Packages and Binaries:
qemu-block-extra
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides extra block device backend modules for qemu-system emulation and qemu-img from qemu-utils package, which are rarely used and has extra dependencies.
Installed size: 367 KB
How to install: sudo apt install qemu-block-extra
Dependencies:
- libblkio1
- libbz2-1.0
- libc6
- libcurl3t64-gnutls
- libgfapi0
- libiscsi7
- libnfs14
- librados2
- librbd1
- libssh-4
- qemu-system-any | qemu-utils
qemu-guest-agent
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides a daemon (agent) to run inside qemu-system guests (full system emulation). It communicates with the host using a virtio-serial channel org.qemu.guest_agent.0, and allows one to perform some functions in the guest from the host, including:
- querying and setting guest system time
- performing guest filesystem sync operation
- initiating guest shutdown or suspend to ram
- accessing guest files
- freezing/thawing guest filesystem operations
- others.
Install this package on a system which is running as guest inside qemu virtual machine. It is not used on the host.
Installed size: 3.58 MB
How to install: sudo apt install qemu-guest-agent
Dependencies:
- init-system-helpers
- libc6
- libglib2.0-0t64
- libnuma1
- libudev1
- liburing2
qemu-ga
QEMU Guest Agent
root@kali:~# qemu-ga -h
Usage: qemu-ga [-m <method> -p <path>] [<options>]
QEMU Guest Agent 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
-c, --config=PATH configuration file path (default is
/etc/qemu/qemu-ga.conf/qemu-ga.conf
unless overridden by the QGA_CONF environment variable)
-m, --method transport method: one of unix-listen, virtio-serial,
isa-serial, or vsock-listen (virtio-serial is the default)
-p, --path device/socket path (the default for virtio-serial is:
/dev/virtio-ports/org.qemu.guest_agent.0,
the default for isa-serial is:
/dev/ttyS0).
Socket addresses for vsock-listen are written as
<cid>:<port>.
-l, --logfile set logfile path, logs to stderr by default
-f, --pidfile specify pidfile (default is /var/run/qemu-ga.pid)
-F, --fsfreeze-hook
enable fsfreeze hook. Accepts an optional argument that
specifies script to run on freeze/thaw. Script will be
called with 'freeze'/'thaw' arguments accordingly.
(default is /etc/qemu/fsfreeze-hook)
If using -F with an argument, do not follow -F with a
space.
(for example: -F/var/run/fsfreezehook.sh)
-t, --statedir specify dir to store state information (absolute paths
only, default is /var/run)
-v, --verbose log extra debugging information
-V, --version print version information and exit
-d, --daemonize become a daemon
-b, --block-rpcs comma-separated list of RPCs to disable (no spaces,
use "--block-rpcs=help" to list available RPCs)
-a, --allow-rpcs comma-separated list of RPCs to enable (no spaces,
use "--allow-rpcs=help" to list available RPCs)
-D, --dump-conf dump a qemu-ga config file based on current config
options / command-line parameters to stdout
-r, --retry-path attempt re-opening path if it's unavailable or closed
due to an error which may be recoverable in the future
(virtio-serial driver re-install, serial device hot
plug/unplug, etc.)
-h, --help display this help and exit
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This metapackage provides the full system emulation binaries for all supported targets, by depending on all per-architecture system emulation packages which QEMU supports.
Installed size: 71 KB
How to install: sudo apt install qemu-system
Dependencies:
- qemu-system-arm
- qemu-system-mips
- qemu-system-misc
- qemu-system-ppc
- qemu-system-sparc
- qemu-system-x86
qemu-system-arm
QEMU is a fast processor emulator: currently the package supports ARM emulation. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides the full system emulation binaries to emulate the following arm hardware: aarch64 (arm64) arm (armel armhf).
In system emulation mode QEMU emulates a full system, including a processor and various peripherals. It enables easier testing and debugging of system code. It can also be used to provide virtual hosting of several virtual machines on a single server.
Installed size: 62.20 MB
How to install: sudo apt install qemu-system-arm
Dependencies:
- libaio1t64
- libbpf1
- libc6
- libcapstone4
- libfdt1
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libibverbs1
- libjpeg62-turbo
- libnettle8t64
- libnuma1
- libpixman-1-0
- libpmem1
- libpng16-16t64
- librdmacm1t64
- libsasl2-2
- libseccomp2
- libslirp0
- libudev1
- liburing2
- libvdeplug2t64
- libzstd1
- qemu-system-common
- qemu-system-data
- zlib1g
qemu-system-aarch64
QEMU User Documentation
root@kali:~# qemu-system-aarch64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-aarch64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-old-param old param mode
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-arm
QEMU User Documentation
root@kali:~# qemu-system-arm -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-arm [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-old-param old param mode
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-arm64
QEMU User Documentation
root@kali:~# qemu-system-arm64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-arm64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-old-param old param mode
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-armel
QEMU User Documentation
root@kali:~# qemu-system-armel -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-armel [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-old-param old param mode
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-armhf
QEMU User Documentation
root@kali:~# qemu-system-armhf -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-armhf [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-old-param old param mode
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-common
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides common files needed for target-specific full system emulation (qemu-system-*) packages.
Installed size: 4.63 MB
How to install: sudo apt install qemu-system-common
Dependencies:
- libasound2t64
- libbrlapi0.8
- libc6
- libcacard0
- libcap-ng0
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libncursesw6
- libnettle8t64
- libnuma1
- libpixman-1-0
- libtinfo6
- liburing2
- libusb-1.0-0
- libusbredirparser1t64
qemu-pr-helper
QEMU persistent reservation helper
root@kali:~# qemu-pr-helper -h
Usage: qemu-pr-helper [OPTIONS] FILE
Persistent Reservation helper program for QEMU
-h, --help display this help and exit
-V, --version output version information and exit
-d, --daemon run in the background
-f, --pidfile=PATH PID file when running as a daemon
(default '/var/run/qemu-pr-helper.pid')
-k, --socket=PATH path to the unix socket
(default '/var/run/qemu-pr-helper.sock')
-T, --trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-u, --user=USER user to drop privileges to
-g, --group=GROUP group to drop privileges to
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-vmsr-helper
qemu-system-data
This package provides architecture-neutral data files (such as keyboard definitions, icons) for system-mode QEMU emulation (qemu-system-*) packages.
Installed size: 17.62 MB
How to install: sudo apt install qemu-system-data
qemu-system-gui
This package provides optional graphical guest display modules (currently GTK and SDL) and audio backend modules for full system emulation (qemu-system-*) packages.
This package is not a management/control/GUI interface for qemu, use something else (like virt-manager) for that.
Installed size: 1.11 MB
How to install: sudo apt install qemu-system-gui
Dependencies:
- libc6
- libcairo2
- libepoxy0
- libgbm1
- libgdk-pixbuf-2.0-0
- libgl1
- libglib2.0-0t64
- libgtk-3-0t64
- libjack-jackd2-0 | libjack-0.125
- libnuma1
- libpipewire-0.3-0t64
- libpixman-1-0
- libpulse0
- libsdl2-2.0-0
- libvirglrenderer1
- libvte-2.91-0
- libx11-6
- qemu-system-any
- qemu-system-modules-opengl
qemu-system-mips
QEMU is a fast processor emulator: currently the package supports MIPS emulation. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides the full system emulation binaries to emulate the following mips hardware: mips mipsel mips64 mips64el.
In system emulation mode QEMU emulates a full system, including a processor and various peripherals. It enables easier testing and debugging of system code. It can also be used to provide virtual hosting of several virtual machines on a single server.
Installed size: 60.62 MB
How to install: sudo apt install qemu-system-mips
Dependencies:
- libaio1t64
- libbpf1
- libc6
- libcapstone4
- libfdt1
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libibverbs1
- libjpeg62-turbo
- libnettle8t64
- libnuma1
- libpixman-1-0
- libpmem1
- libpng16-16t64
- librdmacm1t64
- libsasl2-2
- libseccomp2
- libslirp0
- libudev1
- liburing2
- libvdeplug2t64
- libzstd1
- qemu-system-common
- qemu-system-data
- zlib1g
qemu-system-mips
QEMU User Documentation
root@kali:~# qemu-system-mips -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-mips [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-mips64
QEMU User Documentation
root@kali:~# qemu-system-mips64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-mips64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-mips64el
QEMU User Documentation
root@kali:~# qemu-system-mips64el -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-mips64el [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-mipsel
QEMU User Documentation
root@kali:~# qemu-system-mipsel -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-mipsel [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-misc
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides the full system emulation binaries to emulate various other hardware which did not made into separate packages. Emulators for the following architectures are provided: alpha avr cris hppa m68k loongarch64 (loong64) microblaze microblazeel or1k riscv32 riscv64 rx sh4 sh4eb s390x tricore xtensa xtensaeb.
In system emulation mode QEMU emulates a full system, including a processor and various peripherals. It enables easier testing and debugging of system code. It can also be used to provide virtual hosting of several virtual machines on a single server.
Installed size: 219.43 MB
How to install: sudo apt install qemu-system-misc
Dependencies:
- libaio1t64
- libbpf1
- libc6
- libcapstone4
- libfdt1
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libibverbs1
- libjpeg62-turbo
- libnettle8t64
- libnuma1
- libpixman-1-0
- libpmem1
- libpng16-16t64
- librdmacm1t64
- libsasl2-2
- libseccomp2
- libslirp0
- libudev1
- liburing2
- libvdeplug2t64
- libzstd1
- opensbi
- qemu-system-common
- qemu-system-data
- zlib1g
qemu-system-alpha
QEMU User Documentation
root@kali:~# qemu-system-alpha -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-alpha [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-avr
QEMU User Documentation
root@kali:~# qemu-system-avr -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-avr [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-cris
QEMU User Documentation
root@kali:~# qemu-system-cris -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-cris [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-hppa
QEMU User Documentation
root@kali:~# qemu-system-hppa -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-hppa [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-loong64
QEMU User Documentation
root@kali:~# qemu-system-loong64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-loong64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-loongarch64
QEMU User Documentation
root@kali:~# qemu-system-loongarch64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-loongarch64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-m68k
QEMU User Documentation
root@kali:~# qemu-system-m68k -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-m68k [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-microblaze
QEMU User Documentation
root@kali:~# qemu-system-microblaze -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-microblaze [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-microblazeel
QEMU User Documentation
root@kali:~# qemu-system-microblazeel -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-microblazeel [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-or1k
QEMU User Documentation
root@kali:~# qemu-system-or1k -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-or1k [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-riscv32
QEMU User Documentation
root@kali:~# qemu-system-riscv32 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-riscv32 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-riscv64
QEMU User Documentation
root@kali:~# qemu-system-riscv64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-riscv64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-rx
QEMU User Documentation
root@kali:~# qemu-system-rx -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-rx [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-s390x
QEMU User Documentation
root@kali:~# qemu-system-s390x -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-s390x [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-sh4
QEMU User Documentation
root@kali:~# qemu-system-sh4 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-sh4 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-sh4eb
QEMU User Documentation
root@kali:~# qemu-system-sh4eb -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-sh4eb [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-tricore
QEMU User Documentation
root@kali:~# qemu-system-tricore -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-tricore [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-xtensa
QEMU User Documentation
root@kali:~# qemu-system-xtensa -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-xtensa [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-xtensaeb
QEMU User Documentation
root@kali:~# qemu-system-xtensaeb -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-xtensaeb [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-semihosting semihosting mode
-semihosting-config [enable=on|off][,target=native|gdb|auto][,chardev=id][,userspace=on|off][,arg=str[,...]]
semihosting configuration
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-modules-opengl
This package provides optional OpenGL display support modules for QEMU full system emulation (qemu-system-*) packages. It also provides D-Bus display type.
Installed size: 799 KB
How to install: sudo apt install qemu-system-modules-opengl
Dependencies:
- libc6
- libepoxy0
- libgbm1
- libglib2.0-0t64
- libpixman-1-0
- libvirglrenderer1
- qemu-system-any
qemu-system-modules-spice
This package provides optional spice display (qxl and spice-app) and audio support modules for QEMU full system emulation (qemu-system-*) packages.
Installed size: 302 KB
How to install: sudo apt install qemu-system-modules-spice
Dependencies:
- libc6
- libglib2.0-0t64
- libpixman-1-0
- libspice-server1
- qemu-system-any
- qemu-system-modules-opengl
qemu-system-ppc
QEMU is a fast processor emulator: currently the package supports PowerPC emulation. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides the full system emulation binaries to emulate the following PowerPC hardware: ppc (powerpc) ppc64 (ppc64le ppc64el).
In system emulation mode QEMU emulates a full system, including a processor and various peripherals. It enables easier testing and debugging of system code. It can also be used to provide virtual hosting of several virtual machines on a single server.
Installed size: 34.68 MB
How to install: sudo apt install qemu-system-ppc
Dependencies:
- libaio1t64
- libbpf1
- libc6
- libcapstone4
- libfdt1
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libibverbs1
- libjpeg62-turbo
- libnettle8t64
- libnuma1
- libpixman-1-0
- libpmem1
- libpng16-16t64
- librdmacm1t64
- libsasl2-2
- libseccomp2
- libslirp0
- libudev1
- liburing2
- libvdeplug2t64
- libzstd1
- qemu-system-common
- qemu-system-data
- zlib1g
qemu-system-powerpc
QEMU User Documentation
root@kali:~# qemu-system-powerpc -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-powerpc [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-ppc
QEMU User Documentation
root@kali:~# qemu-system-ppc -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-ppc [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-ppc64
QEMU User Documentation
root@kali:~# qemu-system-ppc64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-ppc64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-ppc64el
QEMU User Documentation
root@kali:~# qemu-system-ppc64el -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-ppc64el [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-ppc64le
QEMU User Documentation
root@kali:~# qemu-system-ppc64le -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-ppc64le [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-sparc
QEMU is a fast processor emulator: currently the package supports SPARC emulation. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides the full system emulation binaries to emulate the following sparc hardware: sparc sparc64.
In system emulation mode QEMU emulates a full system, including a processor and various peripherals. It enables easier testing and debugging of system code. It can also be used to provide virtual hosting of several virtual machines on a single server.
Installed size: 22.46 MB
How to install: sudo apt install qemu-system-sparc
Dependencies:
- libaio1t64
- libbpf1
- libc6
- libcapstone4
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libibverbs1
- libjpeg62-turbo
- libnettle8t64
- libnuma1
- libpixman-1-0
- libpmem1
- libpng16-16t64
- librdmacm1t64
- libsasl2-2
- libseccomp2
- libslirp0
- libudev1
- liburing2
- libvdeplug2t64
- libzstd1
- qemu-system-common
- qemu-system-data
- zlib1g
qemu-system-sparc
QEMU User Documentation
root@kali:~# qemu-system-sparc -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-sparc [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-sparc64
QEMU User Documentation
root@kali:~# qemu-system-sparc64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-sparc64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-g WxH[xDEPTH] Set the initial graphical resolution and depth
-vnc <display> shorthand for -display vnc=<display>
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-prom-env variable=value
set OpenBIOS nvram variables
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-x86
QEMU is a fast processor emulator: currently the package supports i386 and x86-64 emulation. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides the full system emulation binaries to emulate the following x86 hardware: i386 x86_64 (amd64).
In system emulation mode QEMU emulates a full system, including a processor and various peripherals. It enables easier testing and debugging of system code. It can also be used to provide virtual hosting of several virtual machines on a single server.
On x86 host hardware this package also enables KVM kernel virtual machine usage on systems which supports it.
Installed size: 61.95 MB
How to install: sudo apt install qemu-system-x86
Dependencies:
- ipxe-qemu
- libaio1t64
- libbpf1
- libc6
- libcapstone4
- libfdt1
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libibverbs1
- libjpeg62-turbo
- libnettle8t64
- libnuma1
- libpixman-1-0
- libpmem1
- libpng16-16t64
- librdmacm1t64
- libsasl2-2
- libseccomp2
- libslirp0
- libudev1
- liburing2
- libvdeplug2t64
- libzstd1
- qemu-system-common
- qemu-system-data
- seabios
- zlib1g
kvm
QEMU User Documentation
root@kali:~# kvm -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: kvm [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
i386 target only:
-win2k-hack use it when installing Windows 2000 to avoid a disk full bug
-no-fd-bootchk disable boot signature checking for floppy disks
-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]
ACPI table description
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-amd64
QEMU User Documentation
root@kali:~# qemu-system-amd64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-amd64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
i386 target only:
-win2k-hack use it when installing Windows 2000 to avoid a disk full bug
-no-fd-bootchk disable boot signature checking for floppy disks
-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]
ACPI table description
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-i386
QEMU User Documentation
root@kali:~# qemu-system-i386 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-i386 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
i386 target only:
-win2k-hack use it when installing Windows 2000 to avoid a disk full bug
-no-fd-bootchk disable boot signature checking for floppy disks
-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]
ACPI table description
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-x86_64
QEMU User Documentation
root@kali:~# qemu-system-x86_64 -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-x86_64 [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev alsa,id=id[,prop[=value][,...]]
in|out.dev= name of the audio device to use
in|out.period-length= length of period in microseconds
in|out.try-poll= attempt to use poll mode
threshold= threshold (in microseconds) when playback starts
-audiodev oss,id=id[,prop[=value][,...]]
in|out.dev= path of the audio device to use
in|out.buffer-count= number of buffers
in|out.try-poll= attempt to use poll mode
try-mmap= try using memory mapped access
exclusive= open device in exclusive mode
dsp-policy= set timing policy (0..10), -1 to use fragment mode
-audiodev pa,id=id[,prop[=value][,...]]
server= PulseAudio server address
in|out.name= source/sink device name
in|out.latency= desired latency in microseconds
-audiodev pipewire,id=id[,prop[=value][,...]]
in|out.name= source/sink device name
in|out.stream-name= name of pipewire stream
in|out.latency= desired latency in microseconds
-audiodev sdl,id=id[,prop[=value][,...]]
in|out.buffer-count= number of buffers
-audiodev spice,id=id[,prop[=value][,...]]
-audiodev dbus,id=id[,prop[=value][,...]]
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display spice-app[,gl=on|off]
-display sdl[,gl=on|core|es|off][,grab-mod=<mod>][,show-cursor=on|off]
[,window-close=on|off]
-display gtk[,full-screen=on|off][,gl=on|off][,grab-on-hover=on|off]
[,show-tabs=on|off][,show-cursor=on|off][,window-close=on|off]
[,show-menubar=on|off][,zoom-to-fit=on|off]
-display vnc=<display>[,<optargs>]
-display curses[,charset=<encoding>]
-display egl-headless[,rendernode=<file>]
-display dbus[,addr=<dbusaddr>]
[,gl=on|core|es|off][,rendernode=<file>]
-display none
select display backend type
The default display is equivalent to
"-display gtk"
-nographic disable graphical output and redirect serial I/Os to console
-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]
[,x509-key-file=<file>][,x509-key-password=<file>]
[,x509-cert-file=<file>][,x509-cacert-file=<file>]
[,x509-dh-key-file=<file>][,addr=addr]
[,ipv4=on|off][,ipv6=on|off][,unix=on|off]
[,tls-ciphers=<list>]
[,tls-channel=[main|display|cursor|inputs|record|playback]]
[,plaintext-channel=[main|display|cursor|inputs|record|playback]]
[,sasl=on|off][,disable-ticketing=on|off]
[,password-secret=<secret-id>]
[,image-compression=[auto_glz|auto_lz|quic|glz|lz|off]]
[,jpeg-wan-compression=[auto|never|always]]
[,zlib-glz-wan-compression=[auto|never|always]]
[,streaming-video=[off|all|filter]][,disable-copy-paste=on|off]
[,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]
[,playback-compression=[on|off]][,seamless-migration=[on|off]]
[,gl=[on|off]][,rendernode=<file>]
enable spice
at least one of {port, tls-port} is mandatory
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
i386 target only:
-win2k-hack use it when installing Windows 2000 to avoid a disk full bug
-no-fd-bootchk disable boot signature checking for floppy disks
-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]
ACPI table description
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev user,id=str[,ipv4=on|off][,net=addr[/mask]][,host=addr]
[,ipv6=on|off][,ipv6-net=addr[/int]][,ipv6-host=addr]
[,restrict=on|off][,hostname=host][,dhcpstart=addr]
[,dns=addr][,ipv6-dns=addr][,dnssearch=domain][,domainname=domain]
[,tftp=dir][,tftp-server-name=name][,bootfile=f][,hostfwd=rule][,guestfwd=rule][,smb=dir[,smbserver=addr]]
configure a user mode network backend with ID 'str',
its DHCP server and optional services
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]
configure a network backend to connect to port 'n' of a vde switch
running on host and listening for incoming connections on 'socketpath'.
Use group 'groupname' and mode 'octalmode' to change default
ownership and permissions for communication port.
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|user|l2tpv3|vde|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [user|tap|bridge|vde|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev braille,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev spicevmc,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
-chardev spiceport,id=id,name=name[,debug=debug][,logfile=PATH][,logappend=on|off]
TPM device options:
-tpmdev passthrough,id=id[,path=path][,cancel-path=path]
use path to provide path to a character device; default is /dev/tpm0
use cancel-path to provide path to TPM's cancel sysfs entry; if
not provided it will be searched for in /sys/class/misc/tpm?/device
-tpmdev emulator,id=id,chardev=dev
configure the TPM device using chardev backend
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
-perfmap generate a /tmp/perf-${pid}.map file for perf
-jitdump generate a jit-${pid}.dump file for perf
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-x86_64-microvm
QEMU User Documentation
root@kali:~# qemu-system-x86_64-microvm -h
QEMU emulator version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-system-x86_64-microvm [options] [disk_image]
'disk_image' is a raw hard disk image for IDE hard disk 0
Standard options:
-h or -help display this help and exit
-version display version information and exit
-machine [type=]name[,prop[=value][,...]]
selects emulated machine ('-machine help' for list)
property accel=accel1[:accel2[:...]] selects accelerator
supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)
vmport=on|off|auto controls emulation of vmport (default: auto)
dump-guest-core=on|off include guest memory in a core dump (default=on)
mem-merge=on|off controls memory merge support (default: on)
aes-key-wrap=on|off controls support for AES key wrapping (default=on)
dea-key-wrap=on|off controls support for DEA key wrapping (default=on)
suppress-vmdesc=on|off disables self-describing migration (default=off)
nvdimm=on|off controls NVDIMM support (default=off)
memory-encryption=@var{} memory encryption object to use (default=none)
hmat=on|off controls ACPI HMAT support (default=off)
memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none)
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]
sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid
-cpu cpu select CPU ('-cpu help' for list)
-accel [accel=]accelerator[,prop[=value][,...]]
select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)
igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)
kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)
kvm-shadow-mem=size of KVM shadow MMU in bytes
one-insn-per-tb=on|off (one guest instruction per TCG translation block)
split-wx=on|off (enable TCG split w^x mapping)
tb-size=n (TCG translation block cache size)
dirty-ring-size=n (KVM dirty ring GFN count, default 0)
eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only)
notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only)
thread=single|multi (enable multi-threaded TCG)
device=path (KVM device path, default /dev/kvm)
-smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets]
[,dies=dies][,clusters=clusters][,modules=modules][,cores=cores]
[,threads=threads]
set the number of initial CPUs to 'n' [default=1]
maxcpus= maximum number of total CPUs, including
offline CPUs for hotplug, etc
drawers= number of drawers on the machine board
books= number of books in one drawer
sockets= number of sockets in one book
dies= number of dies in one socket
clusters= number of clusters in one die
modules= number of modules in one cluster
cores= number of cores in one module
threads= number of threads in one core
Note: Different machines may have different subsets of the CPU topology
parameters supported, so the actual meaning of the supported parameters
will vary accordingly. For example, for a machine type that supports a
three-level CPU hierarchy of sockets/cores/threads, the parameters will
sequentially mean as below:
sockets means the number of sockets on the machine board
cores means the number of cores in one socket
threads means the number of threads in one core
For a particular machine type board, an expected CPU topology hierarchy
can be defined through the supported sub-option. Unsupported parameters
can also be provided in addition to the sub-option, but their values
must be set as 1 in the purpose of correct parsing.
-numa node[,mem=size][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa node[,memdev=id][,cpus=firstcpu[-lastcpu]][,nodeid=node][,initiator=node]
-numa dist,src=source,dst=destination,val=distance
-numa cpu,node-id=node[,socket-id=x][,core-id=y][,thread-id=z]
-numa hmat-lb,initiator=node,target=node,hierarchy=memory|first-level|second-level|third-level,data-type=access-latency|read-latency|write-latency[,latency=lat][,bandwidth=bw]
-numa hmat-cache,node-id=node,size=size,level=level[,associativity=none|direct|complex][,policy=none|write-back|write-through][,line=size]
-add-fd fd=fd,set=set[,opaque=opaque]
Add 'fd' to fd 'set'
-set group.id.arg=value
set <arg> parameter for item <id> of type <group>
i.e. -set drive.$id.file=/path/to/image
-global driver.property=value
-global driver=driver,property=property,value=value
set a global default for a driver property
-boot [order=drives][,once=drives][,menu=on|off]
[,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]
'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)
'sp_name': the file's name that would be passed to bios as logo picture, if menu=on
'sp_time': the period that splash picture last if menu=on, unit is ms
'rb_timeout': the timeout before guest reboot when boot failed, unit is ms
-m [size=]megs[,slots=n,maxmem=size]
configure guest RAM
size: initial amount of guest memory
slots: number of hotplug slots (default: none)
maxmem: maximum amount of guest memory (default: none)
Note: Some architectures might enforce a specific granularity
-mem-path FILE provide backing storage for guest RAM
-mem-prealloc preallocate guest memory (use with -mem-path)
-k language use keyboard layout (for example 'fr' for French)
-audio [driver=]driver[,prop[=value][,...]]
specifies default audio backend when `audiodev` is not
used to create a machine or sound device; options are the same as for -audiodev
-audio [driver=]driver,model=value[,prop[=value][,...]]
specifies the audio backend and device to use;
apart from 'model', options are the same as for -audiodev.
use '-audio model=help' to show possible devices.
-audiodev [driver=]driver,id=id[,prop[=value][,...]]
specifies the audio backend to use
Use ``-audiodev help`` to list the available drivers
id= identifier of the backend
timer-period= timer period in microseconds
in|out.mixing-engine= use mixing engine to mix streams inside QEMU
in|out.fixed-settings= use fixed settings for host audio
in|out.frequency= frequency to use with fixed settings
in|out.channels= number of channels to use with fixed settings
in|out.format= sample format to use with fixed settings
valid values: s8, s16, s32, u8, u16, u32, f32
in|out.voices= number of voices to use
in|out.buffer-length= length of buffer in microseconds
-audiodev none,id=id,[,prop[=value][,...]]
dummy driver that discards all output
-audiodev wav,id=id[,prop[=value][,...]]
path= path of wav file to record
-device driver[,prop[=value][,...]]
add device (based on driver)
prop=value,... sets driver properties
use '-device help' to print all possible drivers
use '-device driver,help' to print all possible properties
-name string1[,process=string2][,debug-threads=on|off]
set the name of the guest
string1 sets the window title and string2 the process name
When debug-threads is enabled, individual threads are given a separate name
NOTE: The thread names are for debugging and not a stable API.
-uuid %08x-%04x-%04x-%04x-%012x
specify machine UUID
Block device options:
-fda/-fdb file use 'file' as floppy disk 0/1 image
-hda/-hdb file use 'file' as hard disk 0/1 image
-hdc/-hdd file use 'file' as hard disk 2/3 image
-cdrom file use 'file' as CD-ROM image
-blockdev [driver=]driver[,node-name=N][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]
[,cache=writethrough|writeback|none|directsync|unsafe][,format=f]
[,snapshot=on|off][,rerror=ignore|stop|report]
[,werror=ignore|stop|report|enospc][,id=name]
[,aio=threads|native|io_uring]
[,readonly=on|off][,copy-on-read=on|off]
[,discard=ignore|unmap][,detect-zeroes=on|off|unmap]
[[,bps=b]|[[,bps_rd=r][,bps_wr=w]]]
[[,iops=i]|[[,iops_rd=r][,iops_wr=w]]]
[[,bps_max=bm]|[[,bps_rd_max=rm][,bps_wr_max=wm]]]
[[,iops_max=im]|[[,iops_rd_max=irm][,iops_wr_max=iwm]]]
[[,iops_size=is]]
[[,group=g]]
use 'file' as a drive image
-mtdblock file use 'file' as on-board Flash memory image
-sd file use 'file' as SecureDigital card image
-snapshot write to temporary files instead of disk image files
-fsdev local,id=id,path=path,security_model=mapped-xattr|mapped-file|passthrough|none
[,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode]
[[,throttling.bps-total=b]|[[,throttling.bps-read=r][,throttling.bps-write=w]]]
[[,throttling.iops-total=i]|[[,throttling.iops-read=r][,throttling.iops-write=w]]]
[[,throttling.bps-total-max=bm]|[[,throttling.bps-read-max=rm][,throttling.bps-write-max=wm]]]
[[,throttling.iops-total-max=im]|[[,throttling.iops-read-max=irm][,throttling.iops-write-max=iwm]]]
[[,throttling.iops-size=is]]
-fsdev proxy,id=id,socket=socket[,writeout=immediate][,readonly=on]
-fsdev proxy,id=id,sock_fd=sock_fd[,writeout=immediate][,readonly=on]
-fsdev synth,id=id
-virtfs local,path=path,mount_tag=tag,security_model=mapped-xattr|mapped-file|passthrough|none
[,id=id][,writeout=immediate][,readonly=on][,fmode=fmode][,dmode=dmode][,multidevs=remap|forbid|warn]
-virtfs proxy,mount_tag=tag,socket=socket[,id=id][,writeout=immediate][,readonly=on]
-virtfs proxy,mount_tag=tag,sock_fd=sock_fd[,id=id][,writeout=immediate][,readonly=on]
-virtfs synth,mount_tag=tag[,id=id][,readonly=on]
-iscsi [user=user][,password=password][,password-secret=secret-id]
[,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE]
[,initiator-name=initiator-iqn][,id=target-iqn]
[,timeout=timeout]
iSCSI session parameters
USB convenience options:
-usb enable on-board USB host controller (if not enabled by default)
-usbdevice name add the host or guest USB device 'name'
Display options:
-display vnc=<display>[,<optargs>]
-display none
select display backend type
The default display is equivalent to
"-vnc localhost:0,to=99,id=default"
-nographic disable graphical output and redirect serial I/Os to console
-portrait rotate graphical output 90 deg left (only PXA LCD)
-rotate <deg> rotate graphical output some deg left (only PXA LCD)
-vga [std|cirrus|vmware|qxl|xenfb|tcx|cg3|virtio|none]
select video card type
-full-screen start in full screen
-vnc <display> shorthand for -display vnc=<display>
i386 target only:
-win2k-hack use it when installing Windows 2000 to avoid a disk full bug
-no-fd-bootchk disable boot signature checking for floppy disks
-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]
ACPI table description
-smbios file=binary
load SMBIOS entry from binary file
-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]
[,uefi=on|off]
specify SMBIOS type 0 fields
-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]
[,uuid=uuid][,sku=str][,family=str]
specify SMBIOS type 1 fields
-smbios type=2[,manufacturer=str][,product=str][,version=str][,serial=str]
[,asset=str][,location=str]
specify SMBIOS type 2 fields
-smbios type=3[,manufacturer=str][,version=str][,serial=str][,asset=str]
[,sku=str]
specify SMBIOS type 3 fields
-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str]
[,asset=str][,part=str][,max-speed=%d][,current-speed=%d]
[,processor-family=%d][,processor-id=%d]
specify SMBIOS type 4 fields
-smbios type=8[,external_reference=str][,internal_reference=str][,connector_type=%d][,port_type=%d]
specify SMBIOS type 8 fields
-smbios type=11[,value=str][,path=filename]
specify SMBIOS type 11 fields
-smbios type=17[,loc_pfx=str][,bank=str][,manufacturer=str][,serial=str]
[,asset=str][,part=str][,speed=%d]
specify SMBIOS type 17 fields
-smbios type=41[,designation=str][,kind=str][,instance=%d][,pcidev=str]
specify SMBIOS type 41 fields
Network options:
-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]
[,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]
[,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]
[,poll-us=n]
configure a host TAP network backend with ID 'str'
connected to a bridge (default=br0)
use network scripts 'file' (default=/etc/qemu-ifup)
to configure it and 'dfile' (default=/etc/qemu-ifdown)
to deconfigure it
use '[down]script=no' to disable script execution
use network helper 'helper' (default=/usr/lib/qemu/qemu-bridge-helper) to
configure it
use 'fd=h' to connect to an already opened TAP interface
use 'fds=x:y:...:z' to connect to already opened multiqueue capable TAP interfaces
use 'sndbuf=nbytes' to limit the size of the send buffer (the
default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')
use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag
use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition
use vhost=on to enable experimental in kernel accelerator
(only has effect for virtio guests which use MSIX)
use vhostforce=on to force vhost on for non-MSIX virtio guests
use 'vhostfd=h' to connect to an already opened vhost net device
use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices
use 'queues=n' to specify the number of queues to be created for multiqueue TAP
use 'poll-us=n' to specify the maximum number of microseconds that could be
spent on busy polling for vhost net
-netdev bridge,id=str[,br=bridge][,helper=helper]
configure a host TAP network backend with ID 'str' that is
connected to a bridge (default=br0)
using the program 'helper (default=/usr/lib/qemu/qemu-bridge-helper)
-netdev l2tpv3,id=str,src=srcaddr,dst=dstaddr[,srcport=srcport][,dstport=dstport]
[,rxsession=rxsession],txsession=txsession[,ipv6=on|off][,udp=on|off]
[,cookie64=on|off][,counter][,pincounter][,txcookie=txcookie]
[,rxcookie=rxcookie][,offset=offset]
configure a network backend with ID 'str' connected to
an Ethernet over L2TPv3 pseudowire.
Linux kernel 3.3+ as well as most routers can talk
L2TPv3. This transport allows connecting a VM to a VM,
VM to a router and even VM to Host. It is a nearly-universal
standard (RFC3931). Note - this implementation uses static
pre-configured tunnels (same as the Linux kernel).
use 'src=' to specify source address
use 'dst=' to specify destination address
use 'udp=on' to specify udp encapsulation
use 'srcport=' to specify source udp port
use 'dstport=' to specify destination udp port
use 'ipv6=on' to force v6
L2TPv3 uses cookies to prevent misconfiguration as
well as a weak security measure
use 'rxcookie=0x012345678' to specify a rxcookie
use 'txcookie=0x012345678' to specify a txcookie
use 'cookie64=on' to set cookie size to 64 bit, otherwise 32
use 'counter=off' to force a 'cut-down' L2TPv3 with no counter
use 'pincounter=on' to work around broken counter handling in peer
use 'offset=X' to add an extra offset between header and data
-netdev socket,id=str[,fd=h][,listen=[host]:port][,connect=host:port]
configure a network backend to connect to another network
using a socket connection
-netdev socket,id=str[,fd=h][,mcast=maddr:port[,localaddr=addr]]
configure a network backend to connect to a multicast maddr and port
use 'localaddr=addr' to specify the host address to send packets from
-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]
configure a network backend to connect to another network
using an UDP tunnel
-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]
-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]
configure a network backend to connect to another network
using a socket connection in stream mode.
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]
-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]
configure a network backend to connect to a multicast maddr and port
use ``local.host=addr`` to specify the host address to send packets from
-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]
-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]
-netdev dgram,id=str,local.type=fd,local.str=file-descriptor
configure a network backend to connect to another network
using an UDP tunnel
-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]
configure a vhost-user network, backed by a chardev 'dev'
-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]
configure a vhost-vdpa network,Establish a vhost-vdpa netdev
use 'vhostdev=/path/to/dev' to open a vhost vdpa device
use 'vhostfd=h' to connect to an already opened vhost vdpa device
-netdev hubport,id=str,hubid=n[,netdev=nd]
configure a hub port on the hub with ID 'n'
-nic [tap|bridge|l2tpv3|vhost-user|socket][,option][,...][mac=macaddr]
initialize an on-board / default host NIC (using MAC address
macaddr) and connect it to the given host network backend
-nic none use it alone to have zero network devices (the default is to
provided a 'user' network connection)
-net nic[,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]
configure or create an on-board (or machine default) NIC and
connect it to hub 0 (please use -nic unless you need a hub)
-net [tap|bridge|socket][,option][,option][,...]
old way to initialize a host network interface
(use the -netdev option if possible instead)
Character device options:
-chardev help
-chardev null,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev socket,id=id[,host=host],port=port[,to=to][,ipv4=on|off][,ipv6=on|off][,nodelay=on|off]
[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds][,mux=on|off]
[,logfile=PATH][,logappend=on|off][,tls-creds=ID][,tls-authz=ID] (tcp)
-chardev socket,id=id,path=path[,server=on|off][,wait=on|off][,telnet=on|off][,websocket=on|off][,reconnect=seconds]
[,mux=on|off][,logfile=PATH][,logappend=on|off][,abstract=on|off][,tight=on|off] (unix)
-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]
[,localport=localport][,ipv4=on|off][,ipv6=on|off][,mux=on|off]
[,logfile=PATH][,logappend=on|off]
-chardev msmouse,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]
[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev ringbuf,id=id[,size=size][,logfile=PATH][,logappend=on|off]
-chardev file,id=id,path=path[,input-path=input-file][,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pipe,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev pty,id=id[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev stdio,id=id[,mux=on|off][,signal=on|off][,logfile=PATH][,logappend=on|off]
-chardev serial,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
-chardev parallel,id=id,path=path[,mux=on|off][,logfile=PATH][,logappend=on|off]
Boot Image or Kernel specific:
-bios file set the filename for the BIOS
-pflash file use 'file' as a parallel flash image
-kernel bzImage use 'bzImage' as kernel image
-append cmdline use 'cmdline' as kernel command line
-initrd file use 'file' as initial ram disk
-dtb file use 'file' as device tree image
Debug/Expert options:
-compat [deprecated-input=accept|reject|crash][,deprecated-output=accept|hide]
Policy for handling deprecated management interfaces
-compat [unstable-input=accept|reject|crash][,unstable-output=accept|hide]
Policy for handling unstable management interfaces
-fw_cfg [name=]<name>,file=<file>
add named fw_cfg entry with contents from file
-fw_cfg [name=]<name>,string=<str>
add named fw_cfg entry with contents from string
-serial dev redirect the serial port to char device 'dev'
-parallel dev redirect the parallel port to char device 'dev'
-monitor dev redirect the monitor to char device 'dev'
-qmp dev like -monitor but opens in 'control' mode
-qmp-pretty dev like -qmp but uses pretty JSON formatting
-mon [chardev=]name[,mode=readline|control][,pretty[=on|off]]
-debugcon dev redirect the debug console to char device 'dev'
-pidfile file write PID to 'file'
--preconfig pause QEMU before machine is initialized (experimental)
-S freeze CPU at startup (use 'c' to start execution)
-overcommit [mem-lock=on|off][cpu-pm=on|off]
run qemu with overcommit hints
mem-lock=on|off controls memory lock support (default: off)
cpu-pm=on|off controls cpu power management (default: off)
-gdb dev accept gdb connection on 'dev'. (QEMU defaults to starting
the guest without waiting for gdb to connect; use -S too
if you want it to not start execution.)
-s shorthand for -gdb tcp::1234
-d item1,... enable logging of specified items (use '-d help' for a list of log items)
-D logfile output log to logfile (default stderr)
-dfilter range,.. filter debug output to range of addresses (useful for -d cpu,exec,etc..)
-seed number seed the pseudo-random number generator
-L path set the directory for the BIOS, VGA BIOS and keymaps
-enable-kvm enable KVM full virtualization support
-xen-domid id specify xen guest domain id
-xen-attach attach to existing xen domain
libxl will use this when starting QEMU
-xen-domid-restrict restrict set of available xen operations
to specified domain id. (Does not affect
xenpv machine type).
-no-reboot exit instead of rebooting
-no-shutdown stop before shutdown
-action reboot=reset|shutdown
action when guest reboots [default=reset]
-action shutdown=poweroff|pause
action when guest shuts down [default=poweroff]
-action panic=pause|shutdown|exit-failure|none
action when guest panics [default=shutdown]
-action watchdog=reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-loadvm [tag|id]
start right away with a saved state (loadvm in monitor)
-daemonize daemonize QEMU after initializing
-option-rom rom load a file, rom, into the option ROM space
-rtc [base=utc|localtime|<datetime>][,clock=host|rt|vm][,driftfix=none|slew]
set the RTC base and clock, enable drift fix for clock ticks (x86 only)
-icount [shift=N|auto][,align=on|off][,sleep=on|off][,rr=record|replay,rrfile=<filename>[,rrsnapshot=<snapshot>]]
enable virtual instruction counter with 2^N clock ticks per
instruction, enable aligning the host and virtual clocks
or disable real time cpu sleeping, and optionally enable
record-and-replay mode
-watchdog-action reset|shutdown|poweroff|inject-nmi|pause|debug|none
action when watchdog fires [default=reset]
-echr chr set terminal escape character instead of ctrl-a
-incoming tcp:[host]:port[,to=maxport][,ipv4=on|off][,ipv6=on|off]
-incoming rdma:host:port[,ipv4=on|off][,ipv6=on|off]
-incoming unix:socketpath
prepare for incoming migration, listen on
specified protocol and socket address
-incoming fd:fd
-incoming file:filename[,offset=offset]
-incoming exec:cmdline
accept incoming migration on given file descriptor
or from given external command
-incoming defer
wait for the URI to be specified via migrate_incoming
-only-migratable allow only migratable devices
-nodefaults don't create default devices
-runas user change to user id user just before starting the VM
user can be numeric uid:gid instead
-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]
[,spawn=allow|deny][,resourcecontrol=allow|deny]
Enable seccomp mode 2 system call filter (default 'off').
use 'obsolete' to allow obsolete system calls that are provided
by the kernel, but typically no longer used by modern
C library implementations.
use 'elevateprivileges' to allow or deny the QEMU process ability
to elevate privileges using set*uid|gid system calls.
The value 'children' will deny set*uid|gid system calls for
main QEMU process but will allow forks and execves to run unprivileged
use 'spawn' to avoid QEMU to spawn new threads or processes by
blocking *fork and execve
use 'resourcecontrol' to disable process affinity and schedular priority
-readconfig <file>
read config file
-no-user-config
do not load default user-provided config files at startup
-trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-plugin [file=]<file>[,<argname>=<argvalue>]
load a plugin
-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]
Set miscellaneous QEMU process lifecycle options:
async-teardown=on enables asynchronous teardown (Linux only)
chroot=dir chroot to dir just before starting the VM
user=username switch to the specified user before starting the VM
user=uid:gid ditto, but use specified user-ID and group-ID instead
-msg [timestamp[=on|off]][,guest-name=[on|off]]
control error message format
timestamp=on enables timestamps (default: off)
guest-name=on enables guest name prefix but only if
-name guest option is set (default: off)
-dump-vmstate <file>
Output vmstate information in JSON format to file.
Use the scripts/vmstate-static-checker.py file to
check for possible regressions in migration code
by comparing two such vmstate dumps.
-enable-sync-profile
enable synchronization profiling
Generic object creation:
-object TYPENAME[,PROP1=VALUE1,...]
create a new object of type TYPENAME setting properties
in the order they are specified. Note that the 'id'
property must be set. These objects are placed in the
'/objects' path.
During emulation, the following keys are useful:
ctrl-alt-f toggle full screen
ctrl-alt-n switch to virtual console 'n'
ctrl-alt-g toggle mouse and keyboard grab
When using -nographic, press 'ctrl-a h' to get some help.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-system-xen
This package provides the i386 system emulation binary to work together with the Xen hypervisor for some types of DomUs. This package is not useful by its own.
Installed size: 23.54 MB
How to install: sudo apt install qemu-system-xen
Dependencies:
- libc6
- libfdt1
- libglib2.0-0t64
- libjpeg62-turbo
- libpixman-1-0
- libspice-server1
- libusb-1.0-0
- libxendevicemodel1t64
- libxenevtchn1t64
- libxenforeignmemory1t64
- libxengnttab1t64
- libxenmisc4.17t64
- libxenstore4t64
- libxentoolcore1t64
- qemu-system-data
- seabios
- zlib1g
qemu-user
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides statically linked user mode emulation binaries. In user mode QEMU can launch Linux processes compiled for one CPU on another CPU.
If qemu-user-binfmt package is also installed, it will register binary
format handlers from this qemu-user package with the kernel automatically
so it will be possible to run foreign binaries directly. Without
qemu-user-binfmt, it is possible to register certain binfmt(s) by using:
cat /usr/share/qemu/binfmt.d/qemu-ARCH.conf
> /proc/sys/fs/binfmt_misc/register
Installed size: 371.71 MB
How to install: sudo apt install qemu-user
qemu-aarch64
QEMU User Emulator (static version)
root@kali:~# qemu-aarch64 -h
usage: qemu-aarch64 [options] program [arguments...]
Linux CPU emulator (compiled for aarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-aarch64_be
QEMU User Emulator (static version)
root@kali:~# qemu-aarch64_be -h
usage: qemu-aarch64_be [options] program [arguments...]
Linux CPU emulator (compiled for aarch64_be emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64_be
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-alpha
QEMU User Emulator (static version)
root@kali:~# qemu-alpha -h
usage: qemu-alpha [options] program [arguments...]
Linux CPU emulator (compiled for alpha emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-alpha
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-amd64
QEMU User Emulator (static version)
root@kali:~# qemu-amd64 -h
usage: qemu-x86_64 [options] program [arguments...]
Linux CPU emulator (compiled for x86_64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-x86_64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-arm
QEMU User Emulator (static version)
root@kali:~# qemu-arm -h
usage: qemu-arm [options] program [arguments...]
Linux CPU emulator (compiled for arm emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-arm
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-arm64
QEMU User Emulator (static version)
root@kali:~# qemu-arm64 -h
usage: qemu-aarch64 [options] program [arguments...]
Linux CPU emulator (compiled for aarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-armeb
QEMU User Emulator (static version)
root@kali:~# qemu-armeb -h
usage: qemu-armeb [options] program [arguments...]
Linux CPU emulator (compiled for armeb emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-armeb
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-armel
QEMU User Emulator (static version)
root@kali:~# qemu-armel -h
usage: qemu-arm [options] program [arguments...]
Linux CPU emulator (compiled for arm emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-arm
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-armhf
QEMU User Emulator (static version)
root@kali:~# qemu-armhf -h
usage: qemu-arm [options] program [arguments...]
Linux CPU emulator (compiled for arm emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-arm
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-cris
QEMU User Emulator (static version)
root@kali:~# qemu-cris -h
usage: qemu-cris [options] program [arguments...]
Linux CPU emulator (compiled for cris emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-cris
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-hexagon
QEMU User Emulator (static version)
root@kali:~# qemu-hexagon -h
usage: qemu-hexagon [options] program [arguments...]
Linux CPU emulator (compiled for hexagon emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-hexagon
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-hppa
QEMU User Emulator (static version)
root@kali:~# qemu-hppa -h
usage: qemu-hppa [options] program [arguments...]
Linux CPU emulator (compiled for hppa emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-hppa
QEMU_STACK_SIZE = 83886080 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-i386
QEMU User Emulator (static version)
root@kali:~# qemu-i386 -h
usage: qemu-i386 [options] program [arguments...]
Linux CPU emulator (compiled for i386 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-i386
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-loong64
QEMU User Emulator (static version)
root@kali:~# qemu-loong64 -h
usage: qemu-loongarch64 [options] program [arguments...]
Linux CPU emulator (compiled for loongarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-loongarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-loongarch64
QEMU User Emulator (static version)
root@kali:~# qemu-loongarch64 -h
usage: qemu-loongarch64 [options] program [arguments...]
Linux CPU emulator (compiled for loongarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-loongarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-m68k
QEMU User Emulator (static version)
root@kali:~# qemu-m68k -h
usage: qemu-m68k [options] program [arguments...]
Linux CPU emulator (compiled for m68k emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-m68k
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-microblaze
QEMU User Emulator (static version)
root@kali:~# qemu-microblaze -h
usage: qemu-microblaze [options] program [arguments...]
Linux CPU emulator (compiled for microblaze emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-microblaze
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-microblazeel
QEMU User Emulator (static version)
root@kali:~# qemu-microblazeel -h
usage: qemu-microblazeel [options] program [arguments...]
Linux CPU emulator (compiled for microblazeel emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-microblazeel
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mips
QEMU User Emulator (static version)
root@kali:~# qemu-mips -h
usage: qemu-mips [options] program [arguments...]
Linux CPU emulator (compiled for mips emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mips
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mips64
QEMU User Emulator (static version)
root@kali:~# qemu-mips64 -h
usage: qemu-mips64 [options] program [arguments...]
Linux CPU emulator (compiled for mips64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mips64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mips64el
QEMU User Emulator (static version)
root@kali:~# qemu-mips64el -h
usage: qemu-mips64el [options] program [arguments...]
Linux CPU emulator (compiled for mips64el emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mips64el
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mipsel
QEMU User Emulator (static version)
root@kali:~# qemu-mipsel -h
usage: qemu-mipsel [options] program [arguments...]
Linux CPU emulator (compiled for mipsel emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mipsel
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mipsn32
QEMU User Emulator (static version)
root@kali:~# qemu-mipsn32 -h
usage: qemu-mipsn32 [options] program [arguments...]
Linux CPU emulator (compiled for mipsn32 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mipsn32
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mipsn32el
QEMU User Emulator (static version)
root@kali:~# qemu-mipsn32el -h
usage: qemu-mipsn32el [options] program [arguments...]
Linux CPU emulator (compiled for mipsn32el emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mipsn32el
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-or1k
QEMU User Emulator (static version)
root@kali:~# qemu-or1k -h
usage: qemu-or1k [options] program [arguments...]
Linux CPU emulator (compiled for or1k emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-or1k
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-powerpc
QEMU User Emulator (static version)
root@kali:~# qemu-powerpc -h
usage: qemu-ppc [options] program [arguments...]
Linux CPU emulator (compiled for ppc emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc
QEMU User Emulator (static version)
root@kali:~# qemu-ppc -h
usage: qemu-ppc [options] program [arguments...]
Linux CPU emulator (compiled for ppc emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc64
QEMU User Emulator (static version)
root@kali:~# qemu-ppc64 -h
usage: qemu-ppc64 [options] program [arguments...]
Linux CPU emulator (compiled for ppc64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc64el
QEMU User Emulator (static version)
root@kali:~# qemu-ppc64el -h
usage: qemu-ppc64le [options] program [arguments...]
Linux CPU emulator (compiled for ppc64le emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc64le
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc64le
QEMU User Emulator (static version)
root@kali:~# qemu-ppc64le -h
usage: qemu-ppc64le [options] program [arguments...]
Linux CPU emulator (compiled for ppc64le emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc64le
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-riscv32
QEMU User Emulator (static version)
root@kali:~# qemu-riscv32 -h
usage: qemu-riscv32 [options] program [arguments...]
Linux CPU emulator (compiled for riscv32 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-riscv32
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-riscv64
QEMU User Emulator (static version)
root@kali:~# qemu-riscv64 -h
usage: qemu-riscv64 [options] program [arguments...]
Linux CPU emulator (compiled for riscv64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-riscv64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-s390x
QEMU User Emulator (static version)
root@kali:~# qemu-s390x -h
usage: qemu-s390x [options] program [arguments...]
Linux CPU emulator (compiled for s390x emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-s390x
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sh4
QEMU User Emulator (static version)
root@kali:~# qemu-sh4 -h
usage: qemu-sh4 [options] program [arguments...]
Linux CPU emulator (compiled for sh4 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sh4
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sh4eb
QEMU User Emulator (static version)
root@kali:~# qemu-sh4eb -h
usage: qemu-sh4eb [options] program [arguments...]
Linux CPU emulator (compiled for sh4eb emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sh4eb
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sparc
QEMU User Emulator (static version)
root@kali:~# qemu-sparc -h
usage: qemu-sparc [options] program [arguments...]
Linux CPU emulator (compiled for sparc emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sparc
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sparc32plus
QEMU User Emulator (static version)
root@kali:~# qemu-sparc32plus -h
usage: qemu-sparc32plus [options] program [arguments...]
Linux CPU emulator (compiled for sparc32plus emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sparc32plus
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sparc64
QEMU User Emulator (static version)
root@kali:~# qemu-sparc64 -h
usage: qemu-sparc64 [options] program [arguments...]
Linux CPU emulator (compiled for sparc64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sparc64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-x86_64
QEMU User Emulator (static version)
root@kali:~# qemu-x86_64 -h
usage: qemu-x86_64 [options] program [arguments...]
Linux CPU emulator (compiled for x86_64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-x86_64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-xtensa
QEMU User Emulator (static version)
root@kali:~# qemu-xtensa -h
usage: qemu-xtensa [options] program [arguments...]
Linux CPU emulator (compiled for xtensa emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-xtensa-abi-call0 QEMU_XTENSA_ABI_CALL0 assume CALL0 Xtensa ABI
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-xtensa
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-xtensaeb
QEMU User Emulator (static version)
root@kali:~# qemu-xtensaeb -h
usage: qemu-xtensaeb [options] program [arguments...]
Linux CPU emulator (compiled for xtensaeb emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-xtensa-abi-call0 QEMU_XTENSA_ABI_CALL0 assume CALL0 Xtensa ABI
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-xtensaeb
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-user-binfmt
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides binfmt support registration for the user-mode emulation binaries from qemu-user. This package does not contain additional binaries, just (sym)links to binfmt registration data in /usr/lib/binfmt.d/ so it is picked up automatically by, eg, systemd. Actual files are provided by qemu-user package.
Installed size: 39 KB
How to install: sudo apt install qemu-user-binfmt
Dependencies:
- qemu-user
qemu-user-static
In the past, this package provided statically-built qemu user-mode emulation binaries. Now this functionality is provided by qemu-user package, and this package just to help migration to qemu-user.
This package provides old/compatibility symlinks from qemu-user-static binaries pointing to corresponding qemu-user binaries, and old qemu-debootstrap script. Neither of these should be used in practice.
Please remove this package once you ensure nothing is using the old interfaces.
Installed size: 156 KB
How to install: sudo apt install qemu-user-static
Dependencies:
- qemu-user
- qemu-user-binfmt
qemu-aarch64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-aarch64-static -h
usage: qemu-aarch64 [options] program [arguments...]
Linux CPU emulator (compiled for aarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-aarch64_be-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-aarch64_be-static -h
usage: qemu-aarch64_be [options] program [arguments...]
Linux CPU emulator (compiled for aarch64_be emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64_be
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-alpha-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-alpha-static -h
usage: qemu-alpha [options] program [arguments...]
Linux CPU emulator (compiled for alpha emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-alpha
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-amd64-static
root@kali:~# qemu-amd64-static -h
usage: qemu-x86_64 [options] program [arguments...]
Linux CPU emulator (compiled for x86_64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-x86_64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-arm-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-arm-static -h
usage: qemu-arm [options] program [arguments...]
Linux CPU emulator (compiled for arm emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-arm
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-arm64-static
root@kali:~# qemu-arm64-static -h
usage: qemu-aarch64 [options] program [arguments...]
Linux CPU emulator (compiled for aarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-armeb-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-armeb-static -h
usage: qemu-armeb [options] program [arguments...]
Linux CPU emulator (compiled for armeb emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-armeb
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-armel-static
root@kali:~# qemu-armel-static -h
usage: qemu-arm [options] program [arguments...]
Linux CPU emulator (compiled for arm emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-arm
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-armhf-static
root@kali:~# qemu-armhf-static -h
usage: qemu-arm [options] program [arguments...]
Linux CPU emulator (compiled for arm emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-arm
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-cris-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-cris-static -h
usage: qemu-cris [options] program [arguments...]
Linux CPU emulator (compiled for cris emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-cris
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-debootstrap
QEMU debootstrap wrapper
root@kali:~# man qemu-debootstrap
qemu-debootstrap(1) Debian qemu-debootstrap(1)
NAME
qemu-debootstrap - QEMU debootstrap wrapper
SYNOPSIS
qemu-debootstrap [options]
DESCRIPTION
The qemu-debootstrap wrapper calls debootstrap(8) making use of the
--foreign and --second-stage options, and copies the appropriate
qemu-user-static(1) binary into place in order to install cross-archi-
tecture chroots. In order for it to work seamlessly, the binfmt-support
package must be installed.
SEE ALSO
debootstrap(8), qemu-user-static(1).
AUTHOR
This manual page was written by Vagrant Cascadian <[email protected]>.
0.14.1+dfsg 2011-07-02 qemu-debootstrap(1)
qemu-hexagon-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-hexagon-static -h
usage: qemu-hexagon [options] program [arguments...]
Linux CPU emulator (compiled for hexagon emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-hexagon
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-hppa-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-hppa-static -h
usage: qemu-hppa [options] program [arguments...]
Linux CPU emulator (compiled for hppa emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-hppa
QEMU_STACK_SIZE = 83886080 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-i386-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-i386-static -h
usage: qemu-i386 [options] program [arguments...]
Linux CPU emulator (compiled for i386 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-i386
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-loong64-static
root@kali:~# qemu-loong64-static -h
usage: qemu-loongarch64 [options] program [arguments...]
Linux CPU emulator (compiled for loongarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-loongarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-loongarch64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-loongarch64-static -h
usage: qemu-loongarch64 [options] program [arguments...]
Linux CPU emulator (compiled for loongarch64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-loongarch64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-m68k-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-m68k-static -h
usage: qemu-m68k [options] program [arguments...]
Linux CPU emulator (compiled for m68k emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-m68k
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-microblaze-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-microblaze-static -h
usage: qemu-microblaze [options] program [arguments...]
Linux CPU emulator (compiled for microblaze emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-microblaze
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-microblazeel-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-microblazeel-static -h
usage: qemu-microblazeel [options] program [arguments...]
Linux CPU emulator (compiled for microblazeel emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-microblazeel
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mips-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-mips-static -h
usage: qemu-mips [options] program [arguments...]
Linux CPU emulator (compiled for mips emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mips
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mips64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-mips64-static -h
usage: qemu-mips64 [options] program [arguments...]
Linux CPU emulator (compiled for mips64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mips64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mips64el-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-mips64el-static -h
usage: qemu-mips64el [options] program [arguments...]
Linux CPU emulator (compiled for mips64el emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mips64el
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mipsel-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-mipsel-static -h
usage: qemu-mipsel [options] program [arguments...]
Linux CPU emulator (compiled for mipsel emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mipsel
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mipsn32-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-mipsn32-static -h
usage: qemu-mipsn32 [options] program [arguments...]
Linux CPU emulator (compiled for mipsn32 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mipsn32
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-mipsn32el-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-mipsn32el-static -h
usage: qemu-mipsn32el [options] program [arguments...]
Linux CPU emulator (compiled for mipsn32el emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-mipsn32el
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-or1k-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-or1k-static -h
usage: qemu-or1k [options] program [arguments...]
Linux CPU emulator (compiled for or1k emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-or1k
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-powerpc-static
root@kali:~# qemu-powerpc-static -h
usage: qemu-ppc [options] program [arguments...]
Linux CPU emulator (compiled for ppc emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-ppc-static -h
usage: qemu-ppc [options] program [arguments...]
Linux CPU emulator (compiled for ppc emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-ppc64-static -h
usage: qemu-ppc64 [options] program [arguments...]
Linux CPU emulator (compiled for ppc64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc64el-static
root@kali:~# qemu-ppc64el-static -h
usage: qemu-ppc64le [options] program [arguments...]
Linux CPU emulator (compiled for ppc64le emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc64le
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-ppc64le-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-ppc64le-static -h
usage: qemu-ppc64le [options] program [arguments...]
Linux CPU emulator (compiled for ppc64le emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-ppc64le
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-riscv32-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-riscv32-static -h
usage: qemu-riscv32 [options] program [arguments...]
Linux CPU emulator (compiled for riscv32 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-riscv32
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-riscv64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-riscv64-static -h
usage: qemu-riscv64 [options] program [arguments...]
Linux CPU emulator (compiled for riscv64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-riscv64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-s390x-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-s390x-static -h
usage: qemu-s390x [options] program [arguments...]
Linux CPU emulator (compiled for s390x emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-s390x
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sh4-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-sh4-static -h
usage: qemu-sh4 [options] program [arguments...]
Linux CPU emulator (compiled for sh4 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sh4
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sh4eb-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-sh4eb-static -h
usage: qemu-sh4eb [options] program [arguments...]
Linux CPU emulator (compiled for sh4eb emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sh4eb
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sparc-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-sparc-static -h
usage: qemu-sparc [options] program [arguments...]
Linux CPU emulator (compiled for sparc emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sparc
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sparc32plus-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-sparc32plus-static -h
usage: qemu-sparc32plus [options] program [arguments...]
Linux CPU emulator (compiled for sparc32plus emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sparc32plus
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-sparc64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-sparc64-static -h
usage: qemu-sparc64 [options] program [arguments...]
Linux CPU emulator (compiled for sparc64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-sparc64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-x86_64-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-x86_64-static -h
usage: qemu-x86_64 [options] program [arguments...]
Linux CPU emulator (compiled for x86_64 emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-x86_64
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-xtensa-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-xtensa-static -h
usage: qemu-xtensa [options] program [arguments...]
Linux CPU emulator (compiled for xtensa emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-xtensa-abi-call0 QEMU_XTENSA_ABI_CALL0 assume CALL0 Xtensa ABI
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-xtensa
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-xtensaeb-static
QEMU User Emulator (compatibility symlink)
root@kali:~# qemu-xtensaeb-static -h
usage: qemu-xtensaeb [options] program [arguments...]
Linux CPU emulator (compiled for xtensaeb emulation)
Options and associated environment variables:
Argument Env-variable Description
-h print this help
-help
-g port QEMU_GDB wait gdb connection to 'port'
-L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path'
-s size QEMU_STACK_SIZE set the stack size to 'size' bytes
-cpu model QEMU_CPU select CPU (-cpu help for list)
-E var=value QEMU_SET_ENV sets targets environment variable (see below)
-U var QEMU_UNSET_ENV unsets targets environment variable (see below)
-0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0'
-r uname QEMU_UNAME set qemu uname release string to 'uname'
-B address QEMU_GUEST_BASE set guest_base address to 'address'
-R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space
-d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items)
-dfilter range[,...] QEMU_DFILTER filter logging based on address range
-D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr)
-p pagesize QEMU_PAGESIZE deprecated change to host page size
-one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB
-strace QEMU_STRACE log system calls
-seed QEMU_RAND_SEED Seed for pseudo-random number generator
-trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>]
-version QEMU_VERSION display version information and exit
-xtensa-abi-call0 QEMU_XTENSA_ABI_CALL0 assume CALL0 Xtensa ABI
-perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf
-jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf
Defaults:
QEMU_LD_PREFIX = /usr/gnemul/qemu-xtensaeb
QEMU_STACK_SIZE = 8388608 byte
You can use -E and -U options or the QEMU_SET_ENV and
QEMU_UNSET_ENV environment variables to set and unset
environment variables for the target process.
It is possible to provide several variables by separating them
by commas in getsubopt(3) style. Additionally it is possible to
provide the -E and -U options multiple times.
The following lines are equivalent:
-E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG
-E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG
QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG
Note that if you provide several changes to a single variable
the last change will stay in effect.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-utils
QEMU is a fast processor emulator: currently the package supports Alpha, ARM, CRIS, i386, LoongArch, M68k (ColdFire), MicroBlaze, MIPS, PowerPC, RISC-V, S390x, SH4, SPARC, x86-64, Xtensa and other emulations. By using dynamic translation it achieves reasonable speed while being easy to port on new host CPUs.
This package provides QEMU related utilities:
- qemu-img: QEMU disk image utility
- qemu-io: QEMU disk exerciser
- qemu-nbd: QEMU disk network block device server
Installed size: 11.85 MB
How to install: sudo apt install qemu-utils
Dependencies:
- libaio1t64
- libc6
- libfuse3-3
- libglib2.0-0t64
- libgmp10
- libgnutls30t64
- libhogweed6t64
- libnettle8t64
- libnuma1
- libselinux1
- liburing2
- libzstd1
- zlib1g
qemu-img
QEMU disk image utility
root@kali:~# qemu-img -h
qemu-img version 9.1.0 (Debian 1:9.1.0+ds-8)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers
usage: qemu-img [standard options] command [command options]
QEMU disk image utility
'-h', '--help' display this help and exit
'-V', '--version' output version information and exit
'-T', '--trace' [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
Command syntax:
amend [--object objectdef] [--image-opts] [-p] [-q] [-f fmt] [-t cache] [--force] -o options filename
bench [-c count] [-d depth] [-f fmt] [--flush-interval=flush_interval] [-i aio] [-n] [--no-drain] [-o offset] [--pattern=pattern] [-q] [-s buffer_size] [-S step_size] [-t cache] [-w] [-U] filename
bitmap (--merge SOURCE | --add | --remove | --clear | --enable | --disable)... [-b source_file [-F source_fmt]] [-g granularity] [--object objectdef] [--image-opts | -f fmt] filename bitmap
check [--object objectdef] [--image-opts] [-q] [-f fmt] [--output=ofmt] [-r [leaks | all]] [-T src_cache] [-U] filename
commit [--object objectdef] [--image-opts] [-q] [-f fmt] [-t cache] [-b base] [-r rate_limit] [-d] [-p] filename
compare [--object objectdef] [--image-opts] [-f fmt] [-F fmt] [-T src_cache] [-p] [-q] [-s] [-U] filename1 filename2
convert [--object objectdef] [--image-opts] [--target-image-opts] [--target-is-zero] [--bitmaps] [-U] [-C] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-B backing_file [-F backing_fmt]] [-o options] [-l snapshot_param] [-S sparse_size] [-r rate_limit] [-m num_coroutines] [-W] [--salvage] filename [filename2 [...]] output_filename
create [--object objectdef] [-q] [-f fmt] [-b backing_file [-F backing_fmt]] [-u] [-o options] filename [size]
dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [bs=block_size] [count=blocks] [skip=blocks] if=input of=output
info [--object objectdef] [--image-opts] [-f fmt] [--output=ofmt] [--backing-chain] [-U] filename
map [--object objectdef] [--image-opts] [-f fmt] [--start-offset=offset] [--max-length=len] [--output=ofmt] [-U] filename
measure [--output=ofmt] [-O output_fmt] [-o options] [--size N | [--object objectdef] [--image-opts] [-f fmt] [-l snapshot_param] filename]
snapshot [--object objectdef] [--image-opts] [-U] [-q] [-l | -a snapshot | -c snapshot | -d snapshot] filename
rebase [--object objectdef] [--image-opts] [-U] [-q] [-f fmt] [-t cache] [-T src_cache] [-p] [-u] [-c] -b backing_file [-F backing_fmt] filename
resize [--object objectdef] [--image-opts] [-f fmt] [--preallocation=prealloc] [-q] [--shrink] filename [+ | -]size
Command parameters:
'filename' is a disk image filename
'objectdef' is a QEMU user creatable object definition. See the qemu(1)
manual page for a description of the object properties. The most common
object type is a 'secret', which is used to supply passwords and/or
encryption keys.
'fmt' is the disk image format. It is guessed automatically in most cases
'cache' is the cache mode used to write the output disk image, the valid
options are: 'none', 'writeback' (default, except for convert), 'writethrough',
'directsync' and 'unsafe' (default for convert)
'src_cache' is the cache mode used to read input disk images, the valid
options are the same as for the 'cache' option
'size' is the disk image size in bytes. Optional suffixes
'k' or 'K' (kilobyte, 1024), 'M' (megabyte, 1024k), 'G' (gigabyte, 1024M),
'T' (terabyte, 1024G), 'P' (petabyte, 1024T) and 'E' (exabyte, 1024P) are
supported. 'b' is ignored.
'output_filename' is the destination disk image filename
'output_fmt' is the destination format
'options' is a comma separated list of format specific options in a
name=value format. Use -o help for an overview of the options supported by
the used format
'snapshot_param' is param used for internal snapshot, format
is 'snapshot.id=[ID],snapshot.name=[NAME]', or
'[ID_OR_NAME]'
'-c' indicates that target image must be compressed (qcow format only)
'-u' allows unsafe backing chains. For rebasing, it is assumed that old and
new backing file match exactly. The image doesn't need a working
backing file before rebasing in this case (useful for renaming the
backing file). For image creation, allow creating without attempting
to open the backing file.
'-h' with or without a command shows this help and lists the supported formats
'-p' show progress of command (only certain commands)
'-q' use Quiet mode - do not print any output (except errors)
'-S' indicates the consecutive number of bytes (defaults to 4k) that must
contain only zeros for qemu-img to create a sparse image during
conversion. If the number of bytes is 0, the source will not be scanned for
unallocated or zero sectors, and the destination image will always be
fully allocated
'--output' takes the format in which the output must be done (human or json)
'-n' skips the target volume creation (useful if the volume is created
prior to running qemu-img)
Parameters to bitmap subcommand:
'bitmap' is the name of the bitmap to manipulate, through one or more
actions from '--add', '--remove', '--clear', '--enable', '--disable',
or '--merge source'
'-g granularity' sets the granularity for '--add' actions
'-b source' and '-F src_fmt' tell '--merge' actions to find the source
bitmaps from an alternative file
Parameters to check subcommand:
'-r' tries to repair any inconsistencies that are found during the check.
'-r leaks' repairs only cluster leaks, whereas '-r all' fixes all
kinds of errors, with a higher risk of choosing the wrong fix or
hiding corruption that has already occurred.
Parameters to convert subcommand:
'--bitmaps' copies all top-level persistent bitmaps to destination
'-m' specifies how many coroutines work in parallel during the convert
process (defaults to 8)
'-W' allow to write to the target out of order rather than sequential
Parameters to snapshot subcommand:
'snapshot' is the name of the snapshot to create, apply or delete
'-a' applies a snapshot (revert disk to saved state)
'-c' creates a snapshot
'-d' deletes a snapshot
'-l' lists all snapshots in the given image
Parameters to compare subcommand:
'-f' first image format
'-F' second image format
'-s' run in Strict mode - fail on different image size or sector allocation
Parameters to dd subcommand:
'bs=BYTES' read and write up to BYTES bytes at a time (default: 512)
'count=N' copy only N input blocks
'if=FILE' read from FILE
'of=FILE' write to FILE
'skip=N' skip N bs-sized blocks at the start of input
Supported formats: blkdebug blklogwrites blkverify bochs cloop compress copy-before-write copy-on-read dmg file ftp ftps gluster host_cdrom host_device http https io_uring iscsi iser luks nbd nfs null-aio null-co nvme nvme-io_uring parallels preallocate qcow qcow2 qed quorum raw rbd replication snapshot-access ssh throttle vdi vhdx virtio-blk-vfio-pci virtio-blk-vhost-user virtio-blk-vhost-vdpa vmdk vpc vvfat
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-io
QEMU Disk exerciser
root@kali:~# qemu-io -h
Usage: qemu-io [OPTIONS]... [-c STRING]... [file]
QEMU Disk exerciser
--object OBJECTDEF define an object such as 'secret' for
passwords and/or encryption keys
--image-opts treat file as option string
-c, --cmd STRING execute command with its arguments
from the given string
-f, --format FMT specifies the block driver to use
-r, --read-only export read-only
-s, --snapshot use snapshot file
-n, --nocache disable host cache, short for -t none
-C, --copy-on-read enable copy-on-read
-m, --misalign misalign allocations for O_DIRECT
-k, --native-aio use kernel AIO implementation
(Linux only, prefer use of -i)
-i, --aio=MODE use AIO mode (threads, native or io_uring)
-t, --cache=MODE use the given cache mode for the image
-d, --discard=MODE use the given discard mode for the image
-T, --trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
see qemu-img(1) man page for full description
-U, --force-share force shared permissions
-h, --help display this help and exit
-V, --version output version information and exit
See 'qemu-io -c help' for information on available commands.
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-nbd
QEMU Disk Network Block Device Server
root@kali:~# qemu-nbd -h
Usage: qemu-nbd [OPTIONS] FILE
or: qemu-nbd -L [OPTIONS]
QEMU Disk Network Block Device Utility
-h, --help display this help and exit
-V, --version output version information and exit
Connection properties:
-p, --port=PORT port to listen on (default `10809')
-b, --bind=IFACE interface to bind to (default `0.0.0.0')
-k, --socket=PATH path to the unix socket
(default '/var/lock/qemu-nbd-DEVICE')
-e, --shared=NUM device can be shared by NUM clients (default '1')
-t, --persistent don't exit on the last connection
-v, --verbose display extra debugging information
-x, --export-name=NAME expose export by name (default is empty string)
-D, --description=TEXT export a human-readable description
Exposing part of the image:
-o, --offset=OFFSET offset into the image
-A, --allocation-depth expose the allocation depth
-B, --bitmap=NAME expose a persistent dirty bitmap
General purpose options:
-L, --list list exports available from another NBD server
--object type,id=ID,... define an object such as 'secret' for providing
passwords and/or encryption keys
--tls-creds=ID use id of an earlier --object to provide TLS
--tls-authz=ID use id of an earlier --object to provide
authorization
--tls-hostname=HOSTNAME override hostname used to check x509 certificate
-T, --trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
--fork fork off the server process and exit the parent
once the server is running
--pid-file=PATH store the server's process ID in the given file
--selinux-label=LABEL set SELinux process label on listening socket
Kernel NBD client support:
-c, --connect=DEV connect FILE to the local NBD device DEV
-d, --disconnect disconnect the specified device
Block device options:
-f, --format=FORMAT set image format (raw, qcow2, ...)
-r, --read-only export read-only
-s, --snapshot use FILE as an external snapshot, create a temporary
file with backing_file=FILE, redirect the write to
the temporary one
-l, --load-snapshot=SNAPSHOT_PARAM
load an internal snapshot inside FILE and export it
as an read-only device, SNAPSHOT_PARAM format is
'snapshot.id=[ID],snapshot.name=[NAME]', or
'[ID_OR_NAME]'
-n, --nocache disable host cache
--cache=MODE set cache mode used to access the disk image, the
valid options are: 'none', 'writeback' (default),
'writethrough', 'directsync' and 'unsafe'
--aio=MODE set AIO mode (native, io_uring or threads)
--discard=MODE set discard mode (ignore, unmap)
--detect-zeroes=MODE set detect-zeroes mode (off, on, unmap)
--image-opts treat FILE as a full set of image options
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
qemu-storage-daemon
QEMU storage daemon
root@kali:~# qemu-storage-daemon -h
Usage: qemu-storage-daemon [options]
QEMU storage daemon
-h, --help display this help and exit
-T, --trace [[enable=]<pattern>][,events=<file>][,file=<file>]
specify tracing options
-V, --version output version information and exit
--blockdev [driver=]<driver>[,node-name=<N>][,discard=ignore|unmap]
[,cache.direct=on|off][,cache.no-flush=on|off]
[,read-only=on|off][,auto-read-only=on|off]
[,force-share=on|off][,detect-zeroes=on|off|unmap]
[,driver specific parameters...]
configure a block backend
--chardev <options> configure a character device backend
(see the qemu(1) man page for possible options)
--daemonize daemonize the process, and have the parent exit
once startup is complete
--export [type=]nbd,id=<id>,node-name=<node-name>[,name=<export-name>]
[,writable=on|off][,bitmap=<name>]
export the specified block node over NBD
(requires --nbd-server)
--export [type=]fuse,id=<id>,node-name=<node-name>,mountpoint=<file>
[,growable=on|off][,writable=on|off][,allow-other=on|off|auto]
export the specified block node over FUSE
--export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,
addr.type=unix,addr.path=<socket-path>[,writable=on|off]
[,logical-block-size=<block-size>][,num-queues=<num-queues>]
export the specified block node as a
vhost-user-blk device over UNIX domain socket
--export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,
addr.type=fd,addr.str=<fd>[,writable=on|off]
[,logical-block-size=<block-size>][,num-queues=<num-queues>]
export the specified block node as a
vhost-user-blk device over file descriptor
--export [type=]vduse-blk,id=<id>,node-name=<node-name>
,name=<vduse-name>[,writable=on|off]
[,num-queues=<num-queues>][,queue-size=<queue-size>]
[,logical-block-size=<logical-block-size>]
[,serial=<serial-number>]
export the specified block node as a
vduse-blk device
--monitor [chardev=]name[,mode=control][,pretty[=on|off]]
configure a QMP monitor
--nbd-server addr.type=inet,addr.host=<host>,addr.port=<port>
[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
--nbd-server addr.type=unix,addr.path=<path>
[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
start an NBD server for exporting block nodes
--object help list object types that can be added
--object <type>,help list properties for the given object type
--object <type>[,<property>=<value>...]
create a new object of type <type>, setting
properties in the order they are specified. Note
that the 'id' property must be set.
See the qemu(1) man page for documentation of the
objects that can be added.
--pidfile <path> write process ID to a file after startup
See <https://qemu.org/contribute/report-a-bug> for how to report bugs.
More information on the QEMU project at <https://qemu.org>.
Updated on: 2024-Nov-17