[PULL 0/9] Staging patches

[PULL 0/9] Staging patches

[Peter Xu]

The following changes since commit 5a5b06d2f6f71d7789719b97143fc5b543bec07a:

  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2025-11-20 08:12:59 +0100)

are available in the Git repository at:

  https://gitlab.com/peterx/qemu.git tags/staging-pull-request

for you to fetch changes up to 6aef825073a751215de1ed410a5c94efa675f5ca:

  tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend (2025-11-21 19:23:46 -0500)

----------------------------------------------------------------
Migration pull for rc2

- Zhijian's COLO regression fix (since 10.0)
- Matthew's fix to avoid crash on wrong list manipulations
- Markus's error report leak fix and cleanups
- Peter's qtest changes to merge memory_backend and use_shmem

----------------------------------------------------------------

Li Zhijian (1):
  migration: Fix transition to COLO state from precopy

Markus Armbruster (3):
  migration: Plug memory leaks after migrate_set_error()
  migration: Use warn_reportf_err() where appropriate
  migration/postcopy-ram: Improve error reporting after loadvm failure

Matthew Rosato (1):
  migration: set correct list pointer when removing notifier

Peter Xu (4):
  tests/migration-test: Introduce MemType
  tests/migration-test: Merge shmem_opts into memory_backend
  tests/migration-test: Add MEM_TYPE_SHMEM
  tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend

 tests/qtest/migration/framework.h  |  26 +++++--
 migration/cpr-exec.c               |   3 +-
 migration/migration.c              |   6 +-
 migration/multifd.c                |   6 +-
 migration/postcopy-ram.c           |  17 ++---
 tests/qtest/migration/cpr-tests.c  |   8 +-
 tests/qtest/migration/framework.c  | 113 ++++++++++++++++++++---------
 tests/qtest/migration/misc-tests.c |   2 +-
 8 files changed, 121 insertions(+), 60 deletions(-)

-- 
2.50.1

[PULL 1/9] migration: Fix transition to COLO state from precopy

[Peter Xu]

From: Li Zhijian <lizhijian@fujitsu.com>

Commit 4881411136 ("migration: Always set DEVICE state") set a new DEVICE
state before completed during migration, which broke the original transition
to COLO. The migration flow for precopy has changed to:
active -> pre-switchover -> device -> completed.

This patch updates the transition state to ensure that the Pre-COLO
state corresponds to DEVICE state correctly.

Cc: qemu-stable <qemu-stable@nongnu.org>
Fixes: 4881411136 ("migration: Always set DEVICE state")
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Tested-by: Zhang Chen <zhangckid@gmail.com>
Link: https://lore.kernel.org/r/20251104013606.1937764-1-lizhijian@fujitsu.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index c2daab6bdd..1b2c02d7fa 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3081,9 +3081,9 @@ static void migration_completion(MigrationState *s)
         goto fail;
     }
 
-    if (migrate_colo() && s->state == MIGRATION_STATUS_ACTIVE) {
+    if (migrate_colo() && s->state == MIGRATION_STATUS_DEVICE) {
         /* COLO does not support postcopy */
-        migrate_set_state(&s->state, MIGRATION_STATUS_ACTIVE,
+        migrate_set_state(&s->state, MIGRATION_STATUS_DEVICE,
                           MIGRATION_STATUS_COLO);
     } else {
         migration_completion_end(s);
-- 
2.50.1

[PULL 2/9] migration: set correct list pointer when removing notifier

[Peter Xu]

From: Matthew Rosato <mjrosato@linux.ibm.com>

In migration_remove_notifier(), g_slist_remove() will search for and
potentially remove an entry from the specified list.  The return value
should be used to update the potentially-changed head pointer of the
list that was just searched (migration_state_notifiers[mode]) instead
of the migration blockers list.

Fixes: dc79c7d5e1 ("migration: multi-mode notifier")
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/20251113213545.513453-1-mjrosato@linux.ibm.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/migration.c b/migration/migration.c
index 1b2c02d7fa..b316ee01ab 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1693,7 +1693,7 @@ void migration_remove_notifier(NotifierWithReturn *notify)
 {
     if (notify->notify) {
         for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
-            migration_blockers[mode] =
+            migration_state_notifiers[mode] =
                 g_slist_remove(migration_state_notifiers[mode], notify);
         }
         notify->notify = NULL;
-- 
2.50.1

[PULL 3/9] migration: Plug memory leaks after migrate_set_error()

[Peter Xu]

From: Markus Armbruster <armbru@redhat.com>

migrate_set_error(s, err) stores a copy of @err in @s.  The original
@err is not freed.  Most callers free it immediately.  Some callers
free it later, or pass it on.  And some leak it.  Fix those.

Perhaps migrate_set_error(s, err) should take ownership of @err.  The
callers that free it immediately would become simpler, and avoid a
copy and a deallocation.  The others would have to pass
error_copy(err).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20251115083500.2753895-2-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/cpr-exec.c | 3 ++-
 migration/multifd.c  | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
index d284f6e734..0b8344a86f 100644
--- a/migration/cpr-exec.c
+++ b/migration/cpr-exec.c
@@ -159,11 +159,12 @@ static void cpr_exec_cb(void *opaque)
     error_report_err(error_copy(err));
     migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
     migrate_set_error(s, err);
+    error_free(err);
+    err = NULL;
 
     /* Note, we can go from state COMPLETED to FAILED */
     migration_call_notifiers(s, MIG_EVENT_PRECOPY_FAILED, NULL);
 
-    err = NULL;
     if (!migration_block_activate(&err)) {
         /* error was already reported */
         error_free(err);
diff --git a/migration/multifd.c b/migration/multifd.c
index 98873cee74..a529c399e4 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -964,6 +964,7 @@ bool multifd_send_setup(void)
 
         if (!multifd_new_send_channel_create(p, &local_err)) {
             migrate_set_error(s, local_err);
+            error_free(local_err);
             ret = -1;
         }
     }
@@ -988,6 +989,7 @@ bool multifd_send_setup(void)
         ret = multifd_send_state->ops->send_setup(p, &local_err);
         if (ret) {
             migrate_set_error(s, local_err);
+            error_free(local_err);
             goto err;
         }
         assert(p->iov);
-- 
2.50.1

[PULL 4/9] migration: Use warn_reportf_err() where appropriate

[Peter Xu]

From: Markus Armbruster <armbru@redhat.com>

Replace

    warn_report("...: %s", ..., error_get_pretty(err));

by

    warn_reportf_err(err, "...: ", ...);

Prior art: commit 5217f1887a8 (error: Use error_reportf_err() where
appropriate).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251115083500.2753895-3-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index a529c399e4..6210454838 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -464,8 +464,8 @@ static void migration_ioc_shutdown_gracefully(QIOChannel *ioc)
          */
         migration_tls_channel_end(ioc, &local_err);
         if (local_err) {
-            warn_report("Failed to gracefully terminate TLS connection: %s",
-                        error_get_pretty(local_err));
+            warn_reportf_err(local_err,
+                        "Failed to gracefully terminate TLS connection: ");
         }
     }
 
-- 
2.50.1

[PULL 5/9] migration/postcopy-ram: Improve error reporting after loadvm failure

[Peter Xu]

From: Markus Armbruster <armbru@redhat.com>

One of two error messages show __func__.  Drop it; it doesn't help
users, and developers can grep for the message.  This also permits
de-duplicating the code to prepend to the error message.

Both error messages show a numeric error code.  I doubt that's
helpful, but I'm leaving it alone.

Use error_append_hint() for explaining that some dirty bitmaps may be
lost.  Polish the prose.

Don't faff around with g_clear_pointer(), it's not worth its keep
here.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251115083500.2753895-4-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 3f98dcb6fd..7c9fe61041 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2146,25 +2146,24 @@ static void *postcopy_listen_thread(void *opaque)
     if (load_res < 0) {
         qemu_file_set_error(f, load_res);
         dirty_bitmap_mig_cancel_incoming();
+        error_prepend(&local_err,
+                      "loadvm failed during postcopy: %d: ", load_res);
         if (postcopy_state_get() == POSTCOPY_INCOMING_RUNNING &&
             !migrate_postcopy_ram() && migrate_dirty_bitmaps())
         {
-            error_report("%s: loadvm failed during postcopy: %d: %s. All states "
-                         "are migrated except dirty bitmaps. Some dirty "
-                         "bitmaps may be lost, and present migrated dirty "
-                         "bitmaps are correctly migrated and valid.",
-                         __func__, load_res, error_get_pretty(local_err));
-            g_clear_pointer(&local_err, error_free);
+            error_append_hint(&local_err,
+                              "All state is migrated except dirty bitmaps."
+                              " Some dirty bitmaps may be lost, but any"
+                              " migrated dirty bitmaps are valid.");
+            error_report_err(local_err);
         } else {
             /*
              * Something went fatally wrong and we have a bad state, QEMU will
              * exit depending on if postcopy-exit-on-error is true, but the
              * migration cannot be recovered.
              */
-            error_prepend(&local_err,
-                          "loadvm failed during postcopy: %d: ", load_res);
             migrate_set_error(migr, local_err);
-            g_clear_pointer(&local_err, error_report_err);
+            error_report_err(local_err);
             migrate_set_state(&mis->state, mis->state, MIGRATION_STATUS_FAILED);
             goto out;
         }
-- 
2.50.1

[PULL 6/9] tests/migration-test: Introduce MemType

[Peter Xu]

Some migration tests need to be run with shmem, the rest by default use
anonymous memory.

Introduce MemType and replace use_shmem with such a enumeration.  This
prepares for a 3rd type of memory to be tested for migration.

Careful readers may also already notice that MigrateStart has another field
called memory_backend, which makes the whole "memory type" definition
convoluted.  That'll be merged into MemType soon in a follow up patch.

When doing this, introduce some migrate_mem_type_*() helpers to do the
work for each memory type.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.h  |  8 ++-
 tests/qtest/migration/cpr-tests.c  |  2 +-
 tests/qtest/migration/framework.c  | 81 ++++++++++++++++++++++--------
 tests/qtest/migration/misc-tests.c |  2 +-
 4 files changed, 68 insertions(+), 25 deletions(-)

diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 9bb584a6bb..70705725bc 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -18,6 +18,12 @@
 #define FILE_TEST_OFFSET 0x1000
 #define FILE_TEST_MARKER 'X'
 
+typedef enum {
+    MEM_TYPE_ANON,
+    MEM_TYPE_SHMEM,
+    MEM_TYPE_NUM,
+} MemType;
+
 typedef struct MigrationTestEnv {
     bool has_kvm;
     bool has_tcg;
@@ -102,7 +108,7 @@ typedef struct {
      * unconditionally, because it means the user would like to be verbose.
      */
     bool hide_stderr;
-    bool use_shmem;
+    MemType mem_type;
     /* only launch the source process */
     bool only_source;
     /* only launch the target process */
diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 9388ad64be..70f8e69633 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -32,7 +32,7 @@ static void test_mode_reboot(void)
     g_autofree char *uri = g_strdup_printf("file:%s/%s", tmpfs,
                                            FILE_TEST_FILENAME);
     MigrateCommon args = {
-        .start.use_shmem = true,
+        .start.mem_type = MEM_TYPE_SHMEM,
         .connect_uri = uri,
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_mode_reboot,
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index a9be9c2dbf..8fa39999a1 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -260,6 +260,25 @@ static char *test_shmem_path(void)
     return g_strdup_printf("/dev/shm/qemu-%d", getpid());
 }
 
+/* NOTE: caller is responsbile to free the string if returned */
+static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
+{
+    g_autofree char *shmem_path = NULL;
+    char *backend = NULL;
+
+    switch (type) {
+    case MEM_TYPE_SHMEM:
+        shmem_path = test_shmem_path();
+        backend = g_strdup_printf(
+            "-object memory-backend-file,id=mem0,size=%s"
+            ",mem-path=%s,share=on -numa node,memdev=mem0",
+            memory_size, shmem_path);
+        return backend;
+    default:
+        return NULL;
+    }
+}
+
 int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
 {
     /* options for source and target */
@@ -268,7 +287,6 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
     gchar *cmd_target = NULL;
     const gchar *ignore_stderr;
     g_autofree char *shmem_opts = NULL;
-    g_autofree char *shmem_path = NULL;
     const char *kvm_opts = NULL;
     const char *arch = qtest_get_arch();
     const char *memory_size;
@@ -332,13 +350,7 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
         ignore_stderr = "";
     }
 
-    if (args->use_shmem) {
-        shmem_path = test_shmem_path();
-        shmem_opts = g_strdup_printf(
-            "-object memory-backend-file,id=mem0,size=%s"
-            ",mem-path=%s,share=on -numa node,memdev=mem0",
-            memory_size, shmem_path);
-    }
+    shmem_opts = migrate_mem_type_get_opts(args->mem_type, memory_size);
 
     if (args->memory_backend) {
         memory_backend = g_strdup_printf(args->memory_backend, memory_size);
@@ -403,6 +415,42 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
     return 0;
 }
 
+static bool migrate_mem_type_prepare(MemType type)
+{
+    switch (type) {
+    case MEM_TYPE_SHMEM:
+        if (!g_file_test("/dev/shm", G_FILE_TEST_IS_DIR)) {
+            g_test_skip("/dev/shm is not supported");
+            return false;
+        }
+        break;
+    default:
+        break;
+    }
+
+    return true;
+}
+
+static void migrate_mem_type_cleanup(MemType type)
+{
+    g_autofree char *shmem_path = NULL;
+
+    switch (type) {
+    case MEM_TYPE_SHMEM:
+
+        /*
+         * Remove shmem file immediately to avoid memory leak in test
+         * failed case.  It's valid because QEMU has already opened this
+         * file
+         */
+        shmem_path = test_shmem_path();
+        unlink(shmem_path);
+        break;
+    default:
+        break;
+    }
+}
+
 int migrate_start(QTestState **from, QTestState **to, const char *uri,
                   MigrateStart *args)
 {
@@ -410,11 +458,8 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
     g_autofree gchar *cmd_target = NULL;
     g_autoptr(QList) capabilities = migrate_start_get_qmp_capabilities(args);
 
-    if (args->use_shmem) {
-        if (!g_file_test("/dev/shm", G_FILE_TEST_IS_DIR)) {
-            g_test_skip("/dev/shm is not supported");
-            return -1;
-        }
+    if (!migrate_mem_type_prepare(args->mem_type)) {
+        return -1;
     }
 
     dst_state = (QTestMigrationState) { };
@@ -441,15 +486,7 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                      &dst_state);
     }
 
-    /*
-     * Remove shmem file immediately to avoid memory leak in test failed case.
-     * It's valid because QEMU has already opened this file
-     */
-    if (args->use_shmem) {
-        g_autofree char *shmem_path = test_shmem_path();
-        unlink(shmem_path);
-    }
-
+    migrate_mem_type_cleanup(args->mem_type);
     migrate_start_set_capabilities(*from,
                                    args->only_source ? NULL : *to,
                                    args);
diff --git a/tests/qtest/migration/misc-tests.c b/tests/qtest/migration/misc-tests.c
index 54995256d8..20edaa51f5 100644
--- a/tests/qtest/migration/misc-tests.c
+++ b/tests/qtest/migration/misc-tests.c
@@ -97,7 +97,7 @@ static void test_ignore_shared(void)
     g_autofree char *uri = g_strdup_printf("unix:%s/migsocket", tmpfs);
     QTestState *from, *to;
     MigrateStart args = {
-        .use_shmem = true,
+        .mem_type = MEM_TYPE_SHMEM,
         .caps[MIGRATION_CAPABILITY_X_IGNORE_SHARED] = true,
     };
 
-- 
2.50.1

[PULL 7/9] tests/migration-test: Merge shmem_opts into memory_backend

[Peter Xu]

The two parameters are more or less duplicated in migrate_args().  They all
describe the memory type.  When one is used, the other is not.

mem_type currently uses numa parameter to specify the memory backend, while
memory_backend (the two users of such uses "-machine memory-backend=ID").

This patch merges the use of the two variables so that we always generate a
memory object string and put it into "memory_backend" variable.  Now we can
drop shmem_opts parameter in the function.

Meanwhile we always use a memory-backend-* no matter which mem type is
used.  This brings mem_type to be aligned with memory_backend usage, then
we stick with this as this is flexible enough.

This paves way that we merge mem_type and memory_backend in MigrateStart.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-3-peterx@redhat.com
[peterx: move MEM_TYPE_ANON case upper, per juraj]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.c | 41 ++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 15 deletions(-)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 8fa39999a1..7f325e4753 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -260,23 +260,36 @@ static char *test_shmem_path(void)
     return g_strdup_printf("/dev/shm/qemu-%d", getpid());
 }
 
+#define  MIG_MEM_ID  "mig.mem"
+
 /* NOTE: caller is responsbile to free the string if returned */
 static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
 {
     g_autofree char *shmem_path = NULL;
-    char *backend = NULL;
+    g_autofree char *backend = NULL;
+    bool share = true;
+    char *opts;
 
     switch (type) {
+    case MEM_TYPE_ANON:
+        backend = g_strdup("-object memory-backend-ram");
+        share = false;
+        break;
     case MEM_TYPE_SHMEM:
         shmem_path = test_shmem_path();
-        backend = g_strdup_printf(
-            "-object memory-backend-file,id=mem0,size=%s"
-            ",mem-path=%s,share=on -numa node,memdev=mem0",
-            memory_size, shmem_path);
-        return backend;
+        backend = g_strdup_printf("-object memory-backend-file,mem-path=%s",
+                                  shmem_path);
+        break;
     default:
-        return NULL;
+        g_assert_not_reached();
+        break;
     }
+
+    opts = g_strdup_printf("%s,id=%s,size=%s,share=%s",
+                           backend, MIG_MEM_ID, memory_size,
+                           share ? "on" : "off");
+
+    return opts;
 }
 
 int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
@@ -286,7 +299,7 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
     gchar *cmd_source = NULL;
     gchar *cmd_target = NULL;
     const gchar *ignore_stderr;
-    g_autofree char *shmem_opts = NULL;
+    g_autofree char *mem_object = NULL;
     const char *kvm_opts = NULL;
     const char *arch = qtest_get_arch();
     const char *memory_size;
@@ -350,12 +363,12 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
         ignore_stderr = "";
     }
 
-    shmem_opts = migrate_mem_type_get_opts(args->mem_type, memory_size);
-
     if (args->memory_backend) {
         memory_backend = g_strdup_printf(args->memory_backend, memory_size);
     } else {
-        memory_backend = g_strdup_printf("-m %s ", memory_size);
+        mem_object = migrate_mem_type_get_opts(args->mem_type, memory_size);
+        memory_backend = g_strdup_printf("-machine memory-backend=%s %s",
+                                         MIG_MEM_ID, mem_object);
     }
 
     if (args->use_dirty_ring) {
@@ -378,12 +391,11 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
                                  "-name source,debug-threads=on "
                                  "%s "
                                  "-serial file:%s/src_serial "
-                                 "%s %s %s %s",
+                                 "%s %s %s",
                                  kvm_opts ? kvm_opts : "",
                                  machine, machine_opts,
                                  memory_backend, tmpfs,
                                  arch_opts ? arch_opts : "",
-                                 shmem_opts ? shmem_opts : "",
                                  args->opts_source ? args->opts_source : "",
                                  ignore_stderr);
 
@@ -400,13 +412,12 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
                                  "%s "
                                  "-serial file:%s/dest_serial "
                                  "-incoming %s "
-                                 "%s %s %s %s %s",
+                                 "%s %s %s %s",
                                  kvm_opts ? kvm_opts : "",
                                  machine, machine_opts,
                                  memory_backend, tmpfs, uri,
                                  events,
                                  arch_opts ? arch_opts : "",
-                                 shmem_opts ? shmem_opts : "",
                                  args->opts_target ? args->opts_target : "",
                                  ignore_stderr);
 
-- 
2.50.1

[PULL 8/9] tests/migration-test: Add MEM_TYPE_SHMEM

[Peter Xu]

Add memfd support for mem_type.  Will be used to replace memory_backend.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.h | 13 +++++++++++++
 tests/qtest/migration/framework.c |  3 +++
 2 files changed, 16 insertions(+)

diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 70705725bc..9dec21c344 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -19,8 +19,21 @@
 #define FILE_TEST_MARKER 'X'
 
 typedef enum {
+    /*
+     * Use memory-backend-ram, private mappings
+     */
     MEM_TYPE_ANON,
+    /*
+     * Use shmem file (under /dev/shm), shared mappings
+     */
     MEM_TYPE_SHMEM,
+    /*
+     * Use anonymous memfd, shared mappings.
+     *
+     * NOTE: this is internally almost the same as MEM_TYPE_SHMEM on Linux,
+     * but only anonymously allocated.
+     */
+    MEM_TYPE_MEMFD,
     MEM_TYPE_NUM,
 } MemType;
 
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 7f325e4753..1c662f86a9 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -280,6 +280,9 @@ static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
         backend = g_strdup_printf("-object memory-backend-file,mem-path=%s",
                                   shmem_path);
         break;
+    case MEM_TYPE_MEMFD:
+        backend = g_strdup("-object memory-backend-memfd");
+        break;
     default:
         g_assert_not_reached();
         break;
-- 
2.50.1

[PULL 9/9] tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend

[Peter Xu]

The only two users of memory_backend as of now (cpr-exec, cpr-transfer)
uses memfd as backend, now we fully support it.  We can move memory_backend
usage to mem_type and drop it.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.h |  5 -----
 tests/qtest/migration/cpr-tests.c |  6 ++----
 tests/qtest/migration/framework.c | 10 +++-------
 3 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 9dec21c344..ed85ed502d 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -134,11 +134,6 @@ typedef struct {
     bool suspend_me;
     /* enable OOB QMP capability */
     bool oob;
-    /*
-     * Format string for the main memory backend, containing one %s where the
-     * size is plugged in.  If omitted, "-m %s" is used.
-     */
-    const char *memory_backend;
 
     /* Do not connect to target monitor and qtest sockets in qtest_init */
     bool defer_target_connect;
diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 70f8e69633..2a186c6f35 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -89,8 +89,7 @@ static void test_mode_transfer_common(bool incoming_defer)
         .start.opts_source = opts,
         .start.opts_target = opts_target,
         .start.defer_target_connect = true,
-        .start.memory_backend = "-object memory-backend-memfd,id=pc.ram,size=%s"
-                                " -machine memory-backend=pc.ram",
+        .start.mem_type = MEM_TYPE_MEMFD,
         .listen_uri = incoming_defer ? "defer" : uri,
         .connect_channels = connect_channels,
         .cpr_channel = cpr_channel,
@@ -235,8 +234,7 @@ static void test_mode_exec(void)
     MigrateCommon args = {
         .start.only_source = true,
         .start.opts_source = "-machine aux-ram-share=on -nodefaults",
-        .start.memory_backend = "-object memory-backend-memfd,id=pc.ram,size=%s"
-                                " -machine memory-backend=pc.ram",
+        .start.mem_type = MEM_TYPE_MEMFD,
         .connect_uri = uri,
         .listen_uri = listen_uri,
         .start_hook = test_mode_exec_start,
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 1c662f86a9..e35839c95f 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -366,13 +366,9 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
         ignore_stderr = "";
     }
 
-    if (args->memory_backend) {
-        memory_backend = g_strdup_printf(args->memory_backend, memory_size);
-    } else {
-        mem_object = migrate_mem_type_get_opts(args->mem_type, memory_size);
-        memory_backend = g_strdup_printf("-machine memory-backend=%s %s",
-                                         MIG_MEM_ID, mem_object);
-    }
+    mem_object = migrate_mem_type_get_opts(args->mem_type, memory_size);
+    memory_backend = g_strdup_printf("-machine memory-backend=%s %s",
+                                     MIG_MEM_ID, mem_object);
 
     if (args->use_dirty_ring) {
         kvm_opts = ",dirty-ring-size=4096";
-- 
2.50.1

Re: [PULL 0/9] Staging patches

[Richard Henderson]

On 11/21/25 16:26, Peter Xu wrote:
> The following changes since commit 5a5b06d2f6f71d7789719b97143fc5b543bec07a:
> 
>    Merge tag 'for-upstream' ofhttps://gitlab.com/bonzini/qemu into staging (2025-11-20 08:12:59 +0100)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/peterx/qemu.git tags/staging-pull-request
> 
> for you to fetch changes up to 6aef825073a751215de1ed410a5c94efa675f5ca:
> 
>    tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend (2025-11-21 19:23:46 -0500)
> 
> ----------------------------------------------------------------
> Migration pull for rc2
> 
> - Zhijian's COLO regression fix (since 10.0)
> - Matthew's fix to avoid crash on wrong list manipulations
> - Markus's error report leak fix and cleanups
> - Peter's qtest changes to merge memory_backend and use_shmem

Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.

r~

Re: [PULL 4/9] migration: Use warn_reportf_err() where appropriate

[Peter Maydell]

On Sat, 22 Nov 2025 at 02:02, Peter Xu <peterx@redhat.com> wrote:
>
> From: Markus Armbruster <armbru@redhat.com>
>
> Replace
>
>     warn_report("...: %s", ..., error_get_pretty(err));
>
> by
>
>     warn_reportf_err(err, "...: ", ...);
>
> Prior art: commit 5217f1887a8 (error: Use error_reportf_err() where
> appropriate).
>
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> Reviewed-by: Fabiano Rosas <farosas@suse.de>
> Link: https://lore.kernel.org/r/20251115083500.2753895-3-armbru@redhat.com
> Signed-off-by: Peter Xu <peterx@redhat.com>
> ---
>  migration/multifd.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/migration/multifd.c b/migration/multifd.c
> index a529c399e4..6210454838 100644
> --- a/migration/multifd.c
> +++ b/migration/multifd.c
> @@ -464,8 +464,8 @@ static void migration_ioc_shutdown_gracefully(QIOChannel *ioc)
>           */
>          migration_tls_channel_end(ioc, &local_err);
>          if (local_err) {
> -            warn_report("Failed to gracefully terminate TLS connection: %s",
> -                        error_get_pretty(local_err));
> +            warn_reportf_err(local_err,
> +                        "Failed to gracefully terminate TLS connection: ");
>          }
>      }

Hi; Coverity points out (CID 1643463) that this introduces a double-free
of local_err. In this function local_err is marked up as g_autoptr()
so it is automatically freed when it goes out of scope. This was needed
because error_get_pretty() doesn't free its argument. But
warn_reportf_err() *does* free its error argument, so now we free it twice.

Dropping the g_autoptr markup would be enough, I think.

The "prior art" commit 5217f1887a8 also seemed to introduce
some double-frees in hw/usb/dev-mtp.c, but it looks like we
fixed those in 562a55864 (but with a Fixes: tag that didn't
point at the commit that introduced them but at a different
blameless one).

thanks
-- PMM

Re: [PULL 4/9] migration: Use warn_reportf_err() where appropriate

[Markus Armbruster]

Peter Maydell <peter.maydell@linaro.org> writes:

> On Sat, 22 Nov 2025 at 02:02, Peter Xu <peterx@redhat.com> wrote:
>>
>> From: Markus Armbruster <armbru@redhat.com>
>>
>> Replace
>>
>>     warn_report("...: %s", ..., error_get_pretty(err));
>>
>> by
>>
>>     warn_reportf_err(err, "...: ", ...);
>>
>> Prior art: commit 5217f1887a8 (error: Use error_reportf_err() where
>> appropriate).
>>
>> Signed-off-by: Markus Armbruster <armbru@redhat.com>
>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>> Link: https://lore.kernel.org/r/20251115083500.2753895-3-armbru@redhat.com
>> Signed-off-by: Peter Xu <peterx@redhat.com>
>> ---
>>  migration/multifd.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/migration/multifd.c b/migration/multifd.c
>> index a529c399e4..6210454838 100644
>> --- a/migration/multifd.c
>> +++ b/migration/multifd.c
>> @@ -464,8 +464,8 @@ static void migration_ioc_shutdown_gracefully(QIOChannel *ioc)
>>           */
>>          migration_tls_channel_end(ioc, &local_err);
>>          if (local_err) {
>> -            warn_report("Failed to gracefully terminate TLS connection: %s",
>> -                        error_get_pretty(local_err));
>> +            warn_reportf_err(local_err,
>> +                        "Failed to gracefully terminate TLS connection: ");
>>          }
>>      }
>
> Hi; Coverity points out (CID 1643463) that this introduces a double-free
> of local_err. In this function local_err is marked up as g_autoptr()
> so it is automatically freed when it goes out of scope. This was needed
> because error_get_pretty() doesn't free its argument. But
> warn_reportf_err() *does* free its error argument, so now we free it twice.
>
> Dropping the g_autoptr markup would be enough, I think.

I'll take care of it.  Hand me the brown paper bag, please.

> The "prior art" commit 5217f1887a8 also seemed to introduce
> some double-frees in hw/usb/dev-mtp.c, but it looks like we
> fixed those in 562a55864 (but with a Fixes: tag that didn't
> point at the commit that introduced them but at a different
> blameless one).

You're right, it's the one that added the error_free(), which only
became wrong later.

I re-checked all of commit 5217f1887a8, and could not find lingering
double-frees.

Thanks!