XEC Design >Mostly tutorials for Raspberry Pi

15Apr/12243

QEMU – Emulating Raspberry Pi the easy way (Linux or Windows!)

This page will shows how to emulate an ARM1176JZF-S system the quick and easy way.

Assumptions

You have:

  • QEMU - Linux or Windows. Make sure you have a suitable version (see 'Quick note on QEMU and ARM1176').
  • A disk image for your distro of choice
    • Raspian and Debian should work out of the box, however Arch Linux requires a few tweaks to work. These will not be explored in this article, as they can only be done in Linux.
  • Ability to read and follow instructions carefully

Preparing the environment

  1. Create and enter the work directory.
  2. Download the linux kernel:
  3.  Download and extract the disk image .img file to the working directory.
  4. All of the instructions will be carried out in this directory.

Check that you have everything

  1. Make sure you have kernel-qemu and your disk image files.
  2. qemu-system-arm -cpu ?

If everything looks right, you should be ready to go.

First boot

  1. qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw init=/bin/bash" -hda 2013-09-25-wheezy-raspbian.img

    • Windows users should use qemu-system-armw.exe instead of qemu-system-arm.
    • Make sure you replace '2013-09-25-wheezy-raspbian.img' with the name of your disc image.
    • Do not try to use more than 256 MB of RAM, the value is hard-coded in and QEMU will not work correctly.
    • You should be presented with a minimal shell. From here, you will need to make some modifications before you can boot properly.
  2. nano /etc/ld.so.preload
  3. Put a # in front of the first line so that it looks like this:

    #/usr/lib/arm-linux-gnueabihf/libcofi_rpi.so

  4. Press ctrl-x then y then enter to save and exit.
  5. (Optional) Use steps 2 to 4 above to create a file /etc/udev/rules.d/90-qemu.rules with the following content:

    KERNEL=="sda", SYMLINK+="mmcblk0"
    KERNEL=="sda?", SYMLINK+="mmcblk0p%n"
    KERNEL=="sda2", SYMLINK+="root"

    • The kernel sees the disk as /dev/sda, while a real pi sees /dev/mmcblk0. This will create symlinks to be more consistent with the real pi.
  6. halt

First (proper) boot

  1. qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw" -hda 2013-09-25-wheezy-raspbian.img
    • This is the same command as before, but without init=/bin/bash.
    • This will take a while, but will be much quicker on subsequent boots.
QEMU running raspbian
That's it, you should see the system starting to boot.

Things to keep in mind

  • The disc image will only contain about 200MB of free space (if any at all) for you to play with, so don't expect to be able to install a full system. You can use DD to expand the image and then resize manually, but that is not within the scope of this tutorial.
  • You may see a few steps failing while the image boots. That's normal, since QEMU cannot emulate ALL of the hardware exactly. Double check that all the important steps are fine, but in general, this isn't something to worry about.

 Acknowledgements

kinsa for figuring out the ld.so.preload business. Stevie-O for testing. Mjlally for finding a QEMU build that actually works on windows. v13 for a method to fix up ld.so.preload on windows.

Comments (243) Trackbacks (23)
  1. I can confirm this is working with the latest 64-bit Windows QEMU build using the following command line –
    qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -serial stdio -append “root=/dev/sda2 panic=1″ -hda debian6-19-04-2012.img -clock dynticks

  2. I used

    http://qemu.weilnetz.de/w32/2012-06-28/qemu-system-arm.exe

    But is complains of missing DLLs.

    SDL.dll
    libcrypto.dll
    libcurl-4.dll
    libglib-2.0-0.dll
    libssl.dll

    Some, but not all of them, can be found here

    http://qemu.weilnetz.de/w32/mingw/

    Cheers, Steve

  3. Sorry for asking suck a stupid question.

    Is there a way to download all the necessarily qemu files from http://qemu.weilnetz.de without take them one by one ?

    • AFAIK you don’t need all of them. The one I know you need for sure is qemu-system-arm.exe. When I tried it just crashed on launch, but Steve (in the comment above yours) reports that http://qemu.weilnetz.de/w32/2012-06-28/qemu-system-arm.exe works.

    • For Win64 dowload:
      /w64/dll/*.dll (all dlls)
      /w64/2012-06-28/qemu-system.arm.exe
      /w64/2012-06-28/keymaps/en-us

      Put the dlls in the same directory of qemu-system.arm.exe and preserve the /keymaps subdirectory.

      I could execute it with the following command:
      qemu-system-arm -M versatilepb -m 128M -nographic -kernel c:\Temp\arm\test.bin

  4. Actually, you can expand your image file size without having to create a new one.

    First, launch following command on host :
    dd if=/dev/zero bs=1M count=2048 >> raspbian.img
    (In this example, the file raspbian.img is expanded with 2 GB)

    Then, launch your qemu, and inside the console, launch this :

    PART_START=$(parted /dev/sda -ms unit s p |grep “^2″ | cut -f 2 -d:)
    echo $PART_START # (to be sure that it’s not empty).
    fdisk /dev/sda <<EOF
    p
    d
    2
    n
    p
    2
    $PART_START

    p
    w
    EOF

    Then reboot and launch resize2fs on /dev/root .

    And, here you have your freshly expanded FS :).

    Mainly inspired from raspi-config script ;).

    • That’s great, thanks (as for the whole article)

      The parted script didn’t work for me, so i just want to add that the what the fdisk stuff does is
      – delete the old partition 2 (the d)
      – create a new partition (n) with the same start (parted number) but till the end (the return)
      – write the new partition table (w)

      The number for the start can be seen by running fdisk and typing p for print. its the start of the second partition.

  5. Can you walk through how you built the kernel?

    • You can reach me on the #raspberrypi irc channel on freenode, I’ll be happy to help.
      Edit: But also, there’s the tutorial I wrote earlier which has the exact steps. =)

  6. This might be a noob question, but after getting RPi/Qemu running, how do I transfer cross-compiled binaries to it for testing? I don’t seem to have an accessible network connection, or file system.

    Is it a closed environment?

    Steve

  7. Ok, I am using Fedora 17 with the qemu version 1.0.1 that is available via the repository. I downloaded all of the various images from the raspberry site (2 wheezy debian and one Arch) and the kernel-qemu from your site. I followed the directions for the qemu-system-arm command and it boots initially, but gets a “Kernel panic – not syncing: attempted to kill init!” and stops before getting to a log in prompt.

    I don’t know how to grab the boot log so I can’t parse it in any better detail. I do see that I get some errors at the command line related to pulseaudio, but I don’t think that is the problem.

    Can you give any info on how to debug this thing?

  8. A quick follow up… I tried each of the 3 images from the raspberry pi site; same result. I have now moved on to ubuntu 12.04 with qemu-system-arm version 1.0.50; same result there. Note; both of the linux distributions have been 64 bit. I will try a 32 bit ubuntu next to see if that helps.

  9. Success. Ubuntu 12.10 32 bit with qemu-system-arm version 1.2. Works fine. Don’t know which of the variables made the difference (ubuntu version, qemu version or 32 bit vs 64 bit), but my bet is on 32 bit.

  10. Thanks – works for me with -cpu arm1136-r2.
    With arm1176 the kernel crashed soon after starting the boot process. It`s probably due to my laziness – my QEMU is latest stock, from Ubuntu Precise.
    I see only 256MB RAM despite i gave it 512 (need to emulate model B). Is it limit of the emulated CPU I set or it`s configured somewhere in the raspbian image ?

    • Self answering: 256MB is hardcoded in the emulated versatile platform. If someone needs more memory, he should create a second RAW file for the qemu on a tmpfs (RAM disk) and setup there a swap file. 1-2GB should be possible. Thus the emulated system will efectively extend it’s virtual memory.

  11. I have had reasonable success using the windows binaries from here
    http://lassauge.free.fr/qemu/

    On a separate note, this is an excellent site, very clear and useful information.

  12. Working on my Win XP 32-bit too……. Thanx…

  13. oss: Could not initialize DAC
    oss: Failed to open `/dev/dsp’
    oss: Reason: No such file or directory
    oss: Could not initialize DAC
    oss: Failed to open `/dev/dsp’
    oss: Reason: No such file or directory
    audio: Failed to create voice `lm4549.out’
    VNC server running on `127.0.0.1:5900′
    Uncompressing Linux… done, booting the kernel.
    pflash_write: Unimplemented flash cmd sequence (offset 0000000000000000, wcycle 0x0 cmd 0x0 value 0xf000f0)
    pflash_write: Unimplemented flash cmd sequence (offset 0000000000000000, wcycle 0x0 cmd 0x0 value 0xf0)

  14. Ok thank you anyway !

  15. Can some one please explain in detail how one of the previous posters meant it was possible to gain 512M of ram?

    • Use the qemu-img tool to create a file. Add ‘-hdb yournewfile’ to the qemu parameters. Onced booted, you can run ‘mkswap /dev/sdb’ and ‘swapon /dev/sdb’ as root to use that file as swap. If you have trouble with it, let me know and I’ll add a section about it to the article.

  16. Hello,

    Thank you for this great tutorial, however I get no luck with this. I was trying it on Windows 7 x64. I’ve downloaded QEMU for windows x64 listed here, kernel listed here and official rasbian for RPI.

    when I try to run qemu, I get no error, but just blank black screen. Files stderr.txt and stdout.txt are blank.

    Any ideas what’s wrong?

    • It’s a bit hard to tell given that there’s no output. Could you try again using this binary?
      http://qemu.weilnetz.de/w32/2012-06-28/qemu-system-arm.exe

    • Same problem here. System: Win7 ult x64 AMD 7750. Build 7600.16917

      Running (with any Pi image) the x86 ARM binary gives me error 0xc000007b. And x64 binary gives me a black qemu screen. stderr.txt gets created, but is deleted when the (blank) qemu window is closed. There is nothing in the file while it exists. Stdout.txt gets filled with 24 lines of garbled text, the first line is longer. All images pass hash checks. Clicking inside the blank window removes the mouse pointer from the screen and tells me that alt+ctl will “exit mouse grab”.

      I am using your guide for doing this. My steps are…

      (1) Get and run the windows qemu installer from “http://qemu.weilnetz.de/w64/”.
      (2) Get “qemu-system-arm.exe” from “http://qemu.weilnetz.de/w64/2012-12-04/”
      (3) Get all five *.ddl’s from “http://qemu.weilnetz.de/w64/dll/”
      (4) Move the files from step 2-3 to “C:\Program Files (x86)\qemu” (default install directory.)
      (5) Get the RaspberryPi images from “http://www.raspberrypi.org/downloads”
      (6) decompress the images to qemu directory.
      (7) Run “qemu-system-arm -cpu ?” Confirm that ‘arm1176′ is in Stdout.txt.
      (8) In a command prompt, navigate to the qemu directory, do one of these two commands…

      [code]qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1" -hda .img[/code]

      *OR* (Command provided by Bob above)

      [code]qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -serial stdio -append "root=/dev/sda2 panic=1" -hda .img -clock dynticks[/code]

      Doing “qemu-system-arm -cpu ?” with the x64 binary gives me the expected list of sported cpus in Stdout.txt. So it would appear that qemu is installed and working correctly. However, I tried a non RaspberryPi ARM test image from “http://wiki.qemu.org/Testing” and it did the same thing.

      • EDIT: The *.img files are of course correct when I run the commands. Not blank as they are above.

      • Exact same result for me.

        Will continue to work on it, but… I’m stumped for now.

      • Hi,
        Please refer to the answer to this stack overflow question with references dependency walker:
        http://stackoverflow.com/questions/10492037/the-application-was-unable-to-start-correctly-0xc000007b

        I am using Windows 7 x64
        I used dependency walker and found that “libpng14-14.dll” depends on “zlib1.dll”. A 32 bit version of zlib1.dll was in my path which conflicted with the 64 bit qemu I had downloaded and installed. I did a search for zlib1.dll across my hard drive and found one in an application (Racket) that was in C:\Program Files\ (Which is where all the 64 bit apps are installed).
        I copied that zlib1.dll into my qemu installation folder and then it worked.

        I had a hard time finding a 64 bit version of zlib1.dll on the net.

        Hope that helps,
        Cheers,
        Ben.

  17. Thanks, works nicely with Debian image. For arch linux the booting process fails after random seed (dependency failure for /boot …)

    • To get arch working, you need to edit fstab and change mmcblk0 to sda. Also, you need to add the rw parameter to the append string.

      • Thanks. It requires little work.
        — for record
        mount the image(for how to http://unix.stackexchange.com/questions/2661/mounting-a-img-file) and edit the fstab as mentioned and change the boot location to sda1.
        — remove the symbolic link in /etc/systemd for syslog (If not you can not login as the screen flooded with messages related to this) (why this required when journalctl takes care of this – I will check in their forum)

        • I am pretty sure simply adding rw to the append string fixes the journald flood. This happens because without rw, the root filesystem is mounted as read only, journald can’t write to it and fails to start, which causes the flood.

          • shift, thanks. fstab needs to be updated for both /boot and /. the default is for /boot only. I need to figure out why the default option is not working. I need to go thro’ your qemu article to get 512 MB memory.

  18. kgas, you’ll need a swap disk/partition or a swap file for that. As Angel Genchev mentioned above, 256 is hard-coded into the versatile platform. There is work in progress to give qemu a proper raspberry pi target though, which looks promising.

  19. Thanks for all the help.
    How to Create a larger image file.
    This seems to work on Ubuntu 12.04. I got the qemu source from Linaro and built it using the directions found on this website.

    qemu-img create boot.img 4G
    sudo mkfs.ext4 boot.img
    sudo mount boot.img /mnt/b -t ext4 -o loop
    sudo mount -o loop,offset=$(( 512 * 122880)) 2012-10-28-wheezy-raspbian.img /mnt/img
    cd /mnt/b
    sudo cp -R -a /mnt/img/* .
    cd –
    qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda panic=1″ -hda boot.img

    (note /dev/sda)

    • You need a fat32 partition for booting. To grow the image you need extra work (there are other methods too)
      — create the image size you need ( 4 GB is enough)
      — Partition the image (first one for /boot fat32 (make this bootable) rest for / — you can get lot of how to from search please)
      — Mount the partitions and copy the files to the respective directory
      — un mount and boot with the new image ..

  20. Windows 7 x64:
    QEmu v1.3.0 from http://lassauge.free.fr/qemu/release/Qemu-1.3.0-windows.zip
    Kernel from http://xecdesign.com/downloads/linux-qemu/kernel-qemu

    Start with:
    qemu-system-armw.exe -M versatilepb -cpu arm1176 -hda Raspbian.img -kernel kernel-qemu -m 256 -serial stdio -append “root=/dev/sda2 panic=1″

    If set memory to any more than 256, then I get only a black screen and corrupted stdout.txt file.

    The only issue the low resolution.

    Good work, Thanks

  21. It is very nice idea!So interesting I am very thankful for this article. It helps me a lot by giving an idea about Raspberry Pi. Now i know that it is very useful. Just keep posting great ideas about Raspberry Pi.

  22. I am successfully able to run the emulator now I want to install java on it. Can anyone tell me how to do this. Also how can I view the IP address of the emulator?I have started o use linux as well as Raspberry just recently.

    Thanks in advance.

  23. I just wanted to thank you for this. I’ve written a few scripts for the RPi and this article was very useful. I just came back when trying Arch hard-float and had a running system five minutes later. It’s a shame one has to mount and edit the /etc/fstab but I’d already written a rpi_mount utility that made that painless. If anyone needing to modify /etc/fstab for Arch Linux would like to make use of what I’ve done then feel free to get it from my site (https://github.com/johnlane/rpi-utils).

  24. Works flawless on OS X Mountain Lion…

  25. Great tutorial! I followed the instructions and now I have the Debian VBox with the Raspberry Pi image running. However it seems there is a configuration problem with the mouse. After the Raspeberry Pi starts its LXDE desktop I can’t control the mouse. It works fine in the host LXDE (in the Debian virtual machine), but when I click in Pi’s windows it goes to the upper-left corner or desapears.
    Tried to include -usbdevice tablet command in the qemu-system-arm.exe command line, but it didn’t make any diffference.

    • Are you using something like VirtualBox or VMWare’s mouse integration features? They don’t play well with a guest running qemu.

      • I have vmware server installed so I assume that explains why my mouse is all wonky while emulating raspberry in qemu even when I change the mouse sensitivity settings. How would I disable the vmware servers’s mouse integration? I can only find how-to’s with other vmware products.

  26. Bingo!
    I disabled VirtualBox mouse integration and qemu’s Raspberry desktop worked perfectly.
    Thanks a lot Shift.

  27. Hi,
    Thanks for this tutorial. I couldn’t get QEMU to work in mountain lion so I tried in windows 8 in parallels. When I run qemu-system-arm -cpu ? I get a blank line, and when I run the full command it complained about DLLS, and then when I installed those now I get a blank window that just hangs. Any thoughts?
    I guess I’ll go try it in mountain lion again, since Adi says it works.
    Thanks–

  28. The error I’m getting in Mountain Lion is:
    pflash_write: Unimplemented flash cmd sequence (offset 0000000000000000, wcycle 0x0 cmd 0x0 value 0xf000f0)
    pflash_write: Unimplemented flash cmd sequence (offset 0000000000000000, wcycle 0x0 cmd 0x0 value 0xf0)
    The qemu window launches, but I see:
    EXt3-fs (sda2): error: couldn’t mount because of unsupported optional features (240)
    and then it kernel panics. Thoughts?

    • I’m also getting this error as well right after the mouse set up. I’m not event seeing the rasbian’s rasberri pi logo, just the linux logo. I’m running it on Mountain Lion 10.8 and the 2013 build of Rasbian Wheezy.

  29. It does not work with 2013-02-09-wheezy-raspbian.img
    I downloaded 2012-10-28-wheezy-raspbian.img and it works perfectly, thanks.

  30. @Alexandre It’s identical for me ;) in waiting a solution THX

  31. @Alexandre
    And the same here.

  32. How did you make your kernel-qemu file? I can successfully boot with your kernel, but when I use either of the official kernels (kernel.img or kernel_emergency.img) or the cross compiled kernel image I made myself, I just get an empty window. What did you have to do to your kernel to make it work with qemu? (My kernels do load on the Pi itself.)

  33. In order to run the latest image (2013-02-09-wheezy-raspbian.img) you need to comment out the contents of /etc/ld.so.preload.

    Cheers!

    • I guess you mean one should apply that change to the img itself. How can I do that ? any advisable tool ? (on linux please)

      • I am a bit lazy, so here is a nutshell version. The only tools you need are ‘file’, ‘mount’ and a text editor. Use file on the img to find the startsector of the root partition. Multiply that number by 512. sudo mount whatever.img location -o offset=newnumber. Now you can go to wherever you mounted the partition and make the changes you need. When you’re done, umount and the image should be ready.

  34. Followed your instructions above and successfully loads to the login, but upon login it reports “Raspberry Pi has not been fully configured. Please run ‘sudo raspi-config'” then throws you back to login to repeat the cycle.

    This is under Ubuntu 12.4 LTS with RPi 2013-02-09-wheezy-raspbian.iso

    Any ideas?

  35. Thank you so much for these instructions!

    Using a combination of the suggestions in these comments, I was finally able to get 2013-02-09-wheezy-raspbian working in Ubuntu 12.10 64-bit. I had to comment out /etc/ld.so.preload first as suggested, but it took me a while to figure out I had to mount the *second* partition, and I mounted it using

    http://unix.stackexchange.com/questions/2661/mounting-a-img-file

    as suggested.

    Then I ran into the file system corruption issue mentioned above and fixed it with “fsck /dev/sda2″ as suggested. CTRL+D to reboot.

    Finally raspi-config came up, I went through everything there, and after another CTRL+D I was presented with a login prompt (a little disappointing since I set it to boot to the desktop after login). Panicked for a bit when it wouldn’t let me in and some Googling showed that “pi” is the default login with “raspberry” the password.

    Then I remembered I had reset the password using raspi-config, used that as a password, and I was in to a shell.

    I started the desktop using “startx” and got the standard LXDE desktop!

    Still not sure why I don’t get a DE on startup, but anyway. I might experiment around with Openbox as a DE and fbpanel as a panel – that combination is extremely efficient and lean!

    Next…trying to get Gentoo on it. :-O

    All this is practice before my actual Raspberry Pi arrives…

  36. I’m using Windows and trying to get QEMU to work with the latest Pi image (2013-02-09-wheezy-raspbian.img), can someone please explain how to go about editing the image so that this will work on windows? or provide the pre-modified image file?

  37. i tried it with the last image (2013-02-09-wheezy-raspbian.img)
    i commented the context from /etc/ld.so.preload out und chroot works now fine. but i cant build anything.
    i get the following errors:

    “you need autoconf version 2.59 or newer installed”

    if i run /usr/bin/autoconf i get:
    This script requires a shell more modern than all the shells that i found on your system.

    installed bash version is 4.2.37(1)-release

    does anyone else have those problems?

  38. I followed all instructions related to setup of the system but I cannot run the game “Storm in a Teacup”. Is there any solution ?

  39. Windows 8 User. All directions followed and alot of trouble-shooting done. I can get the QEmu process to start. The process ramps to about 18% of my CPU and the QEmu window remains blank. Does anyone have any ideas?

  40. Im trying to emulate 2013-02-09-wheezy-raspbian.img using the settings listed here without any success.
    Im using QEMU 1.4.0 with the kernal-qemu version listed here (without any file extension).

    All qemu seems to do is lock up wont post or anything site on a blank screen for about 2 mins then just fails to respond.

    im running Windows 7 Ent 64 bit. Any help would be great.

  41. i got an error during booting even with the patch for the img file:

    EXT3-fs (sda2): error: couldn’t mount because of unsupported optional features (240)

  42. when I boot it goes into an endless loop of displaying the license over and over.

    • see the update note at the top of this post. either follow the instructions (should work for the new version of the raspbian-image too) or, if you are on windows, hope that Shift will publish a patcher for the new image. :)

  43. hi,

    getting “403 forbidden” when trying to download kernel-qemu via wget
    my browser is able to download it but I can’t do anything with it using tar or gzip…

  44. Based on this article I have created a Linux tool to create and manage multiple virtual machines https://github.com/mpapis/myarm#readme – thanks a lot for the instructions!

  45. anybody know where the compatible img file is

  46. I am running on Windows 7 64 bit. Ran qemu with the 2013-05-25-wheezy-raspbian.img and got the “Please run ‘sudo raspi-config’” message followed by a return to login to repeat the cycle.

    Ran the patch. Now it hangs after the 2nd pflash_write message. Looks like I am going backwards.

    The message above references a new patcher. Has that been done?

  47. Nevermind….it finally came back and I got logged in.

    Thanks.

  48. So I know this is kind of noobish but oh well :P I compile a custom OS that was given as a tutorial and I have a now compile kernel.img I run Ubuntu 12.04 and when I run

    qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=1″ -hda /kernel.img I get the following errors:

    oss: Could not initialize DAC
    oss: Failed to open `/dev/dsp’
    oss: Reason: No such file or directory
    oss: Could not initialize DAC
    oss: Failed to open `/dev/dsp’
    oss: Reason: No such file or directory
    audio: Failed to create voice `lm4549.out’
    kernel-qemu: No such file or directory
    qemu: could not load kernel ‘kernel-qemu’

    Any help or directions would be perfect :)\

    • Make sure kernel-qemu is in the same directory you’re running that command from. Also, you have a ‘/’ in front of kernel.img, which would indicate that it is located in /, which isn’t a good idea. If I understood what you’re trying to do though, it won’t work. Is kernel.img a kernel or a disk image?

  49. I´m trying to run qemu as the tutorial says: qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=1″ -hda 2013-07-26-wheezy-raspbian.img

    neither with qemu-system-arm or qemu-system-armw does work…

    I’ve downloaded the “kernel-qemu” file from the link the tutorial suggest algo.

    Nothing. I´m using Windows 8 Pro 64 bits, I’ve also checked the file zlib (with Dependency Walker [from other post] and it´s 64bits)

    Would be great to have some help about this

  50. Hey this works on OSX (10.8.4), too!
    I compiled qemu and a cross-compiler by using brew.

    • That’s good, but I am a little reluctant to change the title since I am not an OSX user myself and would not be able to offer help if people run into trouble with it.

  51. hey, what does append do: /dev/sda2
    What is the use of this option, will it harm my hard-drive partition /dev/sda2

    • Sorry for the late reply. Append is what determines the kernel parameters. Similar to what you would put in GRUB. Since the kernel sees the emulated system, /dev/sda2 is equivilent to /dev/mmcblk0p1 or the root filesystem on the image.

  52. “You may see a few steps failing while the image boots. That’s normal, since QEMU cannot emulate ALL of the hardware exactly.”

    Given the popularity of the Raspberry PIs, why is there still no better (more complete) emulation?

    • In a way, there is. Look up Torlus’ qemu on github. It’s more complete, but I wouldn’t say it’s better. He emulates almost everything, but there are some important things missing, like the NIC, which there is no qemu emulation driver for yet. I would recommend using that qemu version for testing bare metal kernels and such, but I still think the method described in the article is what most people are after.

      • Thanks for the pointer. It looks a bit rough, still.

        Actually, the main things missing (in the standard qemu) are /dev/mmc* and 512MB memory. That shouldn’t be hard to emulate, I think.

  53. Above wouldn’t work with newer versions of Raspbian. Please see- http://www.raspberrypi.org/phpBB3/viewtopic.php?f=29&t=37386 and update the post. I needed to add “console=ttyAMA0″ to append option get it started, don’t know if it is necessory for everybody.

  54. does anyone know how to edit /etc/ld.so.preload on OSX? I couldn’t get mount to work. I’m trying to use the new 2013-09-10 wheezy image.

  55. Hello. I’ve created an image and it’s working in QEMU (with -m256) but it’s not working with “-m 512″. I’ve seen in Your article the note about 256M being hardcoded into QEMU, but what can be the reason, that the same image is not booting in Rapsberry Pi B (512M)?

    • Hey, is this a custom image you have made that runs in qemu but not on the pi? Could you provide a little more detail? How did you make the image? how is it partitioned? what’s on the first partition? And so on…

  56. What network card is being emulated by default? I’ve tried
    -netdev user,id=user.0 -device lan9118,netdev=user.0
    -netdev user,id=user.0 -device smc91c111,netdev=user.0

    but neither resulted in a network device that could be detected by the prebuilt kernel…

  57. Hey! This is a really good explanation!! But I have a problem: I want to connect a web-cam and an arduino using qemu in my PC. Is this possible?? I connect them to my computer and qemu doesn´t recognized them. If it´s possible.. What do I have to do?? I hope you can help me. Thank you!

  58. On Windows 7, the following step

    nano /etc/ld.so.preload

    fails with the following error:

    [ Error writing /etc/ld.so.preload: Read-only file system ]

    I have checked and made sure that the image file I am using is not read-only.

    Any help will be appreciated, thanks.

    • I was able to fix this by adding “rw” to the argument string for -append, like so:

      -append “root=/dev/sda2 rw panic=1 rootfstype=ext4 …”

      • Ah, thanks. Forgot to add the ‘rw’ when I updated the instructions, sorry.

        • Thank you for the confirmation.

          BTW, I don’t quite understand step #6 under “First boot” heading. Is it an instruction to do a shutdown/restart? If so, why, since a reboot follows anyways, as described in the next section, “First (proper) boot”? Thanks again.

          • Good point. I meant ‘reboot’ as a command to enter, since the -no-reboot option means this will just shut down. I suppose I’ll change it to something less ambiguous. Thanks again.

  59. Yikes – I can boot, but QEMU seems to be messing with the keyboard. How do you get the correct keycodes for QEMU? I tried “-k en-us”, but that doesn’t help. It seems QEMU won’t read keyboard input correctly.
    Also – the 64-bit QEMU doesn’t boot up at all on Windows 7.

  60. Hi, how can i use a webcam with qemu raspberry ? i tried to add : -usb -usbdevice host:041e:4028 ; but that doesn’t help . it gave me this error : qemu scsi 0.0.0.0 : Device offlined – not ready after error recovery
    thanks

  61. Hey!! just a heads up Torlus @ the raspberrypy forums has made patches for “propper” RPI emulation (most/some of the hw is working and the kernel entry point is @ 0x8000 thus enabling the usage of the propper RPi kernel) check it out: https://github.com/Torlus/qemu-rpi

  62. Hi,
    I tried to use this how-to to emulate 2013-09-25-wheezy-raspbian image but it does not works.
    If I try to emulate 2012-07-15-wheezy-raspbian image it perfectly works. Why?
    I alto tried to download another copy of 2013-09-25 image but the result is the same.

    I hope you can help me

    • I just went through the steps with the 2013-09-25 image and did not see any problems. Can you make sure that your kernel is the one I link to in the article? I have updated it not too long ago to make sure it works with the new image. If you are using the right kernel, what’s the exact problem you are having?

  63. I’m trying to play videos with omxplayer, but it always give me the message ‘failed to open vchiq instance’. Is there a way to get this working?

  64. This Works like a charm for me on my laptop running Windows 8 (AMD64).

  65. I can’t run losetup to set up a loop device on the vm– it says something about maybe needing to recompile the kernel…? (I’m using your prebuilt kernel-qemu.)

    pi@raspberrypi:~/concerto-player$ sudo losetup -f
    losetup: Could not find any loop device. Maybe this kernel does not know
    about the loop device? (If so, recompile or `modprobe loop’.)
    pi@raspberrypi:~/concerto-player$

    pi@raspberrypi:~/concerto-player$ ls -als /lib/modules/3.10.24+/kernel/drivers/block/
    total 92
    4 drwxr-xr-x 3 root root 4096 Dec 23 15:21 .
    4 drwxr-xr-x 32 root root 4096 Dec 23 15:21 ..
    8 -rw-r–r– 1 root root 6906 Dec 20 02:05 cryptoloop.ko
    4 drwxr-xr-x 2 root root 4096 Dec 23 15:21 drbd
    24 -rw-r–r– 1 root root 22409 Dec 20 02:05 nbd.ko
    48 -rw-r–r– 1 root root 47262 Dec 20 02:05 pktcdvd.ko
    pi@raspberrypi:~/concerto-player$

    Any ideas?

  66. When trying to run arch, I get

    systemd[1]: CONFIG_CGROUPS was not set when your kernel was compiled. Systems without control groups are not supported. We will now sleep for 10s, and then continue boot-up. Expect breakage and please do not file bugs. Instead fix your kernel and enable CONFIG_CGROUPS. Consult http://0pointer.de/blog/projects/cgroups-vs-cgroups.html for more information.
    systemd[1]: No control group support available, not creating root group.

    It then continues to boot until it hits:
    systemd[1]: Caught , dumped core as pid 41.
    systemd[1]: Freezing execution.

  67. Very helpful Site!
    After horrible installation of QEMU on my iMac (OS 10.9.1) it was very easy running the newest 2014-01-07-wheezy-raspbian.img. This was the proof of concept…after that i virtualized my fully configured real Raspberry Pi (apache, mysql, php, wordpress, baikal-webdav-Server, mailserver etc etc). Really easy! Thanks!

    • Great to hear, thanks for the feedback.

      • Using Homebrew to install on the Mac went flawlessly — just a simple ‘brew install qemu’, wait for the download, build and install to finish, and then run it as shown in the article.

        One bit of feedback — I used my Debian image from my Pi (just dd’d the SD card to an image file on my Mac) and I had to switch the root partition from sda2 to sda6 for my install. Just in case anyone else was getting a panic on boot. Also changing the panic=1 option to panic=0 allows you to look at the panic error message on the screen instead of rebooting automatically after 1 second.

  68. Hello!

    I can run the emulation with “2014-01-07-wheezy-raspbian.img”. But there is a kernel / modules mismatch.
    ~ uname -a
    Linux raspberrypi 3.10.26+ #2 Fri Jan 17 22:13:59 EST 2014 armv6l GNU/Linux
    ~# dir /lib/modules
    3.10.25+

    I have tried to replace your kernel-qemu with kernel.img from /boot of my (real) Raspberry Pi. This kernel’s version would conform to the disk image. Unfortunately is does not work (not even a message “Uncompressing Linux…”). Host shows 100% cpu load, but nothing happens.

    1) What is your “kernel-qemu” file? What is the difference to kernel images under /boot ?

    2) How is your kernel-qemu built? Do you have a config-file?

    3) What about kernel cmdline parameters? My (real) Raspberry Pi shows a long list of kernel parameters. Has this something to do with the failure?

    Markus

    • Hello Markus

      1) kernel-qemu has drivers needed to support the hardware emulated by qemu.
      2) Check my post titled “Compiling an ARM1176 kernel for QEMU”. Here is the .config http://pastebin.com/9zg3k66x . You will need to follow the instruction in the previously mentioned article, as the kernel needs to be patched a little.
      3) Doesn’t matter.
      4) There is no 4, but since you’re here, look up Torlus’ qemu patches. They allow you to use a stock kernel.img, but you don’t have any networking support at all.

  69. Well, I tried 2014-01-07-wheezy-raspbian.img on Fedora19 (with the latest qemu I could compiled -1.6,IIRC), and under XP : both worked:
    * under FC19, I could open RPi’s XFCE (with startx, from the qemu terminal) or use the host terminal to type commands (tar, configure, make) into RPI. That was very satisfying.

    *under Window, RPI’s XFCE could not start, but I could type the same kind of bash commands in qemu’s terminal …

    • No error message or anything? I haven’t tested qemu on windows in quite a while, so I can’t say if that’s “normal” or what the reason might be.

      • Well, on XP, it is rather puzzling:
        it works very well on a non graphical way .
        I can run “startx” , it very quickly shows a message error (I use XP once a week, in an Internet café as the PC is faster than mine), then a fully fledged desktop starts; after that, if I try to click on LX terminal, it ***for ever*** display a menu (Create New\n PAste\n, SelectAll\n, Inevrt Selection\nSort Files\Desktop Preferences) Any mouse action does not do anything.

        I launched from Cygwin (Xterm) with the following commands:
        export PATH=~/qemu:$PATH

        user@phenix /cygdrive/f/rpi
        $

        user@phenix /cygdrive/f/rpi
        $ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=1 rootfstype=ext4 rw ” -hda 2014-01-07-wheezy-raspbian.img

        OTOH, it works well on Mageia4 with its native qemu…

  70. Hi,

    is there a chance that you might provide a 3.10.26+ kernel? Your 3.6.11 works fine most of the time, but sometimes it seems to fail (maybe some new system-calls?), for example during installation of some php-packages.

    Thanks to your post I know how to compile my own kernel, but setting up the toolchain on my platform is a bit of a hazzle and I currently don’t have the time for that.

    Bernhard

  71. Hi,

    I am working on win 7 64.
    I installed qemu for Windows 64 (1.7.50 version = latest).
    I installed wget for windows and got kernel-qemu from your link. ◦wget http://xecdesign.com/downloads/linux-qemu/kernel-qemu).
    I am using the img from raspberry site (latest: 2014-01-07-wheezy-raspbian.img).
    When I tried “qemu-system-arm -cpu ?” : I have the arm1176 in stdout.txt file.
    I tried the first boot command:
    1.qemu-system-armw -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=1 rootfstype=ext4 rw init=/bin/bash” -hda 2014-01-07-wheezy-raspbian.img
    The system is trying to boot but it gives a kernel panic and the qemu is closed. Exitcode: 0x0000000b
    CPU:0 PID: 1 Comm: bash Not tainted 3.10.26+ #2
    And there are also some error lines following (I have an png file with the errors).

    Can you help me with some advice why this is happening?
    Thanks
    Mihaela

  72. I was looking for the way to boot arm arch (raspberry pi) from sd card directly.

    So first thing to do is BACK UP YOUR SD CARD IMAGE :)
    Next, boot into emergency:
    (might need to modify /dev/mmcblk0 access rules, to void – use root – not safe for work.)

    $ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=0 rootfstype=ext4 rw emergency” -hda /dev/mmcblk0

    Give the root password. After shell is aquired, edit fstab
    $ nano -w /etc/fstab
    change mmcblk0p to sda as per above comments. This will need to be reverted back if sd card is going back raspberry pi slot.

    $ reboot

    Now from the host again:
    $ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=0 rootfstype=ext4 rw” -hda /dev/mmcblk0

    and voila – RPI from SD Card. Not sure this is safe, but I could not be bothered to modify 16gb sd image and copy back to the card (had to make some changes… mine rpi doesn’t have any keyboard,monitor. Only sshd access.) My host: 3.12.9-2-ARCH #1 SMP PREEMPT Fri Jan 31 10:22:54 CET 2014 x86_64 GNU/Linux

    Did changes i needed (fixed fstab – I messed up it before), reverted sda to mmcblk0 in fstab and booted arch with rpi hardware.

    p.s. still not sure what’s happening with my rpi arch – it seems something else is not allowing to boot network services correctly. Without monitor difficult to say what’s wrong :(

  73. Very nice, works for me. Thanks much for this guide.

    Is there a way that you know of to have qemu operate in a bridged networking mode so that the guest OS is a peer on the LAN in the same IP subnet, so I can ssh into it?

    • I don’t know about other network modes but you can use -redir tcp:2222::82 to route the host’s port 2222 to the guest’s port 22. If that doesn’t work, you can also use SSH to tunnel ports from within the guest (look up reverse ssh).

  74. I tried doing the steps but with RASPBMC and it says “rebooting in 1 sec” and the window closes.

    Any ideas on what could be wrong here?

  75. Shift,

    Did you ever have a 3.10.25+ kernel-qemu? If yes, could you provide a link to it please.

  76. Shift,

    Very many thanks for that 3.10.25+ kernel. I asked as I was trying to compile a qemu kernel for the RPi in Mint 16 64bit having added the 32bit libs etc, but the make ARCH=arm step just generated loads of errors when using “arm-linux-gnueabihf-“. I was clueless as to why.

    This stuff is new to me, and it took a lot of searching just to find out how to clone and checkout the 3.10.25 kernel source code from the raspberry git archive. (see this ref for example: http://www.raspberrypi.org/phpBB3/viewtopic.php?f=66&t=57401 )

    I could only get a kernel compile to work if I used “arm-linux-gnueabi-“, with VFP set to yes. That’s good enough for what I wanted. I think I can use the “extract-config” script on your kernel image to see what you used.

    I wanted to test the Volumio beta release in a qemu RPi emulation, so I added ac97 and cifs support to my compile. For full networking in QEMU you can use VDE and a tap. For example, in debian:

    modprobe tun
    vde_switch -tap tap0 -daemon -mod 660 -group users
    ifconfig tap0 192.168.1.100 netmask 255.255.255.0 broadcast 192.168.1.255
    echo “1” > /proc/sys/net/ipv4/ip_forward
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    iptables -A FORWARD -i eth0 -o tap0 -j ACCEPT
    iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT

    Then configure you QEMU VM to use a static ip for the 192.168.1.0 network.

    My qemu command is:

    qemu-system-arm -kernel kernel3-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda3 panic=1 rootfstype=ext4 rw” -hda VolumioBeta1.1PI.img -net nic -net vde -soundhw ac97

    The same fix to /etc/ld.so.preload and /etc/udev/rules.d/90-qemu.rule are need to get this to work.

    Using the kernel-qemu-3.10.25+ you kindly created, I still get a libkmod boot error, but the VM boots.

    I see you used CONFIG_CROSS_COMPILE=”armv6j-hardfloat-linux-gnueabi-” , so was that done on GENTOO?

    Anyway, thanks again for your work and all the info on these pages. My next challenge create a QEMU VM to test runeAudio for RPi which is ARCH Linux based but uses an early 3.6.11 kernel.

    • Yeah, this was done on Gentoo, well spotted. Thanks for the tap device instructions, that’s awesome. I never managed to get proper networking support, so those instructions are handy to have. Did using -soundhw ac97 and adding support to the kernel actually work as well?

  77. Hi Shift,

    Googling will show you other ways to setup the VDE with QEMU with more complex instructions and the use of slirpvde. The latter can give you DHCP on the virtual network. I adopted the simpler method of forwarding between host subnet and virtual subnet and creating static ips in any QEMU VM. You can also connect any VirtualBox VMs to the same tap0, and have them on the same subnet as any QEMU VM.

    Yes, both ac97 and CIFS are supported via inbuilt modules in my kernel compile and cifs mounts work in my RPi emulation as does sound.

    pi@volumio:~$ aplay -l
    **** List of PLAYBACK Hardware Devices ****
    card 0: I82801AAICH [Intel 82801AA-ICH], device 0: Intel ICH [Intel 82801AA-ICH]
    Subdevices: 1/1
    Subdevice #0: subdevice #0

    Sharing data between Debian VM and RPi emulation using smb/cifs:

    pi@volumio:~$ mount
    /dev/root on / type ext4 (rw,noatime,nouser_xattr,errors=remount-ro,data=ordered)
    devtmpfs on /dev type devtmpfs (rw,relatime,size=127216k,nr_inodes=31804,mode=755)
    tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=25460k,mode=755)
    tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
    proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
    sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
    tmpfs on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=262144k)
    devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620)
    /dev/sda1 on /boot type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
    Ramdisk on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=262144k)
    rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
    //192.168.0.50/archdata on /mnt type cifs (rw,relatime,vers=1.0,sec=ntlmssp,cache=strict,username=chris,domain=TEST-SAMBA,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.0.50,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)

    I guess the only way to be sure that the emulation does not throw up module errors is to start by extracting the kernel config from the RPi distro kernel image in the distro’s boot partition. Make the QEMU changes to that config and compile both a kernel and modules. Then mount the rootfs of the distro img and copy the compiled modules to the mounted img.

    I’ve still not managed to get a hard float QEMU kernel compile to work, but as I never got my head around GENTOO I might try it in an ARCH linux VM instead of MINT.

  78. One minor addition: Some of the utilities freak out if they can’t find /dev/root, which for me led to the inability to resize the partition. Even after making the symlink from /dev/mmcblk0p2 manually, a utility responsible for finalizing the resize failed to run on reboot.

    The addition of the following line to the /etc/udev/rules.d/90-qemu.rules files creates a symlink from the correct partition:

    KERNEL==”sda2″, SYMLINK+=”root”

  79. Awsome!

    Thanks

  80. Worked like a charm from Debian Server 13.10 (x86) running Raspbian Wheezy (2014-01-07).

    Minor problem – I have the same “keyboard” issues as the guy described above.

  81. Hi

    may I use my SD-card with the quemu???

    or It just run from the PC’s Image??

  82. Is there a way to increase the RAM? That’d allow running a lot more interesting apps.

  83. I am attempting to get a small but wonderful linux distro to run under QEMU arm emulation. The distro is found at “tinycorelinux.net”, the download is 5.2.2.X for rasPi are downloaded at “tinycorelinux.net/5.x/armv6/release”.

    I am executing the following command
    ‘qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=0 rootfstype=ext4 rw init=” -hda piCore-5.2.2-X.img’

    Genreal observations, “-M versatilepb -serial stdio”, appear to have no effect on execution, it errors out with “Kernel panic – not syncing: no init found. Try passing init= option to kernel”

    It is obvious the problem is related to the init parameters being passed, but seeing as this is the most detailed tutorial on internet I can find for rasPi, I figured I would give it a try.

    Thank you and have a good day!

    • I forgot to include one other thing. I was not able to get anywhere with your link for QEMU, I am using this one “sourceforge.net/projects/rpiqemuwindows/” I have rasbian and noobs running with it.

  84. great tut!
    to have arm1176 i had to compile qemu
    I didn’t use 2013-09-25-wheezy-raspbian.img
    i used RaspbianLite-Server-2014-03-19.img
    commands that works are:
    -first run:
    qemu-system-asatilepb -m 256 -cpu arm1176 -no-reboot -serial stdio -kernel kernel-qemu -hda RaspbianLite-Server-2014-03-19.img -append “root=/dev/sda2 rootfstype=ext4 rw panic=0 init=/bin/bash”
    -after pi boot
    nano /etc/ld.so.preload
    -reboot with this:
    qemu-system-asatilepb -m 256 -cpu arm1176 -no-reboot -serial stdio -kernel kernel-qemu -hda RaspbianLite-Server-2014-03-19.img -net nic -net user,hostfwd=tcp::1969-:22 -append “root=/dev/sda2 rootfstype=ext4 rw panic=0″

    same commands didn’t work with piCore-5.2.2-SSH.img :(

    hope that helps!

    running:
    Distributor ID: Ubuntu
    Description: Ubuntu 9.04
    Release: 9.04
    Codename: jaunty

  85. qemu-system-asatilepb?
    so strange?? something is wrong in before post
    qemu-system-arm -M versatilepb -m 256 -cpu arm1176 -no-reboot -serial stdio -kernel kernel-qemu -hda RaspbianLite-Server-2014-03-19.img -net nic -net user,hostfwd=tcp::2222-:22 -append “root=/dev/sda2 rootfstype=ext4 rw panic=0 init=/bin/bash”

    without init=/bin/bash on first time

  86. x64 version of qemu hanged always on kernel panic (freeing init memory), 32 bit version was the proper one – Windows 8.1 x64.

  87. One thing to note is that this emulated environment has a PCI bus, which the real RPi does not. Thus the results of libpci are different. Thus the emulated environment miscompiles ladvd and a few other packages which should not be compiled with libpci.

  88. Thanks for the great tutorial. FYI: Got it working with Debian Wheezy 7.5 and Qemu 1.7.1
    Has anyone an idea how to get the camera module emulated?

  89. Thanks for the outstanding tutorial!

    I’m trying to run/debug bare-metal RPi kernels, such as

    I’ve created a QEMU image by cloning a 16Mb SD card with only three files:
    bootcode.bin
    start.elf
    kernel.img

    On an actual RPi, this loads “kernel.img” at 0x8000 and begins executing it. The QEMU disk image is in the file “bare16Mb.dsk”, and I’m using the following command line:

    $ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 8 -M versatilepb -no-reboot -serial stdio -hda bare16Mb.dsk -nographic

    I get the message “Uncompressing Linux… done, booting the kernel.” and when I hit [Enter] the “(qemu)” prompt appears. Dumping memory at 0x8000 does not show the content of “kernel.img”.

    Suggestions?

    • The trick is to also set -initrd kernel-qemu. I’m not exactly sure why qemu works that way.

      • Adding “-initrd kernel-qemu” to the end of the command line had no obvious effect.

        Does it matter that “bare16Mb.dsk” was created like this:

        $ sudo qemu-img convert -f raw -O qcow2 /dev/sda bare16Mb.dsk

        I’ve been using qemu-nbd to access/update files in the disk image, e.g.:

        $ sudo qemu-nbd -c /dev/nbd0 bare17Mb.dsk
        $ sudo mount /dev/nbd0p1 /mnt
        $ sudo cp dwelch67/uart02/uart02.bin /mnt/kernel.img
        $ ls -l /mnt
        total 2592
        -rwxr-xr-x 1 root root 17824 Jul 4 09:04 bootcode.bin
        -rwxr-xr-x 1 root root 528 Jul 4 15:21 kernel.img
        -rwxr-xr-x 1 root root 2557464 Jul 4 09:04 start.elf
        $ sudo umount /mnt
        $ sudo qemu-nbd -d /dev/nbd0
        $ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 8 -M versatilepb -no-reboot -serial stdio -hda bare16Mb.dsk -nographic -initrd kernel-qemu

      • BTW, all this is being done on the RPi itself :-)

        (sorry about the “17” typo, should be “bare16Mb.dsk”, of course)

    • Just noticed that the link to my example bare-metal kernel was dropped from my message.

      https://github.com/dwelch67/raspberrypi/tree/master/uart02

      …is an example of the kind of kernel I’m trying to boot. Given the unusual way the RPi boots, having the video core read the SD card and load a kernel at 0x8000, it’s not clear how to hook into this process with QEMU.

      • Hi Dale, this is exactly the method I used to debug my bare metal kernels as well. I also recommend you check out raspbootin to avoid having to write a new kernel to the sd card every time you want to test it on a pi. Take a look at this topic http://www.raspberrypi.org/forums/viewtopic.php?f=72&t=78410 . This is where the initrd trick was recommended to me and it worked fine. You can also pop onto the #raspberrypi IRC channel on freenode and I can try to help there. Good luck.

  90. Just a brief follow-up. For bare-metal experiments, I don’t really even need an -hda or -sd image, just a -kernel, such as:

    $ qemu-system-arm -kernel baremetal.bin -cpu arm1176 -m 8 -M versatilepb -no-reboot -serial stdio -nographic

    The “baremetal.bin” image is loaded at 0x10000, instead of 0x8000 (even with -initrd). Since the bare-metal experiments are all very small (<32Kb) they fit between 0x8000 and 0x10000, so a little assembly preamble can automatically relocate the kernel to 0x8000 and reboot from there. My bootstrap preamble looks like this:

    @ _start is the bootstrap entry point
    .text
    .align 2
    .global _start
    _start:
    sub r1, pc, #8 @ Where are we?
    mov sp, r1 @ Bootstrap stack immediately before _start
    ldr lr, =halt @ Halt on “return”
    ldr r0, =0x8000 @ Absolute address of kernel memory
    cmp r0, r1 @ Are we loaded where we expect to be?
    beq k_start @ Then, jump to kernel entry-point
    mov lr, r0 @ Otherwise, relocate ourselves
    ldr r2, =0x7F00 @ Copy (32k – 256) bytes
    1: ldmia r1!, {r3-r10} @ Read 8 words
    stmia r0!, {r3-r10} @ Write 8 words
    subs r2, #32 @ Decrement len
    bgt 1b @ More to copy?
    bx lr @ Jump to bootstrap entry-point
    halt:
    b halt @ Full stop

    This trick also is convenient for the run-time bootloader. We can upload a new kernel to 0x10000 and simply jump to it, letting the bootstrap preamble relocate it safely down to 0x8000 and reboot at that location. As long as each kernel image starts with this relocation code, it’s all good.

    • Grrr… let me try again with “code” tags instead of “pre” (wish there was a preview option). The bootstrap preamble is:

      @ _start is the bootstrap entry point
      .text
      .align 2
      .global _start
      _start:
      sub r1, pc, #8 @ Where are we?
      mov sp, r1 @ Bootstrap stack immediately before _start
      ldr lr, =halt @ Halt on "return"
      ldr r0, =0x8000 @ Absolute address of kernel memory
      cmp r0, r1 @ Are we loaded where we expect to be?
      beq k_start @ Then, jump to kernel entry-point
      mov lr, r0 @ Otherwise, relocate ourselves
      ldr r2, =0x7F00 @ Copy (32k - 256) bytes
      1: ldmia r1!, {r3-r10} @ Read 8 words
      stmia r0!, {r3-r10} @ Write 8 words
      subs r2, #32 @ Decrement len
      bgt 1b @ More to copy?
      bx lr @ Jump to bootstrap entry-point
      halt:
      b halt @ Full stop

  91. Networking works with the latest qemu-system-arm, which is a few commits past v.2.1.0-rc1. Not sure if v2.0.0 works.

    -net nic,model=smc91c111,netdev=net0 -netdev tap,id=net0

    I imagine other configurations work as well, e.g. usermode networking. Interestingly, smc91c111 is the default nic model, i.e model=smc91c111 isn’t necessary. That model doesn’t even show up if model=? is used. The Pi loads the smc91x driver. (For some reason, the pi driver doesn’t show up in lspci. Didn’t figure out why.) I have found no limitations yet.

  92. It worked for me!
    Thanks for the article!

  93. works great! although, I do have a bit of an issue with mouse grabbing in the qemu display in that it doesn’t really do a very good job of it. my mouse keeps going outside the screen and it’s getting QUITE annoying. If anyone can help, that would be great!

  94. Works on my Linux Mint 16 :-)
    Had to install G++ for MAKE.
    For the mouse outside the screen problem…try CTRL-ALT-f for full screen (switches it on or off).
    Thanx for the great tut!

  95. I followed the instructions carefully but when I execute “qemu-system-arm -cpu ?” I get:

    No machine specified, and there is no default.
    Use -machine help to list supported machines!

    Not sure what’s going on? I cloned qemu from the git repo, compiled and installed it as suggested.

    My system specs are: Ubuntu 14.04 64-bit, 6 GB RAM, Intel Quad-Core.

    Thanks for any help.

  96. I am using ubuntu-12.04

    # qemu-system-arm -cpu ? |grep arm
    arm926
    arm946
    arm1026
    arm1136
    arm1136-r2
    arm1176
    arm11mpcore
    so for Good.

    I have problem while executing with 2014-rpi-image insted of 2013-rpi-image

    # qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=1 rootfstype=ext4 rw init=/bin/bash” -hda 2014-01-07-wheezy-raspbian.img

    Uncompressing Linux… done, booting the kernel.
    Inside the QEMU -shell I have these error messages
    ABORT operation stared … timedout
    DEVICE RESET operation started….timedout
    BUS RESET operation started… timedout
    HOST RESET opoeration started… timed-out
    Device offlined

    Can be please tell me what is wrong
    thanks in advance

  97. Hey, great stuff, but I’m missing dev mapper in kernel. Would be a good addition. Thanks.

  98. Thank you! It’s working on Debian 7 with the wheezy-backports qemu packages.

  99. This may seem like a Noob question but why do you have to provide a linux kernel for Pi? does it not have it’s own kernel?

    • Unfortunately, the official kernel doesn’t support the hardware that qemu emulates.

      • Maybe you can help me. Using qemu version 1.3 with 2014-09-09-wheezy-Raspbian with the command arguments
        qemu-system-armw -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append “root=/dev/sda2 panic=1 rootfstype=ext4 rw init=/bin/bash” -hda 2014-09-09-wheezy-raspbian.img

        The boot process stops and It repeats the following.

        scsi 0:0:9:0 ABORT operation started
        ABORT operation timed-out
        DEVICE RESET operation started
        DEVICE RESET operation timed-out

        I think that I read somewhere that qemu version 1.5 fixes this.
        Any thoughts?

        • I forgot to tell you that the host is Windows 7 64bit.

          • Ok, I finally got Pi to work on my Windows 7 64bit using QEMU version 1.6 32bit found here
            http://lassauge.free.fr/qemu/

            I was then able to follow your instructions. Once I shut down and restarted without the
            init=/bin/bash in the -append command string, it was neccessary to use Ctrl-D to get to the Pi login and then complete desktop launch using startx.
            I hope this helps out other Window 7 users.

  100. Hi All,

    Thanks for the instructions. I have compiled and running QEMU on (Virtual Machine running Linux Mint 17) inside VirtulBox on host (physical machine also running Linux Mint 17). I have downloaded the kernel and raspbian image file (2014-09-09-wheezy-raspbian.zip). Unziped the raspbian image and booted and followed the rest of the instruction about commenting the line in /etc/ld.so.preload and creating /etc/udev/rules.d/90-qemu.rules. everything work as instructed. except my Mouse and Keyboard are not working in the desktop (lxde). the keyboard work in tty but not in lxde desktop. any solution?

    Regards,
    Rob


Leave a comment