QEMU

9.1

System emulation

Removed features and incompatible changes

Consult the 'Removed features' page for details of suggested replacement functionality.

• The Nios II target has been removed.
• The "scsi" property of virtio-blk devices has been removed. SCSI command passthrough had never been present on virtio-blk 1.0 devices, and is now removed from legacy devices as well. Use virtio-scsi instead.
• The pvrdma device and rdmacm-mux helper has been removed.
• The "block migration" options to the migrate commands ("blk" and "inc" for QMP, "-b"/"-i" for the human monitor) have been removed; guest management software such as libvirt is able to perform block migration more efficiently using block jobs and NBD devices.
• The "compress" migration capability has been removed; multifd migration is able to do compression and can be used instead.

New deprecated options and features

Consult the "Deprecated Features" chapter of the QEMU System Emulation User's Guide for further details of the deprecations and their suggested replacements.

• Using the migration URI "fd" together with files has been deprecated. Use it only for sockets, and use "file:" to save a snapshot to a file.
• The "ref405ep" machine and PPC405 CPUs have been deprecated. Firmware images are not available and Linux is dropping support this year as well.
• The PCOMMIT instruction is not decoded by TCG anymore and the corresponding "-cpu pcommit=..." flag is deprecated.

68k

Alpha

Arm

• New CPU architectural features emulated:
  • FEAT_NMI
  • FEAT_CSV2_3
  • FEAT_ETS2
  • FEAT_Spec_FPACC
  • FEAT_WFxT
  • FEAT_Debugv8p8
• The 'max' CPU and any new CPU types will default to a 1GHz generic timer frequency rather than the old 62.5MHz (this is architecturally required from ARMv8.6 onwards)
• The emulated GICv3 also now has NMI support
• The emulated SMMUv3 now supports nested (two-stage) page tables
• the linux-user gdbstub now understands MTE tags
• Changes to existing board models:
  • Add DM163 display to B-L475E-IOT01A board
  • xilinx_zynq: The cache controller is now present
  • xilinx_zynq: Now supports up to two CPU cores
  • xilinx_zynq: New machine property boot-mode to specify the boot mode
  • sbsa-ref: The default CPU type is now Neoverse-N2
  • sbsa-ref: The default generic timer frequency is now 1GHz. (If guest time now seems to be passing too quickly, upgrade your guest TF-A firmware image: older versions had a bug where they did not honour the frequency reported to them by the CPU.)
  • virt: In the secure=off mode, you can now create a second non-secure UART by passing a second -serial argument on the command line.

AVR

Hexagon

HPPA

LoongArch

• Support boot eif kernel directly
• Add extioi virt extension to support 256 vcpu
• Support KVM Guest Debug
• Gdb support lsx/lasx registers display
• Add TPM support by default

Microblaze

MIPS

Nios2

OpenRISC

PowerPC

Renesas RX

Renesas SH

ISA and Extensions

RISC-V

ISA and Extensions

• Support RISC-V privilege 1.13 spec
• Implement SBI debug console (DBCN) calls for KVM
• Set tval in breakpoints
• Add support for Zve32x extension
• Add support for Zve64x extension
• Add th.sxstatus CSR emulation
• Remove experimental prefix from "B" extension
• zvbb implies zvkb
• Support the zimop, zcmop, zama16b and zabha extensions
• Add decode support for Zawrs extension
• Add smcntrpmf extension support

Machines

• Support 64-bit addresses for initrd
• Virt machine aplic/imsic device tree fixes
• QEMU support for KVM Guest Debug on RISC-V
• Add support for RISC-V ACPI tests
• Update the KVM regs to Linux 6.10-rc5
• Re-insert and deprecate 'riscv,delegate' in virt machine device tree
• roms/opensbi: Update to v1.5.1

Fixes and Misc

• Fix exposure of Zkr
• Raise exceptions on wrs.nto
• Tolerate KVM disable ext errors
• Relax vector register check in RISCV gdbstub
• Fix the element agnostic Vector function problem
• Fix Zvkb extension config
• Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
• Check single width operator for vector fp widen instructions
• Check single width operator for vfncvt.rod.f.f.w
• Prioritize pmp errors in raise_mmu_exception()
• Do not set mtval2 for non guest-page faults
• Fixup CBO extension register calculation
• Fix the hart bit setting of AIA
• Decode all of the pmpcfg and pmpaddr CSRs
• Extend virtual irq csrs masks to be 64 bit wide
• Validate the mode when setting vstvec CSR
• Raise an exception when CSRRS/CSRRC writes a read-only CSR

s390x

SPARC

New architectural features emulated:

• FMAF
• IMA
• VIS3
• VIS4

No new cpu types with these features are added, yet, but one may enable them manually with -cpu <type>,+<feature>.

Tricore

x86

• Several fixes to the emulation of the HPET device.
• New CPU models Icelake-Server-v7, SapphireRapids-v3 and SierraForest.
• New CPU features "lam" and "rfds".
• The argument to the new command line option "-smp modules" is now encoded in CPUID.
• Support for SEV-SNP using the "-object sev-snp-guest" command line option.
• Fixed a bug in TCG plugin handling of fxsave and related instructions

TCG

• Several fixes to the emulation of IRET.
• Fixes to the handling of EFLAGS.TF and EFLAGS.RF for various instructions (VMRUN, HLT, PAUSE)
• ICEBP is implemented
• The GD bit of DR7 is implemented

Xtensa

Device emulation and assignment

ACPI / SMBIOS

Audio

Block devices

Graphics

Hyper-V

I2C

Input devices

IPMI

Multi-process QEMU

Network devices

NVDIMM

NVMe

PCI/PCIe

SCSI

SD card

SMBIOS

TPM

UFS

• Supports emulation of MCQ behaviour based on UFSHCI v4.0.
• MCQ Parameter Usage:

-device ufs,mcq=true,mcq-maxq=8

USB

VFIO

virtio

• Support for VIRTIO_F_NOTIFICATION_DATA.
  • Requires ioeventfd disabled, e.g.

-device virtio-scsi-pci,...,ioeventfd=off,notification_data=on

vDPA

Xen

fw_cfg

9pfs

virtiofs

Semihosting

• Semihosting is only included in the build when TCG is enabled

Audio

Character devices

Crypto subsystem

Authorization subsystem

GUI

• Allow UNIX socket option for VNC websocket

GDBStub

• architectures can now extend the stub's command tables

TCG Plugins

• added STORE_U64 and conditional callback ops
• updated examples to use new ops
• plugins can now request to control guest time
• new IPS plugin example
• cleaned up bits of the lockstep plugin
• new stoptrigger plugin that will exit with a status at given conditions
• test plugins can now be found in tests/tcg/plugins (mirroring contrib/plugins)
• the documentation of plugins is now in the emulation section
• fixed a race condition in scoreboard resizing

Host support

Memory backends

Migration

• New 'exit-on-error' option to migrate-incoming, if set to false causes QEMU to not exit on incoming migration failure, giving the management layer an opportunity to fetch the error through QMP.
• Compression offload support with two new compression modes:
  • multifd-compression qpl :: Uses Intel's Query Processing Library (QPL) to enable compression offload to the In-Memory Analytics Accelerator(IAA);
  • multifd-compression uadk :: Enables the usage of User Space Accelerator Development Kit (UADK) accelerator framework;
• New 'direct-io' migration parameter to support O_DIRECT in multifd migrations when targeting a file.
• New migration state 'postcopy-recover-setup' that marks the start of a postcopy recovery attempt. This can be used to disambiguate whether the 'postcopy-failed' state refers to the original postcopy or its recovery.

Monitor

QMP

HMP

Network

Block device backends and tools

• The QEMU 8.2 release introduced a regression in the ability to use TLS to encrypt the NBD connection used for storage migration, particularly visible when iothreads are in use. This regression has been fixed and the testsuite enhanced to ensure it does not regress again.
• CVE-2024-7409 has been patched, which was a long-standing vulnerability in using qemu as a transient NBD server, where a malicious client could crash qemu at the time of nbd-server-stop even if the client did not know the TLS secrets to complete a connection to the server.

Tracing

Semihosting

Miscellaneous

User-mode emulation

runtime

binfmt_misc

alpha

arm/arm64/aarch64

• bsd-user now supports both 32-bit and 64-bit arm emulation.

LoongArch

HPPA

s390

x86

TCG

LoongArch

• Use LASX instructions to support code generation of 256-bit vectors.

Record/Replay

• Handle muxed input on relay cleanly
• fix some regressions in replay/reverse debugging

RISC-V

Guest agent

• Add guest-network-get-route command (Linux only)
• Document allow-rpcs in the config file section
• Allow configuration file path via the cli
• Centralize logic for disabling/enabling commands
  • Some error messages changed
  • Allow to use allow-rpcs and block-rpcs option in parallel
• Add guest-ssh-* commands for Windows

Build Information

Build Dependencies

• When using Python 3.10 or older, building QEMU requires the tomli package to be installed on the host. (The dependency was introduced in QEMU 8.2 but until now QEMU included a vendored copy of the library).
• Building QEMU now requires Meson 1.1 or newer. QEMU however includes a copy of Meson, which is used if a suitable version is not available on the host.

Configuration

• When building with the "--without-default-devices" option, boards have to be enabled specifically in the configs/devices/*/*.mak files. In previous versions, most targets (all except ARM) listed enabled all boards even for --without-default-devices builds, and they had to be disabled instead.

Host support

• When built for the x86 architecture (either 32-bit or 64-bit) QEMU now can specify the desired architecture baseline. For example, configuring with --x86-version=2 will build a version of QEMU that requires x86-64-v2 processors (Intel Nehalem, or Sandy Bridge for the Pentium and Celeron lines, Intel Atom Silvermont, and AMD Bulldozer processors).
• libfdt is not anymore a hard requirement when building the i386-softmmu, mips64el-softmmu, ppc-softmmu and x86_64-softmmu targets. Instead, if libfdt is not available, boards that require it will not be included in the emulator.
• The --enable-avx512f option to configure has been removed, since there is no code in QEMU that uses AVX512F instructions.

Docker Tweaks

• Bumped docker images to Fedora 40 and Alpine 319

Windows

Testing and CI

• The ansible configure scripts for CI machines are now driven by lcitool metadata
• BSD images were updated for the python uprev
• Testing now dumps a packages.txt in the artefacts to help catch package changes
• checkpatch will prompt MAINTAINER actions when touching imported headers

Known issues

• See https://gitlab.com/qemu-project/qemu/-/milestones/13
• The x86 decoder was mostly rewritten and is still a bit slower than in QEMU 9.0 and earlier. Some optimizations are planned for future versions of QEMU.

9.0

Removed features and incompatible changes

Consult the 'Removed features' page for details of suggested replacement functionality.

• Running QEMU with KVM requires Linux 4.4 or newer. A future version of QEMU will increase the minimum requirement for Arm hosts to Linux 4.19 (also when running KVM); if this is too restrictive for your use case, please contact us at qemu-devel@nongnu.org.
• The behaviour of the '-serial none' option when used together with other '-serial' options has been corrected. Previously when '-serial none' was followed by '-serial something' the '-serial none' was effectively ignored. Now it controls the existence of the first serial port, and the following '-serial' option controls the behaviour of the second serial port; this brings it in to line with how all other cases of multiple '-serial' options work. If you have a command line that was accidentally relying on the old behaviour, you can simply delete the unnecessary '-serial none'.

New deprecated options and features

Consult the "Deprecated Features" chapter of the QEMU System Emulation User's Guide for further details of the deprecations and their suggested replacements.

• The CRIS architecture has been marked deprecated
• Arm boards akita, borzoi, cheetah, connex, mainstone, n800, n810, spitz, terrier, tosa, verdex, z2 have been deprecated

68k

• Fixed exception frame format for 68010
• Add nubus-virtio-mmio device to allow the q800 machine to access virtio devices

Alpha

Arm

• Some board types modelling old Arm hardware using the PXA2xx and OMAP2 SoCs have been deprecated and are scheduled for removal in a future QEMU release: akita, borzoi, cheetah, connex, mainstone, n800, n810, spitz, terrier, tosa, verdex, z2. The code implementing these boards was very old and unmaintained, and we don't believe that any of them have a large number of users.
• New architectural features now emulated:
  • FEAT_ECV (Enhanced Counter Virtualization)
  • FEAT_NV (Nested Virtualization)
  • FEAT_NV2 (Enhanced nested virtualization support)
• New board types:
  • b-l475e-iot01a : the B-L475E-IOT01A board (currently minimal support only)
  • mps3-an536 : a Cortex-R52 board modelling the AN536 firmware image for the MPS3 development board
  • raspi4b : the Raspberry Pi 4 Model B. Note that QEMU does not yet model PCI or ethernet; we hope to implement those devices for the next QEMU release.
• Changes to existing board types:
  • The Freescale i.MX6 now models the cache controller and the PCIe controller
  • The Allwinner R40 and Bananapi boards now model the USB controllers, the AHCI/SATA controller and the watchdog timer
  • Raspberry Pi boards now support the SPI controller and the BSC i2c controller
  • The npcm7xx based boards now support the ethernet controllers
  • SBSA Reference Platform uses 1GHz timer frequency. If you see time going too fast then update firmware.
  • The virt board now wires up non-secure EL2 virtual timer IRQ when EL2 emulation is enabled with 'virtualization=on'.

Note that when the virt board uses the non-secure EL2 virtual timer IRQ, this will trip a bug in older versions of the EDK2 guest firmware, which causes EDK2 to assert on bootup with "ASSERT [ArmTimerDxe] /home/kraxel/projects/qemu/roms/edk2/ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.c(72): PropSize == 36 || PropSize == 48". If you see that assertion you should do one of:

• update your EDK2 binaries to edk2-stable202311 or newer
• use the 'virt-8.2' versioned machine type
• not use 'virtualization=on'

AVR

Hexagon

HPPA

• SeaBIOS-hppa version 16
• SeaBIOS now provided as 64-bit and 32-bit binary
• Fixed 32-bit HP-UX crashes on B160L (32-bit) machine
• Fixed random SCSI slowdowns and script aborts on HP-UX 10.20, Linux and NetBSD
• Fixed NetBSD boot failure due to power button in page zero
• Fixed NetBSD FPU detection failure
• Fixed NetBSD networking with tulip driver
• Fixed OpenBSD 7.4 boot failure
• Allows up to 3840 MB of memory (instead of 3.0 GB)
• Supports the qemu --nodefaults option
• Added qemu-specific opcodes for "HALT QEMU", "RESET QEMU" and "RESTORE SHR" (restore shadow registers).
• Does not abort on access failure in Astro/Elroy registers

LoongArch

ISA and Extensions

• Add loongarch kvm accel support
• KVM: Enable LSX/LASX extension
• Fix tlb huge page loading issue
• Set vector registers call clobbered
• Set cpuid CSR register only once with kvm mode

Machines

• Change the UEFI loading mode to loongarch
• Add dynamic cpu number support for loongarch_extioi
• Fix qtest test-hmp error when KVM-only build
• Fix qemu-system-loongarch64 assert failed with the option '-d int'
• Fix interrupt routing update

Microblaze

MIPS

Nios2

• A bug was fixed in nios2-linux-user that meant async work was being skipped

OpenRISC

PowerPC

Renesas RX

Renesas SH

ISA and Extensions

• Fix mac.w memory load operand size
• Fix mac.w behavior in saturation arithmetic mode
• Fix mac.l behavior in saturation arithmetic mode
• Fix delay slot restrictions for PC-relative mov.w, mov.l, mova

RISC-V

ISA and Extensions

• Add support for Zacas extension
• Add amocas.[w,d,q] instructions
• RVA22 profiles support
• Add RVV CSRs to KVM
• Add support for 'B' extension
• Implement optional CSR mcontext of debug Sdtrig extension
• Add support for Zaamo and Zalrsc
• Enable xtheadsync under user mode
• Add Ztso extension
• Use 'zfa' instead of 'Zfa'
• move ratified/frozen exts to non-experimental

Machines

• ACPI: Enable AIA, PLIC and update RHCT
• Fix the interrupts-extended property format of PLIC
• Document acpi parameter of virt machine
• Remove group setting of KVM AIA if the machine only has 1 socket
• sifive_u: Update S-mode U-Boot image build instructions
• Support vlenb and vregs[] in KVM
• Support new isa extension detection devicetree properties
• SMBIOS support for RISC-V virt machine
• Add rv32i,rv32e and rv64e CPUs
• Enable SPCR for SCPI virt machine
• Add SRAT and SLIT ACPI tables
• Update KVM exts to Linux 6.8

Fixes and Misc

• Fix th.dcache.cval1 priviledge check
• Don't allow write mstatus_vs without RVV
• Fix machine IDs QOM getters
• Fix KVM reg id sizes
• Upgrade OpenSBI from v1.3.1 to v1.4
• pmp: Ignore writes when RW=01 and MML=0
• Don't adjust vscause for exceptions
• Ensure mideleg is set correctly on reset
• Check for 'A' extension on all atomic instructions
• Allow large kernels to boot by moving the initrd further away in RAM
• FIX xATP_MODE validation
• Ensure mcountinhibit, mcounteren, scounteren, hcounteren are 32-bit
• Fix vector shift count overflow
• Fix setipnum_le write emulation for APLIC MSI-mode
• Fix in_clrip[x] read emulation
• Fix privilege mode of G-stage translation for debugging
• Fix ACPI MCFG table for virt machine
• A range of Vector fixes
• Update APLIC IDC after claiming iforce register
• Fix timebase-frequency when using KVM acceleration

s390x

• Fix access register handling in the emulation of the LOAD ADDRESS EXTENDED (LAE) instruction
• Add emulation of CVDG, CVB, CVBY and CVBG instructions

SPARC

• Fix ASI_USERTXT access which caused the Solaris kernel to panic when using mdb/gdb/adb within the guest

Tricore

x86

Xen emulation under KVM

TCG

Known issues

Xtensa

Device emulation and assignment

ACPI / SMBIOS

Audio

Block devices

• The 'virtio-blk' device has gained true multiqueue support where different queues of a single disk can be processed by different I/O threads. This can improve scalability in cases where the guest submitted enough I/O to saturate the host CPU running a single I/O thread processing the virtio-blk requests. Multiple I/O threads can be configured using the new 'iothread-vq-mapping' property.
• 'usb-storage' doesn't ignore the properties 'backend_defaults', 'logical_block_size', 'physical_block_size', 'min_io_size', 'opt_io_size' and 'discard_granularity' any more.
• Fixed 'vhost-vdpa-device' to be compatible with VDUSE block exports again (this was broken in QEMU 8.2.0)

Graphics

Hyper-V

I2C

Input devices

IPMI

Multi-process QEMU

Network devices

NVDIMM

NVMe

PCI/PCIe

SCSI

• The ESP SCSI (am53c974/dc390) device has been substantially rewritten, fixing several long-standing bugs and making it easier to maintain in future.

SD card

SMBIOS

TPM

UFS

USB

VFIO

• Introduced an IOMMU interface backend for VFIO devices
• Introduced a new IOMMUFD backend for ARM, x86_64 and s390x platforms
• Better error reporting
• Allowed cpr-reboot for VFIO devices
• Misc fixes

virtio

vDPA

Xen

fw_cfg

9pfs

virtiofs

Semihosting

Audio

Character devices

• Fix potential crash if connection is dropped while the TLS handshake is still in progress
• Fix I/O on TLS channels when chardev frontend is not ready to consume data
• QEMU is more likely to process pending incoming data before processing EOF/HUP

Crypto subsystem

• The 'sm4' cipher algorithm is now supported and can be used with the 'luks' block driver
• The cipher test suite will automatically skip testing algorithms that have been disabled in the underlying OS crypto library at build time.

Authorization subsystem

GUI

GDBStub

• the gdbstub now supports catching syscalls in user-mode
• the gdbstub now supports fork-follow modes
• the gsbstub now supports siginfo:read

TCG Plugins

• vcpu_init callback will now always be in the vcpu context
• A new API for accessing register values is now available (and used by execlog)
• The inline API has been replaced with a thread safe scoreboard indexed by vcpu_index

Host support

Memory backends

• Memory backends specified on the QEMU commandline can now be preallocated concurrently/asynchronously in some configurations, to speedup QEMU startup with preallocation on multiple memory backends: one requirement is that memory backends that are getting preallocated have a "thread-context" set.
• QEMU 8.2 accidentally allowed for creation of memory backends with sizes that are not aligned to the (huge) page size. This has been fixed.

Migration

• Fixed migration for SUSPENDED VM, where we used to ignore the SUSPENDED state and kick off the VM even if it was suspended before the migration.
• New capability called "mapped-ram". It allows efficient VM snapshots save/load by providing both (1) constant size of ultimate VM image rather than unlimited, and (2) multi-threading support so that save/load of snapshots can be faster.
• Zero page detection offloading for multifd, so that idle guest migration should get a major boost when multifd is enabled.
• New parameter called "zero-page-detection", allow the user to choose the policy for detecting zero pages.
• Enhancement to CPR-reboot mode, added VFIO supports (requires guest suspensions), new documents.
• Fixed a rare postcopy hang with preempt mode since 8.2

Monitor

QMP

• Fixed a race condition where monitor commands could be executed unexpectedly in the middle of another operation and caused crashes

HMP

Network

Block device backends and tools

• The block layer is now thread safe and multiple I/O threads can send I/O requests to the same disk image. virtio-blk can be configured to make use of this and improve scalability (see above).
• The 'luks' block driver now supports creation and usage of detached LUKS header files
• The 'stream' and 'commit' block jobs have a new flag 'backing-mask-protocol'. If it is enabled and the base backing file uses a protocol driver (like 'file') directly, 'raw' is stored as the backing file format in the overlay instead of the protocol name.
• In 'blklogwrites', potential log corruption bugs were fixed related to concurrent requests and to write zeroes operations
• Fixed I/O errors in the libblkio based block drivers caused by incorrect memory alignment of bounce buffers
• Fixed deadlocks that could hang the whole QEMU process in the mirror block job and the NBD export

Tracing

Semihosting

Miscellaneous

• During startup QEMU system emulators will raise the max file descriptors soft limit to match the hard limit
• Seccomp filters will now return EPERM rather than killing QEMU if code attempts to spawn a child process. Fixes compatibility with some NVIDIA libraries which try to run modprobe.
• Thread-local coroutine pools have been mostly replaced by a global pool, which reduces the number of inactive coroutines (and therefore memory mappings) and is limited to a maximum size depending on vm.max_map_count on Linux. This fixes the "failed to set up stack guard page" error that has been reported on Linux hosts where the QEMU coroutine pool exceeded the vm.max_map_count limit.

User-mode emulation

runtime

binfmt_misc

alpha

arm/arm64/aarch64

LoongArch

HPPA

s390

x86

TCG

Record/Replay

• fixed record/replay to avoid problems with partial chardev drains
• updated replay-dump.py for current ABI

RISC-V

Guest agent

• Fix build on Solaris
• Improve help for --allow-rpcs and --block-rpcs command line options
• Fix guest-get-fsinfo when a volume has more than one disk (Windows only)
• Add support of Windows Server 2025 in guest-get-osinfo command (Windows only)

Build Information

Build Dependencies

Build hardening

• QEMU build will include '-fzero-call-used-regs' to attempt to reduce exploitable ROP gadgets
• QEMU build will include '-ftrivial-auto-var-init=zero' to reduce the chance of uninitialized stack variables causing security issues

Windows

• 32-bit Windows is no longer supported as a host OS; use a 64-bit Windows host instead.

Testing and CI

• The timeout for TCG tests was raised to 120s (for the benefit of TCI)
• The OpenBSD VM was updated to 7.4

Known issues

• See https://gitlab.com/qemu-project/qemu/-/milestones/11