> For the complete documentation index, see [llms.txt](https://osh.fducslg.com/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osh.fducslg.com/notes/miscellaneous/qemu.md).

# QEMU

## QEMU

QEMU supports a number of hypervisors (known as accelerators) as well as a JIT known as the Tiny Code Generator (TCG) capable of emulating many CPUs.

| Accelerator                           | Host OS                            | Host Architectures                               |
| ------------------------------------- | ---------------------------------- | ------------------------------------------------ |
| KVM                                   | Linux                              | Arm (64 bit only), MIPS, PPC, RISC-V, s390x, x86 |
| Xen                                   | Linux (as dom0)                    | Arm, x86                                         |
| Hypervisor Framework (hvf)            | MacOS                              | x86 (64 bit only), Arm (64 bit only)             |
| Windows Hypervisor Platform (whpx)    | Windows                            | x86                                              |
| NetBSD Virtual Machine Monitor (nvmm) | NetBSD                             | x86                                              |
| Tiny Code Generator (tcg)             | Linux, other POSIX, Windows, MacOS | Arm, x86, Loongarch64, MIPS, PPC, s390x, Sparc64 |

### QEMU Options

| Options     | Description                                                                                                                                                                               |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Machine     | Define the machine type, amount of memory etc                                                                                                                                             |
| CPU         | Type and number/topology of vCPUs. Most accelerators offer a `host` cpu option which simply passes through your host CPU configuration without filtering out any features.                |
| Accelerator | This will depend on the hypervisor you run. Note that the default is TCG, which is purely emulated, so you must specify an accelerator type to take advantage of hardware virtualization. |
| Devices     | Additional devices that are not defined by default with the machine type.                                                                                                                 |
| Backends    | Backends are how QEMU deals with the guest’s data, for example how a block device is stored, how network devices see the network or how a serial device is directed to the outside world. |
| Interfaces  | How the system is displayed, how it is managed and controlled or debugged.                                                                                                                |
| Boot        | How the system boots, via firmware or direct kernel boot.                                                                                                                                 |

```shell
$ qemu-system-aarch64 \
   -machine type=virt,virtualization=on,pflash0=rom,pflash1=efivars \
   -m 4096 \
   -cpu max,pauth-impdef=on \
   -smp 4 \
   -accel tcg \
   -device virtio-net-pci,netdev=unet \
   -device virtio-scsi-pci \
   -device scsi-hd,drive=hd \
   -netdev user,id=unet,hostfwd=tcp::2222-:22 \
   -blockdev driver=raw,node-name=hd,file.driver=host_device,file.filename=/dev/lvm-disk/debian-bullseye-arm64 \
   -blockdev node-name=rom,driver=file,filename=(pwd)/pc-bios/edk2-aarch64-code.fd,read-only=true \
   -blockdev node-name=efivars,driver=file,filename=$HOME/images/qemu-arm64-efivars
   -serial mon:stdio \
   -display none \
```

## Device Emulation

#### Device Front End

All devices can be specified with the `--device` command line option.

A front end is often paired with a back end, which describes how the host’s resources are used in the emulation.

#### Device Buses

* In most cases the BUS a device is attached to can be inferred, for example PCI devices are generally automatically allocated to the next free address of first PCI bus found.
* In complicated configurations you can explicitly specify what bus (`bus=ID`) a device is attached to along with its address (`addr=N`).

Some devices, for example a PCI SCSI host controller, will add an additional buses to the system that other devices can be attached to.

```shell
–device foo,bus=pci.0,addr=0,id=foo 
–device bar,bus=foo.0,addr=1,id=baz
```

which would be a bar device (with the ID of baz) which is attached to the first foo bus (foo.0) at address 1. The foo device which provides that bus is itself is attached to the first PCI bus (pci.0).

#### Device Back End

The back end describes how the data from the emulated device will be processed by QEMU.

1. Serial devices will be backed by a `--chardev` which can redirect the data to a file or socket or some other system.
2. Storage devices are handled by `--blockdev` which will specify how blocks are handled, for example being stored in a qcow2 file or accessing a raw host disk partition.

#### Device Pass Through

* Exposing a single USB device on the host system to the guest.
* Dedicating a video card in a PCI slot to the exclusive use of the guest.