github cloud-hypervisor/cloud-hypervisor v52.0
on GitHub

latest releases: v53.0, v51.2
2 months ago

This release has been tracked in v52.0 group of our roadmap project.

Security Fixes

This release fixes a use-after-free vulnerability in the
virtio-block async I/O completion path (#8220). Details can be found
in GHSA-f47p-p25q-83rh (CVE-2026-45782).

Confidential VM Support: KVM SEV-SNP

AMD SEV-SNP confidential VMs can now be launched on KVM in addition to
MSHV. Cloud Hypervisor uses guest_memfd to back private memory and
loads an IGVM-packaged firmware (e.g. Oak stage0) to bring up an
SEV-SNP guest on real hardware (#7942).

Measured-boot support has been completed for KVM SEV-SNP guests,
bringing parity with the QEMU launch flow: the kernel, command line,
and initrd are reflected in the launch measurement, and a signed SNP
ID block can be passed so the guest (or a remote attestor) can verify
the launch (#8123).

VFIO Device Passthrough via iommufd and vfio-cdev

Cloud Hypervisor now supports the modern Linux VFIO device-access
model based on the iommufd subsystem and per-device vfio-cdev
character devices (available since Linux v6.6). This unlocks the
advanced IOMMU features exposed by modern hardware and enables fully
accelerated IOMMU support inside the guest. The legacy
container/group-based path continues to be supported (#7981).

In addition, several VFIO/PCI improvements have landed:

  • A new host_mmap_bars option allows selective mapping of VFIO BARs
    into the guest, so devices that expose registers that should not be
    fast-pathed can be selectively trapped (#7991).
  • Sub-page VFIO BARs are now expanded to a full page for mmap(),
    avoiding spurious failures on devices with small BARs (#7939).
  • VfioMsix::cap and VfioMsix::bar are now kept synchronized to
    avoid stale MSI-X state (#7993).
  • VFIO MMIO regions are now reliably cleared in DeviceManager::drop
    (#8063).
  • Deferred PCI BAR reprogramming state is now part of the saved
    device state (#7945).
  • GSIs for MSI/MSI-X interrupt vectors are now allocated lazily,
    reducing GSI consumption for VMs with many devices (#7940).

Multi-Connection TCP Live Migration

The send-migration HTTP command now accepts a connections
parameter (defaults to 1) that controls how many parallel TCP
connections are used for the live migration data transfer. On
servers with high-bandwidth (e.g. 100G) network links, multiple
connections significantly increase migration throughput (#7669).

Userfaultfd Demand-Paged Snapshot Restore

A new memory_restore_mode option on the restore path allows guest
memory to be populated lazily via userfaultfd instead of reading
the entire memory snapshot before the VM resumes. This dramatically
reduces restore-to-resume latency for large guests, at the cost of
faulting pages in on demand after resume (#7800).

Configurable PCI BDFs for Devices

Users now can configure the PCI slot/device number, the middle
part of the PCI BDF, through the CLI and API; bus and function
remain fixed at 0. This covers virtio devices (except balloon),
VFIO devices, vfio-user device, and generic vhost-user devices
(#8175, #7965, #8174, #8163).

AIO Block Backend write_zeroes and punch_hole Support

The AIO block backend now implements write_zeroes and punch_hole,
fixing a v51.0 regression that affected guests on hosts with
io_uring disabled (e.g. RHEL 9 / CentOS Stream 9, where
kernel.io_uring_disabled=2 is a common hardening default)
(#7817).

Asynchronous QCOW2 Backend with io_uring

A new QcowDiskAsync backend uses io_uring for data I/O on QCOW2
images and is automatically selected when io_uring is available
(falling back to the synchronous backend otherwise). Each virtio
queue gets its own ring and its own duplicated file descriptor,
enabling parallel data I/O across queues; QCOW2 metadata is shared
behind an Arc<RwLock<_>> (#7882).

Generic vhost-user Device Support

A new generic vhost-user-generic device type has been added.
All information about the device (number of queues, queue size,
feature bits, etc.) is provided to Cloud Hypervisor via the
command line or API, allowing arbitrary vhost-user backends to be
attached without device-type-specific support in the VMM (#7221).

Core Scheduling for vCPU Threads

A new core_scheduling option on --cpus controls how vCPU threads
are placed on SMT siblings via the kernel's core-scheduling feature,
which is useful for mitigating cross-thread side-channel attacks
without disabling SMT outright. Three modes are supported: vm
(default — all vCPU threads share one cookie), one-cookie-per-vCPU,
and a configurable grouping mode (#7747).

Snapshot/Restore and Live Migration Improvements

  • Snapshot and restore now treat the memory backing file as a sparse
    file: on snapshot the backing FD is sought with
    SEEK_DATA/SEEK_HOLE to skip unallocated regions, and on restore
    the on-disk file is read as sparse. Pages the guest never touched
    remain as holes in the backing file, substantially reducing both
    snapshot size and restore time (#8113).
  • Paused VMs can now be migrated (#8099).
  • User-configurable downtime and timeout parameters for live
    migration (#7835), and improved downtime observability (#7979).
  • A new option to automatically resume the VM on restore, useful
    when restoring from the VMM command line without an API socket
    (#7857).
  • Snapshot/restore support for vhost-user devices has been filled
    out (#7908), including migration support for virtio-fs (#7937).
  • Vsock connections are now reset on snapshot restore to avoid stale
    half-open connections on the guest side (#7958).
  • The KVM clock is now restored before vCPUs are resumed (#7932),
    and notify_guest_clock_paused is called for Hyper-V guests
    (#7933), eliminating clock jumps observed after restore.
  • vhost-user devices receive a guest interrupt on resume so that
    in-flight I/O is not stalled across pause/resume (#7851), and
    activated queue eventfds are signaled on resume for all virtio
    devices (#8004).
  • UFFDIO_WAKE and UFFD_FEATURE_MISSING_HUGETLBFS are now handled
    correctly (#8016).

New Command-Line and API Options

  • --no-shutdown keeps the VMM process running when the guest
    triggers a shutdown. This is useful for higher-level management
    layers that need full control over the VMM process (#8025).
  • fw_cfg now supports inline string items via
    --fw-cfg name=...,string=..., matching QEMU's syntax (#7825).
  • A new per-zone mergeable option on --memory-zone lets KSM
    merging be controlled per memory zone instead of only globally
    (#7983).
  • Disk lock granularity is now configurable via --disk (#7763).
  • --cpus threads_per_core is now enforced to be at most two
    (#8078), matching the hardware constraint.
  • --log-format controls the log output format, complementing
    existing log-level controls (#8172). Wallclock log timestamps
    now use UTC (#8193).
  • The HTTP API now logs error responses (#8181), and the
    user_devices configuration is included in the OpenAPI spec
    (#8072).

MSHV Support Improvements

  • SVM_EXIT_CPUID, SVM_EXIT_MSR, and GHCB_MSR_TERM_REQ handlers
    have been added to the SEV-SNP exit path (#7934).
  • Guest MTRR MSRs are now preserved on KVM (#7944).
  • Nested-virtualization control fixes on AMD (#7783).

Deprecations

Auto-detection of disk image types is now deprecated and will be
removed in a future release. Specify the image type explicitly via
the --disk image_type=... CLI option or the image_type field
on DiskConfig in the HTTP/D-Bus API to avoid the deprecation
warning (#8219).

Notable Bug Fixes

  • Fix a guest-triggerable VMM panic via an out-of-bounds
    queue_select in the MSI-X vector access path on the virtio PCI
    common config (#7918).
  • Saturate instead of underflowing on a malformed balloon actual
    value reported by the guest (#7903).
  • IOMMU address translation now returns errors instead of panicking
    on malformed guest input (#8023).
  • Several virtio device error paths now reset queues instead of
    panicking or exiting the worker (#8128); additional device
    manager paths avoid guest-induced panics (#8186).
  • Virtio barriers are now sized from the number of queues actually
    activated by the guest, fixing pause hangs (#7881).
  • Spec compliance fixes for virtio device config layouts (#7805).
    and other small spec deviations (#8066). Console descriptor-chain
    processing has been fixed (#7802). dword writes to the MSI-X
    control register are now handled (#7956).
  • PCI segment ACPI _UID values now match the segment ID (#7992).
  • Fix VHDX multiqueue data corruption (#7746).
  • Fix block-device resize-disk (#7948) and the writeback-mode
    update flow (#7949).
  • Fix vdpa RX failure after device reset by always using base 0
    (#7964).
  • Fix rebooting with landlock and a pty console (#7911).
  • Reject rate limiting with vhost-user (#8135).
  • Fix a deadlock between CpuManager::pause() and MMIO writes to
    the ACPI CPU hotplug controller (#7990, #8092).
  • Cancel vhost-user reconnection if the device has been unplugged
    (#8182).
  • Remove the API socket path when start_vmm fails (#8018).
  • Add missing ID validation for the virtio-rng device (#9a46affc3).
  • Fix UB in MemoryRangeTable::read_from (#7828) and load_igvm()
    (#8129).
  • memory_actual_size reflects hot-plug state, removing a slow
    recomputation path (#7969).
  • DIO alignment is now queried directly from the underlying file
    rather than assumed (#7767).
  • QCOW2 metadata access is now thread-safe with num_queues > 1
    (#7744).
  • Block devices unconditionally assume sparse support, matching
    QEMU and avoiding a non-existent probe ioctl (#7757).
  • Multi-value CLI options now use .action(ArgAction::Append) so
    that repeating an option appends rather than replacing (#7778).
  • AIO completions are batched in next_completed_request for the
    block backend, reducing per-completion overhead (#7864).
  • Roll back the PCI BAR address on a failed move_bar so that an
    out-of-range MMIO address programmed by the guest leaves the
    device functional rather than crashing the VMM (#7950).
  • Fix O_DIRECT writes failing with EINVAL on the synchronous
    QCOW2 backend (#8012).
  • Fix O_DIRECT reads failing with EINVAL on the async io_uring
    QCOW2 read path (#8051).
  • Move QCOW2 compressed-cluster decompression out of the metadata
    lock, removing a bottleneck for compressed images (#8061).
  • Clamp the balloon's reported range to its region before
    processing unused pages (#8098).
  • Validate the requested balloon size against total guest RAM
    (#8116).
  • Reject --memory-zone configurations that set both mergeable
    and shared (#8126).
  • Disable sector 0 writes for autodetected VHD images (#8218).

Contributors

Many thanks to everyone who has contributed to our release:

Check out latest releases or
releases around cloud-hypervisor/cloud-hypervisor v52.0

Don't miss a new cloud-hypervisor release

NewReleases is sending notifications on new releases.

Get notifications