qemu-doc.texi 92.5 KB
Newer Older
bellard's avatar
bellard committed
1
\input texinfo @c -*- texinfo -*-
2 3
@c %**start of header
@setfilename qemu-doc.info
4 5 6 7

@documentlanguage en
@documentencoding UTF-8

bellard's avatar
bellard committed
8
@settitle QEMU Emulator User Documentation
9 10 11
@exampleindent 0
@paragraphindent 0
@c %**end of header
bellard's avatar
bellard committed
12

13 14 15 16 17 18
@ifinfo
@direntry
* QEMU: (qemu-doc).    The QEMU Emulator User Documentation.
@end direntry
@end ifinfo

bellard's avatar
bellard committed
19
@iftex
bellard's avatar
bellard committed
20 21
@titlepage
@sp 7
bellard's avatar
bellard committed
22
@center @titlefont{QEMU Emulator}
23 24
@sp 1
@center @titlefont{User Documentation}
bellard's avatar
bellard committed
25 26
@sp 3
@end titlepage
bellard's avatar
bellard committed
27
@end iftex
bellard's avatar
bellard committed
28

29 30 31 32 33 34 35 36 37
@ifnottex
@node Top
@top

@menu
* Introduction::
* Installation::
* QEMU PC System emulator::
* QEMU System emulator for non PC targets::
38
* QEMU User space emulator::
39
* compilation:: Compilation from the sources
40
* License::
41 42 43 44 45 46 47
* Index::
@end menu
@end ifnottex

@contents

@node Introduction
bellard's avatar
bellard committed
48 49
@chapter Introduction

50 51 52 53 54
@menu
* intro_features:: Features
@end menu

@node intro_features
bellard's avatar
bellard committed
55
@section Features
bellard's avatar
bellard committed
56

bellard's avatar
bellard committed
57 58
QEMU is a FAST! processor emulator using dynamic translation to
achieve good emulation speed.
bellard's avatar
bellard committed
59 60

QEMU has two operating modes:
bellard's avatar
bellard committed
61

62
@itemize
63
@cindex operating modes
bellard's avatar
bellard committed
64

65
@item
66
@cindex system emulation
bellard's avatar
bellard committed
67
Full system emulation. In this mode, QEMU emulates a full system (for
bellard's avatar
bellard committed
68 69 70
example a PC), including one or several processors and various
peripherals. It can be used to launch different Operating Systems
without rebooting the PC or to debug system code.
bellard's avatar
bellard committed
71

72
@item
73
@cindex user mode emulation
74 75
User mode emulation. In this mode, QEMU can launch
processes compiled for one CPU on another CPU. It can be used to
bellard's avatar
bellard committed
76 77
launch the Wine Windows API emulator (@url{http://www.winehq.org}) or
to ease cross-compilation and cross-debugging.
bellard's avatar
bellard committed
78 79 80

@end itemize

81
QEMU can run without a host kernel driver and yet gives acceptable
82
performance.
bellard's avatar
bellard committed
83

bellard's avatar
bellard committed
84 85
For system emulation, the following hardware targets are supported:
@itemize
86 87
@cindex emulated target systems
@cindex supported target systems
bellard's avatar
bellard committed
88
@item PC (x86 or x86_64 processor)
bellard's avatar
bellard committed
89
@item ISA PC (old style PC without PCI bus)
bellard's avatar
bellard committed
90
@item PREP (PowerPC processor)
91
@item G3 Beige PowerMac (PowerPC processor)
bellard's avatar
bellard committed
92
@item Mac99 PowerMac (PowerPC processor, in progress)
93
@item Sun4m/Sun4c/Sun4d (32-bit Sparc processor)
94
@item Sun4u/Sun4v (64-bit Sparc processor, in progress)
95
@item Malta board (32-bit and 64-bit MIPS processors)
96
@item MIPS Magnum (64-bit MIPS processor)
pbrook's avatar
pbrook committed
97 98
@item ARM Integrator/CP (ARM)
@item ARM Versatile baseboard (ARM)
Paul Brook's avatar
Paul Brook committed
99
@item ARM RealView Emulation/Platform baseboard (ARM)
100
@item Spitz, Akita, Borzoi, Terrier and Tosa PDAs (PXA270 processor)
pbrook's avatar
pbrook committed
101 102
@item Luminary Micro LM3S811EVB (ARM Cortex-M3)
@item Luminary Micro LM3S6965EVB (ARM Cortex-M3)
103
@item Freescale MCF5208EVB (ColdFire V2).
104
@item Arnewsh MCF5206 evaluation board (ColdFire V2).
105
@item Palm Tungsten|E PDA (OMAP310 processor)
106
@item N800 and N810 tablets (OMAP2420 processor)
107
@item MusicPal (MV88W8618 ARM processor)
108 109
@item Gumstix "Connex" and "Verdex" motherboards (PXA255/270).
@item Siemens SX1 smartphone (OMAP310 processor)
110 111
@item AXIS-Devboard88 (CRISv32 ETRAX-FS).
@item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
112
@item Avnet LX60/LX110/LX200 boards (Xtensa)
bellard's avatar
bellard committed
113
@end itemize
bellard's avatar
bellard committed
114

115 116 117 118
@cindex supported user mode targets
For user emulation, x86 (32 and 64 bit), PowerPC (32 and 64 bit),
ARM, MIPS (32 bit only), Sparc (32 and 64 bit),
Alpha, ColdFire(m68k), CRISv32 and MicroBlaze CPUs are supported.
bellard's avatar
bellard committed
119

120
@node Installation
bellard's avatar
bellard committed
121 122
@chapter Installation

bellard's avatar
bellard committed
123 124
If you want to compile QEMU yourself, see @ref{compilation}.

125 126 127 128 129 130 131
@menu
* install_linux::   Linux
* install_windows:: Windows
* install_mac::     Macintosh
@end menu

@node install_linux
bellard's avatar
bellard committed
132
@section Linux
133
@cindex installation (Linux)
bellard's avatar
bellard committed
134

bellard's avatar
bellard committed
135 136
If a precompiled package is available for your distribution - you just
have to install it. Otherwise, see @ref{compilation}.
bellard's avatar
bellard committed
137

138
@node install_windows
bellard's avatar
bellard committed
139
@section Windows
140
@cindex installation (Windows)
bellard's avatar
bellard committed
141

bellard's avatar
bellard committed
142
Download the experimental binary installer at
143
@url{http://www.free.oszoo.org/@/download.html}.
144
TODO (no longer available)
145

146
@node install_mac
bellard's avatar
bellard committed
147
@section Mac OS X
148

bellard's avatar
bellard committed
149
Download the experimental binary installer at
150
@url{http://www.free.oszoo.org/@/download.html}.
151
TODO (no longer available)
bellard's avatar
bellard committed
152

153
@node QEMU PC System emulator
bellard's avatar
bellard committed
154
@chapter QEMU PC System emulator
155
@cindex system emulation (PC)
bellard's avatar
bellard committed
156

157 158 159 160 161 162 163 164
@menu
* pcsys_introduction:: Introduction
* pcsys_quickstart::   Quick Start
* sec_invocation::     Invocation
* pcsys_keys::         Keys
* pcsys_monitor::      QEMU Monitor
* disk_images::        Disk Images
* pcsys_network::      Network emulation
165
* pcsys_other_devs::   Other Devices
166 167
* direct_linux_boot::  Direct Linux Boot
* pcsys_usb::          USB emulation
168
* vnc_security::       VNC security
169 170 171 172 173
* gdb_usage::          GDB usage
* pcsys_os_specific::  Target OS specific information
@end menu

@node pcsys_introduction
bellard's avatar
bellard committed
174 175 176 177
@section Introduction

@c man begin DESCRIPTION

bellard's avatar
bellard committed
178 179
The QEMU PC System emulator simulates the
following peripherals:
bellard's avatar
bellard committed
180 181

@itemize @minus
182
@item
bellard's avatar
bellard committed
183
i440FX host PCI bridge and PIIX3 PCI to ISA bridge
bellard's avatar
bellard committed
184
@item
bellard's avatar
bellard committed
185 186
Cirrus CLGD 5446 PCI VGA card or dummy VGA card with Bochs VESA
extensions (hardware level, including all non standard modes).
bellard's avatar
bellard committed
187 188
@item
PS/2 mouse and keyboard
189
@item
bellard's avatar
bellard committed
190
2 PCI IDE interfaces with hard disk and CD-ROM support
bellard's avatar
bellard committed
191 192
@item
Floppy disk
193
@item
194
PCI and ISA network adapters
bellard's avatar
bellard committed
195
@item
bellard's avatar
bellard committed
196 197
Serial ports
@item
bellard's avatar
bellard committed
198 199 200 201
Creative SoundBlaster 16 sound card
@item
ENSONIQ AudioPCI ES1370 sound card
@item
balrog's avatar
balrog committed
202 203
Intel 82801AA AC97 Audio compatible sound card
@item
204 205
Intel HD Audio Controller and HDA codec
@item
206
Adlib (OPL2) - Yamaha YM3812 compatible chip
bellard's avatar
bellard committed
207
@item
208 209
Gravis Ultrasound GF1 sound card
@item
malc's avatar
malc committed
210 211
CS4231A compatible sound card
@item
bellard's avatar
bellard committed
212
PCI UHCI USB controller and a virtual USB hub.
bellard's avatar
bellard committed
213 214
@end itemize

bellard's avatar
bellard committed
215 216
SMP is supported with up to 255 CPUs.

217
QEMU uses the PC BIOS from the Seabios project and the Plex86/Bochs LGPL
bellard's avatar
bellard committed
218 219
VGA BIOS.

bellard's avatar
bellard committed
220 221
QEMU uses YM3812 emulation by Tatsuyuki Satoh.

222
QEMU uses GUS emulation (GUSEMU32 @url{http://www.deinmeister.de/gusemu/})
223
by Tibor "TS" Schütz.
224

225
Note that, by default, GUS shares IRQ(7) with parallel ports and so
226
QEMU must be told to not have parallel ports to have working GUS.
227 228

@example
229
qemu-system-i386 dos.img -soundhw gus -parallel none
230 231 232 233
@end example

Alternatively:
@example
234
qemu-system-i386 dos.img -device gus,irq=5
235 236 237 238
@end example

Or some other unclaimed IRQ.

malc's avatar
malc committed
239 240
CS4231A is the chip used in Windows Sound System and GUSMAX products

bellard's avatar
bellard committed
241 242
@c man end

243
@node pcsys_quickstart
bellard's avatar
bellard committed
244
@section Quick Start
245
@cindex quick start
bellard's avatar
bellard committed
246

bellard's avatar
bellard committed
247
Download and uncompress the linux image (@file{linux.img}) and type:
bellard's avatar
bellard committed
248 249

@example
250
qemu-system-i386 linux.img
bellard's avatar
bellard committed
251 252 253 254
@end example

Linux should boot and give you a prompt.

bellard's avatar
bellard committed
255
@node sec_invocation
bellard's avatar
bellard committed
256 257 258
@section Invocation

@example
bellard's avatar
bellard committed
259
@c man begin SYNOPSIS
260
usage: qemu-system-i386 [options] [@var{disk_image}]
bellard's avatar
bellard committed
261
@c man end
bellard's avatar
bellard committed
262 263
@end example

bellard's avatar
bellard committed
264
@c man begin OPTIONS
blueswir1's avatar
blueswir1 committed
265 266
@var{disk_image} is a raw hard disk image for IDE hard disk 0. Some
targets do not need a disk image.
bellard's avatar
bellard committed
267

268
@include qemu-options.texi
bellard's avatar
bellard committed
269

bellard's avatar
bellard committed
270 271
@c man end

272
@node pcsys_keys
bellard's avatar
bellard committed
273 274 275 276
@section Keys

@c man begin OPTIONS

277 278 279 280 281
During the graphical emulation, you can use special key combinations to change
modes. The default key mappings are shown below, but if you use @code{-alt-grab}
then the modifier is Ctrl-Alt-Shift (instead of Ctrl-Alt) and if you use
@code{-ctrl-grab} then the modifier is the right Ctrl key (instead of Ctrl-Alt):

bellard's avatar
bellard committed
282
@table @key
bellard's avatar
bellard committed
283
@item Ctrl-Alt-f
284
@kindex Ctrl-Alt-f
bellard's avatar
bellard committed
285
Toggle full screen
bellard's avatar
bellard committed
286

Jan Kiszka's avatar
Jan Kiszka committed
287 288 289 290 291 292 293 294
@item Ctrl-Alt-+
@kindex Ctrl-Alt-+
Enlarge the screen

@item Ctrl-Alt--
@kindex Ctrl-Alt--
Shrink the screen

295
@item Ctrl-Alt-u
296
@kindex Ctrl-Alt-u
297 298
Restore the screen's un-scaled dimensions

bellard's avatar
bellard committed
299
@item Ctrl-Alt-n
300
@kindex Ctrl-Alt-n
bellard's avatar
bellard committed
301 302 303 304 305 306 307 308
Switch to virtual console 'n'. Standard console mappings are:
@table @emph
@item 1
Target system display
@item 2
Monitor
@item 3
Serial port
bellard's avatar
bellard committed
309 310
@end table

bellard's avatar
bellard committed
311
@item Ctrl-Alt
312
@kindex Ctrl-Alt
bellard's avatar
bellard committed
313 314 315
Toggle mouse and keyboard grab.
@end table

316 317 318 319
@kindex Ctrl-Up
@kindex Ctrl-Down
@kindex Ctrl-PageUp
@kindex Ctrl-PageDown
bellard's avatar
bellard committed
320 321 322
In the virtual consoles, you can use @key{Ctrl-Up}, @key{Ctrl-Down},
@key{Ctrl-PageUp} and @key{Ctrl-PageDown} to move in the back log.

323
@kindex Ctrl-a h
bellard's avatar
bellard committed
324 325
During emulation, if you are using the @option{-nographic} option, use
@key{Ctrl-a h} to get terminal commands:
bellard's avatar
bellard committed
326 327

@table @key
bellard's avatar
bellard committed
328
@item Ctrl-a h
329
@kindex Ctrl-a h
blueswir1's avatar
blueswir1 committed
330
@item Ctrl-a ?
331
@kindex Ctrl-a ?
bellard's avatar
bellard committed
332
Print this help
333
@item Ctrl-a x
334
@kindex Ctrl-a x
ths's avatar
ths committed
335
Exit emulator
336
@item Ctrl-a s
337
@kindex Ctrl-a s
bellard's avatar
bellard committed
338
Save disk data back to file (if -snapshot)
339
@item Ctrl-a t
340
@kindex Ctrl-a t
blueswir1's avatar
blueswir1 committed
341
Toggle console timestamps
bellard's avatar
bellard committed
342
@item Ctrl-a b
343
@kindex Ctrl-a b
bellard's avatar
bellard committed
344
Send break (magic sysrq in Linux)
bellard's avatar
bellard committed
345
@item Ctrl-a c
346
@kindex Ctrl-a c
bellard's avatar
bellard committed
347
Switch between console and monitor
bellard's avatar
bellard committed
348
@item Ctrl-a Ctrl-a
349
@kindex Ctrl-a a
bellard's avatar
bellard committed
350
Send Ctrl-a
bellard's avatar
bellard committed
351
@end table
bellard's avatar
bellard committed
352 353 354 355
@c man end

@ignore

bellard's avatar
bellard committed
356 357 358 359 360 361 362 363 364 365 366
@c man begin SEEALSO
The HTML documentation of QEMU for more precise information and Linux
user mode emulator invocation.
@c man end

@c man begin AUTHOR
Fabrice Bellard
@c man end

@end ignore

367
@node pcsys_monitor
bellard's avatar
bellard committed
368
@section QEMU Monitor
369
@cindex QEMU monitor
bellard's avatar
bellard committed
370 371 372 373 374 375 376

The QEMU monitor is used to give complex commands to the QEMU
emulator. You can use it to:

@itemize @minus

@item
ths's avatar
ths committed
377
Remove or insert removable media images
378
(such as CD-ROM or floppies).
bellard's avatar
bellard committed
379

380
@item
bellard's avatar
bellard committed
381 382 383 384 385 386 387 388 389 390 391
Freeze/unfreeze the Virtual Machine (VM) and save or restore its state
from a disk file.

@item Inspect the VM state without an external debugger.

@end itemize

@subsection Commands

The following commands are available:

392
@include qemu-monitor.texi
bellard's avatar
bellard committed
393

bellard's avatar
bellard committed
394 395 396 397 398
@subsection Integer expressions

The monitor understands integers expressions for every integer
argument. You can use register names to get the value of specifics
CPU registers by prefixing them with @emph{$}.
bellard's avatar
bellard committed
399

bellard's avatar
bellard committed
400 401 402
@node disk_images
@section Disk Images

403 404
Since version 0.6.1, QEMU supports many disk image formats, including
growable disk images (their size increase as non empty sectors are
bellard's avatar
bellard committed
405 406 407
written), compressed and encrypted disk images. Version 0.8.3 added
the new qcow2 disk image format which is essential to support VM
snapshots.
bellard's avatar
bellard committed
408

409 410 411
@menu
* disk_images_quickstart::    Quick start for disk image creation
* disk_images_snapshot_mode:: Snapshot mode
bellard's avatar
bellard committed
412
* vm_snapshots::              VM snapshots
413
* qemu_img_invocation::       qemu-img Invocation
414
* qemu_nbd_invocation::       qemu-nbd Invocation
415
* disk_images_formats::       Disk image file formats
bellard's avatar
bellard committed
416
* host_drives::               Using host drives
417
* disk_images_fat_images::    Virtual FAT disk images
418
* disk_images_nbd::           NBD access
419
* disk_images_sheepdog::      Sheepdog disk images
420
* disk_images_iscsi::         iSCSI LUNs
421
* disk_images_gluster::       GlusterFS disk images
422
* disk_images_ssh::           Secure Shell (ssh) disk images
423 424 425
@end menu

@node disk_images_quickstart
426 427 428
@subsection Quick start for disk image creation

You can create a disk image with the command:
bellard's avatar
bellard committed
429
@example
430
qemu-img create myimage.img mysize
bellard's avatar
bellard committed
431
@end example
432 433 434 435
where @var{myimage.img} is the disk image filename and @var{mysize} is its
size in kilobytes. You can add an @code{M} suffix to give the size in
megabytes and a @code{G} suffix for gigabytes.

436
See @ref{qemu_img_invocation} for more information.
bellard's avatar
bellard committed
437

438
@node disk_images_snapshot_mode
bellard's avatar
bellard committed
439 440 441 442 443
@subsection Snapshot mode

If you use the option @option{-snapshot}, all disk images are
considered as read only. When sectors in written, they are written in
a temporary file created in @file{/tmp}. You can however force the
444 445
write back to the raw disk images by using the @code{commit} monitor
command (or @key{C-a s} in the serial console).
bellard's avatar
bellard committed
446

bellard's avatar
bellard committed
447 448 449 450 451 452 453 454 455 456 457
@node vm_snapshots
@subsection VM snapshots

VM snapshots are snapshots of the complete virtual machine including
CPU state, RAM, device state and the content of all the writable
disks. In order to use VM snapshots, you must have at least one non
removable and writable block device using the @code{qcow2} disk image
format. Normally this device is the first virtual hard drive.

Use the monitor command @code{savevm} to create a new VM snapshot or
replace an existing one. A human readable name can be assigned to each
bellard's avatar
bellard committed
458
snapshot in addition to its numerical ID.
bellard's avatar
bellard committed
459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480

Use @code{loadvm} to restore a VM snapshot and @code{delvm} to remove
a VM snapshot. @code{info snapshots} lists the available snapshots
with their associated information:

@example
(qemu) info snapshots
Snapshot devices: hda
Snapshot list (from hda):
ID        TAG                 VM SIZE                DATE       VM CLOCK
1         start                   41M 2006-08-06 12:38:02   00:00:14.954
2                                 40M 2006-08-06 12:43:29   00:00:18.633
3         msys                    40M 2006-08-06 12:44:04   00:00:23.514
@end example

A VM snapshot is made of a VM state info (its size is shown in
@code{info snapshots}) and a snapshot of every writable disk image.
The VM state info is stored in the first @code{qcow2} non removable
and writable block device. The disk image snapshots are stored in
every disk image. The size of a snapshot in a disk image is difficult
to evaluate and is not shown by @code{info snapshots} because the
associated disk sectors are shared among all the snapshots to save
bellard's avatar
bellard committed
481 482
disk space (otherwise each snapshot would need a full copy of all the
disk images).
bellard's avatar
bellard committed
483 484 485 486 487 488 489

When using the (unrelated) @code{-snapshot} option
(@ref{disk_images_snapshot_mode}), you can always make VM snapshots,
but they are deleted as soon as you exit QEMU.

VM snapshots currently have the following known limitations:
@itemize
490
@item
bellard's avatar
bellard committed
491 492
They cannot cope with removable devices if they are removed or
inserted after a snapshot is done.
493
@item
bellard's avatar
bellard committed
494 495 496 497
A few device drivers still have incomplete snapshot support so their
state is not saved or restored properly (in particular USB).
@end itemize

498 499
@node qemu_img_invocation
@subsection @code{qemu-img} Invocation
bellard's avatar
bellard committed
500

501
@include qemu-img.texi
bellard's avatar
bellard committed
502

503 504 505 506 507
@node qemu_nbd_invocation
@subsection @code{qemu-nbd} Invocation

@include qemu-nbd.texi

508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529
@node disk_images_formats
@subsection Disk image file formats

QEMU supports many image file formats that can be used with VMs as well as with
any of the tools (like @code{qemu-img}). This includes the preferred formats
raw and qcow2 as well as formats that are supported for compatibility with
older QEMU versions or other hypervisors.

Depending on the image format, different options can be passed to
@code{qemu-img create} and @code{qemu-img convert} using the @code{-o} option.
This section describes each format and the options that are supported for it.

@table @option
@item raw

Raw disk image format. This format has the advantage of
being simple and easily exportable to all other emulators. If your
file system supports @emph{holes} (for example in ext2 or ext3 on
Linux or NTFS on Windows), then only the written sectors will reserve
space. Use @code{qemu-img info} to know the real size used by the
image or @code{ls -ls} on Unix/Linux.

530 531 532 533 534 535 536 537 538
Supported options:
@table @code
@item preallocation
Preallocation mode (allowed values: @code{off}, @code{falloc}, @code{full}).
@code{falloc} mode preallocates space for image by calling posix_fallocate().
@code{full} mode preallocates space for image by writing zeros to underlying
storage.
@end table

539 540 541 542 543 544 545 546 547
@item qcow2
QEMU image format, the most versatile format. Use it to have smaller
images (useful if your filesystem does not supports holes, for example
on Windows), optional AES encryption, zlib based compression and
support of multiple VM snapshots.

Supported options:
@table @code
@item compat
548 549
Determines the qcow2 version to use. @code{compat=0.10} uses the
traditional image format that can be read by any QEMU since 0.10.
550
@code{compat=1.1} enables image format extensions that only QEMU 1.1 and
551 552
newer understand (this is the default). Amongst others, this includes
zero clusters, which allow efficient copy-on-read for sparse images.
553 554 555 556 557 558

@item backing_file
File name of a base image (see @option{create} subcommand)
@item backing_fmt
Image format of the base image
@item encryption
559
If this option is set to @code{on}, the image is encrypted with 128-bit AES-CBC.
560

561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579
The use of encryption in qcow and qcow2 images is considered to be flawed by
modern cryptography standards, suffering from a number of design problems:

@itemize @minus
@item The AES-CBC cipher is used with predictable initialization vectors based
on the sector number. This makes it vulnerable to chosen plaintext attacks
which can reveal the existence of encrypted data.
@item The user passphrase is directly used as the encryption key. A poorly
chosen or short passphrase will compromise the security of the encryption.
@item In the event of the passphrase being compromised there is no way to
change the passphrase to protect data in any qcow images. The files must
be cloned, using a different encryption passphrase in the new file. The
original file must then be securely erased using a program like shred,
though even this is ineffective with many modern storage technologies.
@end itemize

Use of qcow / qcow2 encryption is thus strongly discouraged. Users are
recommended to use an alternative encryption technology such as the
Linux dm-crypt / LUKS system.
580 581 582 583 584 585 586

@item cluster_size
Changes the qcow2 cluster size (must be between 512 and 2M). Smaller cluster
sizes can improve the image file size whereas larger cluster sizes generally
provide better performance.

@item preallocation
587 588 589 590 591
Preallocation mode (allowed values: @code{off}, @code{metadata}, @code{falloc},
@code{full}). An image with preallocated metadata is initially larger but can
improve performance when the image needs to grow. @code{falloc} and @code{full}
preallocations are like the same options of @code{raw} format, but sets up
metadata also.
592 593 594 595 596 597 598 599 600 601 602

@item lazy_refcounts
If this option is set to @code{on}, reference count updates are postponed with
the goal of avoiding metadata I/O and improving performance. This is
particularly interesting with @option{cache=writethrough} which doesn't batch
metadata updates. The tradeoff is that after a host crash, the reference count
tables must be rebuilt, i.e. on the next open an (automatic) @code{qemu-img
check -r all} is required, which may take some time.

This option can only be enabled if @code{compat=1.1} is specified.

603
@item nocow
Chunyan Liu's avatar
Chunyan Liu committed
604
If this option is set to @code{on}, it will turn off COW of the file. It's only
605 606 607 608 609 610 611 612 613 614 615 616
valid on btrfs, no effect on other file systems.

Btrfs has low performance when hosting a VM image file, even more when the guest
on the VM also using btrfs as file system. Turning off COW is a way to mitigate
this bad performance. Generally there are two ways to turn off COW on btrfs:
a) Disable it by mounting with nodatacow, then all newly created files will be
NOCOW. b) For an empty file, add the NOCOW file attribute. That's what this option
does.

Note: this option is only valid to new or empty files. If there is an existing
file which is COW and has data blocks already, it couldn't be changed to NOCOW
by setting @code{nocow=on}. One can issue @code{lsattr filename} to check if
Chunyan Liu's avatar
Chunyan Liu committed
617
the NOCOW flag is set or not (Capital 'C' is NOCOW flag).
618

619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691
@end table

@item qed
Old QEMU image format with support for backing files and compact image files
(when your filesystem or transport medium does not support holes).

When converting QED images to qcow2, you might want to consider using the
@code{lazy_refcounts=on} option to get a more QED-like behaviour.

Supported options:
@table @code
@item backing_file
File name of a base image (see @option{create} subcommand).
@item backing_fmt
Image file format of backing file (optional).  Useful if the format cannot be
autodetected because it has no header, like some vhd/vpc files.
@item cluster_size
Changes the cluster size (must be power-of-2 between 4K and 64K). Smaller
cluster sizes can improve the image file size whereas larger cluster sizes
generally provide better performance.
@item table_size
Changes the number of clusters per L1/L2 table (must be power-of-2 between 1
and 16).  There is normally no need to change this value but this option can be
used for performance benchmarking.
@end table

@item qcow
Old QEMU image format with support for backing files, compact image files,
encryption and compression.

Supported options:
@table @code
@item backing_file
File name of a base image (see @option{create} subcommand)
@item encryption
If this option is set to @code{on}, the image is encrypted.
@end table

@item vdi
VirtualBox 1.1 compatible image format.
Supported options:
@table @code
@item static
If this option is set to @code{on}, the image is created with metadata
preallocation.
@end table

@item vmdk
VMware 3 and 4 compatible image format.

Supported options:
@table @code
@item backing_file
File name of a base image (see @option{create} subcommand).
@item compat6
Create a VMDK version 6 image (instead of version 4)
@item subformat
Specifies which VMDK subformat to use. Valid options are
@code{monolithicSparse} (default),
@code{monolithicFlat},
@code{twoGbMaxExtentSparse},
@code{twoGbMaxExtentFlat} and
@code{streamOptimized}.
@end table

@item vpc
VirtualPC compatible image format (VHD).
Supported options:
@table @code
@item subformat
Specifies which VHD subformat to use. Valid options are
@code{dynamic} (default) and @code{fixed}.
@end table
692 693 694 695 696 697 698 699 700 701 702 703 704 705 706

@item VHDX
Hyper-V compatible image format (VHDX).
Supported options:
@table @code
@item subformat
Specifies which VHDX subformat to use. Valid options are
@code{dynamic} (default) and @code{fixed}.
@item block_state_zero
Force use of payload blocks of type 'ZERO'.
@item block_size
Block size; min 1 MB, max 256 MB.  0 means auto-calculate based on image size.
@item log_size
Log size; min 1 MB.
@end table
707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723
@end table

@subsubsection Read-only formats
More disk image file formats are supported in a read-only mode.
@table @option
@item bochs
Bochs images of @code{growing} type.
@item cloop
Linux Compressed Loop image, useful only to reuse directly compressed
CD-ROM images present for example in the Knoppix CD-ROMs.
@item dmg
Apple disk image.
@item parallels
Parallels disk image format.
@end table


bellard's avatar
bellard committed
724 725 726 727 728 729 730 731 732
@node host_drives
@subsection Using host drives

In addition to disk image files, QEMU can directly access host
devices. We describe here the usage for QEMU version >= 0.8.3.

@subsubsection Linux

On Linux, you can directly use the host device filename instead of a
733
disk image filename provided you have enough privileges to access
bellard's avatar
bellard committed
734 735 736
it. For example, use @file{/dev/cdrom} to access to the CDROM or
@file{/dev/fd0} for the floppy.

bellard's avatar
bellard committed
737
@table @code
bellard's avatar
bellard committed
738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757
@item CD
You can specify a CDROM device even if no CDROM is loaded. QEMU has
specific code to detect CDROM insertion or removal. CDROM ejection by
the guest OS is supported. Currently only data CDs are supported.
@item Floppy
You can specify a floppy device even if no floppy is loaded. Floppy
removal is currently not detected accurately (if you change floppy
without doing floppy access while the floppy is not loaded, the guest
OS will think that the same floppy is loaded).
@item Hard disks
Hard disks can be used. Normally you must specify the whole disk
(@file{/dev/hdb} instead of @file{/dev/hdb1}) so that the guest OS can
see it as a partitioned disk. WARNING: unless you know what you do, it
is better to only make READ-ONLY accesses to the hard disk otherwise
you may corrupt your host data (use the @option{-snapshot} command
line option or modify the device permissions accordingly).
@end table

@subsubsection Windows

758 759
@table @code
@item CD
760
The preferred syntax is the drive letter (e.g. @file{d:}). The
761 762
alternate syntax @file{\\.\d:} is supported. @file{/dev/cdrom} is
supported as an alias to the first CDROM drive.
bellard's avatar
bellard committed
763

ths's avatar
ths committed
764
Currently there is no specific code to handle removable media, so it
bellard's avatar
bellard committed
765 766
is better to use the @code{change} or @code{eject} monitor commands to
change or eject media.
767
@item Hard disks
768
Hard disks can be used with the syntax: @file{\\.\PhysicalDrive@var{N}}
769 770 771 772 773 774 775 776
where @var{N} is the drive number (0 is the first hard disk).

WARNING: unless you know what you do, it is better to only make
READ-ONLY accesses to the hard disk otherwise you may corrupt your
host data (use the @option{-snapshot} command line so that the
modifications are written in a temporary file).
@end table

bellard's avatar
bellard committed
777 778 779

@subsubsection Mac OS X

780
@file{/dev/cdrom} is an alias to the first CDROM.
bellard's avatar
bellard committed
781

ths's avatar
ths committed
782
Currently there is no specific code to handle removable media, so it
bellard's avatar
bellard committed
783 784 785
is better to use the @code{change} or @code{eject} monitor commands to
change or eject media.

786
@node disk_images_fat_images
bellard's avatar
bellard committed
787 788 789 790 791
@subsection Virtual FAT disk images

QEMU can automatically create a virtual FAT disk image from a
directory tree. In order to use it, just type:

792
@example
793
qemu-system-i386 linux.img -hdb fat:/my_directory
bellard's avatar
bellard committed
794 795 796 797 798 799 800 801
@end example

Then you access access to all the files in the @file{/my_directory}
directory without having to copy them in a disk image or to export
them via SAMBA or NFS. The default access is @emph{read-only}.

Floppies can be emulated with the @code{:floppy:} option:

802
@example
803
qemu-system-i386 linux.img -fda fat:floppy:/my_directory
bellard's avatar
bellard committed
804 805 806 807 808
@end example

A read/write support is available for testing (beta stage) with the
@code{:rw:} option:

809
@example
810
qemu-system-i386 linux.img -fda fat:floppy:rw:/my_directory
bellard's avatar
bellard committed
811 812 813 814 815 816
@end example

What you should @emph{never} do:
@itemize
@item use non-ASCII filenames ;
@item use "-snapshot" together with ":rw:" ;
bellard's avatar
bellard committed
817 818
@item expect it to work when loadvm'ing ;
@item write to the FAT directory on the host system while accessing it with the guest system.
bellard's avatar
bellard committed
819 820
@end itemize

821 822 823 824 825 826 827
@node disk_images_nbd
@subsection NBD access

QEMU can access directly to block device exported using the Network Block Device
protocol.

@example
Paolo Bonzini's avatar
Paolo Bonzini committed
828
qemu-system-i386 linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
829 830 831 832 833 834
@end example

If the NBD server is located on the same host, you can use an unix socket instead
of an inet socket:

@example
Paolo Bonzini's avatar
Paolo Bonzini committed
835
qemu-system-i386 linux.img -hdb nbd+unix://?socket=/tmp/my_socket
836 837 838 839 840 841 842 843
@end example

In this case, the block device must be exported using qemu-nbd:

@example
qemu-nbd --socket=/tmp/my_socket my_disk.qcow2
@end example

844
The use of qemu-nbd allows sharing of a disk between several guests:
845 846 847 848
@example
qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
@end example

Paolo Bonzini's avatar
Paolo Bonzini committed
849
@noindent
850 851
and then you can use it with two guests:
@example
Paolo Bonzini's avatar
Paolo Bonzini committed
852 853
qemu-system-i386 linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
qemu-system-i386 linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
854 855
@end example

Paolo Bonzini's avatar
Paolo Bonzini committed
856 857
If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
own embedded NBD server), you must specify an export name in the URI:
858
@example
Paolo Bonzini's avatar
Paolo Bonzini committed
859 860 861 862 863 864 865 866 867 868
qemu-system-i386 -cdrom nbd://localhost/debian-500-ppc-netinst
qemu-system-i386 -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
@end example

The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
also available.  Here are some example of the older syntax:
@example
qemu-system-i386 linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
qemu-system-i386 linux2.img -hdb nbd:unix:/tmp/my_socket
qemu-system-i386 -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
869 870
@end example

871 872 873 874 875 876 877 878 879
@node disk_images_sheepdog
@subsection Sheepdog disk images

Sheepdog is a distributed storage system for QEMU.  It provides highly
available block level storage volumes that can be attached to
QEMU-based virtual machines.

You can create a Sheepdog disk image with the command:
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
880
qemu-img create sheepdog:///@var{image} @var{size}
881 882 883 884 885 886 887
@end example
where @var{image} is the Sheepdog image name and @var{size} is its
size.

To import the existing @var{filename} to Sheepdog, you can use a
convert command.
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
888
qemu-img convert @var{filename} sheepdog:///@var{image}
889 890 891 892
@end example

You can boot from the Sheepdog disk image with the command:
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
893
qemu-system-i386 sheepdog:///@var{image}
894 895 896 897
@end example

You can also create a snapshot of the Sheepdog image like qcow2.
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
898
qemu-img snapshot -c @var{tag} sheepdog:///@var{image}
899 900 901 902 903 904
@end example
where @var{tag} is a tag name of the newly created snapshot.

To boot from the Sheepdog snapshot, specify the tag name of the
snapshot.
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
905
qemu-system-i386 sheepdog:///@var{image}#@var{tag}
906 907 908 909
@end example

You can create a cloned image from the existing snapshot.
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
910
qemu-img create -b sheepdog:///@var{base}#@var{tag} sheepdog:///@var{image}
911 912 913 914
@end example
where @var{base} is a image name of the source snapshot and @var{tag}
is its tag name.

915 916 917 918 919 920
You can use an unix socket instead of an inet socket:

@example
qemu-system-i386 sheepdog+unix:///@var{image}?socket=@var{path}
@end example

921 922 923
If the Sheepdog daemon doesn't run on the local host, you need to
specify one of the Sheepdog servers to connect to.
@example
MORITA Kazutaka's avatar
MORITA Kazutaka committed
924 925
qemu-img create sheepdog://@var{hostname}:@var{port}/@var{image} @var{size}
qemu-system-i386 sheepdog://@var{hostname}:@var{port}/@var{image}
926 927
@end example

928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962
@node disk_images_iscsi
@subsection iSCSI LUNs

iSCSI is a popular protocol used to access SCSI devices across a computer
network.

There are two different ways iSCSI devices can be used by QEMU.

The first method is to mount the iSCSI LUN on the host, and make it appear as
any other ordinary SCSI device on the host and then to access this device as a
/dev/sd device from QEMU. How to do this differs between host OSes.

The second method involves using the iSCSI initiator that is built into
QEMU. This provides a mechanism that works the same way regardless of which
host OS you are running QEMU on. This section will describe this second method
of using iSCSI together with QEMU.

In QEMU, iSCSI devices are described using special iSCSI URLs

@example
URL syntax:
iscsi://[<username>[%<password>]@@]<host>[:<port>]/<target-iqn-name>/<lun>
@end example

Username and password are optional and only used if your target is set up
using CHAP authentication for access control.
Alternatively the username and password can also be set via environment
variables to have these not show up in the process list

@example
export LIBISCSI_CHAP_USERNAME=<username>
export LIBISCSI_CHAP_PASSWORD=<password>
iscsi://<host>/<target-iqn-name>/<lun>
@end example

963 964 965 966
Various session related parameters can be set via special options, either
in a configuration file provided via '-readconfig' or directly on the
command line.

967 968 969 970 971
If the initiator-name is not specified qemu will use a default name
of 'iqn.2008-11.org.linux-kvm[:<name>'] where <name> is the name of the
virtual machine.


972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018
@example
Setting a specific initiator name to use when logging in to the target
-iscsi initiator-name=iqn.qemu.test:my-initiator
@end example

@example
Controlling which type of header digest to negotiate with the target
-iscsi header-digest=CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
@end example

These can also be set via a configuration file
@example
[iscsi]
  user = "CHAP username"
  password = "CHAP password"
  initiator-name = "iqn.qemu.test:my-initiator"
  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
  header-digest = "CRC32C"
@end example


Setting the target name allows different options for different targets
@example
[iscsi "iqn.target.name"]
  user = "CHAP username"
  password = "CHAP password"
  initiator-name = "iqn.qemu.test:my-initiator"
  # header digest is one of CRC32C|CRC32C-NONE|NONE-CRC32C|NONE
  header-digest = "CRC32C"
@end example


Howto use a configuration file to set iSCSI configuration options:
@example
cat >iscsi.conf <<EOF
[iscsi]
  user = "me"
  password = "my password"
  initiator-name = "iqn.qemu.test:my-initiator"
  header-digest = "CRC32C"
EOF

qemu-system-i386 -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
    -readconfig iscsi.conf
@end example


1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
Howto set up a simple iSCSI target on loopback and accessing it via QEMU:
@example
This example shows how to set up an iSCSI target with one CDROM and one DISK
using the Linux STGT software target. This target is available on Red Hat based
systems as the package 'scsi-target-utils'.

tgtd --iscsi portal=127.0.0.1:3260
tgtadm --lld iscsi --op new --mode target --tid 1 -T iqn.qemu.test
tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 1 \
    -b /IMAGES/disk.img --device-type=disk
tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \
    -b /IMAGES/cd.iso --device-type=cd
tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL

1033 1034
qemu-system-i386 -iscsi initiator-name=iqn.qemu.test:my-initiator \
    -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
1035 1036 1037
    -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
@end example

1038 1039
@node disk_images_gluster
@subsection GlusterFS disk images
1040

1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086
GlusterFS is an user space distributed file system.

You can boot from the GlusterFS disk image with the command:
@example
qemu-system-x86_64 -drive file=gluster[+@var{transport}]://[@var{server}[:@var{port}]]/@var{volname}/@var{image}[?socket=...]
@end example

@var{gluster} is the protocol.

@var{transport} specifies the transport type used to connect to gluster
management daemon (glusterd). Valid transport types are
tcp, unix and rdma. If a transport type isn't specified, then tcp
type is assumed.

@var{server} specifies the server where the volume file specification for
the given volume resides. This can be either hostname, ipv4 address
or ipv6 address. ipv6 address needs to be within square brackets [ ].
If transport type is unix, then @var{server} field should not be specifed.
Instead @var{socket} field needs to be populated with the path to unix domain
socket.

@var{port} is the port number on which glusterd is listening. This is optional
and if not specified, QEMU will send 0 which will make gluster to use the
default port. If the transport type is unix, then @var{port} should not be
specified.

@var{volname} is the name of the gluster volume which contains the disk image.

@var{image} is the path to the actual disk image that resides on gluster volume.

You can create a GlusterFS disk image with the command:
@example
qemu-img create gluster://@var{server}/@var{volname}/@var{image} @var{size}
@end example

Examples
@example
qemu-system-x86_64 -drive file=gluster://1.2.3.4/testvol/a.img
qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4/testvol/a.img
qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
qemu-system-x86_64 -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
qemu-system-x86_64 -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
qemu-system-x86_64 -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
@end example
1087

1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129
@node disk_images_ssh
@subsection Secure Shell (ssh) disk images

You can access disk images located on a remote ssh server
by using the ssh protocol:

@example
qemu-system-x86_64 -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
@end example

Alternative syntax using properties:

@example
qemu-system-x86_64 -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
@end example

@var{ssh} is the protocol.

@var{user} is the remote user.  If not specified, then the local
username is tried.

@var{server} specifies the remote ssh server.  Any ssh server can be
used, but it must implement the sftp-server protocol.  Most Unix/Linux
systems should work without requiring any extra configuration.

@var{port} is the port number on which sshd is listening.  By default
the standard ssh port (22) is used.

@var{path} is the path to the disk image.

The optional @var{host_key_check} parameter controls how the remote
host's key is checked.  The default is @code{yes} which means to use
the local @file{.ssh/known_hosts} file.  Setting this to @code{no}
turns off known-hosts checking.  Or you can check that the host key
matches a specific fingerprint:
@code{host_key_check=md5:78:45:8e:14:57:4f:d5:45:83:0a:0e:f3:49:82:c9:c8}
(@code{sha1:} can also be used as a prefix, but note that OpenSSH
tools only use MD5 to print fingerprints).

Currently authentication must be done using ssh-agent.  Other
authentication methods may be supported in future.

1130 1131 1132 1133 1134 1135 1136 1137 1138 1139
Note: Many ssh servers do not support an @code{fsync}-style operation.
The ssh driver cannot guarantee that disk flush requests are
obeyed, and this causes a risk of disk corruption if the remote
server or network goes down during writes.  The driver will
print a warning when @code{fsync} is not supported:

warning: ssh server @code{ssh.example.com:22} does not support fsync

With sufficiently new versions of libssh2 and OpenSSH, @code{fsync} is
supported.
1140

1141
@node pcsys_network
bellard's avatar
bellard committed
1142 1143
@section Network emulation

1144
QEMU can simulate several network cards (PCI or ISA cards on the PC
bellard's avatar
bellard committed
1145 1146 1147
target) and can connect them to an arbitrary number of Virtual Local
Area Networks (VLANs). Host TAP devices can be connected to any QEMU
VLAN. VLAN can be connected between separate instances of QEMU to
1148
simulate large networks. For simpler usage, a non privileged user mode
bellard's avatar
bellard committed
1149 1150 1151 1152
network stack can replace the TAP device to have a basic network
connection.

@subsection VLANs
bellard's avatar
bellard committed
1153

bellard's avatar
bellard committed
1154 1155 1156 1157
QEMU simulates several VLANs. A VLAN can be symbolised as a virtual
connection between several network devices. These devices can be for
example QEMU virtual Ethernet cards or virtual Host ethernet devices
(TAP devices).
bellard's avatar
bellard committed
1158

bellard's avatar
bellard committed
1159 1160 1161 1162 1163
@subsection Using TAP network interfaces

This is the standard way to connect QEMU to a real network. QEMU adds
a virtual network device on your host (called @code{tapN}), and you
can then configure it as if it was a real ethernet card.
bellard's avatar
bellard committed
1164

bellard's avatar
bellard committed
1165 1166
@subsubsection Linux host

bellard's avatar
bellard committed
1167 1168 1169 1170
As an example, you can download the @file{linux-test-xxx.tar.gz}
archive and copy the script @file{qemu-ifup} in @file{/etc} and
configure properly @code{sudo} so that the command @code{ifconfig}
contained in @file{qemu-ifup} can be executed as root. You must verify
bellard's avatar
bellard committed
1171
that your host kernel supports the TAP network interfaces: the
bellard's avatar
bellard committed
1172 1173
device @file{/dev/net/tun} must be present.

bellard's avatar
bellard committed
1174 1175
See @ref{sec_invocation} to have examples of command lines using the
TAP network interfaces.
bellard's avatar
bellard committed
1176

bellard's avatar
bellard committed
1177 1178 1179 1180 1181 1182 1183
@subsubsection Windows host

There is a virtual ethernet driver for Windows 2000/XP systems, called
TAP-Win32. But it is not included in standard QEMU for Windows,
so you will need to get it separately. It is part of OpenVPN package,
so download OpenVPN from : @url{http://openvpn.net/}.

bellard's avatar
bellard committed
1184 1185
@subsection Using the user mode network stack

bellard's avatar
bellard committed
1186 1187
By using the option @option{-net user} (default configuration if no
@option{-net} option is specified), QEMU uses a completely user mode
1188
network stack (you don't need root privilege to use the virtual
bellard's avatar
bellard committed
1189
network). The virtual network configuration is the following:
bellard's avatar
bellard committed
1190 1191 1192

@example

bellard's avatar
bellard committed
1193 1194
         QEMU VLAN      <------>  Firewall/DHCP server <-----> Internet
                           |          (10.0.2.2)
bellard's avatar
bellard committed
1195
                           |
bellard's avatar
bellard committed
1196
                           ---->  DNS server (10.0.2.3)
1197
                           |
bellard's avatar
bellard committed
1198
                           ---->  SMB server (10.0.2.4)
bellard's avatar
bellard committed
1199 1200 1201 1202
@end example

The QEMU VM behaves as if it was behind a firewall which blocks all
incoming connections. You can use a DHCP client to automatically
bellard's avatar
bellard committed
1203 1204
configure the network in the QEMU VM. The DHCP server assign addresses
to the hosts starting from 10.0.2.15.
bellard's avatar
bellard committed
1205 1206 1207 1208 1209

In order to check that the user mode network is working, you can ping
the address 10.0.2.2 and verify that you got an address in the range
10.0.2.x from the QEMU virtual DHCP server.

1210 1211 1212 1213 1214 1215 1216 1217 1218 1219
Note that ICMP traffic in general does not work with user mode networking.
@code{ping}, aka. ICMP echo, to the local router (10.0.2.2) shall work,
however. If you're using QEMU on Linux >= 3.0, it can use unprivileged ICMP
ping sockets to allow @code{ping} to the Internet. The host admin has to set
the ping_group_range in order to grant access to those sockets. To allow ping
for GID 100 (usually users group):

@example
echo 100 100 > /proc/sys/net/ipv4/ping_group_range
@end example
bellard's avatar
bellard committed
1220

bellard's avatar
bellard committed
1221 1222 1223 1224 1225 1226
When using the built-in TFTP server, the router is also the TFTP
server.

When using the @option{-redir} option, TCP or UDP connections can be
redirected from the host to the guest. It allows for example to
redirect X11, telnet or SSH connections.
bellard's avatar
bellard committed
1227

bellard's avatar
bellard committed
1228 1229 1230 1231 1232 1233
@subsection Connecting VLANs between QEMU instances

Using the @option{-net socket} option, it is possible to make VLANs
that span several QEMU instances. See @ref{sec_invocation} to have a
basic example.

1234
@node pcsys_other_devs
1235 1236 1237 1238 1239 1240 1241 1242 1243 1244
@section Other Devices

@subsection Inter-VM Shared Memory device

With KVM enabled on a Linux host, a shared memory device is available.  Guests
map a POSIX shared memory region into the guest as a PCI device that enables
zero-copy communication to the application level of the guests.  The basic
syntax is:

@example
1245
qemu-system-i386 -device ivshmem,size=<size in format accepted by -m>[,shm=<shm name>]
1246 1247 1248 1249 1250 1251 1252 1253 1254
@end example

If desired, interrupts can be sent between guest VMs accessing the same shared
memory region.  Interrupt support requires using a shared memory server and
using a chardev socket to connect to it.  The code for the shared memory server
is qemu.git/contrib/ivshmem-server.  An example syntax when using the shared
memory server is:

@example
1255 1256 1257
qemu-system-i386 -device ivshmem,size=<size in format accepted by -m>[,chardev=<id>]
                 [,msi=on][,ioeventfd=on][,vectors=n][,role=peer|master]
qemu-system-i386 -chardev socket,path=<path>,id=<id>
1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277
@end example

When using the server, the guest will be assigned a VM ID (>=0) that allows guests
using the same server to communicate via interrupts.  Guests can read their
VM ID from a device register (see example code).  Since receiving the shared
memory region from the server is asynchronous, there is a (small) chance the
guest may boot before the shared memory is attached.  To allow an application
to ensure shared memory is attached, the VM ID register will return -1 (an
invalid VM ID) until the memory is attached.  Once the shared memory is
attached, the VM ID will return the guest's valid VM ID.  With these semantics,
the guest application can check to ensure the shared memory is attached to the
guest before proceeding.

The @option{role} argument can be set to either master or peer and will affect
how the shared memory is migrated.  With @option{role=master}, the guest will
copy the shared memory on migration to the destination host.  With
@option{role=peer}, the guest will not be able to migrate with the device attached.
With the @option{peer} case, the device should be detached and then reattached
after migration using the PCI hotplug support.

bellard's avatar
bellard committed
1278 1279
@node direct_linux_boot
@section Direct Linux Boot
bellard's avatar
bellard committed
1280 1281 1282

This section explains how to launch a Linux kernel inside QEMU without
having to make a full bootable image. It is very useful for fast Linux
bellard's avatar
bellard committed
1283
kernel testing.
bellard's avatar
bellard committed
1284

bellard's avatar
bellard committed
1285
The syntax is:
bellard's avatar
bellard committed
1286
@example
1287
qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
bellard's avatar
bellard committed
1288 1289
@end example

bellard's avatar
bellard committed
1290 1291 1292
Use @option{-kernel} to provide the Linux kernel image and
@option{-append} to give the kernel command line arguments. The
@option{-initrd} option can be used to provide an INITRD image.
bellard's avatar
bellard committed
1293

bellard's avatar
bellard committed
1294 1295 1296
When using the direct Linux boot, a disk image for the first hard disk
@file{hda} is required because its boot sector is used to launch the
Linux kernel.
bellard's avatar
bellard committed
1297

bellard's avatar
bellard committed
1298 1299 1300
If you do not need graphical output, you can disable it and redirect
the virtual serial port and the QEMU monitor to the console with the
@option{-nographic} option. The typical command line is:
bellard's avatar
bellard committed
1301
@example
1302 1303
qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
                 -append "root=/dev/hda console=ttyS0" -nographic
bellard's avatar
bellard committed
1304 1305
@end example

bellard's avatar
bellard committed
1306 1307
Use @key{Ctrl-a c} to switch between the serial console and the
monitor (@pxref{pcsys_keys}).
bellard's avatar
bellard committed
1308

1309
@node pcsys_usb
bellard's avatar
bellard committed
1310 1311
@section USB emulation

pbrook's avatar
pbrook committed
1312 1313
QEMU emulates a PCI UHCI USB controller. You can virtually plug
virtual USB devices or real host USB devices (experimental, works only
1314
on Linux hosts).  QEMU will automatically create and connect virtual USB hubs
bellard's avatar
bellard committed
1315
as necessary to connect multiple USB devices.
bellard's avatar
bellard committed
1316

pbrook's avatar
pbrook committed
1317 1318 1319 1320 1321 1322
@menu
* usb_devices::
* host_usb_devices::
@end menu
@node usb_devices
@subsection Connecting USB devices
bellard's avatar
bellard committed
1323

pbrook's avatar
pbrook committed
1324 1325
USB devices can be connected with the @option{-usbdevice} commandline option
or the @code{usb_add} monitor command.  Available devices are:
bellard's avatar
bellard committed
1326

1327 1328
@table @code
@item mouse
pbrook's avatar
pbrook committed
1329
Virtual Mouse.  This will override the PS/2 mouse emulation when activated.
1330
@item tablet
bellard's avatar
bellard committed
1331
Pointer device that uses absolute coordinates (like a touchscreen).
1332
This means QEMU is able to report the mouse position without having
pbrook's avatar
pbrook committed
1333
to grab the mouse.  Also overrides the PS/2 mouse emulation when activated.
1334
@item disk:@var{file}
pbrook's avatar
pbrook committed
1335
Mass storage device based on @var{file} (@pxref{disk_images})
1336
@item host:@var{bus.addr}
pbrook's avatar
pbrook committed
1337 1338
Pass through the host device identified by @var{bus.addr}
(Linux only)
1339
@item host:@var{vendor_id:product_id}
pbrook's avatar
pbrook committed
1340 1341
Pass through the host device identified by @var{vendor_id:product_id}
(Linux only)
1342
@item wacom-tablet
1343 1344 1345
Virtual Wacom PenPartner tablet.  This device is similar to the @code{tablet}
above but it can be used with the tslib library because in addition to touch
coordinates it reports touch pressure.
1346
@item keyboard
balrog's avatar
balrog committed
1347
Standard USB keyboard.  Will override the PS/2 keyboard (if present).
1348 1349 1350 1351
@item serial:[vendorid=@var{vendor_id}][,product_id=@var{product_id}]:@var{dev}
Serial converter. This emulates an FTDI FT232BM chip connected to host character
device @var{dev}. The available character devices are the same as for the
@code{-serial} option. The @code{vendorid} and @code{productid} options can be
Stefan Weil's avatar
Stefan Weil committed
1352
used to override the default 0403:6001. For instance,
1353 1354 1355 1356 1357
@example
usb_add serial:productid=FA00:tcp:192.168.0.2:4444
@end example
will connect to tcp port 4444 of ip 192.168.0.2, and plug that to the virtual
serial converter, faking a Matrix Orbital LCD Display (USB ID 0403:FA00).
aurel32's avatar
aurel32 committed
1358 1359 1360
@item braille
Braille device.  This will use BrlAPI to display the braille output on a real
or fake device.
1361 1362 1363 1364
@item net:@var{options}
Network adapter that supports CDC ethernet and RNDIS protocols.  @var{options}
specifies NIC options as with @code{-net nic,}@var{options} (see description).
For instance, user-mode networking can be used with
1365
@example
1366
qemu-system-i386 [...OPTIONS...] -net user,vlan=0 -usbdevice net:vlan=0
1367 1368
@end example
Currently this cannot be used in machines that support PCI NICs.
1369 1370 1371 1372 1373 1374 1375
@item bt[:@var{hci-type}]
Bluetooth dongle whose type is specified in the same format as with
the @option{-bt hci} option, @pxref{bt-hcis,,allowed HCI types}.  If
no type is given, the HCI logic corresponds to @code{-bt hci,vlan=0}.
This USB device implements the USB Transport Layer of HCI.  Example
usage:
@example
1376
qemu-system-i386 [...OPTIONS...] -usbdevice bt:hci,vlan=3 -bt device:keyboard,vlan=3
1377
@end example
pbrook's avatar
pbrook committed
1378
@end table
bellard's avatar
bellard committed
1379

pbrook's avatar
pbrook committed
1380
@node host_usb_devices
bellard's avatar
bellard committed
1381 1382 1383 1384 1385 1386 1387
@subsection Using host USB devices on a Linux host

WARNING: this is an experimental feature. QEMU will slow down when
using it. USB devices requiring real time streaming (i.e. USB Video
Cameras) are not supported yet.

@enumerate
1388
@item If you use an early Linux 2.4 kernel, verify that no Linux driver
bellard's avatar
bellard committed
1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
is actually using the USB device. A simple way to do that is simply to
disable the corresponding kernel module by renaming it from @file{mydriver.o}
to @file{mydriver.o.disabled}.

@item Verify that @file{/proc/bus/usb} is working (most Linux distributions should enable it by default). You should see something like that:
@example
ls /proc/bus/usb
001  devices  drivers
@end example

@item Since only root can access to the USB devices directly, you can either launch QEMU as root or change the permissions of the USB devices you want to use. For testing, the following suffices:
@example
chown -R myuid /proc/bus/usb
@end example

@item Launch QEMU and do in the monitor:
1405
@example
bellard's avatar
bellard committed
1406 1407 1408 1409 1410 1411 1412 1413
info usbhost
  Device 1.2, speed 480 Mb/s
    Class 00: USB device 1234:5678, USB DISK
@end example
You should see the list of the devices you can use (Never try to use
hubs, it won't work).

@item Add the device in QEMU by using:
1414
@example
bellard's avatar
bellard committed
1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427
usb_add host:1234:5678
@end example

Normally the guest OS should report that a new USB device is
plugged. You can use the option @option{-usbdevice} to do the same.

@item Now you can try to use the host USB device in QEMU.

@end enumerate

When relaunching QEMU, you may have to unplug and plug again the USB
device to make it work again (this is a bug).

1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440
@node vnc_security
@section VNC security

The VNC server capability provides access to the graphical console
of the guest VM across the network. This has a number of security
considerations depending on the deployment scenarios.

@menu
* vnc_sec_none::
* vnc_sec_password::
* vnc_sec_certificate::
* vnc_sec_certificate_verify::
* vnc_sec_certificate_pw::
1441 1442
* vnc_sec_sasl::
* vnc_sec_certificate_sasl::
1443
* vnc_generate_cert::
1444
* vnc_setup_sasl::
1445 1446 1447 1448 1449 1450 1451 1452 1453
@end menu
@node vnc_sec_none
@subsection Without passwords

The simplest VNC server setup does not include any form of authentication.
For this setup it is recommended to restrict it to listen on a UNIX domain
socket only. For example

@example
1454
qemu-system-i386 [...OPTIONS...] -vnc unix:/home/joebloggs/.qemu-myvm-vnc
1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469
@end example

This ensures that only users on local box with read/write access to that
path can access the VNC server. To securely access the VNC server from a
remote machine, a combination of netcat+ssh can be used to provide a secure
tunnel.

@node vnc_sec_password
@subsection With passwords

The VNC protocol has limited support for password based authentication. Since
the protocol limits passwords to 8 characters it should not be considered
to provide high security. The password can be fairly easily brute-forced by
a client making repeat connections. For this reason, a VNC server using password
authentication should be restricted to only listen on the loopback interface
1470 1471 1472 1473 1474
or UNIX domain sockets. Password authentication is not supported when operating
in FIPS 140-2 compliance mode as it requires the use of the DES cipher. Password
authentication is requested with the @code{password} option, and then once QEMU
is running the password is set with the monitor. Until the monitor is used to
set the password all clients will be rejected.
1475 1476

@example
1477
qemu-system-i386 [...OPTIONS...] -vnc :1,password -monitor stdio
1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493
(qemu) change vnc password
Password: ********
(qemu)
@end example

@node vnc_sec_certificate
@subsection With x509 certificates

The QEMU VNC server also implements the VeNCrypt extension allowing use of
TLS for encryption of the session, and x509 certificates for authentication.
The use of x509 certificates is strongly recommended, because TLS on its
own is susceptible to man-in-the-middle attacks. Basic x509 certificate
support provides a secure session, but no authentication. This allows any
client to connect, and provides an encrypted session.

@example
1494
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio
1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511
@end example

In the above example @code{/etc/pki/qemu} should contain at least three files,
@code{ca-cert.pem}, @code{server-cert.pem} and @code{server-key.pem}. Unprivileged
users will want to use a private directory, for example @code{$HOME/.pki/qemu}.
NB the @code{server-key.pem} file should be protected with file mode 0600 to
only be readable by the user owning it.

@node vnc_sec_certificate_verify
@subsection With x509 certificates and client verification

Certificates can also provide a means to authenticate the client connecting.
The server will request that the client provide a certificate, which it will
then validate against the CA certificate. This is a good choice if deploying
in an environment with a private internal certificate authority.

@example
1512
qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor stdio
1513 1514 1515 1516 1517 1518 1519 1520 1521 1522
@end example


@node vnc_sec_certificate_pw
@subsection With x509 certificates, client verification and passwords

Finally, the previous method can be combined with VNC password authentication
to provide two layers of authentication for clients.

@example
1523
qemu-system-i386 [...OPTIONS...] -vnc :1,password,tls,x509verify=/etc/pki/qemu -monitor stdio
1524 1525 1526 1527 1528
(qemu) change vnc password
Password: ********
(qemu)
@end example

1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545

@node vnc_sec_sasl
@subsection With SASL authentication

The SASL authentication method is a VNC extension, that provides an
easily extendable, pluggable authentication method. This allows for
integration with a wide range of authentication mechanisms, such as
PAM, GSSAPI/Kerberos, LDAP, SQL databases, one-time keys and more.
The strength of the authentication depends on the exact mechanism
configured. If the chosen mechanism also provides a SSF layer, then
it will encrypt the datastream as well.

Refer to the later docs on how to choose the exact SASL mechanism
used for authentication, but assuming use of one supporting SSF,
then QEMU can be launched with:

@example
1546
qemu-system-i386 [...OPTIONS...] -vnc :1,sasl -monitor stdio
1547 1548 1549 1550 1551 1552 1553 1554