Qemu 10 is here: significantly improved macOS emulation

The Qemu developers (quick emulator) have released version 10.0.0 of their free virtualization software. A total of over 2800 changes from 211 developers flowed in. Qemu is an open source project under GPL2 license, apart from parts such as the Tiny Code Generator (TCG), which is largely under the BSD or co-license. A look at the list of innovations and improvements shows in the emulation of the various architectures, especially changes in RISC-V and ARM, but also (still) surprisingly, a surprising amount of HPPA and Loongarch.

Again great progress in RISC-V

The Qemu emulation for RISC-V, the source-open and free BSD license command architecture (ISA, Instruction Set Architecture) received some important extensions. Qemu 10 now supports the ISA extensions SSSTATEEN, SMRNMI, SMDBlTRP/SSDBLTRP, SUPM/SSPM and SVUKTE. The latter, for example, is intended to prevent attacks that try to find out the address room layout of the supervisor software and use it for exploits. A RISCV IMMUSSYS device is new, and a translation day is intended to provide more speed in emulation for the IOMMU-PageTable cache.

In addition, the emulations for tenstorrent-ascalon CPUs (1 to 8 cores), which have data centers and AI, have the focus, as well as the RV64-Xiann-Nanhu-CPU (1 to 2 cores), which should run quickly in 7 Nm up to 2.8 GHz. Qemu 10 now also emulates AMDS RISC-V Microblaze V, the softcore microprocessor for Xilinx FPGas.

Somewhat surprisingly, the RISC-V Default-Machine is no longer supported. So far, Qemu has defined “Spike” as a standard machine, provided no machine option was specified in the command line. This happened because “Spike” was the first RISC-V machine implemented in Qemu. In the meantime there are several emulated RISC V machines, and so the developers want to force the user to specify the exact machine type. Of course, the “Spike” machine still exists. Anyone who has not yet specified a machine and thus used the “Default Machine” (Spike) must explicitly have the parameter from Qemu 10 -M spike Add when starting.

Beware of ARM and FEAT_PAUTH

By default, the emulation of FEAT_AUTH no longer uses the QARMA5 algorithm intended by the ARM/LLVM architecture, but a Qemu-owned algorithm, because this “significantly” is faster and it is supposedly exactly what the users want. So this is intended for users who don’t care whether the pointers have been manipulated in their code or not. Pointers are signed via the pointer authentication. For this purpose, a cryptographic hash including additional data (Pepper & Salt) is saved. Before this pointer is used again, it must be authenticated by checking its signature. This prevents preventing Pointer of unknown origin be used to replace the signed pointer. If you want to use a safe arm environment, you have to explicitly switch on the Qarma5 option from Qemu 10 (-cpu max,pauth-qarma5=on).

In addition, ARMV8 architectural functions such as FEAT_AFP, feat_rpres and feat_xs as well as the emulation of the physical and virtual timers from Secure EL2. The “Secure” should not be overestimated, because the Execification Level (EL) are defined from El0 to EL3. Roughly speaking, EL0 is the user space, EL1 the kernel/operating system, EL2 is called “Secure Monitor” for hypervisors (and “non-secure”) and only EL3 as the highest privilege.

In addition, Qemu 10 provides two new ARM board models: the NPCM845 Evaluation Board and the I.MX 8M Plus EVK Board.

Hppa and loongarch still live

Fortunately, there are still Qemu developers who also work on older or unusual architectures. This time there are no explicit innovations or fixes for Sparc, MIPS, PowerPC, Alpha or 68k. Loongarch, the RISC architecture developed in China and based on MIPS, has also contributed to the development of Qemu (Binary Translation Instructions by X86-CPU emulation). With Qemu 10, LOONGARCH machines receive more KVM support as the possibility for CPU hotel plug. HPPA (also PA-Risc), a forerunner of the Itanium processor that has been buried for a long time, is now running with an updated Seabios-Hppa V18 and can emulate up to 256 GB RAM. In addition, an emulated HP Diva GSP (Guardian Service Processor) PCI board for remote maintenance and more flexible selection options for graphics cards.

Apple: MacOS guests with accelerated graphics

Qemu 10 introduces two new emulated devices: Apple GFX PCI and Apple GFX-MMIO. How the names suggest that the graphics for MacOS guests accelerate at MacOS hosts can be provided as part of the paravirtualizedgraphics.framow. Apple-GFX-PCI is intended for use to X86-64, Apple GFX-MMIO replicates the graphics device of the Aarch64 version of MacOS implemented by Virtualization.Framework. This should make the graphic surface of MacOS guests significantly more fluid.

With Qemu 10.0, VirtioSio-SCSI devices have received “real” multi-quota support support. It improves I/O scalability. Virtio-Mem is now also available on IBM S390X and the measurement data for virtio-balloon are set to zero with a reset of the machine. The VFIO code received many improvements and now also supports old ATI X550-GPUs.

There are many other detail changes and possible incompatibilities of Qemu 10.0.0 in the changelog documented. The online documentary and the current source code also provide the developers on the Qemu project page free of charge.

See also: