Linux User space emulator

Quick Start

In order to launch a Linux process, QEMU needs the process executable itself and all the target (x86) dynamic libraries used by it.

  • On x86, you can just try to launch any process by using the native libraries:

    qemu-i386 -L / /bin/ls

    -L / tells that the x86 dynamic linker must be searched with a / prefix.

  • Since QEMU is also a linux process, you can launch QEMU with QEMU (NOTE: you can only do that if you compiled QEMU from the sources):

    qemu-i386 -L / qemu-i386 -L / /bin/ls

  • On non x86 CPUs, you need first to download at least an x86 glibc (qemu-runtime-i386-XXX-.tar.gz on the QEMU web page). Ensure that LD_LIBRARY_PATH is not set:

    unset LD_LIBRARY_PATH

    Then you can launch the precompiled ls x86 executable:

    qemu-i386 tests/i386/ls

    You can look at scripts/qemu-binfmt-conf.sh so that QEMU is automatically launched by the Linux kernel when you try to launch x86 executables. It requires the binfmt_misc module in the Linux kernel.

  • The x86 version of QEMU is also included. You can try weird things such as:

    qemu-i386 /usr/local/qemu-i386/bin/qemu-i386 \
          /usr/local/qemu-i386/bin/ls-i386

Wine launch

  • Ensure that you have a working QEMU with the x86 glibc distribution (see previous section). In order to verify it, you must be able to do:

    qemu-i386 /usr/local/qemu-i386/bin/ls-i386

  • Download the binary x86 Wine install (qemu-XXX-i386-wine.tar.gz on the QEMU web page).

  • Configure Wine on your account. Look at the provided script /usr/local/qemu-i386/bin/wine-conf.sh. Your previous ${HOME}/.wine directory is saved to ${HOME}/.wine.org.

  • Then you can try the example putty.exe:

    qemu-i386 /usr/local/qemu-i386/wine/bin/wine \
          /usr/local/qemu-i386/wine/c/Program\ Files/putty.exe

Command line options

qemu-i386 [-h] [-d] [-L path] [-s size] [-cpu model] [-g port] [-B offset] [-R size] program [arguments...]
-h
Print the help
-L path
Set the x86 elf interpreter prefix (default=/usr/local/qemu-i386)
-s size
Set the x86 stack size in bytes (default=524288)
-cpu model
Select CPU model (-cpu help for list and additional feature selection)
-E var=value
Set environment var to value.
-U var
Remove var from the environment.
-B offset
Offset guest address by the specified number of bytes. This is useful when the address region required by guest applications is reserved on the host. This option is currently only supported on some hosts.
-R size
Pre-allocate a guest virtual address space of the given size (in bytes). “G”, “M”, and “k” suffixes may be used when specifying the size.

Debug options:

-d item1,...
Activate logging of the specified items (use ’-d help’ for a list of log items)
-p pagesize
Act as if the host page size was ’pagesize’ bytes
-g port
Wait gdb connection to port
-singlestep
Run the emulation in single step mode.

Environment variables:

QEMU_STRACE
Print system calls and arguments similar to the ’strace’ program (NOTE: the actual ’strace’ program will not work because the user space emulator hasn’t implemented ptrace). At the moment this is incomplete. All system calls that don’t have a specific argument format are printed with information for six arguments. Many flag-style arguments don’t have decoders and will show up as numbers.

Other binaries

user mode (Alpha)

qemu-alpha TODO.

user mode (ARM)

qemu-armeb TODO.

user mode (ARM)

qemu-arm is also capable of running ARM “Angel” semihosted ELF binaries (as implemented by the arm-elf and arm-eabi Newlib/GDB configurations), and arm-uclinux bFLT format binaries.

user mode (ColdFire)user mode (M68K)

qemu-m68k is capable of running semihosted binaries using the BDM (m5xxx-ram-hosted.ld) or m68k-sim (sim.ld) syscall interfaces, and coldfire uClinux bFLT format binaries.

The binary format is detected automatically.

user mode (Cris)

qemu-cris TODO.

user mode (i386)

qemu-i386 TODO. qemu-x86_64 TODO.

user mode (Microblaze)

qemu-microblaze TODO.

user mode (MIPS)

qemu-mips TODO. qemu-mipsel TODO.

user mode (PowerPC)

qemu-ppc64abi32 TODO. qemu-ppc64 TODO. qemu-ppc TODO.

user mode (SH4)

qemu-sh4eb TODO. qemu-sh4 TODO.

user mode (SPARC)

qemu-sparc can execute Sparc32 binaries (Sparc32 CPU, 32 bit ABI).

qemu-sparc32plus can execute Sparc32 and SPARC32PLUS binaries (Sparc64 CPU, 32 bit ABI).

qemu-sparc64 can execute some Sparc64 (Sparc64 CPU, 64 bit ABI) and SPARC32PLUS binaries (Sparc64 CPU, 32 bit ABI).