ChangeLog/9.1

Release schedule: Planning/9.1.

System emulation

Removed features and incompatible changes

Consult the 'Removed features' page for details of suggested replacement functionality.

• The Nios II target has been removed.
• The "scsi" property of virtio-blk devices has been removed. SCSI command passthrough had never been present on virtio-blk 1.0 devices, and is now removed from legacy devices as well. Use virtio-scsi instead.
• The pvrdma device and rdmacm-mux helper has been removed.
• The "block migration" options to the migrate commands ("blk" and "inc" for QMP, "-b"/"-i" for the human monitor) have been removed; guest management software such as libvirt is able to perform block migration more efficiently using block jobs and NBD devices.
• The "compress" migration capability has been removed; multifd migration is able to do compression and can be used instead.

New deprecated options and features

Consult the "Deprecated Features" chapter of the QEMU System Emulation User's Guide for further details of the deprecations and their suggested replacements.

• Using the migration URI "fd" together with files has been deprecated. Use it only for sockets, and use "file:" to save a snapshot to a file.
• The "ref405ep" machine and PPC405 CPUs have been deprecated. Firmware images are not available and Linux is dropping support this year as well.
• The PCOMMIT instruction is not decoded by TCG anymore and the corresponding "-cpu pcommit=..." flag is deprecated.

Arm

• New CPU architectural features emulated:
  • FEAT_NMI
  • FEAT_CSV2_3
  • FEAT_ETS2
  • FEAT_Spec_FPACC
  • FEAT_WFxT
  • FEAT_Debugv8p8

• The 'max' CPU and any new CPU types will default to a 1GHz generic timer frequency rather than the old 62.5MHz (this is architecturally required from ARMv8.6 onwards)
• The emulated GICv3 also now has NMI support
• The emulated SMMUv3 now supports nested (two-stage) page tables
• the linux-user gdbstub now understands MTE tags

• Changes to existing board models:
  • Add DM163 display to B-L475E-IOT01A board
  • xilinx_zynq: The cache controller is now present
  • xilinx_zynq: Now supports up to two CPU cores
  • xilinx_zynq: New machine property boot-mode to specify the boot mode
  • sbsa-ref: The default CPU type is now Neoverse-N2
  • sbsa-ref: The default generic timer frequency is now 1GHz. (If guest time now seems to be passing too quickly, upgrade your guest TF-A firmware image: older versions had a bug where they did not honour the frequency reported to them by the CPU.)
  • virt: In the secure=off mode, you can now create a second non-secure UART by passing a second -serial argument on the command line.

RISC-V

ISA and Extensions

• Support RISC-V privilege 1.13 spec
• Implement SBI debug console (DBCN) calls for KVM
• Set tval in breakpoints
• Add support for Zve32x extension
• Add support for Zve64x extension
• Add th.sxstatus CSR emulation
• Remove experimental prefix from "B" extension
• zvbb implies zvkb
• Support the zimop, zcmop, zama16b and zabha extensions
• Add decode support for Zawrs extension
• Add smcntrpmf extension support

Machines

• Support 64-bit addresses for initrd
• Virt machine aplic/imsic device tree fixes
• QEMU support for KVM Guest Debug on RISC-V
• Add support for RISC-V ACPI tests
• Update the KVM regs to Linux 6.10-rc5
• Re-insert and deprecate 'riscv,delegate' in virt machine device tree
• roms/opensbi: Update to v1.5.1

Fixes and Misc

• Fix exposure of Zkr
• Raise exceptions on wrs.nto
• Tolerate KVM disable ext errors
• Relax vector register check in RISCV gdbstub
• Fix the element agnostic Vector function problem
• Fix Zvkb extension config
• Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
• Check single width operator for vector fp widen instructions
• Check single width operator for vfncvt.rod.f.f.w
• Prioritize pmp errors in raise_mmu_exception()
• Do not set mtval2 for non guest-page faults
• Fixup CBO extension register calculation
• Fix the hart bit setting of AIA
• Decode all of the pmpcfg and pmpaddr CSRs
• Extend virtual irq csrs masks to be 64 bit wide
• Validate the mode when setting vstvec CSR
• Raise an exception when CSRRS/CSRRC writes a read-only CSR

SPARC

New architectural features emulated:

• FMAF
• IMA
• VIS3
• VIS4

No new cpu types with these features are added, yet, but one may enable them manually with -cpu <type>,+<feature>.

x86

• Several fixes to the emulation of the HPET device.
• New CPU models Icelake-Server-v7, SapphireRapids-v3 and SierraForest.
• New CPU features "lam" and "rfds".
• The argument to the new command line option "-smp modules" is now encoded in CPUID.
• Support for SEV-SNP using the "-object sev-snp-guest" command line option.

TCG

• Several fixes to the emulation of IRET.
• Fixes to the handling of EFLAGS.TF and EFLAGS.RF for various instructions (VMRUN, HLT, PAUSE)
• ICEBP is implemented
• The GD bit of DR7 is implemented

Device emulation and assignment

UFS

• Supports emulation of MCQ behaviour based on UFSHCI v4.0.
• MCQ Parameter Usage:

-device ufs,mcq=true,mcq-maxq=8

virtio

• Support for VIRTIO_F_NOTIFICATION_DATA.
  • Requires ioeventfd disabled, e.g.

-device virtio-scsi-pci,...,ioeventfd=off,notification_data=on

Semihosting

• Semihosting is only included in the build when TCG is enabled

GUI

• Allow UNIX socket option for VNC websocket

GDBStub

• architectures can now extend the stub's command tables

TCG Plugins

• added STORE_U64 and conditional callback ops
• updated examples to use new ops
• plugins can now request to control guest time
• new IPS plugin example
• cleaned up bits of the lockstep plugin
• new stoptrigger plugin that will exit with a status at given conditions
• test plugins can now be found in tests/tcg/plugins (mirroring contrib/plugins)
• the documentation of plugins is now in the emulation section

Migration

• New 'exit-on-error' option to migrate-incoming, if set to false causes QEMU to not exit on incoming migration failure, giving the management layer an opportunity to fetch the error through QMP.

• Compression offload support with two new compression modes:
  • multifd-compression qpl :: Uses Intel's Query Processing Library (QPL) to enable compression offload to the In-Memory Analytics Accelerator(IAA);
  • multifd-compression uadk :: Enables the usage of User Space Accelerator Development Kit (UADK) accelerator framework;

• New 'direct-io' migration parameter to support O_DIRECT in multifd migrations when targeting a file.

• New migration state 'postcopy-recover-setup' that marks the start of a postcopy recovery attempt. This can be used to disambiguate whether the 'postcopy-failed' state refers to the original postcopy or its recovery.

Block device backends and tools

• The QEMU 8.2 release introduced a regression in the ability to use TLS to encrypt the NBD connection used for storage migration, particularly visible when iothreads are in use. This regression has been fixed and the testsuite enhanced to ensure it does not regress again.
• CVE-2024-7409 has been patched, which was a long-standing vulnerability in using qemu as a transient NBD server, where a malicious client could crash qemu at the time of nbd-server-stop even if the client did not know the TLS secrets to complete a connection to the server.

User-mode emulation

arm/arm64/aarch64

• bsd-user now supports both 32-bit and 64-bit arm emulation.

TCG

LoongArch

• Use LASX instructions to support code generation of 256-bit vectors.

Guest agent

• Add guest-network-get-route command (Linux only)
• Document allow-rpcs in the config file section
• Allow configuration file path via the cli
• Centralize logic for disabling/enabling commands
  • Some error messages changed
  • Allow to use allow-rpcs and block-rpcs option in parallel

Build Information

Build Dependencies

• When using Python 3.10 or older, building QEMU requires the tomli package to be installed on the host. (The dependency was introduced in QEMU 8.2 but until now QEMU included a vendored copy of the library).
• Building QEMU now requires Meson 1.1 or newer. QEMU however includes a copy of Meson, which is used if a suitable version is not available on the host.

Configuration

• When building with the "--without-default-devices" option, boards have to be enabled specifically in the configs/devices/*/*.mak files. In previous versions, most targets (all except ARM) listed enabled all boards even for --without-default-devices builds, and they had to be disabled instead.

Host support

• When built for the x86 architecture (either 32-bit or 64-bit) QEMU now can specify the desired architecture baseline. For example, configuring with --x86-version=2 will build a version of QEMU that requires x86-64-v2 processors (Intel Nehalem, or Sandy Bridge for the Pentium and Celeron lines, Intel Atom Silvermont, and AMD Bulldozer processors).
• libfdt is not anymore a hard requirement when building the i386-softmmu, mips64el-softmmu, ppc-softmmu and x86_64-softmmu targets. Instead, if libfdt is not available, boards that require it will not be included in the emulator.
• The --enable-avx512f option to configure has been removed, since there is no code in QEMU that uses AVX512F instructions.

Docker Tweaks

• Bumped docker images to Fedora 40 and Alpine 319

Testing and CI

• The ansible configure scripts for CI machines are now driven by lcitool metadata
• BSD images were updated for the python uprev
• Testing now dumps a packages.txt in the artefacts to help catch package changes

Known issues

• See https://gitlab.com/qemu-project/qemu/-/milestones/13
• The x86 decoder was mostly rewritten and is still a bit slower than in QEMU 9.0 and earlier. Some optimizations are planned for future versions of QEMU.