[PULL 00/24] Qom patches

[PULL 00/24] Qom patches

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

The following changes since commit 5e61afe211e82a9af15a8794a0bd29bb574e953b:

  Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11 10:49:53 -0400)

are available in the Git repository at:

  https://gitlab.com/marcandre.lureau/qemu.git tags/qom-pull-request

for you to fetch changes up to bc61a3209bf064826481a5f8f2b4feb47c70b02f:

  target/s390x: add gen-features.h dependency to s390x_system_ss (2026-05-11 23:59:33 +0400)

----------------------------------------------------------------
QOM object lifecycle fixes

----------------------------------------------------------------

Marc-André Lureau (23):
  hw/remote: check visit return in vfu_object_set_socket
  qom/object: update doc about NULL values in link properties
  hw/remote: guard listener unregister in finalize
  io/net-listener: move mutex init to instance_init
  net/colo-compare: guard finalize against uninitialized state
  ui/console: remove console from global list on finalization
  hw/i386/x86: free oem_id and oem_table_id on finalization
  hw/core/resetcontainer: free children array on finalization
  net/can: free ifname on socketcan finalization
  backends/igvm-cfg: free filename on finalization
  scsi/pr-manager-helper: free path on finalization
  accel/kvm: free device path on finalization
  system/qtest: add missing qtest_finalize()
  hw/fsi: move OPBus address space init to realize
  hw/fsi: move OPBus qbus_init() to instance_init
  hw/gpio/pca9552: fix state_str leak in pca955x_set_led
  hw/arm/aspeed: free fmc_model and spi_model on finalization
  hw/arm/sbsa-ref: free unrealized flash devices on finalization
  hw/arm/virt: free flash devices and OEM strings on finalization
  hw/ppc/pnv: drop extra ref on PHB after adding as child
  hw/riscv/virt: free flash devices and OEM strings on finalization
  meson: drop sphinx-build < 1.7 compatiblity check
  target/s390x: add gen-features.h dependency to s390x_system_ss

Peter Xu (1):
  system/ioport: Fix qom-list-properties crash on portio list obj

 docs/meson.build          | 14 +-------------
 include/qom/object.h      |  8 ++++----
 accel/kvm/kvm-all.c       |  8 ++++++++
 backends/igvm-cfg.c       |  1 +
 hw/arm/aspeed.c           |  9 +++++++++
 hw/arm/sbsa-ref.c         | 12 ++++++++++++
 hw/arm/virt.c             | 14 ++++++++++++++
 hw/core/resetcontainer.c  |  3 +++
 hw/fsi/aspeed_apb2opb.c   | 37 ++++++++++++++++++++++++-------------
 hw/gpio/pca9552.c         |  2 +-
 hw/i386/x86.c             |  9 +++++++++
 hw/ppc/pnv.c              |  1 +
 hw/remote/remote-obj.c    |  4 +++-
 hw/remote/vfio-user-obj.c |  4 +++-
 hw/riscv/virt.c           | 14 ++++++++++++++
 io/net-listener.c         |  9 ++++++++-
 net/can/can_socketcan.c   |  8 ++++++++
 net/colo-compare.c        | 31 +++++++++++++++----------------
 scsi/pr-manager-helper.c  |  1 +
 system/ioport.c           | 11 +++++++++--
 system/qtest.c            | 10 ++++++++++
 ui/console.c              |  5 ++++-
 target/s390x/meson.build  |  1 +
 23 files changed, 163 insertions(+), 53 deletions(-)

-- 
2.54.0

[PULL 01/24] hw/remote: check visit return in vfu_object_set_socket

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

vfu_object_set_socket() dereferences o->socket without checking if
visit_type_SocketAddress() succeeded. On failure, o->socket remains
NULL, leading to a NULL dereference. Check the return value.

Fixes: 8f9a9259d32c ("vfio-user: define vfio-user-server object")
Reviewed-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/remote/vfio-user-obj.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/remote/vfio-user-obj.c b/hw/remote/vfio-user-obj.c
index 12ecdab6dea..49bf5ecae0c 100644
--- a/hw/remote/vfio-user-obj.c
+++ b/hw/remote/vfio-user-obj.c
@@ -161,7 +161,9 @@ static void vfu_object_set_socket(Object *obj, Visitor *v, const char *name,
 
     o->socket = NULL;
 
-    visit_type_SocketAddress(v, name, &o->socket, errp);
+    if (!visit_type_SocketAddress(v, name, &o->socket, errp)) {
+        return;
+    }
 
     if (o->socket->type != SOCKET_ADDRESS_TYPE_UNIX) {
         error_setg(errp, "vfu: Unsupported socket type - %s",
-- 
2.54.0

[PULL 02/24] qom/object: update doc about NULL values in link properties

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 include/qom/object.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index f40d8ccd4a2..2a2829343d0 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -1714,10 +1714,10 @@ void object_property_allow_set_link(const Object *obj, const char *name,
  *
  * Links form the graph in the object model.
  *
- * The @check() callback is invoked when
- * object_property_set_link() is called and can raise an error to prevent the
- * link being set.  If @check is NULL, the property is read-only
- * and cannot be set.
+ * The @check() callback is invoked when object_property_set_link() is called
+ * and can raise an error to prevent the link being set. If @check is NULL, the
+ * property is read-only and cannot be set. Care must be taken to handle NULL
+ * values for @val.
  *
  * Ownership of the pointer that @child points to is transferred to the
  * link property.  The reference count for *@child is
-- 
2.54.0

[PULL 03/24] hw/remote: guard listener unregister in finalize

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Guard the unregister by checking whether the listener callback was
set, which only happens right before registration.

Cc: jag.raman@oracle.com
Fixes: c7d80c7c1d9 ("multi-process: Associate fd of a PCIDevice with its object")
Reviewed-by: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/remote/remote-obj.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/remote/remote-obj.c b/hw/remote/remote-obj.c
index 86192dc8dad..4e74ae76158 100644
--- a/hw/remote/remote-obj.c
+++ b/hw/remote/remote-obj.c
@@ -154,7 +154,9 @@ static void remote_object_finalize(Object *obj)
     RemoteObjectClass *k = REMOTE_OBJECT_GET_CLASS(obj);
     RemoteObject *o = REMOTE_OBJECT(obj);
 
-    device_listener_unregister(&o->listener);
+    if (o->listener.unrealize) {
+        device_listener_unregister(&o->listener);
+    }
 
     if (o->ioc) {
         qio_channel_shutdown(o->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
-- 
2.54.0

[PULL 04/24] io/net-listener: move mutex init to instance_init

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

The QIONetListener mutex is initialized in the convenience
constructor qio_net_listener_new() rather than in an instance_init.
This means a bare object_new(TYPE_QIO_NET_LISTENER) produces an
object with an uninitialized mutex, but instance_finalize
unconditionally calls qemu_mutex_destroy() on it, which aborts.

Move the mutex initialization to a proper instance_init so that init
and finalize are always paired regardless of how the object is
created.

Fixes: 9d86181874a ("qio: Protect NetListener callback with mutex")
Cc: peterx@redhat.com
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 io/net-listener.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/io/net-listener.c b/io/net-listener.c
index 9410d72da9c..1fd0f6cb5ab 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -38,7 +38,6 @@ QIONetListener *qio_net_listener_new(void)
     QIONetListener *listener;
 
     listener = QIO_NET_LISTENER(object_new(TYPE_QIO_NET_LISTENER));
-    qemu_mutex_init(&listener->lock);
     return listener;
 }
 
@@ -440,6 +439,13 @@ qio_net_listener_get_local_address(QIONetListener *listener, size_t n,
     return qio_channel_socket_get_local_address(sioc, errp);
 }
 
+static void qio_net_listener_instance_init(Object *obj)
+{
+    QIONetListener *listener = QIO_NET_LISTENER(obj);
+
+    qemu_mutex_init(&listener->lock);
+}
+
 static void qio_net_listener_finalize(Object *obj)
 {
     QIONetListener *listener = QIO_NET_LISTENER(obj);
@@ -463,6 +469,7 @@ static const TypeInfo qio_net_listener_info = {
     .parent = TYPE_OBJECT,
     .name = TYPE_QIO_NET_LISTENER,
     .instance_size = sizeof(QIONetListener),
+    .instance_init = qio_net_listener_instance_init,
     .instance_finalize = qio_net_listener_finalize,
 };
 
-- 
2.54.0

[PULL 05/24] net/colo-compare: guard finalize against uninitialized state

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

colo_compare_finalize() assumes the object was fully set up by
colo_compare_complete(), but a bare object_new() followed by
object_unref() skips the complete callback entirely.

This causes two crashes:
- qemu_mutex_destroy on the static event_mtx which was never
  initialized (colo_compare_active is false)
- qemu_bh_delete(NULL) and iothread dereference when s->iothread
  is NULL

Guard the event_mtx teardown with colo_compare_active, and the
iothread-dependent cleanup with an s->iothread NULL check.

Fixes: 45942b79b9f8 ("net/colo-compare.c: Check that colo-compare is active")
Cc: peterx@redhat.com
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 net/colo-compare.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index abc1326b704..823b8aa323c 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -1416,7 +1416,7 @@ static void colo_compare_finalize(Object *obj)
             break;
         }
     }
-    if (QTAILQ_EMPTY(&net_compares)) {
+    if (colo_compare_active && QTAILQ_EMPTY(&net_compares)) {
         colo_compare_active = false;
         qemu_mutex_destroy(&event_mtx);
         qemu_cond_destroy(&event_complete_cond);
@@ -1431,30 +1431,29 @@ static void colo_compare_finalize(Object *obj)
     }
 
     colo_compare_timer_del(s);
+    g_clear_pointer(&s->event_bh, qemu_bh_delete);
 
-    qemu_bh_delete(s->event_bh);
+    if (s->iothread) {
+        AioContext *ctx = iothread_get_aio_context(s->iothread);
 
-    AioContext *ctx = iothread_get_aio_context(s->iothread);
-    AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
-    if (s->notify_dev) {
-        AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
-    }
+        AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
+        if (s->notify_dev) {
+            AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
+        }
+
+        /* Release all unhandled packets after compare thread exited */
+        g_queue_foreach(&s->conn_list, colo_flush_packets, s);
+        AIO_WAIT_WHILE(NULL, !s->out_sendco.done);
 
-    /* Release all unhandled packets after compare thead exited */
-    g_queue_foreach(&s->conn_list, colo_flush_packets, s);
-    AIO_WAIT_WHILE(NULL, !s->out_sendco.done);
+        object_unref(OBJECT(s->iothread));
+    }
 
     g_queue_clear(&s->conn_list);
     g_queue_clear(&s->out_sendco.send_list);
     if (s->notify_dev) {
         g_queue_clear(&s->notify_sendco.send_list);
     }
-
-    if (s->connection_track_table) {
-        g_hash_table_destroy(s->connection_track_table);
-    }
-
-    object_unref(OBJECT(s->iothread));
+    g_clear_pointer(&s->connection_track_table, g_hash_table_destroy);
 
     g_free(s->pri_indev);
     g_free(s->sec_indev);
-- 
2.54.0

[PULL 06/24] system/ioport: Fix qom-list-properties crash on portio list obj

[marcandre.lureau]

From: Peter Xu <peterx@redhat.com>

Currently qom-list-properties QMP command will crash when querying the
portio list MR object.  It's because its finalize() assumes full
initialization done in portio_list_add_1().

Provide a simple fix for now to avoid the crash.  There is chance for a
longer term fix, ideally MR should be initialized in instance_init().

However that'll need more work, and that should also be done with cleaning
the hard-coded MR operations in portio_list_add_1().  To be explored.

Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Link: https://lore.kernel.org/r/87a4uvw066.fsf@pond.sub.org
Reported-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 system/ioport.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/system/ioport.c b/system/ioport.c
index 9209bff2eab..1a0e01fd06b 100644
--- a/system/ioport.c
+++ b/system/ioport.c
@@ -346,8 +346,15 @@ static void memory_region_portio_list_finalize(Object *obj)
 {
     MemoryRegionPortioList *mrpio = MEMORY_REGION_PORTIO_LIST(obj);
 
-    object_unref(&mrpio->mr);
-    g_free(mrpio->ports);
+    /*
+     * This check makes sure any random object_new() (without doing the
+     * rest inits in portio_list_add_1()) will not crash when finalizing.
+     * One example is QMP command qom-list-properties.
+     */
+    if (mrpio->ports) {
+        object_unref(&mrpio->mr);
+        g_free(mrpio->ports);
+    }
 }
 
 static const TypeInfo memory_region_portio_list_info = {
-- 
2.54.0

[PULL 07/24] ui/console: remove console from global list on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

This commit removes the QemuConsole from the global "consoles" list when
it is finalized, fixing use-after-free on throw-away objects.

Reproducer: QMP command qom-list-properties with typename
"qemu-text-console", "qemu-fixed-text-console" or
"qemu-graphic-console".

The assertions added ensure that `dcls`, `gl_block`, and the
`dump_queue` are empty before removal, confirming the console is in a
clean state. This is left to handle correctly in a future series for
hot-unplug case.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/console.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ui/console.c b/ui/console.c
index 6f6330d61f1..eaa41086743 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -392,10 +392,13 @@ qemu_console_finalize(Object *obj)
 {
     QemuConsole *c = QEMU_CONSOLE(obj);
 
-    /* TODO: check this code path, and unregister from consoles */
+    /* TODO: fix hot-unplug support of consoles */
+    assert(c->gl_block == 0);
+    assert(qemu_co_queue_empty(&c->dump_queue));
     g_clear_pointer(&c->surface, qemu_free_displaysurface);
     g_clear_pointer(&c->gl_unblock_timer, timer_free);
     g_clear_pointer(&c->ui_timer, timer_free);
+    QTAILQ_REMOVE(&consoles, c, next);
 }
 
 static void
-- 
2.54.0

[PULL 08/24] hw/i386/x86: free oem_id and oem_table_id on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

x86_machine_initfn allocates oem_id and oem_table_id via g_strndup,
but no instance_finalize existed for x86_machine_info, so these
strings were never freed when the object was destroyed.

Add x86_machine_finalize to release both fields.

Fixes: d07b22863b8e ("acpi: Move setters/getters of oem fields to X86MachineState")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/i386/x86.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index 01872cba073..dc7f0d56b01 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -372,6 +372,14 @@ static void x86_machine_initfn(Object *obj)
     x86ms->above_4g_mem_start = 4 * GiB;
 }
 
+static void x86_machine_finalize(Object *obj)
+{
+    X86MachineState *x86ms = X86_MACHINE(obj);
+
+    g_free(x86ms->oem_id);
+    g_free(x86ms->oem_table_id);
+}
+
 static void x86_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -445,6 +453,7 @@ static const TypeInfo x86_machine_info = {
     .abstract = true,
     .instance_size = sizeof(X86MachineState),
     .instance_init = x86_machine_initfn,
+    .instance_finalize = x86_machine_finalize,
     .class_size = sizeof(X86MachineClass),
     .class_init = x86_machine_class_init,
     .interfaces = (const InterfaceInfo[]) {
-- 
2.54.0

[PULL 09/24] hw/core/resetcontainer: free children array on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

resettable_container_init allocates a GPtrArray for children, but
resettable_container_finalize was empty and never freed it.

Fixes: 4c046ce37af0 ("hw/core: Add ResetContainer which holds objects implementing Resettable")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/core/resetcontainer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/core/resetcontainer.c b/hw/core/resetcontainer.c
index ef84aa2374a..a4a6476a036 100644
--- a/hw/core/resetcontainer.c
+++ b/hw/core/resetcontainer.c
@@ -66,6 +66,9 @@ static void resettable_container_init(Object *obj)
 
 static void resettable_container_finalize(Object *obj)
 {
+    ResettableContainer *rc = RESETTABLE_CONTAINER(obj);
+
+    g_ptr_array_unref(rc->children);
 }
 
 static void resettable_container_class_init(ObjectClass *klass,
-- 
2.54.0

[PULL 10/24] net/can: free ifname on socketcan finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

can_host_socketcan_set_if allocates ifname via g_strdup, but no
instance_finalize existed to free it.

Fixes: ea15ea8a7c67 ("net/can: support for connecting to Linux host SocketCAN interface.")
Acked-by: Pavel Pisa <pisa@fel.cvut.cz>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 net/can/can_socketcan.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/can/can_socketcan.c b/net/can/can_socketcan.c
index 8a57ae07178..be67ed7f5a9 100644
--- a/net/can/can_socketcan.c
+++ b/net/can/can_socketcan.c
@@ -319,11 +319,19 @@ static void can_host_socketcan_class_init(ObjectClass *klass,
     chc->disconnect = can_host_socketcan_disconnect;
 }
 
+static void can_host_socketcan_finalize(Object *obj)
+{
+    CanHostSocketCAN *c = CAN_HOST_SOCKETCAN(obj);
+
+    g_free(c->ifname);
+}
+
 static const TypeInfo can_host_socketcan_info = {
     .parent = TYPE_CAN_HOST,
     .name = TYPE_CAN_HOST_SOCKETCAN,
     .instance_size = sizeof(CanHostSocketCAN),
     .instance_init = can_host_socketcan_instance_init,
+    .instance_finalize = can_host_socketcan_finalize,
     .class_init = can_host_socketcan_class_init,
 };
 
-- 
2.54.0

[PULL 11/24] backends/igvm-cfg: free filename on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

set_igvm allocates filename via g_strdup, but igvm_cfg_finalize
did not free it.

Fixes: c1d466d267cf ("backends/igvm: Add IGVM loader and configuration")
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 backends/igvm-cfg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backends/igvm-cfg.c b/backends/igvm-cfg.c
index 64589ca34f2..e1f09855f66 100644
--- a/backends/igvm-cfg.c
+++ b/backends/igvm-cfg.c
@@ -108,4 +108,5 @@ static void igvm_cfg_finalize(Object *obj)
     if (igvm->file >= 0) {
         igvm_free(igvm->file);
     }
+    g_free(igvm->filename);
 }
-- 
2.54.0

[PULL 12/24] scsi/pr-manager-helper: free path on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

set_path allocates path via g_strdup, but
pr_manager_helper_instance_finalize did not free it.

Fixes: 9bad2a6b9d0a ("scsi: add persistent reservation manager using qemu-pr-helper")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 scsi/pr-manager-helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
index f6454cd80de..53432e6d606 100644
--- a/scsi/pr-manager-helper.c
+++ b/scsi/pr-manager-helper.c
@@ -284,6 +284,7 @@ static void pr_manager_helper_instance_finalize(Object *obj)
 {
     PRManagerHelper *pr_mgr = PR_MANAGER_HELPER(obj);
 
+    g_free(pr_mgr->path);
     object_unref(OBJECT(pr_mgr->ioc));
     qemu_mutex_destroy(&pr_mgr->lock);
 }
-- 
2.54.0

[PULL 13/24] accel/kvm: free device path on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

kvm_set_device allocates device via g_strdup, but no
instance_finalize existed for the KVM accelerator type.

Fixes: aef158b093b9 ("Add class property to configure KVM device node to use")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 accel/kvm/kvm-all.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 92af42503b1..96f90ebb240 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -4342,10 +4342,18 @@ static void kvm_accel_class_init(ObjectClass *oc, const void *data)
     kvm_arch_accel_class_init(oc);
 }
 
+static void kvm_accel_finalize(Object *obj)
+{
+    KVMState *s = KVM_STATE(obj);
+
+    g_free(s->device);
+}
+
 static const TypeInfo kvm_accel_type = {
     .name = TYPE_KVM_ACCEL,
     .parent = TYPE_ACCEL,
     .instance_init = kvm_accel_instance_init,
+    .instance_finalize = kvm_accel_finalize,
     .class_init = kvm_accel_class_init,
     .instance_size = sizeof(KVMState),
 };
-- 
2.54.0

[PULL 14/24] system/qtest: add missing qtest_finalize()

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Free owned resources on object finalization.

Fixes: 6ba7ada3559e ("qtest: add a QOM object for qtest")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 system/qtest.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/system/qtest.c b/system/qtest.c
index cf90cd53adb..a79d10d1361 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -1020,10 +1020,20 @@ static void qtest_class_init(ObjectClass *oc, const void *data)
                                   qtest_get_log, qtest_set_log);
 }
 
+static void qtest_finalize(Object *obj)
+{
+    QTest *q = QTEST(obj);
+
+    g_free(q->chr_name);
+    g_free(q->log);
+    object_unref(q->chr);
+}
+
 static const TypeInfo qtest_info = {
     .name = TYPE_QTEST,
     .parent = TYPE_OBJECT,
     .class_init = qtest_class_init,
+    .instance_finalize = qtest_finalize,
     .instance_size = sizeof(QTest),
     .interfaces = (const InterfaceInfo[]) {
         { TYPE_USER_CREATABLE },
-- 
2.54.0

[PULL 15/24] hw/fsi: move OPBus address space init to realize

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

The OPBus instance_init initializes an AddressSpace, registering it in
the global address_spaces list. When a bare OPBus object is created
and destroyed (e.g. by qom-tests), there is no finalize to remove the
stale entry, leading to a heap-use-after-free when a subsequent
flatviews_reset iterates the list.

Move address_space_init to the bus realize callback and add the
corresponding address_space_destroy in unrealize, following the
NubusBus pattern. Also fix the memory_region_init owner from NULL to
the OPBus object, so the MR is properly parented instead of dangling
under the "unattached" container.

Fixes: eb04c35da2c0 ("hw/fsi: Aspeed APB2OPB & On-chip peripheral bus")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/fsi/aspeed_apb2opb.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/hw/fsi/aspeed_apb2opb.c b/hw/fsi/aspeed_apb2opb.c
index b9d72f3ecf6..36092468391 100644
--- a/hw/fsi/aspeed_apb2opb.c
+++ b/hw/fsi/aspeed_apb2opb.c
@@ -348,15 +348,37 @@ static void fsi_opb_init(Object *o)
 {
     OPBus *opb = OP_BUS(o);
 
-    memory_region_init(&opb->mr, 0, TYPE_FSI_OPB, UINT32_MAX);
+    memory_region_init(&opb->mr, o, TYPE_FSI_OPB, UINT32_MAX);
+}
+
+static void fsi_opb_realize(BusState *bus, Error **errp)
+{
+    OPBus *opb = OP_BUS(bus);
+
     address_space_init(&opb->as, &opb->mr, TYPE_FSI_OPB);
 }
 
+static void fsi_opb_unrealize(BusState *bus)
+{
+    OPBus *opb = OP_BUS(bus);
+
+    address_space_destroy(&opb->as);
+}
+
+static void fsi_opb_class_init(ObjectClass *klass, const void *data)
+{
+    BusClass *bc = BUS_CLASS(klass);
+
+    bc->realize = fsi_opb_realize;
+    bc->unrealize = fsi_opb_unrealize;
+}
+
 static const TypeInfo opb_info = {
     .name = TYPE_OP_BUS,
     .parent = TYPE_BUS,
     .instance_init = fsi_opb_init,
     .instance_size = sizeof(OPBus),
+    .class_init = fsi_opb_class_init,
 };
 
 static void fsi_opb_register_types(void)
-- 
2.54.0

[PULL 16/24] hw/fsi: move OPBus qbus_init() to instance_init

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Remove the TODO comment that documented the workaround, as it is
no longer needed.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/fsi/aspeed_apb2opb.c | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/hw/fsi/aspeed_apb2opb.c b/hw/fsi/aspeed_apb2opb.c
index 36092468391..058abc86452 100644
--- a/hw/fsi/aspeed_apb2opb.c
+++ b/hw/fsi/aspeed_apb2opb.c
@@ -273,6 +273,7 @@ static void fsi_aspeed_apb2opb_init(Object *o)
     for (i = 0; i < ASPEED_FSI_NUM; i++) {
         object_initialize_child(o, "fsi-master[*]", &s->fsi[i],
                                 TYPE_FSI_MASTER);
+        qbus_init(&s->opb[i], sizeof(s->opb[i]), TYPE_OP_BUS, DEVICE(s), NULL);
     }
 }
 
@@ -282,18 +283,6 @@ static void fsi_aspeed_apb2opb_realize(DeviceState *dev, Error **errp)
     AspeedAPB2OPBState *s = ASPEED_APB2OPB(dev);
     int i;
 
-    /*
-     * TODO: The OPBus model initializes the OPB address space in
-     * the .instance_init handler and this is problematic for test
-     * device-introspect-test. To avoid a memory corruption and a QEMU
-     * crash, qbus_init() should be called from realize(). Something to
-     * improve. Possibly, OPBus could also be removed.
-     */
-    for (i = 0; i < ASPEED_FSI_NUM; i++) {
-        qbus_init(&s->opb[i], sizeof(s->opb[i]), TYPE_OP_BUS, DEVICE(s),
-                  NULL);
-    }
-
     sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_apb2opb_ops, s,
-- 
2.54.0

[PULL 17/24] hw/gpio/pca9552: fix state_str leak in pca955x_set_led

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

visit_type_str() allocates state_str, but the function never frees it
on any code path. Use g_autofree to ensure it is freed on return.

Fixes: a90d8f84674d ("misc/pca9552: Add qom set and get")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/gpio/pca9552.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c
index dd3f1536b65..472d8ad9571 100644
--- a/hw/gpio/pca9552.c
+++ b/hw/gpio/pca9552.c
@@ -342,7 +342,7 @@ static void pca955x_set_led(Object *obj, Visitor *v, const char *name,
     PCA955xState *s = PCA955X(obj);
     int led, rc, reg, val;
     uint8_t state;
-    char *state_str;
+    g_autofree char *state_str = NULL;
 
     if (!visit_type_str(v, name, &state_str, errp)) {
         return;
-- 
2.54.0

[PULL 18/24] hw/arm/aspeed: free fmc_model and spi_model on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

The fmc_model and spi_model strings are allocated via g_strdup in
property setters but never freed when the machine object is destroyed.

Fixes: 9820e52fbef7 ("hw/arm/aspeed: Add machine properties to define the flash models")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/arm/aspeed.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index a3db3406c5f..a48c4420583 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -419,12 +419,21 @@ static void aspeed_machine_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_class_props_init(oc);
 }
 
+static void aspeed_machine_instance_finalize(Object *obj)
+{
+    AspeedMachineState *bmc = ASPEED_MACHINE(obj);
+
+    g_free(bmc->fmc_model);
+    g_free(bmc->spi_model);
+}
+
 static const TypeInfo aspeed_machine_types[] = {
     {
         .name          = TYPE_ASPEED_MACHINE,
         .parent        = TYPE_MACHINE,
         .instance_size = sizeof(AspeedMachineState),
         .instance_init = aspeed_machine_instance_init,
+        .instance_finalize = aspeed_machine_instance_finalize,
         .class_size    = sizeof(AspeedMachineClass),
         .class_init    = aspeed_machine_class_init,
         .abstract      = true,
-- 
2.54.0

[PULL 19/24] hw/arm/sbsa-ref: free unrealized flash devices on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Flash devices are created with qdev_new() in instance_init and added as
children, but the initial reference from qdev_new() is only dropped by
sysbus_realize_and_unref() during machine init. When the machine object
is destroyed before realization (e.g. during qtest device introspection),
the flash devices leak.

Fixes: e9fdf453240e ("hw/arm: Add arm SBSA reference machine, devices part")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/arm/sbsa-ref.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 52c35e10c2d..484b90053e8 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -892,6 +892,17 @@ static void sbsa_ref_instance_init(Object *obj)
     sbsa_flash_create(sms);
 }
 
+static void sbsa_ref_instance_finalize(Object *obj)
+{
+    SBSAMachineState *sms = SBSA_MACHINE(obj);
+
+    for (int i = 0; i < ARRAY_SIZE(sms->flash); i++) {
+        if (sms->flash[i] && !qdev_is_realized(DEVICE(sms->flash[i]))) {
+            object_unref(OBJECT(sms->flash[i]));
+        }
+    }
+}
+
 static void sbsa_ref_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -930,6 +941,7 @@ static const TypeInfo sbsa_ref_info = {
     .name          = TYPE_SBSA_MACHINE,
     .parent        = TYPE_MACHINE,
     .instance_init = sbsa_ref_instance_init,
+    .instance_finalize = sbsa_ref_instance_finalize,
     .class_init    = sbsa_ref_class_init,
     .instance_size = sizeof(SBSAMachineState),
     .interfaces    = aarch64_machine_interfaces,
-- 
2.54.0

[PULL 20/24] hw/arm/virt: free flash devices and OEM strings on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Flash devices created in instance_init via qdev_new() hold an extra
reference that is only dropped on sysbus_realize_and_unref(). When the
machine is destroyed before realization, the flash objects leak. Also,
the oem_id and oem_table_id strings from g_strndup() are never freed.

Fixes: 602b458201ff ("acpi: Permit OEM ID and OEM table ID fields to be changed")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/arm/virt.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 10b19543826..b090233893c 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -4321,6 +4321,19 @@ static void virt_instance_init(Object *obj)
     cxl_machine_init(obj, &vms->cxl_devices_state);
 }
 
+static void virt_instance_finalize(Object *obj)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    for (int i = 0; i < ARRAY_SIZE(vms->flash); i++) {
+        if (vms->flash[i] && !qdev_is_realized(DEVICE(vms->flash[i]))) {
+            object_unref(OBJECT(vms->flash[i]));
+        }
+    }
+    g_free(vms->oem_id);
+    g_free(vms->oem_table_id);
+}
+
 static const TypeInfo virt_machine_info = {
     .name          = TYPE_VIRT_MACHINE,
     .parent        = TYPE_MACHINE,
@@ -4329,6 +4342,7 @@ static const TypeInfo virt_machine_info = {
     .class_size    = sizeof(VirtMachineClass),
     .class_init    = virt_machine_class_init,
     .instance_init = virt_instance_init,
+    .instance_finalize = virt_instance_finalize,
     .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
          { }
-- 
2.54.0

[PULL 21/24] hw/ppc/pnv: drop extra ref on PHB after adding as child

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

object_new() returns an object with refcount 1, and
object_property_add_child() adds another reference. The initial
reference must be dropped so the parent becomes the sole owner,
otherwise the PHB objects leak when the chip is destroyed.

Fixes: 0d512c7120a2 ("ppc/pnv: turn chip8->phbs[] into a PnvPHB* array")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/ppc/pnv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 9ed918fa6a1..8306754d9ad 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1696,6 +1696,7 @@ static void pnv_chip_power8_instance_init(Object *obj)
              */
             object_property_add_child(obj, "phb[*]", phb);
             chip8->phbs[i] = PNV_PHB(phb);
+            object_unref(phb);
         }
     }
 
-- 
2.54.0

[PULL 22/24] hw/riscv/virt: free flash devices and OEM strings on finalization

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Add instance_finalize to free the two pflash devices (when unrealized)
and the OEM ID strings allocated during instance_init. Fixes leaks
found by ASan.

Fixes: 71eb522c4063 ("riscv/virt: Add the PFlash CFI01 device")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/riscv/virt.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index a1c323e66df..315049bc86c 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1745,6 +1745,19 @@ static void virt_machine_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&s->machine_done);
 }
 
+static void virt_machine_instance_finalize(Object *obj)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+
+    for (int i = 0; i < ARRAY_SIZE(s->flash); i++) {
+        if (s->flash[i] && !qdev_is_realized(DEVICE(s->flash[i]))) {
+            object_unref(OBJECT(s->flash[i]));
+        }
+    }
+    g_free(s->oem_id);
+    g_free(s->oem_table_id);
+}
+
 static void virt_machine_instance_init(Object *obj)
 {
     RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
@@ -1984,6 +1997,7 @@ static const TypeInfo virt_machine_typeinfo = {
     .parent     = TYPE_MACHINE,
     .class_init = virt_machine_class_init,
     .instance_init = virt_machine_instance_init,
+    .instance_finalize = virt_machine_instance_finalize,
     .instance_size = sizeof(RISCVVirtState),
     .interfaces = (const InterfaceInfo[]) {
          { TYPE_HOTPLUG_HANDLER },
-- 
2.54.0

[PULL 23/24] meson: drop sphinx-build < 1.7 compatiblity check

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Since commit fe791b7fcc ("Python: bump minimum sphinx version to
3.4.3"), we no longer support building with sphinx-build < 3.4.3

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
---
 docs/meson.build | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/docs/meson.build b/docs/meson.build
index c3e9fb05846..a8d893681ec 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -4,24 +4,12 @@ sphinx_build = find_program(fs.parent(python.full_path()) / 'sphinx-build',
 # Check if tools are available to build documentation.
 build_docs = false
 if sphinx_build.found()
-  SPHINX_ARGS = ['env', 'CONFDIR=' + qemu_confdir, sphinx_build, '-q']
+  SPHINX_ARGS = ['env', 'CONFDIR=' + qemu_confdir, sphinx_build, '-q', '-j', 'auto']
   # If we're making warnings fatal, apply this to Sphinx runs as well
   if get_option('werror')
     SPHINX_ARGS += [ '-W', '-Dkerneldoc_werror=1' ]
   endif
 
-  sphinx_version = run_command(SPHINX_ARGS + ['--version'],
-                               check: true).stdout().split()[1]
-  if sphinx_version.version_compare('>=1.7.0')
-    SPHINX_ARGS += ['-j', 'auto']
-  else
-    nproc = find_program('nproc')
-    if nproc.found()
-      jobs = run_command(nproc, check: true).stdout()
-      SPHINX_ARGS += ['-j', jobs]
-    endif
-  endif
-
   # This is a bit awkward but works: create a trivial document and
   # try to run it with our configuration file (which enforces a
   # version requirement). This will fail if sphinx-build is too old.
-- 
2.54.0

[PULL 24/24] target/s390x: add gen-features.h dependency to s390x_system_ss

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Commit 0b83acf2f05 moved gen_features_h from s390x_ss to
s390x_common_ss. However s390x_system_ss (containing ioinst.c) was left
without the dependency, causing a build race: it can be compiled before
gen-features.h is generated (via cpu.h -> cpu_models.h -> cpu_features.h
-> gen-features.h)

Add gen_features_h to s390x_system_ss to correct the build ordering.

Fixes: 0b83acf2f05 ("target/s390x: Introduce common system/user meson source set")
Acked-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 target/s390x/meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/s390x/meson.build b/target/s390x/meson.build
index 44f58ac2919..bc4459e8ed7 100644
--- a/target/s390x/meson.build
+++ b/target/s390x/meson.build
@@ -26,6 +26,7 @@ s390x_common_ss.add(files(
   'gdbstub.c',
 ))
 
+s390x_system_ss.add(gen_features_h)
 s390x_system_ss.add(files(
   'ioinst.c',
 ))
-- 
2.54.0

Re: [PULL 00/24] Qom patches

[Stefan Hajnoczi]

On Mon, May 11, 2026 at 4:21 PM <marcandre.lureau@redhat.com> wrote:
>
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> The following changes since commit 5e61afe211e82a9af15a8794a0bd29bb574e953b:
>
>   Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11 10:49:53 -0400)
>
> are available in the Git repository at:
>
>   https://gitlab.com/marcandre.lureau/qemu.git tags/qom-pull-request
>
> for you to fetch changes up to bc61a3209bf064826481a5f8f2b4feb47c70b02f:
>
>   target/s390x: add gen-features.h dependency to s390x_system_ss (2026-05-11 23:59:33 +0400)
>
> ----------------------------------------------------------------
> QOM object lifecycle fixes
>
> ----------------------------------------------------------------

Hi Marc-André,
I'm not sure if this CI failure is related to this pull request, but
there is a dbus-vnc issue:

>>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MESON_TEST_ITERATION=1 PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh QTEST_QEMU_IMG=./qemu-img QTEST_QEMU_BINARY=./qemu-system-x86_64 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 RUST_BACKTRACE=1 MALLOC_PERTURB_=211 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/dbus-vnc-test --tap -k

754/1075 /x86_64/dbus-vnc/password-auth -
ERROR:../tests/qtest/dbus-vnc-test.c:621:test_dbus_vnc_password_auth:
assertion failed (qemu_vnc1_server_get_auth(proxy) == "vnc"): ("none"
== "vnc") FAIL

https://gitlab.com/qemu-project/qemu/-/jobs/14337427774#L5512

Any ideas?

Stefan

>
> Marc-André Lureau (23):
>   hw/remote: check visit return in vfu_object_set_socket
>   qom/object: update doc about NULL values in link properties
>   hw/remote: guard listener unregister in finalize
>   io/net-listener: move mutex init to instance_init
>   net/colo-compare: guard finalize against uninitialized state
>   ui/console: remove console from global list on finalization
>   hw/i386/x86: free oem_id and oem_table_id on finalization
>   hw/core/resetcontainer: free children array on finalization
>   net/can: free ifname on socketcan finalization
>   backends/igvm-cfg: free filename on finalization
>   scsi/pr-manager-helper: free path on finalization
>   accel/kvm: free device path on finalization
>   system/qtest: add missing qtest_finalize()
>   hw/fsi: move OPBus address space init to realize
>   hw/fsi: move OPBus qbus_init() to instance_init
>   hw/gpio/pca9552: fix state_str leak in pca955x_set_led
>   hw/arm/aspeed: free fmc_model and spi_model on finalization
>   hw/arm/sbsa-ref: free unrealized flash devices on finalization
>   hw/arm/virt: free flash devices and OEM strings on finalization
>   hw/ppc/pnv: drop extra ref on PHB after adding as child
>   hw/riscv/virt: free flash devices and OEM strings on finalization
>   meson: drop sphinx-build < 1.7 compatiblity check
>   target/s390x: add gen-features.h dependency to s390x_system_ss
>
> Peter Xu (1):
>   system/ioport: Fix qom-list-properties crash on portio list obj
>
>  docs/meson.build          | 14 +-------------
>  include/qom/object.h      |  8 ++++----
>  accel/kvm/kvm-all.c       |  8 ++++++++
>  backends/igvm-cfg.c       |  1 +
>  hw/arm/aspeed.c           |  9 +++++++++
>  hw/arm/sbsa-ref.c         | 12 ++++++++++++
>  hw/arm/virt.c             | 14 ++++++++++++++
>  hw/core/resetcontainer.c  |  3 +++
>  hw/fsi/aspeed_apb2opb.c   | 37 ++++++++++++++++++++++++-------------
>  hw/gpio/pca9552.c         |  2 +-
>  hw/i386/x86.c             |  9 +++++++++
>  hw/ppc/pnv.c              |  1 +
>  hw/remote/remote-obj.c    |  4 +++-
>  hw/remote/vfio-user-obj.c |  4 +++-
>  hw/riscv/virt.c           | 14 ++++++++++++++
>  io/net-listener.c         |  9 ++++++++-
>  net/can/can_socketcan.c   |  8 ++++++++
>  net/colo-compare.c        | 31 +++++++++++++++----------------
>  scsi/pr-manager-helper.c  |  1 +
>  system/ioport.c           | 11 +++++++++--
>  system/qtest.c            | 10 ++++++++++
>  ui/console.c              |  5 ++++-
>  target/s390x/meson.build  |  1 +
>  23 files changed, 163 insertions(+), 53 deletions(-)
>
> --
> 2.54.0
>
>

Re: [PULL 00/24] Qom patches

[Marc-André Lureau]

Hi Stefan

On Wed, May 13, 2026 at 3:20 AM Stefan Hajnoczi <stefanha@gmail.com> wrote:
>
> On Mon, May 11, 2026 at 4:21 PM <marcandre.lureau@redhat.com> wrote:
> >
> > From: Marc-André Lureau <marcandre.lureau@redhat.com>
> >
> > The following changes since commit 5e61afe211e82a9af15a8794a0bd29bb574e953b:
> >
> >   Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11 10:49:53 -0400)
> >
> > are available in the Git repository at:
> >
> >   https://gitlab.com/marcandre.lureau/qemu.git tags/qom-pull-request
> >
> > for you to fetch changes up to bc61a3209bf064826481a5f8f2b4feb47c70b02f:
> >
> >   target/s390x: add gen-features.h dependency to s390x_system_ss (2026-05-11 23:59:33 +0400)
> >
> > ----------------------------------------------------------------
> > QOM object lifecycle fixes
> >
> > ----------------------------------------------------------------
>
> Hi Marc-André,
> I'm not sure if this CI failure is related to this pull request, but
> there is a dbus-vnc issue:
>
> >>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MESON_TEST_ITERATION=1 PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh QTEST_QEMU_IMG=./qemu-img QTEST_QEMU_BINARY=./qemu-system-x86_64 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 RUST_BACKTRACE=1 MALLOC_PERTURB_=211 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/dbus-vnc-test --tap -k
>
> 754/1075 /x86_64/dbus-vnc/password-auth -
> ERROR:../tests/qtest/dbus-vnc-test.c:621:test_dbus_vnc_password_auth:
> assertion failed (qemu_vnc1_server_get_auth(proxy) == "vnc"): ("none"
> == "vnc") FAIL
>
> https://gitlab.com/qemu-project/qemu/-/jobs/14337427774#L5512
>
> Any ideas?

Embarrassingly, I have no idea. Before org.qemu.vnc is exposed by
qemu-vnc (and the auth is checked by the test), qemu-vnc must have
started a VNC server successfully (vnc_display_new)..

Fwiw, the tests runs quite smoothly locally with meson test --repeat
1000  (some time out sometime, due to heavy load).

Let's mark/run it as QEMU_TEST_FLAKY_TESTS until I figure out?


>
> Stefan
>
> >
> > Marc-André Lureau (23):
> >   hw/remote: check visit return in vfu_object_set_socket
> >   qom/object: update doc about NULL values in link properties
> >   hw/remote: guard listener unregister in finalize
> >   io/net-listener: move mutex init to instance_init
> >   net/colo-compare: guard finalize against uninitialized state
> >   ui/console: remove console from global list on finalization
> >   hw/i386/x86: free oem_id and oem_table_id on finalization
> >   hw/core/resetcontainer: free children array on finalization
> >   net/can: free ifname on socketcan finalization
> >   backends/igvm-cfg: free filename on finalization
> >   scsi/pr-manager-helper: free path on finalization
> >   accel/kvm: free device path on finalization
> >   system/qtest: add missing qtest_finalize()
> >   hw/fsi: move OPBus address space init to realize
> >   hw/fsi: move OPBus qbus_init() to instance_init
> >   hw/gpio/pca9552: fix state_str leak in pca955x_set_led
> >   hw/arm/aspeed: free fmc_model and spi_model on finalization
> >   hw/arm/sbsa-ref: free unrealized flash devices on finalization
> >   hw/arm/virt: free flash devices and OEM strings on finalization
> >   hw/ppc/pnv: drop extra ref on PHB after adding as child
> >   hw/riscv/virt: free flash devices and OEM strings on finalization
> >   meson: drop sphinx-build < 1.7 compatiblity check
> >   target/s390x: add gen-features.h dependency to s390x_system_ss
> >
> > Peter Xu (1):
> >   system/ioport: Fix qom-list-properties crash on portio list obj
> >
> >  docs/meson.build          | 14 +-------------
> >  include/qom/object.h      |  8 ++++----
> >  accel/kvm/kvm-all.c       |  8 ++++++++
> >  backends/igvm-cfg.c       |  1 +
> >  hw/arm/aspeed.c           |  9 +++++++++
> >  hw/arm/sbsa-ref.c         | 12 ++++++++++++
> >  hw/arm/virt.c             | 14 ++++++++++++++
> >  hw/core/resetcontainer.c  |  3 +++
> >  hw/fsi/aspeed_apb2opb.c   | 37 ++++++++++++++++++++++++-------------
> >  hw/gpio/pca9552.c         |  2 +-
> >  hw/i386/x86.c             |  9 +++++++++
> >  hw/ppc/pnv.c              |  1 +
> >  hw/remote/remote-obj.c    |  4 +++-
> >  hw/remote/vfio-user-obj.c |  4 +++-
> >  hw/riscv/virt.c           | 14 ++++++++++++++
> >  io/net-listener.c         |  9 ++++++++-
> >  net/can/can_socketcan.c   |  8 ++++++++
> >  net/colo-compare.c        | 31 +++++++++++++++----------------
> >  scsi/pr-manager-helper.c  |  1 +
> >  system/ioport.c           | 11 +++++++++--
> >  system/qtest.c            | 10 ++++++++++
> >  ui/console.c              |  5 ++++-
> >  target/s390x/meson.build  |  1 +
> >  23 files changed, 163 insertions(+), 53 deletions(-)
> >
> > --
> > 2.54.0
> >
> >
>

Re: [PULL 00/24] Qom patches

[Stefan Hajnoczi]

On Wed, May 13, 2026 at 3:49 AM Marc-André Lureau
<marcandre.lureau@redhat.com> wrote:
>
> Hi Stefan
>
> On Wed, May 13, 2026 at 3:20 AM Stefan Hajnoczi <stefanha@gmail.com> wrote:
> >
> > On Mon, May 11, 2026 at 4:21 PM <marcandre.lureau@redhat.com> wrote:
> > >
> > > From: Marc-André Lureau <marcandre.lureau@redhat.com>
> > >
> > > The following changes since commit 5e61afe211e82a9af15a8794a0bd29bb574e953b:
> > >
> > >   Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11 10:49:53 -0400)
> > >
> > > are available in the Git repository at:
> > >
> > >   https://gitlab.com/marcandre.lureau/qemu.git tags/qom-pull-request
> > >
> > > for you to fetch changes up to bc61a3209bf064826481a5f8f2b4feb47c70b02f:
> > >
> > >   target/s390x: add gen-features.h dependency to s390x_system_ss (2026-05-11 23:59:33 +0400)
> > >
> > > ----------------------------------------------------------------
> > > QOM object lifecycle fixes
> > >
> > > ----------------------------------------------------------------
> >
> > Hi Marc-André,
> > I'm not sure if this CI failure is related to this pull request, but
> > there is a dbus-vnc issue:
> >
> > >>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MESON_TEST_ITERATION=1 PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh QTEST_QEMU_IMG=./qemu-img QTEST_QEMU_BINARY=./qemu-system-x86_64 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 RUST_BACKTRACE=1 MALLOC_PERTURB_=211 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/dbus-vnc-test --tap -k
> >
> > 754/1075 /x86_64/dbus-vnc/password-auth -
> > ERROR:../tests/qtest/dbus-vnc-test.c:621:test_dbus_vnc_password_auth:
> > assertion failed (qemu_vnc1_server_get_auth(proxy) == "vnc"): ("none"
> > == "vnc") FAIL
> >
> > https://gitlab.com/qemu-project/qemu/-/jobs/14337427774#L5512
> >
> > Any ideas?
>
> Embarrassingly, I have no idea. Before org.qemu.vnc is exposed by
> qemu-vnc (and the auth is checked by the test), qemu-vnc must have
> started a VNC server successfully (vnc_display_new)..
>
> Fwiw, the tests runs quite smoothly locally with meson test --repeat
> 1000  (some time out sometime, due to heavy load).
>
> Let's mark/run it as QEMU_TEST_FLAKY_TESTS until I figure out?

If it helps, your last ui pull request seems to be the first
occurrence of this failure:
https://gitlab.com/qemu-project/qemu/-/commit/5e61afe211e82a9af15a8794a0bd29bb574e953b

If you'd like me to run CI on a test branch, just let me know.

Stefan

>
>
> >
> > Stefan
> >
> > >
> > > Marc-André Lureau (23):
> > >   hw/remote: check visit return in vfu_object_set_socket
> > >   qom/object: update doc about NULL values in link properties
> > >   hw/remote: guard listener unregister in finalize
> > >   io/net-listener: move mutex init to instance_init
> > >   net/colo-compare: guard finalize against uninitialized state
> > >   ui/console: remove console from global list on finalization
> > >   hw/i386/x86: free oem_id and oem_table_id on finalization
> > >   hw/core/resetcontainer: free children array on finalization
> > >   net/can: free ifname on socketcan finalization
> > >   backends/igvm-cfg: free filename on finalization
> > >   scsi/pr-manager-helper: free path on finalization
> > >   accel/kvm: free device path on finalization
> > >   system/qtest: add missing qtest_finalize()
> > >   hw/fsi: move OPBus address space init to realize
> > >   hw/fsi: move OPBus qbus_init() to instance_init
> > >   hw/gpio/pca9552: fix state_str leak in pca955x_set_led
> > >   hw/arm/aspeed: free fmc_model and spi_model on finalization
> > >   hw/arm/sbsa-ref: free unrealized flash devices on finalization
> > >   hw/arm/virt: free flash devices and OEM strings on finalization
> > >   hw/ppc/pnv: drop extra ref on PHB after adding as child
> > >   hw/riscv/virt: free flash devices and OEM strings on finalization
> > >   meson: drop sphinx-build < 1.7 compatiblity check
> > >   target/s390x: add gen-features.h dependency to s390x_system_ss
> > >
> > > Peter Xu (1):
> > >   system/ioport: Fix qom-list-properties crash on portio list obj
> > >
> > >  docs/meson.build          | 14 +-------------
> > >  include/qom/object.h      |  8 ++++----
> > >  accel/kvm/kvm-all.c       |  8 ++++++++
> > >  backends/igvm-cfg.c       |  1 +
> > >  hw/arm/aspeed.c           |  9 +++++++++
> > >  hw/arm/sbsa-ref.c         | 12 ++++++++++++
> > >  hw/arm/virt.c             | 14 ++++++++++++++
> > >  hw/core/resetcontainer.c  |  3 +++
> > >  hw/fsi/aspeed_apb2opb.c   | 37 ++++++++++++++++++++++++-------------
> > >  hw/gpio/pca9552.c         |  2 +-
> > >  hw/i386/x86.c             |  9 +++++++++
> > >  hw/ppc/pnv.c              |  1 +
> > >  hw/remote/remote-obj.c    |  4 +++-
> > >  hw/remote/vfio-user-obj.c |  4 +++-
> > >  hw/riscv/virt.c           | 14 ++++++++++++++
> > >  io/net-listener.c         |  9 ++++++++-
> > >  net/can/can_socketcan.c   |  8 ++++++++
> > >  net/colo-compare.c        | 31 +++++++++++++++----------------
> > >  scsi/pr-manager-helper.c  |  1 +
> > >  system/ioport.c           | 11 +++++++++--
> > >  system/qtest.c            | 10 ++++++++++
> > >  ui/console.c              |  5 ++++-
> > >  target/s390x/meson.build  |  1 +
> > >  23 files changed, 163 insertions(+), 53 deletions(-)
> > >
> > > --
> > > 2.54.0
> > >
> > >
> >

Re: [PULL 00/24] Qom patches

[Marc-André Lureau]

Hi

On Wed, May 13, 2026 at 11:05 PM Stefan Hajnoczi <stefanha@gmail.com> wrote:
>
> On Wed, May 13, 2026 at 3:49 AM Marc-André Lureau
> <marcandre.lureau@redhat.com> wrote:
> >
> > Hi Stefan
> >
> > On Wed, May 13, 2026 at 3:20 AM Stefan Hajnoczi <stefanha@gmail.com> wrote:
> > >
> > > On Mon, May 11, 2026 at 4:21 PM <marcandre.lureau@redhat.com> wrote:
> > > >
> > > > From: Marc-André Lureau <marcandre.lureau@redhat.com>
> > > >
> > > > The following changes since commit 5e61afe211e82a9af15a8794a0bd29bb574e953b:
> > > >
> > > >   Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11 10:49:53 -0400)
> > > >
> > > > are available in the Git repository at:
> > > >
> > > >   https://gitlab.com/marcandre.lureau/qemu.git tags/qom-pull-request
> > > >
> > > > for you to fetch changes up to bc61a3209bf064826481a5f8f2b4feb47c70b02f:
> > > >
> > > >   target/s390x: add gen-features.h dependency to s390x_system_ss (2026-05-11 23:59:33 +0400)
> > > >
> > > > ----------------------------------------------------------------
> > > > QOM object lifecycle fixes
> > > >
> > > > ----------------------------------------------------------------
> > >
> > > Hi Marc-André,
> > > I'm not sure if this CI failure is related to this pull request, but
> > > there is a dbus-vnc issue:
> > >
> > > >>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MESON_TEST_ITERATION=1 PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh QTEST_QEMU_IMG=./qemu-img QTEST_QEMU_BINARY=./qemu-system-x86_64 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 RUST_BACKTRACE=1 MALLOC_PERTURB_=211 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/dbus-vnc-test --tap -k
> > >
> > > 754/1075 /x86_64/dbus-vnc/password-auth -
> > > ERROR:../tests/qtest/dbus-vnc-test.c:621:test_dbus_vnc_password_auth:
> > > assertion failed (qemu_vnc1_server_get_auth(proxy) == "vnc"): ("none"
> > > == "vnc") FAIL
> > >
> > > https://gitlab.com/qemu-project/qemu/-/jobs/14337427774#L5512
> > >
> > > Any ideas?
> >
> > Embarrassingly, I have no idea. Before org.qemu.vnc is exposed by
> > qemu-vnc (and the auth is checked by the test), qemu-vnc must have
> > started a VNC server successfully (vnc_display_new)..
> >
> > Fwiw, the tests runs quite smoothly locally with meson test --repeat
> > 1000  (some time out sometime, due to heavy load).
> >
> > Let's mark/run it as QEMU_TEST_FLAKY_TESTS until I figure out?
>
> If it helps, your last ui pull request seems to be the first
> occurrence of this failure:
> https://gitlab.com/qemu-project/qemu/-/commit/5e61afe211e82a9af15a8794a0bd29bb574e953b
>
> If you'd like me to run CI on a test branch, just let me know.

It's new code, from the patches introducing qemu-vnc & the test. Let's
just skip the test for now by default.
(https://patchew.org/QEMU/20260513082517.1720433-1-marcandre.lureau@redhat.com/)
Would you like me to send a new PR?

Re: [PULL 00/24] Qom patches

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 3740 bytes --]

On Wed, May 13, 2026, 15:16 Marc-André Lureau <marcandre.lureau@redhat.com>
wrote:

> Hi
>
> On Wed, May 13, 2026 at 11:05 PM Stefan Hajnoczi <stefanha@gmail.com>
> wrote:
> >
> > On Wed, May 13, 2026 at 3:49 AM Marc-André Lureau
> > <marcandre.lureau@redhat.com> wrote:
> > >
> > > Hi Stefan
> > >
> > > On Wed, May 13, 2026 at 3:20 AM Stefan Hajnoczi <stefanha@gmail.com>
> wrote:
> > > >
> > > > On Mon, May 11, 2026 at 4:21 PM <marcandre.lureau@redhat.com> wrote:
> > > > >
> > > > > From: Marc-André Lureau <marcandre.lureau@redhat.com>
> > > > >
> > > > > The following changes since commit
> 5e61afe211e82a9af15a8794a0bd29bb574e953b:
> > > > >
> > > > >   Merge tag 'ui-pull-request' of
> https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11
> 10:49:53 -0400)
> > > > >
> > > > > are available in the Git repository at:
> > > > >
> > > > >   https://gitlab.com/marcandre.lureau/qemu.git
> tags/qom-pull-request
> > > > >
> > > > > for you to fetch changes up to
> bc61a3209bf064826481a5f8f2b4feb47c70b02f:
> > > > >
> > > > >   target/s390x: add gen-features.h dependency to s390x_system_ss
> (2026-05-11 23:59:33 +0400)
> > > > >
> > > > > ----------------------------------------------------------------
> > > > > QOM object lifecycle fixes
> > > > >
> > > > > ----------------------------------------------------------------
> > > >
> > > > Hi Marc-André,
> > > > I'm not sure if this CI failure is related to this pull request, but
> > > > there is a dbus-vnc issue:
> > > >
> > > > >>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1
> QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MESON_TEST_ITERATION=1
> PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3
> QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon
> G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh
> QTEST_QEMU_IMG=./qemu-img QTEST_QEMU_BINARY=./qemu-system-x86_64
> UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1
> RUST_BACKTRACE=1 MALLOC_PERTURB_=211
> MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1
> /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/dbus-vnc-test
> --tap -k
> > > >
> > > > 754/1075 /x86_64/dbus-vnc/password-auth -
> > > > ERROR:../tests/qtest/dbus-vnc-test.c:621:test_dbus_vnc_password_auth:
> > > > assertion failed (qemu_vnc1_server_get_auth(proxy) == "vnc"): ("none"
> > > > == "vnc") FAIL
> > > >
> > > > https://gitlab.com/qemu-project/qemu/-/jobs/14337427774#L5512
> > > >
> > > > Any ideas?
> > >
> > > Embarrassingly, I have no idea. Before org.qemu.vnc is exposed by
> > > qemu-vnc (and the auth is checked by the test), qemu-vnc must have
> > > started a VNC server successfully (vnc_display_new)..
> > >
> > > Fwiw, the tests runs quite smoothly locally with meson test --repeat
> > > 1000  (some time out sometime, due to heavy load).
> > >
> > > Let's mark/run it as QEMU_TEST_FLAKY_TESTS until I figure out?
> >
> > If it helps, your last ui pull request seems to be the first
> > occurrence of this failure:
> >
> https://gitlab.com/qemu-project/qemu/-/commit/5e61afe211e82a9af15a8794a0bd29bb574e953b
> >
> > If you'd like me to run CI on a test branch, just let me know.
>
> It's new code, from the patches introducing qemu-vnc & the test. Let's
> just skip the test for now by default.
> (
> https://patchew.org/QEMU/20260513082517.1720433-1-marcandre.lureau@redhat.com/
> )
> Would you like me to send a new PR?
>

No, it's okay. I can merge your patch directly into master.

Stefan

>

[-- Attachment #2: Type: text/html, Size: 6018 bytes --]

Re: [PULL 00/24] Qom patches

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]