[PATCH 0/7] debug: add PR_SET_VMA_ANON_NAME support

[PATCH 0/7] debug: add PR_SET_VMA_ANON_NAME support

[John Snow]

Add PR_SET_VMA_ANON_NAME support to name mmap'd regions of
memory. This is only supported on Linux >= 5.17, but allows QEMU to
communicate names for each VMA segment to linux, where they are
visible in /proc/$pid/[s]maps and utilities like pmap.

John Snow (7):
  debug/mem: add utility to name anonymous memory mappings
  debug/mem: add tracing to qemu_vname_vma()
  debug/mem: name <reserved> regions in mmap-alloc
  debug/mem: name pthreads
  debug/mem: name coroutine stacks
  debug/mem: name qemu_anon_ram_alloc/qemu_ram_mmap pages
  debug/mem: HACK add qemu_name_buffer

 meson.build                |  8 ++++
 include/qemu/bitmap.h      |  6 +++
 include/qemu/mmap-alloc.h  |  3 +-
 include/qemu/mmap-vma.h    | 21 +++++++++
 include/qemu/osdep.h       |  2 +-
 hw/core/loader.c           |  3 ++
 hw/display/virtio-gpu-gl.c |  2 +-
 hw/i386/x86-common.c       |  3 ++
 migration/ram.c            |  3 +-
 system/device_tree.c       |  2 +
 system/physmem.c           | 15 ++++--
 target/i386/kvm/tdx.c      |  3 +-
 util/mmap-alloc.c          | 17 +++++--
 util/mmap-vma.c            | 94 ++++++++++++++++++++++++++++++++++++++
 util/oslib-posix.c         |  7 ++-
 util/oslib-win32.c         |  2 +-
 util/qemu-thread-posix.c   | 34 ++++++++++++++
 util/meson.build           |  1 +
 util/trace-events          |  3 ++
 19 files changed, 213 insertions(+), 16 deletions(-)
 create mode 100644 include/qemu/mmap-vma.h
 create mode 100644 util/mmap-vma.c

-- 
2.56.0

[PATCH 1/7] debug/mem: add utility to name anonymous memory mappings

[John Snow]

Add support to name mmap'd memory regions using
PR_SET_VMA_ANON_NAME. On supported platforms, the QEMU utility
functions are no-ops.

This is useful primarily for debugging and profiling QEMU; beind able
to see and correlate each VMA segment with a specific use within QEMU.

Signed-off-by: John Snow <jsnow@redhat.com>
---
 include/qemu/mmap-vma.h | 18 +++++++++++
 util/mmap-vma.c         | 67 +++++++++++++++++++++++++++++++++++++++++
 util/meson.build        |  1 +
 3 files changed, 86 insertions(+)
 create mode 100644 include/qemu/mmap-vma.h
 create mode 100644 util/mmap-vma.c

diff --git a/include/qemu/mmap-vma.h b/include/qemu/mmap-vma.h
new file mode 100644
index 00000000000..763ea5a5cab
--- /dev/null
+++ b/include/qemu/mmap-vma.h
@@ -0,0 +1,18 @@
+/*
+ * Utility for naming VMA allocations in linux
+ *
+ * Copyright (c) Red Hat, Inc 2026
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+
+#ifndef __QEMU_MMAP_VMA_H
+#define __QEMU_MMAP_VMA_H
+
+#include <stddef.h>
+#include "osdep.h"
+
+int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
+    G_GNUC_PRINTF(3, 4);
+
+#endif
diff --git a/util/mmap-vma.c b/util/mmap-vma.c
new file mode 100644
index 00000000000..7dcef3b7455
--- /dev/null
+++ b/util/mmap-vma.c
@@ -0,0 +1,67 @@
+/*
+ * Utility for naming VMA allocations in linux
+ *
+ * Copyright (c) Red Hat, Inc 2026
+ *
+ * SPDX-License-Identifier: LGPL-2.1-or-later
+ */
+#include "qemu/mmap-vma.h"
+#include "qemu/osdep.h"
+
+#include <errno.h>
+#include <stddef.h>
+#include <stdio.h>
+
+#if defined(__linux__)
+#include <sys/prctl.h>
+#endif
+
+#define VMA_PREFIX " qemu: "
+#define VMA_MAXLEN 80
+
+/*
+ * Give a human-readable name to a previously mmap'd memory segment.
+ * This feature is only available on Linux >= 5.17, and only when the
+ * kernel was configured with CONFIG_ANON_VMA_NAME=y.
+ *
+ * For systems without this option, prctl() will return -1 and set
+ * errno to EINVAL, and can be safely ignored.
+ *
+ * For systems with this option, these human-readable names will be
+ * visible in /proc/$pid/[s]maps, pmap output, etc.
+ */
+G_GNUC_PRINTF(3, 0)
+static int qemu_vname_vma(void *ptr, size_t sz, const char *fmt, va_list args)
+{
+    int rc = 0;
+
+#if defined(PR_SET_VMA_ANON_NAME)
+    char strbuf[VMA_MAXLEN];
+
+    assert(sizeof(VMA_PREFIX) < sizeof(strbuf));
+    strncpy(strbuf, VMA_PREFIX, sizeof(strbuf));
+    rc = vsnprintf(strbuf + sizeof(VMA_PREFIX),
+                   sizeof(strbuf) - sizeof(VMA_PREFIX), fmt, args);
+    if (rc < 0) {
+        return -errno;
+    } else if (rc >= (sizeof(strbuf) - sizeof(VMA_PREFIX))) {
+        sprintf(strbuf + sizeof(strbuf) - 4, "...");
+    }
+
+    rc = prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ptr, sz, strbuf);
+    if (rc) {
+        return -errno;
+    }
+#endif
+
+    return rc;
+}
+
+G_GNUC_PRINTF(3, 4)
+int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
+{
+    va_list args;
+
+    va_start(args, fmt);
+    return qemu_vname_vma(ptr, sz, fmt, args);
+}
diff --git a/util/meson.build b/util/meson.build
index fa174c07a57..861ee228d5b 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -1,5 +1,6 @@
 util_ss.add(files('osdep.c', 'cutils.c', 'unicode.c', 'qemu-timer-common.c'))
 util_ss.add(files('thread-context.c'), numa)
+util_ss.add(files('mmap-vma.c'))
 if host_os != 'windows'
   util_ss.add(files('aio-posix.c'))
   util_ss.add(files('fdmon-poll.c'))
-- 
2.56.0

[PATCH 2/7] debug/mem: add tracing to qemu_vname_vma()

[John Snow]

Signed-off-by: John Snow <jsnow@redhat.com>
---
 util/mmap-vma.c   | 6 +++++-
 util/trace-events | 3 +++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/util/mmap-vma.c b/util/mmap-vma.c
index 7dcef3b7455..93ca7f608d7 100644
--- a/util/mmap-vma.c
+++ b/util/mmap-vma.c
@@ -7,6 +7,7 @@
  */
 #include "qemu/mmap-vma.h"
 #include "qemu/osdep.h"
+#include "trace.h"
 
 #include <errno.h>
 #include <stddef.h>
@@ -36,6 +37,7 @@ static int qemu_vname_vma(void *ptr, size_t sz, const char *fmt, va_list args)
     int rc = 0;
 
 #if defined(PR_SET_VMA_ANON_NAME)
+    int err;
     char strbuf[VMA_MAXLEN];
 
     assert(sizeof(VMA_PREFIX) < sizeof(strbuf));
@@ -49,8 +51,10 @@ static int qemu_vname_vma(void *ptr, size_t sz, const char *fmt, va_list args)
     }
 
     rc = prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ptr, sz, strbuf);
+    err = errno;
+    trace_qemu_vname_vma(strbuf, ptr, sz, rc, err);
     if (rc) {
-        return -errno;
+        return -err;
     }
 #endif
 
diff --git a/util/trace-events b/util/trace-events
index df549646d12..5ffc6cd205c 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -117,3 +117,6 @@ module_lookup_object_type(const char *name) "name %s"
 
 # datadir.c
 load_file(const char *name, const char *path) "name %s location %s"
+
+# mmap-vma.c
+qemu_vname_vma(const char *name, void *addr, size_t sz, int rc, int err) "name %s addr %p size %zu: rc %i errno %i"
-- 
2.56.0

[PATCH 3/7] debug/mem: name <reserved> regions in mmap-alloc

[John Snow]

For mmap memory reserved by QEMU, give it the name "<reserved>". This
will show up in maps output as "anon: qemu: <reserved>".

Signed-off-by: John Snow <jsnow@redhat.com>
---
 util/mmap-alloc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
index ed14f9c64de..2133b2c9bda 100644
--- a/util/mmap-alloc.c
+++ b/util/mmap-alloc.c
@@ -22,6 +22,7 @@
 #include "qemu/host-utils.h"
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
+#include "qemu/mmap-vma.h"
 
 #define HUGETLBFS_MAGIC       0x958458f6
 
@@ -152,6 +153,7 @@ static bool map_noreserve_effective(int fd, uint32_t qemu_map_flags)
 static void *mmap_reserve(size_t size, int fd)
 {
     int flags = MAP_PRIVATE;
+    void *ptr;
 
 #if defined(__powerpc64__) && defined(__linux__)
     /*
@@ -174,7 +176,10 @@ static void *mmap_reserve(size_t size, int fd)
     flags |= MAP_ANONYMOUS;
 #endif
 
-    return mmap(0, size, PROT_NONE, flags, fd, 0);
+    ptr = mmap(0, size, PROT_NONE, flags, fd, 0);
+    qemu_name_vma(ptr, size, "<reserved>");
+
+    return ptr;
 }
 
 /*
-- 
2.56.0

[PATCH 4/7] debug/mem: name pthreads

[John Snow]

Signed-off-by: John Snow <jsnow@redhat.com>
---
 meson.build              |  8 ++++++++
 util/qemu-thread-posix.c | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/meson.build b/meson.build
index d7bcb581c18..ef961df2f64 100644
--- a/meson.build
+++ b/meson.build
@@ -2878,7 +2878,15 @@ config_host_data.set('CONFIG_PTHREAD_GET_NAME_NP', cc.links(osdep_prefix + '''
     pthread_get_name_np(pthread_self(), buf, sizeof(buf));
     return 0;
   }''', dependencies: threads))
+config_host_data.set('CONFIG_PTHREAD_GETATTR_NP', cc.links(osdep_prefix + '''
+  #include <pthread.h>
 
+  int main(void)
+  {
+    pthread_attr_t attr;
+    pthread_getattr_np(pthread_self(), &attr);
+    return 0;
+  }''', dependencies: threads))
 config_host_data.set('CONFIG_PTHREAD_CONDATTR_SETCLOCK', cc.links(osdep_prefix + '''
   #include <pthread.h>
 
diff --git a/util/qemu-thread-posix.c b/util/qemu-thread-posix.c
index 089606c93fb..353fc1a4be5 100644
--- a/util/qemu-thread-posix.c
+++ b/util/qemu-thread-posix.c
@@ -17,6 +17,7 @@
 #include "qemu-thread-common.h"
 #include "qemu/tsan.h"
 #include "qemu/bitmap.h"
+#include "qemu/mmap-vma.h"
 
 #if defined(CONFIG_PTHREAD_SET_NAME_NP) || defined(CONFIG_PTHREAD_GET_NAME_NP)
 #include <pthread_np.h>
@@ -362,6 +363,13 @@ static void qemu_thread_atexit_notify(void *arg)
 
 void qemu_thread_set_name(const char *name)
 {
+# if defined(CONFIG_PTHREAD_GETATTR_NP)
+    pthread_attr_t real_attr;
+    void *pthread_addr;
+    size_t stacksize;
+    size_t guardsize;
+# endif
+
     /*
      * Attempt to set the thread name; note that this is for debug, so
      * we're not going to fail if we can't set it.
@@ -373,6 +381,32 @@ void qemu_thread_set_name(const char *name)
 # elif defined(CONFIG_PTHREAD_SET_NAME_NP)
     pthread_set_name_np(pthread_self(), name);
 # endif
+
+# if defined(CONFIG_PTHREAD_GETATTR_NP)
+    if (pthread_getattr_np(pthread_self(), &real_attr)) {
+        return;
+    }
+
+    if (pthread_attr_getguardsize(&real_attr, &guardsize)) {
+        goto cleanup;
+    }
+
+    if (pthread_attr_getguardsize(&real_attr, &guardsize)) {
+        goto cleanup;
+    }
+
+    if (pthread_attr_getstack(&real_attr, &pthread_addr, &stacksize)) {
+        goto cleanup;
+    }
+
+    /* Though there's a guard page, it isn't actually marked RO, so
+     * just label the entire region */
+    qemu_name_vma(pthread_addr - guardsize, stacksize + guardsize,
+                  "pthread (%s)", name);
+
+ cleanup:
+    pthread_attr_destroy(&real_attr);
+# endif
 }
 
 typedef struct {
-- 
2.56.0

[PATCH 5/7] debug/mem: name coroutine stacks

[John Snow]

Simple enough.

RFC: Is there a better name we can give these to help tell them apart
during analysis?

Signed-off-by: John Snow <jsnow@redhat.com>
---
 util/oslib-posix.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index dc001da66dd..454579c72df 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -60,6 +60,7 @@
 
 #include "qemu/memalign.h"
 #include "qemu/mmap-alloc.h"
+#include "qemu/mmap-vma.h"
 
 #define MAX_MEM_PREALLOC_THREAD_COUNT 32
 
@@ -742,6 +743,8 @@ void *qemu_alloc_stack(size_t *sz)
         abort();
     }
 
+    qemu_name_vma(ptr, *sz, "coroutine-stack");
+
     /* Stack grows down -- guard page at the bottom. */
     if (mprotect(ptr, pagesz, PROT_NONE) != 0) {
         perror("failed to set up stack guard page");
-- 
2.56.0

[PATCH 6/7] debug/mem: name qemu_anon_ram_alloc/qemu_ram_mmap pages

[John Snow]

This patch adds a nickname parameter to qemu_anon_ram_alloc, which
passes it to qemu_ram_mmap, which passes it in turn to mmap_activate,
where it is used to name the region being allocated.

Signed-off-by: John Snow <jsnow@redhat.com>
---
 include/qemu/mmap-alloc.h  |  3 ++-
 include/qemu/osdep.h       |  2 +-
 hw/display/virtio-gpu-gl.c |  2 +-
 migration/ram.c            |  3 ++-
 system/physmem.c           |  7 +++++--
 target/i386/kvm/tdx.c      |  3 ++-
 util/mmap-alloc.c          | 10 +++++++---
 util/oslib-posix.c         |  4 ++--
 util/oslib-win32.c         |  2 +-
 9 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/include/qemu/mmap-alloc.h b/include/qemu/mmap-alloc.h
index 8344daaa03f..c34587179b6 100644
--- a/include/qemu/mmap-alloc.h
+++ b/include/qemu/mmap-alloc.h
@@ -36,7 +36,8 @@ void *qemu_ram_mmap(int fd,
                     size_t size,
                     size_t align,
                     uint32_t qemu_map_flags,
-                    off_t map_offset);
+                    off_t map_offset,
+                    const char *nickname);
 
 void qemu_ram_munmap(int fd, void *ptr, size_t size);
 
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index b27d159d5bb..5e712ff1c6c 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -552,7 +552,7 @@ void QEMU_ERROR("code path is reachable")
 
 int qemu_daemon(int nochdir, int noclose);
 void *qemu_anon_ram_alloc(size_t size, uint64_t *align, bool shared,
-                          bool noreserve);
+                          bool noreserve, const char *nickname);
 void qemu_anon_ram_free(void *ptr, size_t size);
 int qemu_shm_alloc(size_t size, Error **errp);
 
diff --git a/hw/display/virtio-gpu-gl.c b/hw/display/virtio-gpu-gl.c
index 2b7a41c4664..66c302315c5 100644
--- a/hw/display/virtio-gpu-gl.c
+++ b/hw/display/virtio-gpu-gl.c
@@ -145,7 +145,7 @@ static void virtio_gpu_gl_device_realize(DeviceState *qdev, Error **errp)
 #if !defined(CONFIG_WIN32)
     if (virtio_gpu_hostmem_enabled(b->conf)) {
         map = qemu_ram_mmap(-1, b->conf.hostmem, qemu_real_host_page_size(),
-                            0, 0);
+                            0, 0, "virgl-hostmem");
         if (map == MAP_FAILED) {
             error_setg_errno(errp, errno,
                              "virgl hostmem region could not be initialized");
diff --git a/migration/ram.c b/migration/ram.c
index e6db3bf5238..c48e05078d1 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3720,7 +3720,8 @@ int colo_init_ram_cache(Error **errp)
     WITH_RCU_READ_LOCK_GUARD() {
         RAMBLOCK_FOREACH_NOT_IGNORED(block) {
             block->colo_cache = qemu_anon_ram_alloc(block->used_length,
-                                                    NULL, false, false);
+                                                    NULL, false, false,
+                                                    "colo cache");
             if (!block->colo_cache) {
                 error_setg(errp, "Can't alloc memory for COLO cache of "
                            "block %s, size 0x" RAM_ADDR_FMT,
diff --git a/system/physmem.c b/system/physmem.c
index a7300bb9d97..202e3a5cd00 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1767,7 +1767,8 @@ static void *file_ram_alloc(RAMBlock *block,
     qemu_map_flags |= (block->flags & RAM_SHARED) ? QEMU_MAP_SHARED : 0;
     qemu_map_flags |= (block->flags & RAM_PMEM) ? QEMU_MAP_SYNC : 0;
     qemu_map_flags |= (block->flags & RAM_NORESERVE) ? QEMU_MAP_NORESERVE : 0;
-    area = qemu_ram_mmap(fd, memory, block->mr->align, qemu_map_flags, offset);
+    area = qemu_ram_mmap(fd, memory, block->mr->align, qemu_map_flags, offset,
+                         "file_ram_alloc");
     if (area == MAP_FAILED) {
         error_setg_errno(errp, errno,
                          "unable to map backing store for guest RAM");
@@ -2169,7 +2170,9 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
         } else {
             new_block->host = qemu_anon_ram_alloc(new_block->max_length,
                                                   &new_block->mr->align,
-                                                  shared, noreserve);
+                                                  shared, noreserve,
+                                                  new_block->mr->name);
+
             if (!new_block->host) {
                 g_autofree char *size_s = size_to_str(new_block->max_length);
                 error_setg_errno(errp, errno,
diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 52bb2ec6ced..e4d589fc950 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -354,7 +354,8 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
         case TDVF_SECTION_TYPE_TD_HOB:
         case TDVF_SECTION_TYPE_TEMP_MEM:
             entry->mem_ptr = qemu_ram_mmap(-1, entry->size,
-                                           qemu_real_host_page_size(), 0, 0);
+                                           qemu_real_host_page_size(), 0, 0,
+                                           "tdx");
             if (entry->mem_ptr == MAP_FAILED) {
                 error_report("Failed to mmap memory for TDVF section %d",
                              entry->type);
diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
index 2133b2c9bda..f0b903dfdbe 100644
--- a/util/mmap-alloc.c
+++ b/util/mmap-alloc.c
@@ -187,7 +187,8 @@ static void *mmap_reserve(size_t size, int fd)
  * it accessible.
  */
 static void *mmap_activate(void *ptr, size_t size, int fd,
-                           uint32_t qemu_map_flags, off_t map_offset)
+                           uint32_t qemu_map_flags, off_t map_offset,
+                           const char *nickname)
 {
     const bool noreserve = qemu_map_flags & QEMU_MAP_NORESERVE;
     const bool readonly = qemu_map_flags & QEMU_MAP_READONLY;
@@ -236,6 +237,8 @@ static void *mmap_activate(void *ptr, size_t size, int fd,
          */
         activated_ptr = mmap(ptr, size, prot, flags, fd, map_offset);
     }
+
+    qemu_name_vma(ptr, size, "%s", nickname);
     return activated_ptr;
 }
 
@@ -253,7 +256,8 @@ void *qemu_ram_mmap(int fd,
                     size_t size,
                     size_t align,
                     uint32_t qemu_map_flags,
-                    off_t map_offset)
+                    off_t map_offset,
+                    const char *nickname)
 {
     const size_t guard_pagesize = mmap_guard_pagesize(fd);
     size_t offset, total;
@@ -277,7 +281,7 @@ void *qemu_ram_mmap(int fd,
     offset = QEMU_ALIGN_UP((uintptr_t)guardptr, align) - (uintptr_t)guardptr;
 
     ptr = mmap_activate(guardptr + offset, size, fd, qemu_map_flags,
-                        map_offset);
+                        map_offset, nickname);
     if (ptr == MAP_FAILED) {
         munmap(guardptr, total);
         return MAP_FAILED;
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 454579c72df..ba3ebb52eb5 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -207,13 +207,13 @@ fail_close:
 
 /* alloc shared memory pages */
 void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment, bool shared,
-                          bool noreserve)
+                          bool noreserve, const char *nickname)
 {
     const uint32_t qemu_map_flags = (shared ? QEMU_MAP_SHARED : 0) |
                                     (noreserve ? QEMU_MAP_NORESERVE : 0);
     size_t align = QEMU_VMALLOC_ALIGN;
 #ifndef EMSCRIPTEN
-    void *ptr = qemu_ram_mmap(-1, size, align, qemu_map_flags, 0);
+    void *ptr = qemu_ram_mmap(-1, size, align, qemu_map_flags, 0, nickname);
 
     if (ptr == MAP_FAILED) {
         return NULL;
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 5f3e8f4d980..52c6335995c 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -45,7 +45,7 @@ static int get_allocation_granularity(void)
 }
 
 void *qemu_anon_ram_alloc(size_t size, uint64_t *align, bool shared,
-                          bool noreserve)
+                          bool noreserve, const char *nickname)
 {
     void *ptr;
 
-- 
2.56.0

[PATCH 7/7] debug/mem: HACK add qemu_name_buffer

[John Snow]

This is a hack to allow us to name malloc'd buffers that are backed by
anonymous mmap allocations.

Quite useful in my debugging, probably not quite appropriate for
upstream unless we can figure out a more robust method for identifying
when we get an mmap'd page from malloc and adjusting the pointer
offset accordingly - I am currently subtracting a fixed 16 bytes
because that "works on my system", and I have no clue if that's
appropriate everywhere or not.

At least this way, my trick is published to the list for posterity.

Signed-off-by: John Snow <jsnow@redhat.com>
---
 include/qemu/bitmap.h   |  6 ++++++
 include/qemu/mmap-vma.h |  3 +++
 hw/core/loader.c        |  3 +++
 hw/i386/x86-common.c    |  3 +++
 system/device_tree.c    |  2 ++
 system/physmem.c        |  8 ++++++--
 util/mmap-vma.c         | 23 +++++++++++++++++++++++
 7 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/include/qemu/bitmap.h b/include/qemu/bitmap.h
index 0044333cb51..6681c87737f 100644
--- a/include/qemu/bitmap.h
+++ b/include/qemu/bitmap.h
@@ -104,6 +104,12 @@ static inline unsigned long *bitmap_try_new(long nbits)
     return g_try_new0(unsigned long, nelem);
 }
 
+static inline size_t bitmap_size(long nbits)
+{
+    long nelem = BITS_TO_LONGS(nbits);
+    return sizeof(unsigned long) * nelem;
+}
+
 static inline unsigned long *bitmap_new(long nbits)
 {
     long nelem = BITS_TO_LONGS(nbits);
diff --git a/include/qemu/mmap-vma.h b/include/qemu/mmap-vma.h
index 763ea5a5cab..4646657022c 100644
--- a/include/qemu/mmap-vma.h
+++ b/include/qemu/mmap-vma.h
@@ -15,4 +15,7 @@
 int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
     G_GNUC_PRINTF(3, 4);
 
+int qemu_name_buffer(void *ptr, size_t sz, const char *fmt, ...)
+    G_GNUC_PRINTF(3, 4);
+
 #endif
diff --git a/hw/core/loader.c b/hw/core/loader.c
index 5cbfba0a86d..cc0e0d6979a 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -45,6 +45,7 @@
 #include "qemu/osdep.h"
 #include "qemu/datadir.h"
 #include "qemu/error-report.h"
+#include "qemu/mmap-vma.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine.h"
 #include "qapi/type-helpers.h"
@@ -1111,6 +1112,8 @@ ssize_t rom_add_file(const char *file, const char *fw_dir,
         goto err;
     }
 
+    qemu_name_buffer(rom->data, size, "%s", file);
+
     if (fw_dir) {
         rom->fw_dir  = g_strdup(fw_dir);
         rom->fw_file = g_strdup(file);
diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index dcd4fa8eb79..608c4cf4202 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -25,6 +25,7 @@
 #include "qemu/cutils.h"
 #include "qemu/units.h"
 #include "qemu/datadir.h"
+#include "qemu/mmap-vma.h"
 #include "qapi/error.h"
 #include "system/numa.h"
 #include "system/system.h"
@@ -914,6 +915,8 @@ void x86_load_linux(X86MachineState *x86ms,
 
     setup  = g_malloc(setup_size);
     kernel = g_malloc(kernel_size);
+    qemu_name_buffer(kernel, kernel_size, "%s", kernel_filename);
+
     fseek(f, 0, SEEK_SET);
     if (fread(setup, 1, setup_size, f) != setup_size) {
         fprintf(stderr, "fread() failed\n");
diff --git a/system/device_tree.c b/system/device_tree.c
index 48365435ea0..816874fb299 100644
--- a/system/device_tree.c
+++ b/system/device_tree.c
@@ -27,6 +27,7 @@
 #include "hw/core/loader.h"
 #include "hw/core/boards.h"
 #include "qemu/config-file.h"
+#include "qemu/mmap-vma.h"
 #include "qapi/qapi-commands-machine.h"
 #include "qobject/qdict.h"
 
@@ -41,6 +42,7 @@ void *create_device_tree(int *sizep)
 
     *sizep = FDT_MAX_SIZE;
     fdt = g_malloc0(FDT_MAX_SIZE);
+    qemu_name_buffer(fdt, FDT_MAX_SIZE, "device_tree");
     ret = fdt_create(fdt, FDT_MAX_SIZE);
     if (ret < 0) {
         goto fail;
diff --git a/system/physmem.c b/system/physmem.c
index 202e3a5cd00..dc0e9540919 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -26,6 +26,7 @@
 #include "qemu/hbitmap.h"
 #include "qemu/madvise.h"
 #include "qemu/lockable.h"
+#include "qemu/mmap-vma.h"
 
 #ifdef CONFIG_TCG
 #include "accel/tcg/cpu-ops.h"
@@ -2105,7 +2106,7 @@ void qemu_ram_msync(RAMBlock *block, ram_addr_t start, ram_addr_t length)
 }
 
 /* Called with ram_list.mutex held */
-static void dirty_memory_extend(ram_addr_t new_ram_size)
+static void dirty_memory_extend(ram_addr_t new_ram_size, const char *nickname)
 {
     unsigned int old_num_blocks = ram_list.num_dirty_blocks;
     unsigned int new_num_blocks = DIV_ROUND_UP(new_ram_size,
@@ -2133,6 +2134,9 @@ static void dirty_memory_extend(ram_addr_t new_ram_size)
 
         for (j = old_num_blocks; j < new_num_blocks; j++) {
             new_blocks->blocks[j] = bitmap_new(DIRTY_MEMORY_BLOCK_SIZE);
+            qemu_name_buffer(new_blocks->blocks[j],
+                             bitmap_size(DIRTY_MEMORY_BLOCK_SIZE),
+                             "bitmap<%s>", nickname);
         }
 
         qatomic_rcu_set(&ram_list.dirty_memory[i], new_blocks);
@@ -2254,7 +2258,7 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
     }
 
     ram_size = (new_block->offset + new_block->max_length) >> TARGET_PAGE_BITS;
-    dirty_memory_extend(ram_size);
+    dirty_memory_extend(ram_size, new_block->mr->name);
     /* Keep the list sorted from biggest to smallest block.  Unlike QTAILQ,
      * QLIST (which has an RCU-friendly variant) does not have insertion at
      * tail, so save the last element in last_block.
diff --git a/util/mmap-vma.c b/util/mmap-vma.c
index 93ca7f608d7..9b1309df635 100644
--- a/util/mmap-vma.c
+++ b/util/mmap-vma.c
@@ -69,3 +69,26 @@ int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
     va_start(args, fmt);
     return qemu_vname_vma(ptr, sz, fmt, args);
 }
+
+G_GNUC_PRINTF(3, 4)
+int qemu_name_buffer(void *ptr, size_t sz, const char *fmt, ...)
+{
+    /*
+     * this is hacky as hell, but ptmalloc will occasionally use
+     * mmap() for large buffers - when it does so, you get a pointer
+     * to 16 bytes after the actual mmap. This function compensates
+     * for that to guess at what the real mmap allocation was.
+     *
+     * This can be used unconditionally whether or not the allocation
+     * was actually mmap'd - if it wasn't, this just fails. Yes, it's
+     * still very ugly.
+     */
+    va_list args;
+    size_t pagesz = qemu_real_host_page_size();
+
+    ptr = ptr - 0x10;
+    sz = ROUND_UP(sz + 0x10, pagesz);
+
+    va_start(args, fmt);
+    return qemu_vname_vma(ptr, sz, fmt, args);
+}
-- 
2.56.0

Re: [PATCH 1/7] debug/mem: add utility to name anonymous memory mappings

[Daniel P. Berrangé]

On Mon, Nov 09, 2026 at 01:59:01PM -0500, John Snow wrote:
> Add support to name mmap'd memory regions using
> PR_SET_VMA_ANON_NAME. On supported platforms, the QEMU utility
> functions are no-ops.
> 
> This is useful primarily for debugging and profiling QEMU; beind able
> to see and correlate each VMA segment with a specific use within QEMU.
> 
> Signed-off-by: John Snow <jsnow@redhat.com>
> ---
>  include/qemu/mmap-vma.h | 18 +++++++++++
>  util/mmap-vma.c         | 67 +++++++++++++++++++++++++++++++++++++++++
>  util/meson.build        |  1 +
>  3 files changed, 86 insertions(+)
>  create mode 100644 include/qemu/mmap-vma.h
>  create mode 100644 util/mmap-vma.c
> 
> diff --git a/include/qemu/mmap-vma.h b/include/qemu/mmap-vma.h
> new file mode 100644
> index 00000000000..763ea5a5cab
> --- /dev/null
> +++ b/include/qemu/mmap-vma.h
> @@ -0,0 +1,18 @@
> +/*
> + * Utility for naming VMA allocations in linux
> + *
> + * Copyright (c) Red Hat, Inc 2026
> + *
> + * SPDX-License-Identifier: LGPL-2.1-or-later
> + */
> +
> +#ifndef __QEMU_MMAP_VMA_H
> +#define __QEMU_MMAP_VMA_H
> +
> +#include <stddef.h>
> +#include "osdep.h"
> +
> +int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
> +    G_GNUC_PRINTF(3, 4);
> +
> +#endif
> diff --git a/util/mmap-vma.c b/util/mmap-vma.c
> new file mode 100644
> index 00000000000..7dcef3b7455
> --- /dev/null
> +++ b/util/mmap-vma.c
> @@ -0,0 +1,67 @@
> +/*
> + * Utility for naming VMA allocations in linux
> + *
> + * Copyright (c) Red Hat, Inc 2026
> + *
> + * SPDX-License-Identifier: LGPL-2.1-or-later
> + */
> +#include "qemu/mmap-vma.h"
> +#include "qemu/osdep.h"
> +
> +#include <errno.h>
> +#include <stddef.h>
> +#include <stdio.h>
> +
> +#if defined(__linux__)
> +#include <sys/prctl.h>
> +#endif
> +
> +#define VMA_PREFIX " qemu: "
> +#define VMA_MAXLEN 80
> +
> +/*
> + * Give a human-readable name to a previously mmap'd memory segment.
> + * This feature is only available on Linux >= 5.17, and only when the
> + * kernel was configured with CONFIG_ANON_VMA_NAME=y.
> + *
> + * For systems without this option, prctl() will return -1 and set
> + * errno to EINVAL, and can be safely ignored.
> + *
> + * For systems with this option, these human-readable names will be
> + * visible in /proc/$pid/[s]maps, pmap output, etc.
> + */
> +G_GNUC_PRINTF(3, 0)
> +static int qemu_vname_vma(void *ptr, size_t sz, const char *fmt, va_list args)
> +{
> +    int rc = 0;
> +
> +#if defined(PR_SET_VMA_ANON_NAME)
> +    char strbuf[VMA_MAXLEN];
> +
> +    assert(sizeof(VMA_PREFIX) < sizeof(strbuf));
> +    strncpy(strbuf, VMA_PREFIX, sizeof(strbuf));
> +    rc = vsnprintf(strbuf + sizeof(VMA_PREFIX),
> +                   sizeof(strbuf) - sizeof(VMA_PREFIX), fmt, args);
> +    if (rc < 0) {
> +        return -errno;
> +    } else if (rc >= (sizeof(strbuf) - sizeof(VMA_PREFIX))) {
> +        sprintf(strbuf + sizeof(strbuf) - 4, "...");
> +    }
> +
> +    rc = prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ptr, sz, strbuf);
> +    if (rc) {
> +        return -errno;
> +    }
> +#endif
> +
> +    return rc;
> +}
> +
> +G_GNUC_PRINTF(3, 4)
> +int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
> +{
> +    va_list args;
> +
> +    va_start(args, fmt);
> +    return qemu_vname_vma(ptr, sz, fmt, args);

We need a va_end here too.

> +}
> diff --git a/util/meson.build b/util/meson.build
> index fa174c07a57..861ee228d5b 100644
> --- a/util/meson.build
> +++ b/util/meson.build
> @@ -1,5 +1,6 @@
>  util_ss.add(files('osdep.c', 'cutils.c', 'unicode.c', 'qemu-timer-common.c'))
>  util_ss.add(files('thread-context.c'), numa)
> +util_ss.add(files('mmap-vma.c'))
>  if host_os != 'windows'
>    util_ss.add(files('aio-posix.c'))
>    util_ss.add(files('fdmon-poll.c'))
> -- 
> 2.56.0
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 2/7] debug/mem: add tracing to qemu_vname_vma()

[Daniel P. Berrangé]

On Mon, Nov 09, 2026 at 01:59:02PM -0500, John Snow wrote:
> Signed-off-by: John Snow <jsnow@redhat.com>
> ---
>  util/mmap-vma.c   | 6 +++++-
>  util/trace-events | 3 +++
>  2 files changed, 8 insertions(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 3/7] debug/mem: name <reserved> regions in mmap-alloc

[Daniel P. Berrangé]

On Mon, Nov 09, 2026 at 01:59:03PM -0500, John Snow wrote:
> For mmap memory reserved by QEMU, give it the name "<reserved>". This
> will show up in maps output as "anon: qemu: <reserved>".
> 
> Signed-off-by: John Snow <jsnow@redhat.com>
> ---
>  util/mmap-alloc.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 5/7] debug/mem: name coroutine stacks

[Daniel P. Berrangé]

On Mon, Nov 09, 2026 at 01:59:05PM -0500, John Snow wrote:
> Simple enough.
> 
> RFC: Is there a better name we can give these to help tell them apart
> during analysis?

We would have to give a name to each coroutine, and then pass
it into qemu_alloc_stack. Would probably be fairly useful thing
todo as we use coroutines for lots of different things and by
way of comparison we give threads useful names too.

> 
> Signed-off-by: John Snow <jsnow@redhat.com>
> ---
>  util/oslib-posix.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/util/oslib-posix.c b/util/oslib-posix.c
> index dc001da66dd..454579c72df 100644
> --- a/util/oslib-posix.c
> +++ b/util/oslib-posix.c
> @@ -60,6 +60,7 @@
>  
>  #include "qemu/memalign.h"
>  #include "qemu/mmap-alloc.h"
> +#include "qemu/mmap-vma.h"
>  
>  #define MAX_MEM_PREALLOC_THREAD_COUNT 32
>  
> @@ -742,6 +743,8 @@ void *qemu_alloc_stack(size_t *sz)
>          abort();
>      }
>  
> +    qemu_name_vma(ptr, *sz, "coroutine-stack");
> +
>      /* Stack grows down -- guard page at the bottom. */
>      if (mprotect(ptr, pagesz, PROT_NONE) != 0) {
>          perror("failed to set up stack guard page");
> -- 
> 2.56.0
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 6/7] debug/mem: name qemu_anon_ram_alloc/qemu_ram_mmap pages

[Daniel P. Berrangé]

On Mon, Nov 09, 2026 at 01:59:06PM -0500, John Snow wrote:
> This patch adds a nickname parameter to qemu_anon_ram_alloc, which
> passes it to qemu_ram_mmap, which passes it in turn to mmap_activate,
> where it is used to name the region being allocated.
> 
> Signed-off-by: John Snow <jsnow@redhat.com>
> ---
>  include/qemu/mmap-alloc.h  |  3 ++-
>  include/qemu/osdep.h       |  2 +-
>  hw/display/virtio-gpu-gl.c |  2 +-
>  migration/ram.c            |  3 ++-
>  system/physmem.c           |  7 +++++--
>  target/i386/kvm/tdx.c      |  3 ++-
>  util/mmap-alloc.c          | 10 +++++++---
>  util/oslib-posix.c         |  4 ++--
>  util/oslib-win32.c         |  2 +-
>  9 files changed, 23 insertions(+), 13 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 1/7] debug/mem: add utility to name anonymous memory mappings

[John Snow]

On Mon, Nov 9, 2026 at 2:29 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> On Mon, Nov 09, 2026 at 01:59:01PM -0500, John Snow wrote:
> > Add support to name mmap'd memory regions using
> > PR_SET_VMA_ANON_NAME. On supported platforms, the QEMU utility
> > functions are no-ops.
> >
> > This is useful primarily for debugging and profiling QEMU; beind able
> > to see and correlate each VMA segment with a specific use within QEMU.
> >
> > Signed-off-by: John Snow <jsnow@redhat.com>
> > ---
> >  include/qemu/mmap-vma.h | 18 +++++++++++
> >  util/mmap-vma.c         | 67 +++++++++++++++++++++++++++++++++++++++++
> >  util/meson.build        |  1 +
> >  3 files changed, 86 insertions(+)
> >  create mode 100644 include/qemu/mmap-vma.h
> >  create mode 100644 util/mmap-vma.c
> >
> > diff --git a/include/qemu/mmap-vma.h b/include/qemu/mmap-vma.h
> > new file mode 100644
> > index 00000000000..763ea5a5cab
> > --- /dev/null
> > +++ b/include/qemu/mmap-vma.h
> > @@ -0,0 +1,18 @@
> > +/*
> > + * Utility for naming VMA allocations in linux
> > + *
> > + * Copyright (c) Red Hat, Inc 2026
> > + *
> > + * SPDX-License-Identifier: LGPL-2.1-or-later
> > + */
> > +
> > +#ifndef __QEMU_MMAP_VMA_H
> > +#define __QEMU_MMAP_VMA_H
> > +
> > +#include <stddef.h>
> > +#include "osdep.h"
> > +
> > +int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
> > +    G_GNUC_PRINTF(3, 4);
> > +
> > +#endif
> > diff --git a/util/mmap-vma.c b/util/mmap-vma.c
> > new file mode 100644
> > index 00000000000..7dcef3b7455
> > --- /dev/null
> > +++ b/util/mmap-vma.c
> > @@ -0,0 +1,67 @@
> > +/*
> > + * Utility for naming VMA allocations in linux
> > + *
> > + * Copyright (c) Red Hat, Inc 2026
> > + *
> > + * SPDX-License-Identifier: LGPL-2.1-or-later
> > + */
> > +#include "qemu/mmap-vma.h"
> > +#include "qemu/osdep.h"
> > +
> > +#include <errno.h>
> > +#include <stddef.h>
> > +#include <stdio.h>
> > +
> > +#if defined(__linux__)
> > +#include <sys/prctl.h>
> > +#endif
> > +
> > +#define VMA_PREFIX " qemu: "
> > +#define VMA_MAXLEN 80
> > +
> > +/*
> > + * Give a human-readable name to a previously mmap'd memory segment.
> > + * This feature is only available on Linux >= 5.17, and only when the
> > + * kernel was configured with CONFIG_ANON_VMA_NAME=y.
> > + *
> > + * For systems without this option, prctl() will return -1 and set
> > + * errno to EINVAL, and can be safely ignored.
> > + *
> > + * For systems with this option, these human-readable names will be
> > + * visible in /proc/$pid/[s]maps, pmap output, etc.
> > + */
> > +G_GNUC_PRINTF(3, 0)
> > +static int qemu_vname_vma(void *ptr, size_t sz, const char *fmt, va_list args)
> > +{
> > +    int rc = 0;
> > +
> > +#if defined(PR_SET_VMA_ANON_NAME)
> > +    char strbuf[VMA_MAXLEN];
> > +
> > +    assert(sizeof(VMA_PREFIX) < sizeof(strbuf));
> > +    strncpy(strbuf, VMA_PREFIX, sizeof(strbuf));
> > +    rc = vsnprintf(strbuf + sizeof(VMA_PREFIX),
> > +                   sizeof(strbuf) - sizeof(VMA_PREFIX), fmt, args);
> > +    if (rc < 0) {
> > +        return -errno;
> > +    } else if (rc >= (sizeof(strbuf) - sizeof(VMA_PREFIX))) {
> > +        sprintf(strbuf + sizeof(strbuf) - 4, "...");
> > +    }
> > +
> > +    rc = prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ptr, sz, strbuf);
> > +    if (rc) {
> > +        return -errno;
> > +    }
> > +#endif
> > +
> > +    return rc;
> > +}
> > +
> > +G_GNUC_PRINTF(3, 4)
> > +int qemu_name_vma(void *ptr, size_t sz, const char *fmt, ...)
> > +{
> > +    va_list args;
> > +
> > +    va_start(args, fmt);
> > +    return qemu_vname_vma(ptr, sz, fmt, args);
>
> We need a va_end here too.

Definitely spent too long in the python mines...

Thanks, and thanks for the pre-submission review as well. ... and
thanks for figuring out that the entire feature needed a configuration
variable, and thanks for proposing we enable that variable in our
Fedora debug builds. :)

It's been a *massive* help, even more than "massif" ;)

(Note to international audiences: effusive praise is typical for
Americans, they are just like this. If you should find yourself the
subject of overwhelming praise by an American, do not panic, they are
not likely to propose to you. They may just offer to buy you a drink
should you meet, or perhaps stand a little less than six feet apart
should you happen to be waiting for a bus/train together.)

>
> > +}
> > diff --git a/util/meson.build b/util/meson.build
> > index fa174c07a57..861ee228d5b 100644
> > --- a/util/meson.build
> > +++ b/util/meson.build
> > @@ -1,5 +1,6 @@
> >  util_ss.add(files('osdep.c', 'cutils.c', 'unicode.c', 'qemu-timer-common.c'))
> >  util_ss.add(files('thread-context.c'), numa)
> > +util_ss.add(files('mmap-vma.c'))
> >  if host_os != 'windows'
> >    util_ss.add(files('aio-posix.c'))
> >    util_ss.add(files('fdmon-poll.c'))
> > --
> > 2.56.0
> >
>
> With regards,
> Daniel
> --
> |: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
> |: https://libvirt.org          ~~          https://entangle-photo.org :|
> |: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|
>