[PATCH 2/2] s390x/pci: fix set_ind_atomic

[Halil Pasic]

The atomic_cmpxchg() loop is broken because we occasionally end up with
old and _old having different values (a legit compiler can generate code
that accessed *ind_addr again to pick up a value for _old instead of
using the value of old that was already fetched according to the
rules of the abstract machine). This means the underlying CS instruction
may use a different old (_old) than the one we intended to use if
atomic_cmpxchg() performed the xchg part.

Let us use volatile to force the rules of the abstract machine for
accesses to *ind_addr. Let us also rewrite the loop so, we that the
new old is used to compute the new desired value if the xchg part
is not performed.

Signed-off-by: Halil Pasic 
Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
Reported-by: Christian Borntraeger 
---
 hw/s390x/s390-pci-bus.c | 16 +---
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index c4a4259f0c..80eb957a91 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -637,22 +637,24 @@ static AddressSpace *s390_pci_dma_iommu(PCIBus *bus, void 
*opaque, int devfn)
 
 static uint8_t set_ind_atomic(uint64_t ind_loc, uint8_t to_be_set)
 {
-uint8_t ind_old, ind_new;
+uint8_t expected, actual;
 hwaddr len = 1;
-uint8_t *ind_addr;
+/* avoid  multiple fetches */
+uint8_t volatile *ind_addr;
 
 ind_addr = cpu_physical_memory_map(ind_loc, , true);
 if (!ind_addr) {
 s390_pci_generate_error_event(ERR_EVENT_AIRERR, 0, 0, 0, 0);
 return -1;
 }
+actual = *ind_addr;
 do {
-ind_old = *ind_addr;
-ind_new = ind_old | to_be_set;
-} while (atomic_cmpxchg(ind_addr, ind_old, ind_new) != ind_old);
-cpu_physical_memory_unmap(ind_addr, len, 1, len);
+expected = actual;
+actual = atomic_cmpxchg(ind_addr, expected, expected | to_be_set);
+} while (actual != expected);
+cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
 
-return ind_old;
+return actual;
 }
 
 static void s390_msi_ctrl_write(void *opaque, hwaddr addr, uint64_t data,
-- 
2.17.1

[PATCH 1/2] virtio-ccw: fix virtio_set_ind_atomic

[Halil Pasic]

The atomic_cmpxchg() loop is broken because we occasionally end up with
old and _old having different values (a legit compiler can generate code
that accessed *ind_addr again to pick up a value for _old instead of
using the value of old that was already fetched according to the
rules of the abstract machine). This means the underlying CS instruction
may use a different old (_old) than the one we intended to use if
atomic_cmpxchg() performed the xchg part.

Let us use volatile to force the rules of the abstract machine for
accesses to *ind_addr. Let us also rewrite the loop so, we that the
new old is used to compute the new desired value if the xchg part
is not performed.

Signed-off-by: Halil Pasic 
Reported-by: Andre Wild 
Fixes: 7e7494627f ("s390x/virtio-ccw: Adapter interrupt support.")
---
 hw/s390x/virtio-ccw.c | 18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index c1f4bb1d33..3c988a000b 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -786,9 +786,10 @@ static inline VirtioCcwDevice 
*to_virtio_ccw_dev_fast(DeviceState *d)
 static uint8_t virtio_set_ind_atomic(SubchDev *sch, uint64_t ind_loc,
  uint8_t to_be_set)
 {
-uint8_t ind_old, ind_new;
+uint8_t expected, actual;
 hwaddr len = 1;
-uint8_t *ind_addr;
+/* avoid  multiple fetches */
+uint8_t volatile *ind_addr;
 
 ind_addr = cpu_physical_memory_map(ind_loc, , true);
 if (!ind_addr) {
@@ -796,14 +797,15 @@ static uint8_t virtio_set_ind_atomic(SubchDev *sch, 
uint64_t ind_loc,
  __func__, sch->cssid, sch->ssid, sch->schid);
 return -1;
 }
+actual = *ind_addr;
 do {
-ind_old = *ind_addr;
-ind_new = ind_old | to_be_set;
-} while (atomic_cmpxchg(ind_addr, ind_old, ind_new) != ind_old);
-trace_virtio_ccw_set_ind(ind_loc, ind_old, ind_new);
-cpu_physical_memory_unmap(ind_addr, len, 1, len);
+expected = actual;
+actual = atomic_cmpxchg(ind_addr, expected, expected | to_be_set);
+} while (actual != expected);
+trace_virtio_ccw_set_ind(ind_loc, actual, actual | to_be_set);
+cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
 
-return ind_old;
+return actual;
 }
 
 static void virtio_ccw_notify(DeviceState *d, uint16_t vector)
-- 
2.17.1

[PATCH 0/2] two atomic_cmpxchg() related fixes

[Halil Pasic]

The story short: compiler can generate code that does two
distinct fetches of *ind_addr for old and _old. If that happens we can
not figure out if we had the desired xchg or not.

Halil Pasic (2):
  virtio-ccw: fix virtio_set_ind_atomic
  s390x/pci: fix set_ind_atomic

 hw/s390x/s390-pci-bus.c | 16 +---
 hw/s390x/virtio-ccw.c   | 18 ++
 2 files changed, 19 insertions(+), 15 deletions(-)


base-commit: 7d3660e79830a069f1848bb4fa1cdf8f666424fb
-- 
2.17.1

[PATCH v6 5/5] hw/riscv: virt: Allow creating multiple NUMA sockets

[Anup Patel]

We extend RISC-V virt machine to allow creating a multi-socket
machine. Each RISC-V virt machine socket is a NUMA node having
a set of HARTs, a memory instance, a CLINT instance, and a PLIC
instance. Other devices are shared between all sockets. We also
update the generated device tree accordingly.

By default, NUMA multi-socket support is disabled for RISC-V virt
machine. To enable it, users can use "-numa" command-line options
of QEMU.

Example1: For two NUMA nodes with 2 CPUs each, append following
to command-line options: "-smp 4 -numa node -numa node"

Example2: For two NUMA nodes with 1 and 3 CPUs, append following
to command-line options:
"-smp 4 -numa node -numa node -numa cpu,node-id=0,core-id=0 \
-numa cpu,node-id=1,core-id=1 -numa cpu,node-id=1,core-id=2 \
-numa cpu,node-id=1,core-id=3"

The maximum number of sockets in a RISC-V virt machine is 8
but this limit can be changed in future.

Signed-off-by: Anup Patel 
Reviewed-by: Atish Patra 
---
 hw/riscv/virt.c | 530 +++-
 include/hw/riscv/virt.h |   9 +-
 2 files changed, 308 insertions(+), 231 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 35dc43d620..e01925ff3d 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -35,6 +35,7 @@
 #include "hw/riscv/sifive_test.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
+#include "hw/riscv/numa.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
@@ -60,7 +61,7 @@ static const struct MemmapEntry {
 [VIRT_TEST] ={   0x10,0x1000 },
 [VIRT_RTC] = {   0x101000,0x1000 },
 [VIRT_CLINT] =   {  0x200,   0x1 },
-[VIRT_PLIC] ={  0xc00, 0x400 },
+[VIRT_PLIC] ={  0xc00, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
 [VIRT_UART0] =   { 0x1000, 0x100 },
 [VIRT_VIRTIO] =  { 0x10001000,0x1000 },
 [VIRT_FLASH] =   { 0x2000, 0x400 },
@@ -182,10 +183,17 @@ static void create_fdt(RISCVVirtState *s, const struct 
MemmapEntry *memmap,
 uint64_t mem_size, const char *cmdline)
 {
 void *fdt;
-int cpu, i;
-uint32_t *cells;
-char *nodename;
-uint32_t plic_phandle, test_phandle, phandle = 1;
+int i, cpu, socket;
+MachineState *mc = MACHINE(s);
+uint64_t addr, size;
+uint32_t *clint_cells, *plic_cells;
+unsigned long clint_addr, plic_addr;
+uint32_t plic_phandle[MAX_NODES];
+uint32_t cpu_phandle, intc_phandle, test_phandle;
+uint32_t phandle = 1, plic_mmio_phandle = 1;
+uint32_t plic_pcie_phandle = 1, plic_virtio_phandle = 1;
+char *mem_name, *cpu_name, *core_name, *intc_name;
+char *name, *clint_name, *plic_name, *clust_name;
 hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
 hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
 
@@ -206,231 +214,238 @@ static void create_fdt(RISCVVirtState *s, const struct 
MemmapEntry *memmap,
 qemu_fdt_setprop_cell(fdt, "/soc", "#size-cells", 0x2);
 qemu_fdt_setprop_cell(fdt, "/soc", "#address-cells", 0x2);
 
-nodename = g_strdup_printf("/memory@%lx",
-(long)memmap[VIRT_DRAM].base);
-qemu_fdt_add_subnode(fdt, nodename);
-qemu_fdt_setprop_cells(fdt, nodename, "reg",
-memmap[VIRT_DRAM].base >> 32, memmap[VIRT_DRAM].base,
-mem_size >> 32, mem_size);
-qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
-g_free(nodename);
-
 qemu_fdt_add_subnode(fdt, "/cpus");
 qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
   SIFIVE_CLINT_TIMEBASE_FREQ);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
+qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
+
+for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
+clust_name = g_strdup_printf("/cpus/cpu-map/cluster%d", socket);
+qemu_fdt_add_subnode(fdt, clust_name);
+
+plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+clint_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
+cpu_phandle = phandle++;
 
-for (cpu = s->soc.num_harts - 1; cpu >= 0; cpu--) {
-int cpu_phandle = phandle++;
-int intc_phandle;
-nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
-char *intc = g_strdup_printf("/cpus/cpu@%d/interrupt-controller", cpu);
-char *isa = riscv_isa_string(>soc.harts[cpu]);
-qemu_fdt_add_subnode(fdt, nodename);
+cpu_name = g_strdup_printf("/cpus/cpu@%d",
+s->soc[socket].hartid_base + cpu);
+qemu_fdt_add_subnode(fdt, cpu_name);
 #if defined(TARGET_RISCV32)
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv32");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv32");
 #else
-  

[PATCH v6 2/5] hw/riscv: Allow creating multiple instances of PLIC

[Anup Patel]

We extend PLIC emulation to allow multiple instances of PLIC in
a QEMU RISC-V machine. To achieve this, we remove first HART id
zero assumption from PLIC emulation.

Signed-off-by: Anup Patel 
Reviewed-by: Palmer Dabbelt 
Reviewed-by: Alistair Francis 
---
 hw/riscv/sifive_e.c|  2 +-
 hw/riscv/sifive_plic.c | 24 +---
 hw/riscv/sifive_u.c|  2 +-
 hw/riscv/virt.c|  2 +-
 include/hw/riscv/sifive_plic.h | 12 +++-
 5 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index 1c3b37d0ba..bd122e71ae 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -152,7 +152,7 @@ static void riscv_sifive_e_soc_realize(DeviceState *dev, 
Error **errp)
 
 /* MMIO */
 s->plic = sifive_plic_create(memmap[SIFIVE_E_PLIC].base,
-(char *)SIFIVE_E_PLIC_HART_CONFIG,
+(char *)SIFIVE_E_PLIC_HART_CONFIG, 0,
 SIFIVE_E_PLIC_NUM_SOURCES,
 SIFIVE_E_PLIC_NUM_PRIORITIES,
 SIFIVE_E_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/sifive_plic.c b/hw/riscv/sifive_plic.c
index c1e04cbb98..f88bb48053 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/riscv/sifive_plic.c
@@ -352,6 +352,7 @@ static const MemoryRegionOps sifive_plic_ops = {
 
 static Property sifive_plic_properties[] = {
 DEFINE_PROP_STRING("hart-config", SiFivePLICState, hart_config),
+DEFINE_PROP_UINT32("hartid-base", SiFivePLICState, hartid_base, 0),
 DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 0),
 DEFINE_PROP_UINT32("num-priorities", SiFivePLICState, num_priorities, 0),
 DEFINE_PROP_UINT32("priority-base", SiFivePLICState, priority_base, 0),
@@ -400,10 +401,12 @@ static void parse_hart_config(SiFivePLICState *plic)
 }
 hartid++;
 
-/* store hart/mode combinations */
 plic->num_addrs = addrid;
+plic->num_harts = hartid;
+
+/* store hart/mode combinations */
 plic->addr_config = g_new(PLICAddr, plic->num_addrs);
-addrid = 0, hartid = 0;
+addrid = 0, hartid = plic->hartid_base;
 p = plic->hart_config;
 while ((c = *p++)) {
 if (c == ',') {
@@ -429,8 +432,6 @@ static void sifive_plic_irq_request(void *opaque, int irq, 
int level)
 
 static void sifive_plic_realize(DeviceState *dev, Error **errp)
 {
-MachineState *ms = MACHINE(qdev_get_machine());
-unsigned int smp_cpus = ms->smp.cpus;
 SiFivePLICState *plic = SIFIVE_PLIC(dev);
 int i;
 
@@ -451,8 +452,8 @@ static void sifive_plic_realize(DeviceState *dev, Error 
**errp)
  * lost a interrupt in the case a PLIC is attached. The SEIP bit must be
  * hardware controlled when a PLIC is attached.
  */
-for (i = 0; i < smp_cpus; i++) {
-RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(i));
+for (i = 0; i < plic->num_harts; i++) {
+RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(plic->hartid_base + i));
 if (riscv_cpu_claim_interrupts(cpu, MIP_SEIP) < 0) {
 error_report("SEIP already claimed");
 exit(1);
@@ -488,16 +489,17 @@ type_init(sifive_plic_register_types)
  * Create PLIC device.
  */
 DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
-uint32_t num_sources, uint32_t num_priorities,
-uint32_t priority_base, uint32_t pending_base,
-uint32_t enable_base, uint32_t enable_stride,
-uint32_t context_base, uint32_t context_stride,
-uint32_t aperture_size)
+uint32_t hartid_base, uint32_t num_sources,
+uint32_t num_priorities, uint32_t priority_base,
+uint32_t pending_base, uint32_t enable_base,
+uint32_t enable_stride, uint32_t context_base,
+uint32_t context_stride, uint32_t aperture_size)
 {
 DeviceState *dev = qdev_create(NULL, TYPE_SIFIVE_PLIC);
 assert(enable_stride == (enable_stride & -enable_stride));
 assert(context_stride == (context_stride & -context_stride));
 qdev_prop_set_string(dev, "hart-config", hart_config);
+qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 qdev_prop_set_uint32(dev, "num-sources", num_sources);
 qdev_prop_set_uint32(dev, "num-priorities", num_priorities);
 qdev_prop_set_uint32(dev, "priority-base", priority_base);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index c193761916..53e48e2ff5 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -586,7 +586,7 @@ static void riscv_sifive_u_soc_realize(DeviceState *dev, 
Error **errp)
 
 /* MMIO */
 s->plic = sifive_plic_create(memmap[SIFIVE_U_PLIC].base,
-plic_hart_config,
+plic_hart_config, 0,
 SIFIVE_U_PLIC_NUM_SOURCES,
 SIFIVE_U_PLIC_NUM_PRIORITIES,
 SIFIVE_U_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 041c400261..35dc43d620 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -584,7 +584,7 @@ static void riscv_virt_board_init(MachineState *machine)
 
 /* MMIO */
 s->plic = sifive_plic_create(memmap[VIRT_PLIC].base,
-plic_hart_config,
+

[PATCH v6 3/5] hw/riscv: Add helpers for RISC-V multi-socket NUMA machines

[Anup Patel]

We add common helper routines which can be shared by RISC-V
multi-socket NUMA machines.

We have two types of helpers:
1. riscv_socket_xyz() - These helper assist managing multiple
   sockets irrespective whether QEMU NUMA is enabled/disabled
2. riscv_numa_xyz() - These helpers assist in providing
   necessary QEMU machine callbacks for QEMU NUMA emulation

Signed-off-by: Anup Patel 
Reviewed-by: Atish Patra 
---
 hw/riscv/Makefile.objs  |   1 +
 hw/riscv/numa.c | 242 
 include/hw/riscv/numa.h | 113 +++
 3 files changed, 356 insertions(+)
 create mode 100644 hw/riscv/numa.c
 create mode 100644 include/hw/riscv/numa.h

diff --git a/hw/riscv/Makefile.objs b/hw/riscv/Makefile.objs
index fc3c6dd7c8..4483e61879 100644
--- a/hw/riscv/Makefile.objs
+++ b/hw/riscv/Makefile.objs
@@ -1,4 +1,5 @@
 obj-y += boot.o
+obj-y += numa.o
 obj-$(CONFIG_SPIKE) += riscv_htif.o
 obj-$(CONFIG_HART) += riscv_hart.o
 obj-$(CONFIG_SIFIVE_E) += sifive_e.o
diff --git a/hw/riscv/numa.c b/hw/riscv/numa.c
new file mode 100644
index 00..4f92307102
--- /dev/null
+++ b/hw/riscv/numa.c
@@ -0,0 +1,242 @@
+/*
+ * QEMU RISC-V NUMA Helper
+ *
+ * Copyright (c) 2020 Western Digital Corporation or its affiliates.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see .
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/riscv/numa.h"
+#include "sysemu/device_tree.h"
+
+static bool numa_enabled(const MachineState *ms)
+{
+return (ms->numa_state && ms->numa_state->num_nodes) ? true : false;
+}
+
+int riscv_socket_count(const MachineState *ms)
+{
+return (numa_enabled(ms)) ? ms->numa_state->num_nodes : 1;
+}
+
+int riscv_socket_first_hartid(const MachineState *ms, int socket_id)
+{
+int i, first_hartid = ms->smp.cpus;
+
+if (!numa_enabled(ms)) {
+return (!socket_id) ? 0 : -1;
+}
+
+for (i = 0; i < ms->smp.cpus; i++) {
+if (ms->possible_cpus->cpus[i].props.node_id != socket_id) {
+continue;
+}
+if (i < first_hartid) {
+first_hartid = i;
+}
+}
+
+return (first_hartid < ms->smp.cpus) ? first_hartid : -1;
+}
+
+int riscv_socket_last_hartid(const MachineState *ms, int socket_id)
+{
+int i, last_hartid = -1;
+
+if (!numa_enabled(ms)) {
+return (!socket_id) ? ms->smp.cpus - 1 : -1;
+}
+
+for (i = 0; i < ms->smp.cpus; i++) {
+if (ms->possible_cpus->cpus[i].props.node_id != socket_id) {
+continue;
+}
+if (i > last_hartid) {
+last_hartid = i;
+}
+}
+
+return (last_hartid < ms->smp.cpus) ? last_hartid : -1;
+}
+
+int riscv_socket_hart_count(const MachineState *ms, int socket_id)
+{
+int first_hartid, last_hartid;
+
+if (!numa_enabled(ms)) {
+return (!socket_id) ? ms->smp.cpus : -1;
+}
+
+first_hartid = riscv_socket_first_hartid(ms, socket_id);
+if (first_hartid < 0) {
+return -1;
+}
+
+last_hartid = riscv_socket_last_hartid(ms, socket_id);
+if (last_hartid < 0) {
+return -1;
+}
+
+if (first_hartid > last_hartid) {
+return -1;
+}
+
+return last_hartid - first_hartid + 1;
+}
+
+bool riscv_socket_check_hartids(const MachineState *ms, int socket_id)
+{
+int i, first_hartid, last_hartid;
+
+if (!numa_enabled(ms)) {
+return (!socket_id) ? true : false;
+}
+
+first_hartid = riscv_socket_first_hartid(ms, socket_id);
+if (first_hartid < 0) {
+return false;
+}
+
+last_hartid = riscv_socket_last_hartid(ms, socket_id);
+if (last_hartid < 0) {
+return false;
+}
+
+for (i = first_hartid; i <= last_hartid; i++) {
+if (ms->possible_cpus->cpus[i].props.node_id != socket_id) {
+return false;
+}
+}
+
+return true;
+}
+
+uint64_t riscv_socket_mem_offset(const MachineState *ms, int socket_id)
+{
+int i;
+uint64_t mem_offset = 0;
+
+if (!numa_enabled(ms)) {
+return 0;
+}
+
+for (i = 0; i < ms->numa_state->num_nodes; i++) {
+if (i == socket_id) {
+break;
+}
+mem_offset += ms->numa_state->nodes[i].node_mem;
+}
+
+return (i == socket_id) ? mem_offset : 0;
+}
+
+uint64_t 

[PATCH v6 4/5] hw/riscv: spike: Allow creating multiple NUMA sockets

[Anup Patel]

We extend RISC-V spike machine to allow creating a multi-socket
machine. Each RISC-V spike machine socket is a NUMA node having
a set of HARTs, a memory instance, and a CLINT instance. Other
devices are shared between all sockets. We also update the
generated device tree accordingly.

By default, NUMA multi-socket support is disabled for RISC-V spike
machine. To enable it, users can use "-numa" command-line options
of QEMU.

Example1: For two NUMA nodes with 2 CPUs each, append following
to command-line options: "-smp 4 -numa node -numa node"

Example2: For two NUMA nodes with 1 and 3 CPUs, append following
to command-line options:
"-smp 4 -numa node -numa node -numa cpu,node-id=0,core-id=0 \
-numa cpu,node-id=1,core-id=1 -numa cpu,node-id=1,core-id=2 \
-numa cpu,node-id=1,core-id=3"

The maximum number of sockets in a RISC-V spike machine is 8
but this limit can be changed in future.

Signed-off-by: Anup Patel 
Reviewed-by: Atish Patra 
---
 hw/riscv/spike.c | 237 ++-
 include/hw/riscv/spike.h |  11 +-
 2 files changed, 169 insertions(+), 79 deletions(-)

diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index a3db885ffa..29e7270035 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -36,6 +36,7 @@
 #include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/spike.h"
 #include "hw/riscv/boot.h"
+#include "hw/riscv/numa.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
@@ -64,9 +65,14 @@ static void create_fdt(SpikeState *s, const struct 
MemmapEntry *memmap,
 uint64_t mem_size, const char *cmdline)
 {
 void *fdt;
-int cpu;
-uint32_t *cells;
-char *nodename;
+uint64_t addr, size;
+unsigned long clint_addr;
+int cpu, socket;
+MachineState *mc = MACHINE(s);
+uint32_t *clint_cells;
+uint32_t cpu_phandle, intc_phandle, phandle = 1;
+char *name, *mem_name, *clint_name, *clust_name;
+char *core_name, *cpu_name, *intc_name;
 
 fdt = s->fdt = create_device_tree(>fdt_size);
 if (!fdt) {
@@ -88,68 +94,91 @@ static void create_fdt(SpikeState *s, const struct 
MemmapEntry *memmap,
 qemu_fdt_setprop_cell(fdt, "/soc", "#size-cells", 0x2);
 qemu_fdt_setprop_cell(fdt, "/soc", "#address-cells", 0x2);
 
-nodename = g_strdup_printf("/memory@%lx",
-(long)memmap[SPIKE_DRAM].base);
-qemu_fdt_add_subnode(fdt, nodename);
-qemu_fdt_setprop_cells(fdt, nodename, "reg",
-memmap[SPIKE_DRAM].base >> 32, memmap[SPIKE_DRAM].base,
-mem_size >> 32, mem_size);
-qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
-g_free(nodename);
-
 qemu_fdt_add_subnode(fdt, "/cpus");
 qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
 SIFIVE_CLINT_TIMEBASE_FREQ);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
 qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
+qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
+
+for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
+clust_name = g_strdup_printf("/cpus/cpu-map/cluster%d", socket);
+qemu_fdt_add_subnode(fdt, clust_name);
+
+clint_cells =  g_new0(uint32_t, s->soc[socket].num_harts * 4);
 
-for (cpu = s->soc.num_harts - 1; cpu >= 0; cpu--) {
-nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
-char *intc = g_strdup_printf("/cpus/cpu@%d/interrupt-controller", cpu);
-char *isa = riscv_isa_string(>soc.harts[cpu]);
-qemu_fdt_add_subnode(fdt, nodename);
+for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
+cpu_phandle = phandle++;
+
+cpu_name = g_strdup_printf("/cpus/cpu@%d",
+s->soc[socket].hartid_base + cpu);
+qemu_fdt_add_subnode(fdt, cpu_name);
 #if defined(TARGET_RISCV32)
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv32");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv32");
 #else
-qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv48");
+qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv48");
 #endif
-qemu_fdt_setprop_string(fdt, nodename, "riscv,isa", isa);
-qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv");
-qemu_fdt_setprop_string(fdt, nodename, "status", "okay");
-qemu_fdt_setprop_cell(fdt, nodename, "reg", cpu);
-qemu_fdt_setprop_string(fdt, nodename, "device_type", "cpu");
-qemu_fdt_add_subnode(fdt, intc);
-qemu_fdt_setprop_cell(fdt, intc, "phandle", 1);
-qemu_fdt_setprop_string(fdt, intc, "compatible", "riscv,cpu-intc");
-qemu_fdt_setprop(fdt, intc, "interrupt-controller", NULL, 0);
-qemu_fdt_setprop_cell(fdt, intc, "#interrupt-cells", 1);
-g_free(isa);
-g_free(intc);
-g_free(nodename);
-}
+name = riscv_isa_string(>soc[socket].harts[cpu]);
+qemu_fdt_setprop_string(fdt, 

[PATCH v6 0/5] RISC-V multi-socket support

[Anup Patel]

This series adds multi-socket support for RISC-V virt machine and
RISC-V spike machine. The multi-socket support will help us improve
various RISC-V operating systems, firmwares, and bootloader to
support RISC-V NUMA systems.

These patch can be found in riscv_multi_socket_v6 branch at:
https://github.com/avpatel/qemu.git

Changes since v5:
 - Rebased patches on Spike changes from Alistair
 - Added comments describing RISC-V NUMA helper functions

Changes since v4:
 - Re-arrange patches and move CLINT and PLIC patches before other
   patches because these are already reviewed
 - Added PATCH3 for common RISC-V multi-socket helpers
 - Added support for "-numa cpu,node-id" option in PATCH4 and PATCH5

Changes since v3:
 - Use "-numa" QEMU options to populate sockets instead of custom
   "multi-socket" sub-option in machine name

Changes since v2:
 - Dropped PATCH1 as it is not required any more
 - Added "multi-socket" sub-option for Spike and Virt machine
   which can be used to enable/disable mult-socket support

Changes since v1:
 - Fixed checkpatch errors and warnings
 - Added PATCH1 for knowning whether "sockets" sub-option was specified
 - Remove SPIKE_CPUS_PER_SOCKET_MIN and SPIKE_CPUS_PER_SOCKET_MAX in PATCH3
 - Remove VIRT_CPUS_PER_SOCKET_MIN and VIRT_CPUS_PER_SOCKET_MAX in PATCH5

Anup Patel (5):
  hw/riscv: Allow creating multiple instances of CLINT
  hw/riscv: Allow creating multiple instances of PLIC
  hw/riscv: Add helpers for RISC-V multi-socket NUMA machines
  hw/riscv: spike: Allow creating multiple NUMA sockets
  hw/riscv: virt: Allow creating multiple NUMA sockets

 hw/riscv/Makefile.objs  |   1 +
 hw/riscv/numa.c | 242 +++
 hw/riscv/sifive_clint.c |  20 +-
 hw/riscv/sifive_e.c |   4 +-
 hw/riscv/sifive_plic.c  |  24 +-
 hw/riscv/sifive_u.c |   4 +-
 hw/riscv/spike.c| 237 +-
 hw/riscv/virt.c | 530 ++--
 include/hw/riscv/numa.h | 113 +++
 include/hw/riscv/sifive_clint.h |   7 +-
 include/hw/riscv/sifive_plic.h  |  12 +-
 include/hw/riscv/spike.h|  11 +-
 include/hw/riscv/virt.h |   9 +-
 13 files changed, 873 insertions(+), 341 deletions(-)
 create mode 100644 hw/riscv/numa.c
 create mode 100644 include/hw/riscv/numa.h

-- 
2.25.1

[PATCH v6 1/5] hw/riscv: Allow creating multiple instances of CLINT

[Anup Patel]

We extend CLINT emulation to allow multiple instances of CLINT in
a QEMU RISC-V machine. To achieve this, we remove first HART id
zero assumption from CLINT emulation.

Signed-off-by: Anup Patel 
Reviewed-by: Alistair Francis 
Reviewed-by: Palmer Dabbelt 
---
 hw/riscv/sifive_clint.c | 20 
 hw/riscv/sifive_e.c |  2 +-
 hw/riscv/sifive_u.c |  2 +-
 hw/riscv/spike.c|  2 +-
 hw/riscv/virt.c |  2 +-
 include/hw/riscv/sifive_clint.h |  7 ---
 6 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/hw/riscv/sifive_clint.c b/hw/riscv/sifive_clint.c
index e933d35092..7d713fd743 100644
--- a/hw/riscv/sifive_clint.c
+++ b/hw/riscv/sifive_clint.c
@@ -78,7 +78,7 @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, 
unsigned size)
 SiFiveCLINTState *clint = opaque;
 if (addr >= clint->sip_base &&
 addr < clint->sip_base + (clint->num_harts << 2)) {
-size_t hartid = (addr - clint->sip_base) >> 2;
+size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -91,7 +91,8 @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, 
unsigned size)
 }
 } else if (addr >= clint->timecmp_base &&
 addr < clint->timecmp_base + (clint->num_harts << 3)) {
-size_t hartid = (addr - clint->timecmp_base) >> 3;
+size_t hartid = clint->hartid_base +
+((addr - clint->timecmp_base) >> 3);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -128,7 +129,7 @@ static void sifive_clint_write(void *opaque, hwaddr addr, 
uint64_t value,
 
 if (addr >= clint->sip_base &&
 addr < clint->sip_base + (clint->num_harts << 2)) {
-size_t hartid = (addr - clint->sip_base) >> 2;
+size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -141,7 +142,8 @@ static void sifive_clint_write(void *opaque, hwaddr addr, 
uint64_t value,
 return;
 } else if (addr >= clint->timecmp_base &&
 addr < clint->timecmp_base + (clint->num_harts << 3)) {
-size_t hartid = (addr - clint->timecmp_base) >> 3;
+size_t hartid = clint->hartid_base +
+((addr - clint->timecmp_base) >> 3);
 CPUState *cpu = qemu_get_cpu(hartid);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
@@ -185,6 +187,7 @@ static const MemoryRegionOps sifive_clint_ops = {
 };
 
 static Property sifive_clint_properties[] = {
+DEFINE_PROP_UINT32("hartid-base", SiFiveCLINTState, hartid_base, 0),
 DEFINE_PROP_UINT32("num-harts", SiFiveCLINTState, num_harts, 0),
 DEFINE_PROP_UINT32("sip-base", SiFiveCLINTState, sip_base, 0),
 DEFINE_PROP_UINT32("timecmp-base", SiFiveCLINTState, timecmp_base, 0),
@@ -226,13 +229,13 @@ type_init(sifive_clint_register_types)
 /*
  * Create CLINT device.
  */
-DeviceState *sifive_clint_create(hwaddr addr, hwaddr size, uint32_t num_harts,
-uint32_t sip_base, uint32_t timecmp_base, uint32_t time_base,
-bool provide_rdtime)
+DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
+uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
+uint32_t timecmp_base, uint32_t time_base, bool provide_rdtime)
 {
 int i;
 for (i = 0; i < num_harts; i++) {
-CPUState *cpu = qemu_get_cpu(i);
+CPUState *cpu = qemu_get_cpu(hartid_base + i);
 CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 if (!env) {
 continue;
@@ -246,6 +249,7 @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size, 
uint32_t num_harts,
 }
 
 DeviceState *dev = qdev_create(NULL, TYPE_SIFIVE_CLINT);
+qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 qdev_prop_set_uint32(dev, "num-harts", num_harts);
 qdev_prop_set_uint32(dev, "sip-base", sip_base);
 qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index b53109521e..1c3b37d0ba 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -163,7 +163,7 @@ static void riscv_sifive_e_soc_realize(DeviceState *dev, 
Error **errp)
 SIFIVE_E_PLIC_CONTEXT_STRIDE,
 memmap[SIFIVE_E_PLIC].size);
 sifive_clint_create(memmap[SIFIVE_E_CLINT].base,
-memmap[SIFIVE_E_CLINT].size, ms->smp.cpus,
+memmap[SIFIVE_E_CLINT].size, 0, ms->smp.cpus,
 SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
 create_unimplemented_device("riscv.sifive.e.aon",
 memmap[SIFIVE_E_AON].base, memmap[SIFIVE_E_AON].size);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index 4299bdf480..c193761916 100644
--- 

[PATCH v2] migration: Count new_dirty instead of real_dirty

[Keqian Zhu]

real_dirty_pages becomes equal to total ram size after dirty log sync
in ram_init_bitmaps, the reason is that the bitmap of ramblock is
initialized to be all set, so old path counts them as "real dirty" at
beginning.

This causes wrong dirty rate and false positive throttling at the end
of first ram save iteration.

Signed-off-by: Keqian Zhu 

---
Changelog:

v2:
 - use new_dirty_pages instead of accu_dirty_pages.
 - adjust commit messages.

---
 include/exec/ram_addr.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
index 7b5c24e928..a95e2e7c25 100644
--- a/include/exec/ram_addr.h
+++ b/include/exec/ram_addr.h
@@ -443,7 +443,7 @@ static inline
 uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
ram_addr_t start,
ram_addr_t length,
-   uint64_t *real_dirty_pages)
+   uint64_t *new_dirty_pages)
 {
 ram_addr_t addr;
 unsigned long word = BIT_WORD((start + rb->offset) >> TARGET_PAGE_BITS);
@@ -469,7 +469,6 @@ uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
 if (src[idx][offset]) {
 unsigned long bits = atomic_xchg([idx][offset], 0);
 unsigned long new_dirty;
-*real_dirty_pages += ctpopl(bits);
 new_dirty = ~dest[k];
 dest[k] |= bits;
 new_dirty &= bits;
@@ -502,7 +501,6 @@ uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
 start + addr + offset,
 TARGET_PAGE_SIZE,
 DIRTY_MEMORY_MIGRATION)) {
-*real_dirty_pages += 1;
 long k = (start + addr) >> TARGET_PAGE_BITS;
 if (!test_and_set_bit(k, dest)) {
 num_dirty++;
@@ -511,6 +509,7 @@ uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
 }
 }
 
+*new_dirty_pages += num_dirty;
 return num_dirty;
 }
 #endif
-- 
2.19.1

RE: [PATCH 0/5] colo: Introduce resource agent and test suite/CI

[Zhang, Chen]

> -Original Message-
> From: Lukas Straub 
> Sent: Sunday, June 7, 2020 3:00 AM
> To: Zhang, Chen 
> Cc: qemu-devel ; Alberto Garcia
> ; Dr. David Alan Gilbert ; Jason
> Wang 
> Subject: Re: [PATCH 0/5] colo: Introduce resource agent and test suite/CI
> 
> On Mon, 18 May 2020 09:38:24 +
> "Zhang, Chen"  wrote:
> 
> > > -Original Message-
> > > From: Lukas Straub 
> > > Sent: Monday, May 11, 2020 8:27 PM
> > > To: qemu-devel 
> > > Cc: Alberto Garcia ; Dr. David Alan Gilbert
> > > ; Zhang, Chen 
> > > Subject: [PATCH 0/5] colo: Introduce resource agent and test
> > > suite/CI
> > >
> > > Hello Everyone,
> > > These patches introduce a resource agent for fully automatic
> > > management of colo and a test suite building upon the resource agent to
> extensively test colo.
> > >
> > > Test suite features:
> > > -Tests failover with peer crashing and hanging and failover during
> > > checkpoint -Tests network using ssh and iperf3 -Quick test requires
> > > no special configuration -Network test for testing colo-compare
> > > -Stress test: failover all the time with network load
> > >
> > > Resource agent features:
> > > -Fully automatic management of colo
> > > -Handles many failures: hanging/crashing qemu, replication error,
> > > disk error, ...
> > > -Recovers from hanging qemu by using the "yank" oob command -Tracks
> > > which node has up-to-date data -Works well in clusters with more
> > > than 2 nodes
> > >
> > > Run times on my laptop:
> > > Quick test: 200s
> > > Network test: 800s (tagged as slow)
> > > Stress test: 1300s (tagged as slow)
> > >
> > > The test suite needs access to a network bridge to properly test the
> > > network, so some parameters need to be given to the test run. See
> > > tests/acceptance/colo.py for more information.
> > >
> > > I wonder how this integrates in existing CI infrastructure. Is there
> > > a common CI for qemu where this can run or does every subsystem have
> > > to run their own CI?
> >
> > Wow~ Very happy to see this series.
> > I have checked the "how to" in tests/acceptance/colo.py, But it looks
> > not enough for users, can you write an independent document for this
> series?
> > Include test Infrastructure ASC II diagram,  test cases design ,
> > detailed how to and more information for pacemaker cluster and resource
> agent..etc ?
> 
> Hi,
> I quickly created a more complete howto for configuring a pacemaker cluster
> and using the resource agent, I hope it helps:
> https://wiki.qemu.org/Features/COLO/Managed_HOWTO

Hi Lukas,

I noticed you contribute some content in Qemu COLO WIKI.
For the Features/COLO/Manual HOWTO
https://wiki.qemu.org/Features/COLO/Manual_HOWTO

Why not keep the Secondary side start command same with the 
qemu/docs/COLO-FT.txt?
If I understand correctly, add the quorum related command in secondary will 
support resume replication.
Then, we can add primary/secondary resume step here.

Thanks
Zhang Chen

> 
> Regards,
> Lukas Straub
> 
> > Thanks
> > Zhang Chen
> >
> >
> > >
> > > Regards,
> > > Lukas Straub
> > >
> > >
> > > Lukas Straub (5):
> > >   block/quorum.c: stable children names
> > >   colo: Introduce resource agent
> > >   colo: Introduce high-level test suite
> > >   configure,Makefile: Install colo resource-agent
> > >   MAINTAINERS: Add myself as maintainer for COLO resource agent
> > >
> > >  MAINTAINERS  |6 +
> > >  Makefile |5 +
> > >  block/quorum.c   |   20 +-
> > >  configure|   10 +
> > >  scripts/colo-resource-agent/colo | 1429 ++
> > >  scripts/colo-resource-agent/crm_master   |   44 +
> > >  scripts/colo-resource-agent/crm_resource |   12 +
> > >  tests/acceptance/colo.py |  689 +++
> > >  8 files changed, 2209 insertions(+), 6 deletions(-)  create mode
> > > 100755 scripts/colo-resource-agent/colo  create mode 100755
> > > scripts/colo-resource- agent/crm_master  create mode 100755
> > > scripts/colo-resource-agent/crm_resource
> > >  create mode 100644 tests/acceptance/colo.py
> > >
> > > --
> > > 2.20.1

Re: [PATCH 0/5] QEMU Gating CI

[Cleber Rosa]

On Thu, Apr 23, 2020 at 01:04:13PM -0400, Cleber Rosa wrote:
> 
> 
> - Original Message -
> > From: "Peter Maydell" 
> > To: "Markus Armbruster" 
> > Cc: "Fam Zheng" , "Thomas Huth" , 
> > "Beraldo Leal" , "Erik
> > Skultety" , "Alex Bennée" , 
> > "Wainer Moschetta" ,
> > "QEMU Developers" , "Wainer dos Santos Moschetta" 
> > , "Willian Rampazzo"
> > , "Cleber Rosa" , "Philippe 
> > Mathieu-Daudé" , "Eduardo
> > Habkost" 
> > Sent: Tuesday, April 21, 2020 8:53:49 AM
> > Subject: Re: [PATCH 0/5] QEMU Gating CI
> > 
> > On Thu, 19 Mar 2020 at 16:33, Markus Armbruster  wrote:
> > > Peter Maydell  writes:
> > > > I think we should start by getting the gitlab setup working
> > > > for the basic "x86 configs" first. Then we can try adding
> > > > a runner for s390 (that one's logistically easiest because
> > > > it is a project machine, not one owned by me personally or
> > > > by Linaro) once the basic framework is working, and expand
> > > > from there.
> > >
> > > Makes sense to me.
> > >
> > > Next steps to get this off the ground:
> > >
> > > * Red Hat provides runner(s) for x86 stuff we care about.
> > >
> > > * If that doesn't cover 'basic "x86 configs" in your judgement, we
> > >   fill the gaps as described below under "Expand from there".
> > >
> > > * Add an s390 runner using the project machine you mentioned.
> > >
> > > * Expand from there: identify the remaining gaps, map them to people /
> > >   organizations interested in them, and solicit contributions from these
> > >   guys.
> > >
> > > A note on contributions: we need both hardware and people.  By people I
> > > mean maintainers for the infrastructure, the tools and all the runners.
> > > Cleber & team are willing to serve for the infrastructure, the tools and
> > > the Red Hat runners.
> > 
> > So, with 5.0 nearly out the door it seems like a good time to check
> > in on this thread again to ask where we are progress-wise with this.
> > My impression is that this patchset provides most of the scripting
> > and config side of the first step, so what we need is for RH to provide
> > an x86 runner machine and tell the gitlab CI it exists. I appreciate
> > that the whole coronavirus and working-from-home situation will have
> > upended everybody's plans, especially when actual hardware might
> > be involved, but how's it going ?
> > 
> 
> Hi Peter,
> 
> You hit the nail in the head here.  We were affected indeed with our ability
> to move some machines from one lab to another (across the country), but we're
> actively working on it.
> 
> From now on, I'll give you an update every time a significant event occurs on
> our side.
>

Hi all,

It took a while, but I finally have some updates, and they're pretty
good news.

Red Hat is sponsoring 3 x86_64 machines that will act as runners for
the QEMU CI, and together with QEMU's own s390 and aarch64 machines (1
each), we have enough hardware now for a reasonable build and test
coverage.

The s390 and aarch64 machines are already up and running, and the
x86_64 machines are being racked up, but should be up and running
in the next few days.  I'm working on an updated version of this
series that takes into account this new scenario, and some
fixes and improvements.

And as a reminder, if you (individual or organization) would like to
sponsor hardware or people to expand the QEMU build and test coverage,
please reach out to us.

Thanks,
- Cleber.

> > thanks
> > -- PMM
> > 
> > 
> 
> Thanks for checking in!
> - Cleber.


signature.asc
Description: PGP signature

Re: [PATCH] hw/acpi: specify 64-bit acpi table

[no-reply]

Patchew URL: https://patchew.org/QEMU/20200616003654.1058035-1-ja...@zx2c4.com/



Hi,

This series failed the asan build test. Please find the testing commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
export ARCH=x86_64
make docker-image-fedora V=1 NETWORK=1
time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
=== TEST SCRIPT END ===

PASS 25 test-qobject-output-visitor /visitor/output/list_union/string
PASS 26 test-qobject-output-visitor /visitor/output/list_union/number
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-clone-visitor -m=quick -k --tap < /dev/null | 
./scripts/tap-driver.pl --test-name="test-clone-visitor" 
==6201==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 fdc-test /x86_64/fdc/media_change
PASS 5 fdc-test /x86_64/fdc/sense_interrupt
PASS 6 fdc-test /x86_64/fdc/relative_seek
---
PASS 32 test-opts-visitor /visitor/opts/range/beyond
PASS 33 test-opts-visitor /visitor/opts/dict/unvisited
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-coroutine -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-coroutine" 
==6243==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
==6243==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 
0x7ffd24264000; bottom 0x7fad671d9000; size: 0x004fbd08b000 (342473879552)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 1 test-coroutine /basic/no-dangling-access
---
PASS 11 test-aio /aio/event/wait
PASS 12 test-aio /aio/event/flush
PASS 13 test-aio /aio/event/wait/no-flush-cb
==6258==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 14 test-aio /aio/timer/schedule
PASS 11 fdc-test /x86_64/fdc/read_no_dma_18
PASS 15 test-aio /aio/coroutine/queue-chaining
---
PASS 28 test-aio /aio-gsource/timer/schedule
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-aio-multithread -m=quick -k --tap < /dev/null | 
./scripts/tap-driver.pl --test-name="test-aio-multithread" 
PASS 1 test-aio-multithread /aio/multi/lifecycle
==6263==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 2 test-aio-multithread /aio/multi/schedule
PASS 3 test-aio-multithread /aio/multi/mutex/contended
PASS 12 fdc-test /x86_64/fdc/read_no_dma_19
PASS 13 fdc-test /x86_64/fdc/fuzz-registers
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img 
tests/qtest/ide-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="ide-test" 
==6290==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 ide-test /x86_64/ide/identify
==6296==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 2 ide-test /x86_64/ide/flush
PASS 4 test-aio-multithread /aio/multi/mutex/handoff
==6302==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 3 ide-test /x86_64/ide/bmdma/simple_rw
PASS 5 test-aio-multithread /aio/multi/mutex/mcs
==6313==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 4 ide-test /x86_64/ide/bmdma/trim
==6324==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 6 test-aio-multithread /aio/multi/mutex/pthread
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-throttle -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-throttle" 
==6331==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 1 test-throttle /throttle/leak_bucket
PASS 2 test-throttle /throttle/compute_wait
PASS 3 test-throttle /throttle/init
---
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  
tests/test-thread-pool -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl 
--test-name="test-thread-pool" 
PASS 1 test-thread-pool /thread-pool/submit
PASS 2 test-thread-pool /thread-pool/submit-aio
==6335==WARNING: ASan doesn't fully support makecontext/swapcontext functions 
and may produce false positives in some cases!
PASS 3 test-thread-pool /thread-pool/submit-co
PASS 4 test-thread-pool /thread-pool/submit-many
PASS 5 test-thread-pool /thread-pool/cancel
---
PASS 39 test-hbitmap /hbitmap/next_dirty_area/next_dirty_area_4
PASS 40 test-hbitmap 

Re: [PATCH] migration: Count new_dirty instead of real_dirty

[zhukeqian]

Hi Jay Zhou,

On 2020/6/15 19:50, Zhoujian (jay) wrote:
> Hi Keqian,
> 
>> -Original Message-
>> From: zhukeqian
>> Sent: Monday, June 15, 2020 11:19 AM
>> To: qemu-devel@nongnu.org; qemu-...@nongnu.org; Paolo Bonzini
>> ; Zhoujian (jay) 
>> Cc: Juan Quintela ; Chao Fan ;
>> Wanghaibin (D) 
>> Subject: Re: [PATCH] migration: Count new_dirty instead of real_dirty
>>
>> Hi Paolo and Jian Zhou,
>>
>> Do you have any suggestion on this patch?
>>
>> Thanks,
>> Keqian
>>
>> On 2020/6/1 12:02, Keqian Zhu wrote:
>>> DIRTY_LOG_INITIALLY_ALL_SET feature is on the queue. This fixs the
> 
> s/fixs/fixes
Thanks.
> 
>>> dirty rate calculation for this feature. After introducing this
>>> feature, real_dirty_pages is equal to total memory size at begining.
>>> This causing wrong dirty rate and false positive throttling.
> 
> I think it should be tested whether DIRTY_LOG_INITIALLY_ALL_SET is enabled
> in ram_init_bitmaps(maybe?) in order to be compatible with the old path.
Yeah, you are right ;-)

But after I tested old path yesterday, I found that the num_dirty_pages_period
becomes total ram size after log sync in ram_init_bitmaps. The reason is that
bitmap of ramblock is initialized to be all set, so old path counts them as 
dirty
by mistake.

This bug causes false positive throttling at the end of first ram save 
iteration,
even without our DIRTY_LOG_INITIALLY_ALL_SET feature.
> 
> Thanks,
> Jay Zhou
> 
>>>
>>> BTW, real dirty rate is not suitable and not very accurate.
>>>
>>> 1. For not suitable: We mainly concern on the relationship between
>>>dirty rate and network bandwidth. Net increasement of dirty pages
>>>makes more sense.
>>> 2. For not very accurate: With manual dirty log clear, some dirty pages
>>>will be cleared during each peroid, our "real dirty rate" is less
>>>than real "real dirty rate".
> 
I should correct these commit messages for reason above :-)
> 
> 
>>>
>>> Signed-off-by: Keqian Zhu 
[...]

Thanks,
Keqian

Re: [PATCH] hw/acpi: specify 64-bit acpi table

[no-reply]

Patchew URL: https://patchew.org/QEMU/20200616003654.1058035-1-ja...@zx2c4.com/



Hi,

This series failed the docker-quick@centos7 build test. Please find the testing 
commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
make docker-image-centos7 V=1 NETWORK=1
time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
=== TEST SCRIPT END ===

acpi-test: Warning! DSDT binary file mismatch. Actual [aml:/tmp/aml-82GJM0], 
Expected [aml:tests/data/acpi/pc/DSDT].
See source file tests/qtest/bios-tables-test.c for instructions on how to 
update expected files.
to see ASL diff between mismatched files install IASL, rebuild QEMU from 
scratch and re-run tests with V=1 environment variable set**
ERROR:/tmp/qemu-test/src/tests/qtest/bios-tables-test.c:494:test_acpi_asl: 
assertion failed: (all_tables_match)
ERROR - Bail out! 
ERROR:/tmp/qemu-test/src/tests/qtest/bios-tables-test.c:494:test_acpi_asl: 
assertion failed: (all_tables_match)
make: *** [check-qtest-x86_64] Error 1
make: *** Waiting for unfinished jobs
  TESTcheck-unit: tests/test-uuid
  TESTcheck-unit: tests/ptimer-test
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', 
'--label', 'com.qemu.instance.uuid=4ab0846b17934bfaaf93d067b9fe8f54', '-u', 
'1001', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', 
'-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 
'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', 
'/home/patchew/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', 
'/var/tmp/patchew-tester-tmp-4jtkwojc/src/docker-src.2020-06-15-20.44.30.15176:/var/tmp/qemu:z,ro',
 'qemu:centos7', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit 
status 2.
filter=--filter=label=com.qemu.instance.uuid=4ab0846b17934bfaaf93d067b9fe8f54
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-4jtkwojc/src'
make: *** [docker-run-test-quick@centos7] Error 2

real15m3.057s
user0m8.689s


The full log is available at
http://patchew.org/logs/20200616003654.1058035-1-ja...@zx2c4.com/testing.docker-quick@centos7/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

[PATCH v2 5/5] hw/riscv: sifive_u: Add a dummy DDR memory controller device

[Bin Meng]

From: Bin Meng 

It is enough to simply map the SiFive FU540 DDR memory controller
into the MMIO space using create_unimplemented_device(), to make
the upstream U-Boot v2020.07 DDR memory initialization codes happy.

Note we do not generate device tree fragment for the DDR memory
controller. Since the controller data in device tree consumes a
very large space (see fu540-hifive-unleashed-a00-ddr.dtsi in the
U-Boot source), and it is only needed by U-Boot SPL but not any
operating system, we choose not to generate the fragment here.
This also means when testing with U-Boot SPL, the device tree has
to come from U-Boot SPL itself, but not the one generated by QEMU
on the fly. The memory has to be set to 8GiB to match the real
HiFive Unleashed board when invoking QEMU (-m 8G).

With this commit, QEMU can boot U-Boot SPL built for SiFive FU540
all the way up to loading U-Boot proper from MMC:

$ qemu-system-riscv64 -nographic -M sifive_u,msel=6 -m 8G -bios u-boot-spl.bin

U-Boot SPL 2020.07-rc3-00208-g88bd5b1 (Jun 08 2020 - 20:16:10 +0800)
Trying to boot from MMC1
Unhandled exception: Load access fault
EPC: 08009be6 TVAL: 10050014

The above exception is expected because QSPI is unsupported yet.

Signed-off-by: Bin Meng 
Reviewed-by: Alistair Francis 

---

(no changes since v1)

 hw/riscv/sifive_u.c | 4 
 include/hw/riscv/sifive_u.h | 1 +
 2 files changed, 5 insertions(+)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index c94ff6f..7923df4 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -82,6 +82,7 @@ static const struct MemmapEntry {
 [SIFIVE_U_OTP] =  { 0x1007, 0x1000 },
 [SIFIVE_U_GEM] =  { 0x1009, 0x2000 },
 [SIFIVE_U_GEM_MGMT] = { 0x100a, 0x1000 },
+[SIFIVE_U_DMC] =  { 0x100b,0x1 },
 [SIFIVE_U_FLASH0] =   { 0x2000, 0x1000 },
 [SIFIVE_U_DRAM] = { 0x8000,0x0 },
 };
@@ -733,6 +734,9 @@ static void sifive_u_soc_realize(DeviceState *dev, Error 
**errp)
 
 create_unimplemented_device("riscv.sifive.u.gem-mgmt",
 memmap[SIFIVE_U_GEM_MGMT].base, memmap[SIFIVE_U_GEM_MGMT].size);
+
+create_unimplemented_device("riscv.sifive.u.dmc",
+memmap[SIFIVE_U_DMC].base, memmap[SIFIVE_U_DMC].size);
 }
 
 static Property sifive_u_soc_props[] = {
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index 5d80f91..3e33646 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -78,6 +78,7 @@ enum {
 SIFIVE_U_UART1,
 SIFIVE_U_GPIO,
 SIFIVE_U_OTP,
+SIFIVE_U_DMC,
 SIFIVE_U_FLASH0,
 SIFIVE_U_DRAM,
 SIFIVE_U_GEM,
-- 
2.7.4

[PATCH v2 4/5] hw/riscv: sifive_u: Sort the SoC memmap table entries

[Bin Meng]

From: Bin Meng 

Move the flash and DRAM to the end of the SoC memmap table.

Signed-off-by: Bin Meng 
Reviewed-by: Alistair Francis 
---

(no changes since v1)

 hw/riscv/sifive_u.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index f64aa52..c94ff6f 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -80,10 +80,10 @@ static const struct MemmapEntry {
 [SIFIVE_U_UART1] ={ 0x10011000, 0x1000 },
 [SIFIVE_U_GPIO] = { 0x1006, 0x1000 },
 [SIFIVE_U_OTP] =  { 0x1007, 0x1000 },
-[SIFIVE_U_FLASH0] =   { 0x2000, 0x1000 },
-[SIFIVE_U_DRAM] = { 0x8000,0x0 },
 [SIFIVE_U_GEM] =  { 0x1009, 0x2000 },
 [SIFIVE_U_GEM_MGMT] = { 0x100a, 0x1000 },
+[SIFIVE_U_FLASH0] =   { 0x2000, 0x1000 },
+[SIFIVE_U_DRAM] = { 0x8000,0x0 },
 };
 
 #define OTP_SERIAL  1
-- 
2.7.4

[PATCH v2 3/5] hw/riscv: sifive_u: Support different boot source per MSEL pin state

[Bin Meng]

From: Bin Meng 

SiFive FU540 SoC supports booting from several sources, which are
controlled using the Mode Select (MSEL[3:0]) pins on the chip.
Typically, the boot process runs through several stages before it
begins execution of user-provided programs.

The SoC supports booting from memory-mapped QSPI flash, which is
how start_in_flash property is used for at present. This matches
MSEL = 1 configuration (QSPI0).

Typical booting flows involve the Zeroth Stage Boot Loader (ZSBL).
It's not necessary for QEMU to implement the full ZSBL ROM codes,
because we know ZSBL downloads the next stage program into the L2
LIM at address 0x800 and executes from there. We can bypass
the whole ZSBL execution and use "-bios" to load the next stage
program directly if MSEL indicates a ZSBL booting flow.

Signed-off-by: Bin Meng 
Reviewed-by: Alistair Francis 
---

(no changes since v1)

 hw/riscv/sifive_u.c | 39 +++
 include/hw/riscv/sifive_u.h |  6 ++
 2 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index 0a86ffc..f64aa52 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -408,8 +408,34 @@ static void sifive_u_machine_init(MachineState *machine)
 /* create device tree */
 create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline);
 
-riscv_find_and_load_firmware(machine, BIOS_FILENAME,
- memmap[SIFIVE_U_DRAM].base, NULL);
+if (s->start_in_flash) {
+/*
+ * If start_in_flash property is given, assign s->msel to a value
+ * that representing booting from QSPI0 memory-mapped flash.
+ *
+ * This also means that when both start_in_flash and msel properties
+ * are given, start_in_flash takes the precedence over msel.
+ *
+ * Note this is to keep backward compatibility not to break existing
+ * users that use start_in_flash property.
+ */
+s->msel = MSEL_MEMMAP_QSPI0_FLASH;
+}
+
+switch (s->msel) {
+case MSEL_MEMMAP_QSPI0_FLASH:
+start_addr = memmap[SIFIVE_U_FLASH0].base;
+break;
+case MSEL_L2LIM_QSPI0_FLASH:
+case MSEL_L2LIM_QSPI2_SD:
+start_addr = memmap[SIFIVE_U_L2LIM].base;
+break;
+default:
+start_addr = memmap[SIFIVE_U_DRAM].base;
+break;
+}
+
+riscv_find_and_load_firmware(machine, BIOS_FILENAME, start_addr, NULL);
 
 if (machine->kernel_filename) {
 uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
@@ -427,13 +453,9 @@ static void sifive_u_machine_init(MachineState *machine)
 }
 }
 
-if (s->start_in_flash) {
-start_addr = memmap[SIFIVE_U_FLASH0].base;
-}
-
 /* reset vector */
 uint32_t reset_vec[8] = {
-0x,
+s->msel,   /* MSEL pin state */
 0x0297,/* 1:  auipc  t0, %pcrel_hi(dtb) */
 0x01c28593,/* addi   a1, t0, %pcrel_lo(1b) */
 0xf1402573,/* csrr   a0, mhartid  */
@@ -505,7 +527,8 @@ static void sifive_u_machine_instance_init(Object *obj)
  sifive_u_machine_set_start_in_flash);
 object_property_set_description(obj, "start-in-flash",
 "Set on to tell QEMU's ROM to jump to "
-"flash. Otherwise QEMU will jump to DRAM");
+"flash. Otherwise QEMU will jump to DRAM "
+"or L2LIM depending on the msel value");
 
 s->msel = 0;
 object_property_add(obj, "msel", "uint32",
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index d82cfe0..5d80f91 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -111,6 +111,12 @@ enum {
 SIFIVE_U_RTCCLK_FREQ = 100
 };
 
+enum {
+MSEL_MEMMAP_QSPI0_FLASH = 1,
+MSEL_L2LIM_QSPI0_FLASH = 6,
+MSEL_L2LIM_QSPI2_SD = 11
+};
+
 #define SIFIVE_U_MANAGEMENT_CPU_COUNT   1
 #define SIFIVE_U_COMPUTE_CPU_COUNT  4
 
-- 
2.7.4

[PATCH v2 1/5] target/riscv: Rename IBEX CPU init routine

[Bin Meng]

From: Bin Meng 

Current IBEX CPU init routine name seems to be too generic.
Since it uses a different reset vector from the generic one,
it merits a dedicated name.

Signed-off-by: Bin Meng 

---

Changes in v2:
- new patch: Rename IBEX CPU init routine

 target/riscv/cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e867766..5f03458 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -153,7 +153,7 @@ static void rvxx_imacu_nommu_cpu_init(Object *obj)
 
 #if defined(TARGET_RISCV32)
 
-static void rv32_imcu_nommu_cpu_init(Object *obj)
+static void rv32_ibex_cpu_init(Object *obj)
 {
 CPURISCVState *env = _CPU(obj)->env;
 set_misa(env, RV32 | RVI | RVM | RVC | RVU);
@@ -577,7 +577,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 DEFINE_CPU(TYPE_RISCV_CPU_ANY,  riscv_any_cpu_init),
 #if defined(TARGET_RISCV32)
 DEFINE_CPU(TYPE_RISCV_CPU_BASE32,   riscv_base_cpu_init),
-DEFINE_CPU(TYPE_RISCV_CPU_IBEX, rv32_imcu_nommu_cpu_init),
+DEFINE_CPU(TYPE_RISCV_CPU_IBEX, rv32_ibex_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,   rvxx_imacu_nommu_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,   rv32_imafcu_nommu_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,   rvxx_gcsu_priv1_10_0_cpu_init),
-- 
2.7.4

[PATCH v2 0/5] hw/riscv: sifive_u: Add Mode Select (MSEL[3:0]) support

[Bin Meng]

From: Bin Meng 

This series updates the 'sifive_u' machine support:

- Change SiFive E/U series CPU reset vector to 0x1004
- Support Mode Select (MSEL[3:0]) settings at 0x1000 via a new
  "msel" machine property
- Add a dummy DDR memory controller device

With this series, QEMU can boot U-Boot SPL built for SiFive FU540
all the way up to loading U-Boot proper from MMC:

$ qemu-system-riscv64 -nographic -M sifive_u,msel=6 -m 8G -bios u-boot-spl.bin

U-Boot SPL 2020.07-rc3-00208-g88bd5b1 (Jun 08 2020 - 20:16:10 +0800)
Trying to boot from MMC1
Unhandled exception: Load access fault
EPC: 08009be6 TVAL: 10050014

The last big gap for the 'sifive_u' machine is the QSPI modeling.

Changes in v2:
- Drop the already applied patch 01 to 11 in v1
- new patch: Rename IBEX CPU init routine
- rebase on https://github.com/alistair23/qemu riscv-to-apply.next branch
- rename SiFive E/U CPU init routine names

Bin Meng (5):
  target/riscv: Rename IBEX CPU init routine
  hw/riscv: sifive: Change SiFive E/U CPU reset vector to 0x1004
  hw/riscv: sifive_u: Support different boot source per MSEL pin state
  hw/riscv: sifive_u: Sort the SoC memmap table entries
  hw/riscv: sifive_u: Add a dummy DDR memory controller device

 hw/riscv/sifive_e.c | 10 +
 hw/riscv/sifive_u.c | 51 ++---
 include/hw/riscv/sifive_u.h |  7 +++
 target/riscv/cpu.c  | 20 +-
 4 files changed, 62 insertions(+), 26 deletions(-)

-- 
2.7.4

[PATCH v2 2/5] hw/riscv: sifive: Change SiFive E/U CPU reset vector to 0x1004

[Bin Meng]

From: Bin Meng 

Per the SiFive manual, all E/U series CPU cores' reset vector is
at 0x1004. Update our codes to match the hardware.

Signed-off-by: Bin Meng 

---

Changes in v2:
- rebase on https://github.com/alistair23/qemu riscv-to-apply.next branch
- rename SiFive E/U CPU init routine names

 hw/riscv/sifive_e.c | 10 ++
 hw/riscv/sifive_u.c |  6 +++---
 target/riscv/cpu.c  | 16 
 3 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index d9a5c7b..d1d3bf1 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -98,14 +98,16 @@ static void sifive_e_machine_init(MachineState *machine)
 memmap[SIFIVE_E_DTIM].base, main_mem);
 
 /* Mask ROM reset vector */
-uint32_t reset_vec[2];
+uint32_t reset_vec[4];
 
 if (s->revb) {
-reset_vec[0] = 0x200102b7;/* 0x1000: lui t0,0x20010 */
+reset_vec[1] = 0x200102b7;  /* 0x1004: lui t0,0x20010 */
 } else {
-reset_vec[0] = 0x204002b7;/* 0x1000: lui t0,0x20400 */
+reset_vec[1] = 0x204002b7;  /* 0x1004: lui t0,0x20400 */
 }
-reset_vec[1] = 0x00028067;/* 0x1004: jr  t0 */
+reset_vec[2] = 0x00028067;  /* 0x1008: jr  t0 */
+
+reset_vec[0] = reset_vec[3] = 0;
 
 /* copy in the reset vector in little_endian byte order */
 for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index aaa5adb..0a86ffc 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -433,18 +433,18 @@ static void sifive_u_machine_init(MachineState *machine)
 
 /* reset vector */
 uint32_t reset_vec[8] = {
+0x,
 0x0297,/* 1:  auipc  t0, %pcrel_hi(dtb) */
-0x02028593,/* addi   a1, t0, %pcrel_lo(1b) */
+0x01c28593,/* addi   a1, t0, %pcrel_lo(1b) */
 0xf1402573,/* csrr   a0, mhartid  */
 #if defined(TARGET_RISCV32)
 0x0182a283,/* lw t0, 24(t0) */
 #elif defined(TARGET_RISCV64)
-0x0182b283,/* ld t0, 24(t0) */
+0x0182e283,/* lwut0, 24(t0) */
 #endif
 0x00028067,/* jr t0 */
 0x,
 start_addr,/* start: .dword */
-0x,
/* dtb: */
 };
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 5f03458..391a0b9 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -134,20 +134,20 @@ static void riscv_base_cpu_init(Object *obj)
 set_resetvec(env, DEFAULT_RSTVEC);
 }
 
-static void rvxx_gcsu_priv1_10_0_cpu_init(Object *obj)
+static void rvxx_sifive_u_cpu_init(Object *obj)
 {
 CPURISCVState *env = _CPU(obj)->env;
 set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
 set_priv_version(env, PRIV_VERSION_1_10_0);
-set_resetvec(env, DEFAULT_RSTVEC);
+set_resetvec(env, 0x1004);
 }
 
-static void rvxx_imacu_nommu_cpu_init(Object *obj)
+static void rvxx_sifive_e_cpu_init(Object *obj)
 {
 CPURISCVState *env = _CPU(obj)->env;
 set_misa(env, RVXLEN | RVI | RVM | RVA | RVC | RVU);
 set_priv_version(env, PRIV_VERSION_1_10_0);
-set_resetvec(env, DEFAULT_RSTVEC);
+set_resetvec(env, 0x1004);
 qdev_prop_set_bit(DEVICE(obj), "mmu", false);
 }
 
@@ -578,13 +578,13 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #if defined(TARGET_RISCV32)
 DEFINE_CPU(TYPE_RISCV_CPU_BASE32,   riscv_base_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_IBEX, rv32_ibex_cpu_init),
-DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,   rvxx_imacu_nommu_cpu_init),
+DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E31,   rvxx_sifive_e_cpu_init),
 DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E34,   rv32_imafcu_nommu_cpu_init),
-DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,   rvxx_gcsu_priv1_10_0_cpu_init),
+DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U34,   rvxx_sifive_u_cpu_init),
 #elif defined(TARGET_RISCV64)
 DEFINE_CPU(TYPE_RISCV_CPU_BASE64,   riscv_base_cpu_init),
-DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,   rvxx_imacu_nommu_cpu_init),
-DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,   rvxx_gcsu_priv1_10_0_cpu_init),
+DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_E51,   rvxx_sifive_e_cpu_init),
+DEFINE_CPU(TYPE_RISCV_CPU_SIFIVE_U54,   rvxx_sifive_u_cpu_init),
 #endif
 };
 
-- 
2.7.4

[PATCH v2 8/8] sm501: Convert debug printfs to traces

[BALATON Zoltan]

Signed-off-by: BALATON Zoltan 
---
 hw/display/sm501.c  | 50 +++--
 hw/display/trace-events | 12 ++
 2 files changed, 25 insertions(+), 37 deletions(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 583a0ff6b5..abe75f21dc 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -39,15 +39,7 @@
 #include "qemu/range.h"
 #include "ui/pixel_ops.h"
 #include "qemu/bswap.h"
-
-/*#define DEBUG_SM501*/
-/*#define DEBUG_BITBLT*/
-
-#ifdef DEBUG_SM501
-#define SM501_DPRINTF(fmt, ...) printf(fmt, ## __VA_ARGS__)
-#else
-#define SM501_DPRINTF(fmt, ...) do {} while (0)
-#endif
+#include "trace.h"
 
 #define MMIO_BASE_OFFSET 0x3e0
 #define MMIO_SIZE 0x20
@@ -871,7 +863,6 @@ static uint64_t sm501_system_config_read(void *opaque, 
hwaddr addr,
 {
 SM501State *s = (SM501State *)opaque;
 uint32_t ret = 0;
-SM501_DPRINTF("sm501 system config regs : read addr=%x\n", (int)addr);
 
 switch (addr) {
 case SM501_SYSTEM_CONTROL:
@@ -923,7 +914,7 @@ static uint64_t sm501_system_config_read(void *opaque, 
hwaddr addr,
 qemu_log_mask(LOG_UNIMP, "sm501: not implemented system config"
   "register read. addr=%" HWADDR_PRIx "\n", addr);
 }
-
+trace_sm501_system_config_read(addr, ret);
 return ret;
 }
 
@@ -931,9 +922,8 @@ static void sm501_system_config_write(void *opaque, hwaddr 
addr,
   uint64_t value, unsigned size)
 {
 SM501State *s = (SM501State *)opaque;
-SM501_DPRINTF("sm501 system config regs : write addr=%x, val=%x\n",
-  (uint32_t)addr, (uint32_t)value);
 
+trace_sm501_system_config_write((uint32_t)addr, (uint32_t)value);
 switch (addr) {
 case SM501_SYSTEM_CONTROL:
 s->system_control &= 0x10DB;
@@ -1019,9 +1009,7 @@ static uint64_t sm501_i2c_read(void *opaque, hwaddr addr, 
unsigned size)
 qemu_log_mask(LOG_UNIMP, "sm501 i2c : not implemented register read."
   " addr=0x%" HWADDR_PRIx "\n", addr);
 }
-
-SM501_DPRINTF("sm501 i2c regs : read addr=%" HWADDR_PRIx " val=%x\n",
-  addr, ret);
+trace_sm501_i2c_read((uint32_t)addr, ret);
 return ret;
 }
 
@@ -1029,9 +1017,8 @@ static void sm501_i2c_write(void *opaque, hwaddr addr, 
uint64_t value,
 unsigned size)
 {
 SM501State *s = (SM501State *)opaque;
-SM501_DPRINTF("sm501 i2c regs : write addr=%" HWADDR_PRIx
-  " val=%" PRIx64 "\n", addr, value);
 
+trace_sm501_i2c_write((uint32_t)addr, (uint32_t)value);
 switch (addr) {
 case SM501_I2C_BYTE_COUNT:
 s->i2c_byte_count = value & 0xf;
@@ -1045,25 +1032,19 @@ static void sm501_i2c_write(void *opaque, hwaddr addr, 
uint64_t value,
 s->i2c_status |= (res ? SM501_I2C_STATUS_ERROR : 0);
 if (!res) {
 int i;
-SM501_DPRINTF("sm501 i2c : transferring %d bytes to 
0x%x\n",
-  s->i2c_byte_count + 1, s->i2c_addr >> 1);
 for (i = 0; i <= s->i2c_byte_count; i++) {
 res = i2c_send_recv(s->i2c_bus, >i2c_data[i],
 !(s->i2c_addr & 1));
 if (res) {
-SM501_DPRINTF("sm501 i2c : transfer failed"
-  " i=%d, res=%d\n", i, res);
 s->i2c_status |= SM501_I2C_STATUS_ERROR;
 return;
 }
 }
 if (i) {
-SM501_DPRINTF("sm501 i2c : transferred %d bytes\n", i);
 s->i2c_status = SM501_I2C_STATUS_COMPLETE;
 }
 }
 } else {
-SM501_DPRINTF("sm501 i2c : end transfer\n");
 i2c_end_transfer(s->i2c_bus);
 s->i2c_status &= ~SM501_I2C_STATUS_ERROR;
 }
@@ -1103,7 +1084,8 @@ static const MemoryRegionOps sm501_i2c_ops = {
 static uint32_t sm501_palette_read(void *opaque, hwaddr addr)
 {
 SM501State *s = (SM501State *)opaque;
-SM501_DPRINTF("sm501 palette read addr=%x\n", (int)addr);
+
+trace_sm501_palette_read((uint32_t)addr);
 
 /* TODO : consider BYTE/WORD access */
 /* TODO : consider endian */
@@ -1116,8 +1098,8 @@ static void sm501_palette_write(void *opaque, hwaddr addr,
 uint32_t value)
 {
 SM501State *s = (SM501State *)opaque;
-SM501_DPRINTF("sm501 palette write addr=%x, val=%x\n",
-  (int)addr, value);
+
+trace_sm501_palette_write((uint32_t)addr, value);
 
 /* TODO : consider BYTE/WORD access */
 /* TODO : consider endian */
@@ -1132,7 +1114,6 @@ static uint64_t sm501_disp_ctrl_read(void *opaque, hwaddr 
addr,
 {
 SM501State *s = (SM501State *)opaque;
 uint32_t ret = 0;
-

[PATCH v2 3/8] sm501: Ignore no-op blits

[BALATON Zoltan]

Some guests seem to try source copy blits with same source and dest
which are no-op so avoid calling pixman for these.

Signed-off-by: BALATON Zoltan 
Reviewed-by: Peter Maydell 
---
 hw/display/sm501.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 85d54b598f..3397ca9fbf 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -788,6 +788,11 @@ static void sm501_2d_operation(SM501State *s)
   (rop2_source_is_pattern ?
   " with pattern source" : ""));
 }
+/* Ignore no-op blits, some guests seem to do this */
+if (src_base == dst_base && src_pitch == dst_pitch &&
+src_x == dst_x && src_y == dst_y) {
+break;
+}
 /* Check for overlaps, this could be made more exact */
 uint32_t sb, se, db, de;
 sb = src_base + src_x + src_y * (width + src_pitch);
-- 
2.21.3

[PATCH] hw/acpi: specify 64-bit acpi table

[Jason A. Donenfeld]

SSDTs cannot address 64-bit physical addresses in 32-bit tables, so we
increment the revision to '2' so that these larger addresses are
addressable. This matters because the DSDT revision represents the
maximum capability of all other SSDTs. This is also what arm does.

Signed-off-by: Jason A. Donenfeld 
---
 hw/i386/acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 900f786d08..51420d90a8 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -2073,7 +2073,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
 g_array_append_vals(table_data, dsdt->buf->data, dsdt->buf->len);
 build_header(linker, table_data,
 (void *)(table_data->data + table_data->len - dsdt->buf->len),
-"DSDT", dsdt->buf->len, 1, NULL, NULL);
+"DSDT", dsdt->buf->len, 2, NULL, NULL);
 free_aml_allocator();
 }
 
-- 
2.27.0

[PATCH v2 6/8] sm501: Use stn_he_p/ldn_he_p instead of switch/case

[BALATON Zoltan]

Instead of open coding op with different sizes using a switch and type
casting it can be written more compactly using stn_he_p/ldn_he_p.

Suggested-by: Peter Maydell 
Signed-off-by: BALATON Zoltan 
---
 hw/display/sm501.c | 12 +---
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index b6356ea1ee..6e914d3162 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -766,17 +766,7 @@ static void sm501_2d_operation(SM501State *s)
 for (y = 0; y < height; y++) {
 i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
 for (x = 0; x < width; x++, i += bypp) {
-switch (format) {
-case 0:
-d[i] = ~d[i];
-break;
-case 1:
-*(uint16_t *)[i] = ~*(uint16_t *)[i];
-break;
-case 2:
-*(uint32_t *)[i] = ~*(uint32_t *)[i];
-break;
-}
+stn_he_p([i], bypp, ~ldn_he_p([i], bypp));
 }
 }
 } else {
-- 
2.21.3

[PATCH v2 2/8] sm501: Drop unneded variable

[BALATON Zoltan]

We don't need a separate variable to keep track if we allocated memory
that needs to be freed as we can test the pointer itself.

Signed-off-by: BALATON Zoltan 
Reviewed-by: Peter Maydell 
---
 hw/display/sm501.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 5ae320ddc3..85d54b598f 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -796,13 +796,12 @@ static void sm501_2d_operation(SM501State *s)
 de = db + width + height * (width + dst_pitch);
 if (rtl && ((db >= sb && db <= se) || (de >= sb && de <= se))) {
 /* regions may overlap: copy via temporary */
-int free_buf = 0, llb = width * (1 << format);
+int llb = width * (1 << format);
 int tmp_stride = DIV_ROUND_UP(llb, sizeof(uint32_t));
 uint32_t *tmp = tmp_buf;
 
 if (tmp_stride * sizeof(uint32_t) * height > sizeof(tmp_buf)) {
 tmp = g_malloc(tmp_stride * sizeof(uint32_t) * height);
-free_buf = 1;
 }
 pixman_blt((uint32_t *)>local_mem[src_base], tmp,
src_pitch * (1 << format) / sizeof(uint32_t),
@@ -813,7 +812,7 @@ static void sm501_2d_operation(SM501State *s)
dst_pitch * (1 << format) / sizeof(uint32_t),
8 * (1 << format), 8 * (1 << format),
0, 0, dst_x, dst_y, width, height);
-if (free_buf) {
+if (tmp != tmp_buf) {
 g_free(tmp);
 }
 } else {
-- 
2.21.3

[PATCH v2 1/8] sm501: Fix bounds checks

[BALATON Zoltan]

We don't need to add width to pitch when calculating last point, that
would reject valid ops within the card's local_mem.

Fixes: b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4
Signed-off-by: BALATON Zoltan 
Reviewed-by: Peter Maydell 
---
 hw/display/sm501.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index edd8d24a76..5ae320ddc3 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -723,8 +723,8 @@ static void sm501_2d_operation(SM501State *s)
 dst_y -= height - 1;
 }
 
-if (dst_base >= get_local_mem_size(s) || dst_base +
-(dst_x + width + (dst_y + height) * (dst_pitch + width)) *
+if (dst_base >= get_local_mem_size(s) ||
+dst_base + (dst_x + width + (dst_y + height) * dst_pitch) *
 (1 << format) >= get_local_mem_size(s)) {
 qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
 return;
@@ -749,8 +749,8 @@ static void sm501_2d_operation(SM501State *s)
 src_y -= height - 1;
 }
 
-if (src_base >= get_local_mem_size(s) || src_base +
-(src_x + width + (src_y + height) * (src_pitch + width)) *
+if (src_base >= get_local_mem_size(s) ||
+src_base + (src_x + width + (src_y + height) * src_pitch) *
 (1 << format) >= get_local_mem_size(s)) {
 qemu_log_mask(LOG_GUEST_ERROR,
   "sm501: 2D op src is outside vram.\n");
-- 
2.21.3

[PATCH v2 0/8] More sm501 fixes and optimisations

[BALATON Zoltan]

Version 2 with changes according to review by Peter plus some new
patches added. Still need to verify overlap checks so likely will be
another version but sending it now if additional comments come up.

Regards,
BALATON Zoltan

BALATON Zoltan (8):
  sm501: Fix bounds checks
  sm501: Drop unneded variable
  sm501: Ignore no-op blits
  sm501: Introduce variable for commonly used value for better
readability
  sm501: Optimise 1 pixel 2d ops
  sm501: Use stn_he_p/ldn_he_p instead of switch/case
  sm501: Do not allow guest to set invalid format
  sm501: Convert debug printfs to traces

 hw/display/sm501.c  | 133 ++--
 hw/display/trace-events |  12 
 2 files changed, 72 insertions(+), 73 deletions(-)

-- 
2.21.3

[PATCH v2 4/8] sm501: Introduce variable for commonly used value for better readability

[BALATON Zoltan]

The bytes per pixel value can be calculated from format but it's used
freqently enough (and will be used more in subseqent patches) so store
it in a variable for better readabilty. Also drop some unneded 0x
prefix around where new variable is defined.

Signed-off-by: BALATON Zoltan 
---
 hw/display/sm501.c | 41 +
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 3397ca9fbf..282574adec 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -684,10 +684,11 @@ static void sm501_2d_operation(SM501State *s)
 {
 int cmd = (s->twoD_control >> 16) & 0x1F;
 int rtl = s->twoD_control & BIT(27);
-int format = (s->twoD_stretch >> 20) & 0x3;
-int rop_mode = (s->twoD_control >> 15) & 0x1; /* 1 for rop2, else rop3 */
+int format = (s->twoD_stretch >> 20) & 3;
+int bypp = 1 << format; /* bytes per pixel */
+int rop_mode = (s->twoD_control >> 15) & 1; /* 1 for rop2, else rop3 */
 /* 1 if rop2 source is the pattern, otherwise the source is the bitmap */
-int rop2_source_is_pattern = (s->twoD_control >> 14) & 0x1;
+int rop2_source_is_pattern = (s->twoD_control >> 14) & 1;
 int rop = s->twoD_control & 0xFF;
 unsigned int dst_x = (s->twoD_destination >> 16) & 0x01FFF;
 unsigned int dst_y = s->twoD_destination & 0x;
@@ -724,8 +725,8 @@ static void sm501_2d_operation(SM501State *s)
 }
 
 if (dst_base >= get_local_mem_size(s) ||
-dst_base + (dst_x + width + (dst_y + height) * dst_pitch) *
-(1 << format) >= get_local_mem_size(s)) {
+dst_base + (dst_x + width + (dst_y + height) * dst_pitch) * bypp >=
+get_local_mem_size(s)) {
 qemu_log_mask(LOG_GUEST_ERROR, "sm501: 2D op dest is outside vram.\n");
 return;
 }
@@ -750,8 +751,8 @@ static void sm501_2d_operation(SM501State *s)
 }
 
 if (src_base >= get_local_mem_size(s) ||
-src_base + (src_x + width + (src_y + height) * src_pitch) *
-(1 << format) >= get_local_mem_size(s)) {
+src_base + (src_x + width + (src_y + height) * src_pitch) * bypp >=
+get_local_mem_size(s)) {
 qemu_log_mask(LOG_GUEST_ERROR,
   "sm501: 2D op src is outside vram.\n");
 return;
@@ -763,8 +764,8 @@ static void sm501_2d_operation(SM501State *s)
 uint8_t *d = s->local_mem + dst_base;
 
 for (y = 0; y < height; y++) {
-i = (dst_x + (dst_y + y) * dst_pitch) * (1 << format);
-for (x = 0; x < width; x++, i += (1 << format)) {
+i = (dst_x + (dst_y + y) * dst_pitch) * bypp;
+for (x = 0; x < width; x++, i += bypp) {
 switch (format) {
 case 0:
 d[i] = ~d[i];
@@ -801,7 +802,7 @@ static void sm501_2d_operation(SM501State *s)
 de = db + width + height * (width + dst_pitch);
 if (rtl && ((db >= sb && db <= se) || (de >= sb && de <= se))) {
 /* regions may overlap: copy via temporary */
-int llb = width * (1 << format);
+int llb = width * bypp;
 int tmp_stride = DIV_ROUND_UP(llb, sizeof(uint32_t));
 uint32_t *tmp = tmp_buf;
 
@@ -809,13 +810,13 @@ static void sm501_2d_operation(SM501State *s)
 tmp = g_malloc(tmp_stride * sizeof(uint32_t) * height);
 }
 pixman_blt((uint32_t *)>local_mem[src_base], tmp,
-   src_pitch * (1 << format) / sizeof(uint32_t),
-   tmp_stride, 8 * (1 << format), 8 * (1 << format),
+   src_pitch * bypp / sizeof(uint32_t),
+   tmp_stride, 8 * bypp, 8 * bypp,
src_x, src_y, 0, 0, width, height);
 pixman_blt(tmp, (uint32_t *)>local_mem[dst_base],
tmp_stride,
-   dst_pitch * (1 << format) / sizeof(uint32_t),
-   8 * (1 << format), 8 * (1 << format),
+   dst_pitch * bypp / sizeof(uint32_t),
+   8 * bypp, 8 * bypp,
0, 0, dst_x, dst_y, width, height);
 if (tmp != tmp_buf) {
 g_free(tmp);
@@ -823,9 +824,9 @@ static void sm501_2d_operation(SM501State *s)
 } else {
 pixman_blt((uint32_t *)>local_mem[src_base],
(uint32_t *)>local_mem[dst_base],
-   src_pitch * (1 << format) / sizeof(uint32_t),
-   dst_pitch * (1 << format) / sizeof(uint32_t),
-   8 * (1 << format), 8 * (1 << format),
+   src_pitch * bypp / sizeof(uint32_t),
+   dst_pitch * bypp / sizeof(uint32_t),
+   

[PATCH v2 5/8] sm501: Optimise 1 pixel 2d ops

[BALATON Zoltan]

Some guests do 1x1 blits which is faster to do directly than calling a
function for it so avoid overhead in this case.

Signed-off-by: BALATON Zoltan 
---
 hw/display/sm501.c | 19 ---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 282574adec..b6356ea1ee 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -794,6 +794,14 @@ static void sm501_2d_operation(SM501State *s)
 src_x == dst_x && src_y == dst_y) {
 break;
 }
+/* Some clients also do 1 pixel blits, avoid overhead for these */
+if (width == 1 && height == 1) {
+unsigned int si = (src_x + src_y * src_pitch) * bypp;
+unsigned int di = (dst_x + dst_y * dst_pitch) * bypp;
+stn_he_p(>local_mem[dst_base + di], bypp,
+ ldn_he_p(>local_mem[src_base + si], bypp));
+break;
+}
 /* Check for overlaps, this could be made more exact */
 uint32_t sb, se, db, de;
 sb = src_base + src_x + src_y * (width + src_pitch);
@@ -842,9 +850,14 @@ static void sm501_2d_operation(SM501State *s)
 color = cpu_to_le16(color);
 }
 
-pixman_fill((uint32_t *)>local_mem[dst_base],
-dst_pitch * bypp / sizeof(uint32_t),
-8 * bypp, dst_x, dst_y, width, height, color);
+if (width == 1 && height == 1) {
+unsigned int i = (dst_x + dst_y * dst_pitch) * bypp;
+stn_he_p(>local_mem[dst_base + i], bypp, color);
+} else {
+pixman_fill((uint32_t *)>local_mem[dst_base],
+dst_pitch * bypp / sizeof(uint32_t),
+8 * bypp, dst_x, dst_y, width, height, color);
+}
 break;
 }
 default:
-- 
2.21.3

[PATCH v2 7/8] sm501: Do not allow guest to set invalid format

[BALATON Zoltan]

Prevent guest setting invalid format value that might trip checks in
sm501_2d_operation().

Signed-off-by: BALATON Zoltan 
---
 hw/display/sm501.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 6e914d3162..583a0ff6b5 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1503,6 +1503,9 @@ static void sm501_2d_engine_write(void *opaque, hwaddr 
addr,
 s->twoD_background = value;
 break;
 case SM501_2D_STRETCH:
+if (((value >> 20) & 3) == 3) {
+value &= ~BIT(20);
+}
 s->twoD_stretch = value;
 break;
 case SM501_2D_COLOR_COMPARE:
-- 
2.21.3

[PATCH 1/1] os_find_datadir: search as in version 4.2

[Joe Slater]

Always look for ../share/qemu then ../pc-bios when looking for datadir.

Signed-off-by: Joe Slater 
---
 os-posix.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/os-posix.c b/os-posix.c
index 3cd52e1e70..f77da94bf6 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -82,8 +82,9 @@ void os_setup_signal_handling(void)
 
 /*
  * Find a likely location for support files using the location of the binary.
+ * Typically, this would be "$bindir/../share/qemu".
  * When running from the build tree this will be "$bindir/../pc-bios".
- * Otherwise, this is CONFIG_QEMU_DATADIR.
+ * Otherwise, this is CONFIG_QEMU_DATADIR as constructed by configure.
  */
 char *os_find_datadir(void)
 {
@@ -93,6 +94,12 @@ char *os_find_datadir(void)
 exec_dir = qemu_get_exec_dir();
 g_return_val_if_fail(exec_dir != NULL, NULL);
 
+dir = g_build_filename(exec_dir, "..", "share", "qemu", NULL);
+if (g_file_test(dir, G_FILE_TEST_IS_DIR)) {
+return g_steal_pointer();
+}
+g_free(dir);  /* no autofree this time */
+
 dir = g_build_filename(exec_dir, "..", "pc-bios", NULL);
 if (g_file_test(dir, G_FILE_TEST_IS_DIR)) {
 return g_steal_pointer();
-- 
2.17.1

Re: [PATCH v3 0/3] python/machine.py: refactor shutdown

[Eduardo Habkost]

On Mon, Jun 15, 2020 at 05:21:18PM +0200, Philippe Mathieu-Daudé wrote:
> On 6/9/20 11:55 PM, John Snow wrote:
> > 
> > 
> > On 6/9/20 9:08 AM, Philippe Mathieu-Daudé wrote:
> >> Hi John,
> >>
> >> On 6/4/20 9:52 PM, John Snow wrote:
> >>> v3:
> >>>  - Split _post_shutdown refactor into own patch (now 1/3)
> >>>  - Re-add sigkill warning squelch (now 3/3)
> >>>
> >>> NOTE: I re-added the squelch in its own patch for review purposes, but
> >>> for the purposes of avoiding temporary breakage, a maintainer may wish
> >>> to squash patches 2 and 3 if they are accepted.
> >>>
> >>> v2: Philippe took patches 1, 3 and 4.
> >>>
> >>> This is a re-write of what was:
> >>> [PATCH RFC 03/32] python//machine.py: remove bare except
> >>> [PATCH 2/4] python/machine.py: remove bare except
> >>>
> >>> It's a bit heavier handed, but it should address some of kwolf's
> >>> feedback from the RFC version.
> >>>
> >>> Applies straight to origin/master, ought to pass pylint and flake8:
> >>>
>  cd ~/src/qemu/python/qemu
>  pylint *.py
>  flake8 *.py
> >>>
> >>> John Snow (3):
> >>>   python/machine.py: consolidate _post_shutdown()
> >>>   python/machine.py: refactor shutdown
> >>>   python/machine.py: re-add sigkill warning suppression
> >>>
> >>>  python/qemu/machine.py | 100 +
> >>>  1 file changed, 71 insertions(+), 29 deletions(-)
> >>>
> >>
> >> I'm now seeing this error:
> >>
> >> 21:31:58 DEBUG| / # reboot
> >> 21:32:01 DEBUG| / # reboot: Restarting system
> >> 21:32:01 DEBUG| >>> {'execute': 'quit'}
> >> 21:32:01 WARNI| qemu received signal 9; command:
> >> "mips-softmmu/qemu-system-mips -display none -vga none -chardev
> >> socket,id=mon,path=/tmp/tmp679upvrk/qemu-10292-monitor.sock -mon
> >> chardev=mon,mode=control -machine malta -chardev
> >> socket,id=console,path=/tmp/tmp679upvrk/qemu-10292-console.sock,server,nowait
> >> -serial chardev:console -kernel
> >> /tmp/avocado_b3aaagr9/avocado_job_5bj0xe1h/12-tests_acceptance_boot_linux_console.py_BootLinuxConsole.test_mips_malta_cpio/boot/vmlinux-4.5.0-2-4kc-malta
> >> -initrd
> >> /tmp/avocado_b3aaagr9/avocado_job_5bj0xe1h/12-tests_acceptance_boot_linux_console.py_BootLinuxConsole.test_mips_malta_cpiorootfs.cpio
> >> -append printk.time=0 console=ttyS0 console=tty rdinit=/sbin/init
> >> noreboot -no-reboot"
> >> 21:32:01 ERROR|
> >> 21:32:01 ERROR| Reproduced traceback from:
> >> /home/travis/build/philmd/qemu/build/tests/venv/lib/python3.6/site-packages/avocado/core/test.py:886
> >> 21:32:01 ERROR| Traceback (most recent call last):
> >> 21:32:01 ERROR|   File
> >> "/home/travis/build/philmd/qemu/build/tests/acceptance/avocado_qemu/__init__.py",
> >> line 195, in tearDown
> >> 21:32:01 ERROR| vm.shutdown()
> >> 21:32:01 ERROR|   File
> >> "/home/travis/build/philmd/qemu/python/qemu/machine.py", line 449, in
> >> shutdown
> >> 21:32:01 ERROR| self._do_shutdown(has_quit)
> >> 21:32:01 ERROR|   File
> >> "/home/travis/build/philmd/qemu/python/qemu/machine.py", line 426, in
> >> _do_shutdown
> >> 21:32:01 ERROR| self._soft_shutdown(has_quit, timeout)
> >> 21:32:01 ERROR|   File
> >> "/home/travis/build/philmd/qemu/python/qemu/machine.py", line 413, in
> >> _soft_shutdown
> >> 21:32:01 ERROR| self._qmp.cmd('quit')
> >> 21:32:01 ERROR|   File
> >> "/home/travis/build/philmd/qemu/python/qemu/qmp.py", line 271, in cmd
> >> 21:32:01 ERROR| return self.cmd_obj(qmp_cmd)
> >> 21:32:01 ERROR|   File
> >> "/home/travis/build/philmd/qemu/python/qemu/qmp.py", line 249, in cmd_obj
> >> 21:32:01 ERROR| 
> >> self.__sock.sendall(json.dumps(qmp_cmd).encode('utf-8'))
> >> 21:32:01 ERROR| BrokenPipeError: [Errno 32] Broken pipe
> >> 21:32:01 ERROR|
> >> 21:32:01 DEBUG| DATA (filename=output.expected) => NOT FOUND (data
> >> sources: variant, test, file)
> >> 21:32:01 DEBUG| DATA (filename=stdout.expected) => NOT FOUND (data
> >> sources: variant, test, file)
> >> 21:32:01 DEBUG| DATA (filename=stderr.expected) => NOT FOUND (data
> >> sources: variant, test, file)
> >> 21:32:01 DEBUG| Not logging /var/log/syslog (lack of permissions)
> >> 21:32:01 ERROR| ERROR
> >> 12-tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_mips_malta_cpio
> >> -> TestSetupFail: [Errno 32] Broken pipe
> >> 21:32:01 INFO |
> >>
> >> https://travis-ci.org/github/philmd/qemu/jobs/696142277#L5329
> >>
> > 
> > Gotcha.
> > 
> > The problem here is that `test_mips_malta_cpio` in boot_linux_console.py
> > does this:
> > 
> > self.vm.add_args('-kernel', kernel_path,
> >  '-initrd', initrd_path,
> >  '-append', kernel_command_line,
> >  '-no-reboot')
> > 
> > and then:
> > 
> > exec_command_and_wait_for_pattern(self, 'reboot',
> >  'reboot: Restarting system')
> > 
> > and (in avocado_qemu/) __init__.py does this:
> > 
> > def tearDown(self):
> > for vm in self._vms.values():
> > vm.shutdown()
> > 
> > 
> > 

Re: [PULL 16/84] macio: Put "macio-nvram" device on the macio bus

[BALATON Zoltan]

On Mon, 15 Jun 2020, Markus Armbruster wrote:

macio_oldworld_init() creates a "macio-nvram", sysbus device, but
neglects to but it on a bus.


This letter   ^ is upside down :-) (but -> put).

Regards,
BALATON Zoltan



Put it on the macio bus.  Affects machine g3beige.  Visible in "info
qtree":

bus: macio.0
  type macio-bus
  [...]
   +  dev: macio-nvram, id ""
   +size = 8192 (0x2000)
   +it_shift = 4 (0x4)

This also makes it a QOM child of macio-oldworld.  Visible in "info
qom-tree":

/machine (g3beige-machine)
  [...]
  /unattached (container)
[...]
/device[6] (macio-oldworld)
  [...]
   -/device[7] (macio-nvram)
   -  /macio-nvram[0] (qemu:memory-region)
   +  /nvram (macio-nvram)
   +/macio-nvram[0] (qemu:memory-region)
[rest of device[*] renumbered...]

Cc: Mark Cave-Ayland 
Cc: David Gibson 
Cc: qemu-...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: Mark Cave-Ayland 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200609122339.937862-15-arm...@redhat.com>
---
hw/misc/macio/macio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index b3dddf8be7..ebc96cc8f6 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -245,7 +245,8 @@ static void macio_oldworld_init(Object *obj)

macio_init_child_obj(s, "cuda", >cuda, sizeof(s->cuda), TYPE_CUDA);

-object_initialize(>nvram, sizeof(os->nvram), TYPE_MACIO_NVRAM);
+macio_init_child_obj(s, "nvram", >nvram, sizeof(os->nvram),
+ TYPE_MACIO_NVRAM);
dev = DEVICE(>nvram);
qdev_prop_set_uint32(dev, "size", 0x2000);
qdev_prop_set_uint32(dev, "it_shift", 4);

Re: [PATCH v2] target/ppc: add vmsumudm vmsumcud instructions

[Lijun Pan]

> On Jun 15, 2020, at 11:12 AM, Richard Henderson 
>  wrote:
> 
> On 6/12/20 8:55 PM, Lijun Pan wrote:
>> vmsumudm (Power ISA 3.0) - Vector Multiply-Sum Unsigned Doubleword Modulo
>> VA-form.
>> vmsumcud (Power ISA 3.1) - Vector Multiply-Sum & write Carry-out Unsigned
>> Doubleword VA-form.
>> 
>> Signed-off-by: Lijun Pan 
>> ---
>> v2: move vmsumcudm() to qemu/int128.h as Richard Henderson suggested,
>>also rename addu128() to uint128_add() and include it in qemu/int128.h
>> 
>> disas/ppc.c |  2 +
>> include/qemu/int128.h   | 97 +
>> target/ppc/helper.h |  4 +-
>> target/ppc/int_helper.c | 19 +-
>> target/ppc/translate.c  |  1 -
>> target/ppc/translate/vmx-impl.inc.c | 39 ++--
>> target/ppc/translate/vmx-ops.inc.c  |  2 +
>> 7 files changed, 143 insertions(+), 21 deletions(-)
>> 
>> diff --git a/disas/ppc.c b/disas/ppc.c
>> index 63e97cfe1d..3ed4d23ed3 100644
>> --- a/disas/ppc.c
>> +++ b/disas/ppc.c
>> @@ -2261,7 +2261,9 @@ const struct powerpc_opcode powerpc_opcodes[] = {
>> { "vmsumshs",  VXA(4,  41), VXA_MASK,PPCVEC, { VD, VA, VB, 
>> VC } },
>> { "vmsumubm",  VXA(4,  36), VXA_MASK,   PPCVEC,  { VD, VA, VB, 
>> VC } },
>> { "vmsumuhm",  VXA(4,  38), VXA_MASK,   PPCVEC,  { VD, VA, VB, 
>> VC } },
>> +{ "vmsumudm",  VXA(4,  35), VXA_MASK,   PPCVEC, { VD, VA, VB, 
>> VC } },
>> { "vmsumuhs",  VXA(4,  39), VXA_MASK,   PPCVEC,  { VD, VA, VB, 
>> VC } },
>> +{ "vmsumcud",  VXA(4,  23), VXA_MASK,   PPCVEC, { VD, VA, VB, 
>> VC } },
>> { "vmulesb",   VX(4,  776), VX_MASK, PPCVEC, { VD, VA, VB } },
>> { "vmulesh",   VX(4,  840), VX_MASK, PPCVEC, { VD, VA, VB } },
>> { "vmuleub",   VX(4,  520), VX_MASK, PPCVEC, { VD, VA, VB } },
>> diff --git a/include/qemu/int128.h b/include/qemu/int128.h
>> index 5c9890db8b..3362973cc5 100644
>> --- a/include/qemu/int128.h
>> +++ b/include/qemu/int128.h
>> @@ -3,6 +3,7 @@
>> 
>> #ifdef CONFIG_INT128
>> #include "qemu/bswap.h"
>> +#include "qemu/host-utils.h"
>> 
>> typedef __int128_t Int128;
>> 
>> @@ -143,6 +144,55 @@ static inline Int128 bswap128(Int128 a)
>> return int128_make128(bswap64(int128_gethi(a)), 
>> bswap64(int128_getlo(a)));
>> }
>> 
>> +/**
>> + * uint128_add - add two 128-bit values (r=a+b, ca=carry-out)
>> + * @ah: high 64 bits of a
>> + * @al: low 64 bits of a
>> + * @bh: high 64 bits of b
>> + * @bl: low 64 bits of b
>> + * @rh: high 64 bits of r to be returned
>> + * @rl: low 64 bits of r to be returned
>> + * @ca: carry out to be returned.
>> + */
>> +static inline void uint128_add(uint64_t ah, uint64_t al, uint64_t bh,
>> +uint64_t bl, uint64_t *rh, uint64_t *rl, uint64_t *ca)
>> +{
>> +__uint128_t a = (__uint128_t)ah << 64 | (__uint128_t)al;
>> +__uint128_t b = (__uint128_t)bh << 64 | (__uint128_t)bl;
>> +__uint128_t r = a + b;
>> +
>> +*rh = (uint64_t)(r >> 64);
>> +*rl = (uint64_t)r;
>> +*ca = (~a < b);
>> +}
> 
> This is *not* what I had in mind at all.
> 
> int128.h should be operating on Int128, and *not* component uint64_t values.

Should uint128_add() be included in a new file called uint128.h? or still at 
host-utils.h?

> 
> 
>> +
>> +/**
>> + * mulsum - (rh, rl) = ah*bh + al*bl + (ch, cl)
>> + * @ah: high 64 bits of a
>> + * @al: low 64 bits of a
>> + * @bh: high 64 bits of b
>> + * @bl: low 64 bits of b
>> + * @ch: high 64 bits of c
>> + * @cl: low 64 bits of c
>> + * @rh: high 64 bits of r to be returned
>> + * @rl: low 64 bits of r to be returned
>> + * @ca: carry-out to be returned.
>> + */
>> +static inline void mulsum(uint64_t ah, uint64_t al, uint64_t bh,
>> +uint64_t bl, uint64_t ch, uint64_t cl, uint64_t *rh,
>> +uint64_t *rl, uint64_t *ca)
>> +{
>> +__uint128_t prod1, prod2, r;
>> +__uint128_t c = (__uint128_t)ch << 64 | (__uint128_t)cl;
>> +
>> +prod1 = (__uint128_t)ah * (__uint128_t)bh;
>> +prod2 = (__uint128_t)al * (__uint128_t)bl;
>> +r = prod1 + prod2 + c;
>> +*rh = (uint64_t)(r >> 64);
>> +*rl = (uint64_t)r;
>> +*ca = (~prod1 < prod2) + (~c < (prod1 + prod2));
>> +}
> 
> Why is mulsum an interesting primitive for int128.h?
> I would think int128_mul and int128_add sufficient here.

But prod1, prod2, r are unsigned 128-bit values. Changing above code to the 
following
implementation doesn’t seem right.
prod1 = int128_mul((__uint128_t)ah, (__uint128_t)bh);
prod2 = int128_mul((__uint128_t)al * (__uint128_t)bl);
r = int128_add(prod1, prod2);
r = int128_add(r,  c);

Maybe you mean using uint128_mul & uint128_add?

> 
> I did not ask you to place the entire ppc instruction in int128.h.

vmsumudm/vmsumcud operate as follows:
1. 128-bit prod1 = (high 64 bits of a) * (high 64 bits of b), // I reuse 
mulu64()
2. 128-bit prod2 = (high 64 bits of b) * (high 64 bits of b), // I reuse 
mulu64()
3. 128-bit result = prod1 + prod2 

Re: [PATCH 0/6] Add several Power ISA 3.1 32/64-bit vector instructions

[Lijun Pan]

> On Jun 15, 2020, at 12:36 PM, Cédric Le Goater  wrote:
> 
> Hello,
> 
> On 6/13/20 6:20 AM, Lijun Pan wrote:
>> This patch series add several newly introduced 32/64-bit vector
>> instructions in Power ISA 3.1. The newly added instructions are
>> flagged as ISA300 temporarily in vmx-ops.inc.c and vmx-impl.inc.c
>> to make them compile and function since Power ISA 3.1, together
>> with next generation processor, has not been fully enabled in QEMU
>> yet. When Power ISA 3.1 and next generation processor are fully
>> supported, the flags should be changed.
> 
> What do you mean ? 
> 
> ISA 3.1 and POWER10 are merged in Linux and in the QEMU pseries 
> and PowerNV (OPAL) machines.
> 
> It's very much empty but it's there.

I mean it does not work if you boots the guest in TCG mode, not KVM mode.

Lijun

> 
> C. 
> 
> 
>> 
>> Lijun Pan (6):
>>  target/ppc: add byte-reverse br[dwh] instructions
>>  target/ppc: add vmulld instruction
>>  targetc/ppc: add vmulh{su}w instructions
>>  target/ppc: add vmulh{su}d instructions
>>  fix the prototype of muls64/mulu64
>>  target/ppc: add vdiv{su}{wd} vmod{su}{wd} instructions
>> 
>> include/qemu/host-utils.h   |  4 +-
>> target/ppc/helper.h | 13 ++
>> target/ppc/int_helper.c | 58 +
>> target/ppc/translate.c  | 65 +
>> target/ppc/translate/vmx-impl.inc.c | 24 +++
>> target/ppc/translate/vmx-ops.inc.c  | 22 --
>> 6 files changed, 180 insertions(+), 6 deletions(-)
>> 
> 

[PULL 77/84] sysbus: sysbus_init_child_obj() is now unused, drop

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-52-arm...@redhat.com>
---
 include/hw/sysbus.h | 17 -
 hw/core/sysbus.c|  8 
 2 files changed, 25 deletions(-)

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 606095ba35..da9f85c58c 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -93,23 +93,6 @@ MemoryRegion *sysbus_address_space(SysBusDevice *dev);
 bool sysbus_realize(SysBusDevice *dev, Error **errp);
 bool sysbus_realize_and_unref(SysBusDevice *dev, Error **errp);
 
-/**
- * sysbus_init_child_obj:
- * @parent: The parent object
- * @childname: Used as name of the "child<>" property in the parent
- * @child: A pointer to the memory to be used for the object.
- * @childsize: The maximum size available at @child for the object.
- * @childtype: The name of the type of the object to instantiate.
- *
- * This function will initialize an object and attach it to the main system
- * bus. The memory for the object should have already been allocated. The
- * object will then be added as child to the given parent. The returned object
- * has a reference count of 1 (for the "child<...>" property from the parent),
- * so the object will be finalized automatically when the parent gets removed.
- */
-void sysbus_init_child_obj(Object *parent, const char *childname, void *child,
-   size_t childsize, const char *childtype);
-
 /* Call func for every dynamically created sysbus device in the system */
 void foreach_dynamic_sysbus_device(FindSysbusDeviceFunc *func, void *opaque);
 
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index 1220298e8f..70239b7e7d 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -355,14 +355,6 @@ BusState *sysbus_get_default(void)
 return main_system_bus;
 }
 
-void sysbus_init_child_obj(Object *parent, const char *childname, void *child,
-   size_t childsize, const char *childtype)
-{
-object_initialize_child_with_props(parent, childname, child, childsize,
-   childtype, _abort, NULL);
-qdev_set_parent_bus(DEVICE(child), sysbus_get_default());
-}
-
 static void sysbus_register_types(void)
 {
 type_register_static(_bus_info);
-- 
2.26.2

[PULL 64/84] macio: Eliminate macio_init_child_obj()

[Markus Armbruster]

macio_init_child_obj() has become a trivial wrapper around
object_initialize_child_with_props().  Eliminate it, since the general
convenience wrapper object_initialize_child() is just as convenient
already.

Cc: Mark Cave-Ayland 
Cc: David Gibson 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-39-arm...@redhat.com>
---
 hw/misc/macio/macio.c | 30 +-
 1 file changed, 9 insertions(+), 21 deletions(-)

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 1a07ca2ca5..8ba7af073c 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -94,14 +94,6 @@ static void macio_bar_setup(MacIOState *s)
 macio_escc_legacy_setup(s);
 }
 
-static void macio_init_child_obj(MacIOState *s, const char *childname,
- void *child, size_t childsize,
- const char *childtype)
-{
-object_initialize_child_with_props(OBJECT(s), childname, child, childsize,
-   childtype, _abort, NULL);
-}
-
 static void macio_common_realize(PCIDevice *d, Error **errp)
 {
 MacIOState *s = MACIO(d);
@@ -218,13 +210,12 @@ static void macio_oldworld_realize(PCIDevice *d, Error 
**errp)
 }
 }
 
-static void macio_init_ide(MacIOState *s, MACIOIDEState *ide, size_t ide_size,
-   int index)
+static void macio_init_ide(MacIOState *s, MACIOIDEState *ide, int index)
 {
 gchar *name = g_strdup_printf("ide[%i]", index);
 uint32_t addr = 0x1f000 + ((index + 1) * 0x1000);
 
-macio_init_child_obj(s, name, ide, ide_size, TYPE_MACIO_IDE);
+object_initialize_child(OBJECT(s), name, ide, TYPE_MACIO_IDE);
 qdev_prop_set_uint32(DEVICE(ide), "addr", addr);
 memory_region_add_subregion(>bar, addr, >mem);
 g_free(name);
@@ -242,16 +233,15 @@ static void macio_oldworld_init(Object *obj)
  qdev_prop_allow_set_link_before_realize,
  0);
 
-macio_init_child_obj(s, "cuda", >cuda, sizeof(s->cuda), TYPE_CUDA);
+object_initialize_child(OBJECT(s), "cuda", >cuda, TYPE_CUDA);
 
-macio_init_child_obj(s, "nvram", >nvram, sizeof(os->nvram),
- TYPE_MACIO_NVRAM);
+object_initialize_child(OBJECT(s), "nvram", >nvram, TYPE_MACIO_NVRAM);
 dev = DEVICE(>nvram);
 qdev_prop_set_uint32(dev, "size", 0x2000);
 qdev_prop_set_uint32(dev, "it_shift", 4);
 
 for (i = 0; i < 2; i++) {
-macio_init_ide(s, >ide[i], sizeof(os->ide[i]), i);
+macio_init_ide(s, >ide[i], i);
 }
 }
 
@@ -396,11 +386,10 @@ static void macio_newworld_init(Object *obj)
  qdev_prop_allow_set_link_before_realize,
  0);
 
-macio_init_child_obj(s, "gpio", >gpio, sizeof(ns->gpio),
- TYPE_MACIO_GPIO);
+object_initialize_child(OBJECT(s), "gpio", >gpio, TYPE_MACIO_GPIO);
 
 for (i = 0; i < 2; i++) {
-macio_init_ide(s, >ide[i], sizeof(ns->ide[i]), i);
+macio_init_ide(s, >ide[i], i);
 }
 }
 
@@ -413,10 +402,9 @@ static void macio_instance_init(Object *obj)
 qbus_create_inplace(>macio_bus, sizeof(s->macio_bus), TYPE_MACIO_BUS,
 DEVICE(obj), "macio.0");
 
-macio_init_child_obj(s, "dbdma", >dbdma, sizeof(s->dbdma),
- TYPE_MAC_DBDMA);
+object_initialize_child(OBJECT(s), "dbdma", >dbdma, TYPE_MAC_DBDMA);
 
-macio_init_child_obj(s, "escc", >escc, sizeof(s->escc), TYPE_ESCC);
+object_initialize_child(OBJECT(s), "escc", >escc, TYPE_ESCC);
 }
 
 static const VMStateDescription vmstate_macio_oldworld = {
-- 
2.26.2

[PULL 75/84] sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 3

[Markus Armbruster]

These are init/realize pairs produced by the previous commit's
Coccinelle script where the argument test doesn't quite match.  They
need even more careful review.

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-50-arm...@redhat.com>
---
 hw/arm/armsse.c  | 33 +
 hw/arm/armv7m.c  |  6 +++---
 hw/arm/microbit.c| 12 ++--
 hw/arm/xlnx-versal.c |  6 +++---
 hw/arm/xlnx-zynqmp.c |  6 +++---
 hw/cpu/realview_mpcore.c |  5 ++---
 hw/display/sm501.c   |  4 ++--
 hw/intc/armv7m_nvic.c|  7 +++
 8 files changed, 35 insertions(+), 44 deletions(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index 6571c1ed4c..8abe1307a9 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -256,9 +256,8 @@ static void armsse_init(Object *obj)
 g_free(name);
 
 name = g_strdup_printf("armv7m%d", i);
-sysbus_init_child_obj(OBJECT(>cluster[i]), name,
-  >armv7m[i], sizeof(s->armv7m[i]),
-  TYPE_ARMV7M);
+object_initialize_child(OBJECT(>cluster[i]), name, >armv7m[i],
+TYPE_ARMV7M);
 qdev_prop_set_string(DEVICE(>armv7m[i]), "cpu-type",
  ARM_CPU_TYPE_NAME("cortex-m33"));
 g_free(name);
@@ -308,31 +307,26 @@ static void armsse_init(Object *obj)
 object_initialize_child(obj, "armsse-sysinfo", >sysinfo,
 TYPE_IOTKIT_SYSINFO);
 if (info->has_mhus) {
-sysbus_init_child_obj(obj, "mhu0", >mhu[0], sizeof(s->mhu[0]),
-  TYPE_ARMSSE_MHU);
-sysbus_init_child_obj(obj, "mhu1", >mhu[1], sizeof(s->mhu[1]),
-  TYPE_ARMSSE_MHU);
+object_initialize_child(obj, "mhu0", >mhu[0], TYPE_ARMSSE_MHU);
+object_initialize_child(obj, "mhu1", >mhu[1], TYPE_ARMSSE_MHU);
 }
 if (info->has_ppus) {
 for (i = 0; i < info->num_cpus; i++) {
 char *name = g_strdup_printf("CPU%dCORE_PPU", i);
 int ppuidx = CPU0CORE_PPU + i;
 
-sysbus_init_child_obj(obj, name, >ppu[ppuidx],
-  sizeof(s->ppu[ppuidx]),
-  TYPE_UNIMPLEMENTED_DEVICE);
+object_initialize_child(obj, name, >ppu[ppuidx],
+TYPE_UNIMPLEMENTED_DEVICE);
 g_free(name);
 }
-sysbus_init_child_obj(obj, "DBG_PPU", >ppu[DBG_PPU],
-  sizeof(s->ppu[DBG_PPU]),
-  TYPE_UNIMPLEMENTED_DEVICE);
+object_initialize_child(obj, "DBG_PPU", >ppu[DBG_PPU],
+TYPE_UNIMPLEMENTED_DEVICE);
 for (i = 0; i < info->sram_banks; i++) {
 char *name = g_strdup_printf("RAM%d_PPU", i);
 int ppuidx = RAM0_PPU + i;
 
-sysbus_init_child_obj(obj, name, >ppu[ppuidx],
-  sizeof(s->ppu[ppuidx]),
-  TYPE_UNIMPLEMENTED_DEVICE);
+object_initialize_child(obj, name, >ppu[ppuidx],
+TYPE_UNIMPLEMENTED_DEVICE);
 g_free(name);
 }
 }
@@ -428,7 +422,7 @@ static void map_ppu(ARMSSE *s, int ppuidx, const char 
*name, hwaddr addr)
 
 qdev_prop_set_string(dev, "name", name);
 qdev_prop_set_uint64(dev, "size", 0x1000);
-qdev_init_nofail(dev);
+sysbus_realize(SYS_BUS_DEVICE(dev), _fatal);
 sysbus_mmio_map(SYS_BUS_DEVICE(>ppu[ppuidx]), 0, addr);
 }
 
@@ -579,7 +573,7 @@ static void armsse_realize(DeviceState *dev, Error **errp)
 error_propagate(errp, err);
 return;
 }
-object_property_set_bool(cpuobj, true, "realized", );
+sysbus_realize(SYS_BUS_DEVICE(cpuobj), );
 if (err) {
 error_propagate(errp, err);
 return;
@@ -815,8 +809,7 @@ static void armsse_realize(DeviceState *dev, Error **errp)
 int cpunum;
 SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(>mhu[i]);
 
-object_property_set_bool(OBJECT(>mhu[i]), true,
- "realized", );
+sysbus_realize(SYS_BUS_DEVICE(>mhu[i]), );
 if (err) {
 error_propagate(errp, err);
 return;
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 6fd672e7d9..5cdd0b9b51 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -141,8 +141,8 @@ static void armv7m_instance_init(Object *obj)
   OBJECT(>nvic), "num-irq");
 
 for (i = 0; i < ARRAY_SIZE(s->bitband); i++) {
-sysbus_init_child_obj(obj, "bitband[*]", >bitband[i],
-  sizeof(s->bitband[i]), TYPE_BITBAND);
+object_initialize_child(obj, "bitband[*]", >bitband[i],
+TYPE_BITBAND);
 }
 }
 
@@ -257,7 +257,7 @@ 

[PULL 71/84] sysbus: Convert to sysbus_realize() etc. with Coccinelle

[Markus Armbruster]

Convert from qdev_realize(), qdev_realize_and_unref() with null @bus
argument to sysbus_realize(), sysbus_realize_and_unref().

Coccinelle script:

@@
expression dev, errp;
@@
-qdev_realize(DEVICE(dev), NULL, errp);
+sysbus_realize(SYS_BUS_DEVICE(dev), errp);

@@
expression sysbus_dev, dev, errp;
@@
+sysbus_dev = SYS_BUS_DEVICE(dev);
-qdev_realize_and_unref(dev, NULL, errp);
+sysbus_realize_and_unref(sysbus_dev, errp);
-sysbus_dev = SYS_BUS_DEVICE(dev);

@@
expression sysbus_dev, dev, errp;
expression expr;
@@
 sysbus_dev = SYS_BUS_DEVICE(dev);
 ... when != dev = expr;
-qdev_realize_and_unref(dev, NULL, errp);
+sysbus_realize_and_unref(sysbus_dev, errp);

@@
expression dev, errp;
@@
-qdev_realize_and_unref(DEVICE(dev), NULL, errp);
+sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp);

@@
expression dev, errp;
@@
-qdev_realize_and_unref(dev, NULL, errp);
+sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp);

Whitespace changes minimized manually.

Signed-off-by: Markus Armbruster 
Acked-by: Alistair Francis 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-46-arm...@redhat.com>
[Conflicts in hw/misc/empty_slot.c and hw/sparc/leon3.c resolved]
---
 hw/lm32/lm32.h   |  6 ++---
 hw/lm32/milkymist-hw.h   | 18 ++---
 include/hw/char/cadence_uart.h   |  2 +-
 include/hw/char/cmsdk-apb-uart.h |  2 +-
 include/hw/char/pl011.h  |  4 +--
 include/hw/char/xilinx_uartlite.h|  2 +-
 include/hw/cris/etraxfs.h|  2 +-
 include/hw/misc/unimp.h  |  2 +-
 include/hw/timer/cmsdk-apb-timer.h   |  2 +-
 hw/alpha/typhoon.c   |  2 +-
 hw/arm/exynos4210.c  | 18 ++---
 hw/arm/exynos4_boards.c  |  2 +-
 hw/arm/highbank.c| 12 -
 hw/arm/integratorcp.c|  2 +-
 hw/arm/mps2-tz.c |  2 +-
 hw/arm/msf2-som.c|  2 +-
 hw/arm/musicpal.c|  4 +--
 hw/arm/netduino2.c   |  2 +-
 hw/arm/netduinoplus2.c   |  2 +-
 hw/arm/nseries.c |  4 +--
 hw/arm/omap1.c   |  8 +++---
 hw/arm/omap2.c   |  8 +++---
 hw/arm/pxa2xx.c  |  4 +--
 hw/arm/pxa2xx_gpio.c |  2 +-
 hw/arm/pxa2xx_pic.c  |  2 +-
 hw/arm/realview.c| 10 
 hw/arm/sbsa-ref.c| 12 -
 hw/arm/spitz.c   |  2 +-
 hw/arm/stellaris.c   |  6 ++---
 hw/arm/strongarm.c   |  4 +--
 hw/arm/versatilepb.c |  8 +++---
 hw/arm/vexpress.c|  8 +++---
 hw/arm/virt.c| 18 ++---
 hw/arm/xilinx_zynq.c | 16 ++--
 hw/arm/xlnx-versal-virt.c|  2 +-
 hw/arm/xlnx-versal.c |  2 +-
 hw/block/fdc.c   |  4 +--
 hw/block/pflash_cfi01.c  |  2 +-
 hw/block/pflash_cfi02.c  |  2 +-
 hw/char/exynos4210_uart.c|  2 +-
 hw/char/mcf_uart.c   |  2 +-
 hw/char/serial.c |  2 +-
 hw/core/sysbus.c |  2 +-
 hw/cris/axis_dev88.c |  2 +-
 hw/display/milkymist-tmu2.c  |  2 +-
 hw/display/sm501.c   |  2 +-
 hw/dma/pxa2xx_dma.c  |  4 +--
 hw/dma/rc4030.c  |  2 +-
 hw/dma/sparc32_dma.c |  8 +++---
 hw/hppa/dino.c   |  2 +-
 hw/hppa/lasi.c   |  2 +-
 hw/hppa/machine.c|  2 +-
 hw/i386/pc.c |  2 +-
 hw/i386/pc_q35.c |  2 +-
 hw/i386/pc_sysfw.c   |  2 +-
 hw/i386/x86.c|  2 +-
 hw/intc/exynos4210_gic.c |  2 +-
 hw/intc/s390_flic.c  |  2 +-
 hw/isa/isa-bus.c |  2 +-
 hw/m68k/mcf5208.c|  2 +-
 hw/m68k/mcf_intc.c   |  2 +-
 hw/m68k/next-cube.c  |  6 ++---
 hw/m68k/q800.c   | 12 -
 hw/microblaze/petalogix_ml605_mmu.c  | 10 
 hw/microblaze/petalogix_s3adsp1800_mmu.c |  6 ++---
 hw/mips/boston.c |  4 +--
 hw/mips/gt64xxx_pci.c|  2 +-
 hw/mips/jazz.c   |  8 +++---
 hw/mips/malta.c  |  2 +-
 hw/mips/mipssim.c  

[PULL 67/84] sysbus: Tidy up sysbus_init_child_obj()'s @childsize arg, part 1

[Markus Armbruster]

The callers of sysbus_init_child_obj() commonly pass either ,
sizeof(child), or pchild, sizeof(*pchild).  Tidy up the few that use
sizeof(child_type) instead, mostly to keep future commits simpler.

Coccinelle script:

@@
expression parent, propname, type;
type T;
T child;
@@
-sysbus_init_child_obj(parent, propname, , sizeof(T), type)
+sysbus_init_child_obj(parent, propname, , sizeof(child), type)

@@
expression parent, propname, type;
type T;
T *child;
@@
-sysbus_init_child_obj(parent, propname, child, sizeof(T), type)
+sysbus_init_child_obj(parent, propname, child, sizeof(*child), type)

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-42-arm...@redhat.com>
---
 hw/arm/bcm2835_peripherals.c| 3 +--
 hw/arm/mps2-tz.c| 5 ++---
 hw/arm/musca.c  | 8 +++-
 hw/display/sm501.c  | 2 +-
 hw/microblaze/xlnx-zynqmp-pmu.c | 4 ++--
 5 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index cca5b5ad04..188b112c13 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -27,8 +27,7 @@ static void create_unimp(BCM2835PeripheralState *ps,
  UnimplementedDeviceState *uds,
  const char *name, hwaddr ofs, hwaddr size)
 {
-sysbus_init_child_obj(OBJECT(ps), name, uds,
-  sizeof(UnimplementedDeviceState),
+sysbus_init_child_obj(OBJECT(ps), name, uds, sizeof(*uds),
   TYPE_UNIMPLEMENTED_DEVICE);
 qdev_prop_set_string(DEVICE(uds), "name", name);
 qdev_prop_set_uint64(DEVICE(uds), "size", size);
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 8a050228d0..ad0bc9365a 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -174,8 +174,7 @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
  */
 UnimplementedDeviceState *uds = opaque;
 
-sysbus_init_child_obj(OBJECT(mms), name, uds,
-  sizeof(UnimplementedDeviceState),
+sysbus_init_child_obj(OBJECT(mms), name, uds, sizeof(*uds),
   TYPE_UNIMPLEMENTED_DEVICE);
 qdev_prop_set_string(DEVICE(uds), "name", name);
 qdev_prop_set_uint64(DEVICE(uds), "size", size);
@@ -552,7 +551,7 @@ static void mps2tz_common_init(MachineState *machine)
 char *gpioname;
 
 sysbus_init_child_obj(OBJECT(machine), ppcinfo->name, ppc,
-  sizeof(TZPPC), TYPE_TZ_PPC);
+  sizeof(*ppc), TYPE_TZ_PPC);
 ppcdev = DEVICE(ppc);
 
 for (port = 0; port < TZ_NUM_PORTS; port++) {
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index cd7df7c191..b7f1c4e128 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -142,8 +142,7 @@ static MemoryRegion *make_unimp_dev(MuscaMachineState *mms,
  */
 UnimplementedDeviceState *uds = opaque;
 
-sysbus_init_child_obj(OBJECT(mms), name, uds,
-  sizeof(UnimplementedDeviceState),
+sysbus_init_child_obj(OBJECT(mms), name, uds, sizeof(*uds),
   TYPE_UNIMPLEMENTED_DEVICE);
 qdev_prop_set_string(DEVICE(uds), "name", name);
 qdev_prop_set_uint64(DEVICE(uds), "size", size);
@@ -246,8 +245,7 @@ static MemoryRegion *make_mpc(MuscaMachineState *mms, void 
*opaque,
 case MPC_CRYPTOISLAND:
 /* We don't implement the CryptoIsland yet */
 uds = >cryptoisland;
-sysbus_init_child_obj(OBJECT(mms), name, uds,
-  sizeof(UnimplementedDeviceState),
+sysbus_init_child_obj(OBJECT(mms), name, uds, sizeof(*uds),
   TYPE_UNIMPLEMENTED_DEVICE);
 qdev_prop_set_string(DEVICE(uds), "name", mpcinfo[i].name);
 qdev_prop_set_uint64(DEVICE(uds), "size", mpcinfo[i].size);
@@ -535,7 +533,7 @@ static void musca_init(MachineState *machine)
 char *gpioname;
 
 sysbus_init_child_obj(OBJECT(machine), ppcinfo->name, ppc,
-  sizeof(TZPPC), TYPE_TZ_PPC);
+  sizeof(*ppc), TYPE_TZ_PPC);
 ppcdev = DEVICE(ppc);
 
 for (port = 0; port < TZ_NUM_PORTS; port++) {
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 3e62eca3de..ccdbce1a06 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -2023,7 +2023,7 @@ static void sm501_sysbus_init(Object *o)
 SM501SysBusState *sm501 = SYSBUS_SM501(o);
 SerialMM *smm = >serial;
 
-sysbus_init_child_obj(o, "serial", smm, sizeof(SerialMM), TYPE_SERIAL_MM);
+sysbus_init_child_obj(o, "serial", smm, sizeof(*smm), TYPE_SERIAL_MM);
 qdev_set_legacy_instance_id(DEVICE(smm), SM501_UART0, 2);
 qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
 qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c 

[PULL 76/84] sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 4

[Markus Armbruster]

This is still the same transformation as in the previous commits, but
here the sysbus_init_child_obj() and its matching realize in are in
separate files.  Fortunately, there's just one realize left to
convert.

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-51-arm...@redhat.com>
---
 hw/arm/aspeed_ast2600.c | 10 --
 hw/arm/aspeed_soc.c |  4 ++--
 hw/sd/aspeed_sdhci.c|  2 +-
 3 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 7c39adb272..d465743247 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -200,9 +200,8 @@ static void aspeed_soc_ast2600_init(Object *obj)
 
 /* Init sd card slot class here so that they're under the correct parent */
 for (i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
-sysbus_init_child_obj(obj, "sd-controller.sdhci[*]",
-  >sdhci.slots[i],
-  sizeof(s->sdhci.slots[i]), TYPE_SYSBUS_SDHCI);
+object_initialize_child(obj, "sd-controller.sdhci[*]",
+>sdhci.slots[i], TYPE_SYSBUS_SDHCI);
 }
 
 object_initialize_child(obj, "emmc-controller", >emmc,
@@ -210,9 +209,8 @@ static void aspeed_soc_ast2600_init(Object *obj)
 
 object_property_set_int(OBJECT(>emmc), 1, "num-slots", _abort);
 
-sysbus_init_child_obj(obj, "emmc-controller.sdhci",
-  >emmc.slots[0], sizeof(s->emmc.slots[0]),
-  TYPE_SYSBUS_SDHCI);
+object_initialize_child(obj, "emmc-controller.sdhci", >emmc.slots[0],
+TYPE_SYSBUS_SDHCI);
 }
 
 /*
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index c40839c1fb..d1e48b7a5d 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -208,8 +208,8 @@ static void aspeed_soc_init(Object *obj)
 
 /* Init sd card slot class here so that they're under the correct parent */
 for (i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
-sysbus_init_child_obj(obj, "sdhci[*]", >sdhci.slots[i],
-  sizeof(s->sdhci.slots[i]), TYPE_SYSBUS_SDHCI);
+object_initialize_child(obj, "sdhci[*]", >sdhci.slots[i],
+TYPE_SYSBUS_SDHCI);
 }
 }
 
diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
index 6a039a1d2f..538d3bad3d 100644
--- a/hw/sd/aspeed_sdhci.c
+++ b/hw/sd/aspeed_sdhci.c
@@ -145,7 +145,7 @@ static void aspeed_sdhci_realize(DeviceState *dev, Error 
**errp)
 return;
 }
 
-object_property_set_bool(sdhci_slot, true, "realized", );
+sysbus_realize(sbd_slot, );
 if (err) {
 error_propagate(errp, err);
 return;
-- 
2.26.2

[PULL 79/84] s390x/event-facility: Simplify creation of SCLP event devices

[Markus Armbruster]

init_event_facility() creates the SCLP events bus with two SCLP event
devices (sclpquiesce and sclp-cpu-hotplug).  It leaves the devices
unrealized.  A comment explains they will be realized "via the bus".

The bus's realize method sclp_events_bus_realize() indeed realizes all
unrealized devices on this bus.  It carries a TODO comment claiming
this "has to be done in common code".  No other bus realize method
realizes its devices.

The common code in question is bus_set_realized(), which has a TODO
comment asking for recursive realization.  It's been asking for years.

The only devices sclp_events_bus_realize() will ever realize are the
two init_event_facility() puts there.

Simplify as follows:

* Make the devices members of the event facility instance struct, just
  like the bus.  object_initialize_child() is simpler than
  object_property_add_child() and object_unref().

* Realize them in the event facility realize method.

This is in line with how such things are done elsewhere.

Cc: Cornelia Huck 
Cc: Halil Pasic 
Cc: Christian Borntraeger 
Cc: Richard Henderson 
Cc: David Hildenbrand 
Cc: qemu-s3...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: David Hildenbrand 
Acked-by: Cornelia Huck 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-54-arm...@redhat.com>
---
 hw/s390x/event-facility.c | 64 ++-
 1 file changed, 29 insertions(+), 35 deletions(-)

diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
index 97a4f0b1f5..164b1fd295 100644
--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
@@ -39,6 +39,7 @@ typedef struct SCLPEventsBus {
 struct SCLPEventFacility {
 SysBusDevice parent_obj;
 SCLPEventsBus sbus;
+SCLPEvent quiesce, cpu_hotplug;
 /* guest's receive mask */
 union {
 uint32_t receive_mask_pieces[2];
@@ -328,34 +329,9 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB 
*sccb)
 
 #define TYPE_SCLP_EVENTS_BUS "s390-sclp-events-bus"
 
-static void sclp_events_bus_realize(BusState *bus, Error **errp)
-{
-Error *err = NULL;
-BusChild *kid;
-
-/* TODO: recursive realization has to be done in common code */
-QTAILQ_FOREACH(kid, >children, sibling) {
-DeviceState *dev = kid->child;
-
-object_property_set_bool(OBJECT(dev), true, "realized", );
-if (err) {
-error_propagate(errp, err);
-return;
-}
-}
-}
-
-static void sclp_events_bus_class_init(ObjectClass *klass, void *data)
-{
-BusClass *bc = BUS_CLASS(klass);
-
-bc->realize = sclp_events_bus_realize;
-}
-
 static const TypeInfo sclp_events_bus_info = {
 .name = TYPE_SCLP_EVENTS_BUS,
 .parent = TYPE_BUS,
-.class_init = sclp_events_bus_class_init,
 };
 
 static void command_handler(SCLPEventFacility *ef, SCCB *sccb, uint64_t code)
@@ -443,27 +419,44 @@ static void init_event_facility(Object *obj)
 {
 SCLPEventFacility *event_facility = EVENT_FACILITY(obj);
 DeviceState *sdev = DEVICE(obj);
-Object *new;
 
 event_facility->mask_length = 4;
 event_facility->allow_all_mask_sizes = true;
 object_property_add_bool(obj, "allow_all_mask_sizes",
  sclp_event_get_allow_all_mask_sizes,
  sclp_event_set_allow_all_mask_sizes);
+
 /* Spawn a new bus for SCLP events */
 qbus_create_inplace(_facility->sbus, sizeof(event_facility->sbus),
 TYPE_SCLP_EVENTS_BUS, sdev, NULL);
 
-new = object_new(TYPE_SCLP_QUIESCE);
-object_property_add_child(obj, TYPE_SCLP_QUIESCE, new);
-object_unref(new);
-qdev_set_parent_bus(DEVICE(new), BUS(_facility->sbus));
+object_initialize_child(obj, TYPE_SCLP_QUIESCE,
+_facility->quiesce,
+TYPE_SCLP_QUIESCE);
 
-new = object_new(TYPE_SCLP_CPU_HOTPLUG);
-object_property_add_child(obj, TYPE_SCLP_CPU_HOTPLUG, new);
-object_unref(new);
-qdev_set_parent_bus(DEVICE(new), BUS(_facility->sbus));
-/* the facility will automatically realize the devices via the bus */
+object_initialize_child(obj, TYPE_SCLP_CPU_HOTPLUG,
+_facility->cpu_hotplug,
+TYPE_SCLP_CPU_HOTPLUG);
+}
+
+static void realize_event_facility(DeviceState *dev, Error **errp)
+{
+SCLPEventFacility *event_facility = EVENT_FACILITY(dev);
+Error *local_err = NULL;
+
+qdev_realize(DEVICE(_facility->quiesce),
+ BUS(_facility->sbus), _err);
+if (local_err) {
+error_propagate(errp, local_err);
+return;
+}
+qdev_realize(DEVICE(_facility->cpu_hotplug),
+ BUS(_facility->sbus), _err);
+if (local_err) {
+error_propagate(errp, local_err);
+qdev_unrealize(DEVICE(_facility->quiesce));
+return;
+}
 }
 
 static void reset_event_facility(DeviceState *dev)
@@ -479,6 +472,7 @@ static void init_event_facility_class(ObjectClass 

[PULL 73/84] sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 1

[Markus Armbruster]

I'm converting from qdev_set_parent_bus()/realize to qdev_realize();
recent commit "qdev: Convert uses of qdev_set_parent_bus() with
Coccinelle" explains why.

sysbus_init_child_obj() is a wrapper around
object_initialize_child_with_props() and qdev_set_parent_bus().  It
passes no properties.

Convert sysbus_init_child_obj()/realize to object_initialize_child()/
qdev_realize().

Coccinelle script:

@@
expression parent, name, size, type, errp;
expression child;
symbol true;
@@
-sysbus_init_child_obj(parent, name, , size, type);
+sysbus_init_child_XXX(parent, name, , size, type);
 ...
-object_property_set_bool(OBJECT(), true, "realized", errp);
+sysbus_realize(SYS_BUS_DEVICE(), errp);

@@
expression parent, name, size, type, errp;
expression child;
symbol true;
@@
-sysbus_init_child_obj(parent, name, child, size, type);
+sysbus_init_child_XXX(parent, name, child, size, type);
 ...
-object_property_set_bool(OBJECT(child), true, "realized", errp);
+sysbus_realize(SYS_BUS_DEVICE(child), errp);

@@
expression parent, name, size, type;
expression child;
expression dev;
expression expr;
@@
-sysbus_init_child_obj(parent, name, child, size, type);
+sysbus_init_child_XXX(parent, name, child, size, type);
 ...
 dev = DEVICE(child);
 ... when != dev = expr;
-qdev_init_nofail(dev);
+sysbus_realize(SYS_BUS_DEVICE(dev), _fatal);

@@
expression parent, propname, type;
expression child;
@@
-sysbus_init_child_XXX(parent, propname, child, sizeof(*child), type)
+object_initialize_child(parent, propname, child, type)

@@
expression parent, propname, type;
expression child;
@@
-sysbus_init_child_XXX(parent, propname, , sizeof(child), type)
+object_initialize_child(parent, propname, , type)

Signed-off-by: Markus Armbruster 
Acked-by: Alistair Francis 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-48-arm...@redhat.com>
---
 hw/arm/bcm2835_peripherals.c |  5 ++--
 hw/arm/exynos4_boards.c  |  7 +++--
 hw/arm/mps2-tz.c | 50 
 hw/arm/mps2.c| 19 +-
 hw/arm/musca.c   | 37 --
 hw/arm/xlnx-versal-virt.c|  6 ++---
 hw/arm/xlnx-versal.c | 36 +++---
 hw/intc/armv7m_nvic.c|  8 +++---
 hw/mips/boston.c |  6 ++---
 hw/mips/cps.c| 20 ++-
 hw/mips/malta.c  |  6 ++---
 hw/misc/mac_via.c| 14 +-
 hw/riscv/spike.c |  7 +++--
 hw/riscv/virt.c  |  7 +++--
 14 files changed, 96 insertions(+), 132 deletions(-)

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index 188b112c13..987e394ec8 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -27,11 +27,10 @@ static void create_unimp(BCM2835PeripheralState *ps,
  UnimplementedDeviceState *uds,
  const char *name, hwaddr ofs, hwaddr size)
 {
-sysbus_init_child_obj(OBJECT(ps), name, uds, sizeof(*uds),
-  TYPE_UNIMPLEMENTED_DEVICE);
+object_initialize_child(OBJECT(ps), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
 qdev_prop_set_string(DEVICE(uds), "name", name);
 qdev_prop_set_uint64(DEVICE(uds), "size", size);
-object_property_set_bool(OBJECT(uds), true, "realized", _fatal);
+sysbus_realize(SYS_BUS_DEVICE(uds), _fatal);
 memory_region_add_subregion_overlap(>peri_mr, ofs,
 sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0), -1000);
 }
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index 326122abff..56b729141b 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -128,10 +128,9 @@ exynos4_boards_init_common(MachineState *machine,
 exynos4_boards_init_ram(s, get_system_memory(),
 exynos4_board_ram_size[board_type]);
 
-sysbus_init_child_obj(OBJECT(machine), "soc",
-  >soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
-object_property_set_bool(OBJECT(>soc), true, "realized",
- _fatal);
+object_initialize_child(OBJECT(machine), "soc", >soc,
+TYPE_EXYNOS4210_SOC);
+sysbus_realize(SYS_BUS_DEVICE(>soc), _fatal);
 
 return s;
 }
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 4c49512e0b..a2b20fff37 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -174,11 +174,10 @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState 
*mms,
  */
 UnimplementedDeviceState *uds = opaque;
 
-sysbus_init_child_obj(OBJECT(mms), name, uds, sizeof(*uds),
-  TYPE_UNIMPLEMENTED_DEVICE);
+object_initialize_child(OBJECT(mms), name, uds, 

[PULL 70/84] sysbus: New sysbus_realize(), sysbus_realize_and_unref()

[Markus Armbruster]

Sysbus devices almost always plug into the main system bus.
qdev_create() even has a convenience feature to make that easy: a null
bus argument gets replaced by the main system bus.  qdev_realize() and
qdev_realize_and_unref() do the same.

We can do better.  Provide convenience wrappers around qdev_realize()
and qdev_realize_and_unref() that don't take a @bus argument.  They
always pass the main system bus.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-45-arm...@redhat.com>
---
 include/hw/sysbus.h |  4 +++-
 hw/core/sysbus.c| 14 --
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index c4a1c0adfa..606095ba35 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -90,6 +90,9 @@ void sysbus_add_io(SysBusDevice *dev, hwaddr addr,
MemoryRegion *mem);
 MemoryRegion *sysbus_address_space(SysBusDevice *dev);
 
+bool sysbus_realize(SysBusDevice *dev, Error **errp);
+bool sysbus_realize_and_unref(SysBusDevice *dev, Error **errp);
+
 /**
  * sysbus_init_child_obj:
  * @parent: The parent object
@@ -121,5 +124,4 @@ static inline DeviceState *sysbus_create_simple(const char 
*name,
 return sysbus_create_varargs(name, addr, irq, NULL);
 }
 
-
 #endif /* HW_SYSBUS_H */
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index e8d08d349b..68b837ac85 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -217,7 +217,7 @@ void sysbus_init_ioports(SysBusDevice *dev, uint32_t 
ioport, uint32_t size)
  * from being set to NULL to break the normal init/realize
  * of some devices.
  */
-static void sysbus_realize(DeviceState *dev, Error **errp)
+static void sysbus_device_realize(DeviceState *dev, Error **errp)
 {
 }
 
@@ -250,6 +250,16 @@ DeviceState *sysbus_create_varargs(const char *name,
 return dev;
 }
 
+bool sysbus_realize(SysBusDevice *dev, Error **errp)
+{
+return qdev_realize(DEVICE(dev), sysbus_get_default(), errp);
+}
+
+bool sysbus_realize_and_unref(SysBusDevice *dev, Error **errp)
+{
+return qdev_realize_and_unref(DEVICE(dev), sysbus_get_default(), errp);
+}
+
 static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
 {
 SysBusDevice *s = SYS_BUS_DEVICE(dev);
@@ -301,7 +311,7 @@ MemoryRegion *sysbus_address_space(SysBusDevice *dev)
 static void sysbus_device_class_init(ObjectClass *klass, void *data)
 {
 DeviceClass *k = DEVICE_CLASS(klass);
-k->realize = sysbus_realize;
+k->realize = sysbus_device_realize;
 k->bus_type = TYPE_SYSTEM_BUS;
 /*
  * device_add plugs devices into a suitable bus.  For "real" buses,
-- 
2.26.2

Re: [PATCH] linux-user: mremap fails with EFAULT if address range overlaps with stack guard

[Tobias Koch]

Ok, so according to the manpage, mremap generates EFAULT when "the range 
old_address to old_address+old_size is an
invalid virtual memory address for this process". This is what the kernel does 
for the stack guard. However, the
mappings in setup_arg_pages() will only ever provoke an ENOMEM, because there 
is no artifical way to turn a page into an
invalid address. So as long as target bits >= host bits, this works as expected 
and EFAULT is generated, because then
mremap is basically passed through and the kernel responds directly. But when 
reserved_va is set, this needs to be
special-cased to fake kernel behavior.

I'm open to other suggestions. I also understand that the code duplication in 
elfload.c and mmap.c to handle this is
undesirable, but the most viable alternative seems to be introducing more 
globals.

On 6/15/20 11:28 PM, Tobias Koch wrote:
> Hm, I see I need to have another look at this :)
>
> On 6/15/20 10:17 AM, Tobias Koch wrote:
>> Hi Laurent,
>>
>> the code in musl libc probing the stack is in
>>
>>     https://git.musl-libc.org/cgit/musl/plain/src/thread/pthread_getattr_np.c
>>
>> The setup in elfload.c does work, but only when reserved_va is not set. In 
>> that case, any stack guard violation is
>> handled by the host kernel and thus results in the expected EFAULT.
>>
>> However, in case of e.g. a 32bit target being emulated on a 64bit host, 
>> reserved_va is set and the current code in
>> mmap.c will only produce a more generic ENOMEM, deviating from the kernel's 
>> behavior.
>>
>>
>> On 5/7/20 5:35 PM, Laurent Vivier wrote:
>>> Le 05/03/2020 à 22:05, Tobias Koch a écrit :
 If the address range starting at old_address overlaps with the stack guard 
 it
 is invalid and mremap must fail with EFAULT. The musl c library relies on 
 this
 behavior to detect the stack size, which it does by doing consecutive 
 mremaps
 until it hits the stack guard. Without this patch, software (such as the 
 Ruby
 interpreter) that calls pthread_getattr_np under musl will crash on 32 bit
 targets emulated on a 64 bit host.
>>> Could you share some pointers to the code that is doing this?
>>>
>>> We have already this kind of code in linux-user/elfload.c,
>>> setup_arg_pages(): could you check why it doesn't work?

[PULL 84/84] MAINTAINERS: Make section QOM cover hw/core/*bus.c as well

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-59-arm...@redhat.com>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index de25c82249..b69edc2d2f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2298,6 +2298,8 @@ R: Eduardo Habkost 
 S: Supported
 F: docs/qdev-device-use.txt
 F: hw/core/qdev*
+F: hw/core/bus.c
+F: hw/core/sysbus.c
 F: include/hw/qdev*
 F: include/monitor/qdev.h
 F: include/qom/
-- 
2.26.2

[PULL 80/84] qdev: Make qdev_realize() support bus-less devices

[Markus Armbruster]

So far, qdev_realize() supports only devices that plug into a bus:
argument @bus cannot be null.  Extend it to support bus-less devices,
too.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-55-arm...@redhat.com>
---
 hw/core/qdev.c | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 78a06db76e..50336168f2 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -408,7 +408,7 @@ void qdev_init_nofail(DeviceState *dev)
 /*
  * Realize @dev.
  * @dev must not be plugged into a bus.
- * Plug @dev into @bus.  This takes a reference to @dev.
+ * If @bus, plug @dev into @bus.  This takes a reference to @dev.
  * If @dev has no QOM parent, make one up, taking another reference.
  * On success, return true.
  * On failure, store an error through @errp and return false.
@@ -418,9 +418,12 @@ bool qdev_realize(DeviceState *dev, BusState *bus, Error 
**errp)
 Error *err = NULL;
 
 assert(!dev->realized && !dev->parent_bus);
-assert(bus);
 
-qdev_set_parent_bus(dev, bus);
+if (bus) {
+qdev_set_parent_bus(dev, bus);
+} else {
+assert(!DEVICE_GET_CLASS(dev)->bus_type);
+}
 
 object_property_set_bool(OBJECT(dev), true, "realized", );
 if (err) {
-- 
2.26.2

[PULL 62/84] qom: Less verbose object_initialize_child()

[Markus Armbruster]

All users of object_initialize_child() pass the obvious child size
argument.  Almost all pass _abort and no properties.  Tiresome.

Rename object_initialize_child() to
object_initialize_child_with_props() to free the name.  New
convenience wrapper object_initialize_child() automates the size
argument, and passes _abort and no properties.

Rename object_initialize_childv() to
object_initialize_child_with_propsv() for consistency.

Convert callers with this Coccinelle script:

@@
expression parent, propname, type;
expression child, size;
symbol error_abort;
@@
-object_initialize_child(parent, propname, OBJECT(child), size, type, 
_abort, NULL)
+object_initialize_child(parent, propname, child, size, type, 
_abort, NULL)

@@
expression parent, propname, type;
expression child;
symbol error_abort;
@@
-object_initialize_child(parent, propname, child, sizeof(*child), type, 
_abort, NULL)
+object_initialize_child(parent, propname, child, type)

@@
expression parent, propname, type;
expression child;
symbol error_abort;
@@
-object_initialize_child(parent, propname, , sizeof(child), type, 
_abort, NULL)
+object_initialize_child(parent, propname, , type)

@@
expression parent, propname, type;
expression child, size, err;
expression list props;
@@
-object_initialize_child(parent, propname, child, size, type, err, 
props)
+object_initialize_child_with_props(parent, propname, child, size, 
type, err, props)

Note that Coccinelle chokes on ARMSSE typedef vs. macro in
hw/arm/armsse.c.  Worked around by temporarily renaming the macro for
the spatch run.

Signed-off-by: Markus Armbruster 
Acked-by: Alistair Francis 
[Rebased: machine opentitan is new (commit fe0fe4735e7)]
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-37-arm...@redhat.com>
---
 include/qom/object.h| 30 +++
 hw/arm/allwinner-a10.c  |  5 ++--
 hw/arm/allwinner-h3.c   |  5 ++--
 hw/arm/armsse.c | 26 +++-
 hw/arm/aspeed.c |  4 +---
 hw/arm/aspeed_ast2600.c |  4 +---
 hw/arm/aspeed_soc.c |  4 +---
 hw/arm/bcm2836.c|  3 +--
 hw/arm/digic.c  |  4 +---
 hw/arm/exynos4210.c |  3 +--
 hw/arm/fsl-imx25.c  |  4 +---
 hw/arm/fsl-imx31.c  |  4 +---
 hw/arm/fsl-imx6.c   |  5 ++--
 hw/arm/fsl-imx6ul.c |  4 ++--
 hw/arm/fsl-imx7.c   |  5 ++--
 hw/arm/imx25_pdk.c  |  3 +--
 hw/arm/kzm.c|  3 +--
 hw/arm/mps2-tz.c| 14 +--
 hw/arm/musca.c  | 14 +--
 hw/arm/raspi.c  |  4 ++--
 hw/arm/stm32f405_soc.c  |  6 ++---
 hw/arm/xlnx-versal.c|  5 ++--
 hw/arm/xlnx-zcu102.c|  3 +--
 hw/arm/xlnx-zynqmp.c| 16 +
 hw/char/serial-isa.c|  3 +--
 hw/char/serial-pci-multi.c  |  4 +---
 hw/char/serial-pci.c|  3 +--
 hw/char/serial.c|  6 ++---
 hw/core/sysbus.c|  4 ++--
 hw/dma/xilinx_axidma.c  |  9 +++
 hw/intc/pnv_xive.c  |  6 ++---
 hw/intc/spapr_xive.c|  6 ++---
 hw/microblaze/xlnx-zynqmp-pmu.c |  7 +++---
 hw/misc/macio/macio.c   | 10 
 hw/net/xilinx_axienet.c |  9 +++
 hw/pci-host/designware.c|  3 +--
 hw/pci-host/gpex.c  |  3 +--
 hw/pci-host/pnv_phb3.c  | 12 --
 hw/pci-host/pnv_phb4.c  |  6 ++---
 hw/pci-host/pnv_phb4_pec.c  |  6 ++---
 hw/pci-host/q35.c   |  3 +--
 hw/pci-host/xilinx-pcie.c   |  3 +--
 hw/ppc/pnv.c| 42 -
 hw/ppc/pnv_psi.c|  6 ++---
 hw/ppc/spapr.c  |  6 ++---
 hw/riscv/opentitan.c|  3 +--
 hw/riscv/riscv_hart.c   |  4 +---
 hw/riscv/sifive_e.c |  4 +---
 hw/riscv/sifive_u.c | 12 +++---
 hw/virtio/virtio.c  |  5 ++--
 qom/object.c| 19 +++
 51 files changed, 161 insertions(+), 221 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index 43858162ad..94a61ccc3f 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -781,7 +781,7 @@ int object_set_propv(Object *obj,
 void object_initialize(void *obj, size_t size, const char *typename);
 
 /**
- * object_initialize_child:
+ * object_initialize_child_with_props:
  * @parentobj: The parent object to add a property to
  * @propname: The name of the property
  * @childobj: A pointer to the memory to be used for the object.
@@ -801,12 +801,13 @@ void object_initialize(void *obj, size_t size, const char 
*typename);
  * If the object implements the user creatable interface, the object will
  * be marked complete once all the 

[PULL 28/84] Revert "hw/prep: realize the PCI root bus as part of the prep init"

[Markus Armbruster]

This reverts commit 685f9a3428f625f580af0123aa95f4838d86cac3.

Realizing a device automatically realizes its buses, in
device_set_realized().  Realizing them in realize methods is
redundant, unless the methods themselves require them to be realized
early.  raven_pcihost_realizefn() doesn't.  Drop the redundant bus
realization.

Cc: Marcel Apfelbaum 
Cc: Michael S. Tsirkin 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-3-arm...@redhat.com>
---
 hw/pci-host/prep.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index 88e2fc66a9..fc01a294a4 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -268,7 +268,6 @@ static void raven_pcihost_realizefn(DeviceState *d, Error 
**errp)
 memory_region_add_subregion(address_space_mem, 0xbff0, >pci_intack);
 
 /* TODO Remove once realize propagates to child devices. */
-object_property_set_bool(OBJECT(>pci_bus), true, "realized", errp);
 object_property_set_bool(OBJECT(>pci_dev), true, "realized", errp);
 }
 
-- 
2.26.2

[PULL 59/84] auxbus: Convert a use of qdev_set_parent_bus()

[Markus Armbruster]

Convert qdev_set_parent_bus()/qdev_init_nofail() to qdev_realize();
recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains
why.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-34-arm...@redhat.com>
---
 hw/display/xlnx_dp.c | 2 +-
 hw/misc/auxbus.c | 4 +---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index a714cf8a50..884d29c8ce 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1268,7 +1268,7 @@ static void xlnx_dp_realize(DeviceState *dev, Error 
**errp)
 
 aux_bus_realize(s->aux_bus);
 
-qdev_init_nofail(DEVICE(s->dpcd));
+qdev_realize(DEVICE(s->dpcd), BUS(s->aux_bus), _fatal);
 aux_map_slave(AUX_SLAVE(s->dpcd), 0x);
 
 qdev_realize_and_unref(DEVICE(s->edid), BUS(aux_get_i2c_bus(s->aux_bus)),
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index 75b6de1c63..5c9c23a336 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -70,7 +70,6 @@ AUXBus *aux_bus_init(DeviceState *parent, const char *name)
 bus = AUX_BUS(qbus_create(TYPE_AUX_BUS, parent, name));
 auxtoi2c = object_new_with_props(TYPE_AUXTOI2C, OBJECT(bus), "i2c",
  _abort, NULL);
-qdev_set_parent_bus(DEVICE(auxtoi2c), BUS(bus));
 
 bus->bridge = AUXTOI2C(auxtoi2c);
 
@@ -83,7 +82,7 @@ AUXBus *aux_bus_init(DeviceState *parent, const char *name)
 
 void aux_bus_realize(AUXBus *bus)
 {
-qdev_init_nofail(DEVICE(bus->bridge));
+qdev_realize(DEVICE(bus->bridge), BUS(bus), _fatal);
 }
 
 void aux_map_slave(AUXSlave *aux_dev, hwaddr addr)
@@ -280,7 +279,6 @@ DeviceState *aux_create_slave(AUXBus *bus, const char *type)
 
 dev = qdev_new(type);
 assert(dev);
-qdev_set_parent_bus(dev, >qbus);
 return dev;
 }
 
-- 
2.26.2

[PULL 43/84] pci: pci_create(), pci_create_multifunction() are now unused, drop

[Markus Armbruster]

Cc: Michael S. Tsirkin 
Cc: Marcel Apfelbaum 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-18-arm...@redhat.com>
Reviewed-by: Michael S. Tsirkin 
---
 include/hw/pci/pci.h |  3 ---
 hw/pci/pci.c | 16 
 2 files changed, 19 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 66f8ba519b..a4e9c33416 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -717,12 +717,9 @@ PCIDevice *pci_new_multifunction(int devfn, bool 
multifunction,
 PCIDevice *pci_new(int devfn, const char *name);
 bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp);
 
-PCIDevice *pci_create_multifunction(PCIBus *bus, int devfn, bool multifunction,
-const char *name);
 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
bool multifunction,
const char *name);
-PCIDevice *pci_create(PCIBus *bus, int devfn, const char *name);
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name);
 
 void lsi53c8xx_handle_legacy_cmdline(DeviceState *lsi_dev);
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 24f726d4cd..b22dedc88c 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2184,17 +2184,6 @@ bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, 
Error **errp)
 return qdev_realize_and_unref(>qdev, >qbus, errp);
 }
 
-PCIDevice *pci_create_multifunction(PCIBus *bus, int devfn, bool multifunction,
-const char *name)
-{
-DeviceState *dev;
-
-dev = qdev_create(>qbus, name);
-qdev_prop_set_int32(dev, "addr", devfn);
-qdev_prop_set_bit(dev, "multifunction", multifunction);
-return PCI_DEVICE(dev);
-}
-
 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
bool multifunction,
const char *name)
@@ -2204,11 +2193,6 @@ PCIDevice *pci_create_simple_multifunction(PCIBus *bus, 
int devfn,
 return dev;
 }
 
-PCIDevice *pci_create(PCIBus *bus, int devfn, const char *name)
-{
-return pci_create_multifunction(bus, devfn, false, name);
-}
-
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name)
 {
 return pci_create_simple_multifunction(bus, devfn, false, name);
-- 
2.26.2

[PULL 60/84] auxbus: Eliminate aux_create_slave()

[Markus Armbruster]

aux_create_slave() has become a trivial wrapper around qdev_new().
There's just one user.  Eliminate.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-35-arm...@redhat.com>
---
 include/hw/misc/auxbus.h | 7 ---
 hw/display/xlnx_dp.c | 2 +-
 hw/misc/auxbus.c | 9 -
 3 files changed, 1 insertion(+), 17 deletions(-)

diff --git a/include/hw/misc/auxbus.h b/include/hw/misc/auxbus.h
index 0d849d9d89..15a8973517 100644
--- a/include/hw/misc/auxbus.h
+++ b/include/hw/misc/auxbus.h
@@ -131,13 +131,6 @@ I2CBus *aux_get_i2c_bus(AUXBus *bus);
  */
 void aux_init_mmio(AUXSlave *aux_slave, MemoryRegion *mmio);
 
-/* aux_create_slave: Create a new device on an AUX bus
- *
- * @bus The AUX bus for the new device.
- * @name The type of the device to be created.
- */
-DeviceState *aux_create_slave(AUXBus *bus, const char *name);
-
 /* aux_map_slave: Map the mmio for an AUX slave on the bus.
  *
  * @dev The AUX slave.
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 884d29c8ce..c56e6ec593 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1249,7 +1249,7 @@ static void xlnx_dp_init(Object *obj)
 /*
  * Initialize DPCD and EDID..
  */
-s->dpcd = DPCD(aux_create_slave(s->aux_bus, "dpcd"));
+s->dpcd = DPCD(qdev_new("dpcd"));
 object_property_add_child(OBJECT(s), "dpcd", OBJECT(s->dpcd));
 
 s->edid = I2CDDC(qdev_new("i2c-ddc"));
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index 5c9c23a336..da361baa32 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -273,15 +273,6 @@ static void aux_slave_dev_print(Monitor *mon, DeviceState 
*dev, int indent)
memory_region_size(s->mmio));
 }
 
-DeviceState *aux_create_slave(AUXBus *bus, const char *type)
-{
-DeviceState *dev;
-
-dev = qdev_new(type);
-assert(dev);
-return dev;
-}
-
 void aux_init_mmio(AUXSlave *aux_slave, MemoryRegion *mmio)
 {
 assert(!aux_slave->mmio);
-- 
2.26.2

[PULL 61/84] qom: Tidy up a few object_initialize_child() calls

[Markus Armbruster]

The callers of object_initialize_child() commonly  pass either
, sizeof(child), or pchild, sizeof(*pchild).  Tidy up the few
that don't, mostly to keep the next commit simpler.

Signed-off-by: Markus Armbruster 
Reviewed-by: Alistair Francis 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-36-arm...@redhat.com>
---
 hw/arm/aspeed.c | 2 +-
 hw/microblaze/xlnx-zynqmp-pmu.c | 3 +--
 hw/pci-host/pnv_phb4.c  | 2 +-
 hw/riscv/riscv_hart.c   | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 2b96244cf5..ee50476ccb 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -268,7 +268,7 @@ static void aspeed_machine_init(MachineState *machine)
 memory_region_add_subregion(>ram_container, 0, machine->ram);
 
 object_initialize_child(OBJECT(machine), "soc", >soc,
-(sizeof(bmc->soc)), amc->soc_name, _abort,
+sizeof(bmc->soc), amc->soc_name, _abort,
 NULL);
 
 sc = ASPEED_SOC_GET_CLASS(>soc);
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c
index 028f31894d..aa90b9d1be 100644
--- a/hw/microblaze/xlnx-zynqmp-pmu.c
+++ b/hw/microblaze/xlnx-zynqmp-pmu.c
@@ -174,8 +174,7 @@ static void xlnx_zynqmp_pmu_init(MachineState *machine)
 pmu_ram);
 
 /* Create the PMU device */
-object_initialize_child(OBJECT(machine), "pmu", pmu,
-sizeof(XlnxZynqMPPMUSoCState),
+object_initialize_child(OBJECT(machine), "pmu", pmu, sizeof(*pmu),
 TYPE_XLNX_ZYNQMP_PMU_SOC, _abort, NULL);
 object_property_set_bool(OBJECT(pmu), true, "realized", _fatal);
 
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index e30ae9ad5b..aba710fd1f 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1155,7 +1155,7 @@ static void pnv_phb4_instance_init(Object *obj)
 QLIST_INIT(>dma_spaces);
 
 /* XIVE interrupt source object */
-object_initialize_child(obj, "source", >xsrc, sizeof(XiveSource),
+object_initialize_child(obj, "source", >xsrc, sizeof(phb->xsrc),
 TYPE_XIVE_SOURCE, _abort, NULL);
 
 /* Root Port */
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index 276a9baca0..61e88e2e37 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -46,7 +46,7 @@ static void riscv_hart_realize(RISCVHartArrayState *s, int 
idx,
 Error *err = NULL;
 
 object_initialize_child(OBJECT(s), "harts[*]", >harts[idx],
-sizeof(RISCVCPU), cpu_type,
+sizeof(s->harts[idx]), cpu_type,
 _abort, NULL);
 s->harts[idx].env.mhartid = s->hartid_base + idx;
 qemu_register_reset(riscv_harts_cpu_reset, >harts[idx]);
-- 
2.26.2

[PULL 81/84] qdev: Use qdev_realize() in qdev_device_add()

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-56-arm...@redhat.com>
---
 qdev-monitor.c | 6 ++
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/qdev-monitor.c b/qdev-monitor.c
index 20cfa7615b..22da107484 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -661,9 +661,7 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
 goto err_del_dev;
 }
 
-if (bus) {
-qdev_set_parent_bus(dev, bus);
-} else if (qdev_hotplug && !qdev_get_machine_hotplug_handler(dev)) {
+if (!bus && qdev_hotplug && !qdev_get_machine_hotplug_handler(dev)) {
 /* No bus, no machine hotplug handler --> device is not hotpluggable */
 error_setg(, "Device '%s' can not be hotplugged on this machine",
driver);
@@ -678,7 +676,7 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
 }
 
 dev->opts = opts;
-object_property_set_bool(OBJECT(dev), true, "realized", );
+qdev_realize(DEVICE(dev), bus, );
 if (err != NULL) {
 dev->opts = NULL;
 goto err_del_dev;
-- 
2.26.2

[PULL 78/84] microbit: Eliminate two local variables in microbit_init()

[Markus Armbruster]

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-53-arm...@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé 
---
 hw/arm/microbit.c | 14 ++
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index d20ebd3aad..8fe42c9d6a 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -36,15 +36,13 @@ static void microbit_init(MachineState *machine)
 MicrobitMachineState *s = MICROBIT_MACHINE(machine);
 MemoryRegion *system_memory = get_system_memory();
 MemoryRegion *mr;
-Object *soc = OBJECT(>nrf51);
-Object *i2c = OBJECT(>i2c);
 
 object_initialize_child(OBJECT(machine), "nrf51", >nrf51,
 TYPE_NRF51_SOC);
 qdev_prop_set_chr(DEVICE(>nrf51), "serial0", serial_hd(0));
-object_property_set_link(soc, OBJECT(system_memory), "memory",
- _fatal);
-sysbus_realize(SYS_BUS_DEVICE(soc), _fatal);
+object_property_set_link(OBJECT(>nrf51), OBJECT(system_memory),
+ "memory", _fatal);
+sysbus_realize(SYS_BUS_DEVICE(>nrf51), _fatal);
 
 /*
  * Overlap the TWI stub device into the SoC.  This is a microbit-specific
@@ -53,13 +51,13 @@ static void microbit_init(MachineState *machine)
  */
 object_initialize_child(OBJECT(machine), "microbit.twi", >i2c,
 TYPE_MICROBIT_I2C);
-sysbus_realize(SYS_BUS_DEVICE(i2c), _fatal);
-mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(i2c), 0);
+sysbus_realize(SYS_BUS_DEVICE(>i2c), _fatal);
+mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(>i2c), 0);
 memory_region_add_subregion_overlap(>nrf51.container, NRF51_TWI_BASE,
 mr, -1);
 
 armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-   NRF51_SOC(soc)->flash_size);
+   s->nrf51.flash_size);
 }
 
 static void microbit_machine_class_init(ObjectClass *oc, void *data)
-- 
2.26.2

[PULL 48/84] ssi: ssi_auto_connect_slaves() never does anything, drop

[Markus Armbruster]

ssi_auto_connect_slaves(parent, cs_line, bus) iterates over @parent's
QOM children @dev of type TYPE_SSI_SLAVE.  It puts these on @bus, and
sets cs_line[] to qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0).

Suspicious: there is no protection against overrunning cs_line[].

Turns out it's safe because ssi_auto_connect_slaves() never finds any
such children.  Its called by realize methods of some (but not all)
devices providing an SSI bus, and gets passed the device.

SSI slave devices are always created with ssi_create_slave_no_init(),
optionally via ssi_create_slave().  This adds them to their SSI bus.
It doesn't set their QOM parent.

ssi_create_slave_no_init() is always immediately followed by
qdev_init_nofail(), with no QOM parent assigned, so
device_set_realized() puts the device into the /machine/unattached/
orphanage.  None become QOM children of a device providing an SSI bus.

ssi_auto_connect_slaves() was added in commit b4ae3cfa57 "ssi: Add
slave autoconnect helper".  I can't see which slaves it was supposed
to connect back then.

Cc: Alistair Francis 
Signed-off-by: Markus Armbruster 
Acked-by: Alistair Francis 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-23-arm...@redhat.com>
---
 include/hw/ssi/ssi.h  |  4 
 hw/ssi/aspeed_smc.c   |  1 -
 hw/ssi/imx_spi.c  |  2 --
 hw/ssi/mss-spi.c  |  1 -
 hw/ssi/ssi.c  | 33 -
 hw/ssi/xilinx_spi.c   |  1 -
 hw/ssi/xilinx_spips.c |  4 
 7 files changed, 46 deletions(-)

diff --git a/include/hw/ssi/ssi.h b/include/hw/ssi/ssi.h
index 1107cb89ee..1725b13c32 100644
--- a/include/hw/ssi/ssi.h
+++ b/include/hw/ssi/ssi.h
@@ -86,10 +86,6 @@ SSIBus *ssi_create_bus(DeviceState *parent, const char 
*name);
 
 uint32_t ssi_transfer(SSIBus *bus, uint32_t val);
 
-/* Automatically connect all children nodes a spi controller as slaves */
-void ssi_auto_connect_slaves(DeviceState *parent, qemu_irq *cs_lines,
- SSIBus *bus);
-
 /* max111x.c */
 void max111x_set_input(DeviceState *dev, int line, uint8_t value);
 
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 2edccef2d5..4fab1f5f85 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1356,7 +1356,6 @@ static void aspeed_smc_realize(DeviceState *dev, Error 
**errp)
 
 /* Setup cs_lines for slaves */
 s->cs_lines = g_new0(qemu_irq, s->num_cs);
-ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
 
 for (i = 0; i < s->num_cs; ++i) {
 sysbus_init_irq(sbd, >cs_lines[i]);
diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index 43b2f14dd2..7f703d8328 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -424,8 +424,6 @@ static void imx_spi_realize(DeviceState *dev, Error **errp)
 sysbus_init_mmio(SYS_BUS_DEVICE(dev), >iomem);
 sysbus_init_irq(SYS_BUS_DEVICE(dev), >irq);
 
-ssi_auto_connect_slaves(dev, s->cs_lines, s->bus);
-
 for (i = 0; i < 4; ++i) {
 sysbus_init_irq(SYS_BUS_DEVICE(dev), >cs_lines[i]);
 }
diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
index 3050fabb69..b2432c5a13 100644
--- a/hw/ssi/mss-spi.c
+++ b/hw/ssi/mss-spi.c
@@ -376,7 +376,6 @@ static void mss_spi_realize(DeviceState *dev, Error **errp)
 s->spi = ssi_create_bus(dev, "spi");
 
 sysbus_init_irq(sbd, >irq);
-ssi_auto_connect_slaves(dev, >cs_line, s->spi);
 sysbus_init_irq(sbd, >cs_line);
 
 memory_region_init_io(>mmio, OBJECT(s), _ops, s,
diff --git a/hw/ssi/ssi.c b/hw/ssi/ssi.c
index c6415eb6e3..54106f5ef8 100644
--- a/hw/ssi/ssi.c
+++ b/hw/ssi/ssi.c
@@ -142,36 +142,3 @@ static void ssi_slave_register_types(void)
 }
 
 type_init(ssi_slave_register_types)
-
-typedef struct SSIAutoConnectArg {
-qemu_irq **cs_linep;
-SSIBus *bus;
-} SSIAutoConnectArg;
-
-static int ssi_auto_connect_slave(Object *child, void *opaque)
-{
-SSIAutoConnectArg *arg = opaque;
-SSISlave *dev = (SSISlave *)object_dynamic_cast(child, TYPE_SSI_SLAVE);
-qemu_irq cs_line;
-
-if (!dev) {
-return 0;
-}
-
-cs_line = qdev_get_gpio_in_named(DEVICE(dev), SSI_GPIO_CS, 0);
-qdev_set_parent_bus(DEVICE(dev), BUS(arg->bus));
-**arg->cs_linep = cs_line;
-(*arg->cs_linep)++;
-return 0;
-}
-
-void ssi_auto_connect_slaves(DeviceState *parent, qemu_irq *cs_line,
- SSIBus *bus)
-{
-SSIAutoConnectArg arg = {
-.cs_linep = _line,
-.bus = bus
-};
-
-object_child_foreach(OBJECT(parent), ssi_auto_connect_slave, );
-}
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index eba7ccd46a..80d1488dc7 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -334,7 +334,6 @@ static void xilinx_spi_realize(DeviceState *dev, Error 
**errp)
 
 sysbus_init_irq(sbd, >irq);
 s->cs_lines = g_new0(qemu_irq, s->num_cs);
-ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
 for (i = 0; i < s->num_cs; ++i) {
 sysbus_init_irq(sbd, >cs_lines[i]);
 }
diff --git a/hw/ssi/xilinx_spips.c 

[PATCH] hw/audio/gus: Fix registers 32-bit access

[Allan Peramaki]

Fix audio on software that accesses DRAM above 64k via register peek/poke
and some cases when more than 16 voices are used.

Fixes: 135f5ae1974c ("audio: GUSsample is int16_t")
Signed-off-by: Allan Peramaki 
---
 hw/audio/gusemu_hal.c   | 6 +++---
 hw/audio/gusemu_mixer.c | 8 
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/audio/gusemu_hal.c b/hw/audio/gusemu_hal.c
index ae40ca341c..e35e941926 100644
--- a/hw/audio/gusemu_hal.c
+++ b/hw/audio/gusemu_hal.c
@@ -30,9 +30,9 @@
 #include "gustate.h"
 #include "gusemu.h"
 
-#define GUSregb(position) (*(gusptr+(position)))
-#define GUSregw(position) (*(uint16_t *) (gusptr+(position)))
-#define GUSregd(position) (*(uint16_t *)(gusptr+(position)))
+#define GUSregb(position) (*(gusptr + (position)))
+#define GUSregw(position) (*(uint16_t *)(gusptr + (position)))
+#define GUSregd(position) (*(uint32_t *)(gusptr + (position)))
 
 /* size given in bytes */
 unsigned int gus_read(GUSEmuState * state, int port, int size)
diff --git a/hw/audio/gusemu_mixer.c b/hw/audio/gusemu_mixer.c
index 00b9861b92..3b39254518 100644
--- a/hw/audio/gusemu_mixer.c
+++ b/hw/audio/gusemu_mixer.c
@@ -26,11 +26,11 @@
 #include "gusemu.h"
 #include "gustate.h"
 
-#define GUSregb(position)  (*(gusptr+(position)))
-#define GUSregw(position)  (*(uint16_t *) (gusptr+(position)))
-#define GUSregd(position)  (*(uint16_t *)(gusptr+(position)))
+#define GUSregb(position)  (*(gusptr + (position)))
+#define GUSregw(position)  (*(uint16_t *)(gusptr + (position)))
+#define GUSregd(position)  (*(uint32_t *)(gusptr + (position)))
 
-#define GUSvoice(position) (*(uint16_t *)(voiceptr+(position)))
+#define GUSvoice(position) (*(uint16_t *)(voiceptr + (position)))
 
 /* samples are always 16bit stereo (4 bytes each, first right then left 
interleaved) */
 void gus_mixvoices(GUSEmuState * state, unsigned int playback_freq, unsigned 
int numsamples,
-- 
2.20.1

[PULL 13/84] pnv/phb4: Delete unused "pnv-phb4-pec-stack" devices

[Markus Armbruster]

The number of stacks is controlled by property "num-stacks".
pnv_pec_instance_init() creates the maximum supported number, because
the property has not been set then.  pnv_pec_realize() realizes only
the wanted number.  Works, although it can leave unrealized devices
hanging around in the QOM composition tree.  Affects machine powernv9.

Delete the unused devices by making pnv_pec_realize() unparent them.
Visible in "info qom-tree":

 /machine (powernv9-machine)
   /chip[0] (power9_v2.0-pnv-chip)
 [...]
 /pec[0] (pnv-phb4-pec)
   /stack[0] (pnv-phb4-pec-stack)
 [...]
-  /stack[1] (pnv-phb4-pec-stack)
-/phb (pnv-phb4)
-  /pcie-mmcfg-mmio[0] (qemu:memory-region)
-  /root (pnv-phb4-root-port)
-  /source (xive-source)
-  /stack[2] (pnv-phb4-pec-stack)
-/phb (pnv-phb4)
-  /pcie-mmcfg-mmio[0] (qemu:memory-region)
-  /root (pnv-phb4-root-port)
-  /source (xive-source)
   /xscom-pec-0.0-nest[0] (qemu:memory-region)
   /xscom-pec-0.0-pci[0] (qemu:memory-region)
 /pec[1] (pnv-phb4-pec)
   /stack[0] (pnv-phb4-pec-stack)
 [...]
   /stack[1] (pnv-phb4-pec-stack)
 [...]
-  /stack[2] (pnv-phb4-pec-stack)
-/phb (pnv-phb4)
-  /pcie-mmcfg-mmio[0] (qemu:memory-region)
-  /root (pnv-phb4-root-port)
-  /source (xive-source)
   /xscom-pec-0.1-nest[0] (qemu:memory-region)
   /xscom-pec-0.1-pci[0] (qemu:memory-region)
 /pec[2] (pnv-phb4-pec)
   /stack[0] (pnv-phb4-pec-stack)
 [...]
   /stack[1] (pnv-phb4-pec-stack)
 [...]
   /stack[2] (pnv-phb4-pec-stack)
 [...]

Cc: Cédric Le Goater 
Cc: David Gibson 
Cc: qemu-...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: Greg Kurz 
Reviewed-by: Cédric Le Goater 
Message-Id: <20200609122339.937862-12-arm...@redhat.com>
---
 hw/pci-host/pnv_phb4_pec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index 911d147ffd..565345a018 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -397,6 +397,9 @@ static void pnv_pec_realize(DeviceState *dev, Error **errp)
 return;
 }
 }
+for (; i < PHB4_PEC_MAX_STACKS; i++) {
+object_unparent(OBJECT(>stacks[i]));
+}
 
 /* Initialize the XSCOM regions for the PEC registers */
 snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest", pec->chip_id,
-- 
2.26.2

[PULL 65/84] sysbus: Drop useless OBJECT() in sysbus_init_child_obj() calls

[Markus Armbruster]

OBJECT(child) expands to ((Object *)(child)).  sysbus_init_child_obj()
parameter @child is void *.  Pass child instead of OBJECT(child).

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-40-arm...@redhat.com>
---
 hw/arm/allwinner-a10.c  |  4 ++--
 hw/arm/aspeed_ast2600.c | 39 +--
 hw/arm/aspeed_soc.c | 35 +++
 hw/arm/nrf51_soc.c  |  2 +-
 hw/mips/boston.c|  4 ++--
 hw/mips/malta.c |  2 +-
 6 files changed, 38 insertions(+), 48 deletions(-)

diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index 49c51463e1..64449416de 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -59,9 +59,9 @@ static void aw_a10_init(Object *obj)
 int i;
 
 for (i = 0; i < AW_A10_NUM_USB; i++) {
-sysbus_init_child_obj(obj, "ehci[*]", OBJECT(>ehci[i]),
+sysbus_init_child_obj(obj, "ehci[*]", >ehci[i],
   sizeof(s->ehci[i]), TYPE_PLATFORM_EHCI);
-sysbus_init_child_obj(obj, "ohci[*]", OBJECT(>ohci[i]),
+sysbus_init_child_obj(obj, "ohci[*]", >ohci[i],
   sizeof(s->ohci[i]), TYPE_SYSBUS_OHCI);
 }
 }
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index beb688fd8f..10e92643c1 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -131,8 +131,7 @@ static void aspeed_soc_ast2600_init(Object *obj)
 }
 
 snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
-sysbus_init_child_obj(obj, "scu", OBJECT(>scu), sizeof(s->scu),
-  typename);
+sysbus_init_child_obj(obj, "scu", >scu, sizeof(s->scu), typename);
 qdev_prop_set_uint32(DEVICE(>scu), "silicon-rev",
  sc->silicon_rev);
 object_property_add_alias(obj, "hw-strap1", OBJECT(>scu),
@@ -145,36 +144,33 @@ static void aspeed_soc_ast2600_init(Object *obj)
 sysbus_init_child_obj(obj, "a7mpcore", >a7mpcore,
   sizeof(s->a7mpcore), TYPE_A15MPCORE_PRIV);
 
-sysbus_init_child_obj(obj, "rtc", OBJECT(>rtc), sizeof(s->rtc),
+sysbus_init_child_obj(obj, "rtc", >rtc, sizeof(s->rtc),
   TYPE_ASPEED_RTC);
 
 snprintf(typename, sizeof(typename), "aspeed.timer-%s", socname);
-sysbus_init_child_obj(obj, "timerctrl", OBJECT(>timerctrl),
+sysbus_init_child_obj(obj, "timerctrl", >timerctrl,
   sizeof(s->timerctrl), typename);
 
 snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
-sysbus_init_child_obj(obj, "i2c", OBJECT(>i2c), sizeof(s->i2c),
-  typename);
+sysbus_init_child_obj(obj, "i2c", >i2c, sizeof(s->i2c), typename);
 
 snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
-sysbus_init_child_obj(obj, "fmc", OBJECT(>fmc), sizeof(s->fmc),
-  typename);
+sysbus_init_child_obj(obj, "fmc", >fmc, sizeof(s->fmc), typename);
 object_property_add_alias(obj, "num-cs", OBJECT(>fmc), "num-cs");
 
 for (i = 0; i < sc->spis_num; i++) {
 snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, 
socname);
-sysbus_init_child_obj(obj, "spi[*]", OBJECT(>spi[i]),
+sysbus_init_child_obj(obj, "spi[*]", >spi[i],
   sizeof(s->spi[i]), typename);
 }
 
 for (i = 0; i < sc->ehcis_num; i++) {
-sysbus_init_child_obj(obj, "ehci[*]", OBJECT(>ehci[i]),
+sysbus_init_child_obj(obj, "ehci[*]", >ehci[i],
   sizeof(s->ehci[i]), TYPE_PLATFORM_EHCI);
 }
 
 snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
-sysbus_init_child_obj(obj, "sdmc", OBJECT(>sdmc), sizeof(s->sdmc),
-  typename);
+sysbus_init_child_obj(obj, "sdmc", >sdmc, sizeof(s->sdmc), typename);
 object_property_add_alias(obj, "ram-size", OBJECT(>sdmc),
   "ram-size");
 object_property_add_alias(obj, "max-ram-size", OBJECT(>sdmc),
@@ -182,30 +178,29 @@ static void aspeed_soc_ast2600_init(Object *obj)
 
 for (i = 0; i < sc->wdts_num; i++) {
 snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
-sysbus_init_child_obj(obj, "wdt[*]", OBJECT(>wdt[i]),
+sysbus_init_child_obj(obj, "wdt[*]", >wdt[i],
   sizeof(s->wdt[i]), typename);
 }
 
 for (i = 0; i < sc->macs_num; i++) {
-sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(>ftgmac100[i]),
+sysbus_init_child_obj(obj, "ftgmac100[*]", >ftgmac100[i],
   sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
 
 sysbus_init_child_obj(obj, "mii[*]", >mii[i], sizeof(s->mii[i]),
   TYPE_ASPEED_MII);
 }
 
-sysbus_init_child_obj(obj, "xdma", OBJECT(>xdma), 

[PULL 72/84] qdev: Drop qdev_realize() support for null bus

[Markus Armbruster]

The "null @bus means main system bus" convenience feature is no longer
used.  Drop it.

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-47-arm...@redhat.com>
---
 hw/core/qdev.c | 16 ++--
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index a1fdebb3aa..78a06db76e 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -408,8 +408,7 @@ void qdev_init_nofail(DeviceState *dev)
 /*
  * Realize @dev.
  * @dev must not be plugged into a bus.
- * Plug @dev into @bus if non-null, else into the main system bus.
- * This takes a reference to @dev.
+ * Plug @dev into @bus.  This takes a reference to @dev.
  * If @dev has no QOM parent, make one up, taking another reference.
  * On success, return true.
  * On failure, store an error through @errp and return false.
@@ -419,18 +418,7 @@ bool qdev_realize(DeviceState *dev, BusState *bus, Error 
**errp)
 Error *err = NULL;
 
 assert(!dev->realized && !dev->parent_bus);
-
-if (!bus) {
-/*
- * Assert that the device really is a SysBusDevice before we
- * put it onto the sysbus.  Non-sysbus devices which aren't
- * being put onto a bus should be realized with
- * object_property_set_bool(OBJECT(dev), true, "realized",
- * errp);
- */
-g_assert(object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE));
-bus = sysbus_get_default();
-}
+assert(bus);
 
 qdev_set_parent_bus(dev, bus);
 
-- 
2.26.2

[PULL 82/84] qdev: Convert bus-less devices to qdev_realize() with Coccinelle

[Markus Armbruster]

All remaining conversions to qdev_realize() are for bus-less devices.
Coccinelle script:

// only correct for bus-less @dev!

@@
expression errp;
expression dev;
@@
-qdev_init_nofail(dev);
+qdev_realize(dev, NULL, _fatal);

@ depends on !(file in "hw/core/qdev.c") && !(file in "hw/core/bus.c")@
expression errp;
expression dev;
symbol true;
@@
-object_property_set_bool(OBJECT(dev), true, "realized", errp);
+qdev_realize(DEVICE(dev), NULL, errp);

@ depends on !(file in "hw/core/qdev.c") && !(file in "hw/core/bus.c")@
expression errp;
expression dev;
symbol true;
@@
-object_property_set_bool(dev, true, "realized", errp);
+qdev_realize(DEVICE(dev), NULL, errp);

Note that Coccinelle chokes on ARMSSE typedef vs. macro in
hw/arm/armsse.c.  Worked around by temporarily renaming the macro for
the spatch run.

Signed-off-by: Markus Armbruster 
Acked-by: Alistair Francis 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-57-arm...@redhat.com>
---
 hw/arm/allwinner-a10.c   |  2 +-
 hw/arm/allwinner-h3.c|  2 +-
 hw/arm/armsse.c  | 20 ++-
 hw/arm/armv7m.c  |  2 +-
 hw/arm/aspeed.c  |  3 +--
 hw/arm/aspeed_ast2600.c  |  2 +-
 hw/arm/aspeed_soc.c  |  2 +-
 hw/arm/bcm2836.c |  3 +--
 hw/arm/cubieboard.c  |  2 +-
 hw/arm/digic.c   |  2 +-
 hw/arm/digic_boards.c|  2 +-
 hw/arm/exynos4210.c  |  4 +--
 hw/arm/fsl-imx25.c   |  2 +-
 hw/arm/fsl-imx31.c   |  2 +-
 hw/arm/fsl-imx6.c|  2 +-
 hw/arm/fsl-imx6ul.c  |  3 +--
 hw/arm/fsl-imx7.c|  2 +-
 hw/arm/highbank.c|  2 +-
 hw/arm/imx25_pdk.c   |  2 +-
 hw/arm/integratorcp.c|  2 +-
 hw/arm/kzm.c |  2 +-
 hw/arm/mcimx6ul-evk.c|  2 +-
 hw/arm/mcimx7d-sabre.c   |  2 +-
 hw/arm/mps2-tz.c |  9 +++
 hw/arm/mps2.c|  7 +++---
 hw/arm/musca.c   |  6 ++---
 hw/arm/orangepi.c|  2 +-
 hw/arm/raspi.c   |  2 +-
 hw/arm/realview.c|  2 +-
 hw/arm/sabrelite.c   |  2 +-
 hw/arm/sbsa-ref.c|  2 +-
 hw/arm/stm32f205_soc.c   |  2 +-
 hw/arm/stm32f405_soc.c   |  2 +-
 hw/arm/versatilepb.c |  2 +-
 hw/arm/vexpress.c|  2 +-
 hw/arm/virt.c|  2 +-
 hw/arm/xilinx_zynq.c |  2 +-
 hw/arm/xlnx-versal.c |  2 +-
 hw/arm/xlnx-zcu102.c |  2 +-
 hw/arm/xlnx-zynqmp.c | 10 +++-
 hw/block/nand.c  |  2 +-
 hw/char/serial-isa.c |  2 +-
 hw/char/serial-pci-multi.c   |  2 +-
 hw/char/serial-pci.c |  2 +-
 hw/char/serial.c |  4 +--
 hw/core/cpu.c|  2 +-
 hw/hyperv/hyperv.c   |  2 +-
 hw/i386/x86.c|  2 +-
 hw/ide/microdrive.c  |  3 ++-
 hw/intc/pnv_xive.c   |  4 +--
 hw/intc/spapr_xive.c |  4 +--
 hw/intc/xics.c   |  2 +-
 hw/intc/xive.c   |  2 +-
 hw/microblaze/petalogix_ml605_mmu.c  |  2 +-
 hw/microblaze/petalogix_s3adsp1800_mmu.c |  2 +-
 hw/microblaze/xlnx-zynqmp-pmu.c  |  4 +--
 hw/pci-host/pnv_phb3.c   |  6 ++---
 hw/pci-host/pnv_phb4.c   |  2 +-
 hw/pci-host/pnv_phb4_pec.c   |  2 +-
 hw/pci-host/prep.c   |  3 +--
 hw/ppc/pnv.c | 32 ++--
 hw/ppc/pnv_bmc.c |  2 +-
 hw/ppc/pnv_core.c|  2 +-
 hw/ppc/pnv_psi.c |  4 +--
 hw/ppc/spapr.c   |  5 ++--
 hw/ppc/spapr_cpu_core.c  |  2 +-
 hw/ppc/spapr_drc.c   |  2 +-
 hw/ppc/spapr_iommu.c |  2 +-
 hw/ppc/spapr_irq.c   |  2 +-
 hw/riscv/opentitan.c |  3 +--
 hw/riscv/riscv_hart.c|  3 +--
 hw/riscv/sifive_e.c  |  3 +--
 hw/riscv/sifive_u.c  |  9 +++
 hw/s390x/s390-skeys.c|  2 +-
 hw/s390x/s390-stattrib.c |  2 +-
 hw/s390x/s390-virtio-ccw.c   |  4 +--
 hw/s390x/sclp.c  |  2 

[PULL 54/84] usb: usb_create() is now unused, drop

[Markus Armbruster]

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Gerd Hoffmann 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-29-arm...@redhat.com>
---
 include/hw/usb.h | 1 -
 hw/usb/bus.c | 8 
 2 files changed, 9 deletions(-)

diff --git a/include/hw/usb.h b/include/hw/usb.h
index dce16c792b..e29a37635b 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -505,7 +505,6 @@ void usb_legacy_register(const char *typename, const char 
*usbdevice_name,
  USBDevice *(*usbdevice_init)(const char *params));
 USBDevice *usb_new(const char *name);
 bool usb_realize_and_unref(USBDevice *dev, USBBus *bus, Error **errp);
-USBDevice *usb_create(USBBus *bus, const char *name);
 USBDevice *usb_create_simple(USBBus *bus, const char *name);
 USBDevice *usbdevice_create(const char *cmdline);
 void usb_register_port(USBBus *bus, USBPort *port, void *opaque, int index,
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index da85b8b005..5c4d31614e 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -323,14 +323,6 @@ bool usb_realize_and_unref(USBDevice *dev, USBBus *bus, 
Error **errp)
 return qdev_realize_and_unref(>qdev, >qbus, errp);
 }
 
-USBDevice *usb_create(USBBus *bus, const char *name)
-{
-DeviceState *dev;
-
-dev = qdev_create(>qbus, name);
-return USB_DEVICE(dev);
-}
-
 static USBDevice *usb_try_create_simple(USBBus *bus, const char *name,
 Error **errp)
 {
-- 
2.26.2

[PULL 63/84] macio: Convert use of qdev_set_parent_bus()

[Markus Armbruster]

Convert qdev_set_parent_bus()/realize to qdev_realize(); recent commit
"qdev: New qdev_new(), qdev_realize(), etc." explains why.

Cc: Mark Cave-Ayland 
Cc: David Gibson 
Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-38-arm...@redhat.com>
---
 hw/misc/macio/macio.c | 13 ++---
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index a2698e4a20..1a07ca2ca5 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -100,7 +100,6 @@ static void macio_init_child_obj(MacIOState *s, const char 
*childname,
 {
 object_initialize_child_with_props(OBJECT(s), childname, child, childsize,
childtype, _abort, NULL);
-qdev_set_parent_bus(DEVICE(child), BUS(>macio_bus));
 }
 
 static void macio_common_realize(PCIDevice *d, Error **errp)
@@ -109,7 +108,7 @@ static void macio_common_realize(PCIDevice *d, Error **errp)
 SysBusDevice *sysbus_dev;
 Error *err = NULL;
 
-object_property_set_bool(OBJECT(>dbdma), true, "realized", );
+qdev_realize(DEVICE(>dbdma), BUS(>macio_bus), );
 if (err) {
 error_propagate(errp, err);
 return;
@@ -125,7 +124,7 @@ static void macio_common_realize(PCIDevice *d, Error **errp)
 qdev_prop_set_chr(DEVICE(>escc), "chrB", serial_hd(1));
 qdev_prop_set_uint32(DEVICE(>escc), "chnBtype", escc_serial);
 qdev_prop_set_uint32(DEVICE(>escc), "chnAtype", escc_serial);
-object_property_set_bool(OBJECT(>escc), true, "realized", );
+qdev_realize(DEVICE(>escc), BUS(>macio_bus), );
 if (err) {
 error_propagate(errp, err);
 return;
@@ -148,7 +147,7 @@ static void macio_realize_ide(MacIOState *s, MACIOIDEState 
*ide,
 object_property_set_link(OBJECT(ide), OBJECT(>dbdma), "dbdma", errp);
 macio_ide_register_dma(ide);
 
-object_property_set_bool(OBJECT(ide), true, "realized", errp);
+qdev_realize(DEVICE(ide), BUS(>macio_bus), errp);
 }
 
 static void macio_oldworld_realize(PCIDevice *d, Error **errp)
@@ -167,7 +166,7 @@ static void macio_oldworld_realize(PCIDevice *d, Error 
**errp)
 
 qdev_prop_set_uint64(DEVICE(>cuda), "timebase-frequency",
  s->frequency);
-object_property_set_bool(OBJECT(>cuda), true, "realized", );
+qdev_realize(DEVICE(>cuda), BUS(>macio_bus), );
 if (err) {
 error_propagate(errp, err);
 return;
@@ -184,7 +183,7 @@ static void macio_oldworld_realize(PCIDevice *d, Error 
**errp)
 sysbus_connect_irq(sysbus_dev, 1, qdev_get_gpio_in(pic_dev,
OLDWORLD_ESCCA_IRQ));
 
-object_property_set_bool(OBJECT(>nvram), true, "realized", );
+qdev_realize(DEVICE(>nvram), BUS(>macio_bus), );
 if (err) {
 error_propagate(errp, err);
 return;
@@ -348,7 +347,7 @@ static void macio_newworld_realize(PCIDevice *d, Error 
**errp)
  _abort);
 memory_region_add_subregion(>bar, 0x50,
 sysbus_mmio_get_region(sysbus_dev, 0));
-object_property_set_bool(OBJECT(>gpio), true, "realized", );
+qdev_realize(DEVICE(>gpio), BUS(>macio_bus), );
 
 /* PMU */
 object_initialize_child(OBJECT(s), "pmu", >pmu, TYPE_VIA_PMU);
-- 
2.26.2

[PULL 56/84] qdev: qdev_create(), qdev_try_create() are now unused, drop

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-31-arm...@redhat.com>
---
 include/hw/qdev-core.h |  2 --
 hw/core/qdev.c | 48 --
 hw/core/sysbus.c   |  1 -
 migration/migration.c  |  2 +-
 4 files changed, 1 insertion(+), 52 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index be6f7c4736..ef6137b6a8 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -320,8 +320,6 @@ compat_props_add(GPtrArray *arr,
 
 /*** Board API.  This should go away once we have a machine config file.  ***/
 
-DeviceState *qdev_create(BusState *bus, const char *name);
-DeviceState *qdev_try_create(BusState *bus, const char *name);
 DeviceState *qdev_new(const char *name);
 DeviceState *qdev_try_new(const char *name);
 void qdev_init_nofail(DeviceState *dev);
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 4768244f31..a1fdebb3aa 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -128,54 +128,6 @@ void qdev_set_parent_bus(DeviceState *dev, BusState *bus)
 }
 }
 
-/* Create a new device.  This only initializes the device state
-   structure and allows properties to be set.  The device still needs
-   to be realized.  See qdev-core.h.  */
-DeviceState *qdev_create(BusState *bus, const char *name)
-{
-DeviceState *dev;
-
-dev = qdev_try_create(bus, name);
-if (!dev) {
-if (bus) {
-error_report("Unknown device '%s' for bus '%s'", name,
- object_get_typename(OBJECT(bus)));
-} else {
-error_report("Unknown device '%s' for default sysbus", name);
-}
-abort();
-}
-
-return dev;
-}
-
-DeviceState *qdev_try_create(BusState *bus, const char *type)
-{
-DeviceState *dev;
-
-if (object_class_by_name(type) == NULL) {
-return NULL;
-}
-dev = DEVICE(object_new(type));
-if (!dev) {
-return NULL;
-}
-
-if (!bus) {
-/* Assert that the device really is a SysBusDevice before
- * we put it onto the sysbus. Non-sysbus devices which aren't
- * being put onto a bus should be created with object_new(TYPE_FOO),
- * not qdev_create(NULL, TYPE_FOO).
- */
-g_assert(object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE));
-bus = sysbus_get_default();
-}
-
-qdev_set_parent_bus(dev, bus);
-object_unref(OBJECT(dev));
-return dev;
-}
-
 /*
  * Create a device on the heap.
  * A type @name must exist.
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index b5db0d179f..7ff1b5f2de 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -325,7 +325,6 @@ static const TypeInfo sysbus_device_type_info = {
 .class_init = sysbus_device_class_init,
 };
 
-/* This is a nasty hack to allow passing a NULL bus to qdev_create.  */
 static BusState *main_system_bus;
 
 static void main_system_bus_create(void)
diff --git a/migration/migration.c b/migration/migration.c
index b63ad91d34..481a590f72 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3778,7 +3778,7 @@ static const TypeInfo migration_type = {
 .name = TYPE_MIGRATION,
 /*
  * NOTE: TYPE_MIGRATION is not really a device, as the object is
- * not created using qdev_create(), it is not attached to the qdev
+ * not created using qdev_new(), it is not attached to the qdev
  * device tree, and it is never realized.
  *
  * TODO: Make this TYPE_OBJECT once QOM provides something like
-- 
2.26.2

[PULL 83/84] qdev: qdev_init_nofail() is now unused, drop

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-58-arm...@redhat.com>
---
 include/hw/qdev-core.h |  3 +--
 hw/core/qdev.c | 29 -
 2 files changed, 1 insertion(+), 31 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index ef6137b6a8..7dc10be46f 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -57,7 +57,7 @@ typedef void (*BusUnrealize)(BusState *bus);
  * After successful realization, setting static properties will fail.
  *
  * As an interim step, the #DeviceState:realized property can also be
- * set with qdev_realize() or qdev_init_nofail().
+ * set with qdev_realize().
  * In the future, devices will propagate this state change to their children
  * and along busses they expose.
  * The point in time will be deferred to machine creation, so that values
@@ -322,7 +322,6 @@ compat_props_add(GPtrArray *arr,
 
 DeviceState *qdev_new(const char *name);
 DeviceState *qdev_try_new(const char *name);
-void qdev_init_nofail(DeviceState *dev);
 bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp);
 bool qdev_realize_and_unref(DeviceState *dev, BusState *bus, Error **errp);
 void qdev_unrealize(DeviceState *dev);
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 50336168f2..2131c7f951 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -376,35 +376,6 @@ void qdev_simple_device_unplug_cb(HotplugHandler 
*hotplug_dev,
 qdev_unrealize(dev);
 }
 
-/*
- * Realize @dev.
- * Device properties should be set before calling this function.  IRQs
- * and MMIO regions should be connected/mapped after calling this
- * function.
- * On failure, report an error with error_report() and terminate the
- * program.  This is okay during machine creation.  Don't use for
- * hotplug, because there callers need to recover from failure.
- * Exception: if you know the device's init() callback can't fail,
- * then qdev_init_nofail() can't fail either, and is therefore usable
- * even then.  But relying on the device implementation that way is
- * somewhat unclean, and best avoided.
- */
-void qdev_init_nofail(DeviceState *dev)
-{
-Error *err = NULL;
-
-assert(!dev->realized);
-
-object_ref(OBJECT(dev));
-object_property_set_bool(OBJECT(dev), true, "realized", );
-if (err) {
-error_reportf_err(err, "Initialization of device %s failed: ",
-  object_get_typename(OBJECT(dev)));
-exit(1);
-}
-object_unref(OBJECT(dev));
-}
-
 /*
  * Realize @dev.
  * @dev must not be plugged into a bus.
-- 
2.26.2

[PULL 12/84] macio: Delete unused "macio-gpio" devices

[Markus Armbruster]

These devices go with the "via-pmu" device, which is controlled by
property "has-pmu".  macio_newworld_init() creates it unconditionally,
because the property has not been set then.  macio_newworld_realize()
realizes it only when the property is true.  Works, although it can
leave an unrealized device hanging around in the QOM composition tree.
Affects machine mac99 with via=cuda (default).

Delete the unused device by making macio_newworld_realize() unparent
it.  Visible in "info qom-tree":

 /machine (mac99-machine)
   [...]
   /unattached (container)
 /device[9] (macio-newworld)
   [...]
   /escc-legacy-port[8] (qemu:memory-region)
   /escc-legacy-port[9] (qemu:memory-region)
   /escc-legacy[0] (qemu:memory-region)
-  /gpio (macio-gpio)
-/gpio[0] (qemu:memory-region)
   /ide[0] (macio-ide)
 /ide.0 (IDE)
 /pmac-ide[0] (qemu:memory-region)

Cc: Mark Cave-Ayland 
Cc: David Gibson 
Cc: qemu-...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: Mark Cave-Ayland 
Message-Id: <20200609122339.937862-11-arm...@redhat.com>
---
 hw/misc/macio/macio.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index 3779865ab2..b3dddf8be7 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -368,6 +368,8 @@ static void macio_newworld_realize(PCIDevice *d, Error 
**errp)
 memory_region_add_subregion(>bar, 0x16000,
 sysbus_mmio_get_region(sysbus_dev, 0));
 } else {
+object_unparent(OBJECT(>gpio));
+
 /* CUDA */
 object_initialize_child(OBJECT(s), "cuda", >cuda, sizeof(s->cuda),
 TYPE_CUDA, _abort, NULL);
-- 
2.26.2

[PULL 66/84] microbit: Tidy up sysbus_init_child_obj() @child argument

[Markus Armbruster]

The callers of sysbus_init_child_obj() commonly pass either ,
sizeof(child), or pchild, sizeof(*pchild).  Tidy up two that don't,
mostly to keep future commits simpler.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-41-arm...@redhat.com>
---
 hw/arm/microbit.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index ef213695bd..72fab429c4 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -39,7 +39,7 @@ static void microbit_init(MachineState *machine)
 Object *soc = OBJECT(>nrf51);
 Object *i2c = OBJECT(>i2c);
 
-sysbus_init_child_obj(OBJECT(machine), "nrf51", soc, sizeof(s->nrf51),
+sysbus_init_child_obj(OBJECT(machine), "nrf51", >nrf51, 
sizeof(s->nrf51),
   TYPE_NRF51_SOC);
 qdev_prop_set_chr(DEVICE(>nrf51), "serial0", serial_hd(0));
 object_property_set_link(soc, OBJECT(system_memory), "memory",
@@ -51,7 +51,7 @@ static void microbit_init(MachineState *machine)
  * hack until we implement the nRF51 TWI controller properly and the
  * magnetometer/accelerometer devices.
  */
-sysbus_init_child_obj(OBJECT(machine), "microbit.twi", i2c,
+sysbus_init_child_obj(OBJECT(machine), "microbit.twi", >i2c,
   sizeof(s->i2c), TYPE_MICROBIT_I2C);
 object_property_set_bool(i2c, true, "realized", _fatal);
 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(i2c), 0);
-- 
2.26.2

[PULL 38/84] qdev: Convert uses of qdev_set_parent_bus() manually

[Markus Armbruster]

Same transformation as in the previous commit.  Manual, because
convincing Coccinelle to transform these cases is somewhere between
not worthwhile and infeasible (at least for me).

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-13-arm...@redhat.com>
---
 hw/pci-host/prep.c |  3 +--
 hw/ppc/pnv.c   |  6 ++
 hw/s390x/sclp.c| 10 --
 3 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index fc01a294a4..a5550d1221 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -268,7 +268,7 @@ static void raven_pcihost_realizefn(DeviceState *d, Error 
**errp)
 memory_region_add_subregion(address_space_mem, 0xbff0, >pci_intack);
 
 /* TODO Remove once realize propagates to child devices. */
-object_property_set_bool(OBJECT(>pci_dev), true, "realized", errp);
+qdev_realize(DEVICE(>pci_dev), BUS(>pci_bus), errp);
 }
 
 static void raven_pcihost_initfn(Object *obj)
@@ -308,7 +308,6 @@ static void raven_pcihost_initfn(Object *obj)
 
 object_initialize(>pci_dev, sizeof(s->pci_dev), TYPE_RAVEN_PCI_DEVICE);
 pci_dev = DEVICE(>pci_dev);
-qdev_set_parent_bus(pci_dev, BUS(>pci_bus));
 object_property_set_int(OBJECT(>pci_dev), PCI_DEVFN(0, 0), "addr",
 NULL);
 qdev_prop_set_bit(pci_dev, "multifunction", false);
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 8562af3fe0..e0588285a2 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1212,12 +1212,11 @@ static void pnv_chip_power8_realize(DeviceState *dev, 
Error **errp)
 object_property_set_int(OBJECT(phb), i, "index", _fatal);
 object_property_set_int(OBJECT(phb), chip->chip_id, "chip-id",
 _fatal);
-object_property_set_bool(OBJECT(phb), true, "realized", _err);
+qdev_realize(DEVICE(phb), NULL, _err);
 if (local_err) {
 error_propagate(errp, local_err);
 return;
 }
-qdev_set_parent_bus(DEVICE(phb), sysbus_get_default());
 
 /* Populate the XSCOM address space. */
 pnv_xscom_add_subregion(chip,
@@ -1422,12 +1421,11 @@ static void pnv_chip_power9_phb_realize(PnvChip *chip, 
Error **errp)
 object_property_set_int(obj, PNV_PHB4_DEVICE_ID, "device-id",
 _fatal);
 object_property_set_link(obj, OBJECT(stack), "stack", 
_abort);
-object_property_set_bool(obj, true, "realized", _err);
+qdev_realize(DEVICE(obj), NULL, _err);
 if (local_err) {
 error_propagate(errp, local_err);
 return;
 }
-qdev_set_parent_bus(DEVICE(obj), sysbus_get_default());
 
 /* Populate the XSCOM address space. */
 pnv_xscom_add_subregion(chip,
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 20aca30ac4..40e27a8cb4 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -333,17 +333,15 @@ static void sclp_realize(DeviceState *dev, Error **errp)
 uint64_t hw_limit;
 int ret;
 
-object_property_set_bool(OBJECT(sclp->event_facility), true, "realized",
- );
-if (err) {
-goto out;
-}
 /*
  * qdev_device_add searches the sysbus for TYPE_SCLP_EVENTS_BUS. As long
  * as we can't find a fitting bus via the qom tree, we have to add the
  * event facility to the sysbus, so e.g. a sclp console can be created.
  */
-qdev_set_parent_bus(DEVICE(sclp->event_facility), sysbus_get_default());
+qdev_realize(DEVICE(sclp->event_facility), NULL, );
+if (err) {
+goto out;
+}
 
 ret = s390_set_memory_limit(machine->maxram_size, _limit);
 if (ret == -E2BIG) {
-- 
2.26.2

[PULL 55/84] usb: Eliminate usb_try_create_simple()

[Markus Armbruster]

usb_try_create_simple() is qdev_try_new() and qdev_realize_and_unref()
with more verbose error messages.  Of its two users, one ignores
errors, and the other asserts they are impossible.

Make them use qdev_try_new() and qdev_realize_and_unref() directly,
and eliminate usb_try_create_simple

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Gerd Hoffmann 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-30-arm...@redhat.com>
---
 hw/usb/bus.c | 37 ++---
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index 5c4d31614e..a81aee2051 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -318,35 +318,22 @@ USBDevice *usb_new(const char *name)
 return USB_DEVICE(qdev_new(name));
 }
 
+static USBDevice *usb_try_new(const char *name)
+{
+return USB_DEVICE(qdev_try_new(name));
+}
+
 bool usb_realize_and_unref(USBDevice *dev, USBBus *bus, Error **errp)
 {
 return qdev_realize_and_unref(>qdev, >qbus, errp);
 }
 
-static USBDevice *usb_try_create_simple(USBBus *bus, const char *name,
-Error **errp)
-{
-Error *err = NULL;
-DeviceState *dev;
-
-dev = qdev_try_new(name);
-if (!dev) {
-error_setg(errp, "Failed to create USB device '%s'", name);
-return NULL;
-}
-qdev_realize_and_unref(dev, >qbus, );
-if (err) {
-error_propagate_prepend(errp, err,
-"Failed to initialize USB device '%s': ",
-name);
-return NULL;
-}
-return USB_DEVICE(dev);
-}
-
 USBDevice *usb_create_simple(USBBus *bus, const char *name)
 {
-return usb_try_create_simple(bus, name, _abort);
+USBDevice *dev = usb_new(name);
+
+usb_realize_and_unref(dev, bus, _abort);
+return dev;
 }
 
 static void usb_fill_port(USBPort *port, void *opaque, int index,
@@ -426,6 +413,7 @@ void usb_claim_port(USBDevice *dev, Error **errp)
 {
 USBBus *bus = usb_bus_from_device(dev);
 USBPort *port;
+USBDevice *hub;
 
 assert(dev->port == NULL);
 
@@ -443,7 +431,10 @@ void usb_claim_port(USBDevice *dev, Error **errp)
 } else {
 if (bus->nfree == 1 && strcmp(object_get_typename(OBJECT(dev)), 
"usb-hub") != 0) {
 /* Create a new hub and chain it on */
-usb_try_create_simple(bus, "usb-hub", NULL);
+hub = usb_try_new("usb-hub");
+if (hub) {
+usb_realize_and_unref(hub, bus, NULL);
+}
 }
 if (bus->nfree == 0) {
 error_setg(errp, "tried to attach usb device %s to a bus "
-- 
2.26.2

[PULL 49/84] ssi: Convert uses of ssi_create_slave_no_init() with Coccinelle

[Markus Armbruster]

Replace

dev = ssi_create_slave_no_init(bus, type_name);
...
qdev_init_nofail(dev);

by

dev = qdev_new(type_name);
...
qdev_realize_and_unref(dev, bus, _fatal);

Recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains
why.

@@
type SSIBus;
identifier bus;
expression dev, qbus, expr;
expression list args;
@@
-bus = (SSIBus *)qbus;
+bus = qbus; // TODO fix up decl
 ...
-dev = ssi_create_slave_no_init(bus, args);
+dev = qdev_new(args);
 ... when != dev = expr
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = ssi_create_slave_no_init(bus, args);
+dev = qdev_new(args);
 ... when != dev = expr
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, BUS(bus), _fatal);

Bus declarations fixed up manually.

Cc: Alistair Francis 
Signed-off-by: Markus Armbruster 
Reviewed-by: Alistair Francis 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-24-arm...@redhat.com>
---
 hw/arm/aspeed.c |  4 ++--
 hw/arm/msf2-som.c   |  8 
 hw/arm/sabrelite.c  |  4 ++--
 hw/arm/xilinx_zynq.c|  4 ++--
 hw/arm/xlnx-zcu102.c| 16 
 hw/microblaze/petalogix_ml605_mmu.c |  4 ++--
 6 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index b08903df33..2b96244cf5 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -225,12 +225,12 @@ static void aspeed_board_init_flashes(AspeedSMCState *s, 
const char *flashtype,
 DriveInfo *dinfo = drive_get_next(IF_MTD);
 qemu_irq cs_line;
 
-fl->flash = ssi_create_slave_no_init(s->spi, flashtype);
+fl->flash = qdev_new(flashtype);
 if (dinfo) {
 qdev_prop_set_drive(fl->flash, "drive", blk_by_legacy_dinfo(dinfo),
 errp);
 }
-qdev_init_nofail(fl->flash);
+qdev_realize_and_unref(fl->flash, BUS(s->spi), _fatal);
 
 cs_line = qdev_get_gpio_in_named(fl->flash, SSI_GPIO_CS, 0);
 sysbus_connect_irq(SYS_BUS_DEVICE(s), i + 1, cs_line);
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index e398703742..ca9cbe1acb 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -47,7 +47,7 @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
 MachineClass *mc = MACHINE_GET_CLASS(machine);
 DriveInfo *dinfo = drive_get_next(IF_MTD);
 qemu_irq cs_line;
-SSIBus *spi_bus;
+BusState *spi_bus;
 MemoryRegion *sysmem = get_system_memory();
 MemoryRegion *ddr = g_new(MemoryRegion, 1);
 
@@ -82,14 +82,14 @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
 soc = MSF2_SOC(dev);
 
 /* Attach SPI flash to SPI0 controller */
-spi_bus = (SSIBus *)qdev_get_child_bus(dev, "spi0");
-spi_flash = ssi_create_slave_no_init(spi_bus, "s25sl12801");
+spi_bus = qdev_get_child_bus(dev, "spi0");
+spi_flash = qdev_new("s25sl12801");
 qdev_prop_set_uint8(spi_flash, "spansion-cr2nv", 1);
 if (dinfo) {
 qdev_prop_set_drive(spi_flash, "drive", blk_by_legacy_dinfo(dinfo),
 _fatal);
 }
-qdev_init_nofail(spi_flash);
+qdev_realize_and_unref(spi_flash, spi_bus, _fatal);
 cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
 sysbus_connect_irq(SYS_BUS_DEVICE(>spi[0]), 1, cs_line);
 
diff --git a/hw/arm/sabrelite.c b/hw/arm/sabrelite.c
index 96cb30aa3c..33d731549d 100644
--- a/hw/arm/sabrelite.c
+++ b/hw/arm/sabrelite.c
@@ -75,13 +75,13 @@ static void sabrelite_init(MachineState *machine)
 qemu_irq cs_line;
 DriveInfo *dinfo = drive_get_next(IF_MTD);
 
-flash_dev = ssi_create_slave_no_init(spi_bus, "sst25vf016b");
+flash_dev = qdev_new("sst25vf016b");
 if (dinfo) {
 qdev_prop_set_drive(flash_dev, "drive",
 blk_by_legacy_dinfo(dinfo),
 _fatal);
 }
-qdev_init_nofail(flash_dev);
+qdev_realize_and_unref(flash_dev, BUS(spi_bus), _fatal);
 
 cs_line = qdev_get_gpio_in_named(flash_dev, SSI_GPIO_CS, 0);
 sysbus_connect_irq(SYS_BUS_DEVICE(spi_dev), 1, cs_line);
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 5fbd2b2e31..0e0f0976c4 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -157,12 +157,12 @@ static inline void zynq_init_spi_flashes(uint32_t 
base_addr, qemu_irq irq,
 
 for (j = 0; j < num_ss; ++j) {
 DriveInfo *dinfo = drive_get_next(IF_MTD);
-flash_dev = ssi_create_slave_no_init(spi, "n25q128");
+flash_dev = qdev_new("n25q128");
 if 

[PULL 50/84] ssi: Convert last use of ssi_create_slave_no_init() manually

[Markus Armbruster]

Same transformation as in the previous commit.  Manual, because
convincing Coccinelle to transform this case is not worthwhile.

Cc: Alistair Francis 
Signed-off-by: Markus Armbruster 
Acked-by: Alistair Francis 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-25-arm...@redhat.com>
---
 hw/ssi/ssi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/ssi.c b/hw/ssi/ssi.c
index 54106f5ef8..58e7d904db 100644
--- a/hw/ssi/ssi.c
+++ b/hw/ssi/ssi.c
@@ -16,6 +16,7 @@
 #include "hw/ssi/ssi.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
+#include "qapi/error.h"
 
 struct SSIBus {
 BusState parent_obj;
@@ -96,9 +97,9 @@ DeviceState *ssi_create_slave_no_init(SSIBus *bus, const char 
*name)
 
 DeviceState *ssi_create_slave(SSIBus *bus, const char *name)
 {
-DeviceState *dev = ssi_create_slave_no_init(bus, name);
+DeviceState *dev = qdev_new(name);
 
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, >parent_obj, _fatal);
 return dev;
 }
 
-- 
2.26.2

[PULL 34/84] qdev: Convert to qdev_unrealize() manually

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-9-arm...@redhat.com>
---
 include/hw/qdev-core.h | 1 -
 hw/core/qdev.c | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index fba29308f7..be6f7c4736 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -328,7 +328,6 @@ void qdev_init_nofail(DeviceState *dev);
 bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp);
 bool qdev_realize_and_unref(DeviceState *dev, BusState *bus, Error **errp);
 void qdev_unrealize(DeviceState *dev);
-
 void qdev_set_legacy_instance_id(DeviceState *dev, int alias_id,
  int required_for_version);
 HotplugHandler *qdev_get_bus_hotplug_handler(DeviceState *dev);
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index b7355fbcd0..4768244f31 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -421,7 +421,7 @@ static void device_reset_child_foreach(Object *obj, 
ResettableChildCallback cb,
 void qdev_simple_device_unplug_cb(HotplugHandler *hotplug_dev,
   DeviceState *dev, Error **errp)
 {
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);
 }
 
 /*
@@ -1183,7 +1183,7 @@ static void device_unparent(Object *obj)
 BusState *bus;
 
 if (dev->realized) {
-object_property_set_bool(obj, false, "realized", _abort);
+qdev_unrealize(dev);
 }
 while (dev->num_child_bus) {
 bus = QLIST_FIRST(>child_bus);
-- 
2.26.2

[PULL 26/84] qdev: Assert onboard devices all get realized properly

[Markus Armbruster]

This would have caught some of the bugs I just fixed.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200609122339.937862-25-arm...@redhat.com>
---
 hw/core/qdev.c | 16 
 1 file changed, 16 insertions(+)

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index b5b42b2616..a68ba674db 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -427,6 +427,19 @@ void qdev_init_nofail(DeviceState *dev)
 object_unref(OBJECT(dev));
 }
 
+static int qdev_assert_realized_properly(Object *obj, void *opaque)
+{
+DeviceState *dev = DEVICE(object_dynamic_cast(obj, TYPE_DEVICE));
+DeviceClass *dc;
+
+if (dev) {
+dc = DEVICE_GET_CLASS(dev);
+assert(dev->realized);
+assert(dev->parent_bus || !dc->bus_type);
+}
+return 0;
+}
+
 void qdev_machine_creation_done(void)
 {
 /*
@@ -434,6 +447,9 @@ void qdev_machine_creation_done(void)
  * only create hotpluggable devices
  */
 qdev_hotplug = true;
+
+object_child_foreach_recursive(object_get_root(),
+   qdev_assert_realized_properly, NULL);
 }
 
 bool qdev_machine_modified(void)
-- 
2.26.2

[PULL 44/84] isa: New isa_new(), isa_realize_and_unref() etc.

[Markus Armbruster]

I'm converting from qdev_create()/qdev_init_nofail() to
qdev_new()/qdev_realize_and_unref(); recent commit "qdev: New
qdev_new(), qdev_realize(), etc." explains why.

ISA devices use qdev_create() through isa_create() and
isa_try_create().

Provide isa_new(), isa_try_new(), and isa_realize_and_unref() for
converting ISA devices.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-19-arm...@redhat.com>
---
 include/hw/isa/isa.h |  3 +++
 hw/isa/isa-bus.c | 15 +++
 2 files changed, 18 insertions(+)

diff --git a/include/hw/isa/isa.h b/include/hw/isa/isa.h
index 02c2350274..3b6215fafe 100644
--- a/include/hw/isa/isa.h
+++ b/include/hw/isa/isa.h
@@ -105,6 +105,9 @@ MemoryRegion *isa_address_space(ISADevice *dev);
 MemoryRegion *isa_address_space_io(ISADevice *dev);
 ISADevice *isa_create(ISABus *bus, const char *name);
 ISADevice *isa_try_create(ISABus *bus, const char *name);
+ISADevice *isa_new(const char *name);
+ISADevice *isa_try_new(const char *name);
+bool isa_realize_and_unref(ISADevice *dev, ISABus *bus, Error **errp);
 ISADevice *isa_create_simple(ISABus *bus, const char *name);
 
 ISADevice *isa_vga_init(ISABus *bus);
diff --git a/hw/isa/isa-bus.c b/hw/isa/isa-bus.c
index 1c9d7e19ab..e6412d39b4 100644
--- a/hw/isa/isa-bus.c
+++ b/hw/isa/isa-bus.c
@@ -176,6 +176,16 @@ ISADevice *isa_try_create(ISABus *bus, const char *name)
 return ISA_DEVICE(dev);
 }
 
+ISADevice *isa_new(const char *name)
+{
+return ISA_DEVICE(qdev_new(name));
+}
+
+ISADevice *isa_try_new(const char *name)
+{
+return ISA_DEVICE(qdev_try_new(name));
+}
+
 ISADevice *isa_create_simple(ISABus *bus, const char *name)
 {
 ISADevice *dev;
@@ -185,6 +195,11 @@ ISADevice *isa_create_simple(ISABus *bus, const char *name)
 return dev;
 }
 
+bool isa_realize_and_unref(ISADevice *dev, ISABus *bus, Error **errp)
+{
+return qdev_realize_and_unref(>parent_obj, >parent_obj, errp);
+}
+
 ISADevice *isa_vga_init(ISABus *bus)
 {
 switch (vga_interface_type) {
-- 
2.26.2

[PULL 45/84] isa: Convert uses of isa_create() with Coccinelle

[Markus Armbruster]

Replace

dev = isa_create(bus, type_name);
...
qdev_init_nofail(dev);

by

dev = isa_new(type_name);
...
isa_realize_and_unref(dev, bus, _fatal);

Recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains
why.

Coccinelle script:

@@
expression dev, bus, expr;
expression list args;
expression d;
@@
-dev = isa_create(bus, args);
+dev = isa_new(args);
(
 d = >qdev;
|
 d = DEVICE(dev);
)
 ... when != dev = expr
-qdev_init_nofail(d);
+isa_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = isa_create(bus, args);
+dev = isa_new(args);
 ... when != dev = expr
-qdev_init_nofail(DEVICE(dev));
+isa_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = DEVICE(isa_create(bus, args));
+ISADevice *isa_dev; // TODO move
+isa_dev = isa_new(args);
+dev = DEVICE(isa_dev);
 ... when != dev = expr
-qdev_init_nofail(dev);
+isa_realize_and_unref(isa_dev, bus, _fatal);

Missing #include "qapi/error.h" added manually, whitespace changes
minimized manually.

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-20-arm...@redhat.com>
---
 include/hw/audio/pcspk.h |  5 +++--
 include/hw/timer/i8254.h |  9 +
 hw/char/parallel-isa.c   |  5 +++--
 hw/char/serial-isa.c |  4 ++--
 hw/dma/i8257.c   |  9 +
 hw/ide/isa.c |  5 +++--
 hw/intc/i8259_common.c   |  5 +++--
 hw/isa/isa-bus.c |  4 ++--
 hw/isa/isa-superio.c | 20 ++--
 hw/ppc/prep.c| 26 --
 hw/rtc/m48t59-isa.c  |  7 +--
 hw/rtc/mc146818rtc.c |  4 ++--
 hw/sparc64/sun4u.c   |  6 --
 13 files changed, 63 insertions(+), 46 deletions(-)

diff --git a/include/hw/audio/pcspk.h b/include/hw/audio/pcspk.h
index 632cce9f68..7e7f5f49dc 100644
--- a/include/hw/audio/pcspk.h
+++ b/include/hw/audio/pcspk.h
@@ -27,6 +27,7 @@
 
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
+#include "qapi/error.h"
 
 #define TYPE_PC_SPEAKER "isa-pcspk"
 
@@ -35,11 +36,11 @@ static inline ISADevice *pcspk_init(ISABus *bus, ISADevice 
*pit)
 DeviceState *dev;
 ISADevice *isadev;
 
-isadev = isa_create(bus, TYPE_PC_SPEAKER);
+isadev = isa_new(TYPE_PC_SPEAKER);
 dev = DEVICE(isadev);
 qdev_prop_set_uint32(dev, "iobase", 0x61);
 object_property_set_link(OBJECT(dev), OBJECT(pit), "pit", NULL);
-qdev_init_nofail(dev);
+isa_realize_and_unref(isadev, bus, _fatal);
 
 return isadev;
 }
diff --git a/include/hw/timer/i8254.h b/include/hw/timer/i8254.h
index 45cb42571f..e75b4a5a08 100644
--- a/include/hw/timer/i8254.h
+++ b/include/hw/timer/i8254.h
@@ -27,6 +27,7 @@
 
 #include "hw/qdev-properties.h"
 #include "hw/isa/isa.h"
+#include "qapi/error.h"
 
 #define PIT_FREQ 1193182
 
@@ -54,10 +55,10 @@ static inline ISADevice *i8254_pit_init(ISABus *bus, int 
base, int isa_irq,
 DeviceState *dev;
 ISADevice *d;
 
-d = isa_create(bus, TYPE_I8254);
+d = isa_new(TYPE_I8254);
 dev = DEVICE(d);
 qdev_prop_set_uint32(dev, "iobase", base);
-qdev_init_nofail(dev);
+isa_realize_and_unref(d, bus, _fatal);
 qdev_connect_gpio_out(dev, 0,
   isa_irq >= 0 ? isa_get_irq(d, isa_irq) : alt_irq);
 
@@ -69,10 +70,10 @@ static inline ISADevice *kvm_pit_init(ISABus *bus, int base)
 DeviceState *dev;
 ISADevice *d;
 
-d = isa_create(bus, TYPE_KVM_I8254);
+d = isa_new(TYPE_KVM_I8254);
 dev = DEVICE(d);
 qdev_prop_set_uint32(dev, "iobase", base);
-qdev_init_nofail(dev);
+isa_realize_and_unref(d, bus, _fatal);
 
 return d;
 }
diff --git a/hw/char/parallel-isa.c b/hw/char/parallel-isa.c
index bcc577f61c..1ccbb96e70 100644
--- a/hw/char/parallel-isa.c
+++ b/hw/char/parallel-isa.c
@@ -14,17 +14,18 @@
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
 #include "hw/char/parallel.h"
+#include "qapi/error.h"
 
 static void parallel_init(ISABus *bus, int index, Chardev *chr)
 {
 DeviceState *dev;
 ISADevice *isadev;
 
-isadev = isa_create(bus, "isa-parallel");
+isadev = isa_new("isa-parallel");
 dev = DEVICE(isadev);
 qdev_prop_set_uint32(dev, "index", index);
 qdev_prop_set_chr(dev, "chardev", chr);
-qdev_init_nofail(dev);
+isa_realize_and_unref(isadev, bus, _fatal);
 }
 
 void parallel_hds_isa_init(ISABus *bus, int n)
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index 165e320e65..d69aab5714 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -160,11 +160,11 @@ static void serial_isa_init(ISABus *bus, int index, 
Chardev *chr)
 DeviceState *dev;
 ISADevice *isadev;
 
-isadev = isa_create(bus, TYPE_ISA_SERIAL);
+isadev = 

[PULL 39/84] pci: New pci_new(), pci_realize_and_unref() etc.

[Markus Armbruster]

I'm converting from qdev_create()/qdev_init_nofail() to
qdev_new()/qdev_realize_and_unref(); recent commit "qdev: New
qdev_new(), qdev_realize(), etc." explains why.

PCI devices use qdev_create() through pci_create() and
pci_create_multifunction().

Provide pci_new(), pci_new_multifunction(), and
pci_realize_and_unref() for converting PCI devices.

Cc: Michael S. Tsirkin 
Cc: Marcel Apfelbaum 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-14-arm...@redhat.com>
Reviewed-by: Michael S. Tsirkin 
---
 include/hw/pci/pci.h |  5 +
 hw/pci/pci.c | 21 +
 2 files changed, 26 insertions(+)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index cfedf5a995..66f8ba519b 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -712,6 +712,11 @@ pci_get_quad_by_mask(uint8_t *config, uint64_t mask)
 return (val & mask) >> ctz32(mask);
 }
 
+PCIDevice *pci_new_multifunction(int devfn, bool multifunction,
+const char *name);
+PCIDevice *pci_new(int devfn, const char *name);
+bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp);
+
 PCIDevice *pci_create_multifunction(PCIBus *bus, int devfn, bool multifunction,
 const char *name);
 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 955eb11a01..7e759646cf 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2163,6 +2163,27 @@ static void pci_qdev_realize(DeviceState *qdev, Error 
**errp)
 }
 }
 
+PCIDevice *pci_new_multifunction(int devfn, bool multifunction,
+ const char *name)
+{
+DeviceState *dev;
+
+dev = qdev_new(name);
+qdev_prop_set_int32(dev, "addr", devfn);
+qdev_prop_set_bit(dev, "multifunction", multifunction);
+return PCI_DEVICE(dev);
+}
+
+PCIDevice *pci_new(int devfn, const char *name)
+{
+return pci_new_multifunction(devfn, false, name);
+}
+
+bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp)
+{
+return qdev_realize_and_unref(>qdev, >qbus, errp);
+}
+
 PCIDevice *pci_create_multifunction(PCIBus *bus, int devfn, bool multifunction,
 const char *name)
 {
-- 
2.26.2

[PULL 68/84] hw/arm/armsse: Pass correct child size to sysbus_init_child_obj()

[Markus Armbruster]

armsse_init() initializes s->armv7m[i] for all i.  It passes the size
of the entire array instead of the array element to
sysbus_init_child_obj().  Harmless, but fix it anyway.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-43-arm...@redhat.com>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index c903e725f7..f042145e6e 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -257,7 +257,8 @@ static void armsse_init(Object *obj)
 
 name = g_strdup_printf("armv7m%d", i);
 sysbus_init_child_obj(OBJECT(>cluster[i]), name,
-  >armv7m[i], sizeof(s->armv7m), TYPE_ARMV7M);
+  >armv7m[i], sizeof(s->armv7m[i]),
+  TYPE_ARMV7M);
 qdev_prop_set_string(DEVICE(>armv7m[i]), "cpu-type",
  ARM_CPU_TYPE_NAME("cortex-m33"));
 g_free(name);
-- 
2.26.2

[PULL 18/84] ppc/pnv: Put "*-pnv-chip" and "pnv-xive" on the main system bus

[Markus Armbruster]

pnv_init() creates "power10_v1.0-pnv-chip", "power8_v2.0-pnv-chip",
"power8e_v2.1-pnv-chip", "power8nvl_v1.0-pnv-chip", or
"power9_v2.0-pnv-chip" sysbus devices in a way that leaves them
unplugged.

pnv_chip_power9_instance_init() creates a "pnv-xive" sysbus device in
a way that leaves it unplugged.

Create them the common way that puts them into the main system bus.
Affects machines powernv8, powernv9, and powernv10.  Visible in "info
qtree".  Here's the change for powernv9:

 bus: main-system-bus
   type System
+  dev: power9_v2.0-pnv-chip, id ""
+chip-id = 0 (0x0)
+ram-start = 0 (0x0)
+ram-size = 1879048192 (0x7000)
+nr-cores = 1 (0x1)
+cores-mask = 72057594037927935 (0xff)
+nr-threads = 1 (0x1)
+num-phbs = 6 (0x6)
+mmio 000603fc/0004
[...]
+  dev: pnv-xive, id ""
+ic-bar = 1692157036462080 (0x603020310)
+vc-bar = 1689949371891712 (0x60100)
+pc-bar = 1690499127705600 (0x60180)
+tm-bar = 1692157036986368 (0x603020318)

Cc: "Cédric Le Goater" 
Cc: David Gibson 
Cc: qemu-...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: Cédric Le Goater 
Message-Id: <20200609122339.937862-17-arm...@redhat.com>
---
 hw/ppc/pnv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 806a5d9a8d..9d1a11adb7 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -818,7 +818,7 @@ static void pnv_init(MachineState *machine)
 pnv->chips = g_new0(PnvChip *, pnv->num_chips);
 for (i = 0; i < pnv->num_chips; i++) {
 char chip_name[32];
-Object *chip = object_new(chip_typename);
+Object *chip = OBJECT(qdev_create(NULL, chip_typename));
 
 pnv->chips[i] = PNV_CHIP(chip);
 
@@ -1317,8 +1317,8 @@ static void pnv_chip_power9_instance_init(Object *obj)
 PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
 int i;
 
-object_initialize_child(obj, "xive", >xive, sizeof(chip9->xive),
-TYPE_PNV_XIVE, _abort, NULL);
+sysbus_init_child_obj(obj, "xive", >xive, sizeof(chip9->xive),
+  TYPE_PNV_XIVE);
 object_property_add_alias(obj, "xive-fabric", OBJECT(>xive),
   "xive-fabric");
 
-- 
2.26.2

[PULL 23/84] sparc/leon3: Fix to put grlib,* devices on sysbus

[Markus Armbruster]

leon3_generic_hw_init() creates a "grlib,ahbpnp" and a "grlib,apbpnp"
sysbus device in a way that leaves them unplugged.

Create them the common way that puts them into the main system bus.
Affects machine leon3_generic.  Visible in "info qtree":

 bus: main-system-bus
   type System
+  dev: grlib,ahbpnp, id ""
+mmio f000/1000
+  dev: grlib,apbpnp, id ""
+mmio 800ff000/1000
   dev: grlib,irqmp, id ""

Cc: Fabien Chouteau 
Cc: KONRAD Frederic 
Cc: Mark Cave-Ayland 
Cc: Artyom Tarasenko 
Signed-off-by: Markus Armbruster 
Reviewed-by: KONRAD Frederic 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200609122339.937862-22-arm...@redhat.com>
Acked-by: Artyom Tarasenko 
---
 hw/sparc/leon3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index cc55117dec..d3ab8c9400 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -213,14 +213,14 @@ static void leon3_generic_hw_init(MachineState *machine)
 reset_info->sp= LEON3_RAM_OFFSET + ram_size;
 qemu_register_reset(main_cpu_reset, reset_info);
 
-ahb_pnp = GRLIB_AHB_PNP(object_new(TYPE_GRLIB_AHB_PNP));
+ahb_pnp = GRLIB_AHB_PNP(qdev_create(NULL, TYPE_GRLIB_AHB_PNP));
 object_property_set_bool(OBJECT(ahb_pnp), true, "realized", _fatal);
 sysbus_mmio_map(SYS_BUS_DEVICE(ahb_pnp), 0, LEON3_AHB_PNP_OFFSET);
 grlib_ahb_pnp_add_entry(ahb_pnp, 0, 0, GRLIB_VENDOR_GAISLER,
 GRLIB_LEON3_DEV, GRLIB_AHB_MASTER,
 GRLIB_CPU_AREA);
 
-apb_pnp = GRLIB_APB_PNP(object_new(TYPE_GRLIB_APB_PNP));
+apb_pnp = GRLIB_APB_PNP(qdev_create(NULL, TYPE_GRLIB_APB_PNP));
 object_property_set_bool(OBJECT(apb_pnp), true, "realized", _fatal);
 sysbus_mmio_map(SYS_BUS_DEVICE(apb_pnp), 0, LEON3_APB_PNP_OFFSET);
 grlib_ahb_pnp_add_entry(ahb_pnp, LEON3_APB_PNP_OFFSET, 0xFFF,
-- 
2.26.2

[PULL 58/84] auxbus: New aux_bus_realize(), pairing with aux_bus_init()

[Markus Armbruster]

aux_bus_init() encapsulates the creation of an aux-bus and its
aux-to-i2c-bridge device.

Create aux_bus_realize() to similarly encapsulate their realization.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-33-arm...@redhat.com>
---
 include/hw/misc/auxbus.h | 7 +++
 hw/display/xlnx_dp.c | 2 +-
 hw/misc/auxbus.c | 5 +
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/include/hw/misc/auxbus.h b/include/hw/misc/auxbus.h
index 5cfd7a9284..0d849d9d89 100644
--- a/include/hw/misc/auxbus.h
+++ b/include/hw/misc/auxbus.h
@@ -93,6 +93,13 @@ struct AUXSlave {
  */
 AUXBus *aux_bus_init(DeviceState *parent, const char *name);
 
+/**
+ * aux_bus_realize: Realize an AUX bus.
+ *
+ * @bus: The AUX bus.
+ */
+void aux_bus_realize(AUXBus *bus);
+
 /*
  * aux_request: Make a request on the bus.
  *
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 31d0c5a101..a714cf8a50 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1266,7 +1266,7 @@ static void xlnx_dp_realize(DeviceState *dev, Error 
**errp)
 DisplaySurface *surface;
 struct audsettings as;
 
-qdev_init_nofail(DEVICE(s->aux_bus->bridge));
+aux_bus_realize(s->aux_bus);
 
 qdev_init_nofail(DEVICE(s->dpcd));
 aux_map_slave(AUX_SLAVE(s->dpcd), 0x);
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index e93a35dd0a..75b6de1c63 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -81,6 +81,11 @@ AUXBus *aux_bus_init(DeviceState *parent, const char *name)
 return bus;
 }
 
+void aux_bus_realize(AUXBus *bus)
+{
+qdev_init_nofail(DEVICE(bus->bridge));
+}
+
 void aux_map_slave(AUXSlave *aux_dev, hwaddr addr)
 {
 DeviceState *dev = DEVICE(aux_dev);
-- 
2.26.2

[PULL 69/84] sysbus: Tidy up sysbus_init_child_obj()'s @childsize arg, part 2

[Markus Armbruster]

The callers of sysbus_init_child_obj() commonly pass either ,
sizeof(child), or pchild, sizeof(*pchild).  Tidy up the few that use
something else instead, mostly to keep future commits simpler.

Coccinelle script:

@@
expression parent, propname, type;
expression child;
type T;
T proxy;
@@
(
 sysbus_init_child_obj(parent, propname, , sizeof(child), type)
|
 sysbus_init_child_obj(parent, propname, child, sizeof(*child), type)
|
-sysbus_init_child_obj(parent, propname, child, sizeof(proxy), type)
+sysbus_init_child_obj(parent, propname, child, sizeof(*child), type)
)

This script is *unsound*: for each change we need to verify the
@childsize argument stays the same.  I did.

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-44-arm...@redhat.com>
---
 hw/arm/mps2-tz.c | 15 +++
 hw/arm/musca.c   |  7 +++
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index ad0bc9365a..90f4449b9d 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -193,7 +193,7 @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, 
void *opaque,
 SysBusDevice *s;
 DeviceState *orgate_dev = DEVICE(>uart_irq_orgate);
 
-sysbus_init_child_obj(OBJECT(mms), name, uart, sizeof(mms->uart[0]),
+sysbus_init_child_obj(OBJECT(mms), name, uart, sizeof(*uart),
   TYPE_CMSDK_APB_UART);
 qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
 qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
@@ -214,8 +214,8 @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void 
*opaque,
 DeviceState *sccdev;
 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 
-sysbus_init_child_obj(OBJECT(mms), "scc", scc,
-  sizeof(mms->scc), TYPE_MPS2_SCC);
+sysbus_init_child_obj(OBJECT(mms), "scc", scc, sizeof(*scc),
+  TYPE_MPS2_SCC);
 sccdev = DEVICE(scc);
 qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
 qdev_prop_set_uint32(sccdev, "scc-aid", 0x0028);
@@ -229,8 +229,8 @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, 
void *opaque,
 {
 MPS2FPGAIO *fpgaio = opaque;
 
-sysbus_init_child_obj(OBJECT(mms), "fpgaio", fpgaio,
-  sizeof(mms->fpgaio), TYPE_MPS2_FPGAIO);
+sysbus_init_child_obj(OBJECT(mms), "fpgaio", fpgaio, sizeof(*fpgaio),
+  TYPE_MPS2_FPGAIO);
 object_property_set_bool(OBJECT(fpgaio), true, "realized", _fatal);
 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
 }
@@ -267,7 +267,7 @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void 
*opaque,
 
 memory_region_init_ram(ssram, NULL, name, ramsize[i], _fatal);
 
-sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(mms->ssram_mpc[0]),
+sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(*mpc),
   TYPE_TZ_MPC);
 object_property_set_link(OBJECT(mpc), OBJECT(ssram),
  "downstream", _fatal);
@@ -363,8 +363,7 @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void 
*opaque,
 int i = spi - >spi[0];
 SysBusDevice *s;
 
-sysbus_init_child_obj(OBJECT(mms), name, spi, sizeof(mms->spi[0]),
-  TYPE_PL022);
+sysbus_init_child_obj(OBJECT(mms), name, spi, sizeof(*spi), TYPE_PL022);
 object_property_set_bool(OBJECT(spi), true, "realized", _fatal);
 s = SYS_BUS_DEVICE(spi);
 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 51 + i));
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index b7f1c4e128..a1a6e887ed 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -256,7 +256,7 @@ static MemoryRegion *make_mpc(MuscaMachineState *mms, void 
*opaque,
 g_assert_not_reached();
 }
 
-sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(mms->mpc[0]),
+sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(*mpc),
   TYPE_TZ_MPC);
 object_property_set_link(OBJECT(mpc), OBJECT(downstream),
  "downstream", _fatal);
@@ -279,7 +279,7 @@ static MemoryRegion *make_rtc(MuscaMachineState *mms, void 
*opaque,
 {
 PL031State *rtc = opaque;
 
-sysbus_init_child_obj(OBJECT(mms), name, rtc, sizeof(mms->rtc), 
TYPE_PL031);
+sysbus_init_child_obj(OBJECT(mms), name, rtc, sizeof(*rtc), TYPE_PL031);
 object_property_set_bool(OBJECT(rtc), true, "realized", _fatal);
 sysbus_connect_irq(SYS_BUS_DEVICE(rtc), 0, get_sse_irq_in(mms, 39));
 return sysbus_mmio_get_region(SYS_BUS_DEVICE(rtc), 0);
@@ -293,8 +293,7 @@ static MemoryRegion *make_uart(MuscaMachineState *mms, void 
*opaque,
 int irqbase = 7 + i * 6;
 SysBusDevice *s;
 
-sysbus_init_child_obj(OBJECT(mms), name, uart, sizeof(mms->uart[0]),
-  TYPE_PL011);
+sysbus_init_child_obj(OBJECT(mms), name, uart, 

[PULL 20/84] display/sm501 display/ati: Fix to realize "i2c-ddc"

[Markus Armbruster]

sm501_init() and ati_vga_realize() create an "i2c-ddc" device, but
neglect to realize it.  Affects machines sam460ex, shix, r2d, and
fulong2e.

In theory, a device becomes real only on realize.  In practice, the
transition from unreal to real is a fuzzy one.  The work to make a
device real can be spread between realize methods (fine),
instance_init methods (wrong), and board code wiring up the device
(fine as long as it effectively happens on realize).  Depending on
what exactly is done where, a device can work even when we neglect
to realize it.

This one appears to work.  Nevertheless, it's a clear misuse of the
interface.  Even when it works today (more or less by chance), it can
break tomorrow.

Fix by realizing it right away.  Visible in "info qom-tree"; here's
the change for sam460ex:

 /machine (sam460ex-machine)
   [...]
   /unattached (container)
 [...]
-/device[14] (sii3112)
+/device[14] (i2c-ddc)
+/device[15] (sii3112)
 [rest of device[*] renumbered...]

Fixes: 4a1f253adb45ac6019971193d5077c4d5d55886a
Fixes: c82c7336de58876862e6b4dccbda29e9240fd388
Cc: BALATON Zoltan 
Cc: qemu-...@nongnu.org
Cc: Magnus Damm 
Cc: Philippe Mathieu-Daudé 
Cc: Aleksandar Markovic 
Signed-off-by: Markus Armbruster 
Tested-by: BALATON Zoltan 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200609122339.937862-19-arm...@redhat.com>
---
 hw/display/ati.c   | 2 ++
 hw/display/sm501.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index 67604e68de..1d9df92b96 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -935,6 +935,8 @@ static void ati_vga_realize(PCIDevice *dev, Error **errp)
 bitbang_i2c_init(>bbi2c, i2cbus);
 I2CSlave *i2cddc = I2C_SLAVE(qdev_create(BUS(i2cbus), TYPE_I2CDDC));
 i2c_set_slave_address(i2cddc, 0x50);
+object_property_set_bool(OBJECT(i2cddc), true, "realized",
+ _abort);
 
 /* mmio register space */
 memory_region_init_io(>mm, OBJECT(s), _mm_ops, s,
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index edd8d24a76..fa23a78164 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1833,6 +1833,8 @@ static void sm501_init(SM501State *s, DeviceState *dev,
 /* ddc */
 I2CDDCState *ddc = I2CDDC(qdev_create(BUS(s->i2c_bus), TYPE_I2CDDC));
 i2c_set_slave_address(I2C_SLAVE(ddc), 0x50);
+object_property_set_bool(OBJECT(ddc), true, "realized",
+ _abort);
 
 /* mmio */
 memory_region_init(>mmio_region, OBJECT(dev), "sm501.mmio", MMIO_SIZE);
-- 
2.26.2

[PULL 40/84] hw/ppc: Eliminate two superfluous QOM casts

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-15-arm...@redhat.com>
Reviewed-by: Michael S. Tsirkin 
---
 hw/ppc/mac_newworld.c | 4 ++--
 hw/ppc/mac_oldworld.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 69281d7834..2d069dcc59 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -122,7 +122,7 @@ static void ppc_core99_init(MachineState *machine)
 long kernel_size, initrd_size;
 UNINHostState *uninorth_pci;
 PCIBus *pci_bus;
-NewWorldMacIOState *macio;
+PCIDevice *macio;
 bool has_pmu, has_adb;
 MACIOIDEState *macio_ide;
 BusState *adb_bus;
@@ -375,7 +375,7 @@ static void ppc_core99_init(MachineState *machine)
 pci_bus = PCI_HOST_BRIDGE(uninorth_pci)->bus;
 
 /* MacIO */
-macio = NEWWORLD_MACIO(pci_create(pci_bus, -1, TYPE_NEWWORLD_MACIO));
+macio = pci_create(pci_bus, -1, TYPE_NEWWORLD_MACIO);
 dev = DEVICE(macio);
 qdev_prop_set_uint64(dev, "frequency", tbfreq);
 qdev_prop_set_bit(dev, "has-pmu", has_pmu);
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index cfc2eae1d9..f73ec5f3a9 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -94,7 +94,7 @@ static void ppc_heathrow_init(MachineState *machine)
 uint32_t kernel_base, initrd_base, cmdline_base = 0;
 int32_t kernel_size, initrd_size;
 PCIBus *pci_bus;
-OldWorldMacIOState *macio;
+PCIDevice *macio;
 MACIOIDEState *macio_ide;
 SysBusDevice *s;
 DeviceState *dev, *pic_dev;
@@ -278,7 +278,7 @@ static void ppc_heathrow_init(MachineState *machine)
 ide_drive_get(hd, ARRAY_SIZE(hd));
 
 /* MacIO */
-macio = OLDWORLD_MACIO(pci_create(pci_bus, -1, TYPE_OLDWORLD_MACIO));
+macio = pci_create(pci_bus, -1, TYPE_OLDWORLD_MACIO);
 dev = DEVICE(macio);
 qdev_prop_set_uint64(dev, "frequency", tbfreq);
 object_property_set_link(OBJECT(macio), OBJECT(pic_dev), "pic",
-- 
2.26.2

[PULL 52/84] usb: New usb_new(), usb_realize_and_unref()

[Markus Armbruster]

I'm converting from qdev_create()/qdev_init_nofail() to
qdev_new()/qdev_realize_and_unref(); recent commit "qdev: New
qdev_new(), qdev_realize(), etc." explains why.

USB devices use qdev_create() through usb_create().

Provide usb_new() and usb_realize_and_unref() for converting USB
devices.

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Gerd Hoffmann 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-27-arm...@redhat.com>
---
 include/hw/usb.h |  2 ++
 hw/usb/bus.c | 10 ++
 2 files changed, 12 insertions(+)

diff --git a/include/hw/usb.h b/include/hw/usb.h
index e2128c7c45..1cc0ba0fed 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -504,6 +504,8 @@ USBBus *usb_bus_find(int busnr);
 void usb_legacy_register(const char *typename, const char *usbdevice_name,
  USBDevice *(*usbdevice_init)(USBBus *bus,
   const char *params));
+USBDevice *usb_new(const char *name);
+bool usb_realize_and_unref(USBDevice *dev, USBBus *bus, Error **errp);
 USBDevice *usb_create(USBBus *bus, const char *name);
 USBDevice *usb_create_simple(USBBus *bus, const char *name);
 USBDevice *usbdevice_create(const char *cmdline);
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index d28eff1b5c..6b0d9f9e4d 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -314,6 +314,16 @@ void usb_legacy_register(const char *typename, const char 
*usbdevice_name,
 }
 }
 
+USBDevice *usb_new(const char *name)
+{
+return USB_DEVICE(qdev_new(name));
+}
+
+bool usb_realize_and_unref(USBDevice *dev, USBBus *bus, Error **errp)
+{
+return qdev_realize_and_unref(>qdev, >qbus, errp);
+}
+
 USBDevice *usb_create(USBBus *bus, const char *name)
 {
 DeviceState *dev;
-- 
2.26.2

[PULL 32/84] qdev: Convert to qbus_realize(), qbus_unrealize()

[Markus Armbruster]

I'm going to convert device realization to qdev_realize() with the
help of Coccinelle.  Convert bus realization to qbus_realize() first,
to get it out of Coccinelle's way.  Readability improves.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-7-arm...@redhat.com>
---
 hw/core/qdev.c | 10 +++---
 hw/pci/pci.c   |  2 +-
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index f2c5cee278..b7355fbcd0 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -1024,9 +1024,7 @@ static void device_set_realized(Object *obj, bool value, 
Error **errp)
 resettable_state_clear(>reset);
 
 QLIST_FOREACH(bus, >child_bus, sibling) {
-object_property_set_bool(OBJECT(bus), true, "realized",
- _err);
-if (local_err != NULL) {
+if (!qbus_realize(bus, errp)) {
 goto child_realize_fail;
 }
 }
@@ -1051,8 +1049,7 @@ static void device_set_realized(Object *obj, bool value, 
Error **errp)
 
 } else if (!value && dev->realized) {
 QLIST_FOREACH(bus, >child_bus, sibling) {
-object_property_set_bool(OBJECT(bus), false, "realized",
- _abort);
+qbus_unrealize(bus);
 }
 if (qdev_get_vmsd(dev)) {
 vmstate_unregister(VMSTATE_IF(dev), qdev_get_vmsd(dev), dev);
@@ -1070,8 +1067,7 @@ static void device_set_realized(Object *obj, bool value, 
Error **errp)
 
 child_realize_fail:
 QLIST_FOREACH(bus, >child_bus, sibling) {
-object_property_set_bool(OBJECT(bus), false, "realized",
- _abort);
+qbus_unrealize(bus);
 }
 
 if (qdev_get_vmsd(dev)) {
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index a60cf3ae3b..955eb11a01 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -456,7 +456,7 @@ void pci_root_bus_cleanup(PCIBus *bus)
 {
 pci_bus_uninit(bus);
 /* the caller of the unplug hotplug handler will delete this device */
-object_property_set_bool(OBJECT(bus), false, "realized", _abort);
+qbus_unrealize(BUS(bus));
 }
 
 void pci_bus_irqs(PCIBus *bus, pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
-- 
2.26.2

[PULL 57/84] auxbus: Rename aux_init_bus() to aux_bus_init()

[Markus Armbruster]

Suggested-by: Philippe Mathieu-Daudé 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-32-arm...@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé 
---
 include/hw/misc/auxbus.h | 4 ++--
 hw/display/xlnx_dp.c | 2 +-
 hw/misc/auxbus.c | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/hw/misc/auxbus.h b/include/hw/misc/auxbus.h
index a539a98c4b..5cfd7a9284 100644
--- a/include/hw/misc/auxbus.h
+++ b/include/hw/misc/auxbus.h
@@ -84,14 +84,14 @@ struct AUXSlave {
 };
 
 /**
- * aux_init_bus: Initialize an AUX bus.
+ * aux_bus_init: Initialize an AUX bus.
  *
  * Returns the new AUX bus created.
  *
  * @parent The device where this bus is located.
  * @name The name of the bus.
  */
-AUXBus *aux_init_bus(DeviceState *parent, const char *name);
+AUXBus *aux_bus_init(DeviceState *parent, const char *name);
 
 /*
  * aux_request: Make a request on the bus.
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 6e9793584a..31d0c5a101 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1244,7 +1244,7 @@ static void xlnx_dp_init(Object *obj)
 /*
  * Initialize AUX Bus.
  */
-s->aux_bus = aux_init_bus(DEVICE(obj), "aux");
+s->aux_bus = aux_bus_init(DEVICE(obj), "aux");
 
 /*
  * Initialize DPCD and EDID..
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index c37d235b0e..e93a35dd0a 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -62,7 +62,7 @@ static void aux_bus_class_init(ObjectClass *klass, void *data)
 k->print_dev = aux_slave_dev_print;
 }
 
-AUXBus *aux_init_bus(DeviceState *parent, const char *name)
+AUXBus *aux_bus_init(DeviceState *parent, const char *name)
 {
 AUXBus *bus;
 Object *auxtoi2c;
@@ -225,7 +225,7 @@ static void aux_bridge_class_init(ObjectClass *oc, void 
*data)
 DeviceClass *dc = DEVICE_CLASS(oc);
 
 /* This device is private and is created only once for each
- * aux-bus in aux_init_bus(..). So don't allow the user to add one.
+ * aux-bus in aux_bus_init(..). So don't allow the user to add one.
  */
 dc->user_creatable = false;
 }
-- 
2.26.2

[PULL 03/84] arm/stm32f405: Fix realization of "stm32f2xx-adc" devices

[Markus Armbruster]

stm32f405_soc_initfn() creates six such devices, but
stm32f405_soc_realize() realizes only one.  Affects machine
netduinoplus2.

In theory, a device becomes real only on realize.  In practice, the
transition from unreal to real is a fuzzy one.  The work to make a
device real can be spread between realize methods (fine),
instance_init methods (wrong), and board code wiring up the device
(fine as long as it effectively happens on realize).  Depending on
what exactly is done where, a device can work even when we neglect
to realize it.

The five unrealized devices appear to stay unreal: neither MMIO nor
IRQ get wired up.

Fix stm32f405_soc_realize() to realize and wire up all six.  Visible
in "info qtree":

 bus: main-system-bus
   type System
   dev: stm32f405-soc, id ""
 cpu-type = "cortex-m4-arm-cpu"
   dev: stm32f2xx-adc, id ""
 gpio-out "sysbus-irq" 1
-mmio /00ff
+mmio 40012000/00ff
   dev: stm32f2xx-adc, id ""
 gpio-out "sysbus-irq" 1
-mmio /00ff
+mmio 40012100/00ff
   dev: stm32f2xx-adc, id ""
 gpio-out "sysbus-irq" 1
-mmio /00ff
+mmio 40012200/00ff
   dev: stm32f2xx-adc, id ""
 gpio-out "sysbus-irq" 1
-mmio /00ff
+mmio 40012300/00ff
   dev: stm32f2xx-adc, id ""
 gpio-out "sysbus-irq" 1
-mmio 40012000/00ff
+mmio 40012400/00ff
   dev: stm32f2xx-adc, id ""
 gpio-out "sysbus-irq" 1
-mmio /00ff
+mmio 40012500/00ff
   dev: armv7m, id ""

Fixes: 529fc5fd3e18ace8f739afd02dc0953354f39442
Cc: Alistair Francis 
Cc: Peter Maydell 
Cc: qemu-...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200609122339.937862-2-arm...@redhat.com>
Reviewed-by: Alistair Francis 
---
 hw/arm/stm32f405_soc.c | 23 +--
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
index 4f10ce6176..c9a530eecf 100644
--- a/hw/arm/stm32f405_soc.c
+++ b/hw/arm/stm32f405_soc.c
@@ -37,7 +37,8 @@ static const uint32_t usart_addr[] = { 0x40011000, 
0x40004400, 0x40004800,
 /* At the moment only Timer 2 to 5 are modelled */
 static const uint32_t timer_addr[] = { 0x4000, 0x4400,
0x4800, 0x4C00 };
-#define ADC_ADDR   0x40012000
+static const uint32_t adc_addr[] = { 0x40012000, 0x40012100, 0x40012200,
+ 0x40012300, 0x40012400, 0x40012500 };
 static const uint32_t spi_addr[] =   { 0x40013000, 0x40003800, 0x40003C00,
0x40013400, 0x40015000, 0x40015400 };
 #define EXTI_ADDR  0x40013C00
@@ -185,16 +186,18 @@ static void stm32f405_soc_realize(DeviceState *dev_soc, 
Error **errp)
 qdev_connect_gpio_out(DEVICE(>adc_irqs), 0,
   qdev_get_gpio_in(armv7m, ADC_IRQ));
 
-dev = DEVICE(&(s->adc[i]));
-object_property_set_bool(OBJECT(>adc[i]), true, "realized", );
-if (err != NULL) {
-error_propagate(errp, err);
-return;
+for (i = 0; i < STM_NUM_ADCS; i++) {
+dev = DEVICE(&(s->adc[i]));
+object_property_set_bool(OBJECT(>adc[i]), true, "realized", );
+if (err != NULL) {
+error_propagate(errp, err);
+return;
+}
+busdev = SYS_BUS_DEVICE(dev);
+sysbus_mmio_map(busdev, 0, adc_addr[i]);
+sysbus_connect_irq(busdev, 0,
+   qdev_get_gpio_in(DEVICE(>adc_irqs), i));
 }
-busdev = SYS_BUS_DEVICE(dev);
-sysbus_mmio_map(busdev, 0, ADC_ADDR);
-sysbus_connect_irq(busdev, 0,
-   qdev_get_gpio_in(DEVICE(>adc_irqs), i));
 
 /* SPI devices */
 for (i = 0; i < STM_NUM_SPIS; i++) {
-- 
2.26.2

[PULL 47/84] isa: isa_create(), isa_try_create() are now unused, drop

[Markus Armbruster]

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-22-arm...@redhat.com>
---
 include/hw/isa/isa.h |  2 --
 hw/isa/isa-bus.c | 16 
 2 files changed, 18 deletions(-)

diff --git a/include/hw/isa/isa.h b/include/hw/isa/isa.h
index 3b6215fafe..52b61eed88 100644
--- a/include/hw/isa/isa.h
+++ b/include/hw/isa/isa.h
@@ -103,8 +103,6 @@ void isa_bus_dma(ISABus *bus, IsaDma *dma8, IsaDma *dma16);
 IsaDma *isa_get_dma(ISABus *bus, int nchan);
 MemoryRegion *isa_address_space(ISADevice *dev);
 MemoryRegion *isa_address_space_io(ISADevice *dev);
-ISADevice *isa_create(ISABus *bus, const char *name);
-ISADevice *isa_try_create(ISABus *bus, const char *name);
 ISADevice *isa_new(const char *name);
 ISADevice *isa_try_new(const char *name);
 bool isa_realize_and_unref(ISADevice *dev, ISABus *bus, Error **errp);
diff --git a/hw/isa/isa-bus.c b/hw/isa/isa-bus.c
index 9a95ac3f96..630985604d 100644
--- a/hw/isa/isa-bus.c
+++ b/hw/isa/isa-bus.c
@@ -160,22 +160,6 @@ static void isa_device_init(Object *obj)
 dev->isairq[1] = -1;
 }
 
-ISADevice *isa_create(ISABus *bus, const char *name)
-{
-DeviceState *dev;
-
-dev = qdev_create(BUS(bus), name);
-return ISA_DEVICE(dev);
-}
-
-ISADevice *isa_try_create(ISABus *bus, const char *name)
-{
-DeviceState *dev;
-
-dev = qdev_try_create(BUS(bus), name);
-return ISA_DEVICE(dev);
-}
-
 ISADevice *isa_new(const char *name)
 {
 return ISA_DEVICE(qdev_new(name));
-- 
2.26.2

[PULL 53/84] usb: Convert uses of usb_create()

[Markus Armbruster]

Replace

dev = usb_create(bus, type_name);
...
object_property_set_bool(OBJECT(dev), true, "realized", );

by

dev = isa_new(type_name);
...
usb_realize_and_unref(dev, bus, );

Recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains
why.

Cc: Gerd Hoffmann 
Signed-off-by: Markus Armbruster 
Reviewed-by: Gerd Hoffmann 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-28-arm...@redhat.com>
---
 include/hw/usb.h|  3 +--
 hw/usb/bus.c| 11 +--
 hw/usb/dev-serial.c |  4 ++--
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/include/hw/usb.h b/include/hw/usb.h
index 1cc0ba0fed..dce16c792b 100644
--- a/include/hw/usb.h
+++ b/include/hw/usb.h
@@ -502,8 +502,7 @@ void usb_bus_new(USBBus *bus, size_t bus_size,
 void usb_bus_release(USBBus *bus);
 USBBus *usb_bus_find(int busnr);
 void usb_legacy_register(const char *typename, const char *usbdevice_name,
- USBDevice *(*usbdevice_init)(USBBus *bus,
-  const char *params));
+ USBDevice *(*usbdevice_init)(const char *params));
 USBDevice *usb_new(const char *name);
 bool usb_realize_and_unref(USBDevice *dev, USBBus *bus, Error **errp);
 USBDevice *usb_create(USBBus *bus, const char *name);
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index 6b0d9f9e4d..da85b8b005 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -296,14 +296,13 @@ typedef struct LegacyUSBFactory
 {
 const char *name;
 const char *usbdevice_name;
-USBDevice *(*usbdevice_init)(USBBus *bus, const char *params);
+USBDevice *(*usbdevice_init)(const char *params);
 } LegacyUSBFactory;
 
 static GSList *legacy_usb_factory;
 
 void usb_legacy_register(const char *typename, const char *usbdevice_name,
- USBDevice *(*usbdevice_init)(USBBus *bus,
-  const char *params))
+ USBDevice *(*usbdevice_init)(const char *params))
 {
 if (usbdevice_name) {
 LegacyUSBFactory *f = g_malloc0(sizeof(*f));
@@ -710,19 +709,19 @@ USBDevice *usbdevice_create(const char *cmdline)
 }
 
 if (f->usbdevice_init) {
-dev = f->usbdevice_init(bus, params);
+dev = f->usbdevice_init(params);
 } else {
 if (*params) {
 error_report("usbdevice %s accepts no params", driver);
 return NULL;
 }
-dev = usb_create(bus, f->name);
+dev = usb_new(f->name);
 }
 if (!dev) {
 error_report("Failed to create USB device '%s'", f->name);
 return NULL;
 }
-object_property_set_bool(OBJECT(dev), true, "realized", );
+usb_realize_and_unref(dev, bus, );
 if (err) {
 error_reportf_err(err, "Failed to initialize USB device '%s': ",
   f->name);
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index d2c03681b7..7e50e3ba47 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -542,7 +542,7 @@ static void usb_serial_realize(USBDevice *dev, Error **errp)
 s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
 }
 
-static USBDevice *usb_braille_init(USBBus *bus, const char *unused)
+static USBDevice *usb_braille_init(const char *unused)
 {
 USBDevice *dev;
 Chardev *cdrv;
@@ -551,7 +551,7 @@ static USBDevice *usb_braille_init(USBBus *bus, const char 
*unused)
 if (!cdrv)
 return NULL;
 
-dev = usb_create(bus, "usb-braille");
+dev = usb_new("usb-braille");
 qdev_prop_set_chr(>qdev, "chardev", cdrv);
 return dev;
 }
-- 
2.26.2

[PULL 51/84] ssi: ssi_create_slave_no_init() is now unused, drop

[Markus Armbruster]

Cc: Alistair Francis 
Signed-off-by: Markus Armbruster 
Reviewed-by: Alistair Francis 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-26-arm...@redhat.com>
---
 include/hw/ssi/ssi.h | 1 -
 hw/ssi/ssi.c | 5 -
 2 files changed, 6 deletions(-)

diff --git a/include/hw/ssi/ssi.h b/include/hw/ssi/ssi.h
index 1725b13c32..93f2b8b0be 100644
--- a/include/hw/ssi/ssi.h
+++ b/include/hw/ssi/ssi.h
@@ -79,7 +79,6 @@ extern const VMStateDescription vmstate_ssi_slave;
 }
 
 DeviceState *ssi_create_slave(SSIBus *bus, const char *name);
-DeviceState *ssi_create_slave_no_init(SSIBus *bus, const char *name);
 
 /* Master interface.  */
 SSIBus *ssi_create_bus(DeviceState *parent, const char *name);
diff --git a/hw/ssi/ssi.c b/hw/ssi/ssi.c
index 58e7d904db..67b48c31cd 100644
--- a/hw/ssi/ssi.c
+++ b/hw/ssi/ssi.c
@@ -90,11 +90,6 @@ static const TypeInfo ssi_slave_info = {
 .abstract = true,
 };
 
-DeviceState *ssi_create_slave_no_init(SSIBus *bus, const char *name)
-{
-return qdev_create(BUS(bus), name);
-}
-
 DeviceState *ssi_create_slave(SSIBus *bus, const char *name)
 {
 DeviceState *dev = qdev_new(name);
-- 
2.26.2

[PULL 31/84] qdev: Put qdev_new() to use with Coccinelle

[Markus Armbruster]

Let's start simple and put qdev_new() to use.  Coccinelle script:

@ depends on !(file in "hw/core/qdev.c")@
expression type_name;
@@
-DEVICE(object_new(type_name))
+qdev_new(type_name)

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-6-arm...@redhat.com>
---
 hw/block/nand.c  | 2 +-
 hw/misc/auxbus.c | 2 +-
 qdev-monitor.c   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/block/nand.c b/hw/block/nand.c
index bba89688ba..cdf3429ce6 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -644,7 +644,7 @@ DeviceState *nand_init(BlockBackend *blk, int manf_id, int 
chip_id)
 if (nand_flash_ids[chip_id].size == 0) {
 hw_error("%s: Unsupported NAND chip ID.\n", __func__);
 }
-dev = DEVICE(object_new(TYPE_NAND));
+dev = qdev_new(TYPE_NAND);
 qdev_prop_set_uint8(dev, "manufacturer_id", manf_id);
 qdev_prop_set_uint8(dev, "chip_id", chip_id);
 if (blk) {
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index 80bc3a0777..c37d235b0e 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -273,7 +273,7 @@ DeviceState *aux_create_slave(AUXBus *bus, const char *type)
 {
 DeviceState *dev;
 
-dev = DEVICE(object_new(type));
+dev = qdev_new(type);
 assert(dev);
 qdev_set_parent_bus(dev, >qbus);
 return dev;
diff --git a/qdev-monitor.c b/qdev-monitor.c
index a4735d3bb1..20cfa7615b 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -652,7 +652,7 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
 }
 
 /* create device */
-dev = DEVICE(object_new(driver));
+dev = qdev_new(driver);
 
 /* Check whether the hotplug is allowed by the machine */
 if (qdev_hotplug && !qdev_hotplug_allowed(dev, )) {
-- 
2.26.2

[PULL 37/84] qdev: Convert uses of qdev_set_parent_bus() with Coccinelle

[Markus Armbruster]

In addition to the qdev_create() patterns converted so far, we have a
qdev_set_parent_bus() pattern.  Mostly when we embed a device in a
parent device rather than allocating it on the heap.

This pattern also puts devices in the dangerous "no QOM parent, but
plugged into bus" state I explained in recent commit "qdev: New
qdev_new(), qdev_realize(), etc."

Apply same solution: convert to qdev_realize().  Coccinelle script:

@@
expression dev, bus, errp;
symbol true;
@@
-qdev_set_parent_bus(DEVICE(dev), bus);
 ...
-object_property_set_bool(OBJECT(dev), true, "realized", errp);
+qdev_realize(DEVICE(dev), bus, errp);

@ depends on !(file in "qdev-monitor.c") && !(file in "hw/core/qdev.c")@
expression dev, bus, errp;
symbol true;
@@
-qdev_set_parent_bus(dev, bus);
 ...
-object_property_set_bool(OBJECT(dev), true, "realized", errp);
+qdev_realize(dev, bus, errp);

@@
expression dev, bus;
symbol true;
@@
-qdev_set_parent_bus(DEVICE(dev), bus);
 ...
-qdev_init_nofail(DEVICE(dev));
+qdev_realize(DEVICE(dev), bus, _fatal);

Unconverted uses of qdev_set_parent_bus() remain.  They'll be
converted later in this series.

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-12-arm...@redhat.com>
[Also convert new hw/virtio/vhost-user-vsock-pci.c]
---
 hw/display/virtio-gpu-pci.c  | 3 +--
 hw/display/virtio-vga.c  | 3 +--
 hw/i386/amd_iommu.c  | 3 +--
 hw/isa/piix4.c   | 3 +--
 hw/misc/macio/macio.c| 7 ++-
 hw/pci-host/designware.c | 3 +--
 hw/pci-host/gpex.c   | 3 +--
 hw/pci-host/pnv_phb3.c   | 3 +--
 hw/pci-host/pnv_phb4.c   | 3 +--
 hw/pci-host/q35.c| 3 +--
 hw/pci-host/versatile.c  | 3 +--
 hw/pci-host/xilinx-pcie.c| 3 +--
 hw/s390x/vhost-vsock-ccw.c   | 3 +--
 hw/s390x/virtio-ccw-9p.c | 3 +--
 hw/s390x/virtio-ccw-balloon.c| 3 +--
 hw/s390x/virtio-ccw-blk.c| 3 +--
 hw/s390x/virtio-ccw-crypto.c | 3 +--
 hw/s390x/virtio-ccw-gpu.c| 3 +--
 hw/s390x/virtio-ccw-input.c  | 3 +--
 hw/s390x/virtio-ccw-net.c| 3 +--
 hw/s390x/virtio-ccw-rng.c| 3 +--
 hw/s390x/virtio-ccw-scsi.c   | 6 ++
 hw/s390x/virtio-ccw-serial.c | 3 +--
 hw/virtio/vhost-scsi-pci.c   | 3 +--
 hw/virtio/vhost-user-blk-pci.c   | 3 +--
 hw/virtio/vhost-user-fs-pci.c| 3 +--
 hw/virtio/vhost-user-scsi-pci.c  | 3 +--
 hw/virtio/vhost-user-vsock-pci.c | 3 +--
 hw/virtio/vhost-vsock-pci.c  | 3 +--
 hw/virtio/virtio-9p-pci.c| 3 +--
 hw/virtio/virtio-balloon-pci.c   | 3 +--
 hw/virtio/virtio-blk-pci.c   | 3 +--
 hw/virtio/virtio-crypto-pci.c| 3 +--
 hw/virtio/virtio-input-pci.c | 3 +--
 hw/virtio/virtio-iommu-pci.c | 3 +--
 hw/virtio/virtio-net-pci.c   | 3 +--
 hw/virtio/virtio-pmem-pci.c  | 3 +--
 hw/virtio/virtio-rng-pci.c   | 3 +--
 hw/virtio/virtio-scsi-pci.c  | 3 +--
 hw/virtio/virtio-serial-pci.c| 3 +--
 hw/xen/xen-legacy-backend.c  | 3 +--
 41 files changed, 43 insertions(+), 87 deletions(-)

diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
index 3d152ff5c8..b532fe8b5f 100644
--- a/hw/display/virtio-gpu-pci.c
+++ b/hw/display/virtio-gpu-pci.c
@@ -33,9 +33,8 @@ static void virtio_gpu_pci_base_realize(VirtIOPCIProxy 
*vpci_dev, Error **errp)
 int i;
 Error *local_error = NULL;
 
-qdev_set_parent_bus(vdev, BUS(_dev->bus));
 virtio_pci_force_virtio_1(vpci_dev);
-object_property_set_bool(OBJECT(vdev), true, "realized", _error);
+qdev_realize(vdev, BUS(_dev->bus), _error);
 
 if (local_error) {
 error_propagate(errp, local_error);
diff --git a/hw/display/virtio-vga.c b/hw/display/virtio-vga.c
index 95757a6619..68a062ece6 100644
--- a/hw/display/virtio-vga.c
+++ b/hw/display/virtio-vga.c
@@ -137,9 +137,8 @@ static void virtio_vga_base_realize(VirtIOPCIProxy 
*vpci_dev, Error **errp)
 vpci_dev->common.offset = offset;
 
 /* init virtio bits */
-qdev_set_parent_bus(DEVICE(g), BUS(_dev->bus));
 virtio_pci_force_virtio_1(vpci_dev);
-object_property_set_bool(OBJECT(g), true, "realized", );
+qdev_realize(DEVICE(g), BUS(_dev->bus), );
 if (err) {
 error_propagate(errp, err);
 return;
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 4346060e62..b26d30da57 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1549,8 +1549,7 @@ static void amdvi_realize(DeviceState *dev, Error **errp)
 
 /* This device should take care of IOMMU PCI properties */
 x86_iommu->type = TYPE_AMD;
-qdev_set_parent_bus(DEVICE(>pci), >qbus);
-object_property_set_bool(OBJECT(>pci), true, "realized", errp);
+qdev_realize(DEVICE(>pci), >qbus, errp);
 ret = pci_add_capability(>pci.dev, 

[PULL 01/84] qom: Constify object_get_canonical_path{, _component}()'s parameter

[Markus Armbruster]

Suggested-by: Eric Blake 
Signed-off-by: Markus Armbruster 
Message-Id: <20200527084754.7531-2-arm...@redhat.com>
Reviewed-by: Cédric Le Goater 
Reviewed-by: Philippe Mathieu-Daudé 
---
 include/qom/object.h | 4 ++--
 qom/object.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index c7c97ead60..43858162ad 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -1404,7 +1404,7 @@ Object *object_get_internal_root(void);
  * path is the path within the composition tree starting from the root.
  * %NULL if the object doesn't have a parent (and thus a canonical path).
  */
-char *object_get_canonical_path_component(Object *obj);
+char *object_get_canonical_path_component(const Object *obj);
 
 /**
  * object_get_canonical_path:
@@ -1412,7 +1412,7 @@ char *object_get_canonical_path_component(Object *obj);
  * Returns: The canonical path for a object.  This is the path within the
  * composition tree starting from the root.
  */
-char *object_get_canonical_path(Object *obj);
+char *object_get_canonical_path(const Object *obj);
 
 /**
  * object_resolve_path:
diff --git a/qom/object.c b/qom/object.c
index b0ed560fd8..d1340ba3d9 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1881,7 +1881,7 @@ object_property_add_const_link(Object *obj, const char 
*name,
 NULL, OBJ_PROP_LINK_DIRECT);
 }
 
-char *object_get_canonical_path_component(Object *obj)
+char *object_get_canonical_path_component(const Object *obj)
 {
 ObjectProperty *prop = NULL;
 GHashTableIter iter;
@@ -1906,7 +1906,7 @@ char *object_get_canonical_path_component(Object *obj)
 return NULL;
 }
 
-char *object_get_canonical_path(Object *obj)
+char *object_get_canonical_path(const Object *obj)
 {
 Object *root = object_get_root();
 char *newpath, *path = NULL;
-- 
2.26.2

[PULL 36/84] qdev: Convert uses of qdev_create() manually

[Markus Armbruster]

Same transformation as in the previous commit.  Manual, because
convincing Coccinelle to transform these cases is somewhere between
not worthwhile and infeasible (at least for me).

Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-11-arm...@redhat.com>
---
 hw/arm/highbank.c   | 26 +-
 hw/arm/sbsa-ref.c   |  4 ++--
 hw/arm/virt.c   |  4 ++--
 hw/block/xen-block.c|  4 ++--
 hw/char/serial.c|  4 ++--
 hw/display/ati.c|  5 ++---
 hw/display/sm501.c  |  5 ++---
 hw/display/xlnx_dp.c|  5 +++--
 hw/i386/pc.c|  4 ++--
 hw/i386/pc_sysfw.c  |  4 ++--
 hw/pci-bridge/pci_expander_bridge.c |  4 ++--
 hw/ppc/pnv.c|  4 ++--
 hw/riscv/virt.c |  4 ++--
 hw/s390x/s390-pci-bus.c |  4 ++--
 hw/sparc/leon3.c|  8 
 hw/usb/bus.c|  8 
 16 files changed, 48 insertions(+), 49 deletions(-)

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index ac9de9411e..1bed540011 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -311,20 +311,20 @@ static void calxeda_init(MachineState *machine, enum 
cxmachines machine_id)
 
 switch (machine_id) {
 case CALXEDA_HIGHBANK:
-dev = qdev_create(NULL, "l2x0");
-qdev_init_nofail(dev);
+dev = qdev_new("l2x0");
+qdev_realize_and_unref(dev, NULL, _fatal);
 busdev = SYS_BUS_DEVICE(dev);
 sysbus_mmio_map(busdev, 0, 0xfff12000);
 
-dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
+dev = qdev_new(TYPE_A9MPCORE_PRIV);
 break;
 case CALXEDA_MIDWAY:
-dev = qdev_create(NULL, TYPE_A15MPCORE_PRIV);
+dev = qdev_new(TYPE_A15MPCORE_PRIV);
 break;
 }
 qdev_prop_set_uint32(dev, "num-cpu", smp_cpus);
 qdev_prop_set_uint32(dev, "num-irq", NIRQ_GIC);
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, NULL, _fatal);
 busdev = SYS_BUS_DEVICE(dev);
 sysbus_mmio_map(busdev, 0, MPCORE_PERIPHBASE);
 for (n = 0; n < smp_cpus; n++) {
@@ -338,17 +338,17 @@ static void calxeda_init(MachineState *machine, enum 
cxmachines machine_id)
 pic[n] = qdev_get_gpio_in(dev, n);
 }
 
-dev = qdev_create(NULL, "sp804");
+dev = qdev_new("sp804");
 qdev_prop_set_uint32(dev, "freq0", 15000);
 qdev_prop_set_uint32(dev, "freq1", 15000);
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, NULL, _fatal);
 busdev = SYS_BUS_DEVICE(dev);
 sysbus_mmio_map(busdev, 0, 0xfff34000);
 sysbus_connect_irq(busdev, 0, pic[18]);
 pl011_create(0xfff36000, pic[20], serial_hd(0));
 
-dev = qdev_create(NULL, TYPE_HIGHBANK_REGISTERS);
-qdev_init_nofail(dev);
+dev = qdev_new(TYPE_HIGHBANK_REGISTERS);
+qdev_realize_and_unref(dev, NULL, _fatal);
 busdev = SYS_BUS_DEVICE(dev);
 sysbus_mmio_map(busdev, 0, 0xfff3c000);
 
@@ -363,18 +363,18 @@ static void calxeda_init(MachineState *machine, enum 
cxmachines machine_id)
 
 if (nd_table[0].used) {
 qemu_check_nic_model(_table[0], "xgmac");
-dev = qdev_create(NULL, "xgmac");
+dev = qdev_new("xgmac");
 qdev_set_nic_properties(dev, _table[0]);
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, NULL, _fatal);
 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xfff5);
 sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[77]);
 sysbus_connect_irq(SYS_BUS_DEVICE(dev), 1, pic[78]);
 sysbus_connect_irq(SYS_BUS_DEVICE(dev), 2, pic[79]);
 
 qemu_check_nic_model(_table[1], "xgmac");
-dev = qdev_create(NULL, "xgmac");
+dev = qdev_new("xgmac");
 qdev_set_nic_properties(dev, _table[1]);
-qdev_init_nofail(dev);
+qdev_realize_and_unref(dev, NULL, _fatal);
 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xfff51000);
 sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[80]);
 sysbus_connect_irq(SYS_BUS_DEVICE(dev), 1, pic[81]);
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index d68c5d87af..fe24567333 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -211,7 +211,7 @@ static PFlashCFI01 *sbsa_flash_create1(SBSAMachineState 
*sms,
  * Create a single flash device.  We use the same parameters as
  * the flash devices on the Versatile Express board.
  */
-DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI01);
+DeviceState *dev = qdev_new(TYPE_PFLASH_CFI01);
 
 qdev_prop_set_uint64(dev, "sector-length", SBSA_FLASH_SECTOR_SIZE);
 qdev_prop_set_uint8(dev, "width", 4);
@@ -243,7 +243,7 @@ static void sbsa_flash_map1(PFlashCFI01 *flash,
 assert(QEMU_IS_ALIGNED(size, SBSA_FLASH_SECTOR_SIZE));
 assert(size / SBSA_FLASH_SECTOR_SIZE <= UINT32_MAX);
 qdev_prop_set_uint32(dev, 

[PULL 42/84] pci: Convert uses of pci_create() etc. manually

[Markus Armbruster]

Same transformation as in the previous commit.  Manual, because
convincing Coccinelle to transform these cases is not worthwhile.

Cc: Michael S. Tsirkin 
Cc: Marcel Apfelbaum 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-17-arm...@redhat.com>
Reviewed-by: Michael S. Tsirkin 
---
 hw/sparc64/sun4u.c | 12 
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 6f29a013ca..0b898d6e3d 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -635,24 +635,28 @@ static void sun4uv_init(MemoryRegion *address_space_mem,
 memset(, 0, sizeof(MACAddr));
 onboard_nic = false;
 for (i = 0; i < nb_nics; i++) {
+PCIBus *bus;
 nd = _table[i];
 
 if (!nd->model || strcmp(nd->model, "sunhme") == 0) {
 if (!onboard_nic) {
-pci_dev = pci_create_multifunction(pci_busA, PCI_DEVFN(1, 1),
+pci_dev = pci_new_multifunction(PCI_DEVFN(1, 1),
true, "sunhme");
+bus = pci_busA;
 memcpy(, >macaddr.a, sizeof(MACAddr));
 onboard_nic = true;
 } else {
-pci_dev = pci_create(pci_busB, -1, "sunhme");
+pci_dev = pci_new(-1, "sunhme");
+bus = pci_busB;
 }
 } else {
-pci_dev = pci_create(pci_busB, -1, nd->model);
+pci_dev = pci_new(-1, nd->model);
+bus = pci_busB;
 }
 
 dev = _dev->qdev;
 qdev_set_nic_properties(dev, nd);
-qdev_init_nofail(dev);
+pci_realize_and_unref(pci_dev, bus, _fatal);
 }
 
 /* If we don't have an onboard NIC, grab a default MAC address so that
-- 
2.26.2

[PULL 17/84] macio: Fix macio-bus to be a subtype of System bus

[Markus Armbruster]

The devices we plug into the macio-bus are all sysbus devices
(DeviceClass member bus_type is TYPE_SYSTEM_BUS), but macio-bus does
not derive from TYPE_SYSTEM_BUS.  Fix that.

"info qtree" now shows the devices' mmio ranges, as it should

Cc: Mark Cave-Ayland 
Cc: David Gibson 
Cc: qemu-...@nongnu.org
Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Message-Id: <20200609122339.937862-16-arm...@redhat.com>
---
 hw/misc/macio/macio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/macio/macio.c b/hw/misc/macio/macio.c
index ebc96cc8f6..53a9fd5696 100644
--- a/hw/misc/macio/macio.c
+++ b/hw/misc/macio/macio.c
@@ -492,7 +492,7 @@ static void macio_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo macio_bus_info = {
 .name = TYPE_MACIO_BUS,
-.parent = TYPE_BUS,
+.parent = TYPE_SYSTEM_BUS,
 .instance_size = sizeof(MacIOBusState),
 };
 
-- 
2.26.2

[PULL 41/84] pci: Convert uses of pci_create() etc. with Coccinelle

[Markus Armbruster]

Replace

dev = pci_create(bus, type_name);
...
qdev_init_nofail(dev);

by

dev = pci_new(type_name);
...
pci_realize_and_unref(dev, bus, _fatal);

and similarly for pci_create_multifunction().

Recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains
why.

Coccinelle script:

@@
expression dev, bus, expr;
expression list args;
@@
-dev = pci_create(bus, args);
+dev = pci_new(args);
 ... when != dev = expr
-qdev_init_nofail(>qdev);
+pci_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
expression d;
@@
-dev = pci_create(bus, args);
+dev = pci_new(args);
(
 d = >qdev;
|
 d = DEVICE(dev);
)
 ... when != dev = expr
-qdev_init_nofail(d);
+pci_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = pci_create(bus, args);
+dev = pci_new(args);
 ... when != dev = expr
-qdev_init_nofail(DEVICE(dev));
+pci_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = DEVICE(pci_create(bus, args));
+PCIDevice *pci_dev; // TODO move
+pci_dev = pci_new(args);
+dev = DEVICE(pci_dev);
 ... when != dev = expr
-qdev_init_nofail(dev);
+pci_realize_and_unref(pci_dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = pci_create_multifunction(bus, args);
+dev = pci_new_multifunction(args);
 ... when != dev = expr
-qdev_init_nofail(>qdev);
+pci_realize_and_unref(dev, bus, _fatal);

@@
expression bus, expr;
expression list args;
identifier dev;
@@
-PCIDevice *dev = pci_create_multifunction(bus, args);
+PCIDevice *dev = pci_new_multifunction(args);
 ... when != dev = expr
-qdev_init_nofail(>qdev);
+pci_realize_and_unref(dev, bus, _fatal);

@@
expression dev, bus, expr;
expression list args;
@@
-dev = pci_create_multifunction(bus, args);
+dev = pci_new_multifunction(args);
 ... when != dev = expr
-qdev_init_nofail(DEVICE(dev));
+pci_realize_and_unref(dev, bus, _fatal);

Missing #include "qapi/error.h" added manually, whitespace changes
minimized manually, @pci_dev declarations moved manually.

Cc: Michael S. Tsirkin 
Cc: Marcel Apfelbaum 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-16-arm...@redhat.com>
Reviewed-by: Michael S. Tsirkin 
---
 hw/acpi/piix4.c   |  6 --
 hw/i386/pc_q35.c  | 10 +-
 hw/isa/vt82c686.c | 13 +++--
 hw/mips/fuloong2e.c   |  6 --
 hw/pci-bridge/dec.c   |  6 +++---
 hw/pci-host/bonito.c  |  4 ++--
 hw/pci-host/sabre.c   | 13 +++--
 hw/pci/pci.c  |  8 
 hw/ppc/mac_newworld.c |  4 ++--
 hw/ppc/mac_oldworld.c |  4 ++--
 hw/sparc64/sun4u.c|  8 
 11 files changed, 44 insertions(+), 38 deletions(-)

diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
index e27f57195a..1262abc77a 100644
--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
@@ -514,10 +514,12 @@ I2CBus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t 
smb_io_base,
   qemu_irq sci_irq, qemu_irq smi_irq,
   int smm_enabled, DeviceState **piix4_pm)
 {
+PCIDevice *pci_dev;
 DeviceState *dev;
 PIIX4PMState *s;
 
-dev = DEVICE(pci_create(bus, devfn, TYPE_PIIX4_PM));
+pci_dev = pci_new(devfn, TYPE_PIIX4_PM);
+dev = DEVICE(pci_dev);
 qdev_prop_set_uint32(dev, "smb_io_base", smb_io_base);
 if (piix4_pm) {
 *piix4_pm = dev;
@@ -531,7 +533,7 @@ I2CBus *piix4_pm_init(PCIBus *bus, int devfn, uint32_t 
smb_io_base,
 s->use_acpi_pci_hotplug = false;
 }
 
-qdev_init_nofail(dev);
+pci_realize_and_unref(pci_dev, bus, _fatal);
 
 return s->smb.smbus;
 }
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 59307d91e2..a6b6add2ef 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -100,16 +100,16 @@ static int ehci_create_ich9_with_companions(PCIBus *bus, 
int slot)
 return -1;
 }
 
-ehci = pci_create_multifunction(bus, PCI_DEVFN(slot, 7), true, name);
-qdev_init_nofail(>qdev);
+ehci = pci_new_multifunction(PCI_DEVFN(slot, 7), true, name);
+pci_realize_and_unref(ehci, bus, _fatal);
 usbbus = QLIST_FIRST(>qdev.child_bus);
 
 for (i = 0; i < 3; i++) {
-uhci = pci_create_multifunction(bus, PCI_DEVFN(slot, comp[i].func),
-true, comp[i].name);
+uhci = pci_new_multifunction(PCI_DEVFN(slot, comp[i].func), true,
+ comp[i].name);
 qdev_prop_set_string(>qdev, "masterbus", usbbus->name);
 

[PULL 33/84] qdev: Convert to qdev_unrealize() with Coccinelle

[Markus Armbruster]

For readability, and consistency with qbus_realize().

Coccinelle script:

@ depends on !(file in "hw/core/qdev.c")@
typedef DeviceState;
DeviceState *dev;
symbol false, error_abort;
@@
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);

@ depends on !(file in "hw/core/qdev.c") && !(file in "hw/core/bus.c")@
expression dev;
symbol false, error_abort;
@@
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(DEVICE(dev));

Signed-off-by: Markus Armbruster 
Reviewed-by: Philippe Mathieu-Daudé 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-8-arm...@redhat.com>
---
 hw/acpi/pcihp.c| 2 +-
 hw/char/serial-pci-multi.c | 2 +-
 hw/char/serial-pci.c   | 2 +-
 hw/core/bus.c  | 3 +--
 hw/i386/pc.c   | 4 ++--
 hw/pci/pcie.c  | 2 +-
 hw/pci/shpc.c  | 2 +-
 hw/ppc/spapr.c | 8 
 hw/ppc/spapr_pci.c | 3 +--
 hw/s390x/css-bridge.c  | 2 +-
 hw/s390x/s390-pci-bus.c| 4 ++--
 11 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
index d42906ea19..33ea2b76ae 100644
--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
@@ -266,7 +266,7 @@ void acpi_pcihp_device_unplug_cb(HotplugHandler 
*hotplug_dev, AcpiPciHpState *s,
 {
 trace_acpi_pci_unplug(PCI_SLOT(PCI_DEVICE(dev)->devfn),
   acpi_pcihp_get_bsel(pci_get_bus(PCI_DEVICE(dev;
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);
 }
 
 void acpi_pcihp_device_unplug_request_cb(HotplugHandler *hotplug_dev,
diff --git a/hw/char/serial-pci-multi.c b/hw/char/serial-pci-multi.c
index 5f9ccfcc93..23d0ebe2cd 100644
--- a/hw/char/serial-pci-multi.c
+++ b/hw/char/serial-pci-multi.c
@@ -56,7 +56,7 @@ static void multi_serial_pci_exit(PCIDevice *dev)
 
 for (i = 0; i < pci->ports; i++) {
 s = pci->state + i;
-object_property_set_bool(OBJECT(s), false, "realized", _abort);
+qdev_unrealize(DEVICE(s));
 memory_region_del_subregion(>iobar, >io);
 g_free(pci->name[i]);
 }
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index 37818db156..65eacfae0e 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -68,7 +68,7 @@ static void serial_pci_exit(PCIDevice *dev)
 PCISerialState *pci = DO_UPCAST(PCISerialState, dev, dev);
 SerialState *s = >state;
 
-object_property_set_bool(OBJECT(s), false, "realized", _abort);
+qdev_unrealize(DEVICE(s));
 qemu_free_irq(s->irq);
 }
 
diff --git a/hw/core/bus.c b/hw/core/bus.c
index 6f6071f5fa..6cc28b334e 100644
--- a/hw/core/bus.c
+++ b/hw/core/bus.c
@@ -200,8 +200,7 @@ static void bus_set_realized(Object *obj, bool value, Error 
**errp)
 } else if (!value && bus->realized) {
 QTAILQ_FOREACH(kid, >children, sibling) {
 DeviceState *dev = kid->child;
-object_property_set_bool(OBJECT(dev), false, "realized",
- _abort);
+qdev_unrealize(dev);
 }
 if (bc->unrealize) {
 bc->unrealize(bus);
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 143ac1c354..a5dd6252fa 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1386,7 +1386,7 @@ static void pc_memory_unplug(HotplugHandler *hotplug_dev,
 }
 
 pc_dimm_unplug(PC_DIMM(dev), MACHINE(pcms));
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);
  out:
 error_propagate(errp, local_err);
 }
@@ -1494,7 +1494,7 @@ static void pc_cpu_unplug_cb(HotplugHandler *hotplug_dev,
 
 found_cpu = pc_find_cpu_slot(MACHINE(pcms), cpu->apic_id, NULL);
 found_cpu->cpu = NULL;
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);
 
 /* decrement the number of CPUs */
 x86ms->boot_cpus--;
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 5b9c022d91..086d0dfceb 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -460,7 +460,7 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, 
DeviceState *dev,
 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
  Error **errp)
 {
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);
 }
 
 static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
diff --git a/hw/pci/shpc.c b/hw/pci/shpc.c
index b76d3d2c9a..99d65d5c4c 100644
--- a/hw/pci/shpc.c
+++ b/hw/pci/shpc.c
@@ -547,7 +547,7 @@ void shpc_device_plug_cb(HotplugHandler *hotplug_dev, 
DeviceState *dev,
 void shpc_device_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
Error **errp)
 {
-object_property_set_bool(OBJECT(dev), false, "realized", _abort);
+qdev_unrealize(dev);
 }
 
 void shpc_device_unplug_request_cb(HotplugHandler *hotplug_dev,
diff 

[PULL 29/84] Revert "hw/versatile: realize the PCI root bus as part of the versatile init"

[Markus Armbruster]

This reverts commit b1af7959a66610669e1a019b9a84f6ed3a7936c6.

Realizing a device automatically realizes its buses, in
device_set_realized().  Realizing them in realize methods is
redundant, unless the methods themselves require them to be realized
early.  pci_vpb_realize() doesn't.  Drop the redundant bus
realization.

Cc: Marcel Apfelbaum 
Cc: Michael S. Tsirkin 
Signed-off-by: Markus Armbruster 
Reviewed-by: Paolo Bonzini 
Message-Id: <20200610053247.1583243-4-arm...@redhat.com>
---
 hw/pci-host/versatile.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 8ddfb8772a..ea7390c6fa 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -459,7 +459,6 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
 }
 
 /* TODO Remove once realize propagates to child devices. */
-object_property_set_bool(OBJECT(>pci_bus), true, "realized", errp);
 object_property_set_bool(OBJECT(>pci_dev), true, "realized", errp);
 }
 
-- 
2.26.2