<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, ensure this ticket is marked 'confidential' before submission. See https://www.qemu.org/contribute/security-process/ for additional guidance--> ## Host environment - Operating system: Windows 11 (Windows on Arm) - OS/kernel version: Windows 11 26x00 - Architecture: aarch64 - QEMU flavor: qemu-system-aarch64 - QEMU version: v11.1.0-289- 9696bf5dc5 - QEMU command line: <!--Give the smallest, complete command line that exhibits the problem. If you are using libvirt, virsh, or vmm, you can likely find the QEMU command line arguments in /var/log/libvirt/qemu/$GUEST.log.--> qemu-system-aarch64 -machine virt,highmem-ecam=off -accel tcg -cpu cortex-a57 \ -m 1024 -display none -device i6300esb -watchdog-action reset \ -drive if=pflash,format=raw,unit=0,readonly=on,file=CODE-AARCH64.fd \ -drive if=pflash,format=raw,unit=1,file=VARS-AARCH64.fd -S ## Emulated/Virtualized environment - Operating system: N/A -- the bug fires during `qemu_init()`, before any guest code runs. - OS/kernel version: N/A - Architecture: ARM ## Description of problem Crash during qemu_init() due to recent ax3000-soc.c regression. `TYPE_AX3000_SOC` (`hw/arm/ax3000-soc.c`) declares a class struct via `OBJECT_DECLARE_TYPE(Ax3000SoCState, Ax3000SoCClass, AX3000_SOC)` and its `class_init` writes to it: ```c static void ax3000_class_init(ObjectClass *oc, const void *data) { DeviceClass *dc = DEVICE_CLASS(oc); Ax3000SoCClass *sc = AX3000_SOC_CLASS(oc); dc->desc = "Axiado SoC AX3000"; dc->realize = ax3000_realize; sc->num_cpus = AX3000_NUM_CPUS; /* <-- uint32_t, value 4 */ } ``` but the `TypeInfo` omits `.class_size`: ```c static const TypeInfo axiado_soc_types[] = { { .name = TYPE_AX3000_SOC, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(Ax3000SoCState), .instance_init = ax3000_init, .class_init = ax3000_class_init, /* no .class_size */ } }; ``` ## Steps to reproduce 1. 2. 3. <!--Note: if this issue was discovered with the assistance of automated tooling LLM, static analysis, fuzzers), the reporter must disclose that in the description. The steps to reproduce, and any other findings, must be fully validated by the user of the tool prior to submission.--> ## Additional information <!--Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant. If attaching binary test cases you should describe where they were obtained from, preferably linking to the original source. We greatly prefer test cases in the form of source code that can be audited before compiling by the engineer.--> Introduced by 33a71a68c6 ("hw/arm: Add Axiado SoC AX3000"); v11.1.0 is unaffected. Fix: ```diff --- a/hw/arm/ax3000-soc.c +++ b/hw/arm/ax3000-soc.c @@ -236,6 +236,7 @@ static const TypeInfo axiado_soc_types[] = { .instance_size = sizeof(Ax3000SoCState), .instance_init = ax3000_init, .class_init = ax3000_class_init, + .class_size = sizeof(Ax3000SoCClass), } }; ```