972
edits
QEMU: Difference between revisions
m
Highlighting errors
| [unchecked revision] | [unchecked revision] |
(→Supported Devices: expanded list) |
m (Highlighting errors) |
||
| (30 intermediate revisions by 11 users not shown) | |||
Line 1:
{{Emulators}}
QEMU is a free and open-source emulator that performs hardware virtualization. It is widely available for variety of host operating-systems and requires minimal configuration for use in operating-system development. It is capable of emulating a wide variety of systems including [[ARM]], [[x86]] and [[RISC-V]], among others. For a more comprehensive list of targets refer to the [https://www.qemu.org/docs/master/ official documentation].
==Features==
* Supports multiple hosts, multiple targets.
* Two operating modes: full system emulation (of interest for operating-system development) and Linux user process emulation (of interests to people who want to emulate applications).
* Uses 'just in time' code compilation technique (allowing reuse of previous interpretation). This makes it faster than the popular alternative emulator [[Bochs]].
*
* Supports [[VBE]] 2.0.
===VBE Support===
[[VBE]] support be checked by typing '<tt>vbeprobe</tt>' on the [[GRUB]] command-line. The test returns:
{| {{wikitable}}
|-
Line 74 ⟶ 79:
==Supported Architectures==
* [[:Category:X86|x86]]
* [[X86-64|x86_64]]
* [[:Category:ARM|ARM]]
* [[ARM64]]
* [[LatticeMico32]]
* [[M68k_Overview|Motorola 68000]]
* [[MicroBlaze]]
* [[MIPS]]
* [[MIPS64]]
* [[Moxie]]
* [[PowerPC]]
* [[PowerPC64]]
* [[RISC-V]]
* [[IBM System/390]]
* [[SuperH]]
* [[:Category:Sparc|SPARC]]
* [[SPARC64]]
* [[TriCore]]
* [[Unicore]]
* [[Xtensa]]
==Supported Devices==
Line 103 ⟶ 109:
* [[AC97]]
* [[Intel_High_Definition_Audio|Intel High Definition Audio]]
* [[Virtio
* PCI SVGA card (Cirrus Logic 5446)
* PCI support (With BIOS32).
* [[QEMU_fw_cfg]] Allows you to pass info to the guest
==Usage==
QEMU
<syntaxhighlight lang="bash">
qemu-system-i386 \
-accel tcg,thread=single \
-cpu core2duo \
-m 128 \
-no-reboot \
-drive format=raw,media=cdrom,file=myos.iso \
-serial stdio \
-smp 1 \
-usb \
-vga std
</syntaxhighlight>
When running QEMU on a non-UNIX system, it may be necessary to use the <tt>-L</tt> command-line option to instruct QEMU where to find a BIOS image.
The <tt>-m 128</tt> argument instructs QEMU to create the guest system with 128MB of RAM. The <tt>-drive format=raw,media=cdrom,file=myos.iso</tt> argument instructs QEMU to create a drive in our guest system. In this case the created drive is a CDROM drive, with <tt>myos.iso</tt> as its loaded media. If more than one drive in is required in the guest system, it is possible to use the <tt>-boot</tt> option to define the order in which the system will check for bootable media.
The <tt>-serial stdio</tt> argument used above instructs QEMU to redirect the serial input and output to the host system's <tt>stdio</tt> stream. This is particularly useful for debugging purposes. In the documentation, the option to redirect this to <tt>stdio</tt> is described as Unix only. Presumably, one should be able to achieve a similar effect with <tt>-serial file:CON</tt> on Windows.
In order to help track down the source of a triple fault, the <tt>-d int</tt> option can be used to show additional debugging information on interrupts that occur. Additionally, the <tt>-no-shutdown</tt> and <tt>-no-reboot</tt> options can be used. These instruct the virtual machine to halt on error instead of rebooting or shutting down, allowing for the operator to inspect the state of the machine after a triple-fault.
Additional useful command-line options are listed within the [[QEMU#Useful_QEMU_command-line_options|Useful QEMU command-line options]] section.
The keyboard shortcuts <tt>CTRL-ALT-{1,2,3}</tt> can be used inside the emulator to swap in/out of the emulation screen, the QEMU monitor and a serial console. Additional debugging commands can be issued from the system console, such as changing disk images and performing memory dumps, among others.
===The
Instead of the serial port, as outlined above, one can also use the <tt>debugcon</tt> device. By running QEMU with <tt>-debugcon stdio</tt>, you can print a message to your host system's terminal by just writing each byte to port 0xe9. This is the same port as the one used by [[Bochs#I/O_debugger_macros|the equivalent feature in Bochs]].
Unlike the serial port, the debug console is one-way – you can only output. On the flip side, implementing support is much easier, and outputting the messages isn't artificially throttled by a baudrate.
===The QEMU monitor===
{{Main|QEMU Monitor}}
QEMU features its own internal 'monitor' console for debugging the guest operating-system. Through various commands, the monitor allows you to inspect the running guest OS, change removable media and USB devices, take screenshots and audio grabs, and control various aspects of the virtual machine. The monitor can be accessed by the key combination <tt>CTRL-ALT-2</tt> within QEMU.
It is possible to redirect QEMU's monitor output to stdio using the following command-line option when invoking QEMU:
<syntaxhighlight lang="bash">
-monitor stdio
</syntaxhighlight>
Some useful commands:
; xp : eXamine Physical memory. Much like GDB's <tt>x</tt> command, but with no address translation.
; cpu n : switch to CPU n. Note that GDB's threads are numbered from 1, but QEMU's CPUs are numbered from 0.
Line 142 ⟶ 170:
; help : List all commands -- keep in mind that there may be more commands available than those mentioned in the [http://www.qemu.org/qemu-doc.html#SEC12 QEMU documentation].
A full list of the capabilities of QEMU's monitor is available in the [https://qemu.weilnetz.de/doc/qemu-doc.html#pcsys_005fmonitor official documentation] as well as [https://en.wikibooks.org/wiki/QEMU/Monitor here].
==Useful QEMU command-line options==
''Shown below are a list of command-line options for QEMU which are of special significance to Operating-System development. For a full list of options refer to the [https://qemu.weilnetz.de/doc/qemu-doc.html official QEMU documentation].''
{| {{wikitable}}
|-
! Option
! Description
|-
| <tt>-no-reboot</tt>
| Prevents QEMU from rebooting in the event of a [[Triple Fault]].
|-
| <tt>-no-shutdown</tt>
| Don’t exit QEMU on guest shutdown, but instead only stop the emulation.
|-
| <tt>-d</tt>
| Enables the printing of extra debugging information. Arguments for this option include <tt>cpu_reset, int, guest_errors</tt> ( among others ). This can be extremely useful when setting up an [[IDT]] to see interrupt execution in real-time.
|-
| <tt>-gdb</tt> or <tt>-s</tt>
| Launches QEMU in GDB Stub mode. This causes QEMU to accept incoming connections from a [[GDB]] client. See below for more information or refer to [https://wiki.qemu.org/Documentation/Debugging official documentation].
|-
| <tt>-S</tt>
| Causes the guest CPU not to start execution on startup. This is very useful for debugging as it launches the guest in a paused state. The user must use the <tt>continue</tt> command in the console ( or GDB ) to initiate execution on the guest system.
|}
==GDB-Stub==
Starting QEMU with the <tt>-gdb</tt> or <tt>-s <dev></tt> command-line options will instruct QEMU to listen for an incoming [[GDB]] connection. By default QEMU will listen for a connection over HTTP on <tt>localhost:1234</tt>, but the option will accept an argument for a different connection. It is useful to use this switch together with the <tt>-S</tt> option, which will cause QEMU to start in a paused state. This will allow additional time to connect a GDB client, to start the simulation a <tt>continue</tt> command will need to be issued within GDB or in the QEMU console.
For convenience, it is also possible to create a file containing commands for GDB to automatically execute. GDB will read and execute the contents of a file with the name <tt>.gdbinit</tt> in the current working directory. Alternatively, a different file may be specified by the use the <tt>-command=file</tt> command-line argument. An example file can be seen below:
<!-- lang="gdb" Avoid highlighting errors -->
<syntaxhighlight lang="text">
file <my-kernel-binary>
target remote localhost:1234
# Inspect page tables
x /8wg &page_tables_start
</syntaxhighlight>
This will automatically load the kernel binary's symbol file into the debugger and then open the remote connection to QEMU.<br/>
Ensure that the kernel was compiled with debugging symbols included. This can be accomplished via the use of the GCC option <tt>-g</tt>. If you find that the debugger can't find local variables, try using the <tt>-fno-omit-frame-pointer</tt> option during compilation, or disable optimizations.
When running an SMP kernel, the <tt>info threads</tt> and <tt>thread</tt> commands can be used to provide useful information. It is also possible to use the QEMU monitor and its commands using the <tt>monitor</tt> command in GDB. For a list of available commands and their description, use the <tt>monitor help</tt> command.
It is possible to enable the output of additional debugging information to stdout by uncommenting certain preprocessor directives within the QEMU source files.
Some files within the QEMU source code have commented lines of the form:
<syntaxhighlight lang="c">
// #define DEBUG_*
</syntaxhighlight>
Recompiling QEMU from source with this preprocessor variable defined will cause additional debugging information from the applicable file to be printed to stdout.
==See Also==
Line 166 ⟶ 233:
===Articles===
*[[QEMU and GDB in long mode]]
*[[QEMU_fw_cfg]] Pass strings and files into the VM from the QEMU command line
===External Links===
*[http://www.qemu.org/ QEMU homepage]
*[http://qemu-forum.ipi.fi/ QEMU forum]
*[https://en.wikibooks.org/wiki/QEMU QEMU Wikibook]
*[https://wiki.archlinux.org/index.php/QEMU#Creating_a_hard_disk_image QEMU at ArchWiki]
[[Category:Emulators]]
[[Category:QEMU]]
[[de:QEMU]]
| |||