ChangeLog/7.0

System emulation

Incompatible changes

Consult the 'Removed features' page for details of suggested replacement functionality

New deprecated options and features

Consult the "Deprecated Features" chapter of the QEMU System Emulation User's Guide for further details of the deprecations and their suggested replacements.

Arm

• The virt board has gained a new control knob to disable passing a RNG seed in the DTB (dtb-kaslr-seed)
• The AST2600 SoC now supports a dummy version of the i3c device
• The virt board can now run guests with KVM on hosts with restricted IPA ranges
• The virt board now supports virtio-mem-pci
• The virt board now supports specifying the guest CPU topology
• On the virt board, we now enable PAuth when using KVM or hvf and the host CPU supports it
• xlnx-versal-virt now emulates the PMC SLCR
• xlnx-versal-virt now emulates the OSPI flash memory controller
• The Arm GICv3 ITS now emulates the previously missing MOVI and MOVALL commands
• New board model: mori-bmc
• We now support emulating FEAT_LVA
• We now support emulating FEAT_LPA
• We now support emulating FEAT_LPA2. (Note that this is disabled by default for the 'virt' board's versioned machine types prior to 7.0 (ie 'virt-6.2', 'virt-6.1', etc) because Linux kernels prior to v5.12 have a bug which means they will not boot on a CPU which has LPA2.)

HPPA

• Support up to 16 virtual CPUs
• Improved artist graphics driver for HP-UX VDE, HP-UX CDE and Linux framebuffer
• Mouse cursor focus and positioning now works much better under HP-UX X11
• Emulated TOC button can be triggered with "nmi" in the qemu monitor
• Added support for Qemu SCSI boot order option
• Possibility to change system HOSTID for HP-UX and Linux
• Added firmware 16x32 pixel bitmap font for use on HDPI screens
• Ability to choose serial or graphical console as default firmware console

OpenRISC

Machines

• Support up to 4 cores up from 2 on the OpenRISC sim machine
• Support loading an external initrd image on the OpenRISC sim machine
• OpenRISC sim machine now automatically generates a device tree and passes it to the kernel

RISC-V

Extensions

• Add support for ratified 1.0 Vector extension
• Support for the Zve64f and Zve32f extensions
• Drop support for draft 0.7.1 Vector extension
• Support Zfhmin and Zfh extensions
• RISC-V KVM support
• Mark Hypervisor extension as non experimental
• Enable Hypervisor extension by default
• Support for svnapot, svinval and svpbmt extensions
• Experimental support for 128-bit CPUs
• Initial support for XVentanaCondOps custom extension
• stval and mtval support for illegal instructions
• Support for the UXL field in xstatus
• Add support for zfinx, zdinx and zhinx{min} extensions

Machines

• OpenSBI binary loading support for the Spike machine
• Improve kernel loading for non-Linux platforms
• SiFive PDMA 64-bit support
• Support 32 cores on the virt machine
• Add AIA support for virt machine

Fixes

• Fix illegal instruction when PMP is disabled
• Corrections for the Vector extension
• Fixes for OpenTitan timer
• Correction of OpenTitan PLIC stride length
• Removal of OpenSBI ELFs
• Fix trap cause for RV32 HS-mode CSR access from RV64 HS-mode
• Fixup OpenTitan SPI address

Device emulation and assignment

9pfs

• Fixed 9p server crash (issue #841) that happened on some host systems due to incorrect (system dependant) handling of struct dirent size.
• Added support for macOS hosts.

virtiofs

• Fix for CVE-2022-0358 - behaviour with supplementary groups and SGID directories
• Improved security label support
• The virtiofsd in qemu is now starting to be deprecated; please start using and contributing to Rust virtiofsd

Semihosting

• We now generate sane numbers for SYS_HEAPINFO under system emulation

TCG Plugins

• new coverage plugin in contrib which support drcov format traces

Block device backends and tools

• Fleecing backup has been made more flexible: Fleecing backup means exposing a temporary snapshot of an actively used image, and having the “copy-before-write” (CBW) filter (or historically the “backup” block job) copy data there from areas written by the guest to the active image, before they are overwritten, so that the snapshot keeps representing the point-in-time state of the disk when the snapshot was created. This snapshot can then be read (either by qemu itself using the “backup” or “mirror” block jobs, or by outside users e.g. via an NBD export) to create a backup. As of qemu 7.0, instead of reading the snapshot image directly, it can also be accessed through the new “snapshot-access” block driver, by installing such a node on top of the CBW filter. Doing so has some advantages over accessing the snapshot image directly; for example, the image can then be in any format (not just COW formats like qcow2), because the CBW filter keeps track of its allocation bitmap. Once an area has been backed up, users can send a discard request to mark it as done, so that the CBW filter will not potentially copy it to the snapshot image on a subsequent guest write. Furthermore, the CBW filter now has a “bitmap” parameter that allows limiting its scope as specified by the bitmap at the time the CBW filter node is created.
• A bug in caching block status has been fixed that was causing over-eager treatment of a format layer as all data rather than detecting holes, if an earlier block status query had merely been checking for which portions of the backing chain were allocated. While the bug did not affect guest-visible data, it caused some performance regressions, particularly noticeable and easy to trigger when using 'qemu-nbd --allocation-depth'.
• The SSH driver supports sha256 fingerprints with pre-blockdev command line configuration syntax.
• The SSH driver will print the actual fingerprint and its type when failing to validate a host key.

Miscellaneous

• The -sandbox 'spawn' filter, will now correctly block use of the clone syscall for spawnnig processes, while allowing thread creation
• The -sandbox 'spawn' filter, will now entirely block use of the clone3 syscall entirely since there is no way to access its flags parameter from seccomp to distinguish thread vs process creation
• The -sandbox 'spawn' filter, will now block setns, unshare and execveat syscalls since they are not desired.

User-mode emulation

• fixed a bug that caused issues mapping the ARM commpage on 32 bit builds

TCG

User-mode emulation (linux-user, bsd-user) will enforce guest alignment constraints and raise SIGBUS to the guest program as appropriate.

ARM

Support for for ARMv4 and ARMv5 hosts has been dropped. These older Arm versions do not have support for misaligned memory access; such support was added to ARMv6. Since ARMv5 is quite old, it is presumed that such systems do not have sufficient RAM to even run QEMU, and so practically speaking no systems are impacted.

Guest agent

• Support Windows 11 for guest-get-osinfo command
• Fix memory leaks in Windows guest-get-fsinfo command

Build Information

Container Based Builds

• a large number of containers are now updated by lcitool
• TESTS and IMAGES environment variables can be used filter again when building against all docker targets

Known issues

• see Planning/7.0