QEMU full system emulation features:
@itemize
-@item Using mmap() system calls to simulate the MMU
+@item QEMU can either use a full software MMU for maximum portability or use the host system call mmap() to simulate the target MMU.
@end itemize
@section x86 emulation
10 byte @code{long double}s of x86 for floating point emulation to get
maximum performances.
-@item Full system emulation only works if no data are mapped above the virtual address
-0xc0000000 (yet).
-
-@item Some priviledged instructions or behaviors are missing. Only the ones
-needed for proper Linux kernel operation are emulated.
-
-@item No memory separation between the kernel and the user processes is done.
-It will be implemented very soon.
+@item Some priviledged instructions or behaviors are missing, especially for segment protection testing (yet).
@end itemize
The SPARC emulation is currently in development.
+@chapter Installation
+
+If you want to compile QEMU, please read the @file{README} which gives
+the related information. Otherwise just download the binary
+distribution (@file{qemu-XXX-i386.tar.gz}) and untar it as root in
+@file{/}:
+
+@example
+su
+cd /
+tar zxvf /tmp/qemu-XXX-i386.tar.gz
+@end example
+
@chapter QEMU User space emulator invocation
@section Quick Start
-If you need to compile QEMU, please read the @file{README} which gives
-the related information.
-
In order to launch a Linux process, QEMU needs the process executable
itself and all the target (x86) dynamic libraries used by it.
@code{-L /} tells that the x86 dynamic linker must be searched with a
@file{/} prefix.
-@item Since QEMU is also a linux process, you can launch qemu with qemu:
+@item Since QEMU is also a linux process, you can launch qemu with qemu (NOTE: you can only do that if you compiled QEMU from the sources):
@example
qemu-i386 -L / qemu-i386 -L / /bin/ls
@end example
@item On non x86 CPUs, you need first to download at least an x86 glibc
-(@file{qemu-XXX-i386-glibc21.tar.gz} on the QEMU web page). Ensure that
+(@file{qemu-runtime-i386-XXX-.tar.gz} on the QEMU web page). Ensure that
@code{LD_LIBRARY_PATH} is not set:
@example
Then you can launch the precompiled @file{ls} x86 executable:
@example
-qemu-i386 /usr/local/qemu-i386/bin/ls-i386
+qemu-i386 tests/i386/ls
@end example
-You can look at @file{/usr/local/qemu-i386/bin/qemu-conf.sh} so that
+You can look at @file{qemu-binfmt-conf.sh} so that
QEMU is automatically launched by the Linux kernel when you try to
launch x86 executables. It requires the @code{binfmt_misc} module in the
Linux kernel.
@enumerate
@item
-@code{qemu} uses the host Memory Management Unit (MMU) to simulate
+@code{qemu-fast} uses the host Memory Management Unit (MMU) to simulate
the x86 MMU. It is @emph{fast} but has limitations because the whole 4 GB
address space cannot be used and some memory mapped peripherials
cannot be emulated accurately yet. Therefore, a specific Linux kernel
must be used (@xref{linux_compile}).
@item
-@code{qemu-softmmu} uses a software MMU. It is about @emph{two times
-slower} but gives a more accurate emulation. (XXX: Linux cannot be ran
-unpatched yet).
+@code{qemu} uses a software MMU. It is about @emph{two times
+slower} but gives a more accurate emulation.
@end enumerate
@item
PS/2 mouse and keyboard
@item
-IDE disk interface (port=0x1f0, irq=14)
+2 IDE interfaces with hard disk and CD-ROM support
@item
NE2000 network adapter (port=0x300, irq=9)
@item
-Serial port (port=0x3f8, irq=4)
+Serial port
+@item
+Soundblaster 16 card
@item
PIC (interrupt controler)
@item
@section Quick Start
-Download the linux image (@file{linux.img}) and type:
+Download and uncompress the linux image (@file{linux.img}) and type:
@example
-qemu-softmmu linux.img
+qemu linux.img
@end example
Linux should boot and give you a prompt.
@example
> ./qemu.sh
-connected to host network interface: tun0
-Uncompressing Linux... Ok, booting the kernel.
-Linux version 2.4.20 (fabrice@localhost.localdomain) (gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110)) #22 lun jui 7 13:37:41 CEST 2003
+Connected to host network interface: tun0
+Linux version 2.4.21 (bellard@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
BIOS-provided physical RAM map:
BIOS-e801: 0000000000000000 - 000000000009f000 (usable)
BIOS-e801: 0000000000100000 - 0000000002000000 (usable)
zone(0): 4096 pages.
zone(1): 4096 pages.
zone(2): 0 pages.
-Kernel command line: root=/dev/hda ide1=noprobe ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe
-ide_setup: ide1=noprobe
+Kernel command line: root=/dev/hda sb=0x220,5,1,5 ide2=noprobe ide3=noprobe ide4=noprobe ide5=noprobe console=ttyS0
ide_setup: ide2=noprobe
ide_setup: ide3=noprobe
ide_setup: ide4=noprobe
ide_setup: ide5=noprobe
Initializing CPU#0
-Detected 501.285 MHz processor.
-Calibrating delay loop... 989.59 BogoMIPS
-Memory: 29268k/32768k available (907k kernel code, 3112k reserved, 212k data, 52k init, 0k highmem)
+Detected 2399.621 MHz processor.
+Console: colour EGA 80x25
+Calibrating delay loop... 4744.80 BogoMIPS
+Memory: 28872k/32768k available (1210k kernel code, 3508k reserved, 266k data, 64k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
-Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
+Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Intel Pentium Pro stepping 03
apm: BIOS not found.
Starting kswapd
Journalled Block Device driver loaded
+Detected PS/2 Mouse Port.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0x03f8 (irq = 4) is a 16450
-Uniform Multi-Platform E-IDE driver Revision: 6.31
-ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
-hda: QEMU HARDDISK, ATA DISK drive
-ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
-hda: 12288 sectors (6 MB) w/256KiB Cache, CHS=12/16/63
-Partition check:
- hda: unknown partition table
ne.c:v1.10 9/23/94 Donald Becker (becker@scyld.com)
Last modified Nov 1, 2000 by Paul Gortmaker
NE*000 ethercard probe at 0x300: 52 54 00 12 34 56
eth0: NE2000 found at 0x300, using IRQ 9.
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
+Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
+ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
+hda: QEMU HARDDISK, ATA DISK drive
+ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
+hda: attached ide-disk driver.
+hda: 20480 sectors (10 MB) w/256KiB Cache, CHS=20/16/63
+Partition check:
+ hda:
+Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
-Freeing unused kernel memory: 52k freed
-sh: can't access tty; job control turned off
-#
+Freeing unused kernel memory: 64k freed
+
+Linux version 2.4.21 (bellard@voyager.localdomain) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #5 Tue Nov 11 18:18:53 CET 2003
+
+QEMU Linux test distribution (based on Redhat 9)
+
+Type 'exit' to halt the system
+
+sh-2.05b#
@end example
@item
replace the bzImage in qemu.sh to try it.
@item
-vl creates a temporary file in @var{$QEMU_TMPDIR} (@file{/tmp} is the
+qemu creates a temporary file in @var{$QEMU_TMPDIR} (@file{/tmp} is the
default) containing all the simulated PC memory. If possible, try to use
a temporary directory using the tmpfs filesystem to avoid too many
unnecessary disk accesses.
@item
-In order to exit cleanly for vl, you can do a @emph{shutdown} inside
-vl. vl will automatically exit when the Linux shutdown is done.
+In order to exit cleanly from qemu, you can do a @emph{shutdown} inside
+qemu. qemu will automatically exit when the Linux shutdown is done.
@item
You can boot slightly faster by disabling the probe of non present IDE
@end example
@c man begin OPTIONS
-@var{disk_image} is a raw hard image image for IDE hard disk 0.
+@var{disk_image} is a raw hard disk image for IDE hard disk 0.
General options:
@table @option
@item -hda file
@item -hdb file
-Use @var{file} as hard disk 0 or 1 image (@xref{disk_images}).
+@item -hdc file
+@item -hdd file
+Use @var{file} as hard disk 0, 1, 2 or 3 image (@xref{disk_images}).
-@item -snapshot
+@item -cdrom file
+Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and and
+@option{-cdrom} at the same time).
+
+@item -boot [c|d]
+Boot on hard disk (c) or CD-ROM (d). Hard disk boot is the default.
+@item -snapshot
Write to temporary files instead of disk image files. In this case,
the raw disk image you use is not written back. You can however force
the write back by pressing @key{C-a s} (@xref{disk_images}).
Set virtual RAM size to @var{megs} megabytes.
@item -n script
-Set network init script [default=/etc/vl-ifup]. This script is
+Set network init script [default=/etc/qemu-ifup]. This script is
launched to configure the host network interface (usually tun0)
corresponding to the virtual NE2000 card.
@item -p port
Change gdb connection port.
@item -d
-Output log in /tmp/vl.log
+Output log in /tmp/qemu.log
@end table
During emulation, use @key{C-a h} to get terminal commands:
@node linux_compile
@section Linux Kernel Compilation
-You should be able to use any kernel with QEMU provided you make the
-following changes (only 2.4.x and 2.5.x were tested):
+You can use any linux kernel with QEMU. However, if you want to use
+@code{qemu-fast} to get maximum performances, you should make the
+following changes to the Linux kernel (only 2.4.x and 2.5.x were
+tested):
@enumerate
@item
QEMU has a primitive support to work with gdb, so that you can do
'Ctrl-C' while the virtual machine is running and inspect its state.
-In order to use gdb, launch vl with the '-s' option. It will wait for a
+In order to use gdb, launch qemu with the '-s' option. It will wait for a
gdb connection:
@example
-> vl -s arch/i386/boot/bzImage -hda root-2.4.20.img root=/dev/hda
+> qemu -s arch/i386/boot/bzImage -hda root-2.4.20.img root=/dev/hda
Connected to host network interface: tun0
Waiting gdb connection on port 1234
@end example
(gdb) c
@end example
-WARNING: breakpoints and single stepping are not yet supported.
-
Here are some useful tips in order to use gdb on system code:
@enumerate
In the directory @file{tests/}, various interesting testing programs
are available. There are used for regression testing.
-@section @file{hello-i386}
-
-Very simple statically linked x86 program, just to test QEMU during a
-port to a new host CPU.
-
-@section @file{hello-arm}
-
-Very simple statically linked ARM program, just to test QEMU during a
-port to a new host CPU.
-
@section @file{test-i386}
This program executes most of the 16 bit and 32 bit x86 instructions and
Various exceptions are raised to test most of the x86 user space
exception reporting.
+@section @file{linux-test}
+
+This program tests various Linux system calls. It is used to verify
+that the system call parameters are correctly converted between target
+and host CPUs.
+
+@section @file{hello-i386}
+
+Very simple statically linked x86 program, just to test QEMU during a
+port to a new host CPU.
+
+@section @file{hello-arm}
+
+Very simple statically linked ARM program, just to test QEMU during a
+port to a new host CPU.
+
@section @file{sha1}
It is a simple benchmark. Care must be taken to interpret the results
projects / qemu / blobdiff