QEMU VGA fix, optional HMP, and emulator infrastructure

QEMU development on 2026-08-25 focused on a VGA text-mode security fix and a cluster of infrastructure proposals. Series advanced optional HMP builds, bsd-user syscall coverage, IOThread observability, and multi-architecture single-binary work.

VGA text-mode OOB write after surface switch

Patch revisions on qemu-devel fix an out-of-bounds write in the QEMU VGA text renderer that could follow a graphics surface switch. The v3 change separates per-renderer geometry caches and adds a bounds check. Operators running guests that use VGA text mode gain a hardened display path against this class of memory corruption.

HMP made compile-time optional

A 49-patch v3 series makes the Human Monitor Protocol optional at build time through --disable-hmp. The stated aim is to shrink attack surface for deployments that do not require HMP. Security-minded packagers and embedders can produce smaller QEMU binaries with a reduced trusted computing base.

Most remaining bsd-user syscalls upstreamed

Warner Losh posted a v4 series of 40 patches that completes most of the remaining system calls for bsd-user in QEMU. The submission notes heavy Claude assistance with explicit attribution. Users of BSD user-mode emulation move closer to fuller FreeBSD and related guest coverage.

IOThread holder tracking and query support

Version 12 of a 15-patch series adds tracking of IOThread holders and exposes them via query-iothreads. The work improves observability for devices and exports that pin IOThreads. Operators running complex I/O topologies get clearer answers about which components hold which threads.

ARM and RISC-V linked into one qemu-system binary

A 12-patch series extends prior single-binary work by uniquifying symbols and adjusting the build so ARM and RISC-V can share one qemu-system binary. The change continues consolidation of QEMU system emulators. Builders who want fewer artifacts or shared code across architectures have a concrete next step.

TI AM64x SoC and am64-virt machine

An RFC v2 series of 14 patches adds the Texas Instruments AM64x SoC and an am64-virt board to QEMU. It covers the full vendor boot chain and ships new tests. Developers targeting AM64x hardware obtain an upstream emulation path for bring-up and CI.

Force detach for PCI hot-unplug

An 8-patch series proposes a force-unplug option on PCI device_del for ACPI-based and PCIe native hot-unplug paths. The goal is reliable removal when guests do not cooperate. Virtualization operators who must reclaim devices from stuck guests should follow the review.