]> git.proxmox.com Git - qemu.git/blame - qemu-doc.texi
display device identifier string for user with info usb (Lonnie Mendez)
[qemu.git] / qemu-doc.texi
CommitLineData
386405f7 1\input texinfo @c -*- texinfo -*-
debc7065
FB
2@c %**start of header
3@setfilename qemu-doc.info
4@settitle QEMU CPU Emulator User Documentation
5@exampleindent 0
6@paragraphindent 0
7@c %**end of header
386405f7 8
0806e3f6 9@iftex
386405f7
FB
10@titlepage
11@sp 7
debc7065
FB
12@center @titlefont{QEMU CPU Emulator}
13@sp 1
14@center @titlefont{User Documentation}
386405f7
FB
15@sp 3
16@end titlepage
0806e3f6 17@end iftex
386405f7 18
debc7065
FB
19@ifnottex
20@node Top
21@top
22
23@menu
24* Introduction::
25* Installation::
26* QEMU PC System emulator::
27* QEMU System emulator for non PC targets::
28* QEMU Linux User space emulator::
29* compilation:: Compilation from the sources
30* Index::
31@end menu
32@end ifnottex
33
34@contents
35
36@node Introduction
386405f7
FB
37@chapter Introduction
38
debc7065
FB
39@menu
40* intro_features:: Features
41@end menu
42
43@node intro_features
322d0c66 44@section Features
386405f7 45
1f673135
FB
46QEMU is a FAST! processor emulator using dynamic translation to
47achieve good emulation speed.
1eb20527
FB
48
49QEMU has two operating modes:
0806e3f6
FB
50
51@itemize @minus
52
53@item
1f673135 54Full system emulation. In this mode, QEMU emulates a full system (for
3f9f3aa1
FB
55example a PC), including one or several processors and various
56peripherals. It can be used to launch different Operating Systems
57without rebooting the PC or to debug system code.
1eb20527 58
0806e3f6 59@item
1f673135
FB
60User mode emulation (Linux host only). In this mode, QEMU can launch
61Linux processes compiled for one CPU on another CPU. It can be used to
62launch the Wine Windows API emulator (@url{http://www.winehq.org}) or
63to ease cross-compilation and cross-debugging.
1eb20527
FB
64
65@end itemize
66
7c3fc84d 67QEMU can run without an host kernel driver and yet gives acceptable
6f2f2b24 68performance.
322d0c66 69
52c00a5f
FB
70For system emulation, the following hardware targets are supported:
71@itemize
9d0a8e6f 72@item PC (x86 or x86_64 processor)
3f9f3aa1 73@item ISA PC (old style PC without PCI bus)
52c00a5f 74@item PREP (PowerPC processor)
9d0a8e6f
FB
75@item G3 BW PowerMac (PowerPC processor)
76@item Mac99 PowerMac (PowerPC processor, in progress)
3475187d
FB
77@item Sun4m (32-bit Sparc processor)
78@item Sun4u (64-bit Sparc processor, in progress)
3f9f3aa1 79@item Malta board (32-bit MIPS processor)
ed96ca35 80@item ARM Integrator/CP (ARM926E or 1026E processor)
00a9bf19 81@item ARM Versatile baseboard (ARM926E)
52c00a5f 82@end itemize
386405f7 83
3f9f3aa1 84For user emulation, x86, PowerPC, ARM, MIPS, and Sparc32/64 CPUs are supported.
0806e3f6 85
debc7065 86@node Installation
5b9f457a
FB
87@chapter Installation
88
15a34c63
FB
89If you want to compile QEMU yourself, see @ref{compilation}.
90
debc7065
FB
91@menu
92* install_linux:: Linux
93* install_windows:: Windows
94* install_mac:: Macintosh
95@end menu
96
97@node install_linux
1f673135
FB
98@section Linux
99
7c3fc84d
FB
100If a precompiled package is available for your distribution - you just
101have to install it. Otherwise, see @ref{compilation}.
5b9f457a 102
debc7065 103@node install_windows
1f673135 104@section Windows
8cd0ac2f 105
15a34c63 106Download the experimental binary installer at
debc7065 107@url{http://www.free.oszoo.org/@/download.html}.
d691f669 108
debc7065 109@node install_mac
1f673135 110@section Mac OS X
d691f669 111
15a34c63 112Download the experimental binary installer at
debc7065 113@url{http://www.free.oszoo.org/@/download.html}.
df0f11a0 114
debc7065 115@node QEMU PC System emulator
3f9f3aa1 116@chapter QEMU PC System emulator
1eb20527 117
debc7065
FB
118@menu
119* pcsys_introduction:: Introduction
120* pcsys_quickstart:: Quick Start
121* sec_invocation:: Invocation
122* pcsys_keys:: Keys
123* pcsys_monitor:: QEMU Monitor
124* disk_images:: Disk Images
125* pcsys_network:: Network emulation
126* direct_linux_boot:: Direct Linux Boot
127* pcsys_usb:: USB emulation
128* gdb_usage:: GDB usage
129* pcsys_os_specific:: Target OS specific information
130@end menu
131
132@node pcsys_introduction
0806e3f6
FB
133@section Introduction
134
135@c man begin DESCRIPTION
136
3f9f3aa1
FB
137The QEMU PC System emulator simulates the
138following peripherals:
0806e3f6
FB
139
140@itemize @minus
15a34c63
FB
141@item
142i440FX host PCI bridge and PIIX3 PCI to ISA bridge
0806e3f6 143@item
15a34c63
FB
144Cirrus CLGD 5446 PCI VGA card or dummy VGA card with Bochs VESA
145extensions (hardware level, including all non standard modes).
0806e3f6
FB
146@item
147PS/2 mouse and keyboard
148@item
15a34c63 1492 PCI IDE interfaces with hard disk and CD-ROM support
1f673135
FB
150@item
151Floppy disk
0806e3f6 152@item
15a34c63 153NE2000 PCI network adapters
0806e3f6 154@item
05d5818c
FB
155Serial ports
156@item
c0fe3827
FB
157Creative SoundBlaster 16 sound card
158@item
159ENSONIQ AudioPCI ES1370 sound card
160@item
161Adlib(OPL2) - Yamaha YM3812 compatible chip
b389dbfb
FB
162@item
163PCI UHCI USB controller and a virtual USB hub.
0806e3f6
FB
164@end itemize
165
3f9f3aa1
FB
166SMP is supported with up to 255 CPUs.
167
c0fe3827
FB
168Note that adlib is only available when QEMU was configured with
169-enable-adlib
170
15a34c63
FB
171QEMU uses the PC BIOS from the Bochs project and the Plex86/Bochs LGPL
172VGA BIOS.
173
c0fe3827
FB
174QEMU uses YM3812 emulation by Tatsuyuki Satoh.
175
0806e3f6
FB
176@c man end
177
debc7065 178@node pcsys_quickstart
1eb20527
FB
179@section Quick Start
180
285dc330 181Download and uncompress the linux image (@file{linux.img}) and type:
0806e3f6
FB
182
183@example
285dc330 184qemu linux.img
0806e3f6
FB
185@end example
186
187Linux should boot and give you a prompt.
188
6cc721cf 189@node sec_invocation
ec410fc9
FB
190@section Invocation
191
192@example
0806e3f6
FB
193@c man begin SYNOPSIS
194usage: qemu [options] [disk_image]
195@c man end
ec410fc9
FB
196@end example
197
0806e3f6 198@c man begin OPTIONS
9d4520d0 199@var{disk_image} is a raw hard disk image for IDE hard disk 0.
ec410fc9
FB
200
201General options:
202@table @option
3dbbdc25
FB
203@item -M machine
204Select the emulated machine (@code{-M ?} for list)
205
2be3bc02
FB
206@item -fda file
207@item -fdb file
debc7065 208Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can
be3edd95 209use the host floppy by using @file{/dev/fd0} as filename.
2be3bc02 210
ec410fc9
FB
211@item -hda file
212@item -hdb file
181f1558
FB
213@item -hdc file
214@item -hdd file
debc7065 215Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}).
1f47a922 216
181f1558
FB
217@item -cdrom file
218Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and
be3edd95
FB
219@option{-cdrom} at the same time). You can use the host CD-ROM by
220using @file{/dev/cdrom} as filename.
181f1558 221
1f673135
FB
222@item -boot [a|c|d]
223Boot on floppy (a), hard disk (c) or CD-ROM (d). Hard disk boot is
2be3bc02 224the default.
1f47a922 225
181f1558 226@item -snapshot
1f47a922
FB
227Write to temporary files instead of disk image files. In this case,
228the raw disk image you use is not written back. You can however force
debc7065 229the write back by pressing @key{C-a s} (@pxref{disk_images}).
ec410fc9 230
52ca8d6a
FB
231@item -no-fd-bootchk
232Disable boot signature checking for floppy disks in Bochs BIOS. It may
233be needed to boot from old floppy disks.
234
ec410fc9 235@item -m megs
15a34c63 236Set virtual RAM size to @var{megs} megabytes. Default is 128 MB.
ec410fc9 237
3f9f3aa1
FB
238@item -smp n
239Simulate an SMP system with @var{n} CPUs. On the PC target, up to 255
240CPUs are supported.
241
0806e3f6
FB
242@item -nographic
243
244Normally, QEMU uses SDL to display the VGA output. With this option,
245you can totally disable graphical output so that QEMU is a simple
246command line application. The emulated serial port is redirected on
247the console. Therefore, you can still use QEMU to debug a Linux kernel
248with a serial console.
249
24236869
FB
250@item -vnc d
251
252Normally, QEMU uses SDL to display the VGA output. With this option,
253you can have QEMU listen on VNC display d and redirect the VGA display
254over the VNC session. It is very useful to enable the usb tablet device
255when using this option (option @option{-usbdevice tablet}).
256
3d11d0eb
FB
257@item -k language
258
259Use keyboard layout @var{language} (for example @code{fr} for
260French). This option is only needed where it is not easy to get raw PC
261keycodes (e.g. on Macs or with some X11 servers). You don't need to
262use it on PC/Linux or PC/Windows hosts.
263
264The available layouts are:
265@example
266ar de-ch es fo fr-ca hu ja mk no pt-br sv
267da en-gb et fr fr-ch is lt nl pl ru th
268de en-us fi fr-be hr it lv nl-be pt sl tr
269@end example
270
271The default is @code{en-us}.
272
1d14ffa9
FB
273@item -audio-help
274
275Will show the audio subsystem help: list of drivers, tunable
276parameters.
277
6a36d84e 278@item -soundhw card1,card2,... or -soundhw all
1d14ffa9
FB
279
280Enable audio and selected sound hardware. Use ? to print all
281available sound hardware.
282
283@example
284qemu -soundhw sb16,adlib hda
285qemu -soundhw es1370 hda
6a36d84e 286qemu -soundhw all hda
1d14ffa9
FB
287qemu -soundhw ?
288@end example
a8c490cd 289
15a34c63
FB
290@item -localtime
291Set the real time clock to local time (the default is to UTC
292time). This option is needed to have correct date in MS-DOS or
293Windows.
294
d63d307f
FB
295@item -full-screen
296Start in full screen.
297
f7cce898
FB
298@item -pidfile file
299Store the QEMU process PID in @var{file}. It is useful if you launch QEMU
300from a script.
301
9d0a8e6f
FB
302@item -win2k-hack
303Use it when installing Windows 2000 to avoid a disk full bug. After
304Windows 2000 is installed, you no longer need this option (this option
305slows down the IDE transfers).
306
0806e3f6
FB
307@end table
308
b389dbfb
FB
309USB options:
310@table @option
311
312@item -usb
313Enable the USB driver (will be the default soon)
314
315@item -usbdevice devname
0aff66b5 316Add the USB device @var{devname}. @xref{usb_devices}.
b389dbfb
FB
317@end table
318
1f673135
FB
319Network options:
320
321@table @option
322
a41b2ff2 323@item -net nic[,vlan=n][,macaddr=addr][,model=type]
41d03949
FB
324Create a new Network Interface Card and connect it to VLAN @var{n} (@var{n}
325= 0 is the default). The NIC is currently an NE2000 on the PC
326target. Optionally, the MAC address can be changed. If no
327@option{-net} option is specified, a single NIC is created.
a41b2ff2
PB
328Qemu can emulate several different models of network card. Valid values for
329@var{type} are @code{ne2k_pci}, @code{ne2k_isa}, @code{rtl8139},
330@code{smc91c111} and @code{lance}. Not all devices are supported on all
331targets.
41d03949 332
115defd1 333@item -net user[,vlan=n][,hostname=name]
7e89463d 334Use the user mode network stack which requires no administrator
a03a6053 335priviledge to run. @option{hostname=name} can be used to specify the client
115defd1 336hostname reported by the builtin DHCP server.
41d03949
FB
337
338@item -net tap[,vlan=n][,fd=h][,ifname=name][,script=file]
339Connect the host TAP network interface @var{name} to VLAN @var{n} and
340use the network script @var{file} to configure it. The default
341network script is @file{/etc/qemu-ifup}. If @var{name} is not
342provided, the OS automatically provides one. @option{fd=h} can be
343used to specify the handle of an already opened host TAP interface. Example:
1f673135 344
41d03949
FB
345@example
346qemu linux.img -net nic -net tap
347@end example
348
349More complicated example (two NICs, each one connected to a TAP device)
350@example
351qemu linux.img -net nic,vlan=0 -net tap,vlan=0,ifname=tap0 \
352 -net nic,vlan=1 -net tap,vlan=1,ifname=tap1
353@end example
3f1a88f4 354
3f1a88f4 355
41d03949 356@item -net socket[,vlan=n][,fd=h][,listen=[host]:port][,connect=host:port]
1f673135 357
41d03949
FB
358Connect the VLAN @var{n} to a remote VLAN in another QEMU virtual
359machine using a TCP socket connection. If @option{listen} is
360specified, QEMU waits for incoming connections on @var{port}
361(@var{host} is optional). @option{connect} is used to connect to
3d830459
FB
362another QEMU instance using the @option{listen} option. @option{fd=h}
363specifies an already opened TCP socket.
1f673135 364
41d03949
FB
365Example:
366@example
367# launch a first QEMU instance
debc7065
FB
368qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \
369 -net socket,listen=:1234
370# connect the VLAN 0 of this instance to the VLAN 0
371# of the first instance
372qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \
373 -net socket,connect=127.0.0.1:1234
41d03949 374@end example
52c00a5f 375
3d830459
FB
376@item -net socket[,vlan=n][,fd=h][,mcast=maddr:port]
377
378Create a VLAN @var{n} shared with another QEMU virtual
379machines using a UDP multicast socket, effectively making a bus for
380every QEMU with same multicast address @var{maddr} and @var{port}.
381NOTES:
382@enumerate
383@item
384Several QEMU can be running on different hosts and share same bus (assuming
385correct multicast setup for these hosts).
386@item
387mcast support is compatible with User Mode Linux (argument @option{eth@var{N}=mcast}), see
388@url{http://user-mode-linux.sf.net}.
389@item Use @option{fd=h} to specify an already opened UDP multicast socket.
390@end enumerate
391
392Example:
393@example
394# launch one QEMU instance
debc7065
FB
395qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \
396 -net socket,mcast=230.0.0.1:1234
3d830459 397# launch another QEMU instance on same "bus"
debc7065
FB
398qemu linux.img -net nic,macaddr=52:54:00:12:34:57 \
399 -net socket,mcast=230.0.0.1:1234
3d830459 400# launch yet another QEMU instance on same "bus"
debc7065
FB
401qemu linux.img -net nic,macaddr=52:54:00:12:34:58 \
402 -net socket,mcast=230.0.0.1:1234
3d830459
FB
403@end example
404
405Example (User Mode Linux compat.):
406@example
debc7065
FB
407# launch QEMU instance (note mcast address selected
408# is UML's default)
409qemu linux.img -net nic,macaddr=52:54:00:12:34:56 \
410 -net socket,mcast=239.192.168.1:1102
3d830459
FB
411# launch UML
412/path/to/linux ubd0=/path/to/root_fs eth0=mcast
413@end example
414
41d03949
FB
415@item -net none
416Indicate that no network devices should be configured. It is used to
039af320
FB
417override the default configuration (@option{-net nic -net user}) which
418is activated if no @option{-net} options are provided.
52c00a5f 419
9bf05444
FB
420@item -tftp prefix
421When using the user mode network stack, activate a built-in TFTP
422server. All filenames beginning with @var{prefix} can be downloaded
423from the host to the guest using a TFTP client. The TFTP client on the
424guest must be configured in binary mode (use the command @code{bin} of
425the Unix TFTP client). The host IP address on the guest is as usual
42610.0.2.2.
427
2518bd0d
FB
428@item -smb dir
429When using the user mode network stack, activate a built-in SMB
430server so that Windows OSes can access to the host files in @file{dir}
431transparently.
432
433In the guest Windows OS, the line:
434@example
43510.0.2.4 smbserver
436@end example
437must be added in the file @file{C:\WINDOWS\LMHOSTS} (for windows 9x/Me)
438or @file{C:\WINNT\SYSTEM32\DRIVERS\ETC\LMHOSTS} (Windows NT/2000).
439
440Then @file{dir} can be accessed in @file{\\smbserver\qemu}.
441
442Note that a SAMBA server must be installed on the host OS in
443@file{/usr/sbin/smbd}. QEMU was tested succesfully with smbd version
6cc721cf 4442.2.7a from the Red Hat 9 and version 3.0.10-1.fc3 from Fedora Core 3.
2518bd0d 445
9bf05444
FB
446@item -redir [tcp|udp]:host-port:[guest-host]:guest-port
447
448When using the user mode network stack, redirect incoming TCP or UDP
449connections to the host port @var{host-port} to the guest
450@var{guest-host} on guest port @var{guest-port}. If @var{guest-host}
451is not specified, its value is 10.0.2.15 (default address given by the
452built-in DHCP server).
453
454For example, to redirect host X11 connection from screen 1 to guest
455screen 0, use the following:
456
457@example
458# on the host
459qemu -redir tcp:6001::6000 [...]
460# this host xterm should open in the guest X11 server
461xterm -display :1
462@end example
463
464To redirect telnet connections from host port 5555 to telnet port on
465the guest, use the following:
466
467@example
468# on the host
469qemu -redir tcp:5555::23 [...]
470telnet localhost 5555
471@end example
472
473Then when you use on the host @code{telnet localhost 5555}, you
474connect to the guest telnet server.
475
1f673135
FB
476@end table
477
41d03949 478Linux boot specific: When using these options, you can use a given
1f673135
FB
479Linux kernel without installing it in the disk image. It can be useful
480for easier testing of various kernels.
481
0806e3f6
FB
482@table @option
483
484@item -kernel bzImage
485Use @var{bzImage} as kernel image.
486
487@item -append cmdline
488Use @var{cmdline} as kernel command line
489
490@item -initrd file
491Use @var{file} as initial ram disk.
492
ec410fc9
FB
493@end table
494
15a34c63 495Debug/Expert options:
ec410fc9 496@table @option
a0a821a4
FB
497
498@item -serial dev
0bab00f3
FB
499Redirect the virtual serial port to host character device
500@var{dev}. The default device is @code{vc} in graphical mode and
501@code{stdio} in non graphical mode.
502
503This option can be used several times to simulate up to 4 serials
504ports.
505
506Available character devices are:
a0a821a4
FB
507@table @code
508@item vc
509Virtual console
510@item pty
511[Linux only] Pseudo TTY (a new PTY is automatically allocated)
512@item null
513void device
f8d179e3 514@item /dev/XXX
e57a8c0e 515[Linux only] Use host tty, e.g. @file{/dev/ttyS0}. The host serial port
f8d179e3 516parameters are set according to the emulated ones.
e57a8c0e
FB
517@item /dev/parportN
518[Linux only, parallel port only] Use host parallel port
519@var{N}. Currently only SPP parallel port features can be used.
f8d179e3
FB
520@item file:filename
521Write output to filename. No character can be read.
a0a821a4
FB
522@item stdio
523[Unix only] standard input/output
f8d179e3 524@item pipe:filename
0bab00f3
FB
525name pipe @var{filename}
526@item COMn
527[Windows only] Use host serial port @var{n}
528@item udp:remote_port
529UDP Net Console sent to locahost at remote_port
530@item udp:remote_host:remote_port
531UDP Net Console sent to remote_host at remote_port
532@item udp:src_port:remote_host:remote_port
533UDP Net Console sent from src_port to remote_host at the remote_port.
534
535The udp:* sub options are primary intended for netconsole. If you
536just want a simple readonly console you can use @code{netcat} or
537@code{nc}, by starting qemu with: @code{-serial udp:4555} and nc as:
538@code{nc -u -l -p 4555}. Any time qemu writes something to that port
539it will appear in the netconsole session.
540
541If you plan to send characters back via netconsole or you want to stop
542and start qemu a lot of times, you should have qemu use the same
543source port each time by using something like @code{-serial
544udp:4556:localhost:4555} to qemu. Another approach is to use a patched
545version of netcat which can listen to a TCP port and send and receive
546characters via udp. If you have a patched version of netcat which
547activates telnet remote echo and single char transfer, then you can
548use the following options to step up a netcat redirector to allow
549telnet on port 5555 to access the qemu port.
550@table @code
551@item Qemu Options
552-serial udp:4556:localhost:4555
553@item netcat options
554-u -P 4555 -L localhost:4556 -t -p 5555 -I -T
a0a821a4 555@end table
a0a821a4 556
0bab00f3
FB
557
558@item tcp:remote_host:remote_port
559TCP Net Console sent to remote_host at the remote_port
560@item tcpl:host:port
561TCP Net Console: wait for connection on @var{host} on the local port
562@var{port}. If host is omitted, 0.0.0.0 is assumed. Only one TCP
563connection at a time is accepted. You can use @code{telnet} to connect
564to the corresponding character device.
565@end table
05d5818c 566
e57a8c0e
FB
567@item -parallel dev
568Redirect the virtual parallel port to host device @var{dev} (same
569devices as the serial port). On Linux hosts, @file{/dev/parportN} can
570be used to use hardware devices connected on the corresponding host
571parallel port.
572
573This option can be used several times to simulate up to 3 parallel
574ports.
575
a0a821a4
FB
576@item -monitor dev
577Redirect the monitor to host device @var{dev} (same devices as the
578serial port).
579The default device is @code{vc} in graphical mode and @code{stdio} in
580non graphical mode.
581
ec410fc9 582@item -s
debc7065 583Wait gdb connection to port 1234 (@pxref{gdb_usage}).
ec410fc9
FB
584@item -p port
585Change gdb connection port.
52c00a5f
FB
586@item -S
587Do not start CPU at startup (you must type 'c' in the monitor).
ec410fc9 588@item -d
9d4520d0 589Output log in /tmp/qemu.log
46d4767d
FB
590@item -hdachs c,h,s,[,t]
591Force hard disk 0 physical geometry (1 <= @var{c} <= 16383, 1 <=
592@var{h} <= 16, 1 <= @var{s} <= 63) and optionally force the BIOS
593translation mode (@var{t}=none, lba or auto). Usually QEMU can guess
594all thoses parameters. This option is useful for old MS-DOS disk
595images.
7c3fc84d 596
15a34c63
FB
597@item -std-vga
598Simulate a standard VGA card with Bochs VBE extensions (default is
3cb0853a
FB
599Cirrus Logic GD5446 PCI VGA). If your guest OS supports the VESA 2.0
600VBE extensions (e.g. Windows XP) and if you want to use high
601resolution modes (>= 1280x1024x16) then you should use this option.
602
d63d307f
FB
603@item -loadvm file
604Start right away with a saved state (@code{loadvm} in monitor)
ec410fc9
FB
605@end table
606
3e11db9a
FB
607@c man end
608
debc7065 609@node pcsys_keys
3e11db9a
FB
610@section Keys
611
612@c man begin OPTIONS
613
a1b74fe8
FB
614During the graphical emulation, you can use the following keys:
615@table @key
f9859310 616@item Ctrl-Alt-f
a1b74fe8 617Toggle full screen
a0a821a4 618
f9859310 619@item Ctrl-Alt-n
a0a821a4
FB
620Switch to virtual console 'n'. Standard console mappings are:
621@table @emph
622@item 1
623Target system display
624@item 2
625Monitor
626@item 3
627Serial port
a1b74fe8
FB
628@end table
629
f9859310 630@item Ctrl-Alt
a0a821a4
FB
631Toggle mouse and keyboard grab.
632@end table
633
3e11db9a
FB
634In the virtual consoles, you can use @key{Ctrl-Up}, @key{Ctrl-Down},
635@key{Ctrl-PageUp} and @key{Ctrl-PageDown} to move in the back log.
636
a0a821a4
FB
637During emulation, if you are using the @option{-nographic} option, use
638@key{Ctrl-a h} to get terminal commands:
ec410fc9
FB
639
640@table @key
a1b74fe8 641@item Ctrl-a h
ec410fc9 642Print this help
a1b74fe8 643@item Ctrl-a x
ec410fc9 644Exit emulatior
a1b74fe8 645@item Ctrl-a s
1f47a922 646Save disk data back to file (if -snapshot)
a1b74fe8 647@item Ctrl-a b
1f673135 648Send break (magic sysrq in Linux)
a1b74fe8 649@item Ctrl-a c
1f673135 650Switch between console and monitor
a1b74fe8
FB
651@item Ctrl-a Ctrl-a
652Send Ctrl-a
ec410fc9 653@end table
0806e3f6
FB
654@c man end
655
656@ignore
657
1f673135
FB
658@c man begin SEEALSO
659The HTML documentation of QEMU for more precise information and Linux
660user mode emulator invocation.
661@c man end
662
663@c man begin AUTHOR
664Fabrice Bellard
665@c man end
666
667@end ignore
668
debc7065 669@node pcsys_monitor
1f673135
FB
670@section QEMU Monitor
671
672The QEMU monitor is used to give complex commands to the QEMU
673emulator. You can use it to:
674
675@itemize @minus
676
677@item
678Remove or insert removable medias images
679(such as CD-ROM or floppies)
680
681@item
682Freeze/unfreeze the Virtual Machine (VM) and save or restore its state
683from a disk file.
684
685@item Inspect the VM state without an external debugger.
686
687@end itemize
688
689@subsection Commands
690
691The following commands are available:
692
693@table @option
694
695@item help or ? [cmd]
696Show the help for all commands or just for command @var{cmd}.
697
698@item commit
699Commit changes to the disk images (if -snapshot is used)
700
701@item info subcommand
702show various information about the system state
703
704@table @option
705@item info network
41d03949 706show the various VLANs and the associated devices
1f673135
FB
707@item info block
708show the block devices
709@item info registers
710show the cpu registers
711@item info history
712show the command line history
b389dbfb
FB
713@item info pci
714show emulated PCI device
715@item info usb
716show USB devices plugged on the virtual USB hub
717@item info usbhost
718show all USB host devices
1f673135
FB
719@end table
720
721@item q or quit
722Quit the emulator.
723
724@item eject [-f] device
725Eject a removable media (use -f to force it).
726
727@item change device filename
728Change a removable media.
729
730@item screendump filename
731Save screen into PPM image @var{filename}.
732
733@item log item1[,...]
734Activate logging of the specified items to @file{/tmp/qemu.log}.
735
736@item savevm filename
737Save the whole virtual machine state to @var{filename}.
738
739@item loadvm filename
740Restore the whole virtual machine state from @var{filename}.
741
742@item stop
743Stop emulation.
744
745@item c or cont
746Resume emulation.
747
748@item gdbserver [port]
749Start gdbserver session (default port=1234)
750
751@item x/fmt addr
752Virtual memory dump starting at @var{addr}.
753
754@item xp /fmt addr
755Physical memory dump starting at @var{addr}.
756
757@var{fmt} is a format which tells the command how to format the
758data. Its syntax is: @option{/@{count@}@{format@}@{size@}}
759
760@table @var
761@item count
762is the number of items to be dumped.
763
764@item format
765can be x (hexa), d (signed decimal), u (unsigned decimal), o (octal),
766c (char) or i (asm instruction).
767
768@item size
52c00a5f
FB
769can be b (8 bits), h (16 bits), w (32 bits) or g (64 bits). On x86,
770@code{h} or @code{w} can be specified with the @code{i} format to
771respectively select 16 or 32 bit code instruction size.
1f673135
FB
772
773@end table
774
775Examples:
776@itemize
777@item
778Dump 10 instructions at the current instruction pointer:
779@example
780(qemu) x/10i $eip
7810x90107063: ret
7820x90107064: sti
7830x90107065: lea 0x0(%esi,1),%esi
7840x90107069: lea 0x0(%edi,1),%edi
7850x90107070: ret
7860x90107071: jmp 0x90107080
7870x90107073: nop
7880x90107074: nop
7890x90107075: nop
7900x90107076: nop
791@end example
792
793@item
794Dump 80 16 bit values at the start of the video memory.
debc7065 795@smallexample
1f673135
FB
796(qemu) xp/80hx 0xb8000
7970x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42
7980x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41
7990x000b8020: 0x0b42 0x0b69 0x0b6f 0x0b73 0x0b20 0x0b63 0x0b75 0x0b72
8000x000b8030: 0x0b72 0x0b65 0x0b6e 0x0b74 0x0b2d 0x0b63 0x0b76 0x0b73
8010x000b8040: 0x0b20 0x0b30 0x0b35 0x0b20 0x0b4e 0x0b6f 0x0b76 0x0b20
8020x000b8050: 0x0b32 0x0b30 0x0b30 0x0b33 0x0720 0x0720 0x0720 0x0720
8030x000b8060: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
8040x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
8050x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
8060x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
debc7065 807@end smallexample
1f673135
FB
808@end itemize
809
810@item p or print/fmt expr
811
812Print expression value. Only the @var{format} part of @var{fmt} is
813used.
0806e3f6 814
a3a91a35
FB
815@item sendkey keys
816
817Send @var{keys} to the emulator. Use @code{-} to press several keys
818simultaneously. Example:
819@example
820sendkey ctrl-alt-f1
821@end example
822
823This command is useful to send keys that your graphical user interface
824intercepts at low level, such as @code{ctrl-alt-f1} in X Window.
825
15a34c63
FB
826@item system_reset
827
828Reset the system.
829
b389dbfb
FB
830@item usb_add devname
831
0aff66b5
PB
832Add the USB device @var{devname}. For details of available devices see
833@ref{usb_devices}
b389dbfb
FB
834
835@item usb_del devname
836
837Remove the USB device @var{devname} from the QEMU virtual USB
838hub. @var{devname} has the syntax @code{bus.addr}. Use the monitor
839command @code{info usb} to see the devices you can remove.
840
1f673135 841@end table
0806e3f6 842
1f673135
FB
843@subsection Integer expressions
844
845The monitor understands integers expressions for every integer
846argument. You can use register names to get the value of specifics
847CPU registers by prefixing them with @emph{$}.
ec410fc9 848
1f47a922
FB
849@node disk_images
850@section Disk Images
851
acd935ef
FB
852Since version 0.6.1, QEMU supports many disk image formats, including
853growable disk images (their size increase as non empty sectors are
854written), compressed and encrypted disk images.
1f47a922 855
debc7065
FB
856@menu
857* disk_images_quickstart:: Quick start for disk image creation
858* disk_images_snapshot_mode:: Snapshot mode
859* qemu_img_invocation:: qemu-img Invocation
860* disk_images_fat_images:: Virtual FAT disk images
861@end menu
862
863@node disk_images_quickstart
acd935ef
FB
864@subsection Quick start for disk image creation
865
866You can create a disk image with the command:
1f47a922 867@example
acd935ef 868qemu-img create myimage.img mysize
1f47a922 869@end example
acd935ef
FB
870where @var{myimage.img} is the disk image filename and @var{mysize} is its
871size in kilobytes. You can add an @code{M} suffix to give the size in
872megabytes and a @code{G} suffix for gigabytes.
873
debc7065 874See @ref{qemu_img_invocation} for more information.
1f47a922 875
debc7065 876@node disk_images_snapshot_mode
1f47a922
FB
877@subsection Snapshot mode
878
879If you use the option @option{-snapshot}, all disk images are
880considered as read only. When sectors in written, they are written in
881a temporary file created in @file{/tmp}. You can however force the
acd935ef
FB
882write back to the raw disk images by using the @code{commit} monitor
883command (or @key{C-a s} in the serial console).
1f47a922 884
acd935ef
FB
885@node qemu_img_invocation
886@subsection @code{qemu-img} Invocation
1f47a922 887
acd935ef 888@include qemu-img.texi
05efe46e 889
debc7065 890@node disk_images_fat_images
2c6cadd4
FB
891@subsection Virtual FAT disk images
892
893QEMU can automatically create a virtual FAT disk image from a
894directory tree. In order to use it, just type:
895
896@example
897qemu linux.img -hdb fat:/my_directory
898@end example
899
900Then you access access to all the files in the @file{/my_directory}
901directory without having to copy them in a disk image or to export
902them via SAMBA or NFS. The default access is @emph{read-only}.
903
904Floppies can be emulated with the @code{:floppy:} option:
905
906@example
907qemu linux.img -fda fat:floppy:/my_directory
908@end example
909
910A read/write support is available for testing (beta stage) with the
911@code{:rw:} option:
912
913@example
914qemu linux.img -fda fat:floppy:rw:/my_directory
915@end example
916
917What you should @emph{never} do:
918@itemize
919@item use non-ASCII filenames ;
920@item use "-snapshot" together with ":rw:" ;
85b2c688
FB
921@item expect it to work when loadvm'ing ;
922@item write to the FAT directory on the host system while accessing it with the guest system.
2c6cadd4
FB
923@end itemize
924
debc7065 925@node pcsys_network
9d4fb82e
FB
926@section Network emulation
927
41d03949
FB
928QEMU can simulate several networks cards (NE2000 boards on the PC
929target) and can connect them to an arbitrary number of Virtual Local
930Area Networks (VLANs). Host TAP devices can be connected to any QEMU
931VLAN. VLAN can be connected between separate instances of QEMU to
932simulate large networks. For simpler usage, a non priviledged user mode
933network stack can replace the TAP device to have a basic network
934connection.
935
936@subsection VLANs
9d4fb82e 937
41d03949
FB
938QEMU simulates several VLANs. A VLAN can be symbolised as a virtual
939connection between several network devices. These devices can be for
940example QEMU virtual Ethernet cards or virtual Host ethernet devices
941(TAP devices).
9d4fb82e 942
41d03949
FB
943@subsection Using TAP network interfaces
944
945This is the standard way to connect QEMU to a real network. QEMU adds
946a virtual network device on your host (called @code{tapN}), and you
947can then configure it as if it was a real ethernet card.
9d4fb82e
FB
948
949As an example, you can download the @file{linux-test-xxx.tar.gz}
950archive and copy the script @file{qemu-ifup} in @file{/etc} and
951configure properly @code{sudo} so that the command @code{ifconfig}
952contained in @file{qemu-ifup} can be executed as root. You must verify
41d03949 953that your host kernel supports the TAP network interfaces: the
9d4fb82e
FB
954device @file{/dev/net/tun} must be present.
955
956See @ref{direct_linux_boot} to have an example of network use with a
41d03949
FB
957Linux distribution and @ref{sec_invocation} to have examples of
958command lines using the TAP network interfaces.
9d4fb82e
FB
959
960@subsection Using the user mode network stack
961
41d03949
FB
962By using the option @option{-net user} (default configuration if no
963@option{-net} option is specified), QEMU uses a completely user mode
964network stack (you don't need root priviledge to use the virtual
965network). The virtual network configuration is the following:
9d4fb82e
FB
966
967@example
968
41d03949
FB
969 QEMU VLAN <------> Firewall/DHCP server <-----> Internet
970 | (10.0.2.2)
9d4fb82e 971 |
2518bd0d
FB
972 ----> DNS server (10.0.2.3)
973 |
974 ----> SMB server (10.0.2.4)
9d4fb82e
FB
975@end example
976
977The QEMU VM behaves as if it was behind a firewall which blocks all
978incoming connections. You can use a DHCP client to automatically
41d03949
FB
979configure the network in the QEMU VM. The DHCP server assign addresses
980to the hosts starting from 10.0.2.15.
9d4fb82e
FB
981
982In order to check that the user mode network is working, you can ping
983the address 10.0.2.2 and verify that you got an address in the range
98410.0.2.x from the QEMU virtual DHCP server.
985
b415a407
FB
986Note that @code{ping} is not supported reliably to the internet as it
987would require root priviledges. It means you can only ping the local
988router (10.0.2.2).
989
9bf05444
FB
990When using the built-in TFTP server, the router is also the TFTP
991server.
992
993When using the @option{-redir} option, TCP or UDP connections can be
994redirected from the host to the guest. It allows for example to
995redirect X11, telnet or SSH connections.
443f1376 996
41d03949
FB
997@subsection Connecting VLANs between QEMU instances
998
999Using the @option{-net socket} option, it is possible to make VLANs
1000that span several QEMU instances. See @ref{sec_invocation} to have a
1001basic example.
1002
9d4fb82e
FB
1003@node direct_linux_boot
1004@section Direct Linux Boot
1f673135
FB
1005
1006This section explains how to launch a Linux kernel inside QEMU without
1007having to make a full bootable image. It is very useful for fast Linux
1008kernel testing. The QEMU network configuration is also explained.
1009
1010@enumerate
1011@item
1012Download the archive @file{linux-test-xxx.tar.gz} containing a Linux
1013kernel and a disk image.
1014
1015@item Optional: If you want network support (for example to launch X11 examples), you
1016must copy the script @file{qemu-ifup} in @file{/etc} and configure
1017properly @code{sudo} so that the command @code{ifconfig} contained in
1018@file{qemu-ifup} can be executed as root. You must verify that your host
1019kernel supports the TUN/TAP network interfaces: the device
1020@file{/dev/net/tun} must be present.
1021
1022When network is enabled, there is a virtual network connection between
1023the host kernel and the emulated kernel. The emulated kernel is seen
1024from the host kernel at IP address 172.20.0.2 and the host kernel is
1025seen from the emulated kernel at IP address 172.20.0.1.
1026
1027@item Launch @code{qemu.sh}. You should have the following output:
1028
debc7065 1029@smallexample
1f673135
FB
1030> ./qemu.sh
1031Connected to host network interface: tun0
debc7065 1032Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
1f673135
FB
1033BIOS-provided physical RAM map:
1034 BIOS-e801: 0000000000000000 - 000000000009f000 (usable)
1035 BIOS-e801: 0000000000100000 - 0000000002000000 (usable)
103632MB LOWMEM available.
1037On node 0 totalpages: 8192
1038zone(0): 4096 pages.
1039zone(1): 4096 pages.
1040zone(2): 0 pages.
debc7065 1041Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe @/ide5=noprobe console=ttyS0
1f673135
FB
1042ide_setup: ide2=noprobe
1043ide_setup: ide3=noprobe
1044ide_setup: ide4=noprobe
1045ide_setup: ide5=noprobe
1046Initializing CPU#0
1047Detected 2399.621 MHz processor.
1048Console: colour EGA 80x25
1049Calibrating delay loop... 4744.80 BogoMIPS
debc7065 1050Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, @/0k highmem)
1f673135
FB
1051Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
1052Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
1053Mount cache hash table entries: 512 (order: 0, 4096 bytes)
1054Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
1055Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
1056CPU: Intel Pentium Pro stepping 03
1057Checking 'hlt' instruction... OK.
1058POSIX conformance testing by UNIFIX
1059Linux NET4.0 for Linux 2.4
1060Based upon Swansea University Computer Society NET3.039
1061Initializing RT netlink socket
1062apm: BIOS not found.
1063Starting kswapd
1064Journalled Block Device driver loaded
1065Detected PS/2 Mouse Port.
1066pty: 256 Unix98 ptys configured
1067Serial driver version 5.05c (2001-07-08) with no serial options enabled
1068ttyS00 at 0x03f8 (irq = 4) is a 16450
fa7cf687 1069ne.c:v1.10 9/23/94 Donald Becker (becker@@scyld.com)
1f673135
FB
1070Last modified Nov 1, 2000 by Paul Gortmaker
1071NE*000 ethercard probe at 0x300: 52 54 00 12 34 56
1072eth0: NE2000 found at 0x300, using IRQ 9.
1073RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
1074Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
1075ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
1076hda: QEMU HARDDISK, ATA DISK drive
1077ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
1078hda: attached ide-disk driver.
1079hda: 20480 sectors (10 MB) w/256KiB Cache, CHS=20/16/63
1080Partition check:
1081 hda:
1082Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996
1083NET4: Linux TCP/IP 1.0 for NET4.0
1084IP Protocols: ICMP, UDP, TCP, IGMP
1085IP: routing cache hash table of 512 buckets, 4Kbytes
1086TCP: Hash tables configured (established 2048 bind 4096)
1087NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
1088EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
1089VFS: Mounted root (ext2 filesystem).
1090Freeing unused kernel memory: 64k freed
1091
debc7065 1092Linux version 2.4.21 (bellard@@voyager.localdomain) (gcc version 3.2.2 20030222 @/(Red Hat @/Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
1f673135
FB
1093
1094QEMU Linux test distribution (based on Redhat 9)
1095
1096Type 'exit' to halt the system
1097
1098sh-2.05b#
debc7065 1099@end smallexample
1f673135
FB
1100
1101@item
1102Then you can play with the kernel inside the virtual serial console. You
1103can launch @code{ls} for example. Type @key{Ctrl-a h} to have an help
1104about the keys you can type inside the virtual serial console. In
1105particular, use @key{Ctrl-a x} to exit QEMU and use @key{Ctrl-a b} as
1106the Magic SysRq key.
1107
1108@item
1109If the network is enabled, launch the script @file{/etc/linuxrc} in the
1110emulator (don't forget the leading dot):
1111@example
1112. /etc/linuxrc
1113@end example
1114
1115Then enable X11 connections on your PC from the emulated Linux:
1116@example
1117xhost +172.20.0.2
1118@end example
1119
1120You can now launch @file{xterm} or @file{xlogo} and verify that you have
1121a real Virtual Linux system !
1122
1123@end enumerate
1124
1125NOTES:
1126@enumerate
1127@item
1128A 2.5.74 kernel is also included in the archive. Just
1129replace the bzImage in qemu.sh to try it.
1130
1f673135
FB
1131@item
1132In order to exit cleanly from qemu, you can do a @emph{shutdown} inside
1133qemu. qemu will automatically exit when the Linux shutdown is done.
1134
1135@item
1136You can boot slightly faster by disabling the probe of non present IDE
1137interfaces. To do so, add the following options on the kernel command
1138line:
1139@example
1140ide1=noprobe ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe
1141@end example
1142
1143@item
1144The example disk image is a modified version of the one made by Kevin
1145Lawton for the plex86 Project (@url{www.plex86.org}).
1146
1147@end enumerate
1148
debc7065 1149@node pcsys_usb
b389dbfb
FB
1150@section USB emulation
1151
0aff66b5
PB
1152QEMU emulates a PCI UHCI USB controller. You can virtually plug
1153virtual USB devices or real host USB devices (experimental, works only
1154on Linux hosts). Qemu will automatically create and connect virtual USB hubs
1155as neccessary to connect multiple USB devices.
b389dbfb 1156
0aff66b5
PB
1157@menu
1158* usb_devices::
1159* host_usb_devices::
1160@end menu
1161@node usb_devices
1162@subsection Connecting USB devices
b389dbfb 1163
0aff66b5
PB
1164USB devices can be connected with the @option{-usbdevice} commandline option
1165or the @code{usb_add} monitor command. Available devices are:
b389dbfb 1166
0aff66b5
PB
1167@table @var
1168@item @code{mouse}
1169Virtual Mouse. This will override the PS/2 mouse emulation when activated.
1170@item @code{tablet}
1171Pointer device that uses abolsute coordinates (like a touchscreen).
1172This means qemu is able to report the mouse position without having
1173to grab the mouse. Also overrides the PS/2 mouse emulation when activated.
1174@item @code{disk:file}
1175Mass storage device based on @var{file} (@pxref{disk_images})
1176@item @code{host:bus.addr}
1177Pass through the host device identified by @var{bus.addr}
1178(Linux only)
1179@item @code{host:vendor_id:product_id}
1180Pass through the host device identified by @var{vendor_id:product_id}
1181(Linux only)
1182@end table
b389dbfb 1183
0aff66b5 1184@node host_usb_devices
b389dbfb
FB
1185@subsection Using host USB devices on a Linux host
1186
1187WARNING: this is an experimental feature. QEMU will slow down when
1188using it. USB devices requiring real time streaming (i.e. USB Video
1189Cameras) are not supported yet.
1190
1191@enumerate
1192@item If you use an early Linux 2.4 kernel, verify that no Linux driver
1193is actually using the USB device. A simple way to do that is simply to
1194disable the corresponding kernel module by renaming it from @file{mydriver.o}
1195to @file{mydriver.o.disabled}.
1196
1197@item Verify that @file{/proc/bus/usb} is working (most Linux distributions should enable it by default). You should see something like that:
1198@example
1199ls /proc/bus/usb
1200001 devices drivers
1201@end example
1202
1203@item Since only root can access to the USB devices directly, you can either launch QEMU as root or change the permissions of the USB devices you want to use. For testing, the following suffices:
1204@example
1205chown -R myuid /proc/bus/usb
1206@end example
1207
1208@item Launch QEMU and do in the monitor:
1209@example
1210info usbhost
1211 Device 1.2, speed 480 Mb/s
1212 Class 00: USB device 1234:5678, USB DISK
1213@end example
1214You should see the list of the devices you can use (Never try to use
1215hubs, it won't work).
1216
1217@item Add the device in QEMU by using:
1218@example
1219usb_add host:1234:5678
1220@end example
1221
1222Normally the guest OS should report that a new USB device is
1223plugged. You can use the option @option{-usbdevice} to do the same.
1224
1225@item Now you can try to use the host USB device in QEMU.
1226
1227@end enumerate
1228
1229When relaunching QEMU, you may have to unplug and plug again the USB
1230device to make it work again (this is a bug).
1231
0806e3f6 1232@node gdb_usage
da415d54
FB
1233@section GDB usage
1234
1235QEMU has a primitive support to work with gdb, so that you can do
0806e3f6 1236'Ctrl-C' while the virtual machine is running and inspect its state.
da415d54 1237
9d4520d0 1238In order to use gdb, launch qemu with the '-s' option. It will wait for a
da415d54
FB
1239gdb connection:
1240@example
debc7065
FB
1241> qemu -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
1242 -append "root=/dev/hda"
da415d54
FB
1243Connected to host network interface: tun0
1244Waiting gdb connection on port 1234
1245@end example
1246
1247Then launch gdb on the 'vmlinux' executable:
1248@example
1249> gdb vmlinux
1250@end example
1251
1252In gdb, connect to QEMU:
1253@example
6c9bf893 1254(gdb) target remote localhost:1234
da415d54
FB
1255@end example
1256
1257Then you can use gdb normally. For example, type 'c' to launch the kernel:
1258@example
1259(gdb) c
1260@end example
1261
0806e3f6
FB
1262Here are some useful tips in order to use gdb on system code:
1263
1264@enumerate
1265@item
1266Use @code{info reg} to display all the CPU registers.
1267@item
1268Use @code{x/10i $eip} to display the code at the PC position.
1269@item
1270Use @code{set architecture i8086} to dump 16 bit code. Then use
294e8637 1271@code{x/10i $cs*16+$eip} to dump the code at the PC position.
0806e3f6
FB
1272@end enumerate
1273
debc7065 1274@node pcsys_os_specific
1a084f3d
FB
1275@section Target OS specific information
1276
1277@subsection Linux
1278
15a34c63
FB
1279To have access to SVGA graphic modes under X11, use the @code{vesa} or
1280the @code{cirrus} X11 driver. For optimal performances, use 16 bit
1281color depth in the guest and the host OS.
1a084f3d 1282
e3371e62
FB
1283When using a 2.6 guest Linux kernel, you should add the option
1284@code{clock=pit} on the kernel command line because the 2.6 Linux
1285kernels make very strict real time clock checks by default that QEMU
1286cannot simulate exactly.
1287
7c3fc84d
FB
1288When using a 2.6 guest Linux kernel, verify that the 4G/4G patch is
1289not activated because QEMU is slower with this patch. The QEMU
1290Accelerator Module is also much slower in this case. Earlier Fedora
1291Core 3 Linux kernel (< 2.6.9-1.724_FC3) were known to incorporte this
1292patch by default. Newer kernels don't have it.
1293
1a084f3d
FB
1294@subsection Windows
1295
1296If you have a slow host, using Windows 95 is better as it gives the
1297best speed. Windows 2000 is also a good choice.
1298
e3371e62
FB
1299@subsubsection SVGA graphic modes support
1300
1301QEMU emulates a Cirrus Logic GD5446 Video
15a34c63
FB
1302card. All Windows versions starting from Windows 95 should recognize
1303and use this graphic card. For optimal performances, use 16 bit color
1304depth in the guest and the host OS.
1a084f3d 1305
3cb0853a
FB
1306If you are using Windows XP as guest OS and if you want to use high
1307resolution modes which the Cirrus Logic BIOS does not support (i.e. >=
13081280x1024x16), then you should use the VESA VBE virtual graphic card
1309(option @option{-std-vga}).
1310
e3371e62
FB
1311@subsubsection CPU usage reduction
1312
1313Windows 9x does not correctly use the CPU HLT
15a34c63
FB
1314instruction. The result is that it takes host CPU cycles even when
1315idle. You can install the utility from
1316@url{http://www.user.cityline.ru/~maxamn/amnhltm.zip} to solve this
1317problem. Note that no such tool is needed for NT, 2000 or XP.
1a084f3d 1318
9d0a8e6f 1319@subsubsection Windows 2000 disk full problem
e3371e62 1320
9d0a8e6f
FB
1321Windows 2000 has a bug which gives a disk full problem during its
1322installation. When installing it, use the @option{-win2k-hack} QEMU
1323option to enable a specific workaround. After Windows 2000 is
1324installed, you no longer need this option (this option slows down the
1325IDE transfers).
e3371e62 1326
6cc721cf
FB
1327@subsubsection Windows 2000 shutdown
1328
1329Windows 2000 cannot automatically shutdown in QEMU although Windows 98
1330can. It comes from the fact that Windows 2000 does not automatically
1331use the APM driver provided by the BIOS.
1332
1333In order to correct that, do the following (thanks to Struan
1334Bartlett): go to the Control Panel => Add/Remove Hardware & Next =>
1335Add/Troubleshoot a device => Add a new device & Next => No, select the
1336hardware from a list & Next => NT Apm/Legacy Support & Next => Next
1337(again) a few times. Now the driver is installed and Windows 2000 now
1338correctly instructs QEMU to shutdown at the appropriate moment.
1339
1340@subsubsection Share a directory between Unix and Windows
1341
1342See @ref{sec_invocation} about the help of the option @option{-smb}.
1343
e3371e62
FB
1344@subsubsection Windows XP security problems
1345
1346Some releases of Windows XP install correctly but give a security
1347error when booting:
1348@example
1349A problem is preventing Windows from accurately checking the
1350license for this computer. Error code: 0x800703e6.
1351@end example
1352The only known workaround is to boot in Safe mode
1353without networking support.
1354
1355Future QEMU releases are likely to correct this bug.
1356
a0a821a4
FB
1357@subsection MS-DOS and FreeDOS
1358
1359@subsubsection CPU usage reduction
1360
1361DOS does not correctly use the CPU HLT instruction. The result is that
1362it takes host CPU cycles even when idle. You can install the utility
1363from @url{http://www.vmware.com/software/dosidle210.zip} to solve this
1364problem.
1365
debc7065 1366@node QEMU System emulator for non PC targets
3f9f3aa1
FB
1367@chapter QEMU System emulator for non PC targets
1368
1369QEMU is a generic emulator and it emulates many non PC
1370machines. Most of the options are similar to the PC emulator. The
1371differences are mentionned in the following sections.
1372
debc7065
FB
1373@menu
1374* QEMU PowerPC System emulator::
1375* Sparc32 System emulator invocation::
1376* Sparc64 System emulator invocation::
1377* MIPS System emulator invocation::
1378* ARM System emulator invocation::
1379@end menu
1380
1381@node QEMU PowerPC System emulator
3f9f3aa1 1382@section QEMU PowerPC System emulator
1a084f3d 1383
15a34c63
FB
1384Use the executable @file{qemu-system-ppc} to simulate a complete PREP
1385or PowerMac PowerPC system.
1a084f3d 1386
b671f9ed 1387QEMU emulates the following PowerMac peripherals:
1a084f3d 1388
15a34c63
FB
1389@itemize @minus
1390@item
1391UniNorth PCI Bridge
1392@item
1393PCI VGA compatible card with VESA Bochs Extensions
1394@item
13952 PMAC IDE interfaces with hard disk and CD-ROM support
1396@item
1397NE2000 PCI adapters
1398@item
1399Non Volatile RAM
1400@item
1401VIA-CUDA with ADB keyboard and mouse.
1a084f3d
FB
1402@end itemize
1403
b671f9ed 1404QEMU emulates the following PREP peripherals:
52c00a5f
FB
1405
1406@itemize @minus
1407@item
15a34c63
FB
1408PCI Bridge
1409@item
1410PCI VGA compatible card with VESA Bochs Extensions
1411@item
52c00a5f
FB
14122 IDE interfaces with hard disk and CD-ROM support
1413@item
1414Floppy disk
1415@item
15a34c63 1416NE2000 network adapters
52c00a5f
FB
1417@item
1418Serial port
1419@item
1420PREP Non Volatile RAM
15a34c63
FB
1421@item
1422PC compatible keyboard and mouse.
52c00a5f
FB
1423@end itemize
1424
15a34c63 1425QEMU uses the Open Hack'Ware Open Firmware Compatible BIOS available at
3f9f3aa1 1426@url{http://perso.magic.fr/l_indien/OpenHackWare/index.htm}.
52c00a5f 1427
15a34c63
FB
1428@c man begin OPTIONS
1429
1430The following options are specific to the PowerPC emulation:
1431
1432@table @option
1433
15a34c63
FB
1434@item -g WxH[xDEPTH]
1435
1436Set the initial VGA graphic mode. The default is 800x600x15.
1437
1438@end table
1439
1440@c man end
1441
1442
52c00a5f 1443More information is available at
3f9f3aa1 1444@url{http://perso.magic.fr/l_indien/qemu-ppc/}.
52c00a5f 1445
debc7065 1446@node Sparc32 System emulator invocation
3f9f3aa1 1447@section Sparc32 System emulator invocation
e80cfcfc 1448
0986ac3b 1449Use the executable @file{qemu-system-sparc} to simulate a SparcStation 5
3475187d 1450(sun4m architecture). The emulation is somewhat complete.
e80cfcfc 1451
b671f9ed 1452QEMU emulates the following sun4m peripherals:
e80cfcfc
FB
1453
1454@itemize @minus
3475187d 1455@item
e80cfcfc
FB
1456IOMMU
1457@item
1458TCX Frame buffer
1459@item
1460Lance (Am7990) Ethernet
1461@item
1462Non Volatile RAM M48T08
1463@item
3475187d
FB
1464Slave I/O: timers, interrupt controllers, Zilog serial ports, keyboard
1465and power/reset logic
1466@item
1467ESP SCSI controller with hard disk and CD-ROM support
1468@item
1469Floppy drive
e80cfcfc
FB
1470@end itemize
1471
3475187d
FB
1472The number of peripherals is fixed in the architecture.
1473
30a604f3 1474Since version 0.8.2, QEMU uses OpenBIOS
0986ac3b
FB
1475@url{http://www.openbios.org/}. OpenBIOS is a free (GPL v2) portable
1476firmware implementation. The goal is to implement a 100% IEEE
14771275-1994 (referred to as Open Firmware) compliant firmware.
3475187d
FB
1478
1479A sample Linux 2.6 series kernel and ram disk image are available on
0986ac3b
FB
1480the QEMU web site. Please note that currently NetBSD, OpenBSD or
1481Solaris kernels don't work.
3475187d
FB
1482
1483@c man begin OPTIONS
1484
1485The following options are specific to the Sparc emulation:
1486
1487@table @option
1488
1489@item -g WxH
1490
1491Set the initial TCX graphic mode. The default is 1024x768.
1492
1493@end table
1494
1495@c man end
1496
debc7065 1497@node Sparc64 System emulator invocation
3f9f3aa1 1498@section Sparc64 System emulator invocation
e80cfcfc 1499
3475187d
FB
1500Use the executable @file{qemu-system-sparc64} to simulate a Sun4u machine.
1501The emulator is not usable for anything yet.
b756921a 1502
83469015
FB
1503QEMU emulates the following sun4u peripherals:
1504
1505@itemize @minus
1506@item
1507UltraSparc IIi APB PCI Bridge
1508@item
1509PCI VGA compatible card with VESA Bochs Extensions
1510@item
1511Non Volatile RAM M48T59
1512@item
1513PC-compatible serial ports
1514@end itemize
1515
debc7065 1516@node MIPS System emulator invocation
3f9f3aa1 1517@section MIPS System emulator invocation
9d0a8e6f
FB
1518
1519Use the executable @file{qemu-system-mips} to simulate a MIPS machine.
3f9f3aa1
FB
1520The emulator is able to boot a Linux kernel and to run a Linux Debian
1521installation from NFS. The following devices are emulated:
1522
1523@itemize @minus
1524@item
1525MIPS R4K CPU
1526@item
1527PC style serial port
1528@item
1529NE2000 network card
1530@end itemize
1531
1532More information is available in the QEMU mailing-list archive.
1533
debc7065 1534@node ARM System emulator invocation
3f9f3aa1
FB
1535@section ARM System emulator invocation
1536
1537Use the executable @file{qemu-system-arm} to simulate a ARM
1538machine. The ARM Integrator/CP board is emulated with the following
1539devices:
1540
1541@itemize @minus
1542@item
ed96ca35 1543ARM926E or ARM1026E CPU
3f9f3aa1
FB
1544@item
1545Two PL011 UARTs
1546@item
1547SMC 91c111 Ethernet adapter
00a9bf19
PB
1548@item
1549PL110 LCD controller
1550@item
1551PL050 KMI with PS/2 keyboard and mouse.
1552@end itemize
1553
1554The ARM Versatile baseboard is emulated with the following devices:
1555
1556@itemize @minus
1557@item
1558ARM926E CPU
1559@item
1560PL190 Vectored Interrupt Controller
1561@item
1562Four PL011 UARTs
1563@item
1564SMC 91c111 Ethernet adapter
1565@item
1566PL110 LCD controller
1567@item
1568PL050 KMI with PS/2 keyboard and mouse.
1569@item
1570PCI host bridge. Note the emulated PCI bridge only provides access to
1571PCI memory space. It does not provide access to PCI IO space.
1572This means some devices (eg. ne2k_pci NIC) are not useable, and others
1573(eg. rtl8139 NIC) are only useable when the guest drivers use the memory
1574mapped control registers.
e6de1bad
PB
1575@item
1576PCI OHCI USB controller.
1577@item
1578LSI53C895A PCI SCSI Host Bus Adapter with hard disk and CD-ROM devices.
3f9f3aa1
FB
1579@end itemize
1580
1581A Linux 2.6 test image is available on the QEMU web site. More
1582information is available in the QEMU mailing-list archive.
9d0a8e6f 1583
debc7065 1584@node QEMU Linux User space emulator
3f9f3aa1 1585@chapter QEMU Linux User space emulator
386405f7 1586
debc7065
FB
1587@menu
1588* Quick Start::
1589* Wine launch::
1590* Command line options::
79737e4a 1591* Other binaries::
debc7065
FB
1592@end menu
1593
1594@node Quick Start
1f673135 1595@section Quick Start
df0f11a0 1596
1f673135
FB
1597In order to launch a Linux process, QEMU needs the process executable
1598itself and all the target (x86) dynamic libraries used by it.
386405f7 1599
1f673135 1600@itemize
386405f7 1601
1f673135
FB
1602@item On x86, you can just try to launch any process by using the native
1603libraries:
386405f7 1604
1f673135
FB
1605@example
1606qemu-i386 -L / /bin/ls
1607@end example
386405f7 1608
1f673135
FB
1609@code{-L /} tells that the x86 dynamic linker must be searched with a
1610@file{/} prefix.
386405f7 1611
1f673135 1612@item Since QEMU is also a linux process, you can launch qemu with qemu (NOTE: you can only do that if you compiled QEMU from the sources):
386405f7 1613
1f673135
FB
1614@example
1615qemu-i386 -L / qemu-i386 -L / /bin/ls
1616@end example
386405f7 1617
1f673135
FB
1618@item On non x86 CPUs, you need first to download at least an x86 glibc
1619(@file{qemu-runtime-i386-XXX-.tar.gz} on the QEMU web page). Ensure that
1620@code{LD_LIBRARY_PATH} is not set:
df0f11a0 1621
1f673135
FB
1622@example
1623unset LD_LIBRARY_PATH
1624@end example
1eb87257 1625
1f673135 1626Then you can launch the precompiled @file{ls} x86 executable:
1eb87257 1627
1f673135
FB
1628@example
1629qemu-i386 tests/i386/ls
1630@end example
1631You can look at @file{qemu-binfmt-conf.sh} so that
1632QEMU is automatically launched by the Linux kernel when you try to
1633launch x86 executables. It requires the @code{binfmt_misc} module in the
1634Linux kernel.
1eb87257 1635
1f673135
FB
1636@item The x86 version of QEMU is also included. You can try weird things such as:
1637@example
debc7065
FB
1638qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \
1639 /usr/local/qemu-i386/bin/ls-i386
1f673135 1640@end example
1eb20527 1641
1f673135 1642@end itemize
1eb20527 1643
debc7065 1644@node Wine launch
1f673135 1645@section Wine launch
1eb20527 1646
1f673135 1647@itemize
386405f7 1648
1f673135
FB
1649@item Ensure that you have a working QEMU with the x86 glibc
1650distribution (see previous section). In order to verify it, you must be
1651able to do:
386405f7 1652
1f673135
FB
1653@example
1654qemu-i386 /usr/local/qemu-i386/bin/ls-i386
1655@end example
386405f7 1656
1f673135
FB
1657@item Download the binary x86 Wine install
1658(@file{qemu-XXX-i386-wine.tar.gz} on the QEMU web page).
386405f7 1659
1f673135 1660@item Configure Wine on your account. Look at the provided script
debc7065 1661@file{/usr/local/qemu-i386/@/bin/wine-conf.sh}. Your previous
1f673135 1662@code{$@{HOME@}/.wine} directory is saved to @code{$@{HOME@}/.wine.org}.
386405f7 1663
1f673135 1664@item Then you can try the example @file{putty.exe}:
386405f7 1665
1f673135 1666@example
debc7065
FB
1667qemu-i386 /usr/local/qemu-i386/wine/bin/wine \
1668 /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe
1f673135 1669@end example
386405f7 1670
1f673135 1671@end itemize
fd429f2f 1672
debc7065 1673@node Command line options
1f673135 1674@section Command line options
1eb20527 1675
1f673135
FB
1676@example
1677usage: qemu-i386 [-h] [-d] [-L path] [-s size] program [arguments...]
1678@end example
1eb20527 1679
1f673135
FB
1680@table @option
1681@item -h
1682Print the help
1683@item -L path
1684Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)
1685@item -s size
1686Set the x86 stack size in bytes (default=524288)
386405f7
FB
1687@end table
1688
1f673135 1689Debug options:
386405f7 1690
1f673135
FB
1691@table @option
1692@item -d
1693Activate log (logfile=/tmp/qemu.log)
1694@item -p pagesize
1695Act as if the host page size was 'pagesize' bytes
1696@end table
386405f7 1697
79737e4a
PB
1698@node Other binaries
1699@section Other binaries
1700
1701@command{qemu-arm} is also capable of running ARM "Angel" semihosted ELF
1702binaries (as implemented by the arm-elf and arm-eabi Newlib/GDB
1703configurations), and arm-uclinux bFLT format binaries.
1704
1705The binary format is detected automatically.
1706
15a34c63
FB
1707@node compilation
1708@chapter Compilation from the sources
1709
debc7065
FB
1710@menu
1711* Linux/Unix::
1712* Windows::
1713* Cross compilation for Windows with Linux::
1714* Mac OS X::
1715@end menu
1716
1717@node Linux/Unix
7c3fc84d
FB
1718@section Linux/Unix
1719
1720@subsection Compilation
1721
1722First you must decompress the sources:
1723@example
1724cd /tmp
1725tar zxvf qemu-x.y.z.tar.gz
1726cd qemu-x.y.z
1727@end example
1728
1729Then you configure QEMU and build it (usually no options are needed):
1730@example
1731./configure
1732make
1733@end example
1734
1735Then type as root user:
1736@example
1737make install
1738@end example
1739to install QEMU in @file{/usr/local}.
1740
7c3fc84d
FB
1741@subsection Tested tool versions
1742
1743In order to compile QEMU succesfully, it is very important that you
1744have the right tools. The most important one is gcc. I cannot guaranty
1745that QEMU works if you do not use a tested gcc version. Look at
1746'configure' and 'Makefile' if you want to make a different gcc
1747version work.
1748
1749@example
1750host gcc binutils glibc linux distribution
1751----------------------------------------------------------------------
1752x86 3.2 2.13.2 2.1.3 2.4.18
1753 2.96 2.11.93.0.2 2.2.5 2.4.18 Red Hat 7.3
1754 3.2.2 2.13.90.0.18 2.3.2 2.4.20 Red Hat 9
1755
1756PowerPC 3.3 [4] 2.13.90.0.18 2.3.1 2.4.20briq
1757 3.2
1758
1759Alpha 3.3 [1] 2.14.90.0.4 2.2.5 2.2.20 [2] Debian 3.0
1760
1761Sparc32 2.95.4 2.12.90.0.1 2.2.5 2.4.18 Debian 3.0
1762
1763ARM 2.95.4 2.12.90.0.1 2.2.5 2.4.9 [3] Debian 3.0
1764
1765[1] On Alpha, QEMU needs the gcc 'visibility' attribute only available
1766 for gcc version >= 3.3.
1767[2] Linux >= 2.4.20 is necessary for precise exception support
1768 (untested).
1769[3] 2.4.9-ac10-rmk2-np1-cerf2
1770
1771[4] gcc 2.95.x generates invalid code when using too many register
1772variables. You must use gcc 3.x on PowerPC.
1773@end example
15a34c63 1774
debc7065 1775@node Windows
15a34c63
FB
1776@section Windows
1777
1778@itemize
1779@item Install the current versions of MSYS and MinGW from
1780@url{http://www.mingw.org/}. You can find detailed installation
1781instructions in the download section and the FAQ.
1782
1783@item Download
1784the MinGW development library of SDL 1.2.x
debc7065 1785(@file{SDL-devel-1.2.x-@/mingw32.tar.gz}) from
15a34c63
FB
1786@url{http://www.libsdl.org}. Unpack it in a temporary place, and
1787unpack the archive @file{i386-mingw32msvc.tar.gz} in the MinGW tool
1788directory. Edit the @file{sdl-config} script so that it gives the
1789correct SDL directory when invoked.
1790
1791@item Extract the current version of QEMU.
1792
1793@item Start the MSYS shell (file @file{msys.bat}).
1794
1795@item Change to the QEMU directory. Launch @file{./configure} and
1796@file{make}. If you have problems using SDL, verify that
1797@file{sdl-config} can be launched from the MSYS command line.
1798
1799@item You can install QEMU in @file{Program Files/Qemu} by typing
1800@file{make install}. Don't forget to copy @file{SDL.dll} in
1801@file{Program Files/Qemu}.
1802
1803@end itemize
1804
debc7065 1805@node Cross compilation for Windows with Linux
15a34c63
FB
1806@section Cross compilation for Windows with Linux
1807
1808@itemize
1809@item
1810Install the MinGW cross compilation tools available at
1811@url{http://www.mingw.org/}.
1812
1813@item
1814Install the Win32 version of SDL (@url{http://www.libsdl.org}) by
1815unpacking @file{i386-mingw32msvc.tar.gz}. Set up the PATH environment
1816variable so that @file{i386-mingw32msvc-sdl-config} can be launched by
1817the QEMU configuration script.
1818
1819@item
1820Configure QEMU for Windows cross compilation:
1821@example
1822./configure --enable-mingw32
1823@end example
1824If necessary, you can change the cross-prefix according to the prefix
1825choosen for the MinGW tools with --cross-prefix. You can also use
1826--prefix to set the Win32 install path.
1827
1828@item You can install QEMU in the installation directory by typing
1829@file{make install}. Don't forget to copy @file{SDL.dll} in the
1830installation directory.
1831
1832@end itemize
1833
1834Note: Currently, Wine does not seem able to launch
1835QEMU for Win32.
1836
debc7065 1837@node Mac OS X
15a34c63
FB
1838@section Mac OS X
1839
1840The Mac OS X patches are not fully merged in QEMU, so you should look
1841at the QEMU mailing list archive to have all the necessary
1842information.
1843
debc7065
FB
1844@node Index
1845@chapter Index
1846@printindex cp
1847
1848@bye