[PATCH 0/7] Fixes for 11.1

[PATCH 0/7] Fixes for 11.1

[Marc-André Lureau]

Hi

Here are some assorted patches worth considering for the 11.1 freeze
bug-fix period.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
Marc-André Lureau (7):
      hw/display/virtio-gpu-rutabaga: zero-init capset info response
      block/blkio: fix error return value on getlength()
      Fix many -Werror=maybe-uninitialized
      hw/hexagon: fix machine->fdt leak in qom-test
      hw/core/machine: free machine->fdt in machine_finalize()
      migration/multifd: fix Error leak in multifd_recv_terminate_threads()
      qdev-monitor: drain RCU callbacks in qdev_device_add_from_qdict

 block/blkio.c                    |  8 ++++----
 block/qcow2.c                    |  2 +-
 hw/core/machine.c                |  1 +
 hw/cxl/cxl-host.c                |  2 +-
 hw/display/virtio-gpu-rutabaga.c |  2 ++
 hw/hexagon/virt.c                |  9 +--------
 hw/scsi/scsi-disk.c              |  2 +-
 hw/scsi/scsi-generic.c           |  4 ++--
 hw/scsi/virtio-scsi.c            |  2 +-
 io/net-listener.c                | 10 +++++-----
 migration/multifd.c              |  1 +
 system/qdev-monitor.c            | 33 ++++++++++-----------------------
 target/i386/cpu.c                |  3 ++-
 target/i386/emulate/x86_mmu.c    |  4 ++--
 14 files changed, 34 insertions(+), 49 deletions(-)
---
base-commit: 300438ffbb8d9430cac2fcc15cba6f482b2c0587
change-id: 20260725-fix2-6e51d231794b

Best regards,
--  
Marc-André Lureau <marcandre.lureau@redhat.com>

[PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

[Marc-André Lureau]

rutabaga_cmd_get_capset_info() only fills in capset_id,
capset_max_version and capset_max_size before sending the response to
the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
stack garbage and leaked to the guest, including host pointers useful
for an ASLR bypass.

Zero the response first, matching virgl_cmd_get_capset_info().

Not a real risk thanks to -ftrivial-auto-var-init=zero.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
Reported-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu-rutabaga.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index 4d7d7b245929..95a19eed7eda 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
 
     VIRTIO_GPU_FILL_CMD(info);
 
+    memset(&resp, 0, sizeof(resp));
+
     result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
                                       &resp.capset_id, &resp.capset_max_version,
                                       &resp.capset_max_size);

-- 
2.55.0

[PATCH 2/7] block/blkio: fix error return value on getlength()

[Marc-André Lureau]

Negative values should be return for errors.

It also helps with GCC false-positives:
../block/blkio.c: In function ‘blkio_co_getlength’:
../block/blkio.c:943:8: error: ‘ret’ may be used uninitialized [-Werror=maybe-uninitialized]
  943 |     if (ret < 0) {
      |        ^

Fixes: fd66dbd424 ("blkio: add libblkio block driver")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 block/blkio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index fb8bec27d71a..d2ba2a4d58dc 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -935,13 +935,13 @@ static int64_t coroutine_fn blkio_co_getlength(BlockDriverState *bs)
 {
     BDRVBlkioState *s = bs->opaque;
     uint64_t capacity;
-    int ret;
+    int ret = -1;
 
     WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
         ret = blkio_get_uint64(s->blkio, "capacity", &capacity);
     }
     if (ret < 0) {
-        return -ret;
+        return ret;
     }
 
     return capacity;

-- 
2.55.0

[PATCH 3/7] Fix many -Werror=maybe-uninitialized

[Marc-André Lureau]

When compiled with -Og, gcc produces many false-positives
gcc (GCC) 16.1.1 20260515 (Red Hat 16.1.1-2).

We already use auto-var-init=zero, but better be explicit.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 block/blkio.c                 |  4 ++--
 block/qcow2.c                 |  2 +-
 hw/cxl/cxl-host.c             |  2 +-
 hw/scsi/scsi-disk.c           |  2 +-
 hw/scsi/scsi-generic.c        |  4 ++--
 hw/scsi/virtio-scsi.c         |  2 +-
 io/net-listener.c             | 10 +++++-----
 target/i386/cpu.c             |  3 ++-
 target/i386/emulate/x86_mmu.c |  4 ++--
 9 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index d2ba2a4d58dc..f7cb6e0b57d4 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -278,7 +278,7 @@ static bool blkio_completion_fd_poll(void *opaque)
 {
     BlockDriverState *bs = opaque;
     BDRVBlkioState *s = bs->opaque;
-    int ret;
+    int ret = -1;
 
     /* Just in case we already fetched a completion */
     if (s->poll_completion.user_data != NULL) {
@@ -559,7 +559,7 @@ static bool blkio_register_buf(BlockDriverState *bs, void *host, size_t size,
     BDRVBlkioState *s = bs->opaque;
     struct blkio_mem_region region;
     BlkioMemRegionResult region_result;
-    int ret;
+    int ret = -1;
 
     /*
      * Mapping memory regions conflicts with RAM discard (virtio-mem) when
diff --git a/block/qcow2.c b/block/qcow2.c
index 19271b10a49f..639593d737c8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -838,7 +838,7 @@ static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
 static void coroutine_fn cache_clean_timer(void *opaque)
 {
     BDRVQcow2State *s = opaque;
-    uint64_t wait_ns;
+    uint64_t wait_ns = 0;
 
     WITH_QEMU_LOCK_GUARD(&s->lock) {
         wait_ns = s->cache_clean_interval * NANOSECONDS_PER_SECOND;
diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
index 7e744312f1d8..eba13c9e7cba 100644
--- a/hw/cxl/cxl-host.c
+++ b/hw/cxl/cxl-host.c
@@ -279,7 +279,7 @@ static void cxl_fmws_direct_passthrough_setup(CXLDirectPTState *state,
     MemoryRegion *mr = NULL;
     uint64_t vmr_size = 0, pmr_size = 0, offset = 0;
     MemoryRegion *direct_mr;
-    g_autofree char *direct_mr_name;
+    g_autofree char *direct_mr_name = NULL;
     unsigned int idx = state->hdm_decoder_idx;
 
     if (ct3d->hostvmem) {
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index 1b0cce128c5e..82dc75cb7d10 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -3263,7 +3263,7 @@ static bool scsi_disk_pr_state_needed(void *opaque)
 {
     SCSIDiskState *s = opaque;
     SCSIPRState *pr_state = &s->qdev.pr_state;
-    bool ret;
+    bool ret = false;
 
     if (!s->qdev.migrate_pr) {
         return false;
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 8999f3b72006..b044561ae2dd 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -553,8 +553,8 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp)
     SCSIPRState *pr_state = &s->pr_state;
     Error *local_err = NULL;
     bool check_stale_key = true;
-    uint64_t key;
-    uint8_t resv_type;
+    uint64_t key = 0;
+    uint8_t resv_type = 0;
 
     /* Get the migrated PR state */
     WITH_QEMU_LOCK_GUARD(&pr_state->mutex) {
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 6c7376801190..833f773d7f6c 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1093,7 +1093,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
 
 static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
 {
-    bool events_dropped;
+    bool events_dropped = false;
 
     WITH_QEMU_LOCK_GUARD(&s->event_lock) {
         events_dropped = s->events_dropped;
diff --git a/io/net-listener.c b/io/net-listener.c
index 1fd0f6cb5ab8..8df19c35bd8f 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -54,11 +54,11 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
                                               gpointer opaque)
 {
     QIONetListener *listener = QIO_NET_LISTENER(opaque);
-    QIOChannelSocket *sioc;
-    QIONetListenerClientFunc io_func;
-    gpointer io_data;
-    GMainContext *context;
-    AioContext *aio_context;
+    QIOChannelSocket *sioc = NULL;
+    QIONetListenerClientFunc io_func = NULL;
+    gpointer io_data = NULL;
+    GMainContext *context = NULL;
+    AioContext *aio_context = NULL;
 
     sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc),
                                      NULL);
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5805d33ab92d..e9759ab25077 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7734,7 +7734,7 @@ static void x86_cpuid_get_avx10_version(Object *obj, Visitor *v,
 static bool x86_cpu_apply_avx10_features(X86CPU *cpu, uint8_t version,
                                          Error **errp)
 {
-    const AVX10VersionDefinition *def;
+    const AVX10VersionDefinition *def = NULL;
     CPUX86State *env = &cpu->env;
 
     if (!version) {
@@ -7758,6 +7758,7 @@ static bool x86_cpu_apply_avx10_features(X86CPU *cpu, uint8_t version,
         }
     }
 
+    assert(def != NULL);
     if (def->version < version) {
         error_setg(errp, "avx10-version can be at most %d", def->version);
         return false;
diff --git a/target/i386/emulate/x86_mmu.c b/target/i386/emulate/x86_mmu.c
index 8d4371467fd7..c1cb385b3228 100644
--- a/target/i386/emulate/x86_mmu.c
+++ b/target/i386/emulate/x86_mmu.c
@@ -185,8 +185,8 @@ static MMUTranslateResult walk_gpt(CPUState *cpu, target_ulong addr, MMUTranslat
     int largeness = 0;
     target_ulong cr3 = x86_read_cr(cpu, 3);
     uint64_t page_mask = pae ? PAE_PTE_PAGE_MASK : LEGACY_PTE_PAGE_MASK;
-    MMUTranslateResult res;
-    
+    MMUTranslateResult res = 0;
+
     memset(pt, 0, sizeof(*pt));
     top_level = gpt_top_level(cpu, pae);
 

-- 
2.55.0

[PATCH 4/7] hw/hexagon: fix machine->fdt leak in qom-test

[Marc-André Lureau]

virt_instance_init() built the FDT unconditionally at QOM
instance-init time, so simply instantiating the object (e.g. via
qom-test's introspection, without ever realizing the machine) leaked
the 1MB FDT blob: machine_finalize() does not free machine->fdt.

Other boards (arm/virt, riscv/virt, ...) build the FDT lazily from
their MachineClass::init callback, which only runs when the machine
is actually selected to boot. Do the same here by moving create_fdt()
into virt_init().

Fixes: 88a8bc7f43ff ("hw/hexagon: Define hexagon "virt" machine")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/hexagon/virt.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/hw/hexagon/virt.c b/hw/hexagon/virt.c
index a3638998b873..b75047250260 100644
--- a/hw/hexagon/virt.c
+++ b/hw/hexagon/virt.c
@@ -175,13 +175,6 @@ static void fdt_add_cpu_nodes(const HexagonVirtMachineState *vms)
 
 
 
-static void virt_instance_init(Object *obj)
-{
-    HexagonVirtMachineState *vms = HEXAGON_VIRT_MACHINE(obj);
-
-    create_fdt(vms);
-}
-
 void hexagon_load_fdt(const HexagonVirtMachineState *vms)
 {
     MachineState *ms = MACHINE(vms);
@@ -242,6 +235,7 @@ static void virt_init(MachineState *ms)
     DeviceState *cpu0;
     int32_t clk_phandle;
 
+    create_fdt(vms);
     qemu_fdt_setprop_string(ms->fdt, "/chosen", "bootargs", ms->kernel_cmdline);
 
     vms->sys = get_system_memory();
@@ -341,7 +335,6 @@ static const TypeInfo virt_machine_types[] = { {
     .parent = TYPE_HEXAGON_COMMON_MACHINE,
     .instance_size = sizeof(HexagonVirtMachineState),
     .class_init = virt_class_init,
-    .instance_init = virt_instance_init,
 } };
 
 DEFINE_TYPES(virt_machine_types)

-- 
2.55.0

[PATCH 5/7] hw/core/machine: free machine->fdt in machine_finalize()

[Marc-André Lureau]

machine->fdt is a plain g_malloc0() buffer (see create_device_tree())
that boards populate during MachineClass::init, but machine_finalize()
never freed it, unlike the other boot-time buffers (dtb, dumpdtb,
kernel_filename, ...). Free it for consistency.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/core/machine.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 805148678d57..2b24d711d76f 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1301,6 +1301,7 @@ static void machine_finalize(Object *obj)
     g_free(ms->kernel_cmdline);
     g_free(ms->dtb);
     g_free(ms->dumpdtb);
+    g_free(ms->fdt);
     g_free(ms->dt_compatible);
     g_free(ms->firmware);
     g_free(ms->device_memory);

-- 
2.55.0

[PATCH 6/7] migration/multifd: fix Error leak in multifd_recv_terminate_threads()

[Marc-André Lureau]

If err != NULL, free it.

Fixes: 11dd7be57524 ("migration/multifd: Remove p->quit from recv side")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 migration/multifd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/migration/multifd.c b/migration/multifd.c
index dbad525d2a28..503014f76ba5 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -1056,6 +1056,7 @@ static void multifd_recv_terminate_threads(Error *err)
     trace_multifd_recv_terminate_threads(err != NULL);
 
     if (qatomic_xchg(&multifd_recv_state->exiting, 1)) {
+        error_free(err);
         return;
     }
 

-- 
2.55.0

[PATCH 7/7] qdev-monitor: drain RCU callbacks in qdev_device_add_from_qdict

[Marc-André Lureau]

qmp_device_add() and hmp_device_add() drain pending RCU callbacks after
a failed device_add, since some bus teardown (e.g. bus_remove_child())
is deferred to call_rcu(). -device on the command line reaches the same
qdev_device_add_from_qdict() with errp pointing at error_fatal, whose
ERRP_GUARD() exits before control returns to the caller, so the caller's
drain_call_rcu() never runs.

Move the drain into qdev_device_add_from_qdict()'s own err_del_dev path
so it always runs, and drop the now-redundant calls in qmp_device_add()
and hmp_device_add().

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 system/qdev-monitor.c | 33 ++++++++++-----------------------
 1 file changed, 10 insertions(+), 23 deletions(-)

diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
index 00fed791cce1..884d407d60d4 100644
--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
@@ -746,6 +746,16 @@ err_del_dev:
     object_unparent(OBJECT(dev));
     object_unref(OBJECT(dev));
 
+    /*
+     * Drain all pending RCU callbacks. This is done because some bus
+     * related operations can delay a device removal (in this case this
+     * can happen if device is added and then removed due to a
+     * configuration error) to a RCU callback, but a caller might expect
+     * the failed device to be fully torn down once this function
+     * returns.
+     */
+    drain_call_rcu();
+
     return NULL;
 }
 
@@ -870,18 +880,6 @@ void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp)
     DeviceState *dev;
 
     dev = qdev_device_add_from_qdict(qdict, true, errp);
-    if (!dev) {
-        /*
-         * Drain all pending RCU callbacks. This is done because
-         * some bus related operations can delay a device removal
-         * (in this case this can happen if device is added and then
-         * removed due to a configuration error)
-         * to a RCU callback, but user might expect that this interface
-         * will finish its job completely once qmp command returns result
-         * to the user
-         */
-        drain_call_rcu();
-    }
     object_unref(OBJECT(dev));
 }
 
@@ -1017,17 +1015,6 @@ void hmp_device_add(Monitor *mon, const QDict *qdict)
     }
     dev = qdev_device_add(opts, &err);
     if (!dev) {
-        /*
-         * Drain all pending RCU callbacks. This is done because
-         * some bus related operations can delay a device removal
-         * (in this case this can happen if device is added and then
-         * removed due to a configuration error)
-         * to a RCU callback, but user might expect that this interface
-         * will finish its job completely once qmp command returns result
-         * to the user
-         */
-        drain_call_rcu();
-
         qemu_opts_del(opts);
     }
     object_unref(dev);

-- 
2.55.0

Re: [PATCH 7/7] qdev-monitor: drain RCU callbacks in qdev_device_add_from_qdict

[Akihiko Odaki]

On 2026/07/25 23:00, Marc-André Lureau wrote:
> qmp_device_add() and hmp_device_add() drain pending RCU callbacks after
> a failed device_add, since some bus teardown (e.g. bus_remove_child())
> is deferred to call_rcu(). -device on the command line reaches the same
> qdev_device_add_from_qdict() with errp pointing at error_fatal, whose
> ERRP_GUARD() exits before control returns to the caller, so the caller's
> drain_call_rcu() never runs.
> 
> Move the drain into qdev_device_add_from_qdict()'s own err_del_dev path
> so it always runs, and drop the now-redundant calls in qmp_device_add()
> and hmp_device_add().

It is reachable from virtio-net failover during guest feature 
negotiation. MMIO dispatch holds an RCU read lock at 
address_space_write(). If deferred primary creation fails, 
drain_call_rcu() waits for a grace period while its own thread remains a 
reader, deadlocking the VM.

Regards,
Akihiko Odaki

> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   system/qdev-monitor.c | 33 ++++++++++-----------------------
>   1 file changed, 10 insertions(+), 23 deletions(-)
> 
> diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
> index 00fed791cce1..884d407d60d4 100644
> --- a/system/qdev-monitor.c
> +++ b/system/qdev-monitor.c
> @@ -746,6 +746,16 @@ err_del_dev:
>       object_unparent(OBJECT(dev));
>       object_unref(OBJECT(dev));
>   
> +    /*
> +     * Drain all pending RCU callbacks. This is done because some bus
> +     * related operations can delay a device removal (in this case this
> +     * can happen if device is added and then removed due to a
> +     * configuration error) to a RCU callback, but a caller might expect
> +     * the failed device to be fully torn down once this function
> +     * returns.
> +     */
> +    drain_call_rcu();
> +
>       return NULL;
>   }
>   
> @@ -870,18 +880,6 @@ void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp)
>       DeviceState *dev;
>   
>       dev = qdev_device_add_from_qdict(qdict, true, errp);
> -    if (!dev) {
> -        /*
> -         * Drain all pending RCU callbacks. This is done because
> -         * some bus related operations can delay a device removal
> -         * (in this case this can happen if device is added and then
> -         * removed due to a configuration error)
> -         * to a RCU callback, but user might expect that this interface
> -         * will finish its job completely once qmp command returns result
> -         * to the user
> -         */
> -        drain_call_rcu();
> -    }
>       object_unref(OBJECT(dev));
>   }
>   
> @@ -1017,17 +1015,6 @@ void hmp_device_add(Monitor *mon, const QDict *qdict)
>       }
>       dev = qdev_device_add(opts, &err);
>       if (!dev) {
> -        /*
> -         * Drain all pending RCU callbacks. This is done because
> -         * some bus related operations can delay a device removal
> -         * (in this case this can happen if device is added and then
> -         * removed due to a configuration error)
> -         * to a RCU callback, but user might expect that this interface
> -         * will finish its job completely once qmp command returns result
> -         * to the user
> -         */
> -        drain_call_rcu();
> -
>           qemu_opts_del(opts);
>       }
>       object_unref(dev);
> 

Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

[Akihiko Odaki]

On 2026/07/25 23:00, Marc-André Lureau wrote:
> rutabaga_cmd_get_capset_info() only fills in capset_id,
> capset_max_version and capset_max_size before sending the response to
> the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
> including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
> stack garbage and leaked to the guest, including host pointers useful
> for an ASLR bypass.
> 
> Zero the response first, matching virgl_cmd_get_capset_info().
> 
> Not a real risk thanks to -ftrivial-auto-var-init=zero.

GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still 
supports GCC 10.4/11.

Regards,
Akihiko Odaki

> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
> Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
> Reported-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   hw/display/virtio-gpu-rutabaga.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
> index 4d7d7b245929..95a19eed7eda 100644
> --- a/hw/display/virtio-gpu-rutabaga.c
> +++ b/hw/display/virtio-gpu-rutabaga.c
> @@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
>   
>       VIRTIO_GPU_FILL_CMD(info);
>   
> +    memset(&resp, 0, sizeof(resp));
> +
>       result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
>                                         &resp.capset_id, &resp.capset_max_version,
>                                         &resp.capset_max_size);
> 

Re: [PATCH 2/7] block/blkio: fix error return value on getlength()

[Akihiko Odaki]

On 2026/07/25 23:00, Marc-André Lureau wrote:
> Negative values should be return for errors.

Nit: s/return/returned/

> 
> It also helps with GCC false-positives:
> ../block/blkio.c: In function ‘blkio_co_getlength’:
> ../block/blkio.c:943:8: error: ‘ret’ may be used uninitialized [-Werror=maybe-uninitialized]
>    943 |     if (ret < 0) {
>        |        ^
> 
> Fixes: fd66dbd424 ("blkio: add libblkio block driver")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   block/blkio.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/block/blkio.c b/block/blkio.c
> index fb8bec27d71a..d2ba2a4d58dc 100644
> --- a/block/blkio.c
> +++ b/block/blkio.c
> @@ -935,13 +935,13 @@ static int64_t coroutine_fn blkio_co_getlength(BlockDriverState *bs)
>   {
>       BDRVBlkioState *s = bs->opaque;
>       uint64_t capacity;
> -    int ret;
> +    int ret = -1;

Initializing a variable with a dummy value can suppress a useful 
warning. Replacing WITH_QEMU_LOCK_GUARD() with QEMU_LOCK_GUARD() will 
fix it without introducing a dummy value and also result in a bit 
simpler code.

Regards,
Akihiko Odaki

>   
>       WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
>           ret = blkio_get_uint64(s->blkio, "capacity", &capacity);
>       }
>       if (ret < 0) {
> -        return -ret;
> +        return ret;
>       }
>   
>       return capacity;
> 

Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

[Marc-André Lureau]

Hi

On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
<odaki@rsg.ci.i.u-tokyo.ac.jp> wrote:
>
> On 2026/07/25 23:00, Marc-André Lureau wrote:
> > rutabaga_cmd_get_capset_info() only fills in capset_id,
> > capset_max_version and capset_max_size before sending the response to
> > the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
> > including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
> > stack garbage and leaked to the guest, including host pointers useful
> > for an ASLR bypass.
> >
> > Zero the response first, matching virgl_cmd_get_capset_info().
> >
> > Not a real risk thanks to -ftrivial-auto-var-init=zero.
>
> GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
> supports GCC 10.4/11.
>

Good point, may be we should update:
https://patchew.org/QEMU/20260723094622.1515831-1-berrange@redhat.com/

ack otherwise?

> Regards,
> Akihiko Odaki
>
> >
> > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
> > Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
> > Reported-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
> > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> > ---
> >   hw/display/virtio-gpu-rutabaga.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
> > index 4d7d7b245929..95a19eed7eda 100644
> > --- a/hw/display/virtio-gpu-rutabaga.c
> > +++ b/hw/display/virtio-gpu-rutabaga.c
> > @@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
> >
> >       VIRTIO_GPU_FILL_CMD(info);
> >
> > +    memset(&resp, 0, sizeof(resp));
> > +
> >       result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
> >                                         &resp.capset_id, &resp.capset_max_version,
> >                                         &resp.capset_max_size);
> >
>

Re: [PATCH 3/7] Fix many -Werror=maybe-uninitialized

[Akihiko Odaki]

On 2026/07/25 23:00, Marc-André Lureau wrote:
> When compiled with -Og, gcc produces many false-positives
> gcc (GCC) 16.1.1 20260515 (Red Hat 16.1.1-2).
> 
> We already use auto-var-init=zero, but better be explicit.

I'm kind of reluctant to describe it is more explicit and it is better. 
The variables causing the false positives do not contain a useful value 
until later assignments. Initializing them obscures the fact and 
suppresses useful warnings. This patch may serve as a workaround, but 
its scope should be minimized.

I think WITH_QEMU_LOCK_GUARD() should be fixed to explicitly tell that 
the block is unconditionally executed. Linux does so, for example:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fcc22ac5baf06dd17193de44b60dbceea6461983
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   block/blkio.c                 |  4 ++--
>   block/qcow2.c                 |  2 +-
>   hw/cxl/cxl-host.c             |  2 +-
>   hw/scsi/scsi-disk.c           |  2 +-
>   hw/scsi/scsi-generic.c        |  4 ++--
>   hw/scsi/virtio-scsi.c         |  2 +-
>   io/net-listener.c             | 10 +++++-----
>   target/i386/cpu.c             |  3 ++-
>   target/i386/emulate/x86_mmu.c |  4 ++--
>   9 files changed, 17 insertions(+), 16 deletions(-)
> 
> diff --git a/block/blkio.c b/block/blkio.c
> index d2ba2a4d58dc..f7cb6e0b57d4 100644
> --- a/block/blkio.c
> +++ b/block/blkio.c
> @@ -278,7 +278,7 @@ static bool blkio_completion_fd_poll(void *opaque)
>   {
>       BlockDriverState *bs = opaque;
>       BDRVBlkioState *s = bs->opaque;
> -    int ret;
> +    int ret = -1;
>   
>       /* Just in case we already fetched a completion */
>       if (s->poll_completion.user_data != NULL) {
> @@ -559,7 +559,7 @@ static bool blkio_register_buf(BlockDriverState *bs, void *host, size_t size,
>       BDRVBlkioState *s = bs->opaque;
>       struct blkio_mem_region region;
>       BlkioMemRegionResult region_result;
> -    int ret;
> +    int ret = -1;
>   
>       /*
>        * Mapping memory regions conflicts with RAM discard (virtio-mem) when
> diff --git a/block/qcow2.c b/block/qcow2.c
> index 19271b10a49f..639593d737c8 100644
> --- a/block/qcow2.c
> +++ b/block/qcow2.c
> @@ -838,7 +838,7 @@ static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
>   static void coroutine_fn cache_clean_timer(void *opaque)
>   {
>       BDRVQcow2State *s = opaque;
> -    uint64_t wait_ns;
> +    uint64_t wait_ns = 0;
>   
>       WITH_QEMU_LOCK_GUARD(&s->lock) {
>           wait_ns = s->cache_clean_interval * NANOSECONDS_PER_SECOND;
> diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
> index 7e744312f1d8..eba13c9e7cba 100644
> --- a/hw/cxl/cxl-host.c
> +++ b/hw/cxl/cxl-host.c
> @@ -279,7 +279,7 @@ static void cxl_fmws_direct_passthrough_setup(CXLDirectPTState *state,
>       MemoryRegion *mr = NULL;
>       uint64_t vmr_size = 0, pmr_size = 0, offset = 0;
>       MemoryRegion *direct_mr;
> -    g_autofree char *direct_mr_name;
> +    g_autofree char *direct_mr_name = NULL;

This fixes a real issue, not a false positive. An early return can 
trigger a cleanup on an uninitialized variable.

Regards,
Akihiko Odaki

>       unsigned int idx = state->hdm_decoder_idx;
>   
>       if (ct3d->hostvmem) {
> diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
> index 1b0cce128c5e..82dc75cb7d10 100644
> --- a/hw/scsi/scsi-disk.c
> +++ b/hw/scsi/scsi-disk.c
> @@ -3263,7 +3263,7 @@ static bool scsi_disk_pr_state_needed(void *opaque)
>   {
>       SCSIDiskState *s = opaque;
>       SCSIPRState *pr_state = &s->qdev.pr_state;
> -    bool ret;
> +    bool ret = false;
>   
>       if (!s->qdev.migrate_pr) {
>           return false;
> diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
> index 8999f3b72006..b044561ae2dd 100644
> --- a/hw/scsi/scsi-generic.c
> +++ b/hw/scsi/scsi-generic.c
> @@ -553,8 +553,8 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp)
>       SCSIPRState *pr_state = &s->pr_state;
>       Error *local_err = NULL;
>       bool check_stale_key = true;
> -    uint64_t key;
> -    uint8_t resv_type;
> +    uint64_t key = 0;
> +    uint8_t resv_type = 0;
>   
>       /* Get the migrated PR state */
>       WITH_QEMU_LOCK_GUARD(&pr_state->mutex) {
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index 6c7376801190..833f773d7f6c 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -1093,7 +1093,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
>   
>   static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
>   {
> -    bool events_dropped;
> +    bool events_dropped = false;
>   
>       WITH_QEMU_LOCK_GUARD(&s->event_lock) {
>           events_dropped = s->events_dropped;
> diff --git a/io/net-listener.c b/io/net-listener.c
> index 1fd0f6cb5ab8..8df19c35bd8f 100644
> --- a/io/net-listener.c
> +++ b/io/net-listener.c
> @@ -54,11 +54,11 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
>                                                 gpointer opaque)
>   {
>       QIONetListener *listener = QIO_NET_LISTENER(opaque);
> -    QIOChannelSocket *sioc;
> -    QIONetListenerClientFunc io_func;
> -    gpointer io_data;
> -    GMainContext *context;
> -    AioContext *aio_context;
> +    QIOChannelSocket *sioc = NULL;
> +    QIONetListenerClientFunc io_func = NULL;
> +    gpointer io_data = NULL;
> +    GMainContext *context = NULL;
> +    AioContext *aio_context = NULL;
>   
>       sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc),
>                                        NULL);
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 5805d33ab92d..e9759ab25077 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -7734,7 +7734,7 @@ static void x86_cpuid_get_avx10_version(Object *obj, Visitor *v,
>   static bool x86_cpu_apply_avx10_features(X86CPU *cpu, uint8_t version,
>                                            Error **errp)
>   {
> -    const AVX10VersionDefinition *def;
> +    const AVX10VersionDefinition *def = NULL;
>       CPUX86State *env = &cpu->env;
>   
>       if (!version) {
> @@ -7758,6 +7758,7 @@ static bool x86_cpu_apply_avx10_features(X86CPU *cpu, uint8_t version,
>           }
>       }
>   
> +    assert(def != NULL);
>       if (def->version < version) {
>           error_setg(errp, "avx10-version can be at most %d", def->version);
>           return false;
> diff --git a/target/i386/emulate/x86_mmu.c b/target/i386/emulate/x86_mmu.c
> index 8d4371467fd7..c1cb385b3228 100644
> --- a/target/i386/emulate/x86_mmu.c
> +++ b/target/i386/emulate/x86_mmu.c
> @@ -185,8 +185,8 @@ static MMUTranslateResult walk_gpt(CPUState *cpu, target_ulong addr, MMUTranslat
>       int largeness = 0;
>       target_ulong cr3 = x86_read_cr(cpu, 3);
>       uint64_t page_mask = pae ? PAE_PTE_PAGE_MASK : LEGACY_PTE_PAGE_MASK;
> -    MMUTranslateResult res;
> -
> +    MMUTranslateResult res = 0;
> +
>       memset(pt, 0, sizeof(*pt));
>       top_level = gpt_top_level(cpu, pae);
>   
> 

Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

[Akihiko Odaki]

On 2026/07/26 17:24, Marc-André Lureau wrote:
> Hi
> 
> On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
> <odaki@rsg.ci.i.u-tokyo.ac.jp> wrote:
>>
>> On 2026/07/25 23:00, Marc-André Lureau wrote:
>>> rutabaga_cmd_get_capset_info() only fills in capset_id,
>>> capset_max_version and capset_max_size before sending the response to
>>> the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
>>> including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
>>> stack garbage and leaked to the guest, including host pointers useful
>>> for an ASLR bypass.
>>>
>>> Zero the response first, matching virgl_cmd_get_capset_info().
>>>
>>> Not a real risk thanks to -ftrivial-auto-var-init=zero.
>>
>> GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
>> supports GCC 10.4/11.
>>
> 
> Good point, may be we should update:
> https://patchew.org/QEMU/20260723094622.1515831-1-berrange@redhat.com/
> 
> ack otherwise?

Yes:

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

Regards.
Akihiko Odaki

> 
>> Regards,
>> Akihiko Odaki
>>
>>>
>>> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
>>> Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
>>> Reported-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
>>> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>>> ---
>>>    hw/display/virtio-gpu-rutabaga.c | 2 ++
>>>    1 file changed, 2 insertions(+)
>>>
>>> diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
>>> index 4d7d7b245929..95a19eed7eda 100644
>>> --- a/hw/display/virtio-gpu-rutabaga.c
>>> +++ b/hw/display/virtio-gpu-rutabaga.c
>>> @@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
>>>
>>>        VIRTIO_GPU_FILL_CMD(info);
>>>
>>> +    memset(&resp, 0, sizeof(resp));
>>> +
>>>        result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
>>>                                          &resp.capset_id, &resp.capset_max_version,
>>>                                          &resp.capset_max_size);
>>>
>>
> 

Re: [PATCH 5/7] hw/core/machine: free machine->fdt in machine_finalize()

[Akihiko Odaki]

On 2026/07/25 23:00, Marc-André Lureau wrote:
> machine->fdt is a plain g_malloc0() buffer (see create_device_tree())
> that boards populate during MachineClass::init, but machine_finalize()
> never freed it, unlike the other boot-time buffers (dtb, dumpdtb,
> kernel_filename, ...). Free it for consistency.

This unfortunately converts an existing bug into double-free.

spapr_machine_reset() aliases machine->fdt to spapr->fdt_blob. 
spapr_dtb_pre_load() and h_update_dt() later free it via
spapr->fdt_blob, but does not update machine->fdt, making it dangling.

Leaving machine->fdt dangling is already a bug. 
do_client_architecture_support() explains that as follows:

     /*
      * Set the machine->fdt pointer again since we just freed
      * it above (by freeing spapr->fdt_blob). We set this
      * pointer to enable support for the 'dumpdtb' QMP/HMP
      * command.
      */
     MACHINE(spapr)->fdt = fdt;

This patch introduces another path to trigger the bug.

Regards,
Akihiko Odaki

> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   hw/core/machine.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 805148678d57..2b24d711d76f 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -1301,6 +1301,7 @@ static void machine_finalize(Object *obj)
>       g_free(ms->kernel_cmdline);
>       g_free(ms->dtb);
>       g_free(ms->dumpdtb);
> +    g_free(ms->fdt);
>       g_free(ms->dt_compatible);
>       g_free(ms->firmware);
>       g_free(ms->device_memory);
> 

Re: [PATCH 4/7] hw/hexagon: fix machine->fdt leak in qom-test

[Philippe Mathieu-Daudé]

On 25/7/26 16:00, Marc-André Lureau wrote:
> virt_instance_init() built the FDT unconditionally at QOM
> instance-init time, so simply instantiating the object (e.g. via
> qom-test's introspection, without ever realizing the machine) leaked
> the 1MB FDT blob: machine_finalize() does not free machine->fdt.
> 
> Other boards (arm/virt, riscv/virt, ...) build the FDT lazily from
> their MachineClass::init callback, which only runs when the machine
> is actually selected to boot. Do the same here by moving create_fdt()
> into virt_init().
> 
> Fixes: 88a8bc7f43ff ("hw/hexagon: Define hexagon "virt" machine")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   hw/hexagon/virt.c | 9 +--------
>   1 file changed, 1 insertion(+), 8 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

[Daniel P. Berrangé]

On Sun, Jul 26, 2026 at 12:24:52PM +0400, Marc-André Lureau wrote:
> Hi
> 
> On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
> <odaki@rsg.ci.i.u-tokyo.ac.jp> wrote:
> >
> > On 2026/07/25 23:00, Marc-André Lureau wrote:
> > > rutabaga_cmd_get_capset_info() only fills in capset_id,
> > > capset_max_version and capset_max_size before sending the response to
> > > the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
> > > including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
> > > stack garbage and leaked to the guest, including host pointers useful
> > > for an ASLR bypass.
> > >
> > > Zero the response first, matching virgl_cmd_get_capset_info().
> > >
> > > Not a real risk thanks to -ftrivial-auto-var-init=zero.
> >
> > GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
> > supports GCC 10.4/11.

Opps, I thought we had new enough versions already.

> 
> Good point, may be we should update:
> https://patchew.org/QEMU/20260723094622.1515831-1-berrange@redhat.com/

I'm inclined to bump our min GCC/Clang versions so we can assume
zero-init.

We picked 10.5 due to NetBSD, and CentOS 9 still has 11.x

In both those cases, however, Clang is available in new enough
version to support -ftrivial-auto-var-init=zero. In NetBSD
there are also many new versions of GCC  available, only the
base system GCC is 10.5.


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

[Marc-André Lureau]

Hi

On Mon, Jul 27, 2026 at 3:07 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> On Sun, Jul 26, 2026 at 12:24:52PM +0400, Marc-André Lureau wrote:
> > Hi
> >
> > On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
> > <odaki@rsg.ci.i.u-tokyo.ac.jp> wrote:
> > >
> > > On 2026/07/25 23:00, Marc-André Lureau wrote:
> > > > rutabaga_cmd_get_capset_info() only fills in capset_id,
> > > > capset_max_version and capset_max_size before sending the response to
> > > > the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
> > > > including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
> > > > stack garbage and leaked to the guest, including host pointers useful
> > > > for an ASLR bypass.
> > > >
> > > > Zero the response first, matching virgl_cmd_get_capset_info().
> > > >
> > > > Not a real risk thanks to -ftrivial-auto-var-init=zero.
> > >
> > > GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
> > > supports GCC 10.4/11.
>
> Opps, I thought we had new enough versions already.
>
> >
> > Good point, may be we should update:
> > https://patchew.org/QEMU/20260723094622.1515831-1-berrange@redhat.com/
>
> I'm inclined to bump our min GCC/Clang versions so we can assume
> zero-init.
>
> We picked 10.5 due to NetBSD, and CentOS 9 still has 11.x
>
> In both those cases, however, Clang is available in new enough
> version to support -ftrivial-auto-var-init=zero. In NetBSD
> there are also many new versions of GCC  available, only the
> base system GCC is 10.5.

Apparently it needs clang 16 from Mar 2023
(https://releases.llvm.org/18.1.6/tools/clang/docs/ReleaseNotes.html#removed-compiler-flags)

>
>
> With regards,
> Daniel
> --
> |: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
> |: https://libvirt.org          ~~          https://entangle-photo.org :|
> |: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|
>
>

Re: [PATCH 4/7] hw/hexagon: fix machine->fdt leak in qom-test

[Brian Cain]

On 7/25/2026 9:00 AM, Marc-André Lureau wrote:
> virt_instance_init() built the FDT unconditionally at QOM
> instance-init time, so simply instantiating the object (e.g. via
> qom-test's introspection, without ever realizing the machine) leaked
> the 1MB FDT blob: machine_finalize() does not free machine->fdt.
>
> Other boards (arm/virt, riscv/virt, ...) build the FDT lazily from
> their MachineClass::init callback, which only runs when the machine
> is actually selected to boot. Do the same here by moving create_fdt()
> into virt_init().
>
> Fixes: 88a8bc7f43ff ("hw/hexagon: Define hexagon "virt" machine")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---

Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>


>   hw/hexagon/virt.c | 9 +--------
>   1 file changed, 1 insertion(+), 8 deletions(-)
>
> diff --git a/hw/hexagon/virt.c b/hw/hexagon/virt.c
> index a3638998b873..b75047250260 100644
> --- a/hw/hexagon/virt.c
> +++ b/hw/hexagon/virt.c
> @@ -175,13 +175,6 @@ static void fdt_add_cpu_nodes(const HexagonVirtMachineState *vms)
>   
>   
>   
> -static void virt_instance_init(Object *obj)
> -{
> -    HexagonVirtMachineState *vms = HEXAGON_VIRT_MACHINE(obj);
> -
> -    create_fdt(vms);
> -}
> -
>   void hexagon_load_fdt(const HexagonVirtMachineState *vms)
>   {
>       MachineState *ms = MACHINE(vms);
> @@ -242,6 +235,7 @@ static void virt_init(MachineState *ms)
>       DeviceState *cpu0;
>       int32_t clk_phandle;
>   
> +    create_fdt(vms);
>       qemu_fdt_setprop_string(ms->fdt, "/chosen", "bootargs", ms->kernel_cmdline);
>   
>       vms->sys = get_system_memory();
> @@ -341,7 +335,6 @@ static const TypeInfo virt_machine_types[] = { {
>       .parent = TYPE_HEXAGON_COMMON_MACHINE,
>       .instance_size = sizeof(HexagonVirtMachineState),
>       .class_init = virt_class_init,
> -    .instance_init = virt_instance_init,
>   } };
>   
>   DEFINE_TYPES(virt_machine_types)
>