If cpu->env.has_error_code is true, backwards migration of a VM from
a QEMU binary with commit 27535e9cca to a QEMU binary without commit
27535e9cca will fail:

> kvm: error while loading state for instance 0x0 of device 'cpu'

In practice, wrongly setting the error code to 0 on the target is
often unproblematic, so additionally checking error_code != 0 in
cpu_errcode_needed() is not enough to mitigate the issue. Instead, add
proper machine version compat handling.

Cc: qemu-stable@nongnu.org
Fixes: 27535e9cca ("target/i386: Add support for save/load of exception error code")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v2:
* Add proper machine version compat rather than just checking if
  error_code != 0.

 hw/i386/pc.c          | 1 +
 target/i386/cpu.c     | 1 +
 target/i386/cpu.h     | 1 +
 target/i386/machine.c | 2 +-
 4 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index addf602da0..4b53b5be4a 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -78,6 +78,7 @@ const size_t pc_compat_10_2_len = G_N_ELEMENTS(pc_compat_10_2);
 
 GlobalProperty pc_compat_10_1[] = {
     { "mch", "extended-tseg-mbytes", "16" },
+    { TYPE_X86_CPU, "x-migrate-error-code", "false" },
 };
 const size_t pc_compat_10_1_len = G_N_ELEMENTS(pc_compat_10_1);
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 0a29ff805f..abf129c7d5 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -10561,6 +10561,7 @@ static const Property x86_cpu_properties[] = {
     DEFINE_PROP_BOOL("tcg-cpuid", X86CPU, expose_tcg, true),
     DEFINE_PROP_BOOL("x-migrate-smi-count", X86CPU, migrate_smi_count,
                      true),
+    DEFINE_PROP_BOOL("x-migrate-error-code", X86CPU, migrate_error_code, true),
     /*
      * lecacy_cache defaults to true unless the CPU model provides its
      * own cache information (see x86_cpu_load_def()).
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 5a62aa6157..ecae8593c8 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2361,6 +2361,7 @@ struct ArchCPU {
     bool expose_tcg;
     bool migratable;
     bool migrate_smi_count;
+    bool migrate_error_code;
     uint32_t apic_id;
 
     /* Enables publishing of TSC increment and Local APIC bus frequencies to
diff --git a/target/i386/machine.c b/target/i386/machine.c
index c913961281..48a2a4b319 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -466,7 +466,7 @@ static bool cpu_errcode_needed(void *opaque)
 {
     X86CPU *cpu = opaque;
 
-    return cpu->env.has_error_code != 0;
+    return cpu->env.has_error_code != 0 && cpu->migrate_error_code;
 }
 
 static const VMStateDescription vmstate_error_code = {
-- 
2.47.3

Queued, thanks.

Paolo

On Tue, Mar 10, 2026 at 04:43:23PM +0100, Fiona Ebner wrote:
> Date: Tue, 10 Mar 2026 16:43:23 +0100
> From: Fiona Ebner <f.ebner@proxmox.com>
> Subject: [PATCH v2] target/i386: add compat for migrating error code
> X-Mailer: git-send-email 2.47.3
> 
> If cpu->env.has_error_code is true, backwards migration of a VM from
> a QEMU binary with commit 27535e9cca to a QEMU binary without commit
> 27535e9cca will fail:
> 
> > kvm: error while loading state for instance 0x0 of device 'cpu'
> 
> In practice, wrongly setting the error code to 0 on the target is
> often unproblematic, so additionally checking error_code != 0 in
> cpu_errcode_needed() is not enough to mitigate the issue. Instead, add
> proper machine version compat handling.
> 
> Cc: qemu-stable@nongnu.org
> Fixes: 27535e9cca ("target/i386: Add support for save/load of exception error code")
> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
> 
> Changes in v2:
> * Add proper machine version compat rather than just checking if
>   error_code != 0.
> 
>  hw/i386/pc.c          | 1 +
>  target/i386/cpu.c     | 1 +
>  target/i386/cpu.h     | 1 +
>  target/i386/machine.c | 2 +-
>  4 files changed, 4 insertions(+), 1 deletion(-)

...

> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index 5a62aa6157..ecae8593c8 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -2361,6 +2361,7 @@ struct ArchCPU {
>      bool expose_tcg;
>      bool migratable;
>      bool migrate_smi_count;

only a nit, it's better to have a comment like:

    /*
     * Compatibility bits for old machine types.
     * If true, allow to migrate error code.
     */

> +    bool migrate_error_code;
>      uint32_t apic_id;

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>