If you want to enable SMP (Symmetric Multi-Processing) support, you
must make the following change in @file{include/asm/fixmap.h}. Replace
bellard's avatar
update    
bellard committed
799
@example
bellard's avatar
update    
bellard committed
800
#define FIXADDR_TOP	(0xffffX000UL)
bellard's avatar
update    
bellard committed
801
@end example
bellard's avatar
update    
bellard committed
802
803
804
805
806
807
by 
@example
#define FIXADDR_TOP	(0xa7ffX000UL)
@end example
(X is 'e' or 'f' depending on the kernel version). Although you can
use an SMP kernel with QEMU, it only supports one CPU.
bellard's avatar
update    
bellard committed
808

bellard's avatar
update    
bellard committed
809
@item
bellard's avatar
bellard committed
810
811
If you are not using a 2.6 kernel as host kernel but if you use a target
2.6 kernel, you must also ensure that the 'HZ' define is set to 100
bellard's avatar
update    
bellard committed
812
(1000 is the default) as QEMU cannot currently emulate timers at
bellard's avatar
bellard committed
813
frequencies greater than 100 Hz on host Linux systems < 2.6. In
bellard's avatar
update    
bellard committed
814
@file{include/asm/param.h}, replace:
bellard's avatar
update    
bellard committed
815
816
817
818
819
820
821
822
823

@example
# define HZ		1000		/* Internal kernel timer frequency */
@end example
by
@example
# define HZ		100		/* Internal kernel timer frequency */
@end example

bellard's avatar
update    
bellard committed
824
825
826
827
828
829
830
831
832
833
834
835
@end enumerate

The file config-2.x.x gives the configuration of the example kernels.

Just type
@example
make bzImage
@end example

As you would do to make a real kernel. Then you can use with QEMU
exactly the same kernel as you would boot on your PC (in
@file{arch/i386/boot/bzImage}).
bellard's avatar
bellard committed
836

bellard's avatar
updated    
bellard committed
837
@node gdb_usage
bellard's avatar
bellard committed
838
839
840
@section GDB usage

QEMU has a primitive support to work with gdb, so that you can do
bellard's avatar
updated    
bellard committed
841
'Ctrl-C' while the virtual machine is running and inspect its state.
bellard's avatar
bellard committed
842

bellard's avatar
update    
bellard committed
843
In order to use gdb, launch qemu with the '-s' option. It will wait for a
bellard's avatar
bellard committed
844
845
gdb connection:
@example
bellard's avatar
update    
bellard committed
846
> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
bellard's avatar
bellard committed
847
848
849
850
851
852
853
854
855
856
857
Connected to host network interface: tun0
Waiting gdb connection on port 1234
@end example

Then launch gdb on the 'vmlinux' executable:
@example
> gdb vmlinux
@end example

In gdb, connect to QEMU:
@example
bellard's avatar
update    
bellard committed
858
(gdb) target remote localhost:1234
bellard's avatar
bellard committed
859
860
861
862
863
864
865
@end example

Then you can use gdb normally. For example, type 'c' to launch the kernel:
@example
(gdb) c
@end example

bellard's avatar
updated    
bellard committed
866
867
868
869
870
871
872
873
874
875
876
877
Here are some useful tips in order to use gdb on system code:

@enumerate
@item
Use @code{info reg} to display all the CPU registers.
@item
Use @code{x/10i $eip} to display the code at the PC position.
@item
Use @code{set architecture i8086} to dump 16 bit code. Then use
@code{x/10i $cs*16+*eip} to dump the code at the PC position.
@end enumerate

bellard's avatar
update    
bellard committed
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
@chapter QEMU PREP PowerPC System emulator invocation

Use the executable @file{qemu-system-ppc} to simulate a complete PREP
PowerPC system.

QEMU emulates the following PREP peripherials:

@itemize @minus
@item 
2 IDE interfaces with hard disk and CD-ROM support
@item
Floppy disk
@item 
up to 6 NE2000 network adapters
@item
Serial port
@item
PREP Non Volatile RAM
@end itemize

You can read the qemu PC system emulation chapter to have more
informations about QEMU usage.

More information is available at
@url{http://jocelyn.mayer.free.fr/qemu-ppc/}.

bellard's avatar
bellard committed
904
@chapter QEMU User space emulator invocation
bellard's avatar
bellard committed
905

bellard's avatar
bellard committed
906
@section Quick Start
bellard's avatar
update    
bellard committed
907

bellard's avatar
bellard committed
908
909
In order to launch a Linux process, QEMU needs the process executable
itself and all the target (x86) dynamic libraries used by it. 
bellard's avatar
bellard committed
910

bellard's avatar
bellard committed
911
@itemize
bellard's avatar
bellard committed
912

bellard's avatar
bellard committed
913
914
@item On x86, you can just try to launch any process by using the native
libraries:
bellard's avatar
bellard committed
915

bellard's avatar
bellard committed
916
917
918
@example 
qemu-i386 -L / /bin/ls
@end example
bellard's avatar
bellard committed
919

bellard's avatar
bellard committed
920
921
@code{-L /} tells that the x86 dynamic linker must be searched with a
@file{/} prefix.
bellard's avatar
bellard committed
922

bellard's avatar
bellard committed
923
@item Since QEMU is also a linux process, you can launch qemu with qemu (NOTE: you can only do that if you compiled QEMU from the sources):
bellard's avatar
bellard committed
924

bellard's avatar
bellard committed
925
926
927
@example 
qemu-i386 -L / qemu-i386 -L / /bin/ls
@end example
bellard's avatar
bellard committed
928

bellard's avatar
bellard committed
929
930
931
@item On non x86 CPUs, you need first to download at least an x86 glibc
(@file{qemu-runtime-i386-XXX-.tar.gz} on the QEMU web page). Ensure that
@code{LD_LIBRARY_PATH} is not set:
bellard's avatar
update    
bellard committed
932

bellard's avatar
bellard committed
933
934
935
@example
unset LD_LIBRARY_PATH 
@end example
bellard's avatar
update    
bellard committed
936

bellard's avatar
bellard committed
937
Then you can launch the precompiled @file{ls} x86 executable:
bellard's avatar
update    
bellard committed
938

bellard's avatar
bellard committed
939
940
941
942
943
944
945
@example
qemu-i386 tests/i386/ls
@end example
You can look at @file{qemu-binfmt-conf.sh} so that
QEMU is automatically launched by the Linux kernel when you try to
launch x86 executables. It requires the @code{binfmt_misc} module in the
Linux kernel.
bellard's avatar
update    
bellard committed
946

bellard's avatar
bellard committed
947
948
949
950
@item The x86 version of QEMU is also included. You can try weird things such as:
@example
qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386
@end example
bellard's avatar
update    
bellard committed
951

bellard's avatar
bellard committed
952
@end itemize
bellard's avatar
update    
bellard committed
953

bellard's avatar
bellard committed
954
@section Wine launch
bellard's avatar
update    
bellard committed
955

bellard's avatar
bellard committed
956
@itemize
bellard's avatar
bellard committed
957

bellard's avatar
bellard committed
958
959
960
@item Ensure that you have a working QEMU with the x86 glibc
distribution (see previous section). In order to verify it, you must be
able to do:
bellard's avatar
bellard committed
961

bellard's avatar
bellard committed
962
963
964
@example
qemu-i386 /usr/local/qemu-i386/bin/ls-i386
@end example
bellard's avatar
bellard committed
965

bellard's avatar
bellard committed
966
967
@item Download the binary x86 Wine install
(@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page). 
bellard's avatar
bellard committed
968

bellard's avatar
bellard committed
969
970
971
@item Configure Wine on your account. Look at the provided script
@file{/usr/local/qemu-i386/bin/wine-conf.sh}. Your previous
@code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}.
bellard's avatar
bellard committed
972

bellard's avatar
bellard committed
973
@item Then you can try the example @file{putty.exe}:
bellard's avatar
bellard committed
974

bellard's avatar
bellard committed
975
976
977
@example
qemu-i386 /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe
@end example
bellard's avatar
bellard committed
978

bellard's avatar
bellard committed
979
@end itemize
bellard's avatar
update    
bellard committed
980

bellard's avatar
bellard committed
981
@section Command line options
bellard's avatar
update    
bellard committed
982

bellard's avatar
bellard committed
983
984
985
@example
usage: qemu-i386 [-h] [-d] [-L path] [-s size] program [arguments...]
@end example
bellard's avatar
update    
bellard committed
986

bellard's avatar
bellard committed
987
988
989
990
991
992
993
@table @option
@item -h
Print the help
@item -L path   
Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)
@item -s size
Set the x86 stack size in bytes (default=524288)
bellard's avatar
bellard committed
994
995
@end table

bellard's avatar
bellard committed
996
Debug options:
bellard's avatar
bellard committed
997

bellard's avatar
bellard committed
998
999
1000
1001
1002
1003
@table @option
@item -d
Activate log (logfile=/tmp/qemu.log)
@item -p pagesize
Act as if the host page size was 'pagesize' bytes
@end table
bellard's avatar
bellard committed
1004