Commit 0806e3f66f1fbc924741246716ef75272715543a
1 parent
39b4da28
updated
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@401 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
2 changed files
with
170 additions
and
52 deletions
Changelog
| ... | ... | @@ -6,13 +6,18 @@ version 0.4.4: |
| 6 | 6 | - popw (%esp) fix |
| 7 | 7 | - mov to/from segment data width fix |
| 8 | 8 | - added real mode support |
| 9 | - - added Bochs BIOS and LGPL'ed VGA BIOS loader in vl | |
| 9 | + - added Bochs BIOS and LGPL'ed VGA BIOS loader in qemu | |
| 10 | 10 | - m68k host port (Richard Zidlicky) |
| 11 | 11 | - partial soft MMU support for memory mapped I/Os |
| 12 | 12 | - multi-target build |
| 13 | 13 | - fixed: no error code in hardware interrupts |
| 14 | 14 | - fixed: pop ss, mov ss, x and sti disable hardware irqs for the next insn |
| 15 | 15 | - correct single stepping thru string operations |
| 16 | + - preliminary SPARC target support (Thomas M. Ogrisegg) | |
| 17 | + - tun-fd option (Rusty Russell) | |
| 18 | + - automatic IDE geometry detection | |
| 19 | + - renamed 'vl' to qemu and user qemu to qemu-{cpu}. | |
| 20 | + - added man page | |
| 16 | 21 | |
| 17 | 22 | version 0.4.3: |
| 18 | 23 | ... | ... |
qemu-doc.texi
| 1 | 1 | \input texinfo @c -*- texinfo -*- |
| 2 | 2 | |
| 3 | +@iftex | |
| 3 | 4 | @settitle QEMU CPU Emulator Reference Documentation |
| 4 | 5 | @titlepage |
| 5 | 6 | @sp 7 |
| 6 | 7 | @center @titlefont{QEMU CPU Emulator Reference Documentation} |
| 7 | 8 | @sp 3 |
| 8 | 9 | @end titlepage |
| 10 | +@end iftex | |
| 9 | 11 | |
| 10 | 12 | @chapter Introduction |
| 11 | 13 | |
| ... | ... | @@ -16,14 +18,18 @@ achieves a reasonnable speed while being easy to port on new host |
| 16 | 18 | CPUs. |
| 17 | 19 | |
| 18 | 20 | QEMU has two operating modes: |
| 19 | -@itemize | |
| 20 | -@item User mode emulation. In this mode, QEMU can launch Linux processes | |
| 21 | + | |
| 22 | +@itemize @minus | |
| 23 | + | |
| 24 | +@item | |
| 25 | +User mode emulation. In this mode, QEMU can launch Linux processes | |
| 21 | 26 | compiled for one CPU on another CPU. Linux system calls are converted |
| 22 | 27 | because of endianness and 32/64 bit mismatches. The Wine Windows API |
| 23 | 28 | emulator (@url{http://www.winehq.org}) and the DOSEMU DOS emulator |
| 24 | 29 | (@url{www.dosemu.org}) are the main targets for QEMU. |
| 25 | 30 | |
| 26 | -@item Full system emulation. In this mode, QEMU emulates a full | |
| 31 | +@item | |
| 32 | +Full system emulation. In this mode, QEMU emulates a full | |
| 27 | 33 | system, including a processor and various peripherials. Currently, it |
| 28 | 34 | is only used to launch an x86 Linux kernel on an x86 Linux system. It |
| 29 | 35 | enables easier testing and debugging of system code. It can also be |
| ... | ... | @@ -128,6 +134,10 @@ generic dynamic code generation architecture of QEMU. |
| 128 | 134 | |
| 129 | 135 | @end itemize |
| 130 | 136 | |
| 137 | +@section SPARC emulation | |
| 138 | + | |
| 139 | +The SPARC emulation is currently in development. | |
| 140 | + | |
| 131 | 141 | @chapter QEMU User space emulator invocation |
| 132 | 142 | |
| 133 | 143 | @section Quick Start |
| ... | ... | @@ -144,7 +154,7 @@ itself and all the target (x86) dynamic libraries used by it. |
| 144 | 154 | libraries: |
| 145 | 155 | |
| 146 | 156 | @example |
| 147 | -qemu -L / /bin/ls | |
| 157 | +qemu-i386 -L / /bin/ls | |
| 148 | 158 | @end example |
| 149 | 159 | |
| 150 | 160 | @code{-L /} tells that the x86 dynamic linker must be searched with a |
| ... | ... | @@ -153,7 +163,7 @@ qemu -L / /bin/ls |
| 153 | 163 | @item Since QEMU is also a linux process, you can launch qemu with qemu: |
| 154 | 164 | |
| 155 | 165 | @example |
| 156 | -qemu -L / qemu -L / /bin/ls | |
| 166 | +qemu-i386 -L / qemu-i386 -L / /bin/ls | |
| 157 | 167 | @end example |
| 158 | 168 | |
| 159 | 169 | @item On non x86 CPUs, you need first to download at least an x86 glibc |
| ... | ... | @@ -167,7 +177,7 @@ unset LD_LIBRARY_PATH |
| 167 | 177 | Then you can launch the precompiled @file{ls} x86 executable: |
| 168 | 178 | |
| 169 | 179 | @example |
| 170 | -qemu /usr/local/qemu-i386/bin/ls-i386 | |
| 180 | +qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | |
| 171 | 181 | @end example |
| 172 | 182 | You can look at @file{/usr/local/qemu-i386/bin/qemu-conf.sh} so that |
| 173 | 183 | QEMU is automatically launched by the Linux kernel when you try to |
| ... | ... | @@ -176,7 +186,7 @@ Linux kernel. |
| 176 | 186 | |
| 177 | 187 | @item The x86 version of QEMU is also included. You can try weird things such as: |
| 178 | 188 | @example |
| 179 | -qemu /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | |
| 189 | +qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | |
| 180 | 190 | @end example |
| 181 | 191 | |
| 182 | 192 | @end itemize |
| ... | ... | @@ -190,7 +200,7 @@ distribution (see previous section). In order to verify it, you must be |
| 190 | 200 | able to do: |
| 191 | 201 | |
| 192 | 202 | @example |
| 193 | -qemu /usr/local/qemu-i386/bin/ls-i386 | |
| 203 | +qemu-i386 /usr/local/qemu-i386/bin/ls-i386 | |
| 194 | 204 | @end example |
| 195 | 205 | |
| 196 | 206 | @item Download the binary x86 Wine install |
| ... | ... | @@ -203,7 +213,7 @@ qemu /usr/local/qemu-i386/bin/ls-i386 |
| 203 | 213 | @item Then you can try the example @file{putty.exe}: |
| 204 | 214 | |
| 205 | 215 | @example |
| 206 | -qemu /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | |
| 216 | +qemu-i386 /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe | |
| 207 | 217 | @end example |
| 208 | 218 | |
| 209 | 219 | @end itemize |
| ... | ... | @@ -211,7 +221,7 @@ qemu /usr/local/qemu-i386/wine/bin/wine /usr/local/qemu-i386/wine/c/Program\ Fil |
| 211 | 221 | @section Command line options |
| 212 | 222 | |
| 213 | 223 | @example |
| 214 | -usage: qemu [-h] [-d] [-L path] [-s size] program [arguments...] | |
| 224 | +usage: qemu-i386 [-h] [-d] [-L path] [-s size] program [arguments...] | |
| 215 | 225 | @end example |
| 216 | 226 | |
| 217 | 227 | @table @option |
| ... | ... | @@ -234,20 +244,81 @@ Act as if the host page size was 'pagesize' bytes |
| 234 | 244 | |
| 235 | 245 | @chapter QEMU System emulator invocation |
| 236 | 246 | |
| 247 | +@section Introduction | |
| 248 | + | |
| 249 | +@c man begin DESCRIPTION | |
| 250 | + | |
| 251 | +The QEMU System emulator simulates a complete PC. It can either boot | |
| 252 | +directly a Linux kernel (without any BIOS or boot loader) or boot like a | |
| 253 | +real PC with the included BIOS. | |
| 254 | + | |
| 255 | +In order to meet specific user needs, two versions of QEMU are | |
| 256 | +available: | |
| 257 | + | |
| 258 | +@enumerate | |
| 259 | + | |
| 260 | +@item | |
| 261 | +@code{qemu} uses the host Memory Management Unit (MMU) to simulate | |
| 262 | +the x86 MMU. It is @emph{fast} but has limitations because the whole 4 GB | |
| 263 | +address space cannot be used and some memory mapped peripherials | |
| 264 | +cannot be emulated accurately yet. Therefore, a specific Linux kernel | |
| 265 | +must be used (@xref{linux_compile}). | |
| 266 | + | |
| 267 | +@item | |
| 268 | +@code{qemu-softmmu} uses a software MMU. It is about @emph{two times | |
| 269 | +slower} but gives a more accurate emulation. (XXX: Linux cannot be ran | |
| 270 | +unpatched yet). | |
| 271 | + | |
| 272 | +@end enumerate | |
| 273 | + | |
| 274 | +QEMU emulates the following PC peripherials: | |
| 275 | + | |
| 276 | +@itemize @minus | |
| 277 | +@item | |
| 278 | +VGA (hardware level, including all non standard modes) | |
| 279 | +@item | |
| 280 | +PS/2 mouse and keyboard | |
| 281 | +@item | |
| 282 | +IDE disk interface (port=0x1f0, irq=14) | |
| 283 | +@item | |
| 284 | +NE2000 network adapter (port=0x300, irq=9) | |
| 285 | +@item | |
| 286 | +Serial port (port=0x3f8, irq=4) | |
| 287 | +@item | |
| 288 | +PIC (interrupt controler) | |
| 289 | +@item | |
| 290 | +PIT (timers) | |
| 291 | +@item | |
| 292 | +CMOS memory | |
| 293 | +@end itemize | |
| 294 | + | |
| 295 | +@c man end | |
| 296 | + | |
| 237 | 297 | @section Quick Start |
| 238 | 298 | |
| 239 | -This section explains how to launch a Linux kernel inside QEMU. | |
| 299 | +Download the linux image (@file{linux.img}) and type: | |
| 300 | + | |
| 301 | +@example | |
| 302 | +qemu-softmmu linux.img | |
| 303 | +@end example | |
| 304 | + | |
| 305 | +Linux should boot and give you a prompt. | |
| 306 | + | |
| 307 | +@section Direct Linux Boot and Network emulation | |
| 308 | + | |
| 309 | +This section explains how to launch a Linux kernel inside QEMU without | |
| 310 | +having to make a full bootable image. It is very useful for fast Linux | |
| 311 | +kernel testing. The QEMU network configuration is also explained. | |
| 240 | 312 | |
| 241 | 313 | @enumerate |
| 242 | 314 | @item |
| 243 | -Download the archive @file{vl-test-xxx.tar.gz} containing a Linux | |
| 244 | -kernel and a disk image. The archive also contains a precompiled | |
| 245 | -version of @file{vl}, the QEMU System emulator. | |
| 315 | +Download the archive @file{linux-test-xxx.tar.gz} containing a Linux | |
| 316 | +kernel and a disk image. | |
| 246 | 317 | |
| 247 | 318 | @item Optional: If you want network support (for example to launch X11 examples), you |
| 248 | -must copy the script @file{vl-ifup} in @file{/etc} and configure | |
| 319 | +must copy the script @file{qemu-ifup} in @file{/etc} and configure | |
| 249 | 320 | properly @code{sudo} so that the command @code{ifconfig} contained in |
| 250 | -@file{vl-ifup} can be executed as root. You must verify that your host | |
| 321 | +@file{qemu-ifup} can be executed as root. You must verify that your host | |
| 251 | 322 | kernel supports the TUN/TAP network interfaces: the device |
| 252 | 323 | @file{/dev/net/tun} must be present. |
| 253 | 324 | |
| ... | ... | @@ -256,10 +327,10 @@ the host kernel and the emulated kernel. The emulated kernel is seen |
| 256 | 327 | from the host kernel at IP address 172.20.0.2 and the host kernel is |
| 257 | 328 | seen from the emulated kernel at IP address 172.20.0.1. |
| 258 | 329 | |
| 259 | -@item Launch @code{vl.sh}. You should have the following output: | |
| 330 | +@item Launch @code{qemu.sh}. You should have the following output: | |
| 260 | 331 | |
| 261 | 332 | @example |
| 262 | -> ./vl.sh | |
| 333 | +> ./qemu.sh | |
| 263 | 334 | connected to host network interface: tun0 |
| 264 | 335 | Uncompressing Linux... Ok, booting the kernel. |
| 265 | 336 | Linux version 2.4.20 (fabrice@localhost.localdomain) (gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110)) #22 lun jui 7 13:37:41 CEST 2003 |
| ... | ... | @@ -349,11 +420,11 @@ a real Virtual Linux system ! |
| 349 | 420 | NOTES: |
| 350 | 421 | @enumerate |
| 351 | 422 | @item |
| 352 | -A 2.5.74 kernel is also included in the vl-test archive. Just | |
| 353 | -replace the bzImage in vl.sh to try it. | |
| 423 | +A 2.5.74 kernel is also included in the archive. Just | |
| 424 | +replace the bzImage in qemu.sh to try it. | |
| 354 | 425 | |
| 355 | 426 | @item |
| 356 | -vl creates a temporary file in @var{$VLTMPDIR} (@file{/tmp} is the | |
| 427 | +vl creates a temporary file in @var{$QEMU_TMPDIR} (@file{/tmp} is the | |
| 357 | 428 | default) containing all the simulated PC memory. If possible, try to use |
| 358 | 429 | a temporary directory using the tmpfs filesystem to avoid too many |
| 359 | 430 | unnecessary disk accesses. |
| ... | ... | @@ -379,16 +450,19 @@ Lawton for the plex86 Project (@url{www.plex86.org}). |
| 379 | 450 | @section Invocation |
| 380 | 451 | |
| 381 | 452 | @example |
| 382 | -usage: vl [options] bzImage [kernel parameters...] | |
| 453 | +@c man begin SYNOPSIS | |
| 454 | +usage: qemu [options] [disk_image] | |
| 455 | +@c man end | |
| 383 | 456 | @end example |
| 384 | 457 | |
| 385 | -@file{bzImage} is a Linux kernel image. | |
| 458 | +@c man begin OPTIONS | |
| 459 | +@var{disk_image} is a raw hard image image for IDE hard disk 0. | |
| 386 | 460 | |
| 387 | 461 | General options: |
| 388 | 462 | @table @option |
| 389 | 463 | @item -hda file |
| 390 | 464 | @item -hdb file |
| 391 | -Use 'file' as hard disk 0 or 1 image (@xref{disk_images}). | |
| 465 | +Use @var{file} as hard disk 0 or 1 image (@xref{disk_images}). | |
| 392 | 466 | |
| 393 | 467 | @item -snapshot |
| 394 | 468 | |
| ... | ... | @@ -405,13 +479,41 @@ launched to configure the host network interface (usually tun0) |
| 405 | 479 | corresponding to the virtual NE2000 card. |
| 406 | 480 | |
| 407 | 481 | @item -initrd file |
| 408 | -Use 'file' as initial ram disk. | |
| 482 | +Use @var{file} as initial ram disk. | |
| 483 | + | |
| 484 | +@item -tun-fd fd | |
| 485 | +Assumes @var{fd} talks to tap/tun and use it. Read | |
| 486 | +@url{http://bellard.org/qemu/tetrinet.html} to have an example of its | |
| 487 | +use. | |
| 488 | + | |
| 489 | +@item -nographic | |
| 490 | + | |
| 491 | +Normally, QEMU uses SDL to display the VGA output. With this option, | |
| 492 | +you can totally disable graphical output so that QEMU is a simple | |
| 493 | +command line application. The emulated serial port is redirected on | |
| 494 | +the console. Therefore, you can still use QEMU to debug a Linux kernel | |
| 495 | +with a serial console. | |
| 496 | + | |
| 497 | +@end table | |
| 498 | + | |
| 499 | +Linux boot specific (does not require a full PC boot with a BIOS): | |
| 500 | +@table @option | |
| 501 | + | |
| 502 | +@item -kernel bzImage | |
| 503 | +Use @var{bzImage} as kernel image. | |
| 504 | + | |
| 505 | +@item -append cmdline | |
| 506 | +Use @var{cmdline} as kernel command line | |
| 507 | + | |
| 508 | +@item -initrd file | |
| 509 | +Use @var{file} as initial ram disk. | |
| 510 | + | |
| 409 | 511 | @end table |
| 410 | 512 | |
| 411 | 513 | Debug options: |
| 412 | 514 | @table @option |
| 413 | 515 | @item -s |
| 414 | -Wait gdb connection to port 1234. | |
| 516 | +Wait gdb connection to port 1234 (@xref{gdb_usage}). | |
| 415 | 517 | @item -p port |
| 416 | 518 | Change gdb connection port. |
| 417 | 519 | @item -d |
| ... | ... | @@ -432,7 +534,25 @@ Send break (magic sysrq) |
| 432 | 534 | @item C-a C-a |
| 433 | 535 | Send C-a |
| 434 | 536 | @end table |
| 537 | +@c man end | |
| 538 | + | |
| 539 | +@ignore | |
| 540 | + | |
| 541 | +@setfilename qemu | |
| 542 | +@settitle QEMU System Emulator | |
| 543 | + | |
| 544 | +@c man begin SEEALSO | |
| 545 | +The HTML documentation of QEMU for more precise information and Linux | |
| 546 | +user mode emulator invocation. | |
| 547 | +@c man end | |
| 548 | + | |
| 549 | +@c man begin AUTHOR | |
| 550 | +Fabrice Bellard | |
| 551 | +@c man end | |
| 552 | + | |
| 553 | +@end ignore | |
| 435 | 554 | |
| 555 | +@end ignore | |
| 436 | 556 | @node disk_images |
| 437 | 557 | @section Disk Images |
| 438 | 558 | |
| ... | ... | @@ -466,14 +586,14 @@ same disk image template for many users. |
| 466 | 586 | To create a COW disk images, use the command: |
| 467 | 587 | |
| 468 | 588 | @example |
| 469 | -vlmkcow -f myrawimage.bin mycowimage.cow | |
| 589 | +qemu-mkcow -f myrawimage.bin mycowimage.cow | |
| 470 | 590 | @end example |
| 471 | 591 | |
| 472 | 592 | @file{myrawimage.bin} is a raw image you want to use as original disk |
| 473 | 593 | image. It will never be written to. |
| 474 | 594 | |
| 475 | 595 | @file{mycowimage.cow} is the COW disk image which is created by |
| 476 | -@code{vlmkcow}. You can use it directly with the @option{-hdx} | |
| 596 | +@code{qemu-mkcow}. You can use it directly with the @option{-hdx} | |
| 477 | 597 | options. You must not modify the original raw disk image if you use |
| 478 | 598 | COW images, as COW images only store the modified sectors from the raw |
| 479 | 599 | disk image. QEMU stores the original raw disk image name and its |
| ... | ... | @@ -489,7 +609,7 @@ image. It is useful to have a big initial virtual disk image without |
| 489 | 609 | using much disk space. Use: |
| 490 | 610 | |
| 491 | 611 | @example |
| 492 | -vlmkcow mycowimage.cow 1024 | |
| 612 | +qemu-mkcow mycowimage.cow 1024 | |
| 493 | 613 | @end example |
| 494 | 614 | |
| 495 | 615 | to create a 1 gigabyte empty COW disk image. |
| ... | ... | @@ -504,6 +624,7 @@ Since holes are used, the displayed size of the COW disk image is not |
| 504 | 624 | the real one. To know it, use the @code{ls -ls} command. |
| 505 | 625 | @end enumerate |
| 506 | 626 | |
| 627 | +@node linux_compile | |
| 507 | 628 | @section Linux Kernel Compilation |
| 508 | 629 | |
| 509 | 630 | You should be able to use any kernel with QEMU provided you make the |
| ... | ... | @@ -573,31 +694,11 @@ As you would do to make a real kernel. Then you can use with QEMU |
| 573 | 694 | exactly the same kernel as you would boot on your PC (in |
| 574 | 695 | @file{arch/i386/boot/bzImage}). |
| 575 | 696 | |
| 576 | -@section PC Emulation | |
| 577 | - | |
| 578 | -QEMU emulates the following PC peripherials: | |
| 579 | - | |
| 580 | -@itemize | |
| 581 | -@item | |
| 582 | -PIC (interrupt controler) | |
| 583 | -@item | |
| 584 | -PIT (timers) | |
| 585 | -@item | |
| 586 | -CMOS memory | |
| 587 | -@item | |
| 588 | -Dumb VGA (to print the @code{Uncompressing Linux} message) | |
| 589 | -@item | |
| 590 | -Serial port (port=0x3f8, irq=4) | |
| 591 | -@item | |
| 592 | -NE2000 network adapter (port=0x300, irq=9) | |
| 593 | -@item | |
| 594 | -IDE disk interface (port=0x1f0, irq=14) | |
| 595 | -@end itemize | |
| 596 | - | |
| 697 | +@node gdb_usage | |
| 597 | 698 | @section GDB usage |
| 598 | 699 | |
| 599 | 700 | QEMU has a primitive support to work with gdb, so that you can do |
| 600 | -'Ctrl-C' while the kernel is running and inspect its state. | |
| 701 | +'Ctrl-C' while the virtual machine is running and inspect its state. | |
| 601 | 702 | |
| 602 | 703 | In order to use gdb, launch vl with the '-s' option. It will wait for a |
| 603 | 704 | gdb connection: |
| ... | ... | @@ -624,6 +725,18 @@ Then you can use gdb normally. For example, type 'c' to launch the kernel: |
| 624 | 725 | |
| 625 | 726 | WARNING: breakpoints and single stepping are not yet supported. |
| 626 | 727 | |
| 728 | +Here are some useful tips in order to use gdb on system code: | |
| 729 | + | |
| 730 | +@enumerate | |
| 731 | +@item | |
| 732 | +Use @code{info reg} to display all the CPU registers. | |
| 733 | +@item | |
| 734 | +Use @code{x/10i $eip} to display the code at the PC position. | |
| 735 | +@item | |
| 736 | +Use @code{set architecture i8086} to dump 16 bit code. Then use | |
| 737 | +@code{x/10i $cs*16+*eip} to dump the code at the PC position. | |
| 738 | +@end enumerate | |
| 739 | + | |
| 627 | 740 | @chapter QEMU Internals |
| 628 | 741 | |
| 629 | 742 | @section QEMU compared to other emulators | ... | ... |