[Spice-commits] 1011 commits - .gitmodules HACKING MAINTAINERS Makefile Makefile.objs QMP/qmp-events.txt VERSION arch_init.c async.c audio/audio_int.h block-migration.c block.c block/Makefile.objs block/backup.c block/commit.c block/cow.c block/curl.c block/gluster.c block/iscsi.c block/mirror.c block/qcow.c block/qcow2-cluster.c block/qcow2-refcount.c block/qcow2-snapshot.c block/qcow2.c block/qcow2.h block/qed.c block/raw-posix.c block/raw-win32.c block/raw.c block/rbd.c block/sheepdog.c block/ssh.c block/stream.c block/vdi.c block/vhdx.h block/vmdk.c block/vpc.c block/vvfat.c blockdev.c bsd-user/elfload.c bsd-user/main.c bsd-user/qemu.h configure cpu-exec.c cpus.c cputlb.c default-configs/alpha-softmmu.mak default-configs/i386-softmmu.mak default-configs/mips-softmmu.mak default-configs/mips64-softmmu.mak default-configs/mips64el-softmmu.mak default-configs/mipsel-softmmu.mak default-configs/ppc-softmmu.mak default-configs/ppc64-softmmu.mak default-configs/ppcemb-softmmu.mak defa ult-configs/sh4-softmmu.mak default-configs/sh4eb-softmmu.mak default-configs/sparc64-softmmu.mak default-configs/x86_64-softmmu.mak device_tree.c disas.c dma-helpers.c docs/atomics.txt docs/qapi-code-gen.txt docs/rdma.txt dump.c exec.c fsdev/qemu-fsdev.c gdbstub.c hmp-commands.hx hmp.c hmp.h hw/9pfs hw/acpi hw/alpha hw/arm hw/audio hw/block hw/char hw/core hw/cpu hw/cris hw/display hw/dma hw/gpio hw/i2c hw/i386 hw/ide hw/input hw/intc hw/isa hw/lm32 hw/m68k hw/microblaze hw/mips hw/misc hw/moxie hw/net hw/nvram hw/openrisc hw/pci hw/pci-bridge hw/pci-host hw/ppc hw/s390x hw/scsi hw/sd hw/sh4 hw/sparc hw/sparc64 hw/ssi hw/timer hw/tpm hw/unicore32 hw/usb hw/virtio hw/watchdog hw/xen hw/xtensa include/block include/exec include/hw include/migration include/monitor include/net include/qapi include/qemu include/qemu-common.h include/qom include/sysemu include/ui ioport.c kvm-all.c kvm-stub.c ldscripts/alpha.ld ldscripts/arm.ld ldscripts/hppa.ld ldscripts/i386.ld ldscripts/ia64. ld ldscripts/m68k.ld ldscripts/mips.ld ldscripts/ppc.ld ldscripts/ppc64.ld ldscripts/s390.ld ldscripts/sparc.ld ldscripts/sparc64.ld ldscripts/x86_64.ld libcacard/vcard_emul_nss.c linux-user/alpha linux-user/arm linux-user/cpu-uname.c linux-user/cris linux-user/elfload.c linux-user/i386 linux-user/ioctls.h linux-user/linuxload.c linux-user/m68k linux-user/main.c linux-user/microblaze linux-user/mips linux-user/mips64 linux-user/mmap.c linux-user/openrisc linux-user/ppc linux-user/qemu.h linux-user/s390x linux-user/sh4 linux-user/signal.c linux-user/socket.h linux-user/sparc linux-user/sparc64 linux-user/syscall.c linux-user/syscall_defs.h linux-user/unicore32 linux-user/x86_64 memory.c memory_mapping.c migration-rdma.c migration.c monitor.c net/eth.c net/net.c pc-bios/README pc-bios/acpi-dsdt.aml pc-bios/bios.bin pc-bios/multiboot.bin pc-bios/optionrom pc-bios/palcode-clipper pc-bios/q35-acpi-dsdt.aml pc-bios/qemu-nsis.bmp pc-bios/qemu-nsis.ico pc-bios/s390-ccw pc-bios/s390- ccw.img po/Makefile qapi-schema-test.json qapi-schema.json qapi/qapi-visit-core.c qapi/qmp-input-visitor.c qdev-monitor.c qemu-char.c qemu-coroutine-io.c qemu-coroutine-lock.c qemu-doc.texi qemu-img.c qemu-options.hx qemu-seccomp.c qemu.nsi qemu.sasl qga/service-win32.c qmp-commands.hx qobject/qdict.c qobject/qjson.c qom/cpu.c qom/object.c qtest.c roms/qemu-palcode savevm.c scripts/cleanup-trace-events.pl scripts/qapi-commands.py scripts/qapi-types.py scripts/qapi-visit.py scripts/qapi.py slirp/mbuf.h slirp/tcp_subr.c stubs/Makefile.objs stubs/cpus.c stubs/gdbstub.c stubs/vm-stop.c target-alpha/Makefile.objs target-alpha/cpu-qom.h target-alpha/cpu.c target-alpha/cpu.h target-alpha/gdbstub.c target-alpha/helper.c target-alpha/helper.h target-alpha/machine.c target-alpha/mem_helper.c target-alpha/sys_helper.c target-alpha/translate.c target-arm/Makefile.objs target-arm/arm-semi.c target-arm/cpu-qom.h target-arm/cpu.c target-arm/cpu.h target-arm/gdbstub.c target-arm/helper.c ta rget-arm/kvm-stub.c target-arm/kvm.c target-arm/kvm_arm.h target-arm/machine.c target-arm/translate.c target-cris/Makefile.objs target-cris/cpu-qom.h target-cris/cpu.c target-cris/cpu.h target-cris/gdbstub.c target-cris/helper.c target-cris/translate.c target-i386/Makefile.objs target-i386/arch_dump.c target-i386/cpu-qom.h target-i386/cpu.c target-i386/cpu.h target-i386/gdbstub.c target-i386/helper.c target-i386/kvm.c target-i386/machine.c target-i386/misc_helper.c target-i386/seg_helper.c target-i386/smm_helper.c target-i386/translate.c target-lm32/Makefile.objs target-lm32/cpu-qom.h target-lm32/cpu.c target-lm32/cpu.h target-lm32/gdbstub.c target-lm32/helper.c target-lm32/op_helper.c target-lm32/translate.c target-m68k/Makefile.objs target-m68k/cpu-qom.h target-m68k/cpu.c target-m68k/cpu.h target-m68k/gdbstub.c target-m68k/helper.c target-m68k/m68k-semi.c target-m68k/translate.c target-microblaze/Makefile.objs target-microblaze/cpu-qom.h target-microblaze/cpu.c target-micr oblaze/cpu.h target-microblaze/gdbstub.c target-microblaze/helper.c target-microblaze/op_helper.c target-microblaze/translate.c target-mips/Makefile.objs target-mips/cpu-qom.h target-mips/cpu.c target-mips/cpu.h target-mips/dsp_helper.c target-mips/gdbstub.c target-mips/helper.c target-mips/op_helper.c target-mips/translate.c target-moxie/cpu.c target-moxie/cpu.h target-moxie/helper.c target-moxie/translate.c target-openrisc/Makefile.objs target-openrisc/cpu.c target-openrisc/cpu.h target-openrisc/gdbstub.c target-openrisc/machine.c target-openrisc/mmu.c target-openrisc/translate.c target-ppc/Makefile.objs target-ppc/cpu-models.c target-ppc/cpu-models.h target-ppc/cpu-qom.h target-ppc/cpu.h target-ppc/excp_helper.c target-ppc/gdbstub.c target-ppc/kvm-stub.c target-ppc/kvm.c target-ppc/kvm_ppc.h target-ppc/machine.c target-ppc/mmu-hash32.c target-ppc/mmu-hash64.c target-ppc/mmu_helper.c target-ppc/translate.c target-ppc/translate_init.c target-s390x/Makefile.objs target-s390x /cpu-qom.h target-s390x/cpu.c target-s390x/cpu.h target-s390x/gdbstub.c target-s390x/helper.c target-s390x/kvm.c target-s390x/translate.c target-sh4/Makefile.objs target-sh4/cpu-qom.h target-sh4/cpu.c target-sh4/cpu.h target-sh4/gdbstub.c target-sh4/helper.c target-sh4/translate.c target-sparc/Makefile.objs target-sparc/cpu-qom.h target-sparc/cpu.c target-sparc/cpu.h target-sparc/gdbstub.c target-sparc/int32_helper.c target-sparc/int64_helper.c target-sparc/ldst_helper.c target-sparc/mmu_helper.c target-sparc/translate.c target-unicore32/cpu-qom.h target-unicore32/cpu.c target-unicore32/cpu.h target-unicore32/softmmu.c target-unicore32/translate.c target-xtensa/Makefile.objs target-xtensa/cpu-qom.h target-xtensa/cpu.c target-xtensa/cpu.h target-xtensa/gdbstub.c target-xtensa/helper.c target-xtensa/op_helper.c target-xtensa/translate.c target-xtensa/xtensa-semi.c tcg/aarch64 tcg/arm tcg/hppa tcg/i386 tcg/ia64 tcg/mips tcg/ppc tcg/ppc64 tcg/sparc tcg/tcg-op.h tcg/tcg-opc.h tcg /tcg.c tcg/tcg.h tcg/tci tests/Makefile tests/boot-order-test.c tests/endianness-test.c tests/fdc-test.c tests/fw_cfg-test.c tests/hd-geo-test.c tests/ide-test.c tests/libqos tests/libqtest.c tests/libqtest.h tests/qapi-schema tests/qemu-iotests tests/tcg tests/test-bitops.c tests/test-int128.c tests/test-qmp-input-visitor.c tests/test-qmp-output-visitor.c tests/test-thread-pool.c tests/test-visitor-serialization.c tpm.c trace-events translate-all.c ui/console.c ui/gtk.c ui/spice-core.c ui/vnc.c user-exec.c util/acl.c util/aes.c util/notify.c util/qemu-error.c util/qemu-option.c util/qemu-sockets.c vl.c xen-all.c xen-stub.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Tue Jul 30 01:37:59 PDT 2013


 .gitmodules                                    |    2 
 HACKING                                        |   19 
 MAINTAINERS                                    |   56 
 Makefile                                       |   60 
 Makefile.objs                                  |    1 
 QMP/qmp-events.txt                             |   17 
 VERSION                                        |    2 
 arch_init.c                                    |  172 +
 async.c                                        |   33 
 audio/audio_int.h                              |   31 
 block-migration.c                              |   32 
 block.c                                        |  108 
 block/Makefile.objs                            |    1 
 block/backup.c                                 |  386 ++
 block/commit.c                                 |    2 
 block/cow.c                                    |    1 
 block/curl.c                                   |   24 
 block/gluster.c                                |   72 
 block/iscsi.c                                  |  104 
 block/mirror.c                                 |    2 
 block/qcow.c                                   |    1 
 block/qcow2-cluster.c                          |   41 
 block/qcow2-refcount.c                         |  136 -
 block/qcow2-snapshot.c                         |    6 
 block/qcow2.c                                  |   33 
 block/qcow2.h                                  |   34 
 block/qed.c                                    |    1 
 block/raw-posix.c                              |   11 
 block/raw-win32.c                              |    7 
 block/raw.c                                    |   14 
 block/rbd.c                                    |    1 
 block/sheepdog.c                               |   33 
 block/ssh.c                                    |   16 
 block/stream.c                                 |    2 
 block/vdi.c                                    |    1 
 block/vhdx.h                                   |    2 
 block/vmdk.c                                   |  101 
 block/vpc.c                                    |   25 
 block/vvfat.c                                  |   25 
 blockdev.c                                     |  566 ++--
 bsd-user/elfload.c                             |    6 
 bsd-user/main.c                                |   17 
 bsd-user/qemu.h                                |    2 
 configure                                      |  174 -
 cpu-exec.c                                     |   31 
 cpus.c                                         |  290 +-
 cputlb.c                                       |   30 
 default-configs/alpha-softmmu.mak              |    1 
 default-configs/i386-softmmu.mak               |    3 
 default-configs/mips-softmmu.mak               |    2 
 default-configs/mips64-softmmu.mak             |    2 
 default-configs/mips64el-softmmu.mak           |    2 
 default-configs/mipsel-softmmu.mak             |    2 
 default-configs/ppc-softmmu.mak                |    2 
 default-configs/ppc64-softmmu.mak              |   10 
 default-configs/ppcemb-softmmu.mak             |    2 
 default-configs/sh4-softmmu.mak                |    9 
 default-configs/sh4eb-softmmu.mak              |    9 
 default-configs/sparc64-softmmu.mak            |    1 
 default-configs/x86_64-softmmu.mak             |    3 
 device_tree.c                                  |   56 
 disas.c                                        |    4 
 dma-helpers.c                                  |    6 
 docs/atomics.txt                               |  352 ++
 docs/qapi-code-gen.txt                         |  109 
 docs/rdma.txt                                  |  424 +++
 dump.c                                         |   16 
 exec.c                                         |  624 ++--
 fsdev/qemu-fsdev.c                             |    2 
 gdbstub.c                                      | 1633 +-----------
 hmp-commands.hx                                |   24 
 hmp.c                                          |  128 
 hmp.h                                          |    1 
 hw/9pfs/virtio-9p-device.c                     |   27 
 hw/9pfs/virtio-9p-proxy.c                      |    2 
 hw/acpi/core.c                                 |    9 
 hw/acpi/ich9.c                                 |   10 
 hw/acpi/piix4.c                                |   84 
 hw/alpha/alpha_sys.h                           |    2 
 hw/alpha/dp264.c                               |    6 
 hw/alpha/pci.c                                 |   44 
 hw/alpha/typhoon.c                             |  101 
 hw/arm/armv7m.c                                |   26 
 hw/arm/boot.c                                  |   85 
 hw/arm/exynos4210.c                            |   12 
 hw/arm/exynos4_boards.c                        |    4 
 hw/arm/highbank.c                              |   87 
 hw/arm/integratorcp.c                          |   91 
 hw/arm/kzm.c                                   |    6 
 hw/arm/mainstone.c                             |    2 
 hw/arm/musicpal.c                              |  182 -
 hw/arm/omap1.c                                 |   52 
 hw/arm/omap2.c                                 |   16 
 hw/arm/omap_sx1.c                              |   14 
 hw/arm/palm.c                                  |   10 
 hw/arm/pxa2xx.c                                |  116 
 hw/arm/pxa2xx_gpio.c                           |   37 
 hw/arm/pxa2xx_pic.c                            |   20 
 hw/arm/realview.c                              |   16 
 hw/arm/spitz.c                                 |   45 
 hw/arm/stellaris.c                             |   83 
 hw/arm/strongarm.c                             |  154 -
 hw/arm/tosa.c                                  |    2 
 hw/arm/versatilepb.c                           |   44 
 hw/arm/vexpress.c                              |  159 +
 hw/arm/xilinx_zynq.c                           |    6 
 hw/audio/ac97.c                                |    7 
 hw/audio/adlib.c                               |   21 
 hw/audio/cs4231.c                              |   18 
 hw/audio/cs4231a.c                             |    4 
 hw/audio/es1370.c                              |    3 
 hw/audio/gus.c                                 |    1 
 hw/audio/hda-codec.c                           |    3 
 hw/audio/intel-hda.c                           |    5 
 hw/audio/marvell_88w8618.c                     |   16 
 hw/audio/milkymist-ac97.c                      |   15 
 hw/audio/pcspk.c                               |    3 
 hw/audio/pl041.c                               |   48 
 hw/audio/sb16.c                                |    1 
 hw/block/dataplane/virtio-blk.c                |   19 
 hw/block/fdc.c                                 |  142 -
 hw/block/m25p80.c                              |   12 
 hw/block/nand.c                                |   81 
 hw/block/nvme.c                                |    4 
 hw/block/onenand.c                             |   40 
 hw/block/pc_sysfw.c                            |    7 
 hw/block/pflash_cfi01.c                        |   40 
 hw/block/pflash_cfi02.c                        |   44 
 hw/block/virtio-blk.c                          |   33 
 hw/block/xen_disk.c                            |   14 
 hw/char/cadence_uart.c                         |   20 
 hw/char/debugcon.c                             |    3 
 hw/char/escc.c                                 |   49 
 hw/char/etraxfs_ser.c                          |   40 
 hw/char/exynos4210_uart.c                      |   30 
 hw/char/grlib_apbuart.c                        |   15 
 hw/char/imx_serial.c                           |   20 
 hw/char/ipack.c                                |    1 
 hw/char/ipoctal232.c                           |    1 
 hw/char/lm32_juart.c                           |   21 
 hw/char/lm32_uart.c                            |   15 
 hw/char/mcf_uart.c                             |    2 
 hw/char/milkymist-uart.c                       |   17 
 hw/char/omap_uart.c                            |    2 
 hw/char/parallel.c                             |    3 
 hw/char/pl011.c                                |  112 
 hw/char/serial-isa.c                           |    3 
 hw/char/serial-pci.c                           |   10 
 hw/char/serial.c                               |    4 
 hw/char/sh_serial.c                            |    6 
 hw/char/spapr_vty.c                            |   16 
 hw/char/tpci200.c                              |   13 
 hw/char/virtio-serial-bus.c                    |    2 
 hw/char/xilinx_uartlite.c                      |   34 
 hw/core/empty_slot.c                           |   16 
 hw/core/loader.c                               |   85 
 hw/core/qdev-properties.c                      |   68 
 hw/cpu/a15mpcore.c                             |   22 
 hw/cpu/a9mpcore.c                              |   17 
 hw/cpu/arm11mpcore.c                           |   48 
 hw/cpu/icc_bus.c                               |   10 
 hw/cris/axis_dev88.c                           |    8 
 hw/display/cirrus_vga.c                        |   30 
 hw/display/exynos4210_fimd.c                   |   26 
 hw/display/framebuffer.c                       |   12 
 hw/display/g364fb.c                            |   30 
 hw/display/jazz_led.c                          |   14 
 hw/display/milkymist-tmu2.c                    |   15 
 hw/display/milkymist-vgafb.c                   |   19 
 hw/display/omap_dss.c                          |   10 
 hw/display/omap_lcdc.c                         |    2 
 hw/display/pl110.c                             |  140 -
 hw/display/pxa2xx_lcd.c                        |    2 
 hw/display/qxl-render.c                        |    2 
 hw/display/qxl.c                               |   29 
 hw/display/sm501.c                             |    8 
 hw/display/tc6393xb.c                          |    4 
 hw/display/tcx.c                               |   30 
 hw/display/vga-isa-mm.c                        |    8 
 hw/display/vga-isa.c                           |    7 
 hw/display/vga-pci.c                           |   14 
 hw/display/vga.c                               |   23 
 hw/display/vga_int.h                           |    8 
 hw/display/vmware_vga.c                        |   51 
 hw/dma/etraxfs_dma.c                           |    2 
 hw/dma/i82374.c                                |   18 
 hw/dma/i8257.c                                 |    4 
 hw/dma/omap_dma.c                              |   15 
 hw/dma/pl080.c                                 |   93 
 hw/dma/pl330.c                                 |    3 
 hw/dma/puv3_dma.c                              |   14 
 hw/dma/pxa2xx_dma.c                            |   22 
 hw/dma/rc4030.c                                |    4 
 hw/dma/sparc32_dma.c                           |   26 
 hw/dma/sun4m_iommu.c                           |   14 
 hw/dma/xilinx_axidma.c                         |    2 
 hw/gpio/omap_gpio.c                            |   68 
 hw/gpio/pl061.c                                |  112 
 hw/gpio/puv3_gpio.c                            |   14 
 hw/gpio/zaurus.c                               |   21 
 hw/i2c/bitbang_i2c.c                           |   27 
 hw/i2c/core.c                                  |    1 
 hw/i2c/exynos4210_i2c.c                        |   18 
 hw/i2c/omap_i2c.c                              |   40 
 hw/i2c/pm_smbus.c                              |   28 
 hw/i2c/versatile_i2c.c                         |   22 
 hw/i386/kvm/apic.c                             |    4 
 hw/i386/kvm/clock.c                            |   94 
 hw/i386/kvm/i8254.c                            |    2 
 hw/i386/kvm/i8259.c                            |    4 
 hw/i386/kvm/ioapic.c                           |    7 
 hw/i386/kvm/pci-assign.c                       |   38 
 hw/i386/kvmvapic.c                             |  120 
 hw/i386/multiboot.c                            |    2 
 hw/i386/pc.c                                   |  130 -
 hw/i386/pc_piix.c                              |   77 
 hw/i386/pc_q35.c                               |   25 
 hw/ide/ahci.c                                  |   59 
 hw/ide/ahci.h                                  |   10 
 hw/ide/cmd646.c                                |   79 
 hw/ide/core.c                                  | 1251 +++++----
 hw/ide/ich.c                                   |   33 
 hw/ide/internal.h                              |    1 
 hw/ide/isa.c                                   |    1 
 hw/ide/macio.c                                 |  248 +
 hw/ide/mmio.c                                  |    4 
 hw/ide/pci.c                                   |   30 
 hw/ide/pci.h                                   |    8 
 hw/ide/piix.c                                  |   41 
 hw/ide/qdev.c                                  |    1 
 hw/ide/via.c                                   |   27 
 hw/input/milkymist-softusb.c                   |   20 
 hw/input/pckbd.c                               |    8 
 hw/input/pl050.c                               |   84 
 hw/input/pxa2xx_keypad.c                       |    2 
 hw/intc/Makefile.objs                          |    6 
 hw/intc/apic.c                                 |    2 
 hw/intc/arm_gic.c                              |   18 
 hw/intc/arm_gic_common.c                       |    2 
 hw/intc/arm_gic_kvm.c                          |    6 
 hw/intc/armv7m_nvic.c                          |   18 
 hw/intc/etraxfs_pic.c                          |   25 
 hw/intc/exynos4210_combiner.c                  |   25 
 hw/intc/exynos4210_gic.c                       |   53 
 hw/intc/gic_internal.h                         |    5 
 hw/intc/grlib_irqmp.c                          |   35 
 hw/intc/heathrow_pic.c                         |    2 
 hw/intc/i8259.c                                |    6 
 hw/intc/imx_avic.c                             |   30 
 hw/intc/ioapic.c                               |    5 
 hw/intc/ioapic_common.c                        |   12 
 hw/intc/lm32_pic.c                             |   27 
 hw/intc/omap_intc.c                            |   61 
 hw/intc/openpic.c                              |  102 
 hw/intc/openpic_kvm.c                          |  264 ++
 hw/intc/pl190.c                                |   80 
 hw/intc/puv3_intc.c                            |   25 
 hw/intc/realview_gic.c                         |   23 
 hw/intc/sh_intc.c                              |   11 
 hw/intc/slavio_intctl.c                        |   40 
 hw/intc/xics.c                                 |  708 +++++
 hw/intc/xilinx_intc.c                          |   22 
 hw/isa/Makefile.objs                           |    1 
 hw/isa/apm.c                                   |    2 
 hw/isa/i82378.c                                |    7 
 hw/isa/isa-bus.c                               |   10 
 hw/isa/isa_mmio.c                              |   81 
 hw/isa/lpc_ich9.c                              |   16 
 hw/isa/pc87312.c                               |    2 
 hw/isa/vt82c686.c                              |   45 
 hw/lm32/lm32.h                                 |    5 
 hw/lm32/lm32_boards.c                          |    4 
 hw/lm32/milkymist.c                            |    2 
 hw/m68k/an5206.c                               |    4 
 hw/m68k/dummy_m68k.c                           |    2 
 hw/m68k/mcf5206.c                              |    2 
 hw/m68k/mcf5208.c                              |    8 
 hw/m68k/mcf_intc.c                             |    2 
 hw/microblaze/boot.c                           |   27 
 hw/microblaze/petalogix_ml605_mmu.c            |    4 
 hw/microblaze/petalogix_s3adsp1800_mmu.c       |    4 
 hw/mips/gt64xxx_pci.c                          |    5 
 hw/mips/mips_fulong2e.c                        |   21 
 hw/mips/mips_jazz.c                            |   26 
 hw/mips/mips_malta.c                           |  259 +
 hw/mips/mips_mipssim.c                         |   14 
 hw/mips/mips_r4k.c                             |   14 
 hw/misc/a9scu.c                                |    3 
 hw/misc/applesmc.c                             |   51 
 hw/misc/arm_l2x0.c                             |   39 
 hw/misc/arm_sysctl.c                           |   23 
 hw/misc/debugexit.c                            |    3 
 hw/misc/eccmemctl.c                            |   21 
 hw/misc/exynos4210_pmu.c                       |   18 
 hw/misc/imx_ccm.c                              |   21 
 hw/misc/ivshmem.c                              |   68 
 hw/misc/lm32_sys.c                             |   15 
 hw/misc/macio/cuda.c                           |    2 
 hw/misc/macio/mac_dbdma.c                      |  195 -
 hw/misc/macio/macio.c                          |  175 +
 hw/misc/milkymist-hpdmc.c                      |   15 
 hw/misc/milkymist-pfpu.c                       |   15 
 hw/misc/mst_fpga.c                             |   68 
 hw/misc/omap_gpmc.c                            |    8 
 hw/misc/omap_l4.c                              |    2 
 hw/misc/omap_sdrc.c                            |    2 
 hw/misc/omap_tap.c                             |    2 
 hw/misc/pc-testdev.c                           |   37 
 hw/misc/pci-testdev.c                          |   29 
 hw/misc/puv3_pm.c                              |   14 
 hw/misc/pvpanic.c                              |   33 
 hw/misc/pxa2xx_pcmcia.c                        |    6 
 hw/misc/sga.c                                  |    1 
 hw/misc/slavio_misc.c                          |   63 
 hw/misc/vfio.c                                 |  804 +++---
 hw/misc/vmport.c                               |   32 
 hw/misc/zynq_slcr.c                            |   17 
 hw/moxie/moxiesim.c                            |    4 
 hw/net/cadence_gem.c                           |   29 
 hw/net/dp8393x.c                               |    2 
 hw/net/e1000.c                                 |   78 
 hw/net/eepro100.c                              |   15 
 hw/net/etraxfs_eth.c                           |   55 
 hw/net/lan9118.c                               |   29 
 hw/net/lance.c                                 |   28 
 hw/net/mcf_fec.c                               |    2 
 hw/net/milkymist-minimac2.c                    |   33 
 hw/net/mipsnet.c                               |   24 
 hw/net/ne2000-isa.c                            |    3 
 hw/net/ne2000.c                                |    7 
 hw/net/ne2000.h                                |    2 
 hw/net/opencores_eth.c                         |   29 
 hw/net/pcnet-pci.c                             |   28 
 hw/net/rtl8139.c                               |  121 
 hw/net/smc91c111.c                             |   32 
 hw/net/spapr_llan.c                            |   50 
 hw/net/stellaris_enet.c                        |   42 
 hw/net/virtio-net.c                            |  134 -
 hw/net/vmxnet3.c                               |   23 
 hw/net/vmxnet_tx_pkt.c                         |    2 
 hw/net/xgmac.c                                 |   49 
 hw/net/xilinx_axienet.c                        |    2 
 hw/net/xilinx_ethlite.c                        |   24 
 hw/nvram/ds1225y.c                             |   15 
 hw/nvram/fw_cfg.c                              |   48 
 hw/nvram/mac_nvram.c                           |    4 
 hw/nvram/spapr_nvram.c                         |    4 
 hw/openrisc/openrisc_sim.c                     |    8 
 hw/pci-bridge/dec.c                            |    8 
 hw/pci-bridge/i82801b11.c                      |   14 
 hw/pci-bridge/ioh3420.c                        |   36 
 hw/pci-bridge/pci_bridge_dev.c                 |   29 
 hw/pci-bridge/xio3130_downstream.c             |   36 
 hw/pci-bridge/xio3130_upstream.c               |   27 
 hw/pci-host/apb.c                              |  120 
 hw/pci-host/bonito.c                           |   35 
 hw/pci-host/grackle.c                          |    8 
 hw/pci-host/pam.c                              |   16 
 hw/pci-host/piix.c                             |  225 +
 hw/pci-host/ppce500.c                          |   13 
 hw/pci-host/prep.c                             |    9 
 hw/pci-host/q35.c                              |  167 -
 hw/pci-host/uninorth.c                         |   24 
 hw/pci-host/versatile.c                        |   16 
 hw/pci/Makefile.objs                           |    2 
 hw/pci/msix.c                                  |    6 
 hw/pci/pci-hotplug-old.c                       |  337 ++
 hw/pci/pci-hotplug.c                           |  292 --
 hw/pci/pci.c                                   |  147 -
 hw/pci/pci_bridge.c                            |   54 
 hw/pci/pci_host.c                              |    1 
 hw/pci/pcie.c                                  |    2 
 hw/pci/pcie_aer.c                              |    9 
 hw/pci/pcie_host.c                             |    3 
 hw/pci/pcie_port.c                             |   52 
 hw/pci/shpc.c                                  |    4 
 hw/ppc/Makefile.objs                           |    2 
 hw/ppc/e500.c                                  |  135 -
 hw/ppc/mac.h                                   |    3 
 hw/ppc/mac_newworld.c                          |   42 
 hw/ppc/mac_oldworld.c                          |   37 
 hw/ppc/mpc8544_guts.c                          |   37 
 hw/ppc/ppc.c                                   |   12 
 hw/ppc/ppc405_boards.c                         |   18 
 hw/ppc/ppc405_uc.c                             |   12 
 hw/ppc/ppc440_bamboo.c                         |    7 
 hw/ppc/ppc4xx_devs.c                           |    4 
 hw/ppc/ppc4xx_pci.c                            |    8 
 hw/ppc/ppc_booke.c                             |   24 
 hw/ppc/ppce500_spin.c                          |   20 
 hw/ppc/prep.c                                  |   47 
 hw/ppc/spapr.c                                 |  429 ++-
 hw/ppc/spapr_events.c                          |    2 
 hw/ppc/spapr_hcall.c                           |   20 
 hw/ppc/spapr_iommu.c                           |  146 -
 hw/ppc/spapr_pci.c                             |  133 -
 hw/ppc/spapr_rtas.c                            |   23 
 hw/ppc/spapr_vio.c                             |   38 
 hw/ppc/virtex_ml507.c                          |    2 
 hw/ppc/xics.c                                  |  583 ----
 hw/s390x/css.c                                 |    2 
 hw/s390x/css.h                                 |    1 
 hw/s390x/ipl.c                                 |   22 
 hw/s390x/s390-virtio-bus.c                     |    4 
 hw/s390x/s390-virtio-ccw.c                     |    2 
 hw/s390x/s390-virtio.c                         |    6 
 hw/s390x/virtio-ccw.c                          |  208 +
 hw/s390x/virtio-ccw.h                          |    8 
 hw/scsi/esp-pci.c                              |   45 
 hw/scsi/esp.c                                  |   47 
 hw/scsi/lsi53c895a.c                           |   89 
 hw/scsi/megasas.c                              |   78 
 hw/scsi/scsi-bus.c                             |   35 
 hw/scsi/spapr_vscsi.c                          |  344 +-
 hw/scsi/vhost-scsi.c                           |    1 
 hw/scsi/virtio-scsi.c                          |   20 
 hw/scsi/vmw_pvscsi.c                           |    7 
 hw/sd/milkymist-memcard.c                      |   18 
 hw/sd/omap_mmc.c                               |    8 
 hw/sd/pl181.c                                  |   81 
 hw/sd/pxa2xx_mmci.c                            |    4 
 hw/sd/sdhci.c                                  |    4 
 hw/sd/ssi-sd.c                                 |    2 
 hw/sh4/r2d.c                                   |    9 
 hw/sh4/sh7750.c                                |   16 
 hw/sh4/sh_pci.c                                |   48 
 hw/sh4/shix.c                                  |    6 
 hw/sparc/leon3.c                               |    4 
 hw/sparc/sun4m.c                               |   72 
 hw/sparc64/sun4u.c                             |   41 
 hw/ssi/omap_spi.c                              |    2 
 hw/ssi/pl022.c                                 |   93 
 hw/ssi/xilinx_spi.c                            |   30 
 hw/ssi/xilinx_spips.c                          |    5 
 hw/timer/Makefile.objs                         |    2 
 hw/timer/arm_mptimer.c                         |   31 
 hw/timer/arm_timer.c                           |   54 
 hw/timer/cadence_ttc.c                         |   16 
 hw/timer/etraxfs_timer.c                       |   38 
 hw/timer/exynos4210_mct.c                      |   17 
 hw/timer/exynos4210_pwm.c                      |   16 
 hw/timer/exynos4210_rtc.c                      |   17 
 hw/timer/grlib_gptimer.c                       |   16 
 hw/timer/hpet.c                                |   51 
 hw/timer/i8254.c                               |    3 
 hw/timer/imx_epit.c                            |    4 
 hw/timer/imx_gpt.c                             |  558 ++--
 hw/timer/lm32_timer.c                          |   15 
 hw/timer/m48t59.c                              |   24 
 hw/timer/mc146818rtc.c                         |    2 
 hw/timer/milkymist-sysctl.c                    |   16 
 hw/timer/omap_gptimer.c                        |    2 
 hw/timer/omap_synctimer.c                      |    2 
 hw/timer/pl031.c                               |   46 
 hw/timer/puv3_ost.c                            |   14 
 hw/timer/pxa2xx_timer.c                        |   44 
 hw/timer/sh_timer.c                            |    6 
 hw/timer/slavio_timer.c                        |   15 
 hw/timer/tusb6010.c                            |   30 
 hw/timer/xilinx_timer.c                        |   13 
 hw/tpm/tpm_tis.c                               |    3 
 hw/unicore32/puv3.c                            |    2 
 hw/usb/bus.c                                   |    1 
 hw/usb/ccid-card-emulated.c                    |    1 
 hw/usb/ccid-card-passthru.c                    |    3 
 hw/usb/desc.c                                  |    6 
 hw/usb/dev-audio.c                             |    1 
 hw/usb/dev-bluetooth.c                         |    1 
 hw/usb/dev-hid.c                               |    6 
 hw/usb/dev-hub.c                               |    1 
 hw/usb/dev-network.c                           |    1 
 hw/usb/dev-serial.c                            |    2 
 hw/usb/dev-smartcard-reader.c                  |    3 
 hw/usb/dev-storage.c                           |   16 
 hw/usb/dev-uas.c                               |    1 
 hw/usb/dev-wacom.c                             |    1 
 hw/usb/hcd-ehci-pci.c                          |   25 
 hw/usb/hcd-ehci-sysbus.c                       |  130 -
 hw/usb/hcd-ehci.c                              |   72 
 hw/usb/hcd-ehci.h                              |   28 
 hw/usb/hcd-ohci.c                              |   56 
 hw/usb/hcd-uhci.c                              |    5 
 hw/usb/hcd-xhci.c                              |  117 
 hw/usb/host-libusb.c                           |    6 
 hw/usb/host-linux.c                            |    1 
 hw/usb/redirect.c                              |    1 
 hw/virtio/Makefile.objs                        |    1 
 hw/virtio/dataplane/hostmem.c                  |    7 
 hw/virtio/dataplane/vring.c                    |    8 
 hw/virtio/vhost.c                              |   11 
 hw/virtio/virtio-balloon.c                     |    6 
 hw/virtio/virtio-mmio.c                        |  422 +++
 hw/virtio/virtio-pci.c                         |   12 
 hw/virtio/virtio-rng.c                         |    1 
 hw/virtio/virtio.c                             |   40 
 hw/watchdog/watchdog.c                         |    1 
 hw/watchdog/wdt_i6300esb.c                     |    4 
 hw/watchdog/wdt_ib700.c                        |   13 
 hw/xen/Makefile.objs                           |    2 
 hw/xen/xen_apic.c                              |    4 
 hw/xen/xen_platform.c                          |   47 
 hw/xen/xen_pt.c                                |   12 
 hw/xen/xen_pt_msi.c                            |    3 
 hw/xen/xen_pvdevice.c                          |  131 +
 hw/xtensa/xtensa_lx60.c                        |   20 
 hw/xtensa/xtensa_sim.c                         |   14 
 include/block/aio.h                            |    7 
 include/block/block.h                          |    8 
 include/block/block_int.h                      |   44 
 include/block/coroutine.h                      |   15 
 include/exec/cpu-all.h                         |   39 
 include/exec/cpu-common.h                      |   10 
 include/exec/cpu-defs.h                        |    8 
 include/exec/exec-all.h                        |   14 
 include/exec/gdbstub.h                         |   55 
 include/exec/hwaddr.h                          |    4 
 include/exec/ioport.h                          |   30 
 include/exec/iorange.h                         |   31 
 include/exec/memory-internal.h                 |    2 
 include/exec/memory.h                          |  158 -
 include/exec/poison.h                          |    1 
 include/exec/softmmu-semi.h                    |   18 
 include/hw/arm/arm.h                           |    4 
 include/hw/char/escc.h                         |    1 
 include/hw/char/lm32_juart.h                   |   13 
 include/hw/hw.h                                |    1 
 include/hw/i386/ioapic.h                       |    1 
 include/hw/i386/pc.h                           |   51 
 include/hw/isa/isa.h                           |    3 
 include/hw/lm32/lm32_juart.h                   |   11 
 include/hw/loader.h                            |   13 
 include/hw/mips/mips.h                         |    3 
 include/hw/pci-host/pam.h                      |    4 
 include/hw/pci-host/q35.h                      |   14 
 include/hw/pci-host/spapr.h                    |    6 
 include/hw/pci/pci.h                           |   19 
 include/hw/pci/pci_bridge.h                    |    1 
 include/hw/pci/pci_bus.h                       |    7 
 include/hw/pci/pci_host.h                      |   12 
 include/hw/pci/pci_ids.h                       |    7 
 include/hw/pci/pcie_port.h                     |   14 
 include/hw/ppc/mac_dbdma.h                     |  124 
 include/hw/ppc/openpic.h                       |   14 
 include/hw/ppc/ppc.h                           |    3 
 include/hw/ppc/ppc_e500.h                      |    6 
 include/hw/ppc/spapr.h                         |   47 
 include/hw/ppc/spapr_vio.h                     |    5 
 include/hw/ppc/xics.h                          |   74 
 include/hw/qdev-core.h                         |   30 
 include/hw/qdev-properties.h                   |    3 
 include/hw/scsi/scsi.h                         |    4 
 include/hw/sysbus.h                            |   21 
 include/hw/timer/m48t59.h                      |    3 
 include/hw/usb.h                               |    1 
 include/hw/virtio/dataplane/hostmem.h          |    1 
 include/hw/virtio/dataplane/vring.h            |    2 
 include/hw/virtio/virtio-blk.h                 |    1 
 include/hw/virtio/virtio-bus.h                 |    6 
 include/hw/virtio/virtio-net.h                 |    1 
 include/hw/virtio/virtio.h                     |    4 
 include/migration/migration.h                  |   37 
 include/migration/qemu-file.h                  |   32 
 include/migration/vmstate.h                    |    2 
 include/monitor/monitor.h                      |    1 
 include/net/net.h                              |    3 
 include/qapi/qmp/qdict.h                       |    1 
 include/qapi/qmp/qobject.h                     |    1 
 include/qapi/visitor-impl.h                    |    6 
 include/qapi/visitor.h                         |    6 
 include/qemu-common.h                          |   11 
 include/qemu/atomic.h                          |  198 +
 include/qemu/bitops.h                          |   50 
 include/qemu/compiler.h                        |    3 
 include/qemu/error-report.h                    |    2 
 include/qemu/int128.h                          |   25 
 include/qemu/log.h                             |   26 
 include/qemu/notify.h                          |   29 
 include/qemu/option.h                          |    3 
 include/qemu/range.h                           |   16 
 include/qemu/typedefs.h                        |    1 
 include/qom/cpu.h                              |  208 +
 include/sysemu/char.h                          |    2 
 include/sysemu/device_tree.h                   |   59 
 include/sysemu/dma.h                           |    4 
 include/sysemu/kvm.h                           |   34 
 include/sysemu/sysemu.h                        |    6 
 include/ui/console.h                           |    2 
 ioport.c                                       |  383 --
 kvm-all.c                                      |  134 -
 kvm-stub.c                                     |   20 
 ldscripts/alpha.ld                             |  127 
 ldscripts/arm.ld                               |  153 -
 ldscripts/hppa.ld                              |  211 -
 ldscripts/i386.ld                              |  153 -
 ldscripts/ia64.ld                              |  209 -
 ldscripts/m68k.ld                              |  175 -
 ldscripts/mips.ld                              |  222 -
 ldscripts/ppc.ld                               |  237 -
 ldscripts/ppc64.ld                             |  230 -
 ldscripts/s390.ld                              |  201 -
 ldscripts/sparc.ld                             |  150 -
 ldscripts/sparc64.ld                           |  138 -
 ldscripts/x86_64.ld                            |  180 -
 libcacard/vcard_emul_nss.c                     |   22 
 linux-user/alpha/target_cpu.h                  |   36 
 linux-user/arm/syscall.h                       |    2 
 linux-user/arm/target_cpu.h                    |   35 
 linux-user/cpu-uname.c                         |   10 
 linux-user/cris/syscall.h                      |    2 
 linux-user/cris/target_cpu.h                   |   36 
 linux-user/elfload.c                           |   21 
 linux-user/i386/syscall.h                      |    2 
 linux-user/i386/target_cpu.h                   |   48 
 linux-user/ioctls.h                            |    6 
 linux-user/linuxload.c                         |    3 
 linux-user/m68k/target_cpu.h                   |   38 
 linux-user/main.c                              |  187 -
 linux-user/microblaze/syscall.h                |    2 
 linux-user/microblaze/target_cpu.h             |   35 
 linux-user/mips/syscall.h                      |    2 
 linux-user/mips/target_cpu.h                   |   36 
 linux-user/mips64/syscall.h                    |    2 
 linux-user/mips64/target_cpu.h                 |    1 
 linux-user/mmap.c                              |   15 
 linux-user/openrisc/target_cpu.h               |   38 
 linux-user/ppc/syscall.h                       |    2 
 linux-user/ppc/target_cpu.h                    |   41 
 linux-user/qemu.h                              |   21 
 linux-user/s390x/syscall.h                     |    2 
 linux-user/s390x/target_cpu.h                  |   39 
 linux-user/sh4/target_cpu.h                    |   35 
 linux-user/signal.c                            |   57 
 linux-user/socket.h                            |  381 +-
 linux-user/sparc/syscall.h                     |    7 
 linux-user/sparc/target_cpu.h                  |   44 
 linux-user/sparc64/syscall.h                   |    7 
 linux-user/sparc64/target_cpu.h                |    1 
 linux-user/syscall.c                           |  353 +-
 linux-user/syscall_defs.h                      |   54 
 linux-user/unicore32/target_cpu.h              |   27 
 linux-user/x86_64/target_cpu.h                 |    1 
 memory.c                                       |  413 +--
 memory_mapping.c                               |   16 
 migration-rdma.c                               | 3249 +++++++++++++++++++++++++
 migration.c                                    |  107 
 monitor.c                                      |   37 
 net/eth.c                                      |    2 
 net/net.c                                      |   48 
 pc-bios/README                                 |    2 
 pc-bios/acpi-dsdt.aml                          |binary
 pc-bios/bios.bin                               |binary
 pc-bios/multiboot.bin                          |binary
 pc-bios/optionrom/multiboot.S                  |   75 
 pc-bios/palcode-clipper                        |binary
 pc-bios/q35-acpi-dsdt.aml                      |binary
 pc-bios/qemu-nsis.bmp                          |binary
 pc-bios/qemu-nsis.ico                          |binary
 pc-bios/s390-ccw.img                           |binary
 pc-bios/s390-ccw/cio.h                         |   20 
 pc-bios/s390-ccw/main.c                        |    7 
 pc-bios/s390-ccw/s390-ccw.h                    |    1 
 pc-bios/s390-ccw/virtio.c                      |   18 
 po/Makefile                                    |   33 
 qapi-schema-test.json                          |   53 
 qapi-schema.json                               |  217 +
 qapi/qapi-visit-core.c                         |   36 
 qapi/qmp-input-visitor.c                       |   47 
 qdev-monitor.c                                 |   52 
 qemu-char.c                                    |  145 -
 qemu-coroutine-io.c                            |   23 
 qemu-coroutine-lock.c                          |   20 
 qemu-doc.texi                                  |    2 
 qemu-img.c                                     |    6 
 qemu-options.hx                                |   43 
 qemu-seccomp.c                                 |   22 
 qemu.nsi                                       |  250 +
 qemu.sasl                                      |    2 
 qga/service-win32.c                            |  105 
 qmp-commands.hx                                |  121 
 qobject/qdict.c                                |   51 
 qobject/qjson.c                                |    2 
 qom/cpu.c                                      |   58 
 qom/object.c                                   |   11 
 qtest.c                                        |    7 
 roms/qemu-palcode                              |    2 
 savevm.c                                       |  115 
 scripts/cleanup-trace-events.pl                |   51 
 scripts/qapi-commands.py                       |   17 
 scripts/qapi-types.py                          |   65 
 scripts/qapi-visit.py                          |  183 +
 scripts/qapi.py                                |  270 +-
 slirp/mbuf.h                                   |   51 
 slirp/tcp_subr.c                               |   12 
 stubs/Makefile.objs                            |    1 
 stubs/cpus.c                                   |    5 
 stubs/gdbstub.c                                |    5 
 stubs/vm-stop.c                                |    2 
 target-alpha/Makefile.objs                     |    1 
 target-alpha/cpu-qom.h                         |   11 
 target-alpha/cpu.c                             |   22 
 target-alpha/cpu.h                             |   27 
 target-alpha/gdbstub.c                         |   93 
 target-alpha/helper.c                          |   11 
 target-alpha/helper.h                          |    3 
 target-alpha/machine.c                         |   28 
 target-alpha/mem_helper.c                      |   10 
 target-alpha/sys_helper.c                      |    7 
 target-alpha/translate.c                       |   42 
 target-arm/Makefile.objs                       |    2 
 target-arm/arm-semi.c                          |   13 
 target-arm/cpu-qom.h                           |   34 
 target-arm/cpu.c                               |   39 
 target-arm/cpu.h                               |  109 
 target-arm/gdbstub.c                           |  102 
 target-arm/helper.c                            |  391 ++-
 target-arm/kvm-stub.c                          |   23 
 target-arm/kvm.c                               |  294 +-
 target-arm/kvm_arm.h                           |   33 
 target-arm/machine.c                           |  134 -
 target-arm/translate.c                         |  155 +
 target-cris/Makefile.objs                      |    1 
 target-cris/cpu-qom.h                          |   11 
 target-cris/cpu.c                              |   31 
 target-cris/cpu.h                              |   18 
 target-cris/gdbstub.c                          |  130 +
 target-cris/helper.c                           |   11 
 target-cris/translate.c                        |   24 
 target-i386/Makefile.objs                      |    1 
 target-i386/arch_dump.c                        |   17 
 target-i386/cpu-qom.h                          |   17 
 target-i386/cpu.c                              |   50 
 target-i386/cpu.h                              |   16 
 target-i386/gdbstub.c                          |  231 +
 target-i386/helper.c                           |   38 
 target-i386/kvm.c                              |   63 
 target-i386/machine.c                          |   36 
 target-i386/misc_helper.c                      |    2 
 target-i386/seg_helper.c                       |   20 
 target-i386/smm_helper.c                       |   10 
 target-i386/translate.c                        |   14 
 target-lm32/Makefile.objs                      |    1 
 target-lm32/cpu-qom.h                          |    7 
 target-lm32/cpu.c                              |   28 
 target-lm32/cpu.h                              |   19 
 target-lm32/gdbstub.c                          |   92 
 target-lm32/helper.c                           |   10 
 target-lm32/op_helper.c                        |    2 
 target-lm32/translate.c                        |   23 
 target-m68k/Makefile.objs                      |    1 
 target-m68k/cpu-qom.h                          |    7 
 target-m68k/cpu.c                              |   26 
 target-m68k/cpu.h                              |   14 
 target-m68k/gdbstub.c                          |   75 
 target-m68k/helper.c                           |    5 
 target-m68k/m68k-semi.c                        |    5 
 target-m68k/translate.c                        |   22 
 target-microblaze/Makefile.objs                |    1 
 target-microblaze/cpu-qom.h                    |    7 
 target-microblaze/cpu.c                        |   28 
 target-microblaze/cpu.h                        |   24 
 target-microblaze/gdbstub.c                    |   56 
 target-microblaze/helper.c                     |   20 
 target-microblaze/op_helper.c                  |   17 
 target-microblaze/translate.c                  |   27 
 target-mips/Makefile.objs                      |    1 
 target-mips/cpu-qom.h                          |    7 
 target-mips/cpu.c                              |   45 
 target-mips/cpu.h                              |   25 
 target-mips/dsp_helper.c                       |   22 
 target-mips/gdbstub.c                          |  155 +
 target-mips/helper.c                           |    9 
 target-mips/op_helper.c                        |   39 
 target-mips/translate.c                        |   88 
 target-moxie/cpu.c                             |   29 
 target-moxie/cpu.h                             |   10 
 target-moxie/helper.c                          |   15 
 target-moxie/translate.c                       |   13 
 target-openrisc/Makefile.objs                  |    1 
 target-openrisc/cpu.c                          |   32 
 target-openrisc/cpu.h                          |   24 
 target-openrisc/gdbstub.c                      |   83 
 target-openrisc/machine.c                      |   27 
 target-openrisc/mmu.c                          |    5 
 target-openrisc/translate.c                    |   21 
 target-ppc/Makefile.objs                       |    2 
 target-ppc/cpu-models.c                        |   15 
 target-ppc/cpu-models.h                        |    8 
 target-ppc/cpu-qom.h                           |   13 
 target-ppc/cpu.h                               |   37 
 target-ppc/excp_helper.c                       |    9 
 target-ppc/gdbstub.c                           |  131 +
 target-ppc/kvm-stub.c                          |   18 
 target-ppc/kvm.c                               |  134 -
 target-ppc/kvm_ppc.h                           |   22 
 target-ppc/machine.c                           |  531 +++-
 target-ppc/mmu-hash32.c                        |    4 
 target-ppc/mmu-hash64.c                        |    6 
 target-ppc/mmu_helper.c                        |  114 
 target-ppc/translate.c                         |   32 
 target-ppc/translate_init.c                    |  324 +-
 target-s390x/Makefile.objs                     |    1 
 target-s390x/cpu-qom.h                         |    7 
 target-s390x/cpu.c                             |   26 
 target-s390x/cpu.h                             |   40 
 target-s390x/gdbstub.c                         |   88 
 target-s390x/helper.c                          |    5 
 target-s390x/kvm.c                             |   74 
 target-s390x/translate.c                       |   20 
 target-sh4/Makefile.objs                       |    1 
 target-sh4/cpu-qom.h                           |    7 
 target-sh4/cpu.c                               |   35 
 target-sh4/cpu.h                               |   20 
 target-sh4/gdbstub.c                           |  146 +
 target-sh4/helper.c                            |    7 
 target-sh4/translate.c                         |   24 
 target-sparc/Makefile.objs                     |    1 
 target-sparc/cpu-qom.h                         |    7 
 target-sparc/cpu.c                             |   48 
 target-sparc/cpu.h                             |   28 
 target-sparc/gdbstub.c                         |  208 +
 target-sparc/int32_helper.c                    |    2 
 target-sparc/int64_helper.c                    |    2 
 target-sparc/ldst_helper.c                     |   27 
 target-sparc/mmu_helper.c                      |   23 
 target-sparc/translate.c                       |   13 
 target-unicore32/cpu-qom.h                     |    5 
 target-unicore32/cpu.c                         |   15 
 target-unicore32/cpu.h                         |   18 
 target-unicore32/softmmu.c                     |    7 
 target-unicore32/translate.c                   |   22 
 target-xtensa/Makefile.objs                    |    1 
 target-xtensa/cpu-qom.h                        |   10 
 target-xtensa/cpu.c                            |   44 
 target-xtensa/cpu.h                            |    5 
 target-xtensa/gdbstub.c                        |  109 
 target-xtensa/helper.c                         |   47 
 target-xtensa/op_helper.c                      |    4 
 target-xtensa/translate.c                      |   23 
 target-xtensa/xtensa-semi.c                    |   14 
 tcg/aarch64/tcg-target.c                       |  256 +
 tcg/aarch64/tcg-target.h                       |    2 
 tcg/arm/tcg-target.c                           |  178 -
 tcg/arm/tcg-target.h                           |   15 
 tcg/hppa/tcg-target.c                          |   35 
 tcg/hppa/tcg-target.h                          |    1 
 tcg/i386/tcg-target.c                          |   45 
 tcg/ia64/tcg-target.h                          |    2 
 tcg/mips/tcg-target.h                          |    1 
 tcg/ppc/tcg-target.c                           |   14 
 tcg/ppc/tcg-target.h                           |    1 
 tcg/ppc64/tcg-target.c                         |   26 
 tcg/ppc64/tcg-target.h                         |    2 
 tcg/sparc/tcg-target.c                         |   35 
 tcg/sparc/tcg-target.h                         |    2 
 tcg/tcg-op.h                                   |   32 
 tcg/tcg-opc.h                                  |   36 
 tcg/tcg.c                                      |   26 
 tcg/tcg.h                                      |    6 
 tcg/tci/tcg-target.h                           |    6 
 tests/Makefile                                 |   59 
 tests/boot-order-test.c                        |  209 +
 tests/endianness-test.c                        |  316 ++
 tests/fdc-test.c                               |    2 
 tests/fw_cfg-test.c                            |    2 
 tests/hd-geo-test.c                            |    8 
 tests/ide-test.c                               |    2 
 tests/libqos/fw_cfg-pc.c                       |   40 
 tests/libqos/fw_cfg-pc.h                       |   20 
 tests/libqos/fw_cfg.c                          |   55 
 tests/libqos/fw_cfg.h                          |    9 
 tests/libqos/malloc-pc.c                       |    2 
 tests/libqtest.c                               |    4 
 tests/libqtest.h                               |   12 
 tests/qapi-schema/comments.exit                |    1 
 tests/qapi-schema/comments.json                |    4 
 tests/qapi-schema/comments.out                 |    3 
 tests/qapi-schema/empty.exit                   |    1 
 tests/qapi-schema/empty.out                    |    3 
 tests/qapi-schema/funny-char.err               |    1 
 tests/qapi-schema/funny-char.exit              |    1 
 tests/qapi-schema/funny-char.json              |    2 
 tests/qapi-schema/indented-expr.exit           |    1 
 tests/qapi-schema/indented-expr.json           |    2 
 tests/qapi-schema/indented-expr.out            |    3 
 tests/qapi-schema/missing-colon.err            |    1 
 tests/qapi-schema/missing-colon.exit           |    1 
 tests/qapi-schema/missing-colon.json           |    2 
 tests/qapi-schema/missing-comma-list.err       |    1 
 tests/qapi-schema/missing-comma-list.exit      |    1 
 tests/qapi-schema/missing-comma-list.json      |    2 
 tests/qapi-schema/missing-comma-object.err     |    1 
 tests/qapi-schema/missing-comma-object.exit    |    1 
 tests/qapi-schema/missing-comma-object.json    |    2 
 tests/qapi-schema/non-objects.err              |    1 
 tests/qapi-schema/non-objects.exit             |    1 
 tests/qapi-schema/non-objects.json             |    2 
 tests/qapi-schema/qapi-schema-test.exit        |    1 
 tests/qapi-schema/qapi-schema-test.json        |   53 
 tests/qapi-schema/qapi-schema-test.out         |   19 
 tests/qapi-schema/quoted-structural-chars.err  |    1 
 tests/qapi-schema/quoted-structural-chars.exit |    1 
 tests/qapi-schema/quoted-structural-chars.json |    1 
 tests/qapi-schema/test-qapi.py                 |   27 
 tests/qapi-schema/trailing-comma-list.err      |    1 
 tests/qapi-schema/trailing-comma-list.exit     |    1 
 tests/qapi-schema/trailing-comma-list.json     |    2 
 tests/qapi-schema/trailing-comma-object.err    |    1 
 tests/qapi-schema/trailing-comma-object.exit   |    1 
 tests/qapi-schema/trailing-comma-object.json   |    2 
 tests/qapi-schema/unclosed-list.err            |    1 
 tests/qapi-schema/unclosed-list.exit           |    1 
 tests/qapi-schema/unclosed-list.json           |    1 
 tests/qapi-schema/unclosed-object.err          |    1 
 tests/qapi-schema/unclosed-object.exit         |    1 
 tests/qapi-schema/unclosed-object.json         |    1 
 tests/qapi-schema/unclosed-string.err          |    1 
 tests/qapi-schema/unclosed-string.exit         |    1 
 tests/qapi-schema/unclosed-string.json         |    2 
 tests/qemu-iotests/041                         |   14 
 tests/qemu-iotests/051                         |   26 
 tests/qemu-iotests/051.out                     |  153 -
 tests/qemu-iotests/055                         |  294 ++
 tests/qemu-iotests/055.out                     |    5 
 tests/qemu-iotests/056                         |   94 
 tests/qemu-iotests/056.out                     |    5 
 tests/qemu-iotests/common.filter               |    2 
 tests/qemu-iotests/group                       |    4 
 tests/qemu-iotests/iotests.py                  |   20 
 tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c        |   64 
 tests/tcg/mips/mips32-dsp/dpsq_sa_l_w.c        |    4 
 tests/tcg/mips/mips32-dsp/mulq_rs_ph.c         |   19 
 tests/tcg/mips/mips32-dsp/precrq_rs_ph_w.c     |   24 
 tests/test-bitops.c                            |   75 
 tests/test-int128.c                            |  212 +
 tests/test-qmp-input-visitor.c                 |    2 
 tests/test-qmp-output-visitor.c                |    4 
 tests/test-thread-pool.c                       |    8 
 tests/test-visitor-serialization.c             |    8 
 tpm.c                                          |    4 
 trace-events                                   |  193 -
 translate-all.c                                |   42 
 ui/console.c                                   |   10 
 ui/gtk.c                                       |  102 
 ui/spice-core.c                                |   15 
 ui/vnc.c                                       |   15 
 user-exec.c                                    |   21 
 util/acl.c                                     |    4 
 util/aes.c                                     |    5 
 util/notify.c                                  |   30 
 util/qemu-error.c                              |   10 
 util/qemu-option.c                             |   40 
 util/qemu-sockets.c                            |    9 
 vl.c                                           |  202 -
 xen-all.c                                      |   22 
 xen-stub.c                                     |    5 
 955 files changed, 30749 insertions(+), 15610 deletions(-)

New commits:
commit dbe49aea76a7805f05b33d548b2e543b51fa8bb1
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 20:30:29 2013 -0500

    Update version for 1.6.0-rc0
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/VERSION b/VERSION
index 88eb60e..81fd881 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.5.50
+1.5.90
commit d2509b667caf482b6f827ff2645cbeb9b39ce29e
Author: Paul Moore <pmoore at redhat.com>
Date:   Thu Jul 18 09:57:03 2013 -0400

    seccomp: add arch_prctl() to the syscall whitelist
    
    It appears that even a very simple /etc/qemu-ifup configuration can
    require the arch_prctl() syscall, see the example below:
    
    	#!/bin/sh
    	/sbin/ifconfig $1 0.0.0.0 up
    	/usr/sbin/brctl addif <switch> $1
    
    Signed-off-by: Paul Moore <pmoore at redhat.com>
    Reviewed-by: Eduardo Otubo <otubo at linux.vnet.ibm.com>
    Message-id: 20130718135703.8247.19213.stgit at localhost
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 1d2f51c..37d38f8 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -217,7 +217,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(waitid), 241 },
     { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
-    { SCMP_SYS(io_destroy), 241 }
+    { SCMP_SYS(io_destroy), 241 },
+    { SCMP_SYS(arch_prctl), 240 }
 };
 
 int seccomp_start(void)
commit 94113bd8a1d9acd05a879bc309cc659ace09e287
Author: Paul Moore <pmoore at redhat.com>
Date:   Mon Jul 15 15:32:01 2013 -0400

    seccomp: add additional asynchronous I/O syscalls
    
    A previous commit, "seccomp: add the asynchronous I/O syscalls to the
    whitelist", added several asynchronous I/O syscalls but left out the
    io_submit() and io_cancel() syscalls.  This patch corrects this by
    adding the two missing asynchronous I/O syscalls.
    
    Signed-off-by: Paul Moore <pmoore at redhat.com>
    Reviewed-by: Eduardo Otubo <otubo at linux.vnet.ibm.com>
    Message-id: 20130715193201.943.4913.stgit at localhost
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 3298de8..1d2f51c 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -30,6 +30,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(sendto), 250 },
     { SCMP_SYS(socketcall), 250 },
     { SCMP_SYS(read), 249 },
+    { SCMP_SYS(io_submit), 249 },
     { SCMP_SYS(brk), 248 },
     { SCMP_SYS(clone), 247 },
     { SCMP_SYS(mmap), 247 },
@@ -214,6 +215,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(recvmmsg), 241 },
     { SCMP_SYS(prlimit64), 241 },
     { SCMP_SYS(waitid), 241 },
+    { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
     { SCMP_SYS(io_destroy), 241 }
 };
commit 95c1eb19eab9d57035e05a02f7184b63c1da9775
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 11:31:49 2013 +0100

    linux-user: Return success from m68k set_thread_area syscall
    
    The m68k set_thread_area syscall implementation failed to set the
    return value. Correctly set it zero, since this syscall will always
    succeed.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375093909-13653-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 3f6db4b..f986548 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8523,6 +8523,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
       {
           TaskState *ts = ((CPUArchState *)cpu_env)->opaque;
           ts->tp_value = arg1;
+          ret = 0;
           break;
       }
 #else
commit 978fae9f1ac47e22890a1bd9ebf5fa46fe8b6ef7
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 12:00:32 2013 +0100

    linux-user/signal.c: Avoid using uninitialized data in ARM sigreturn
    
    Rephrase code used in ARM sigreturn functions to avoid using
    uninitialized variables. This fixes one genuine problem ('frame'
    would not be initialized if we took the error-exit path because
    our stackpointer was misaligned) and one which is clang being
    alarmist (frame_addr wouldn't be initialized, though this is
    harmless since unlock_user_struct ignores its second argument
    in these cases; however since we don't generally make use of
    this not-really-documented effect it's better avoided).
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375095632-13735-3-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/linux-user/signal.c b/linux-user/signal.c
index d63777d..23d65da 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -1552,7 +1552,7 @@ restore_sigcontext(CPUARMState *env, struct target_sigcontext *sc)
 static long do_sigreturn_v1(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct sigframe_v1 *frame;
+        struct sigframe_v1 *frame = NULL;
 	target_sigset_t set;
         sigset_t host_set;
         int i;
@@ -1562,10 +1562,11 @@ static long do_sigreturn_v1(CPUARMState *env)
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1693,17 +1694,18 @@ static int do_sigframe_return_v2(CPUARMState *env, target_ulong frame_addr,
 static long do_sigreturn_v2(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct sigframe_v2 *frame;
+        struct sigframe_v2 *frame = NULL;
 
 	/*
 	 * Since we stacked the signal on a 64-bit boundary,
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1731,7 +1733,7 @@ long do_sigreturn(CPUARMState *env)
 static long do_rt_sigreturn_v1(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct rt_sigframe_v1 *frame;
+        struct rt_sigframe_v1 *frame = NULL;
         sigset_t host_set;
 
 	/*
@@ -1739,10 +1741,11 @@ static long do_rt_sigreturn_v1(CPUARMState *env)
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
@@ -1772,17 +1775,18 @@ badframe:
 static long do_rt_sigreturn_v2(CPUARMState *env)
 {
         abi_ulong frame_addr;
-	struct rt_sigframe_v2 *frame;
+        struct rt_sigframe_v2 *frame = NULL;
 
 	/*
 	 * Since we stacked the signal on a 64-bit boundary,
 	 * then 'sp' should be word aligned here.  If it's
 	 * not, then the user is trying to mess with us.
 	 */
-	if (env->regs[13] & 7)
-		goto badframe;
-
         frame_addr = env->regs[13];
+        if (frame_addr & 7) {
+            goto badframe;
+        }
+
 	if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))
                 goto badframe;
 
commit b04636f8665a9492143529340eab4450d492d2ee
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 12:00:31 2013 +0100

    linux-user/signal.c: PPC: Silence clang uninitialized-use warning
    
    Silence a clang warning in a PPC signal return function:
    
    /home/petmay01/linaro/qemu-from-laptop/qemu/linux-user/signal.c:4611:9: error: variable 'sr_addr' is used
          uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
        if (!lock_user_struct(VERIFY_READ, sc, sc_addr, 1))
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    /home/petmay01/linaro/qemu-from-laptop/qemu/linux-user/signal.c:4636:28: note: uninitialized use occurs here
        unlock_user_struct(sr, sr_addr, 1);
                               ^~~~~~~
    /home/petmay01/linaro/qemu-from-laptop/qemu/linux-user/qemu.h:442:27: note: expanded from macro 'unlock_user_struct'
        unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0)
                              ^
    
    This happens when we unlock a user struct which we never
    attempted to lock. Strictly, clang is actually wrong here -- it
    hasn't been able to spot that unlock_user_struct() doesn't use
    its second argument if the first is NULL. However it doesn't
    seem too unreasonable to demand that we pass in initialized
    values to it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375095632-13735-2-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/linux-user/signal.c b/linux-user/signal.c
index a5e8906..d63777d 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -4603,7 +4603,7 @@ long do_sigreturn(CPUPPCState *env)
 {
     struct target_sigcontext *sc = NULL;
     struct target_mcontext *sr = NULL;
-    target_ulong sr_addr, sc_addr;
+    target_ulong sr_addr = 0, sc_addr;
     sigset_t blocked;
     target_sigset_t set;
 
commit f6bda9cb99345158722f2e70634dda6b4d53ea67
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:39 2013 +0100

    spapr: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-5-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 46f7d5f..4ff0411 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -38,9 +38,9 @@
 /*#define DEBUG*/
 
 #ifdef DEBUG
-#define dprintf(fmt...) do { fprintf(stderr, fmt); } while (0)
+#define DPRINTF(fmt...) do { fprintf(stderr, fmt); } while (0)
 #else
-#define dprintf(fmt...)
+#define DPRINTF(fmt...)
 #endif
 
 /*
@@ -105,7 +105,7 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
     uint64_t handle;
     uint8_t control;
 
-    dprintf("spapr_vlan_receive() [%s] rx_bufs=%d\n", sdev->qdev.id,
+    DPRINTF("spapr_vlan_receive() [%s] rx_bufs=%d\n", sdev->qdev.id,
             dev->rx_bufs);
 
     if (!dev->isopen) {
@@ -123,7 +123,7 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
         }
 
         bd = vio_ldq(sdev, dev->buf_list + buf_ptr);
-        dprintf("use_buf_ptr=%d bd=0x%016llx\n",
+        DPRINTF("use_buf_ptr=%d bd=0x%016llx\n",
                 buf_ptr, (unsigned long long)bd);
     } while ((!(bd & VLAN_BD_VALID) || (VLAN_BD_LEN(bd) < (size + 8)))
              && (buf_ptr != dev->use_buf_ptr));
@@ -138,14 +138,14 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
     dev->use_buf_ptr = buf_ptr;
     vio_stq(sdev, dev->buf_list + dev->use_buf_ptr, 0);
 
-    dprintf("Found buffer: ptr=%d num=%d\n", dev->use_buf_ptr, dev->rx_bufs);
+    DPRINTF("Found buffer: ptr=%d num=%d\n", dev->use_buf_ptr, dev->rx_bufs);
 
     /* Transfer the packet data */
     if (spapr_vio_dma_write(sdev, VLAN_BD_ADDR(bd) + 8, buf, size) < 0) {
         return -1;
     }
 
-    dprintf("spapr_vlan_receive: DMA write completed\n");
+    DPRINTF("spapr_vlan_receive: DMA write completed\n");
 
     /* Update the receive queue */
     control = VLAN_RXQC_TOGGLE | VLAN_RXQC_VALID;
@@ -159,7 +159,7 @@ static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
     vio_sth(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr + 2, 8);
     vio_stb(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr, control);
 
-    dprintf("wrote rxq entry (ptr=0x%llx): 0x%016llx 0x%016llx\n",
+    DPRINTF("wrote rxq entry (ptr=0x%llx): 0x%016llx 0x%016llx\n",
             (unsigned long long)dev->rxq_ptr,
             (unsigned long long)vio_ldq(sdev, VLAN_BD_ADDR(rxq_bd) +
                                         dev->rxq_ptr),
@@ -374,7 +374,7 @@ static target_ulong h_add_logical_lan_buffer(PowerPCCPU *cpu,
     VIOsPAPRVLANDevice *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
     vlan_bd_t bd;
 
-    dprintf("H_ADD_LOGICAL_LAN_BUFFER(0x" TARGET_FMT_lx
+    DPRINTF("H_ADD_LOGICAL_LAN_BUFFER(0x" TARGET_FMT_lx
             ", 0x" TARGET_FMT_lx ")\n", reg, buf);
 
     if (!sdev) {
@@ -405,7 +405,7 @@ static target_ulong h_add_logical_lan_buffer(PowerPCCPU *cpu,
 
     dev->rx_bufs++;
 
-    dprintf("h_add_logical_lan_buffer():  Added buf  ptr=%d  rx_bufs=%d"
+    DPRINTF("h_add_logical_lan_buffer():  Added buf  ptr=%d  rx_bufs=%d"
             " bd=0x%016llx\n", dev->add_buf_ptr, dev->rx_bufs,
             (unsigned long long)buf);
 
@@ -425,14 +425,14 @@ static target_ulong h_send_logical_lan(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     int i, nbufs;
     int ret;
 
-    dprintf("H_SEND_LOGICAL_LAN(0x" TARGET_FMT_lx ", <bufs>, 0x"
+    DPRINTF("H_SEND_LOGICAL_LAN(0x" TARGET_FMT_lx ", <bufs>, 0x"
             TARGET_FMT_lx ")\n", reg, continue_token);
 
     if (!sdev) {
         return H_PARAMETER;
     }
 
-    dprintf("rxbufs = %d\n", dev->rx_bufs);
+    DPRINTF("rxbufs = %d\n", dev->rx_bufs);
 
     if (!dev->isopen) {
         return H_DROPPED;
@@ -444,7 +444,7 @@ static target_ulong h_send_logical_lan(PowerPCCPU *cpu, sPAPREnvironment *spapr,
 
     total_len = 0;
     for (i = 0; i < 6; i++) {
-        dprintf("   buf desc: 0x" TARGET_FMT_lx "\n", bufs[i]);
+        DPRINTF("   buf desc: 0x" TARGET_FMT_lx "\n", bufs[i]);
         if (!(bufs[i] & VLAN_BD_VALID)) {
             break;
         }
@@ -452,7 +452,7 @@ static target_ulong h_send_logical_lan(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     }
 
     nbufs = i;
-    dprintf("h_send_logical_lan() %d buffers, total length 0x%x\n",
+    DPRINTF("h_send_logical_lan() %d buffers, total length 0x%x\n",
             nbufs, total_len);
 
     if (total_len == 0) {
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index c3f85bf..a6a0a51 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -39,10 +39,10 @@
 /* #define DEBUG_SPAPR */
 
 #ifdef DEBUG_SPAPR
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -201,7 +201,7 @@ static target_ulong h_reg_crq(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     dev->crq.qsize = queue_len;
     dev->crq.qnext = 0;
 
-    dprintf("CRQ for dev 0x" TARGET_FMT_lx " registered at 0x"
+    DPRINTF("CRQ for dev 0x" TARGET_FMT_lx " registered at 0x"
             TARGET_FMT_lx "/0x" TARGET_FMT_lx "\n",
             reg, queue_addr, queue_len);
     return H_SUCCESS;
@@ -213,7 +213,7 @@ static target_ulong free_crq(VIOsPAPRDevice *dev)
     dev->crq.qsize = 0;
     dev->crq.qnext = 0;
 
-    dprintf("CRQ for dev 0x%" PRIx32 " freed\n", dev->reg);
+    DPRINTF("CRQ for dev 0x%" PRIx32 " freed\n", dev->reg);
 
     return H_SUCCESS;
 }
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 3f4c53f..e9090e5 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -45,10 +45,10 @@
 /*#define DEBUG_VSCSI*/
 
 #ifdef DEBUG_VSCSI
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -218,7 +218,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     int total_len = sizeof(iu->srp.rsp);
     uint8_t sol_not = iu->srp.cmd.sol_not;
 
-    dprintf("VSCSI: Sending resp status: 0x%x, "
+    DPRINTF("VSCSI: Sending resp status: 0x%x, "
             "res_in: %d, res_out: %d\n", status, res_in, res_out);
 
     memset(iu, 0, sizeof(struct srp_rsp));
@@ -279,13 +279,13 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
 
     switch (req->dma_fmt) {
     case SRP_NO_DATA_DESC: {
-        dprintf("VSCSI: no data descriptor\n");
+        DPRINTF("VSCSI: no data descriptor\n");
         return 0;
     }
     case SRP_DATA_DESC_DIRECT: {
         memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret));
         assert(req->cur_desc_num == 0);
-        dprintf("VSCSI: direct segment\n");
+        DPRINTF("VSCSI: direct segment\n");
         break;
     }
     case SRP_DATA_DESC_INDIRECT: {
@@ -293,7 +293,7 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
                                        (cmd->add_data + req->cdb_offset);
         if (n < req->local_desc) {
             *ret = tmp->desc_list[n];
-            dprintf("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
+            DPRINTF("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
                     req->qtag, n, req->local_desc);
 
         } else if (n < req->total_desc) {
@@ -302,21 +302,21 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
             unsigned desc_offset = n * sizeof(struct srp_direct_buf);
 
             if (desc_offset >= tbl_desc.len) {
-                dprintf("VSCSI:   #%d is ouf of range (%d bytes)\n",
+                DPRINTF("VSCSI:   #%d is ouf of range (%d bytes)\n",
                         n, desc_offset);
                 return -1;
             }
             rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset,
                                     ret, sizeof(struct srp_direct_buf));
             if (rc) {
-                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
+                DPRINTF("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
                         rc);
                 return -1;
             }
-            dprintf("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
+            DPRINTF("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
                     req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len);
         } else {
-            dprintf("VSCSI:   Out of descriptors !\n");
+            DPRINTF("VSCSI:   Out of descriptors !\n");
             return 0;
         }
         break;
@@ -328,14 +328,14 @@ static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
 
     *ret = vscsi_swap_desc(*ret);
     if (buf_offset > ret->len) {
-        dprintf("   offset=%x is out of a descriptor #%d boundary=%x\n",
+        DPRINTF("   offset=%x is out of a descriptor #%d boundary=%x\n",
                 buf_offset, req->cur_desc_num, ret->len);
         return -1;
     }
     ret->va += buf_offset;
     ret->len -= buf_offset;
 
-    dprintf("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
+    DPRINTF("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
             req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len);
 
     return ret->len ? 1 : 0;
@@ -379,7 +379,7 @@ static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
     int rc = 0;
     uint32_t llen, total = 0;
 
-    dprintf("VSCSI: indirect segment 0x%x bytes\n", len);
+    DPRINTF("VSCSI: indirect segment 0x%x bytes\n", len);
 
     /* While we have data ... */
     while (len) {
@@ -398,10 +398,10 @@ static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
             rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
         if (rc) {
-            dprintf("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
+            DPRINTF("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
             break;
         }
-        dprintf("VSCSI:     data: %02x %02x %02x %02x...\n",
+        DPRINTF("VSCSI:     data: %02x %02x %02x %02x...\n",
                 buf[0], buf[1], buf[2], buf[3]);
 
         len -= llen;
@@ -428,7 +428,7 @@ static int vscsi_srp_transfer_data(VSCSIState *s, vscsi_req *req,
 
     switch (req->dma_fmt) {
     case SRP_NO_DATA_DESC:
-        dprintf("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
+        DPRINTF("VSCSI: no data desc transfer, skipping 0x%x bytes\n", len);
         break;
     case SRP_DATA_DESC_DIRECT:
         err = vscsi_srp_direct_data(s, req, buf, len);
@@ -508,7 +508,7 @@ static void vscsi_transfer_data(SCSIRequest *sreq, uint32_t len)
     uint8_t *buf;
     int rc = 0;
 
-    dprintf("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
+    DPRINTF("VSCSI: SCSI xfer complete tag=0x%x len=0x%x, req=%p\n",
             sreq->tag, len, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
@@ -538,7 +538,7 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     vscsi_req *req = sreq->hba_private;
     int32_t res_in = 0, res_out = 0;
 
-    dprintf("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
+    DPRINTF("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
             sreq->tag, status, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
@@ -548,16 +548,16 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     if (status == CHECK_CONDITION) {
         req->senselen = scsi_req_get_sense(req->sreq, req->sense,
                                            sizeof(req->sense));
-        dprintf("VSCSI: Sense data, %d bytes:\n", req->senselen);
-        dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
+        DPRINTF("VSCSI: Sense data, %d bytes:\n", req->senselen);
+        DPRINTF("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[0], req->sense[1], req->sense[2], req->sense[3],
                 req->sense[4], req->sense[5], req->sense[6], req->sense[7]);
-        dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
+        DPRINTF("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[8], req->sense[9], req->sense[10], req->sense[11],
                 req->sense[12], req->sense[13], req->sense[14], req->sense[15]);
     }
 
-    dprintf("VSCSI: Command complete err=%d\n", status);
+    DPRINTF("VSCSI: Command complete err=%d\n", status);
     if (status == 0) {
         /* We handle overflows, not underflows for normal commands,
          * but hopefully nobody cares
@@ -611,7 +611,7 @@ static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 
     vmstate_save_state(f, &vmstate_spapr_vscsi_req, req);
 
-    dprintf("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
+    DPRINTF("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
             req->qtag, req->cur_desc_num, req->cur_desc_offset);
 }
 
@@ -636,7 +636,7 @@ static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 
     req->sreq = scsi_req_ref(sreq);
 
-    dprintf("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
+    DPRINTF("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
             req->qtag, req->cur_desc_num, req->cur_desc_offset);
 
     return req;
@@ -648,7 +648,7 @@ static void vscsi_process_login(VSCSIState *s, vscsi_req *req)
     struct srp_login_rsp *rsp = &iu->srp.login_rsp;
     uint64_t tag = iu->srp.rsp.tag;
 
-    dprintf("VSCSI: Got login, sendin response !\n");
+    DPRINTF("VSCSI: Got login, sendin response !\n");
 
     /* TODO handle case that requested size is wrong and
      * buffer format is wrong
@@ -714,7 +714,8 @@ static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
 
     sdev = vscsi_device_find(&s->bus, be64_to_cpu(srp->cmd.lun), &lun);
     if (!sdev) {
-        dprintf("VSCSI: Command for lun %08" PRIx64 " with no drive\n", be64_to_cpu(srp->cmd.lun));
+        DPRINTF("VSCSI: Command for lun %08" PRIx64 " with no drive\n",
+                be64_to_cpu(srp->cmd.lun));
         if (srp->cmd.cdb[0] == INQUIRY) {
             vscsi_inquiry_no_target(s, req);
         } else {
@@ -726,7 +727,7 @@ static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
     req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req);
     n = scsi_req_enqueue(req->sreq);
 
-    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
+    DPRINTF("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
             req->qtag, srp->cmd.cdb[0], lun, n);
 
     if (n) {
@@ -939,7 +940,7 @@ static int vscsi_do_crq(struct VIOsPAPRDevice *dev, uint8_t *crq_data)
     crq.s.IU_length = be16_to_cpu(crq.s.IU_length);
     crq.s.IU_data_ptr = be64_to_cpu(crq.s.IU_data_ptr);
 
-    dprintf("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
+    DPRINTF("VSCSI: do_crq %02x %02x ...\n", crq.raw[0], crq.raw[1]);
 
     switch (crq.s.valid) {
     case 0xc0: /* Init command/response */
diff --git a/roms/seabios b/roms/seabios
index c02c219..d4f7d90 160000
--- a/roms/seabios
+++ b/roms/seabios
@@ -1 +1 @@
-Subproject commit c02c219cd79299a0a153ecf862f0e301a057f2cb
+Subproject commit d4f7d90f47462b4e8836899adc5060fbde5253e9
commit da56ff91982f25c03c997309f3d5ed6aab1e0100
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:38 2013 +0100

    target-ppc/kvm.c: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-4-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 27e2aaf..30a870e 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -40,10 +40,10 @@
 //#define DEBUG_KVM
 
 #ifdef DEBUG_KVM
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -550,7 +550,7 @@ static int kvm_put_fp(CPUState *cs)
         reg.addr = (uintptr_t)&fpscr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set FPSCR to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set FPSCR to KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -564,7 +564,7 @@ static int kvm_put_fp(CPUState *cs)
 
             ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to set %s%d to KVM: %s\n", vsx ? "VSR" : "FPR",
+                DPRINTF("Unable to set %s%d to KVM: %s\n", vsx ? "VSR" : "FPR",
                         i, strerror(errno));
                 return ret;
             }
@@ -576,7 +576,7 @@ static int kvm_put_fp(CPUState *cs)
         reg.addr = (uintptr_t)&env->vscr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VSCR to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VSCR to KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -585,7 +585,7 @@ static int kvm_put_fp(CPUState *cs)
             reg.addr = (uintptr_t)&env->avr[i];
             ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to set VR%d to KVM: %s\n", i, strerror(errno));
+                DPRINTF("Unable to set VR%d to KVM: %s\n", i, strerror(errno));
                 return ret;
             }
         }
@@ -610,7 +610,7 @@ static int kvm_get_fp(CPUState *cs)
         reg.addr = (uintptr_t)&fpscr;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to get FPSCR from KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to get FPSCR from KVM: %s\n", strerror(errno));
             return ret;
         } else {
             env->fpscr = fpscr;
@@ -624,7 +624,7 @@ static int kvm_get_fp(CPUState *cs)
 
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to get %s%d from KVM: %s\n",
+                DPRINTF("Unable to get %s%d from KVM: %s\n",
                         vsx ? "VSR" : "FPR", i, strerror(errno));
                 return ret;
             } else {
@@ -641,7 +641,7 @@ static int kvm_get_fp(CPUState *cs)
         reg.addr = (uintptr_t)&env->vscr;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to get VSCR from KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to get VSCR from KVM: %s\n", strerror(errno));
             return ret;
         }
 
@@ -650,7 +650,7 @@ static int kvm_get_fp(CPUState *cs)
             reg.addr = (uintptr_t)&env->avr[i];
             ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
             if (ret < 0) {
-                dprintf("Unable to get VR%d from KVM: %s\n",
+                DPRINTF("Unable to get VR%d from KVM: %s\n",
                         i, strerror(errno));
                 return ret;
             }
@@ -672,7 +672,7 @@ static int kvm_get_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->vpa_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get VPA address from KVM: %s\n", strerror(errno));
+        DPRINTF("Unable to get VPA address from KVM: %s\n", strerror(errno));
         return ret;
     }
 
@@ -682,7 +682,7 @@ static int kvm_get_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->slb_shadow_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get SLB shadow state from KVM: %s\n",
+        DPRINTF("Unable to get SLB shadow state from KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -692,7 +692,7 @@ static int kvm_get_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->dtl_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to get dispatch trace log state from KVM: %s\n",
+        DPRINTF("Unable to get dispatch trace log state from KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -718,7 +718,7 @@ static int kvm_put_vpa(CPUState *cs)
         reg.addr = (uintptr_t)&env->vpa_addr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VPA address to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VPA address to KVM: %s\n", strerror(errno));
             return ret;
         }
     }
@@ -729,7 +729,7 @@ static int kvm_put_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->slb_shadow_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to set SLB shadow state to KVM: %s\n", strerror(errno));
+        DPRINTF("Unable to set SLB shadow state to KVM: %s\n", strerror(errno));
         return ret;
     }
 
@@ -738,7 +738,7 @@ static int kvm_put_vpa(CPUState *cs)
     reg.addr = (uintptr_t)&env->dtl_addr;
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret < 0) {
-        dprintf("Unable to set dispatch trace log state to KVM: %s\n",
+        DPRINTF("Unable to set dispatch trace log state to KVM: %s\n",
                 strerror(errno));
         return ret;
     }
@@ -748,7 +748,7 @@ static int kvm_put_vpa(CPUState *cs)
         reg.addr = (uintptr_t)&env->vpa_addr;
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret < 0) {
-            dprintf("Unable to set VPA address to KVM: %s\n", strerror(errno));
+            DPRINTF("Unable to set VPA address to KVM: %s\n", strerror(errno));
             return ret;
         }
     }
@@ -866,7 +866,7 @@ int kvm_arch_put_registers(CPUState *cs, int level)
 #ifdef TARGET_PPC64
         if (cap_papr) {
             if (kvm_put_vpa(cs) < 0) {
-                dprintf("Warning: Unable to set VPA information to KVM\n");
+                DPRINTF("Warning: Unable to set VPA information to KVM\n");
             }
         }
 #endif /* TARGET_PPC64 */
@@ -1075,7 +1075,7 @@ int kvm_arch_get_registers(CPUState *cs)
 #ifdef TARGET_PPC64
         if (cap_papr) {
             if (kvm_get_vpa(cs) < 0) {
-                dprintf("Warning: Unable to get VPA information from KVM\n");
+                DPRINTF("Warning: Unable to get VPA information from KVM\n");
             }
         }
 #endif
@@ -1129,7 +1129,7 @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
          */
         irq = KVM_INTERRUPT_SET;
 
-        dprintf("injected interrupt %d\n", irq);
+        DPRINTF("injected interrupt %d\n", irq);
         r = kvm_vcpu_ioctl(cs, KVM_INTERRUPT, &irq);
         if (r < 0) {
             printf("cpu %d fail inject %x\n", cs->cpu_index, irq);
@@ -1193,20 +1193,20 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     switch (run->exit_reason) {
     case KVM_EXIT_DCR:
         if (run->dcr.is_write) {
-            dprintf("handle dcr write\n");
+            DPRINTF("handle dcr write\n");
             ret = kvmppc_handle_dcr_write(env, run->dcr.dcrn, run->dcr.data);
         } else {
-            dprintf("handle dcr read\n");
+            DPRINTF("handle dcr read\n");
             ret = kvmppc_handle_dcr_read(env, run->dcr.dcrn, &run->dcr.data);
         }
         break;
     case KVM_EXIT_HLT:
-        dprintf("handle halt\n");
+        DPRINTF("handle halt\n");
         ret = kvmppc_handle_halt(cpu);
         break;
 #if defined(TARGET_PPC64)
     case KVM_EXIT_PAPR_HCALL:
-        dprintf("handle PAPR hypercall\n");
+        DPRINTF("handle PAPR hypercall\n");
         run->papr_hcall.ret = spapr_hypercall(cpu,
                                               run->papr_hcall.nr,
                                               run->papr_hcall.args);
@@ -1214,12 +1214,12 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
         break;
 #endif
     case KVM_EXIT_EPR:
-        dprintf("handle epr\n");
+        DPRINTF("handle epr\n");
         run->epr.epr = ldl_phys(env->mpic_iack);
         ret = 0;
         break;
     case KVM_EXIT_WATCHDOG:
-        dprintf("handle watchdog expiry\n");
+        DPRINTF("handle watchdog expiry\n");
         watchdog_perform_action();
         ret = 0;
         break;
commit e67137c6c5823ad9488b766c79f0963f6ba70f12
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:37 2013 +0100

    s390x: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-3-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index 207eb82..f0aa941 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -38,10 +38,10 @@
 /* #define DEBUG_S390 */
 
 #ifdef DEBUG_S390
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
diff --git a/hw/s390x/s390-virtio.c b/hw/s390x/s390-virtio.c
index edbde00..439d732 100644
--- a/hw/s390x/s390-virtio.c
+++ b/hw/s390x/s390-virtio.c
@@ -41,10 +41,10 @@
 //#define DEBUG_S390
 
 #ifdef DEBUG_S390
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 85f0112..ab0e2b5 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -40,10 +40,10 @@
 /* #define DEBUG_KVM */
 
 #ifdef DEBUG_KVM
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
 #else
-#define dprintf(fmt, ...) \
+#define DPRINTF(fmt, ...) \
     do { } while (0)
 #endif
 
@@ -581,7 +581,7 @@ static int handle_priv(S390CPU *cpu, struct kvm_run *run,
     uint16_t ipbh0 = (run->s390_sieic.ipb & 0xffff0000) >> 16;
     uint8_t ipb = run->s390_sieic.ipb & 0xff;
 
-    dprintf("KVM: PRIV: %d\n", ipa1);
+    DPRINTF("KVM: PRIV: %d\n", ipa1);
     switch (ipa1) {
         case PRIV_SCLP_CALL:
             r = kvm_sclp_service_call(cpu, run, ipbh0);
@@ -594,7 +594,7 @@ static int handle_priv(S390CPU *cpu, struct kvm_run *run,
                     r = 0;
                 }
             } else {
-                dprintf("KVM: unknown PRIV: 0x%x\n", ipa1);
+                DPRINTF("KVM: unknown PRIV: 0x%x\n", ipa1);
                 r = -1;
             }
             break;
@@ -627,7 +627,7 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *run, int ipb_code)
             sleep(10);
             break;
         default:
-            dprintf("KVM: unknown DIAG: 0x%x\n", ipb_code);
+            DPRINTF("KVM: unknown DIAG: 0x%x\n", ipb_code);
             r = -1;
             break;
     }
@@ -640,7 +640,7 @@ static int s390_cpu_restart(S390CPU *cpu)
     kvm_s390_interrupt(cpu, KVM_S390_RESTART, 0);
     s390_add_running_cpu(cpu);
     qemu_cpu_kick(CPU(cpu));
-    dprintf("DONE: SIGP cpu restart: %p\n", &cpu->env);
+    DPRINTF("DONE: SIGP cpu restart: %p\n", &cpu->env);
     return 0;
 }
 
@@ -668,7 +668,7 @@ static int s390_cpu_initial_reset(S390CPU *cpu)
         env->regs[i] = 0;
     }
 
-    dprintf("DONE: SIGP initial reset: %p\n", env);
+    DPRINTF("DONE: SIGP initial reset: %p\n", env);
     return 0;
 }
 
@@ -737,7 +737,8 @@ static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
     int ipb_code = (run->s390_sieic.ipb & 0x0fff0000) >> 16;
     int r = -1;
 
-    dprintf("handle_instruction 0x%x 0x%x\n", run->s390_sieic.ipa, run->s390_sieic.ipb);
+    DPRINTF("handle_instruction 0x%x 0x%x\n",
+            run->s390_sieic.ipa, run->s390_sieic.ipb);
     switch (ipa0) {
     case IPA0_B2:
     case IPA0_B9:
@@ -771,7 +772,7 @@ static int handle_intercept(S390CPU *cpu)
     int icpt_code = run->s390_sieic.icptcode;
     int r = 0;
 
-    dprintf("intercept: 0x%x (at 0x%lx)\n", icpt_code,
+    DPRINTF("intercept: 0x%x (at 0x%lx)\n", icpt_code,
             (long)cs->kvm_run->psw_addr);
     switch (icpt_code) {
         case ICPT_INSTRUCTION:
commit 2440a2c3dfcb9bc463be8ff5a97382e4d2aad750
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 13:16:36 2013 +0100

    block/sheepdog: Rename 'dprintf' to 'DPRINTF'
    
    'dprintf' is the name of a POSIX standard function so we should not be
    stealing it for our debug macro. Rename to 'DPRINTF' (in line with
    a number of other source files.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Message-id: 1375100199-13934-2-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block/sheepdog.c b/block/sheepdog.c
index 6a41ad9..a506137 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -242,14 +242,14 @@ static inline bool is_snapshot(struct SheepdogInode *inode)
     return !!inode->snap_ctime;
 }
 
-#undef dprintf
+#undef DPRINTF
 #ifdef DEBUG_SDOG
-#define dprintf(fmt, args...)                                       \
+#define DPRINTF(fmt, args...)                                       \
     do {                                                            \
         fprintf(stdout, "%s %d: " fmt, __func__, __LINE__, ##args); \
     } while (0)
 #else
-#define dprintf(fmt, args...)
+#define DPRINTF(fmt, args...)
 #endif
 
 typedef struct SheepdogAIOCB SheepdogAIOCB;
@@ -729,7 +729,7 @@ static void coroutine_fn aio_read_response(void *opaque)
         break;
     case AIOCB_FLUSH_CACHE:
         if (rsp.result == SD_RES_INVALID_PARMS) {
-            dprintf("disable cache since the server doesn't support it\n");
+            DPRINTF("disable cache since the server doesn't support it\n");
             s->cache_flags = SD_FLAG_CMD_DIRECT;
             rsp.result = SD_RES_SUCCESS;
         }
@@ -1229,7 +1229,7 @@ static int coroutine_fn resend_aioreq(BDRVSheepdogState *s, AIOReq *aio_req)
          * the same object */
         QLIST_FOREACH(areq, &s->inflight_aio_head, aio_siblings) {
             if (areq != aio_req && areq->oid == aio_req->oid) {
-                dprintf("simultaneous CoW to %" PRIx64 "\n", aio_req->oid);
+                DPRINTF("simultaneous CoW to %" PRIx64 "\n", aio_req->oid);
                 QLIST_REMOVE(aio_req, aio_siblings);
                 QLIST_INSERT_HEAD(&s->pending_aio_head, aio_req, aio_siblings);
                 return SD_RES_SUCCESS;
@@ -1319,7 +1319,7 @@ static int sd_open(BlockDriverState *bs, QDict *options, int flags)
     s->discard_supported = true;
 
     if (snapid || tag[0] != '\0') {
-        dprintf("%" PRIx32 " snapshot inode was open.\n", vid);
+        DPRINTF("%" PRIx32 " snapshot inode was open.\n", vid);
         s->is_snapshot = true;
     }
 
@@ -1554,7 +1554,7 @@ static void sd_close(BlockDriverState *bs)
     unsigned int wlen, rlen = 0;
     int fd, ret;
 
-    dprintf("%s\n", s->name);
+    DPRINTF("%s\n", s->name);
 
     fd = connect_to_sdog(s);
     if (fd < 0) {
@@ -1714,7 +1714,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
     char *buf;
     bool deleted;
 
-    dprintf("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
 
     buf = g_malloc(SD_INODE_SIZE);
 
@@ -1730,7 +1730,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
         goto out;
     }
 
-    dprintf("%" PRIx32 " is created.\n", vid);
+    DPRINTF("%" PRIx32 " is created.\n", vid);
 
     fd = connect_to_sdog(s);
     if (fd < 0) {
@@ -1751,7 +1751,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
 
     s->is_snapshot = false;
     ret = 0;
-    dprintf("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
 
 out:
     g_free(buf);
@@ -1841,11 +1841,11 @@ static int coroutine_fn sd_co_rw_vector(void *p)
         }
 
         if (create) {
-            dprintf("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
+            DPRINTF("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
                     inode->vdi_id, oid,
                     vid_to_data_oid(inode->data_vdi_id[idx], idx), idx);
             oid = vid_to_data_oid(inode->vdi_id, idx);
-            dprintf("new oid %" PRIx64 "\n", oid);
+            DPRINTF("new oid %" PRIx64 "\n", oid);
         }
 
         aio_req = alloc_aio_req(s, acb, oid, len, offset, flags, old_oid, done);
@@ -1978,7 +1978,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
     SheepdogInode *inode;
     unsigned int datalen;
 
-    dprintf("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
+    DPRINTF("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
             "is_snapshot %d\n", sn_info->name, sn_info->id_str,
             s->name, sn_info->vm_state_size, s->is_snapshot);
 
@@ -1989,7 +1989,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
         return -EINVAL;
     }
 
-    dprintf("%s %s\n", sn_info->name, sn_info->id_str);
+    DPRINTF("%s %s\n", sn_info->name, sn_info->id_str);
 
     s->inode.vm_state_size = sn_info->vm_state_size;
     s->inode.vm_clock_nsec = sn_info->vm_clock_nsec;
@@ -2033,7 +2033,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
     }
 
     memcpy(&s->inode, inode, datalen);
-    dprintf("s->inode: name %s snap_id %x oid %x\n",
+    DPRINTF("s->inode: name %s snap_id %x oid %x\n",
             s->inode.name, s->inode.snap_id, s->inode.vdi_id);
 
 cleanup:
commit 398489018183d613306ab022653552247d93919f
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:57 2013 +0200

    pc: limit 64 bit hole to 2G by default
    
    It turns out that some 32 bit windows guests crash
    if 64 bit PCI hole size is >2G.
    Limit it to 2G for piix and q35 by default.
    User may override default 64-bit PCI hole size by
    using "pci-hole64-size" property.
    
    Examples:
    -global i440FX-pcihost.pci-hole64-size=4G
    
    -global q35-pcihost.pci-hole64-size=4G
    
    Reported-by: Igor Mammedov <imammedo at redhat.com>,
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-8-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index b0b98a8..a2b9d88 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -55,6 +55,7 @@
 #include "hw/acpi/acpi.h"
 #include "hw/cpu/icc_bus.h"
 #include "hw/boards.h"
+#include "hw/pci/pci_host.h"
 
 /* debug PC/ISA interrupts */
 //#define DEBUG_IRQ
@@ -1003,15 +1004,27 @@ typedef struct PcRomPciInfo {
 static void pc_fw_cfg_guest_info(PcGuestInfo *guest_info)
 {
     PcRomPciInfo *info;
+    Object *pci_info;
+    bool ambiguous = false;
+
     if (!guest_info->has_pci_info || !guest_info->fw_cfg) {
         return;
     }
+    pci_info = object_resolve_path_type("", TYPE_PCI_HOST_BRIDGE, &ambiguous);
+    g_assert(!ambiguous);
+    if (!pci_info) {
+        return;
+    }
 
     info = g_malloc(sizeof *info);
-    info->w32_min = cpu_to_le64(guest_info->pci_info.w32.begin);
-    info->w32_max = cpu_to_le64(guest_info->pci_info.w32.end);
-    info->w64_min = cpu_to_le64(guest_info->pci_info.w64.begin);
-    info->w64_max = cpu_to_le64(guest_info->pci_info.w64.end);
+    info->w32_min = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE_START, NULL));
+    info->w32_max = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE_END, NULL));
+    info->w64_min = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE64_START, NULL));
+    info->w64_max = cpu_to_le64(object_property_get_int(pci_info,
+                                PCI_HOST_PROP_PCI_HOLE64_END, NULL));
     /* Pass PCI hole info to guest via a side channel.
      * Required so guest PCI enumeration does the right thing. */
     fw_cfg_add_file(guest_info->fw_cfg, "etc/pci-info", info, sizeof *info);
@@ -1037,29 +1050,28 @@ PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
     PcGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state);
     PcGuestInfo *guest_info = &guest_info_state->info;
 
-    guest_info->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
-    if (sizeof(hwaddr) == 4) {
-        guest_info->pci_info.w64.begin = 0;
-        guest_info->pci_info.w64.end = 0;
-    } else {
-        /*
-         * BIOS does not set MTRR entries for the 64 bit window, so no need to
-         * align address to power of two.  Align address at 1G, this makes sure
-         * it can be exactly covered with a PAT entry even when using huge
-         * pages.
-         */
-        guest_info->pci_info.w64.begin =
-            ROUND_UP((0x1ULL << 32) + above_4g_mem_size, 0x1ULL << 30);
-        guest_info->pci_info.w64.end = guest_info->pci_info.w64.begin +
-            (0x1ULL << 62);
-        assert(guest_info->pci_info.w64.begin <= guest_info->pci_info.w64.end);
-    }
-
     guest_info_state->machine_done.notify = pc_guest_info_machine_done;
     qemu_add_machine_init_done_notifier(&guest_info_state->machine_done);
     return guest_info;
 }
 
+void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
+                        uint64_t pci_hole64_size)
+{
+    if ((sizeof(hwaddr) == 4) || (!pci_hole64_size)) {
+        return;
+    }
+    /*
+     * BIOS does not set MTRR entries for the 64 bit window, so no need to
+     * align address to power of two.  Align address at 1G, this makes sure
+     * it can be exactly covered with a PAT entry even when using huge
+     * pages.
+     */
+    pci_info->w64.begin = ROUND_UP(pci_hole64_start, 0x1ULL << 30);
+    pci_info->w64.end = pci_info->w64.begin + pci_hole64_size;
+    assert(pci_info->w64.begin <= pci_info->w64.end);
+}
+
 void pc_acpi_init(const char *default_dsdt)
 {
     char *filename;
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index b58c255..ab25458 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -129,15 +129,6 @@ static void pc_init1(MemoryRegion *system_memory,
     guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size);
     guest_info->has_pci_info = has_pci_info;
 
-    /* Set PCI window size the way seabios has always done it. */
-    /* Power of 2 so bios can cover it with a single MTRR */
-    if (ram_size <= 0x80000000)
-        guest_info->pci_info.w32.begin = 0x80000000;
-    else if (ram_size <= 0xc0000000)
-        guest_info->pci_info.w32.begin = 0xc0000000;
-    else
-        guest_info->pci_info.w32.begin = 0xe0000000;
-
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
         fw_cfg = pc_memory_init(system_memory,
@@ -160,10 +151,7 @@ static void pc_init1(MemoryRegion *system_memory,
                               system_memory, system_io, ram_size,
                               below_4g_mem_size,
                               0x100000000ULL - below_4g_mem_size,
-                              0x100000000ULL + above_4g_mem_size,
-                              (sizeof(hwaddr) == 4
-                               ? 0
-                               : ((uint64_t)1 << 62)),
+                              above_4g_mem_size,
                               pci_memory, ram_memory);
     } else {
         pci_bus = NULL;
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 3f539ec..dc1718f 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -32,6 +32,8 @@
 #include "hw/xen/xen.h"
 #include "hw/pci-host/pam.h"
 #include "sysemu/sysemu.h"
+#include "hw/i386/ioapic.h"
+#include "qapi/visitor.h"
 
 /*
  * I440FX chipset data sheet.
@@ -44,6 +46,8 @@
 
 typedef struct I440FXState {
     PCIHostState parent_obj;
+    PcPciInfo pci_info;
+    uint64_t pci_hole64_size;
 } I440FXState;
 
 #define PIIX_NUM_PIC_IRQS       16      /* i8259 * 2 */
@@ -207,14 +211,71 @@ static const VMStateDescription vmstate_i440fx = {
     }
 };
 
+static void i440fx_pcihost_get_pci_hole_start(Object *obj, Visitor *v,
+                                              void *opaque, const char *name,
+                                              Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+    uint32_t value = s->pci_info.w32.begin;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole_end(Object *obj, Visitor *v,
+                                            void *opaque, const char *name,
+                                            Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+    uint32_t value = s->pci_info.w32.end;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole64_start(Object *obj, Visitor *v,
+                                                void *opaque, const char *name,
+                                                Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+
+    visit_type_uint64(v, &s->pci_info.w64.begin, name, errp);
+}
+
+static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v,
+                                              void *opaque, const char *name,
+                                              Error **errp)
+{
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
+
+    visit_type_uint64(v, &s->pci_info.w64.end, name, errp);
+}
+
 static void i440fx_pcihost_initfn(Object *obj)
 {
     PCIHostState *s = PCI_HOST_BRIDGE(obj);
+    I440FXState *d = I440FX_PCI_HOST_BRIDGE(obj);
 
     memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
     memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s,
                           "pci-conf-data", 4);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "int",
+                        i440fx_pcihost_get_pci_hole_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "int",
+                        i440fx_pcihost_get_pci_hole_end,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "int",
+                        i440fx_pcihost_get_pci_hole64_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "int",
+                        i440fx_pcihost_get_pci_hole64_end,
+                        NULL, NULL, NULL, NULL);
+
+    d->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
 }
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
@@ -247,8 +308,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
                     ram_addr_t ram_size,
                     hwaddr pci_hole_start,
                     hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
+                    ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_address_space,
                     MemoryRegion *ram_memory)
 {
@@ -259,6 +319,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
     PIIX3State *piix3;
     PCII440FXState *f;
     unsigned i;
+    I440FXState *i440fx;
 
     dev = qdev_create(NULL, TYPE_I440FX_PCI_HOST_BRIDGE);
     s = PCI_HOST_BRIDGE(dev);
@@ -274,14 +335,31 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
     f->system_memory = address_space_mem;
     f->pci_address_space = pci_address_space;
     f->ram_memory = ram_memory;
+
+    i440fx = I440FX_PCI_HOST_BRIDGE(dev);
+    /* Set PCI window size the way seabios has always done it. */
+    /* Power of 2 so bios can cover it with a single MTRR */
+    if (ram_size <= 0x80000000) {
+        i440fx->pci_info.w32.begin = 0x80000000;
+    } else if (ram_size <= 0xc0000000) {
+        i440fx->pci_info.w32.begin = 0xc0000000;
+    } else {
+        i440fx->pci_info.w32.begin = 0xe0000000;
+    }
+
     memory_region_init_alias(&f->pci_hole, OBJECT(d), "pci-hole", f->pci_address_space,
                              pci_hole_start, pci_hole_size);
     memory_region_add_subregion(f->system_memory, pci_hole_start, &f->pci_hole);
+
+    pc_init_pci64_hole(&i440fx->pci_info, 0x100000000ULL + above_4g_mem_size,
+                       i440fx->pci_hole64_size);
     memory_region_init_alias(&f->pci_hole_64bit, OBJECT(d), "pci-hole64",
                              f->pci_address_space,
-                             pci_hole64_start, pci_hole64_size);
-    if (pci_hole64_size) {
-        memory_region_add_subregion(f->system_memory, pci_hole64_start,
+                             i440fx->pci_info.w64.begin,
+                             i440fx->pci_hole64_size);
+    if (i440fx->pci_hole64_size) {
+        memory_region_add_subregion(f->system_memory,
+                                    i440fx->pci_info.w64.begin,
                                     &f->pci_hole_64bit);
     }
     memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
@@ -629,6 +707,12 @@ static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
     return "0000";
 }
 
+static Property i440fx_props[] = {
+    DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, I440FXState,
+                     pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -638,6 +722,7 @@ static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
     dc->realize = i440fx_pcihost_realize;
     dc->fw_name = "pci";
     dc->no_user = 1;
+    dc->props = i440fx_props;
 }
 
 static const TypeInfo i440fx_pcihost_info = {
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 69234de..12314d8 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
  */
 #include "hw/hw.h"
 #include "hw/pci-host/q35.h"
+#include "qapi/visitor.h"
 
 /****************************************************************************
  * Q35 host
@@ -64,9 +65,49 @@ static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
     return "0000";
 }
 
+static void q35_host_get_pci_hole_start(Object *obj, Visitor *v,
+                                        void *opaque, const char *name,
+                                        Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    uint32_t value = s->mch.pci_info.w32.begin;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void q35_host_get_pci_hole_end(Object *obj, Visitor *v,
+                                      void *opaque, const char *name,
+                                      Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+    uint32_t value = s->mch.pci_info.w32.end;
+
+    visit_type_uint32(v, &value, name, errp);
+}
+
+static void q35_host_get_pci_hole64_start(Object *obj, Visitor *v,
+                                          void *opaque, const char *name,
+                                          Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+
+    visit_type_uint64(v, &s->mch.pci_info.w64.begin, name, errp);
+}
+
+static void q35_host_get_pci_hole64_end(Object *obj, Visitor *v,
+                                        void *opaque, const char *name,
+                                        Error **errp)
+{
+    Q35PCIHost *s = Q35_HOST_DEVICE(obj);
+
+    visit_type_uint64(v, &s->mch.pci_info.w64.end, name, errp);
+}
+
 static Property mch_props[] = {
     DEFINE_PROP_UINT64("MCFG", Q35PCIHost, parent_obj.base_addr,
                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
+    DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, Q35PCIHost,
+                     mch.pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -96,6 +137,31 @@ static void q35_host_initfn(Object *obj)
     object_property_add_child(OBJECT(s), "mch", OBJECT(&s->mch), NULL);
     qdev_prop_set_uint32(DEVICE(&s->mch), "addr", PCI_DEVFN(0, 0));
     qdev_prop_set_bit(DEVICE(&s->mch), "multifunction", false);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "int",
+                        q35_host_get_pci_hole_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, "int",
+                        q35_host_get_pci_hole_end,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, "int",
+                        q35_host_get_pci_hole64_start,
+                        NULL, NULL, NULL, NULL);
+
+    object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, "int",
+                        q35_host_get_pci_hole64_end,
+                        NULL, NULL, NULL, NULL);
+
+    /* Leave enough space for the biggest MCFG BAR */
+    /* TODO: this matches current bios behaviour, but
+     * it's not a power of two, which means an MTRR
+     * can't cover it exactly.
+     */
+    s->mch.pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
+        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
+    s->mch.pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;
 }
 
 static const TypeInfo q35_host_info = {
@@ -253,17 +319,8 @@ static void mch_reset(DeviceState *qdev)
 static int mch_init(PCIDevice *d)
 {
     int i;
-    hwaddr pci_hole64_size;
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
-    /* Leave enough space for the biggest MCFG BAR */
-    /* TODO: this matches current bios behaviour, but
-     * it's not a power of two, which means an MTRR
-     * can't cover it exactly.
-     */
-    mch->guest_info->pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT +
-        MCH_HOST_BRIDGE_PCIEXBAR_MAX;
-
     /* setup pci memory regions */
     memory_region_init_alias(&mch->pci_hole, OBJECT(mch), "pci-hole",
                              mch->pci_address_space,
@@ -271,15 +328,16 @@ static int mch_init(PCIDevice *d)
                              0x100000000ULL - mch->below_4g_mem_size);
     memory_region_add_subregion(mch->system_memory, mch->below_4g_mem_size,
                                 &mch->pci_hole);
-    pci_hole64_size = (sizeof(hwaddr) == 4 ? 0 :
-                       ((uint64_t)1 << 62));
+
+    pc_init_pci64_hole(&mch->pci_info, 0x100000000ULL + mch->above_4g_mem_size,
+                       mch->pci_hole64_size);
     memory_region_init_alias(&mch->pci_hole_64bit, OBJECT(mch), "pci-hole64",
                              mch->pci_address_space,
-                             0x100000000ULL + mch->above_4g_mem_size,
-                             pci_hole64_size);
-    if (pci_hole64_size) {
+                             mch->pci_info.w64.begin,
+                             mch->pci_hole64_size);
+    if (mch->pci_hole64_size) {
         memory_region_add_subregion(mch->system_memory,
-                                    0x100000000ULL + mch->above_4g_mem_size,
+                                    mch->pci_info.w64.begin,
                                     &mch->pci_hole_64bit);
     }
     /* smram */
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 09c2dd4..3a0c4e3 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -18,7 +18,6 @@ typedef struct PcPciInfo {
 } PcPciInfo;
 
 struct PcGuestInfo {
-    PcPciInfo pci_info;
     bool has_pci_info;
     FWCfgState *fw_cfg;
 };
@@ -101,6 +100,16 @@ void pc_acpi_init(const char *default_dsdt);
 PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,
                                 ram_addr_t above_4g_mem_size);
 
+#define PCI_HOST_PROP_PCI_HOLE_START   "pci-hole-start"
+#define PCI_HOST_PROP_PCI_HOLE_END     "pci-hole-end"
+#define PCI_HOST_PROP_PCI_HOLE64_START "pci-hole64-start"
+#define PCI_HOST_PROP_PCI_HOLE64_END   "pci-hole64-end"
+#define PCI_HOST_PROP_PCI_HOLE64_SIZE  "pci-hole64-size"
+#define DEFAULT_PCI_HOLE64_SIZE (1ULL << 31)
+
+void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
+                        uint64_t pci_hole64_size);
+
 FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
@@ -150,8 +159,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn,
                     ram_addr_t ram_size,
                     hwaddr pci_hole_start,
                     hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
+                    ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_memory,
                     MemoryRegion *ram_memory);
 
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 3cb631e..6eb7ab6 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -55,9 +55,11 @@ typedef struct MCHPCIState {
     MemoryRegion smram_region;
     MemoryRegion pci_hole;
     MemoryRegion pci_hole_64bit;
+    PcPciInfo pci_info;
     uint8_t smm_enabled;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
+    uint64_t pci_hole64_size;
     PcGuestInfo *guest_info;
 } MCHPCIState;
 
commit e8cd45c78f53501e75bd455140da63d1b7ed3685
Author: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
Date:   Mon Jul 29 16:47:56 2013 +0200

    qdev: Add SIZE type to qdev properties
    
    This patch adds a 'SIZE' type property to qdev.
    
    Signed-off-by: Ian Molton <ian.molton at collabora.co.uk>
    Signed-off-by: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-7-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 6e1ed1e..8d43a8d 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -1135,3 +1135,58 @@ void qdev_prop_set_globals(DeviceState *dev, Error **errp)
         class = object_class_get_parent(class);
     } while (class);
 }
+
+/* --- 64bit unsigned int 'size' type --- */
+
+static void get_size(Object *obj, Visitor *v, void *opaque,
+                     const char *name, Error **errp)
+{
+    DeviceState *dev = DEVICE(obj);
+    Property *prop = opaque;
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+
+    visit_type_size(v, ptr, name, errp);
+}
+
+static void set_size(Object *obj, Visitor *v, void *opaque,
+                     const char *name, Error **errp)
+{
+    DeviceState *dev = DEVICE(obj);
+    Property *prop = opaque;
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+
+    visit_type_size(v, ptr, name, errp);
+}
+
+static int parse_size(DeviceState *dev, Property *prop, const char *str)
+{
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+    Error *errp = NULL;
+
+    if (str != NULL) {
+        parse_option_size(prop->name, str, ptr, &errp);
+    }
+    assert_no_error(errp);
+    return 0;
+}
+
+static int print_size(DeviceState *dev, Property *prop, char *dest, size_t len)
+{
+    uint64_t *ptr = qdev_get_prop_ptr(dev, prop);
+    char suffixes[] = {'T', 'G', 'M', 'K', 'B'};
+    int i = 0;
+    uint64_t div;
+
+    for (div = (long int)1 << 40; !(*ptr / div) ; div >>= 10) {
+        i++;
+    }
+    return snprintf(dest, len, "%0.03f%c", (double)*ptr/div, suffixes[i]);
+}
+
+PropertyInfo qdev_prop_size = {
+    .name  = "size",
+    .parse = parse_size,
+    .print = print_size,
+    .get = get_size,
+    .set = set_size,
+};
diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index 39448b7..692f82e 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -15,6 +15,7 @@ extern PropertyInfo qdev_prop_uint64;
 extern PropertyInfo qdev_prop_hex8;
 extern PropertyInfo qdev_prop_hex32;
 extern PropertyInfo qdev_prop_hex64;
+extern PropertyInfo qdev_prop_size;
 extern PropertyInfo qdev_prop_string;
 extern PropertyInfo qdev_prop_chr;
 extern PropertyInfo qdev_prop_ptr;
@@ -116,6 +117,8 @@ extern PropertyInfo qdev_prop_arraylen;
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex32, uint32_t)
 #define DEFINE_PROP_HEX64(_n, _s, _f, _d)                       \
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex64, uint64_t)
+#define DEFINE_PROP_SIZE(_n, _s, _f, _d)                       \
+    DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_size, uint64_t)
 #define DEFINE_PROP_PCI_DEVFN(_n, _s, _f, _d)                   \
     DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t)
 
diff --git a/include/qemu/option.h b/include/qemu/option.h
index 13f5e72..7a58e47 100644
--- a/include/qemu/option.h
+++ b/include/qemu/option.h
@@ -73,6 +73,8 @@ QEMUOptionParameter *append_option_parameters(QEMUOptionParameter *dest,
     QEMUOptionParameter *list);
 QEMUOptionParameter *parse_option_parameters(const char *param,
     QEMUOptionParameter *list, QEMUOptionParameter *dest);
+void parse_option_size(const char *name, const char *value,
+                       uint64_t *ret, Error **errp);
 void free_option_parameters(QEMUOptionParameter *list);
 void print_option_parameters(QEMUOptionParameter *list);
 void print_option_help(QEMUOptionParameter *list);
diff --git a/util/qemu-option.c b/util/qemu-option.c
index 5d686c8..7a1552a 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -173,8 +173,8 @@ static void parse_option_number(const char *name, const char *value,
     }
 }
 
-static void parse_option_size(const char *name, const char *value,
-                              uint64_t *ret, Error **errp)
+void parse_option_size(const char *name, const char *value,
+                       uint64_t *ret, Error **errp)
 {
     char *postfix;
     double sizef;
commit b887796217b7f5b754657e85760693e4ced63356
Author: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
Date:   Mon Jul 29 16:47:55 2013 +0200

    qapi: make visit_type_size fallback to type_int
    
    Currently visit_type_size checks if the visitor's type_size function pointer is
    NULL. If not, it calls it, otherwise it calls v->type_uint64(). But neither of
    these pointers are ever set. Fallback to calling v->type_int() in this third
    (default) case.
    
    Signed-off-by: Vasilis Liaskovitis <vasilis.liaskovitis at profitbricks.com>
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-6-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c
index d6a4012..6451a21 100644
--- a/qapi/qapi-visit-core.c
+++ b/qapi/qapi-visit-core.c
@@ -263,8 +263,17 @@ void visit_type_int64(Visitor *v, int64_t *obj, const char *name, Error **errp)
 
 void visit_type_size(Visitor *v, uint64_t *obj, const char *name, Error **errp)
 {
+    int64_t value;
     if (!error_is_set(errp)) {
-        (v->type_size ? v->type_size : v->type_uint64)(v, obj, name, errp);
+        if (v->type_size) {
+            v->type_size(v, obj, name, errp);
+        } else if (v->type_uint64) {
+            v->type_uint64(v, obj, name, errp);
+        } else {
+            value = *obj;
+            v->type_int(v, &value, name, errp);
+            *obj = value;
+        }
     }
 }
 
commit c52dc697259ac826d905db57e298c50306a8c600
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:54 2013 +0200

    pc: add Q35 to QOM composition tree under /machine
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-5-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 0b1d2e3..2f35d12 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -131,6 +131,7 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     /* create pci host bus */
     q35_host = Q35_HOST_DEVICE(qdev_create(NULL, TYPE_Q35_HOST_DEVICE));
 
+    object_property_add_child(qdev_get_machine(), "q35", OBJECT(q35_host), NULL);
     q35_host->mch.ram_memory = ram_memory;
     q35_host->mch.pci_address_space = pci_memory;
     q35_host->mch.system_memory = get_system_memory();
commit 44fc8c5e743b84c1d29f603e4014125dcf152d26
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:53 2013 +0200

    pc: replace i440fx_common_init() with i440fx_init()
    
    It isn't used anywhere else.
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-4-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 39e9c55..3f539ec 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -239,19 +239,18 @@ static int i440fx_initfn(PCIDevice *dev)
     return 0;
 }
 
-static PCIBus *i440fx_common_init(const char *device_name,
-                                  PCII440FXState **pi440fx_state,
-                                  int *piix3_devfn,
-                                  ISABus **isa_bus, qemu_irq *pic,
-                                  MemoryRegion *address_space_mem,
-                                  MemoryRegion *address_space_io,
-                                  ram_addr_t ram_size,
-                                  hwaddr pci_hole_start,
-                                  hwaddr pci_hole_size,
-                                  hwaddr pci_hole64_start,
-                                  hwaddr pci_hole64_size,
-                                  MemoryRegion *pci_address_space,
-                                  MemoryRegion *ram_memory)
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
+                    int *piix3_devfn,
+                    ISABus **isa_bus, qemu_irq *pic,
+                    MemoryRegion *address_space_mem,
+                    MemoryRegion *address_space_io,
+                    ram_addr_t ram_size,
+                    hwaddr pci_hole_start,
+                    hwaddr pci_hole_size,
+                    hwaddr pci_hole64_start,
+                    hwaddr pci_hole64_size,
+                    MemoryRegion *pci_address_space,
+                    MemoryRegion *ram_memory)
 {
     DeviceState *dev;
     PCIBus *b;
@@ -269,7 +268,7 @@ static PCIBus *i440fx_common_init(const char *device_name,
     object_property_add_child(qdev_get_machine(), "i440fx", OBJECT(dev), NULL);
     qdev_init_nofail(dev);
 
-    d = pci_create_simple(b, 0, device_name);
+    d = pci_create_simple(b, 0, TYPE_I440FX_PCI_DEVICE);
     *pi440fx_state = I440FX_PCI_DEVICE(d);
     f = *pi440fx_state;
     f->system_memory = address_space_mem;
@@ -330,29 +329,6 @@ static PCIBus *i440fx_common_init(const char *device_name,
     return b;
 }
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn,
-                    ISABus **isa_bus, qemu_irq *pic,
-                    MemoryRegion *address_space_mem,
-                    MemoryRegion *address_space_io,
-                    ram_addr_t ram_size,
-                    hwaddr pci_hole_start,
-                    hwaddr pci_hole_size,
-                    hwaddr pci_hole64_start,
-                    hwaddr pci_hole64_size,
-                    MemoryRegion *pci_memory, MemoryRegion *ram_memory)
-
-{
-    PCIBus *b;
-
-    b = i440fx_common_init(TYPE_I440FX_PCI_DEVICE, pi440fx_state,
-                           piix3_devfn, isa_bus, pic,
-                           address_space_mem, address_space_io, ram_size,
-                           pci_hole_start, pci_hole_size,
-                           pci_hole64_start, pci_hole64_size,
-                           pci_memory, ram_memory);
-    return b;
-}
-
 /* PIIX3 PCI to ISA bridge */
 static void piix3_set_irq_pic(PIIX3State *piix3, int pic_irq)
 {
commit 1d0d4aa412eef7d98e53c313c79c359f2f65376e
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jul 29 16:47:52 2013 +0200

    pc: add I440FX QOM cast macro
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-3-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 3908860..39e9c55 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -38,6 +38,10 @@
  * http://download.intel.com/design/chipsets/datashts/29054901.pdf
  */
 
+#define TYPE_I440FX_PCI_HOST_BRIDGE "i440FX-pcihost"
+#define I440FX_PCI_HOST_BRIDGE(obj) \
+    OBJECT_CHECK(I440FXState, (obj), TYPE_I440FX_PCI_HOST_BRIDGE)
+
 typedef struct I440FXState {
     PCIHostState parent_obj;
 } I440FXState;
@@ -257,7 +261,7 @@ static PCIBus *i440fx_common_init(const char *device_name,
     PCII440FXState *f;
     unsigned i;
 
-    dev = qdev_create(NULL, "i440FX-pcihost");
+    dev = qdev_create(NULL, TYPE_I440FX_PCI_HOST_BRIDGE);
     s = PCI_HOST_BRIDGE(dev);
     b = pci_bus_new(dev, NULL, pci_address_space,
                     address_space_io, 0, TYPE_PCI_BUS);
@@ -661,7 +665,7 @@ static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo i440fx_pcihost_info = {
-    .name          = "i440FX-pcihost",
+    .name          = TYPE_I440FX_PCI_HOST_BRIDGE,
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(I440FXState),
     .instance_init = i440fx_pcihost_initfn,
commit f5338ee30d91693f5805208e58df80f0551c3896
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon Jul 29 16:47:51 2013 +0200

    pc: move IO_APIC_DEFAULT_ADDRESS to include/hw/i386/ioapic.h
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1375109277-25561-2-git-send-email-imammedo at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 2a87563..b0b98a8 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -75,8 +75,6 @@
 #define FW_CFG_E820_TABLE (FW_CFG_ARCH_LOCAL + 3)
 #define FW_CFG_HPET (FW_CFG_ARCH_LOCAL + 4)
 
-#define IO_APIC_DEFAULT_ADDRESS 0xfec00000
-
 #define E820_NR_ENTRIES		16
 
 struct e820_entry {
diff --git a/include/hw/i386/ioapic.h b/include/hw/i386/ioapic.h
index 86e63da..6245388 100644
--- a/include/hw/i386/ioapic.h
+++ b/include/hw/i386/ioapic.h
@@ -21,6 +21,7 @@
 #define HW_IOAPIC_H
 
 #define IOAPIC_NUM_PINS 24
+#define IO_APIC_DEFAULT_ADDRESS 0xfec00000
 
 void ioapic_eoi_broadcast(int vector);
 
commit 6a4992d0bdeb38a57314d731d9846063b2057e6c
Merge: eddbf0a b67964d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 14:39:49 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-devices-for-anthony' into staging
    
    QOM device refactorings
    
    * Replace all uses of FROM_SYSBUS() macro with QOM cast macros
      i) "QOM cast cleanup for X"
         Indicates a mechanical 1:1 between TYPE_* and *State.
      ii) "QOM'ify X and Y"
          Indicates abstract types may have been inserted or similar changes
          to type hierarchy.
      ii) Renames
          Coding Style fixes such as CamelCase have been applied in some cases.
    * Fix for sparc floppy - cf. ii) above
    * Change PCI type hierarchy to provide PCI_BRIDGE() casts
    * In doing so, prepare for adopting QOM realize
    
    # gpg: Signature made Mon 29 Jul 2013 02:15:22 PM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Andreas Färber (171) and others
    # Via Andreas Färber
    * afaerber/tags/qom-devices-for-anthony: (173 commits)
      sysbus: QOM parent field cleanup for SysBusDevice
      spapr_pci: QOM cast cleanup
      ioapic: QOM cast cleanup
      kvm/ioapic: QOM cast cleanup
      kvmvapic: QOM cast cleanup
      mipsnet: QOM cast cleanup
      opencores_eth: QOM cast cleanup
      exynos4210_i2c: QOM cast cleanup
      sysbus: Remove unused sysbus_new() prototype
      sysbus: Drop FROM_SYSBUS()
      xilinx_timer: QOM cast cleanup
      tusb6010: QOM cast cleanup
      slavio_timer: QOM cast cleanup
      pxa2xx_timer: QOM'ify pxa25x-timer and pxa27x-timer
      puv3_ost: QOM cast cleanup
      pl031: QOM cast cleanup
      pl031: Rename pl031_state to PL031State
      milkymist-sysctl: QOM cast cleanup
      m48t59: QOM cast cleanup for M48t59SysBusState
      lm32_timer: QOM cast cleanup
      ...

commit b67964d70219a864ec427e727754a205475c7d6c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:40:42 2013 +0200

    sysbus: QOM parent field cleanup for SysBusDevice
    
    Rename the parent field and hide it from gtk-doc.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index f1d1c5e..bb50a87 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -42,7 +42,10 @@ typedef struct SysBusDeviceClass {
 } SysBusDeviceClass;
 
 struct SysBusDevice {
-    DeviceState qdev;
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+
     int num_irq;
     qemu_irq irqs[QDEV_MAX_IRQ];
     qemu_irq *irqp[QDEV_MAX_IRQ];
commit 38fb090a80bc8884ff1874b827ccc9a160102f9d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:39:37 2013 +0200

    spapr_pci: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 3156fdd..1ca35a0 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -479,6 +479,7 @@ static AddressSpace *spapr_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 
 static int spapr_phb_init(SysBusDevice *s)
 {
+    DeviceState *dev = DEVICE(s);
     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
     const char *busname;
@@ -596,14 +597,14 @@ static int spapr_phb_init(SysBusDevice *s)
      * since it's unique by construction, and makes the guest visible
      * BUID clear.
      */
-    if (s->qdev.id) {
+    if (dev->id) {
         busname = NULL;
     } else if (sphb->index == 0) {
         busname = "pci";
     } else {
         busname = sphb->dtbusname;
     }
-    bus = pci_register_bus(DEVICE(s), busname,
+    bus = pci_register_bus(dev, busname,
                            pci_spapr_set_irq, pci_spapr_map_irq, sphb,
                            &sphb->memspace, &sphb->iospace,
                            PCI_DEVFN(0, 0), PCI_NUM_PINS, TYPE_PCI_BUS);
@@ -611,7 +612,7 @@ static int spapr_phb_init(SysBusDevice *s)
 
     sphb->dma_window_start = 0;
     sphb->dma_window_size = 0x40000000;
-    sphb->tcet = spapr_tce_new_table(DEVICE(sphb), sphb->dma_liobn,
+    sphb->tcet = spapr_tce_new_table(dev, sphb->dma_liobn,
                                      sphb->dma_window_size);
     if (!sphb->tcet) {
         fprintf(stderr, "Unable to create TCE table for %s\n", sphb->dtbusname);
commit f54d31575d115377ba2931abc0ff41d4a0abc5a2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:31:42 2013 +0200

    ioapic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 5d064fe..d866e00 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -230,7 +230,7 @@ static void ioapic_init(IOAPICCommonState *s, int instance_no)
     memory_region_init_io(&s->io_memory, OBJECT(s), &ioapic_io_ops, s,
                           "ioapic", 0x1000);
 
-    qdev_init_gpio_in(&s->busdev.qdev, ioapic_set_irq, IOAPIC_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(s), ioapic_set_irq, IOAPIC_NUM_PINS);
 
     ioapics[instance_no] = s;
 }
commit b311963126a18d7f4c5390c4c094a5f015f0fca6
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:30:47 2013 +0200

    kvm/ioapic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvm/ioapic.c b/hw/i386/kvm/ioapic.c
index 688cb5c..f11a540 100644
--- a/hw/i386/kvm/ioapic.c
+++ b/hw/i386/kvm/ioapic.c
@@ -112,7 +112,7 @@ static void kvm_ioapic_put(IOAPICCommonState *s)
 
 static void kvm_ioapic_reset(DeviceState *dev)
 {
-    IOAPICCommonState *s = DO_UPCAST(IOAPICCommonState, busdev.qdev, dev);
+    IOAPICCommonState *s = IOAPIC_COMMON(dev);
 
     ioapic_reset_common(dev);
     kvm_ioapic_put(s);
@@ -131,7 +131,7 @@ static void kvm_ioapic_init(IOAPICCommonState *s, int instance_no)
 {
     memory_region_init_reservation(&s->io_memory, NULL, "kvm-ioapic", 0x1000);
 
-    qdev_init_gpio_in(&s->busdev.qdev, kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(s), kvm_ioapic_set_irq, IOAPIC_NUM_PINS);
 }
 
 static Property kvm_ioapic_properties[] = {
commit 253eacc2fb1f592af9de64c5a9a2157fbf8ccb0d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 16:27:41 2013 +0200

    kvmvapic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index a4506bc..15beb80 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -456,7 +456,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
 void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
                              TPRAccess access)
 {
-    VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
+    VAPICROMState *s = VAPIC(dev);
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
@@ -508,7 +508,7 @@ static void vapic_enable_tpr_reporting(bool enable)
 
 static void vapic_reset(DeviceState *dev)
 {
-    VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
+    VAPICROMState *s = VAPIC(dev);
 
     if (s->state == VAPIC_ACTIVE) {
         s->state = VAPIC_STANDBY;
commit a4dbb8bdebd9b013df06cbc27d641de659e92ab2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:59:07 2013 +0200

    mipsnet: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 61578ed..e421b86 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -19,8 +19,11 @@
 
 #define MAX_ETH_FRAME_SIZE	1514
 
+#define TYPE_MIPS_NET "mipsnet"
+#define MIPS_NET(obj) OBJECT_CHECK(MIPSnetState, (obj), TYPE_MIPS_NET)
+
 typedef struct MIPSnetState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
 
     uint32_t busy;
     uint32_t rx_count;
@@ -231,17 +234,18 @@ static const MemoryRegionOps mipsnet_ioport_ops = {
     .impl.max_access_size = 4,
 };
 
-static int mipsnet_sysbus_init(SysBusDevice *dev)
+static int mipsnet_sysbus_init(SysBusDevice *sbd)
 {
-    MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev, dev);
+    DeviceState *dev = DEVICE(sbd);
+    MIPSnetState *s = MIPS_NET(dev);
 
     memory_region_init_io(&s->io, OBJECT(dev), &mipsnet_ioport_ops, s,
                           "mipsnet-io", 36);
-    sysbus_init_mmio(dev, &s->io);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->io);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->nic = qemu_new_nic(&net_mipsnet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     return 0;
@@ -249,7 +253,7 @@ static int mipsnet_sysbus_init(SysBusDevice *dev)
 
 static void mipsnet_sysbus_reset(DeviceState *dev)
 {
-    MIPSnetState *s = DO_UPCAST(MIPSnetState, busdev.qdev, dev);
+    MIPSnetState *s = MIPS_NET(dev);
     mipsnet_reset(s);
 }
 
@@ -272,7 +276,7 @@ static void mipsnet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mipsnet_info = {
-    .name          = "mipsnet",
+    .name          = TYPE_MIPS_NET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MIPSnetState),
     .class_init    = mipsnet_class_init,
commit 4632cf2d5f77e702afda1e98df86ad7b0721ef70
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:56:28 2013 +0200

    opencores_eth: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index 513f345..4118d54 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -267,8 +267,12 @@ typedef struct desc {
 
 #define DEFAULT_PHY 1
 
+#define TYPE_OPEN_ETH "open_eth"
+#define OPEN_ETH(obj) OBJECT_CHECK(OpenEthState, (obj), TYPE_OPEN_ETH)
+
 typedef struct OpenEthState {
-    SysBusDevice dev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     MemoryRegion reg_io;
@@ -677,28 +681,30 @@ static const MemoryRegionOps open_eth_desc_ops = {
     .write = open_eth_desc_write,
 };
 
-static int sysbus_open_eth_init(SysBusDevice *dev)
+static int sysbus_open_eth_init(SysBusDevice *sbd)
 {
-    OpenEthState *s = DO_UPCAST(OpenEthState, dev, dev);
+    DeviceState *dev = DEVICE(sbd);
+    OpenEthState *s = OPEN_ETH(dev);
 
     memory_region_init_io(&s->reg_io, OBJECT(dev), &open_eth_reg_ops, s,
             "open_eth.regs", 0x54);
-    sysbus_init_mmio(dev, &s->reg_io);
+    sysbus_init_mmio(sbd, &s->reg_io);
 
     memory_region_init_io(&s->desc_io, OBJECT(dev), &open_eth_desc_ops, s,
             "open_eth.desc", 0x400);
-    sysbus_init_mmio(dev, &s->desc_io);
+    sysbus_init_mmio(sbd, &s->desc_io);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->nic = qemu_new_nic(&net_open_eth_info, &s->conf,
-                          object_get_typename(OBJECT(s)), s->dev.qdev.id, s);
+                          object_get_typename(OBJECT(s)), dev->id, s);
     return 0;
 }
 
 static void qdev_open_eth_reset(DeviceState *dev)
 {
-    OpenEthState *d = DO_UPCAST(OpenEthState, dev.qdev, dev);
+    OpenEthState *d = OPEN_ETH(dev);
+
     open_eth_reset(d);
 }
 
@@ -720,7 +726,7 @@ static void open_eth_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo open_eth_info = {
-    .name          = "open_eth",
+    .name          = TYPE_OPEN_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OpenEthState),
     .class_init    = open_eth_class_init,
commit 436033290065be765363ad73f9437821e0c35084
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:50:02 2013 +0200

    exynos4210_i2c: QOM cast cleanup
    
    Fix one ->qdev access and rename parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/exynos4210_i2c.c b/hw/i2c/exynos4210_i2c.c
index 42f5e89..ce5f849 100644
--- a/hw/i2c/exynos4210_i2c.c
+++ b/hw/i2c/exynos4210_i2c.c
@@ -80,7 +80,8 @@ static const char *exynos4_i2c_get_regname(unsigned offset)
 #endif
 
 typedef struct Exynos4210I2CState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     i2c_bus *bus;
     qemu_irq irq;
@@ -297,15 +298,16 @@ static void exynos4210_i2c_reset(DeviceState *d)
     s->scl_free = true;
 }
 
-static int exynos4210_i2c_realize(SysBusDevice *dev)
+static int exynos4210_i2c_realize(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
     Exynos4210I2CState *s = EXYNOS4_I2C(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_i2c_ops, s,
                           TYPE_EXYNOS4_I2C, EXYNOS4_I2C_MEM_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->bus = i2c_init_bus(&dev->qdev, "i2c");
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->bus = i2c_init_bus(dev, "i2c");
     return 0;
 }
 
commit 339104fe3430d19bd1932077bae839cdcc9f7cd2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:45:51 2013 +0200

    sysbus: Remove unused sysbus_new() prototype
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index fbfc066..f1d1c5e 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -55,7 +55,6 @@ struct SysBusDevice {
     pio_addr_t pio[QDEV_MAX_PIO];
 };
 
-void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory);
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
 void sysbus_init_irq(SysBusDevice *dev, qemu_irq *p);
commit f3d74d32e7285af2c7a289c02b948f8feccd95e1
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:39:20 2013 +0200

    sysbus: Drop FROM_SYSBUS()
    
    As a replacement, use your own macro based on OBJECT_CHECK().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 8c17165..fbfc066 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -55,9 +55,6 @@ struct SysBusDevice {
     pio_addr_t pio[QDEV_MAX_PIO];
 };
 
-/* Macros to compensate for lack of type inheritance in C.  */
-#define FROM_SYSBUS(type, dev) DO_UPCAST(type, busdev, dev)
-
 void *sysbus_new(void);
 void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory);
 MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
commit 760d1d00b8148887003b0632da82dabab57d71f5
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:32:47 2013 +0200

    xilinx_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index ee53834..5f2c902 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -57,9 +57,14 @@ struct xlx_timer
     uint32_t regs[R_MAX];
 };
 
+#define TYPE_XILINX_TIMER "xlnx.xps-timer"
+#define XILINX_TIMER(obj) \
+    OBJECT_CHECK(struct timerblock, (obj), TYPE_XILINX_TIMER)
+
 struct timerblock
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     uint8_t one_timer_only;
@@ -200,7 +205,7 @@ static void timer_hit(void *opaque)
 
 static int xilinx_timer_init(SysBusDevice *dev)
 {
-    struct timerblock *t = FROM_SYSBUS(typeof (*t), dev);
+    struct timerblock *t = XILINX_TIMER(dev);
     unsigned int i;
 
     /* All timers share a single irq line.  */
@@ -241,7 +246,7 @@ static void xilinx_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_timer_info = {
-    .name          = "xlnx.xps-timer",
+    .name          = TYPE_XILINX_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct timerblock),
     .class_init    = xilinx_timer_class_init,
commit 453be7a6fc21c5794e335d937c63bc9d49b1fe1a
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:30:21 2013 +0200

    tusb6010: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/tusb6010.c b/hw/timer/tusb6010.c
index 47b6809..c48ecf8 100644
--- a/hw/timer/tusb6010.c
+++ b/hw/timer/tusb6010.c
@@ -26,8 +26,12 @@
 #include "hw/devices.h"
 #include "hw/sysbus.h"
 
+#define TYPE_TUSB6010 "tusb6010"
+#define TUSB(obj) OBJECT_CHECK(TUSBState, (obj), TYPE_TUSB6010)
+
 typedef struct TUSBState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem[2];
     qemu_irq irq;
     MUSBState *musb;
@@ -740,7 +744,7 @@ static void tusb6010_irq(void *opaque, int source, int level)
 
 static void tusb6010_reset(DeviceState *dev)
 {
-    TUSBState *s = FROM_SYSBUS(TUSBState, SYS_BUS_DEVICE(dev));
+    TUSBState *s = TUSB(dev);
     int i;
 
     s->test_reset = TUSB_PROD_TEST_RESET_VAL;
@@ -774,18 +778,20 @@ static void tusb6010_reset(DeviceState *dev)
     musb_reset(s->musb);
 }
 
-static int tusb6010_init(SysBusDevice *dev)
+static int tusb6010_init(SysBusDevice *sbd)
 {
-    TUSBState *s = FROM_SYSBUS(TUSBState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    TUSBState *s = TUSB(dev);
+
     s->otg_timer = qemu_new_timer_ns(vm_clock, tusb_otg_tick, s);
     s->pwr_timer = qemu_new_timer_ns(vm_clock, tusb_power_tick, s);
     memory_region_init_io(&s->iomem[1], OBJECT(s), &tusb_async_ops, s,
                           "tusb-async", UINT32_MAX);
-    sysbus_init_mmio(dev, &s->iomem[0]);
-    sysbus_init_mmio(dev, &s->iomem[1]);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&dev->qdev, tusb6010_irq, musb_irq_max + 1);
-    s->musb = musb_init(&dev->qdev, 1);
+    sysbus_init_mmio(sbd, &s->iomem[0]);
+    sysbus_init_mmio(sbd, &s->iomem[1]);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, tusb6010_irq, musb_irq_max + 1);
+    s->musb = musb_init(dev, 1);
     return 0;
 }
 
@@ -799,7 +805,7 @@ static void tusb6010_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo tusb6010_info = {
-    .name          = "tusb6010",
+    .name          = TYPE_TUSB6010,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(TUSBState),
     .class_init    = tusb6010_class_init,
commit c275471eb1beb0461cfbbb5d96b9d3bcff451c77
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:24:22 2013 +0200

    slavio_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index 7f844d7..33e8f6c 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -54,8 +54,13 @@ typedef struct CPUTimerState {
     uint64_t limit;
 } CPUTimerState;
 
+#define TYPE_SLAVIO_TIMER "slavio_timer"
+#define SLAVIO_TIMER(obj) \
+    OBJECT_CHECK(SLAVIO_TIMERState, (obj), TYPE_SLAVIO_TIMER)
+
 typedef struct SLAVIO_TIMERState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t num_cpus;
     uint32_t cputimer_mode;
     CPUTimerState cputimer[MAX_CPUS + 1];
@@ -354,7 +359,7 @@ static const VMStateDescription vmstate_slavio_timer = {
 
 static void slavio_timer_reset(DeviceState *d)
 {
-    SLAVIO_TIMERState *s = container_of(d, SLAVIO_TIMERState, busdev.qdev);
+    SLAVIO_TIMERState *s = SLAVIO_TIMER(d);
     unsigned int i;
     CPUTimerState *curr_timer;
 
@@ -375,7 +380,7 @@ static void slavio_timer_reset(DeviceState *d)
 
 static int slavio_timer_init1(SysBusDevice *dev)
 {
-    SLAVIO_TIMERState *s = FROM_SYSBUS(SLAVIO_TIMERState, dev);
+    SLAVIO_TIMERState *s = SLAVIO_TIMER(dev);
     QEMUBH *bh;
     unsigned int i;
     TimerContext *tc;
@@ -421,7 +426,7 @@ static void slavio_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo slavio_timer_info = {
-    .name          = "slavio_timer",
+    .name          = TYPE_SLAVIO_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLAVIO_TIMERState),
     .class_init    = slavio_timer_class_init,
commit feea4361b3d29cc7e7374db33df9ab18348cf230
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:20:20 2013 +0200

    pxa2xx_timer: QOM'ify pxa25x-timer and pxa27x-timer
    
    Introduce type constant for new abstract base type, use QOM casts and
    let both non-abstract types inherit from the new base type.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index 4d28719..cdabccd 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -60,6 +60,10 @@ static int pxa2xx_timer4_freq[8] = {
     [5 ... 7] = 0,
 };
 
+#define TYPE_PXA2XX_TIMER "pxa2xx-timer"
+#define PXA2XX_TIMER(obj) \
+    OBJECT_CHECK(PXA2xxTimerInfo, (obj), TYPE_PXA2XX_TIMER)
+
 typedef struct PXA2xxTimerInfo PXA2xxTimerInfo;
 
 typedef struct {
@@ -80,7 +84,8 @@ typedef struct {
 } PXA2xxTimer4;
 
 struct PXA2xxTimerInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t flags;
 
@@ -429,10 +434,9 @@ static int pxa25x_timer_post_load(void *opaque, int version_id)
 
 static int pxa2xx_timer_init(SysBusDevice *dev)
 {
+    PXA2xxTimerInfo *s = PXA2XX_TIMER(dev);
     int i;
-    PXA2xxTimerInfo *s;
 
-    s = FROM_SYSBUS(PXA2xxTimerInfo, dev);
     s->irq_enabled = 0;
     s->oldclock = 0;
     s->clock = 0;
@@ -527,24 +531,21 @@ static const VMStateDescription vmstate_pxa2xx_timer_regs = {
 static Property pxa25x_timer_dev_properties[] = {
     DEFINE_PROP_UINT32("freq", PXA2xxTimerInfo, freq, PXA25X_FREQ),
     DEFINE_PROP_BIT("tm4", PXA2xxTimerInfo, flags,
-    PXA2XX_TIMER_HAVE_TM4, false),
+                    PXA2XX_TIMER_HAVE_TM4, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
 static void pxa25x_timer_dev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pxa2xx_timer_init;
     dc->desc = "PXA25x timer";
-    dc->vmsd = &vmstate_pxa2xx_timer_regs;
     dc->props = pxa25x_timer_dev_properties;
 }
 
 static const TypeInfo pxa25x_timer_dev_info = {
     .name          = "pxa25x-timer",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PXA2XX_TIMER,
     .instance_size = sizeof(PXA2xxTimerInfo),
     .class_init    = pxa25x_timer_dev_class_init,
 };
@@ -552,30 +553,45 @@ static const TypeInfo pxa25x_timer_dev_info = {
 static Property pxa27x_timer_dev_properties[] = {
     DEFINE_PROP_UINT32("freq", PXA2xxTimerInfo, freq, PXA27X_FREQ),
     DEFINE_PROP_BIT("tm4", PXA2xxTimerInfo, flags,
-    PXA2XX_TIMER_HAVE_TM4, true),
+                    PXA2XX_TIMER_HAVE_TM4, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
 static void pxa27x_timer_dev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pxa2xx_timer_init;
     dc->desc = "PXA27x timer";
-    dc->vmsd = &vmstate_pxa2xx_timer_regs;
     dc->props = pxa27x_timer_dev_properties;
 }
 
 static const TypeInfo pxa27x_timer_dev_info = {
     .name          = "pxa27x-timer",
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PXA2XX_TIMER,
     .instance_size = sizeof(PXA2xxTimerInfo),
     .class_init    = pxa27x_timer_dev_class_init,
 };
 
+static void pxa2xx_timer_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc);
+
+    sdc->init = pxa2xx_timer_init;
+    dc->vmsd = &vmstate_pxa2xx_timer_regs;
+}
+
+static const TypeInfo pxa2xx_timer_type_info = {
+    .name          = TYPE_PXA2XX_TIMER,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(PXA2xxTimerInfo),
+    .abstract      = true,
+    .class_init    = pxa2xx_timer_class_init,
+};
+
 static void pxa2xx_timer_register_types(void)
 {
+    type_register_static(&pxa2xx_timer_type_info);
     type_register_static(&pxa25x_timer_dev_info);
     type_register_static(&pxa27x_timer_dev_info);
 }
commit 9c9610b825bdf73d3323dfb5aa0cb789f2c665e8
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:12:40 2013 +0200

    puv3_ost: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index 63f2c9f..4bd2b76 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -14,9 +14,13 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
+#define TYPE_PUV3_OST "puv3_ost"
+#define PUV3_OST(obj) OBJECT_CHECK(PUV3OSTState, (obj), TYPE_PUV3_OST)
+
 /* puv3 ostimer implementation. */
-typedef struct {
-    SysBusDevice busdev;
+typedef struct PUV3OSTState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QEMUBH *bh;
     qemu_irq irq;
@@ -109,7 +113,7 @@ static void puv3_ost_tick(void *opaque)
 
 static int puv3_ost_init(SysBusDevice *dev)
 {
-    PUV3OSTState *s = FROM_SYSBUS(PUV3OSTState, dev);
+    PUV3OSTState *s = PUV3_OST(dev);
 
     s->reg_OIER = 0;
     s->reg_OSSR = 0;
@@ -137,7 +141,7 @@ static void puv3_ost_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_ost_info = {
-    .name = "puv3_ost",
+    .name = TYPE_PUV3_OST,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3OSTState),
     .class_init = puv3_ost_class_init,
commit d3b800495ec886d45a0be7aa6eb4e1de7533968f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:10:14 2013 +0200

    pl031: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index e705a69..d5e2f3e 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -33,8 +33,12 @@ do { printf("pl031: " fmt , ## __VA_ARGS__); } while (0)
 #define RTC_MIS     0x18    /* Masked interrupt status register */
 #define RTC_ICR     0x1c    /* Interrupt clear register */
 
+#define TYPE_PL031 "pl031"
+#define PL031(obj) OBJECT_CHECK(PL031State, (obj), TYPE_PL031)
+
 typedef struct PL031State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QEMUTimer *timer;
     qemu_irq irq;
@@ -189,7 +193,7 @@ static const MemoryRegionOps pl031_ops = {
 
 static int pl031_init(SysBusDevice *dev)
 {
-    PL031State *s = FROM_SYSBUS(PL031State, dev);
+    PL031State *s = PL031(dev);
     struct tm tm;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000);
@@ -251,7 +255,7 @@ static void pl031_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl031_info = {
-    .name          = "pl031",
+    .name          = TYPE_PL031,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL031State),
     .class_init    = pl031_class_init,
commit b91f0dfd12dbd117235409980e77523fba5f8978
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:07:44 2013 +0200

    pl031: Rename pl031_state to PL031State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index 3ce6ed8..e705a69 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -33,7 +33,7 @@ do { printf("pl031: " fmt , ## __VA_ARGS__); } while (0)
 #define RTC_MIS     0x18    /* Masked interrupt status register */
 #define RTC_ICR     0x1c    /* Interrupt clear register */
 
-typedef struct {
+typedef struct PL031State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     QEMUTimer *timer;
@@ -51,34 +51,34 @@ typedef struct {
     uint32_t cr;
     uint32_t im;
     uint32_t is;
-} pl031_state;
+} PL031State;
 
 static const unsigned char pl031_id[] = {
     0x31, 0x10, 0x14, 0x00,         /* Device ID        */
     0x0d, 0xf0, 0x05, 0xb1          /* Cell ID      */
 };
 
-static void pl031_update(pl031_state *s)
+static void pl031_update(PL031State *s)
 {
     qemu_set_irq(s->irq, s->is & s->im);
 }
 
 static void pl031_interrupt(void * opaque)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
     s->is = 1;
     DPRINTF("Alarm raised\n");
     pl031_update(s);
 }
 
-static uint32_t pl031_get_count(pl031_state *s)
+static uint32_t pl031_get_count(PL031State *s)
 {
     int64_t now = qemu_get_clock_ns(rtc_clock);
     return s->tick_offset + now / get_ticks_per_sec();
 }
 
-static void pl031_set_alarm(pl031_state *s)
+static void pl031_set_alarm(PL031State *s)
 {
     uint32_t ticks;
 
@@ -98,7 +98,7 @@ static void pl031_set_alarm(pl031_state *s)
 static uint64_t pl031_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
     if (offset >= 0xfe0  &&  offset < 0x1000)
         return pl031_id[(offset - 0xfe0) >> 2];
@@ -136,7 +136,7 @@ static uint64_t pl031_read(void *opaque, hwaddr offset,
 static void pl031_write(void * opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl031_state *s = (pl031_state *)opaque;
+    PL031State *s = (PL031State *)opaque;
 
 
     switch (offset) {
@@ -189,7 +189,7 @@ static const MemoryRegionOps pl031_ops = {
 
 static int pl031_init(SysBusDevice *dev)
 {
-    pl031_state *s = FROM_SYSBUS(pl031_state, dev);
+    PL031State *s = FROM_SYSBUS(PL031State, dev);
     struct tm tm;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000);
@@ -205,7 +205,7 @@ static int pl031_init(SysBusDevice *dev)
 
 static void pl031_pre_save(void *opaque)
 {
-    pl031_state *s = opaque;
+    PL031State *s = opaque;
 
     /* tick_offset is base_time - rtc_clock base time.  Instead, we want to
      * store the base time relative to the vm_clock for backwards-compatibility.  */
@@ -215,7 +215,7 @@ static void pl031_pre_save(void *opaque)
 
 static int pl031_post_load(void *opaque, int version_id)
 {
-    pl031_state *s = opaque;
+    PL031State *s = opaque;
 
     int64_t delta = qemu_get_clock_ns(rtc_clock) - qemu_get_clock_ns(vm_clock);
     s->tick_offset = s->tick_offset_vmstate - delta / get_ticks_per_sec();
@@ -230,12 +230,12 @@ static const VMStateDescription vmstate_pl031 = {
     .pre_save = pl031_pre_save,
     .post_load = pl031_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(tick_offset_vmstate, pl031_state),
-        VMSTATE_UINT32(mr, pl031_state),
-        VMSTATE_UINT32(lr, pl031_state),
-        VMSTATE_UINT32(cr, pl031_state),
-        VMSTATE_UINT32(im, pl031_state),
-        VMSTATE_UINT32(is, pl031_state),
+        VMSTATE_UINT32(tick_offset_vmstate, PL031State),
+        VMSTATE_UINT32(mr, PL031State),
+        VMSTATE_UINT32(lr, PL031State),
+        VMSTATE_UINT32(cr, PL031State),
+        VMSTATE_UINT32(im, PL031State),
+        VMSTATE_UINT32(is, PL031State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -253,7 +253,7 @@ static void pl031_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl031_info = {
     .name          = "pl031",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl031_state),
+    .instance_size = sizeof(PL031State),
     .class_init    = pl031_class_init,
 };
 
commit b564b137b92c5356ffe3c308defa9d0d324272d9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:06:42 2013 +0200

    milkymist-sysctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index 5009394..94246e5 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -57,8 +57,13 @@ enum {
     R_MAX
 };
 
+#define TYPE_MILKYMIST_SYSCTL "milkymist-sysctl"
+#define MILKYMIST_SYSCTL(obj) \
+    OBJECT_CHECK(MilkymistSysctlState, (obj), TYPE_MILKYMIST_SYSCTL)
+
 struct MilkymistSysctlState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     QEMUBH *bh0;
@@ -246,8 +251,7 @@ static void timer1_hit(void *opaque)
 
 static void milkymist_sysctl_reset(DeviceState *d)
 {
-    MilkymistSysctlState *s =
-            container_of(d, MilkymistSysctlState, busdev.qdev);
+    MilkymistSysctlState *s = MILKYMIST_SYSCTL(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -267,7 +271,7 @@ static void milkymist_sysctl_reset(DeviceState *d)
 
 static int milkymist_sysctl_init(SysBusDevice *dev)
 {
-    MilkymistSysctlState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistSysctlState *s = MILKYMIST_SYSCTL(dev);
 
     sysbus_init_irq(dev, &s->gpio_irq);
     sysbus_init_irq(dev, &s->timer0_irq);
@@ -324,7 +328,7 @@ static void milkymist_sysctl_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_sysctl_info = {
-    .name          = "milkymist-sysctl",
+    .name          = TYPE_MILKYMIST_SYSCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistSysctlState),
     .class_init    = milkymist_sysctl_class_init,
commit 29d1ffc3d8ccbc72dfe1e136a69235901d328d86
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 15:01:49 2013 +0200

    m48t59: QOM cast cleanup for M48t59SysBusState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
index be3490b..0cc9e5b 100644
--- a/hw/timer/m48t59.c
+++ b/hw/timer/m48t59.c
@@ -83,8 +83,12 @@ typedef struct M48t59ISAState {
     MemoryRegion io;
 } M48t59ISAState;
 
+#define SYSBUS_M48T59(obj) \
+    OBJECT_CHECK(M48t59SysBusState, (obj), TYPE_SYSBUS_M48T59)
+
 typedef struct M48t59SysBusState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     M48t59State state;
     MemoryRegion io;
 } M48t59SysBusState;
@@ -621,7 +625,7 @@ static void m48t59_reset_isa(DeviceState *d)
 
 static void m48t59_reset_sysbus(DeviceState *d)
 {
-    M48t59SysBusState *sys = container_of(d, M48t59SysBusState, busdev.qdev);
+    M48t59SysBusState *sys = SYSBUS_M48T59(d);
     M48t59State *NVRAM = &sys->state;
 
     m48t59_reset_common(NVRAM);
@@ -646,13 +650,13 @@ M48t59State *m48t59_init(qemu_irq IRQ, hwaddr mem_base,
     M48t59SysBusState *d;
     M48t59State *state;
 
-    dev = qdev_create(NULL, "m48t59");
+    dev = qdev_create(NULL, TYPE_SYSBUS_M48T59);
     qdev_prop_set_uint32(dev, "model", model);
     qdev_prop_set_uint32(dev, "size", size);
     qdev_prop_set_uint32(dev, "io_base", io_base);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
-    d = FROM_SYSBUS(M48t59SysBusState, s);
+    d = SYSBUS_M48T59(dev);
     state = &d->state;
     sysbus_connect_irq(s, 0, IRQ);
     memory_region_init_io(&d->io, OBJECT(d), &m48t59_io_ops, state,
@@ -716,7 +720,7 @@ static void m48t59_isa_realize(DeviceState *dev, Error **errp)
 
 static int m48t59_init1(SysBusDevice *dev)
 {
-    M48t59SysBusState *d = FROM_SYSBUS(M48t59SysBusState, dev);
+    M48t59SysBusState *d = SYSBUS_M48T59(dev);
     M48t59State *s = &d->state;
     Error *err = NULL;
 
@@ -776,7 +780,7 @@ static void m48t59_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo m48t59_info = {
-    .name          = "m48t59",
+    .name          = TYPE_SYSBUS_M48T59,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(M48t59SysBusState),
     .class_init    = m48t59_class_init,
diff --git a/include/hw/timer/m48t59.h b/include/hw/timer/m48t59.h
index 59337fa..8217522 100644
--- a/include/hw/timer/m48t59.h
+++ b/include/hw/timer/m48t59.h
@@ -21,6 +21,9 @@ int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
                           uint32_t initrd_image, uint32_t initrd_size,
                           uint32_t NVRAM_image,
                           int width, int height, int depth);
+
+#define TYPE_SYSBUS_M48T59 "m48t59"
+
 typedef struct M48t59State M48t59State;
 
 void m48t59_write (void *private, uint32_t addr, uint32_t val);
commit fe54d857056b3cf143fe5aebcf56b7c638d62bc0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:54:54 2013 +0200

    lm32_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index 016dade..986e6a1 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -50,8 +50,12 @@ enum {
     CR_STOP  = (1 << 3),
 };
 
+#define TYPE_LM32_TIMER "lm32-timer"
+#define LM32_TIMER(obj) OBJECT_CHECK(LM32TimerState, (obj), TYPE_LM32_TIMER)
+
 struct LM32TimerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     QEMUBH *bh;
@@ -161,7 +165,7 @@ static void timer_hit(void *opaque)
 
 static void timer_reset(DeviceState *d)
 {
-    LM32TimerState *s = container_of(d, LM32TimerState, busdev.qdev);
+    LM32TimerState *s = LM32_TIMER(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -172,7 +176,7 @@ static void timer_reset(DeviceState *d)
 
 static int lm32_timer_init(SysBusDevice *dev)
 {
-    LM32TimerState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32TimerState *s = LM32_TIMER(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -217,7 +221,7 @@ static void lm32_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_timer_info = {
-    .name          = "lm32-timer",
+    .name          = TYPE_LM32_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32TimerState),
     .class_init    = lm32_timer_class_init,
commit 541ab55ff1bdc558473f0dea40deae568551bb85
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:52:32 2013 +0200

    grlib_gptimer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index 37ba47d..7c1055a 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -50,6 +50,10 @@
 #define COUNTER_RELOAD_OFFSET 0x04
 #define TIMER_BASE            0x10
 
+#define TYPE_GRLIB_GPTIMER "grlib,gptimer"
+#define GRLIB_GPTIMER(obj) \
+    OBJECT_CHECK(GPTimerUnit, (obj), TYPE_GRLIB_GPTIMER)
+
 typedef struct GPTimer     GPTimer;
 typedef struct GPTimerUnit GPTimerUnit;
 
@@ -68,7 +72,8 @@ struct GPTimer {
 };
 
 struct GPTimerUnit {
-    SysBusDevice  busdev;
+    SysBusDevice  parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t nr_timers;         /* Number of timers available */
@@ -314,7 +319,7 @@ static const MemoryRegionOps grlib_gptimer_ops = {
 
 static void grlib_gptimer_reset(DeviceState *d)
 {
-    GPTimerUnit *unit = container_of(d, GPTimerUnit, busdev.qdev);
+    GPTimerUnit *unit = GRLIB_GPTIMER(d);
     int          i    = 0;
 
     assert(unit != NULL);
@@ -343,7 +348,7 @@ static void grlib_gptimer_reset(DeviceState *d)
 
 static int grlib_gptimer_init(SysBusDevice *dev)
 {
-    GPTimerUnit  *unit = FROM_SYSBUS(typeof(*unit), dev);
+    GPTimerUnit  *unit = GRLIB_GPTIMER(dev);
     unsigned int  i;
 
     assert(unit->nr_timers > 0);
@@ -391,7 +396,7 @@ static void grlib_gptimer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo grlib_gptimer_info = {
-    .name          = "grlib,gptimer",
+    .name          = TYPE_GRLIB_GPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GPTimerUnit),
     .class_init    = grlib_gptimer_class_init,
commit 3ddacf27057678f483bbed78db2f10419acb6501
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:49:12 2013 +0200

    exynos4210_rtc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index 7fca071..3f2c8c5 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -79,8 +79,13 @@
 
 #define     RTC_BASE_FREQ       32768
 
+#define TYPE_EXYNOS4210_RTC "exynos4210.rtc"
+#define EXYNOS4210_RTC(obj) \
+    OBJECT_CHECK(Exynos4210RTCState, (obj), TYPE_EXYNOS4210_RTC)
+
 typedef struct Exynos4210RTCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     /* registers */
@@ -507,7 +512,7 @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
  */
 static void exynos4210_rtc_reset(DeviceState *d)
 {
-    Exynos4210RTCState *s = (Exynos4210RTCState *)d;
+    Exynos4210RTCState *s = EXYNOS4210_RTC(d);
 
     qemu_get_timedate(&s->current_tm, 0);
 
@@ -544,7 +549,7 @@ static const MemoryRegionOps exynos4210_rtc_ops = {
  */
 static int exynos4210_rtc_init(SysBusDevice *dev)
 {
-    Exynos4210RTCState *s = FROM_SYSBUS(Exynos4210RTCState, dev);
+    Exynos4210RTCState *s = EXYNOS4210_RTC(dev);
     QEMUBH *bh;
 
     bh = qemu_bh_new(exynos4210_rtc_tick, s);
@@ -577,7 +582,7 @@ static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_rtc_info = {
-    .name          = "exynos4210.rtc",
+    .name          = TYPE_EXYNOS4210_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210RTCState),
     .class_init    = exynos4210_rtc_class_init,
commit 25fce9ad7f7b77d610504e70b03e29630d66dfa9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:45:47 2013 +0200

    exynos4210_pwm: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index 8fa0bb2..a52f0f6 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -97,9 +97,13 @@ typedef struct {
 
 } Exynos4210PWM;
 
+#define TYPE_EXYNOS4210_PWM "exynos4210.pwm"
+#define EXYNOS4210_PWM(obj) \
+    OBJECT_CHECK(Exynos4210PWMState, (obj), TYPE_EXYNOS4210_PWM)
 
 typedef struct Exynos4210PWMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t    reg_tcfg[2];
@@ -352,7 +356,7 @@ static void exynos4210_pwm_write(void *opaque, hwaddr offset,
  */
 static void exynos4210_pwm_reset(DeviceState *d)
 {
-    Exynos4210PWMState *s = (Exynos4210PWMState *)d;
+    Exynos4210PWMState *s = EXYNOS4210_PWM(d);
     int i;
     s->reg_tcfg[0] = 0x0101;
     s->reg_tcfg[1] = 0x0;
@@ -378,7 +382,7 @@ static const MemoryRegionOps exynos4210_pwm_ops = {
  */
 static int exynos4210_pwm_init(SysBusDevice *dev)
 {
-    Exynos4210PWMState *s = FROM_SYSBUS(Exynos4210PWMState, dev);
+    Exynos4210PWMState *s = EXYNOS4210_PWM(dev);
     int i;
     QEMUBH *bh;
 
@@ -408,7 +412,7 @@ static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_pwm_info = {
-    .name          = "exynos4210.pwm",
+    .name          = TYPE_EXYNOS4210_PWM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210PWMState),
     .class_init    = exynos4210_pwm_class_init,
commit 81e1010d0fbfaa5992cffa88e1797af36cc438ef
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:41:50 2013 +0200

    exynos4210_mct: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index 28ebe5d..a8009a4 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -240,8 +240,13 @@ typedef struct {
 
 } Exynos4210MCTLT;
 
+#define TYPE_EXYNOS4210_MCT "exynos4210.mct"
+#define EXYNOS4210_MCT(obj) \
+    OBJECT_CHECK(Exynos4210MCTState, (obj), TYPE_EXYNOS4210_MCT)
+
 typedef struct Exynos4210MCTState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     /* Registers */
@@ -955,7 +960,7 @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 /* set defaul_timer values for all fields */
 static void exynos4210_mct_reset(DeviceState *d)
 {
-    Exynos4210MCTState *s = (Exynos4210MCTState *)d;
+    Exynos4210MCTState *s = EXYNOS4210_MCT(d);
     uint32_t i;
 
     s->reg_mct_cfg = 0;
@@ -1424,7 +1429,7 @@ static const MemoryRegionOps exynos4210_mct_ops = {
 static int exynos4210_mct_init(SysBusDevice *dev)
 {
     int i;
-    Exynos4210MCTState *s = FROM_SYSBUS(Exynos4210MCTState, dev);
+    Exynos4210MCTState *s = EXYNOS4210_MCT(dev);
     QEMUBH *bh[2];
 
     /* Global timer */
@@ -1467,7 +1472,7 @@ static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_mct_info = {
-    .name          = "exynos4210.mct",
+    .name          = TYPE_EXYNOS4210_MCT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210MCTState),
     .class_init    = exynos4210_mct_class_init,
commit 5880ce52eb5560763b378dde83b2144fe41024eb
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:34:22 2013 +0200

    etraxfs_timer: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 7e9807d..a38d9e4 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -42,8 +42,13 @@
 #define R_INTR        0x50
 #define R_MASKED_INTR 0x54
 
+#define TYPE_ETRAX_FS_TIMER "etraxfs,timer"
+#define ETRAX_TIMER(obj) \
+    OBJECT_CHECK(ETRAXTimerState, (obj), TYPE_ETRAX_FS_TIMER)
+
 typedef struct ETRAXTimerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     qemu_irq nmi;
@@ -311,7 +316,7 @@ static void etraxfs_timer_reset(void *opaque)
 
 static int etraxfs_timer_init(SysBusDevice *dev)
 {
-    ETRAXTimerState *t = FROM_SYSBUS(typeof (*t), dev);
+    ETRAXTimerState *t = ETRAX_TIMER(dev);
 
     t->bh_t0 = qemu_bh_new(timer0_hit, t);
     t->bh_t1 = qemu_bh_new(timer1_hit, t);
@@ -338,7 +343,7 @@ static void etraxfs_timer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_timer_info = {
-    .name          = "etraxfs,timer",
+    .name          = TYPE_ETRAX_FS_TIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ETRAXTimerState),
     .class_init    = etraxfs_timer_class_init,
commit 3c9a8a8c8e7b045e9f1b23ff98d54d7df9a10229
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:30:31 2013 +0200

    etraxfs_timer: Rename etrax_timer to ETRAXTimerState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index 6dd1072..7e9807d 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -42,7 +42,7 @@
 #define R_INTR        0x50
 #define R_MASKED_INTR 0x54
 
-struct etrax_timer {
+typedef struct ETRAXTimerState {
     SysBusDevice busdev;
     MemoryRegion mmio;
     qemu_irq irq;
@@ -72,12 +72,12 @@ struct etrax_timer {
     uint32_t rw_ack_intr;
     uint32_t r_intr;
     uint32_t r_masked_intr;
-};
+} ETRAXTimerState;
 
 static uint64_t
 timer_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     uint32_t r = 0;
 
     switch (addr) {
@@ -103,7 +103,7 @@ timer_read(void *opaque, hwaddr addr, unsigned int size)
     return r;
 }
 
-static void update_ctrl(struct etrax_timer *t, int tnum)
+static void update_ctrl(ETRAXTimerState *t, int tnum)
 {
     unsigned int op;
     unsigned int freq;
@@ -167,7 +167,7 @@ static void update_ctrl(struct etrax_timer *t, int tnum)
     }
 }
 
-static void timer_update_irq(struct etrax_timer *t)
+static void timer_update_irq(ETRAXTimerState *t)
 {
     t->r_intr &= ~(t->rw_ack_intr);
     t->r_masked_intr = t->r_intr & t->rw_intr_mask;
@@ -178,21 +178,21 @@ static void timer_update_irq(struct etrax_timer *t)
 
 static void timer0_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     t->r_intr |= 1;
     timer_update_irq(t);
 }
 
 static void timer1_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     t->r_intr |= 2;
     timer_update_irq(t);
 }
 
 static void watchdog_hit(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     if (t->wd_hits == 0) {
         /* real hw gives a single tick before reseting but we are
            a bit friendlier to compensate for our slower execution.  */
@@ -206,7 +206,7 @@ static void watchdog_hit(void *opaque)
     t->wd_hits++;
 }
 
-static inline void timer_watchdog_update(struct etrax_timer *t, uint32_t value)
+static inline void timer_watchdog_update(ETRAXTimerState *t, uint32_t value)
 {
     unsigned int wd_en = t->rw_wd_ctrl & (1 << 8);
     unsigned int wd_key = t->rw_wd_ctrl >> 9;
@@ -245,7 +245,7 @@ static void
 timer_write(void *opaque, hwaddr addr,
             uint64_t val64, unsigned int size)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
     uint32_t value = val64;
 
     switch (addr)
@@ -298,7 +298,7 @@ static const MemoryRegionOps timer_ops = {
 
 static void etraxfs_timer_reset(void *opaque)
 {
-    struct etrax_timer *t = opaque;
+    ETRAXTimerState *t = opaque;
 
     ptimer_stop(t->ptimer_t0);
     ptimer_stop(t->ptimer_t1);
@@ -311,7 +311,7 @@ static void etraxfs_timer_reset(void *opaque)
 
 static int etraxfs_timer_init(SysBusDevice *dev)
 {
-    struct etrax_timer *t = FROM_SYSBUS(typeof (*t), dev);
+    ETRAXTimerState *t = FROM_SYSBUS(typeof (*t), dev);
 
     t->bh_t0 = qemu_bh_new(timer0_hit, t);
     t->bh_t1 = qemu_bh_new(timer1_hit, t);
@@ -340,7 +340,7 @@ static void etraxfs_timer_class_init(ObjectClass *klass, void *data)
 static const TypeInfo etraxfs_timer_info = {
     .name          = "etraxfs,timer",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof (struct etrax_timer),
+    .instance_size = sizeof(ETRAXTimerState),
     .class_init    = etraxfs_timer_class_init,
 };
 
commit 831aab9b0bb3953161cdbe07a5e475723874321f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:28:31 2013 +0200

    cadence_ttc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index a861049..888f9ce 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -64,8 +64,13 @@ typedef struct {
     qemu_irq irq;
 } CadenceTimerState;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_CADENCE_TTC "cadence_ttc"
+#define CADENCE_TTC(obj) \
+    OBJECT_CHECK(CadenceTTCState, (obj), TYPE_CADENCE_TTC)
+
+typedef struct CadenceTTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CadenceTimerState timer[3];
 } CadenceTTCState;
@@ -401,7 +406,7 @@ static void cadence_timer_init(uint32_t freq, CadenceTimerState *s)
 
 static int cadence_ttc_init(SysBusDevice *dev)
 {
-    CadenceTTCState *s = FROM_SYSBUS(CadenceTTCState, dev);
+    CadenceTTCState *s = CADENCE_TTC(dev);
     int i;
 
     for (i = 0; i < 3; ++i) {
@@ -476,7 +481,7 @@ static void cadence_ttc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo cadence_ttc_info = {
-    .name  = "cadence_ttc",
+    .name  = TYPE_CADENCE_TTC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(CadenceTTCState),
     .class_init = cadence_ttc_class_init,
commit e2051b42430b014ab6bdcfeabdd869b28282c3a2
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:20:25 2013 +0200

    arm_timer: QOM cast cleanup for icp_pit_state
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 8d95743..acfea59 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -298,8 +298,13 @@ static int sp804_init(SysBusDevice *sbd)
 
 /* Integrator/CP timer module.  */
 
+#define TYPE_INTEGRATOR_PIT "integrator_pit"
+#define INTEGRATOR_PIT(obj) \
+    OBJECT_CHECK(icp_pit_state, (obj), TYPE_INTEGRATOR_PIT)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     arm_timer_state *timer[3];
 } icp_pit_state;
@@ -341,7 +346,7 @@ static const MemoryRegionOps icp_pit_ops = {
 
 static int icp_pit_init(SysBusDevice *dev)
 {
-    icp_pit_state *s = FROM_SYSBUS(icp_pit_state, dev);
+    icp_pit_state *s = INTEGRATOR_PIT(dev);
 
     /* Timer 0 runs at the system clock speed (40MHz).  */
     s->timer[0] = arm_timer_init(40000000);
@@ -369,7 +374,7 @@ static void icp_pit_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo icp_pit_info = {
-    .name          = "integrator_pit",
+    .name          = TYPE_INTEGRATOR_PIT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pit_state),
     .class_init    = icp_pit_class_init,
commit 0c88dea5ebf248017ab3bf1fab8ee5e24f1b144d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:17:41 2013 +0200

    arm_timer: QOM cast cleanup for SP804State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 25e8890..8d95743 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -179,8 +179,12 @@ static arm_timer_state *arm_timer_init(uint32_t freq)
  * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0271d/index.html
 */
 
+#define TYPE_SP804 "sp804"
+#define SP804(obj) OBJECT_CHECK(SP804State, (obj), TYPE_SP804)
+
 typedef struct SP804State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     arm_timer_state *timer[2];
     uint32_t freq0, freq1;
@@ -273,21 +277,22 @@ static const VMStateDescription vmstate_sp804 = {
     }
 };
 
-static int sp804_init(SysBusDevice *dev)
+static int sp804_init(SysBusDevice *sbd)
 {
-    SP804State *s = FROM_SYSBUS(SP804State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SP804State *s = SP804(dev);
     qemu_irq *qi;
 
     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->timer[0] = arm_timer_init(s->freq0);
     s->timer[1] = arm_timer_init(s->freq1);
     s->timer[0]->irq = qi[0];
     s->timer[1]->irq = qi[1];
     memory_region_init_io(&s->iomem, OBJECT(s), &sp804_ops, s,
                           "sp804", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    vmstate_register(&dev->qdev, -1, &vmstate_sp804, s);
+    sysbus_init_mmio(sbd, &s->iomem);
+    vmstate_register(dev, -1, &vmstate_sp804, s);
     return 0;
 }
 
@@ -386,7 +391,7 @@ static void sp804_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sp804_info = {
-    .name          = "sp804",
+    .name          = TYPE_SP804,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SP804State),
     .class_init    = sp804_class_init,
commit 1024d7f0137da3683c90b1fd77ec0e47c864d897
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:15:46 2013 +0200

    arm_timer: Rename sp804_state to SP804State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index 798a8da..25e8890 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -179,14 +179,14 @@ static arm_timer_state *arm_timer_init(uint32_t freq)
  * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0271d/index.html
 */
 
-typedef struct {
+typedef struct SP804State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     arm_timer_state *timer[2];
     uint32_t freq0, freq1;
     int level[2];
     qemu_irq irq;
-} sp804_state;
+} SP804State;
 
 static const uint8_t sp804_ids[] = {
     /* Timer ID */
@@ -198,7 +198,7 @@ static const uint8_t sp804_ids[] = {
 /* Merge the IRQs from the two component devices.  */
 static void sp804_set_irq(void *opaque, int irq, int level)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     s->level[irq] = level;
     qemu_set_irq(s->irq, s->level[0] || s->level[1]);
@@ -207,7 +207,7 @@ static void sp804_set_irq(void *opaque, int irq, int level)
 static uint64_t sp804_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     if (offset < 0x20) {
         return arm_timer_read(s->timer[0], offset);
@@ -239,7 +239,7 @@ static uint64_t sp804_read(void *opaque, hwaddr offset,
 static void sp804_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    sp804_state *s = (sp804_state *)opaque;
+    SP804State *s = (SP804State *)opaque;
 
     if (offset < 0x20) {
         arm_timer_write(s->timer[0], offset, value);
@@ -268,14 +268,14 @@ static const VMStateDescription vmstate_sp804 = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_INT32_ARRAY(level, sp804_state, 2),
+        VMSTATE_INT32_ARRAY(level, SP804State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static int sp804_init(SysBusDevice *dev)
 {
-    sp804_state *s = FROM_SYSBUS(sp804_state, dev);
+    SP804State *s = FROM_SYSBUS(SP804State, dev);
     qemu_irq *qi;
 
     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
@@ -371,8 +371,8 @@ static const TypeInfo icp_pit_info = {
 };
 
 static Property sp804_properties[] = {
-    DEFINE_PROP_UINT32("freq0", sp804_state, freq0, 1000000),
-    DEFINE_PROP_UINT32("freq1", sp804_state, freq1, 1000000),
+    DEFINE_PROP_UINT32("freq0", SP804State, freq0, 1000000),
+    DEFINE_PROP_UINT32("freq1", SP804State, freq1, 1000000),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -388,7 +388,7 @@ static void sp804_class_init(ObjectClass *klass, void *data)
 static const TypeInfo sp804_info = {
     .name          = "sp804",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(sp804_state),
+    .instance_size = sizeof(SP804State),
     .class_init    = sp804_class_init,
 };
 
commit 3efc10e17d41779bbdaf27a304c8e39f744e530f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:07:22 2013 +0200

    xilinx_spi: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index 7a9fd81..d44caae 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -73,8 +73,12 @@
 
 #define FIFO_CAPACITY 256
 
+#define TYPE_XILINX_SPI "xlnx.xps-spi"
+#define XILINX_SPI(obj) OBJECT_CHECK(XilinxSPI, (obj), TYPE_XILINX_SPI)
+
 typedef struct XilinxSPI {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
 
     qemu_irq irq;
@@ -109,7 +113,7 @@ static void rxfifo_reset(XilinxSPI *s)
 
 static void xlx_spi_update_cs(XilinxSPI *s)
 {
-   int i;
+    int i;
 
     for (i = 0; i < s->num_cs; ++i) {
         qemu_set_irq(s->cs_lines[i], !(~s->regs[R_SPISSR] & 1 << i));
@@ -154,7 +158,7 @@ static void xlx_spi_do_reset(XilinxSPI *s)
 
 static void xlx_spi_reset(DeviceState *d)
 {
-    xlx_spi_do_reset(DO_UPCAST(XilinxSPI, busdev.qdev, d));
+    xlx_spi_do_reset(XILINX_SPI(d));
 }
 
 static inline int spi_master_enabled(XilinxSPI *s)
@@ -314,25 +318,26 @@ static const MemoryRegionOps spi_ops = {
     }
 };
 
-static int xilinx_spi_init(SysBusDevice *dev)
+static int xilinx_spi_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    XilinxSPI *s = XILINX_SPI(dev);
     int i;
-    XilinxSPI *s = FROM_SYSBUS(typeof(*s), dev);
 
     DB_PRINT("\n");
 
-    s->spi = ssi_create_bus(&dev->qdev, "spi");
+    s->spi = ssi_create_bus(dev, "spi");
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->cs_lines = g_new(qemu_irq, s->num_cs);
-    ssi_auto_connect_slaves(DEVICE(s), s->cs_lines, s->spi);
+    ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
     for (i = 0; i < s->num_cs; ++i) {
-        sysbus_init_irq(dev, &s->cs_lines[i]);
+        sysbus_init_irq(sbd, &s->cs_lines[i]);
     }
 
     memory_region_init_io(&s->mmio, OBJECT(s), &spi_ops, s,
                           "xilinx-spi", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     s->irqline = -1;
 
@@ -372,7 +377,7 @@ static void xilinx_spi_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_spi_info = {
-    .name           = "xlnx.xps-spi",
+    .name           = TYPE_XILINX_SPI,
     .parent         = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(XilinxSPI),
     .class_init     = xilinx_spi_class_init,
commit 3d29bceec1357702b2ce0909c6eb8107b806159e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:03:29 2013 +0200

    pl022: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index d33534e..fd479ef 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -39,8 +39,12 @@ do { fprintf(stderr, "pl022: error: " fmt , ## __VA_ARGS__);} while (0)
 #define PL022_INT_RX  0x04
 #define PL022_INT_TX  0x08
 
+#define TYPE_PL022 "pl022"
+#define PL022(obj) OBJECT_CHECK(PL022State, (obj), TYPE_PL022)
+
 typedef struct PL022State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t cr0;
     uint32_t cr1;
@@ -273,16 +277,17 @@ static const VMStateDescription vmstate_pl022 = {
     }
 };
 
-static int pl022_init(SysBusDevice *dev)
+static int pl022_init(SysBusDevice *sbd)
 {
-    PL022State *s = FROM_SYSBUS(PL022State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL022State *s = PL022(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl022_ops, s, "pl022", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->ssi = ssi_create_bus(&dev->qdev, "ssi");
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->ssi = ssi_create_bus(dev, "ssi");
     pl022_reset(s);
-    vmstate_register(&dev->qdev, -1, &vmstate_pl022, s);
+    vmstate_register(dev, -1, &vmstate_pl022, s);
     return 0;
 }
 
@@ -294,7 +299,7 @@ static void pl022_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl022_info = {
-    .name          = "pl022",
+    .name          = TYPE_PL022,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL022State),
     .class_init    = pl022_class_init,
commit ce556e0baffce0624a64bdbe9b077d59cc5f6349
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 14:00:25 2013 +0200

    pl022: Rename pl022_state to PL022State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ssi/pl022.c b/hw/ssi/pl022.c
index 711a0c1..d33534e 100644
--- a/hw/ssi/pl022.c
+++ b/hw/ssi/pl022.c
@@ -39,7 +39,7 @@ do { fprintf(stderr, "pl022: error: " fmt , ## __VA_ARGS__);} while (0)
 #define PL022_INT_RX  0x04
 #define PL022_INT_TX  0x08
 
-typedef struct {
+typedef struct PL022State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t cr0;
@@ -58,12 +58,12 @@ typedef struct {
     uint16_t rx_fifo[8];
     qemu_irq irq;
     SSIBus *ssi;
-} pl022_state;
+} PL022State;
 
 static const unsigned char pl022_id[8] =
   { 0x22, 0x10, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl022_update(pl022_state *s)
+static void pl022_update(PL022State *s)
 {
     s->sr = 0;
     if (s->tx_fifo_len == 0)
@@ -85,7 +85,7 @@ static void pl022_update(pl022_state *s)
     qemu_set_irq(s->irq, (s->is & s->im) != 0);
 }
 
-static void pl022_xfer(pl022_state *s)
+static void pl022_xfer(PL022State *s)
 {
     int i;
     int o;
@@ -133,7 +133,7 @@ static void pl022_xfer(pl022_state *s)
 static uint64_t pl022_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl022_state *s = (pl022_state *)opaque;
+    PL022State *s = (PL022State *)opaque;
     int val;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -177,7 +177,7 @@ static uint64_t pl022_read(void *opaque, hwaddr offset,
 static void pl022_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl022_state *s = (pl022_state *)opaque;
+    PL022State *s = (PL022State *)opaque;
 
     switch (offset) {
     case 0x00: /* CR0 */
@@ -221,7 +221,7 @@ static void pl022_write(void *opaque, hwaddr offset,
     }
 }
 
-static void pl022_reset(pl022_state *s)
+static void pl022_reset(PL022State *s)
 {
     s->rx_fifo_len = 0;
     s->tx_fifo_len = 0;
@@ -242,40 +242,40 @@ static const VMStateDescription vmstate_pl022 = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(cr0, pl022_state),
-        VMSTATE_UINT32(cr1, pl022_state),
-        VMSTATE_UINT32(bitmask, pl022_state),
-        VMSTATE_UINT32(sr, pl022_state),
-        VMSTATE_UINT32(cpsr, pl022_state),
-        VMSTATE_UINT32(is, pl022_state),
-        VMSTATE_UINT32(im, pl022_state),
-        VMSTATE_INT32(tx_fifo_head, pl022_state),
-        VMSTATE_INT32(rx_fifo_head, pl022_state),
-        VMSTATE_INT32(tx_fifo_len, pl022_state),
-        VMSTATE_INT32(rx_fifo_len, pl022_state),
-        VMSTATE_UINT16(tx_fifo[0], pl022_state),
-        VMSTATE_UINT16(rx_fifo[0], pl022_state),
-        VMSTATE_UINT16(tx_fifo[1], pl022_state),
-        VMSTATE_UINT16(rx_fifo[1], pl022_state),
-        VMSTATE_UINT16(tx_fifo[2], pl022_state),
-        VMSTATE_UINT16(rx_fifo[2], pl022_state),
-        VMSTATE_UINT16(tx_fifo[3], pl022_state),
-        VMSTATE_UINT16(rx_fifo[3], pl022_state),
-        VMSTATE_UINT16(tx_fifo[4], pl022_state),
-        VMSTATE_UINT16(rx_fifo[4], pl022_state),
-        VMSTATE_UINT16(tx_fifo[5], pl022_state),
-        VMSTATE_UINT16(rx_fifo[5], pl022_state),
-        VMSTATE_UINT16(tx_fifo[6], pl022_state),
-        VMSTATE_UINT16(rx_fifo[6], pl022_state),
-        VMSTATE_UINT16(tx_fifo[7], pl022_state),
-        VMSTATE_UINT16(rx_fifo[7], pl022_state),
+        VMSTATE_UINT32(cr0, PL022State),
+        VMSTATE_UINT32(cr1, PL022State),
+        VMSTATE_UINT32(bitmask, PL022State),
+        VMSTATE_UINT32(sr, PL022State),
+        VMSTATE_UINT32(cpsr, PL022State),
+        VMSTATE_UINT32(is, PL022State),
+        VMSTATE_UINT32(im, PL022State),
+        VMSTATE_INT32(tx_fifo_head, PL022State),
+        VMSTATE_INT32(rx_fifo_head, PL022State),
+        VMSTATE_INT32(tx_fifo_len, PL022State),
+        VMSTATE_INT32(rx_fifo_len, PL022State),
+        VMSTATE_UINT16(tx_fifo[0], PL022State),
+        VMSTATE_UINT16(rx_fifo[0], PL022State),
+        VMSTATE_UINT16(tx_fifo[1], PL022State),
+        VMSTATE_UINT16(rx_fifo[1], PL022State),
+        VMSTATE_UINT16(tx_fifo[2], PL022State),
+        VMSTATE_UINT16(rx_fifo[2], PL022State),
+        VMSTATE_UINT16(tx_fifo[3], PL022State),
+        VMSTATE_UINT16(rx_fifo[3], PL022State),
+        VMSTATE_UINT16(tx_fifo[4], PL022State),
+        VMSTATE_UINT16(rx_fifo[4], PL022State),
+        VMSTATE_UINT16(tx_fifo[5], PL022State),
+        VMSTATE_UINT16(rx_fifo[5], PL022State),
+        VMSTATE_UINT16(tx_fifo[6], PL022State),
+        VMSTATE_UINT16(rx_fifo[6], PL022State),
+        VMSTATE_UINT16(tx_fifo[7], PL022State),
+        VMSTATE_UINT16(rx_fifo[7], PL022State),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static int pl022_init(SysBusDevice *dev)
 {
-    pl022_state *s = FROM_SYSBUS(pl022_state, dev);
+    PL022State *s = FROM_SYSBUS(PL022State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl022_ops, s, "pl022", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -296,7 +296,7 @@ static void pl022_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl022_info = {
     .name          = "pl022",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl022_state),
+    .instance_size = sizeof(PL022State),
     .class_init    = pl022_class_init,
 };
 
commit 88c034d5b2c406e1859c9a3746229868a20fed41
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:50:51 2013 +0200

    sun4u: QOM cast cleanup for RamDevice
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 9568028..a7214a3 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -714,9 +714,12 @@ static const TypeInfo prom_info = {
 };
 
 
-typedef struct RamDevice
-{
-    SysBusDevice busdev;
+#define TYPE_SUN4U_MEMORY "memory"
+#define SUN4U_RAM(obj) OBJECT_CHECK(RamDevice, (obj), TYPE_SUN4U_MEMORY)
+
+typedef struct RamDevice {
+    SysBusDevice parent_obj;
+
     MemoryRegion ram;
     uint64_t size;
 } RamDevice;
@@ -724,7 +727,7 @@ typedef struct RamDevice
 /* System RAM */
 static int ram_init1(SysBusDevice *dev)
 {
-    RamDevice *d = FROM_SYSBUS(RamDevice, dev);
+    RamDevice *d = SUN4U_RAM(dev);
 
     memory_region_init_ram(&d->ram, OBJECT(d), "sun4u.ram", d->size);
     vmstate_register_ram_global(&d->ram);
@@ -739,10 +742,10 @@ static void ram_init(hwaddr addr, ram_addr_t RAM_size)
     RamDevice *d;
 
     /* allocate RAM */
-    dev = qdev_create(NULL, "memory");
+    dev = qdev_create(NULL, TYPE_SUN4U_MEMORY);
     s = SYS_BUS_DEVICE(dev);
 
-    d = FROM_SYSBUS(RamDevice, s);
+    d = SUN4U_RAM(dev);
     d->size = RAM_size;
     qdev_init_nofail(dev);
 
@@ -764,7 +767,7 @@ static void ram_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ram_info = {
-    .name          = "memory",
+    .name          = TYPE_SUN4U_MEMORY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RamDevice),
     .class_init    = ram_class_init,
commit 13575cf6dbe88ffa9d2f03dace03aedd9e003f8d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:48:18 2013 +0200

    sun4u: QOM cast cleanup for PROMState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 34a5e73..9568028 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -632,8 +632,12 @@ static const TypeInfo ebus_info = {
     .class_init    = ebus_class_init,
 };
 
+#define TYPE_OPENPROM "openprom"
+#define OPENPROM(obj) OBJECT_CHECK(PROMState, (obj), TYPE_OPENPROM)
+
 typedef struct PROMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion prom;
 } PROMState;
 
@@ -651,7 +655,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
     char *filename;
     int ret;
 
-    dev = qdev_create(NULL, "openprom");
+    dev = qdev_create(NULL, TYPE_OPENPROM);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -680,7 +684,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
 
 static int prom_init1(SysBusDevice *dev)
 {
-    PROMState *s = FROM_SYSBUS(PROMState, dev);
+    PROMState *s = OPENPROM(dev);
 
     memory_region_init_ram(&s->prom, OBJECT(s), "sun4u.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
@@ -703,7 +707,7 @@ static void prom_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo prom_info = {
-    .name          = "openprom",
+    .name          = TYPE_OPENPROM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PROMState),
     .class_init    = prom_class_init,
commit 5ab6b4c661ecf3c824e08de6f5c99a855d00fa84
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:45:23 2013 +0200

    sun4m: QOM cast cleanup for RamDevice
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index b943a07..942ca37 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -739,9 +739,12 @@ static const TypeInfo prom_info = {
     .class_init    = prom_class_init,
 };
 
-typedef struct RamDevice
-{
-    SysBusDevice busdev;
+#define TYPE_SUN4M_MEMORY "memory"
+#define SUN4M_RAM(obj) OBJECT_CHECK(RamDevice, (obj), TYPE_SUN4M_MEMORY)
+
+typedef struct RamDevice {
+    SysBusDevice parent_obj;
+
     MemoryRegion ram;
     uint64_t size;
 } RamDevice;
@@ -749,7 +752,7 @@ typedef struct RamDevice
 /* System RAM */
 static int ram_init1(SysBusDevice *dev)
 {
-    RamDevice *d = FROM_SYSBUS(RamDevice, dev);
+    RamDevice *d = SUN4M_RAM(dev);
 
     memory_region_init_ram(&d->ram, OBJECT(d), "sun4m.ram", d->size);
     vmstate_register_ram_global(&d->ram);
@@ -775,7 +778,7 @@ static void ram_init(hwaddr addr, ram_addr_t RAM_size,
     dev = qdev_create(NULL, "memory");
     s = SYS_BUS_DEVICE(dev);
 
-    d = FROM_SYSBUS(RamDevice, s);
+    d = SUN4M_RAM(dev);
     d->size = RAM_size;
     qdev_init_nofail(dev);
 
@@ -797,7 +800,7 @@ static void ram_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ram_info = {
-    .name          = "memory",
+    .name          = TYPE_SUN4M_MEMORY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RamDevice),
     .class_init    = ram_class_init,
commit e6f54c91758d99f476c7db01c449e01a54821e1c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:42:29 2013 +0200

    sun4m: QOM cast cleanup for PROMState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index e5c6881..b943a07 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -658,8 +658,12 @@ static const TypeInfo afx_info = {
     .class_init    = afx_class_init,
 };
 
+#define TYPE_OPENPROM "openprom"
+#define OPENPROM(obj) OBJECT_CHECK(PROMState, (obj), TYPE_OPENPROM)
+
 typedef struct PROMState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion prom;
 } PROMState;
 
@@ -677,7 +681,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
     char *filename;
     int ret;
 
-    dev = qdev_create(NULL, "openprom");
+    dev = qdev_create(NULL, TYPE_OPENPROM);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -706,7 +710,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
 
 static int prom_init1(SysBusDevice *dev)
 {
-    PROMState *s = FROM_SYSBUS(PROMState, dev);
+    PROMState *s = OPENPROM(dev);
 
     memory_region_init_ram(&s->prom, OBJECT(s), "sun4m.prom", PROM_SIZE_MAX);
     vmstate_register_ram_global(&s->prom);
@@ -729,7 +733,7 @@ static void prom_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo prom_info = {
-    .name          = "openprom",
+    .name          = TYPE_OPENPROM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PROMState),
     .class_init    = prom_class_init,
commit b3a4996524910049ac491c512858b7a38878a444
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:38:44 2013 +0200

    sun4m: QOM cast cleanup for AFXState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index eb3b11b..e5c6881 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -612,8 +612,12 @@ static const TypeInfo idreg_info = {
     .class_init    = idreg_class_init,
 };
 
+#define TYPE_TCX_AFX "tcx_afx"
+#define TCX_AFX(obj) OBJECT_CHECK(AFXState, (obj), TYPE_TCX_AFX)
+
 typedef struct AFXState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mem;
 } AFXState;
 
@@ -623,7 +627,7 @@ static void afx_init(hwaddr addr)
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "tcx_afx");
+    dev = qdev_create(NULL, TYPE_TCX_AFX);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -632,7 +636,7 @@ static void afx_init(hwaddr addr)
 
 static int afx_init1(SysBusDevice *dev)
 {
-    AFXState *s = FROM_SYSBUS(AFXState, dev);
+    AFXState *s = TCX_AFX(dev);
 
     memory_region_init_ram(&s->mem, OBJECT(s), "sun4m.afx", 4);
     vmstate_register_ram_global(&s->mem);
@@ -648,7 +652,7 @@ static void afx_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo afx_info = {
-    .name          = "tcx_afx",
+    .name          = TYPE_TCX_AFX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AFXState),
     .class_init    = afx_class_init,
commit ef9dfa4c1c97db30d83dbcc8d31c334641b5f7ca
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:33:46 2013 +0200

    sun4m: QOM cast cleanup for IDRegState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 5c7bd31..eb3b11b 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -559,6 +559,9 @@ static void tcx_init(hwaddr addr, int vram_size, int width,
 }
 
 /* NCR89C100/MACIO Internal ID register */
+
+#define TYPE_MACIO_ID_REGISTER "macio_idreg"
+
 static const uint8_t idreg_data[] = { 0xfe, 0x81, 0x01, 0x03 };
 
 static void idreg_init(hwaddr addr)
@@ -566,7 +569,7 @@ static void idreg_init(hwaddr addr)
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "macio_idreg");
+    dev = qdev_create(NULL, TYPE_MACIO_ID_REGISTER);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
 
@@ -574,14 +577,18 @@ static void idreg_init(hwaddr addr)
     cpu_physical_memory_write_rom(addr, idreg_data, sizeof(idreg_data));
 }
 
+#define MACIO_ID_REGISTER(obj) \
+    OBJECT_CHECK(IDRegState, (obj), TYPE_MACIO_ID_REGISTER)
+
 typedef struct IDRegState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mem;
 } IDRegState;
 
 static int idreg_init1(SysBusDevice *dev)
 {
-    IDRegState *s = FROM_SYSBUS(IDRegState, dev);
+    IDRegState *s = MACIO_ID_REGISTER(dev);
 
     memory_region_init_ram(&s->mem, OBJECT(s),
                            "sun4m.idreg", sizeof(idreg_data));
@@ -599,7 +606,7 @@ static void idreg_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo idreg_info = {
-    .name          = "macio_idreg",
+    .name          = TYPE_MACIO_ID_REGISTER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IDRegState),
     .class_init    = idreg_class_init,
commit 630f44426825f18230072ce239a3dea72242e234
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:23:41 2013 +0200

    pl181: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index dc08595..03875bf 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -22,8 +22,12 @@ do { printf("pl181: " fmt , ## __VA_ARGS__); } while (0)
 
 #define PL181_FIFO_LEN 16
 
+#define TYPE_PL181 "pl181"
+#define PL181(obj) OBJECT_CHECK(PL181State, (obj), TYPE_PL181)
+
 typedef struct PL181State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     SDState *card;
     uint32_t clock;
@@ -449,7 +453,7 @@ static const MemoryRegionOps pl181_ops = {
 
 static void pl181_reset(DeviceState *d)
 {
-    PL181State *s = DO_UPCAST(PL181State, busdev.qdev, d);
+    PL181State *s = PL181(d);
 
     s->power = 0;
     s->cmdarg = 0;
@@ -474,16 +478,17 @@ static void pl181_reset(DeviceState *d)
     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
 }
 
-static int pl181_init(SysBusDevice *dev)
+static int pl181_init(SysBusDevice *sbd)
 {
-    PL181State *s = FROM_SYSBUS(PL181State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL181State *s = PL181(dev);
     DriveInfo *dinfo;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, "pl181", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq[0]);
-    sysbus_init_irq(dev, &s->irq[1]);
-    qdev_init_gpio_out(&s->busdev.qdev, s->cardstatus, 2);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq[0]);
+    sysbus_init_irq(sbd, &s->irq[1]);
+    qdev_init_gpio_out(dev, s->cardstatus, 2);
     dinfo = drive_get_next(IF_SD);
     s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false);
     return 0;
@@ -501,7 +506,7 @@ static void pl181_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl181_info = {
-    .name          = "pl181",
+    .name          = TYPE_PL181,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL181State),
     .class_init    = pl181_class_init,
commit 1d998d93acbbefc3804200ab4387cb0286b07d7b
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:20:09 2013 +0200

    pl181: Rename pl181_state to PL181State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index f5eb1e4..dc08595 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -22,7 +22,7 @@ do { printf("pl181: " fmt , ## __VA_ARGS__); } while (0)
 
 #define PL181_FIFO_LEN 16
 
-typedef struct {
+typedef struct PL181State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     SDState *card;
@@ -50,29 +50,29 @@ typedef struct {
     qemu_irq irq[2];
     /* GPIO outputs for 'card is readonly' and 'card inserted' */
     qemu_irq cardstatus[2];
-} pl181_state;
+} PL181State;
 
 static const VMStateDescription vmstate_pl181 = {
     .name = "pl181",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(clock, pl181_state),
-        VMSTATE_UINT32(power, pl181_state),
-        VMSTATE_UINT32(cmdarg, pl181_state),
-        VMSTATE_UINT32(cmd, pl181_state),
-        VMSTATE_UINT32(datatimer, pl181_state),
-        VMSTATE_UINT32(datalength, pl181_state),
-        VMSTATE_UINT32(respcmd, pl181_state),
-        VMSTATE_UINT32_ARRAY(response, pl181_state, 4),
-        VMSTATE_UINT32(datactrl, pl181_state),
-        VMSTATE_UINT32(datacnt, pl181_state),
-        VMSTATE_UINT32(status, pl181_state),
-        VMSTATE_UINT32_ARRAY(mask, pl181_state, 2),
-        VMSTATE_INT32(fifo_pos, pl181_state),
-        VMSTATE_INT32(fifo_len, pl181_state),
-        VMSTATE_INT32(linux_hack, pl181_state),
-        VMSTATE_UINT32_ARRAY(fifo, pl181_state, PL181_FIFO_LEN),
+        VMSTATE_UINT32(clock, PL181State),
+        VMSTATE_UINT32(power, PL181State),
+        VMSTATE_UINT32(cmdarg, PL181State),
+        VMSTATE_UINT32(cmd, PL181State),
+        VMSTATE_UINT32(datatimer, PL181State),
+        VMSTATE_UINT32(datalength, PL181State),
+        VMSTATE_UINT32(respcmd, PL181State),
+        VMSTATE_UINT32_ARRAY(response, PL181State, 4),
+        VMSTATE_UINT32(datactrl, PL181State),
+        VMSTATE_UINT32(datacnt, PL181State),
+        VMSTATE_UINT32(status, PL181State),
+        VMSTATE_UINT32_ARRAY(mask, PL181State, 2),
+        VMSTATE_INT32(fifo_pos, PL181State),
+        VMSTATE_INT32(fifo_len, PL181State),
+        VMSTATE_INT32(linux_hack, PL181State),
+        VMSTATE_UINT32_ARRAY(fifo, PL181State, PL181_FIFO_LEN),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -125,7 +125,7 @@ static const VMStateDescription vmstate_pl181 = {
 static const unsigned char pl181_id[] =
 { 0x81, 0x11, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl181_update(pl181_state *s)
+static void pl181_update(PL181State *s)
 {
     int i;
     for (i = 0; i < 2; i++) {
@@ -133,7 +133,7 @@ static void pl181_update(pl181_state *s)
     }
 }
 
-static void pl181_fifo_push(pl181_state *s, uint32_t value)
+static void pl181_fifo_push(PL181State *s, uint32_t value)
 {
     int n;
 
@@ -147,7 +147,7 @@ static void pl181_fifo_push(pl181_state *s, uint32_t value)
     DPRINTF("FIFO push %08x\n", (int)value);
 }
 
-static uint32_t pl181_fifo_pop(pl181_state *s)
+static uint32_t pl181_fifo_pop(PL181State *s)
 {
     uint32_t value;
 
@@ -162,7 +162,7 @@ static uint32_t pl181_fifo_pop(pl181_state *s)
     return value;
 }
 
-static void pl181_send_command(pl181_state *s)
+static void pl181_send_command(PL181State *s)
 {
     SDRequest request;
     uint8_t response[16];
@@ -207,7 +207,7 @@ error:
    the FIFO holding 32-bit words and the card taking data in single byte
    chunks.  FIFO bytes are transferred in little-endian order.  */
 
-static void pl181_fifo_run(pl181_state *s)
+static void pl181_fifo_run(PL181State *s)
 {
     uint32_t bits;
     uint32_t value = 0;
@@ -288,7 +288,7 @@ static void pl181_fifo_run(pl181_state *s)
 static uint64_t pl181_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl181_state *s = (pl181_state *)opaque;
+    PL181State *s = (PL181State *)opaque;
     uint32_t tmp;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -372,7 +372,7 @@ static uint64_t pl181_read(void *opaque, hwaddr offset,
 static void pl181_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl181_state *s = (pl181_state *)opaque;
+    PL181State *s = (PL181State *)opaque;
 
     switch (offset) {
     case 0x00: /* Power */
@@ -449,7 +449,7 @@ static const MemoryRegionOps pl181_ops = {
 
 static void pl181_reset(DeviceState *d)
 {
-    pl181_state *s = DO_UPCAST(pl181_state, busdev.qdev, d);
+    PL181State *s = DO_UPCAST(PL181State, busdev.qdev, d);
 
     s->power = 0;
     s->cmdarg = 0;
@@ -476,7 +476,7 @@ static void pl181_reset(DeviceState *d)
 
 static int pl181_init(SysBusDevice *dev)
 {
-    pl181_state *s = FROM_SYSBUS(pl181_state, dev);
+    PL181State *s = FROM_SYSBUS(PL181State, dev);
     DriveInfo *dinfo;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, "pl181", 0x1000);
@@ -503,7 +503,7 @@ static void pl181_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl181_info = {
     .name          = "pl181",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl181_state),
+    .instance_size = sizeof(PL181State),
     .class_init    = pl181_class_init,
 };
 
commit 7a239e46f792b234d77425653a8259152df5d5de
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:18:50 2013 +0200

    milkymist-memcard: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index f69775c..42613b3 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -58,8 +58,13 @@ enum {
     R_MAX
 };
 
+#define TYPE_MILKYMIST_MEMCARD "milkymist-memcard"
+#define MILKYMIST_MEMCARD(obj) \
+    OBJECT_CHECK(MilkymistMemcardState, (obj), TYPE_MILKYMIST_MEMCARD)
+
 struct MilkymistMemcardState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     SDState *card;
 
@@ -231,8 +236,7 @@ static const MemoryRegionOps memcard_mmio_ops = {
 
 static void milkymist_memcard_reset(DeviceState *d)
 {
-    MilkymistMemcardState *s =
-            container_of(d, MilkymistMemcardState, busdev.qdev);
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(d);
     int i;
 
     s->command_write_ptr = 0;
@@ -246,7 +250,7 @@ static void milkymist_memcard_reset(DeviceState *d)
 
 static int milkymist_memcard_init(SysBusDevice *dev)
 {
-    MilkymistMemcardState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
     DriveInfo *dinfo;
 
     dinfo = drive_get_next(IF_SD);
@@ -289,7 +293,7 @@ static void milkymist_memcard_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_memcard_info = {
-    .name          = "milkymist-memcard",
+    .name          = TYPE_MILKYMIST_MEMCARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMemcardState),
     .class_init    = milkymist_memcard_class_init,
commit 880fc798fd34cea6e6647a9210dc7458c9ceedb6
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 13:03:07 2013 +0200

    ppce500_spin: QOM cast cleanup
    
    Introduce type constant and use QOM cast.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 11b7de2..78b23fa 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -42,8 +42,12 @@ typedef struct spin_info {
     uint64_t reserved;
 } QEMU_PACKED SpinInfo;
 
-typedef struct spin_state {
-    SysBusDevice busdev;
+#define TYPE_E500_SPIN "e500-spin"
+#define E500_SPIN(obj) OBJECT_CHECK(SpinState, (obj), TYPE_E500_SPIN)
+
+typedef struct SpinState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     SpinInfo spin[MAX_CPUS];
 } SpinState;
@@ -187,9 +191,7 @@ static const MemoryRegionOps spin_rw_ops = {
 
 static int ppce500_spin_initfn(SysBusDevice *dev)
 {
-    SpinState *s;
-
-    s = FROM_SYSBUS(SpinState, SYS_BUS_DEVICE(dev));
+    SpinState *s = E500_SPIN(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &spin_rw_ops, s,
                           "e500 spin pv device", sizeof(SpinInfo) * MAX_CPUS);
@@ -208,7 +210,7 @@ static void ppce500_spin_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ppce500_spin_info = {
-    .name          = "e500-spin",
+    .name          = TYPE_E500_SPIN,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SpinState),
     .class_init    = ppce500_spin_class_init,
commit 8c1892cf7297ff4972a4ad6dd601921c3a01d618
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:50:29 2013 +0200

    ds1225y: QOM cast cleanup for SysBusNvRamState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index cca6f43..f9a700b 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -104,14 +104,19 @@ static const VMStateDescription vmstate_nvram = {
     }
 };
 
+#define TYPE_DS1225Y "ds1225y"
+#define DS1225Y(obj) OBJECT_CHECK(SysBusNvRamState, (obj), TYPE_DS1225Y)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NvRamState nvram;
 } SysBusNvRamState;
 
 static int nvram_sysbus_initfn(SysBusDevice *dev)
 {
-    NvRamState *s = &FROM_SYSBUS(SysBusNvRamState, dev)->nvram;
+    SysBusNvRamState *sys = DS1225Y(dev);
+    NvRamState *s = &sys->nvram;
     FILE *file;
 
     s->contents = g_malloc0(s->chip_size);
@@ -151,7 +156,7 @@ static void nvram_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo nvram_sysbus_info = {
-    .name          = "ds1225y",
+    .name          = TYPE_DS1225Y,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusNvRamState),
     .class_init    = nvram_sysbus_class_init,
commit 14134f0eb57247e3ec3b8311931a11b344096591
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:47:09 2013 +0200

    ds1225y: Drop bogus qdev field from NvRamState
    
    It is not a device, and the field is not used from code either.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index fa218ce..cca6f43 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -26,7 +26,6 @@
 #include "trace.h"
 
 typedef struct {
-    DeviceState qdev;
     MemoryRegion iomem;
     uint32_t chip_size;
     char *filename;
commit 91a28042958f20eff01a4d441d7072fd1902d375
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:43:06 2013 +0200

    xilinx_ethlite: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 2afc91a..3a2a6c2 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -47,9 +47,14 @@
 #define CTRL_P     0x2
 #define CTRL_S     0x1
 
+#define TYPE_XILINX_ETHLITE "xlnx.xps-ethernetlite"
+#define XILINX_ETHLITE(obj) \
+    OBJECT_CHECK(struct xlx_ethlite, (obj), TYPE_XILINX_ETHLITE)
+
 struct xlx_ethlite
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq irq;
     NICState *nic;
@@ -214,20 +219,21 @@ static NetClientInfo net_xilinx_ethlite_info = {
     .cleanup = eth_cleanup,
 };
 
-static int xilinx_ethlite_init(SysBusDevice *dev)
+static int xilinx_ethlite_init(SysBusDevice *sbd)
 {
-    struct xlx_ethlite *s = FROM_SYSBUS(typeof (*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct xlx_ethlite *s = XILINX_ETHLITE(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->rxbuf = 0;
 
     memory_region_init_io(&s->mmio, OBJECT(s), &eth_ops, s,
                           "xlnx.xps-ethernetlite", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_xilinx_ethlite_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     return 0;
 }
@@ -249,7 +255,7 @@ static void xilinx_ethlite_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_ethlite_info = {
-    .name          = "xlnx.xps-ethernetlite",
+    .name          = TYPE_XILINX_ETHLITE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct xlx_ethlite),
     .class_init    = xilinx_ethlite_class_init,
commit 546921eac5abd7cc6c78f1ceeda3375697ac04bd
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:35:15 2013 +0200

    xgmac: QOM cast cleanup
    
    Introduce type constant and use QOM casts and typedef consistently.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
index 997a5b5..9384fa0 100644
--- a/hw/net/xgmac.c
+++ b/hw/net/xgmac.c
@@ -135,8 +135,12 @@ typedef struct RxTxStats {
     uint64_t rx_mcast;
 } RxTxStats;
 
+#define TYPE_XGMAC "xgmac"
+#define XGMAC(obj) OBJECT_CHECK(XgmacState, (obj), TYPE_XGMAC)
+
 typedef struct XgmacState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq sbd_irq;
     qemu_irq pmt_irq;
@@ -173,14 +177,14 @@ static const VMStateDescription vmstate_xgmac = {
     }
 };
 
-static void xgmac_read_desc(struct XgmacState *s, struct desc *d, int rx)
+static void xgmac_read_desc(XgmacState *s, struct desc *d, int rx)
 {
     uint32_t addr = rx ? s->regs[DMA_CUR_RX_DESC_ADDR] :
         s->regs[DMA_CUR_TX_DESC_ADDR];
     cpu_physical_memory_read(addr, d, sizeof(*d));
 }
 
-static void xgmac_write_desc(struct XgmacState *s, struct desc *d, int rx)
+static void xgmac_write_desc(XgmacState *s, struct desc *d, int rx)
 {
     int reg = rx ? DMA_CUR_RX_DESC_ADDR : DMA_CUR_TX_DESC_ADDR;
     uint32_t addr = s->regs[reg];
@@ -195,7 +199,7 @@ static void xgmac_write_desc(struct XgmacState *s, struct desc *d, int rx)
     cpu_physical_memory_write(addr, d, sizeof(*d));
 }
 
-static void xgmac_enet_send(struct XgmacState *s)
+static void xgmac_enet_send(XgmacState *s)
 {
     struct desc bd;
     int frame_size;
@@ -246,7 +250,7 @@ static void xgmac_enet_send(struct XgmacState *s)
     }
 }
 
-static void enet_update_irq(struct XgmacState *s)
+static void enet_update_irq(XgmacState *s)
 {
     int stat = s->regs[DMA_STATUS] & s->regs[DMA_INTR_ENA];
     qemu_set_irq(s->sbd_irq, !!stat);
@@ -254,7 +258,7 @@ static void enet_update_irq(struct XgmacState *s)
 
 static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
 {
-    struct XgmacState *s = opaque;
+    XgmacState *s = opaque;
     uint64_t r = 0;
     addr >>= 2;
 
@@ -274,7 +278,7 @@ static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
 static void enet_write(void *opaque, hwaddr addr,
                        uint64_t value, unsigned size)
 {
-    struct XgmacState *s = opaque;
+    XgmacState *s = opaque;
 
     addr >>= 2;
     switch (addr) {
@@ -310,7 +314,7 @@ static const MemoryRegionOps enet_mem_ops = {
 
 static int eth_can_rx(NetClientState *nc)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
 
     /* RX enabled?  */
     return s->regs[DMA_CONTROL] & DMA_CONTROL_SR;
@@ -318,7 +322,7 @@ static int eth_can_rx(NetClientState *nc)
 
 static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
     static const unsigned char sa_bcast[6] = {0xff, 0xff, 0xff,
                                               0xff, 0xff, 0xff};
     int unicast, broadcast, multicast;
@@ -366,7 +370,8 @@ out:
 
 static void eth_cleanup(NetClientState *nc)
 {
-    struct XgmacState *s = qemu_get_nic_opaque(nc);
+    XgmacState *s = qemu_get_nic_opaque(nc);
+
     s->nic = NULL;
 }
 
@@ -378,20 +383,21 @@ static NetClientInfo net_xgmac_enet_info = {
     .cleanup = eth_cleanup,
 };
 
-static int xgmac_enet_init(SysBusDevice *dev)
+static int xgmac_enet_init(SysBusDevice *sbd)
 {
-    struct XgmacState *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    XgmacState *s = XGMAC(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
                           "xgmac", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->sbd_irq);
-    sysbus_init_irq(dev, &s->pmt_irq);
-    sysbus_init_irq(dev, &s->mci_irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->sbd_irq);
+    sysbus_init_irq(sbd, &s->pmt_irq);
+    sysbus_init_irq(sbd, &s->mci_irq);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_xgmac_enet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     s->regs[XGMAC_ADDR_HIGH(0)] = (s->conf.macaddr.a[5] << 8) |
@@ -405,7 +411,7 @@ static int xgmac_enet_init(SysBusDevice *dev)
 }
 
 static Property xgmac_properties[] = {
-    DEFINE_NIC_PROPERTIES(struct XgmacState, conf),
+    DEFINE_NIC_PROPERTIES(XgmacState, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -420,9 +426,9 @@ static void xgmac_enet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xgmac_enet_info = {
-    .name          = "xgmac",
+    .name          = TYPE_XGMAC,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct XgmacState),
+    .instance_size = sizeof(XgmacState),
     .class_init    = xgmac_enet_class_init,
 };
 
commit 0618db44b9da3a2525b414a0928d2b445f897eec
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:27:46 2013 +0200

    stellaris_enet: Fix NetClientInfo::cleanup
    
    Drop freeing stellaris_enet_state - that is done by QOM later on unref.
    
    Both MemoryRegion init and savevm registration happen in SysBusDevice
    initfn currently, so move them into an unrealizefn for now.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index 6194e33..9dd77f7 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -391,11 +391,7 @@ static void stellaris_enet_cleanup(NetClientState *nc)
 {
     stellaris_enet_state *s = qemu_get_nic_opaque(nc);
 
-    unregister_savevm(DEVICE(s), "stellaris_enet", s);
-
-    memory_region_destroy(&s->mmio);
-
-    g_free(s);
+    s->nic = NULL;
 }
 
 static NetClientInfo net_stellaris_enet_info = {
@@ -427,6 +423,15 @@ static int stellaris_enet_init(SysBusDevice *sbd)
     return 0;
 }
 
+static void stellaris_enet_unrealize(DeviceState *dev, Error **errp)
+{
+    stellaris_enet_state *s = STELLARIS_ENET(dev);
+
+    unregister_savevm(DEVICE(s), "stellaris_enet", s);
+
+    memory_region_destroy(&s->mmio);
+}
+
 static Property stellaris_enet_properties[] = {
     DEFINE_NIC_PROPERTIES(stellaris_enet_state, conf),
     DEFINE_PROP_END_OF_LIST(),
@@ -438,6 +443,7 @@ static void stellaris_enet_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = stellaris_enet_init;
+    dc->unrealize = stellaris_enet_unrealize;
     dc->props = stellaris_enet_properties;
 }
 
commit 2fa30abadfa2f9f3c47044f677e74988db274d0c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:23:22 2013 +0200

    stellaris_enet: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
index aac7c76..6194e33 100644
--- a/hw/net/stellaris_enet.c
+++ b/hw/net/stellaris_enet.c
@@ -42,8 +42,13 @@ do { fprintf(stderr, "stellaris_enet: error: " fmt , ## __VA_ARGS__);} while (0)
 #define SE_TCTL_CRC     0x04
 #define SE_TCTL_DUPLEX  0x08
 
+#define TYPE_STELLARIS_ENET "stellaris_enet"
+#define STELLARIS_ENET(obj) \
+    OBJECT_CHECK(stellaris_enet_state, (obj), TYPE_STELLARIS_ENET)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t ris;
     uint32_t im;
     uint32_t rctl;
@@ -386,7 +391,7 @@ static void stellaris_enet_cleanup(NetClientState *nc)
 {
     stellaris_enet_state *s = qemu_get_nic_opaque(nc);
 
-    unregister_savevm(&s->busdev.qdev, "stellaris_enet", s);
+    unregister_savevm(DEVICE(s), "stellaris_enet", s);
 
     memory_region_destroy(&s->mmio);
 
@@ -401,22 +406,23 @@ static NetClientInfo net_stellaris_enet_info = {
     .cleanup = stellaris_enet_cleanup,
 };
 
-static int stellaris_enet_init(SysBusDevice *dev)
+static int stellaris_enet_init(SysBusDevice *sbd)
 {
-    stellaris_enet_state *s = FROM_SYSBUS(stellaris_enet_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_enet_state *s = STELLARIS_ENET(dev);
 
     memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,
                           "stellaris_enet", 0x1000);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_stellaris_enet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     stellaris_enet_reset(s);
-    register_savevm(&s->busdev.qdev, "stellaris_enet", -1, 1,
+    register_savevm(dev, "stellaris_enet", -1, 1,
                     stellaris_enet_save, stellaris_enet_load, s);
     return 0;
 }
@@ -436,7 +442,7 @@ static void stellaris_enet_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_enet_info = {
-    .name          = "stellaris_enet",
+    .name          = TYPE_STELLARIS_ENET,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_enet_state),
     .class_init    = stellaris_enet_class_init,
commit 926d152e4c5b56b7a76a4bc77b9cf2987119b884
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:17:48 2013 +0200

    smc91c111: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index c49e37a..f5963e2 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -16,8 +16,12 @@
 /* Number of 2k memory pages available.  */
 #define NUM_PACKETS 4
 
+#define TYPE_SMC91C111 "smc91c111"
+#define SMC91C111(obj) OBJECT_CHECK(smc91c111_state, (obj), TYPE_SMC91C111)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     uint16_t tcr;
@@ -254,7 +258,8 @@ static void smc91c111_queue_tx(smc91c111_state *s, int packet)
 
 static void smc91c111_reset(DeviceState *dev)
 {
-    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, SYS_BUS_DEVICE(dev));
+    smc91c111_state *s = SMC91C111(dev);
+
     s->bank = 0;
     s->tx_fifo_len = 0;
     s->tx_fifo_done_len = 0;
@@ -302,8 +307,9 @@ static void smc91c111_writeb(void *opaque, hwaddr offset,
             return;
         case 5:
             SET_HIGH(rcr, value);
-            if (s->rcr & RCR_SOFT_RST)
-                smc91c111_reset(&s->busdev.qdev);
+            if (s->rcr & RCR_SOFT_RST) {
+                smc91c111_reset(DEVICE(s));
+            }
             return;
         case 10: case 11: /* RPCR */
             /* Ignored */
@@ -744,16 +750,18 @@ static NetClientInfo net_smc91c111_info = {
     .cleanup = smc91c111_cleanup,
 };
 
-static int smc91c111_init1(SysBusDevice *dev)
+static int smc91c111_init1(SysBusDevice *sbd)
 {
-    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    smc91c111_state *s = SMC91C111(dev);
+
     memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
                           "smc91c111-mmio", 16);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     /* ??? Save/restore.  */
     return 0;
@@ -776,7 +784,7 @@ static void smc91c111_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo smc91c111_info = {
-    .name          = "smc91c111",
+    .name          = TYPE_SMC91C111,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(smc91c111_state),
     .class_init    = smc91c111_class_init,
@@ -795,7 +803,7 @@ void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     SysBusDevice *s;
 
     qemu_check_nic_model(nd, "smc91c111");
-    dev = qdev_create(NULL, "smc91c111");
+    dev = qdev_create(NULL, TYPE_SMC91C111);
     qdev_set_nic_properties(dev, nd);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
commit 0e57587f2562dd0123817cefc4e95733f9daec8e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:13:17 2013 +0200

    milkymist-minimac2: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index becd26c..1e92379 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -90,8 +90,13 @@ struct MilkymistMinimac2MdioState {
 };
 typedef struct MilkymistMinimac2MdioState MilkymistMinimac2MdioState;
 
+#define TYPE_MILKYMIST_MINIMAC2 "milkymist-minimac2"
+#define MILKYMIST_MINIMAC2(obj) \
+    OBJECT_CHECK(MilkymistMinimac2State, (obj), TYPE_MILKYMIST_MINIMAC2)
+
 struct MilkymistMinimac2State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     char *phy_model;
@@ -429,8 +434,7 @@ static void minimac2_cleanup(NetClientState *nc)
 
 static void milkymist_minimac2_reset(DeviceState *d)
 {
-    MilkymistMinimac2State *s =
-            container_of(d, MilkymistMinimac2State, busdev.qdev);
+    MilkymistMinimac2State *s = MILKYMIST_MINIMAC2(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -453,17 +457,18 @@ static NetClientInfo net_milkymist_minimac2_info = {
     .cleanup = minimac2_cleanup,
 };
 
-static int milkymist_minimac2_init(SysBusDevice *dev)
+static int milkymist_minimac2_init(SysBusDevice *sbd)
 {
-    MilkymistMinimac2State *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    MilkymistMinimac2State *s = MILKYMIST_MINIMAC2(dev);
     size_t buffers_size = TARGET_PAGE_ALIGN(3 * MINIMAC2_BUFFER_SIZE);
 
-    sysbus_init_irq(dev, &s->rx_irq);
-    sysbus_init_irq(dev, &s->tx_irq);
+    sysbus_init_irq(sbd, &s->rx_irq);
+    sysbus_init_irq(sbd, &s->tx_irq);
 
     memory_region_init_io(&s->regs_region, OBJECT(dev), &minimac2_ops, s,
                           "milkymist-minimac2", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->regs_region);
+    sysbus_init_mmio(sbd, &s->regs_region);
 
     /* register buffers memory */
     memory_region_init_ram(&s->buffers, OBJECT(dev), "milkymist-minimac2.buffers",
@@ -473,11 +478,11 @@ static int milkymist_minimac2_init(SysBusDevice *dev)
     s->rx1_buf = s->rx0_buf + MINIMAC2_BUFFER_SIZE;
     s->tx_buf = s->rx1_buf + MINIMAC2_BUFFER_SIZE;
 
-    sysbus_init_mmio(dev, &s->buffers);
+    sysbus_init_mmio(sbd, &s->buffers);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_milkymist_minimac2_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     return 0;
@@ -532,7 +537,7 @@ static void milkymist_minimac2_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_minimac2_info = {
-    .name          = "milkymist-minimac2",
+    .name          = TYPE_MILKYMIST_MINIMAC2,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMinimac2State),
     .class_init    = milkymist_minimac2_class_init,
commit b1a2aaf77499fe6ac059eeceacc8e70858f1c65d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 12:08:14 2013 +0200

    lance: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/lance.c b/hw/net/lance.c
index 1be7b72..e339f02 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -43,8 +43,13 @@
 #include "pcnet.h"
 #include "trace.h"
 
+#define TYPE_LANCE "lance"
+#define SYSBUS_PCNET(obj) \
+    OBJECT_CHECK(SysBusPCNetState, (obj), TYPE_LANCE)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     PCNetState state;
 } SysBusPCNetState;
 
@@ -112,28 +117,29 @@ static const VMStateDescription vmstate_lance = {
     }
 };
 
-static int lance_init(SysBusDevice *dev)
+static int lance_init(SysBusDevice *sbd)
 {
-    SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SysBusPCNetState *d = SYSBUS_PCNET(dev);
     PCNetState *s = &d->state;
 
     memory_region_init_io(&s->mmio, OBJECT(d), &lance_mem_ops, d,
                           "lance-mmio", 4);
 
-    qdev_init_gpio_in(&dev->qdev, parent_lance_reset, 1);
+    qdev_init_gpio_in(dev, parent_lance_reset, 1);
 
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->phys_mem_read = ledma_memory_read;
     s->phys_mem_write = ledma_memory_write;
-    return pcnet_common_init(&dev->qdev, s, &net_lance_info);
+    return pcnet_common_init(dev, s, &net_lance_info);
 }
 
 static void lance_reset(DeviceState *dev)
 {
-    SysBusPCNetState *d = DO_UPCAST(SysBusPCNetState, busdev.qdev, dev);
+    SysBusPCNetState *d = SYSBUS_PCNET(dev);
 
     pcnet_h_reset(&d->state);
 }
@@ -158,7 +164,7 @@ static void lance_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lance_info = {
-    .name          = "lance",
+    .name          = TYPE_LANCE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SysBusPCNetState),
     .class_init    = lance_class_init,
commit 3ff66d101be9e2f08db1b674495b489f3c969810
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:55:02 2013 +0200

    lan9118: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index 3323f48..2c838f6 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -170,8 +170,12 @@ static const VMStateDescription vmstate_lan9118_packet = {
     }
 };
 
+#define TYPE_LAN9118 "lan9118"
+#define LAN9118(obj) OBJECT_CHECK(lan9118_state, (obj), TYPE_LAN9118)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     NICState *nic;
     NICConf conf;
     qemu_irq irq;
@@ -401,7 +405,8 @@ static void phy_reset(lan9118_state *s)
 
 static void lan9118_reset(DeviceState *d)
 {
-    lan9118_state *s = FROM_SYSBUS(lan9118_state, SYS_BUS_DEVICE(d));
+    lan9118_state *s = LAN9118(d);
+
     s->irq_cfg &= (IRQ_TYPE | IRQ_POL);
     s->int_sts = 0;
     s->int_en = 0;
@@ -1053,7 +1058,7 @@ static void lan9118_writel(void *opaque, hwaddr offset,
     case CSR_HW_CFG:
         if (val & 1) {
             /* SRST */
-            lan9118_reset(&s->busdev.qdev);
+            lan9118_reset(DEVICE(s));
         } else {
             s->hw_cfg = (val & 0x003f300) | (s->hw_cfg & 0x4);
         }
@@ -1320,9 +1325,10 @@ static NetClientInfo net_lan9118_info = {
     .link_status_changed = lan9118_set_link,
 };
 
-static int lan9118_init1(SysBusDevice *dev)
+static int lan9118_init1(SysBusDevice *sbd)
 {
-    lan9118_state *s = FROM_SYSBUS(lan9118_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    lan9118_state *s = LAN9118(dev);
     QEMUBH *bh;
     int i;
     const MemoryRegionOps *mem_ops =
@@ -1330,12 +1336,12 @@ static int lan9118_init1(SysBusDevice *dev)
 
     memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                           "lan9118-mmio", 0x100);
-    sysbus_init_mmio(dev, &s->mmio);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_lan9118_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     s->eeprom[0] = 0xa5;
     for (i = 0; i < 6; i++) {
@@ -1370,7 +1376,7 @@ static void lan9118_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lan9118_info = {
-    .name          = "lan9118",
+    .name          = TYPE_LAN9118,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(lan9118_state),
     .class_init    = lan9118_class_init,
@@ -1389,7 +1395,7 @@ void lan9118_init(NICInfo *nd, uint32_t base, qemu_irq irq)
     SysBusDevice *s;
 
     qemu_check_nic_model(nd, "lan9118");
-    dev = qdev_create(NULL, "lan9118");
+    dev = qdev_create(NULL, TYPE_LAN9118);
     qdev_set_nic_properties(dev, nd);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
commit 58076497dfeff9721ec8f7476336292c8e0eb8c7
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:48:42 2013 +0200

    etraxfs_eth: Rename fs_eth to ETRAXFSEthState
    
    Also add a typedef.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index dda1fc3..78ebbbc 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -324,9 +324,9 @@ static void mdio_cycle(struct qemu_mdio *bus)
 
 #define TYPE_ETRAX_FS_ETH "etraxfs-eth"
 #define ETRAX_FS_ETH(obj) \
-    OBJECT_CHECK(struct fs_eth, (obj), TYPE_ETRAX_FS_ETH)
+    OBJECT_CHECK(ETRAXFSEthState, (obj), TYPE_ETRAX_FS_ETH)
 
-struct fs_eth
+typedef struct ETRAXFSEthState
 {
     SysBusDevice parent_obj;
 
@@ -354,9 +354,9 @@ struct fs_eth
 
     /* PHY.     */
     struct qemu_phy phy;
-};
+} ETRAXFSEthState;
 
-static void eth_validate_duplex(struct fs_eth *eth)
+static void eth_validate_duplex(ETRAXFSEthState *eth)
 {
     struct qemu_phy *phy;
     unsigned int phy_duplex;
@@ -387,7 +387,7 @@ static void eth_validate_duplex(struct fs_eth *eth)
 static uint64_t
 eth_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
     uint32_t r = 0;
 
     addr >>= 2;
@@ -404,7 +404,7 @@ eth_read(void *opaque, hwaddr addr, unsigned int size)
     return r;
 }
 
-static void eth_update_ma(struct fs_eth *eth, int ma)
+static void eth_update_ma(ETRAXFSEthState *eth, int ma)
 {
     int reg;
     int i = 0;
@@ -433,7 +433,7 @@ static void
 eth_write(void *opaque, hwaddr addr,
           uint64_t val64, unsigned int size)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
     uint32_t value = val64;
 
     addr >>= 2;
@@ -477,7 +477,7 @@ eth_write(void *opaque, hwaddr addr,
 /* The ETRAX FS has a groupt address table (GAT) which works like a k=1 bloom
    filter dropping group addresses we have not joined.    The filter has 64
    bits (m). The has function is a simple nible xor of the group addr.    */
-static int eth_match_groupaddr(struct fs_eth *eth, const unsigned char *sa)
+static int eth_match_groupaddr(ETRAXFSEthState *eth, const unsigned char *sa)
 {
     unsigned int hsh;
     int m_individual = eth->regs[RW_REC_CTRL] & 4;
@@ -528,7 +528,7 @@ static int eth_can_receive(NetClientState *nc)
 static ssize_t eth_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
     unsigned char sa_bcast[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
     int use_ma0 = eth->regs[RW_REC_CTRL] & 1;
     int use_ma1 = eth->regs[RW_REC_CTRL] & 2;
     int r_bcast = eth->regs[RW_REC_CTRL] & 8;
@@ -552,12 +552,12 @@ static ssize_t eth_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     /* FIXME: Find another way to pass on the fake csum.  */
     etraxfs_dmac_input(eth->dma_in, (void *)buf, size + 4, 1);
 
-        return size;
+    return size;
 }
 
 static int eth_tx_push(void *opaque, unsigned char *buf, int len, bool eop)
 {
-    struct fs_eth *eth = opaque;
+    ETRAXFSEthState *eth = opaque;
 
     D(printf("%s buf=%p len=%d\n", __func__, buf, len));
     qemu_send_packet(qemu_get_queue(eth->nic), buf, len);
@@ -566,7 +566,7 @@ static int eth_tx_push(void *opaque, unsigned char *buf, int len, bool eop)
 
 static void eth_set_link(NetClientState *nc)
 {
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
     D(printf("%s %d\n", __func__, nc->link_down));
     eth->phy.link = !nc->link_down;
 }
@@ -583,7 +583,7 @@ static const MemoryRegionOps eth_ops = {
 
 static void eth_cleanup(NetClientState *nc)
 {
-    struct fs_eth *eth = qemu_get_nic_opaque(nc);
+    ETRAXFSEthState *eth = qemu_get_nic_opaque(nc);
 
     /* Disconnect the client.  */
     eth->dma_out->client.push = NULL;
@@ -605,7 +605,7 @@ static NetClientInfo net_etraxfs_info = {
 static int fs_eth_init(SysBusDevice *sbd)
 {
     DeviceState *dev = DEVICE(sbd);
-    struct fs_eth *s = ETRAX_FS_ETH(dev);
+    ETRAXFSEthState *s = ETRAX_FS_ETH(dev);
 
     if (!s->dma_out || !s->dma_in) {
         hw_error("Unconnected ETRAX-FS Ethernet MAC.\n");
@@ -632,10 +632,10 @@ static int fs_eth_init(SysBusDevice *sbd)
 }
 
 static Property etraxfs_eth_properties[] = {
-    DEFINE_PROP_UINT32("phyaddr", struct fs_eth, phyaddr, 1),
-    DEFINE_PROP_PTR("dma_out", struct fs_eth, vdma_out),
-    DEFINE_PROP_PTR("dma_in", struct fs_eth, vdma_in),
-    DEFINE_NIC_PROPERTIES(struct fs_eth, conf),
+    DEFINE_PROP_UINT32("phyaddr", ETRAXFSEthState, phyaddr, 1),
+    DEFINE_PROP_PTR("dma_out", ETRAXFSEthState, vdma_out),
+    DEFINE_PROP_PTR("dma_in", ETRAXFSEthState, vdma_in),
+    DEFINE_NIC_PROPERTIES(ETRAXFSEthState, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -651,7 +651,7 @@ static void etraxfs_eth_class_init(ObjectClass *klass, void *data)
 static const TypeInfo etraxfs_eth_info = {
     .name          = TYPE_ETRAX_FS_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct fs_eth),
+    .instance_size = sizeof(ETRAXFSEthState),
     .class_init    = etraxfs_eth_class_init,
 };
 
commit 8784dfa4bc3cb6ee3b6115ea52a4cae2874be7f9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:44:01 2013 +0200

    etraxfs_eth: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/etraxfs_eth.c b/hw/net/etraxfs_eth.c
index ab9a215..dda1fc3 100644
--- a/hw/net/etraxfs_eth.c
+++ b/hw/net/etraxfs_eth.c
@@ -322,9 +322,14 @@ static void mdio_cycle(struct qemu_mdio *bus)
 #define R_STAT          0x0b
 #define FS_ETH_MAX_REGS      0x17
 
+#define TYPE_ETRAX_FS_ETH "etraxfs-eth"
+#define ETRAX_FS_ETH(obj) \
+    OBJECT_CHECK(struct fs_eth, (obj), TYPE_ETRAX_FS_ETH)
+
 struct fs_eth
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     NICState *nic;
     NICConf conf;
@@ -597,9 +602,10 @@ static NetClientInfo net_etraxfs_info = {
     .link_status_changed = eth_set_link,
 };
 
-static int fs_eth_init(SysBusDevice *dev)
+static int fs_eth_init(SysBusDevice *sbd)
 {
-    struct fs_eth *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct fs_eth *s = ETRAX_FS_ETH(dev);
 
     if (!s->dma_out || !s->dma_in) {
         hw_error("Unconnected ETRAX-FS Ethernet MAC.\n");
@@ -612,11 +618,11 @@ static int fs_eth_init(SysBusDevice *dev)
 
     memory_region_init_io(&s->mmio, OBJECT(dev), &eth_ops, s,
                           "etraxfs-eth", 0x5c);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
     s->nic = qemu_new_nic(&net_etraxfs_info, &s->conf,
-                          object_get_typename(OBJECT(s)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(s)), dev->id, s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
 
@@ -643,7 +649,7 @@ static void etraxfs_eth_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_eth_info = {
-    .name          = "etraxfs-eth",
+    .name          = TYPE_ETRAX_FS_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct fs_eth),
     .class_init    = etraxfs_eth_class_init,
commit 318643beaa50f49d3bfa9e318b067784d8fb4f30
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 11:39:47 2013 +0200

    cadence_gem: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index ac929cb..4a355bb 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -315,8 +315,12 @@ static inline void rx_desc_set_length(unsigned *desc, unsigned len)
     desc[1] |= len;
 }
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_CADENCE_GEM "cadence_gem"
+#define GEM(obj) OBJECT_CHECK(GemState, (obj), TYPE_CADENCE_GEM)
+
+typedef struct GemState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     NICState *nic;
     NICConf conf;
@@ -945,7 +949,7 @@ static void gem_phy_reset(GemState *s)
 
 static void gem_reset(DeviceState *d)
 {
-    GemState *s = FROM_SYSBUS(GemState, SYS_BUS_DEVICE(d));
+    GemState *s = GEM(d);
 
     DB_PRINT("\n");
 
@@ -1155,22 +1159,22 @@ static NetClientInfo net_gem_info = {
     .link_status_changed = gem_set_link,
 };
 
-static int gem_init(SysBusDevice *dev)
+static int gem_init(SysBusDevice *sbd)
 {
-    GemState *s;
+    DeviceState *dev = DEVICE(sbd);
+    GemState *s = GEM(dev);
 
     DB_PRINT("\n");
 
-    s = FROM_SYSBUS(GemState, dev);
     gem_init_register_masks(s);
     memory_region_init_io(&s->iomem, OBJECT(s), &gem_ops, s,
                           "enet", sizeof(s->regs));
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&net_gem_info, &s->conf,
-            object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+            object_get_typename(OBJECT(dev)), dev->id, s);
 
     return 0;
 }
@@ -1206,10 +1210,10 @@ static void gem_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo gem_info = {
-    .class_init = gem_class_init,
-    .name  = "cadence_gem",
+    .name  = TYPE_CADENCE_GEM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(GemState),
+    .class_init = gem_class_init,
 };
 
 static void gem_register_types(void)
commit a054e2c2ddea91c8e34fe847327c6250f6f791d6
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:29:03 2013 +0200

    zynq_slcr: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index fc7a85f..e42a5b0 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -114,8 +114,12 @@ typedef enum {
   RESET_MAX
 } ResetValues;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_ZYNQ_SLCR "xilinx,zynq_slcr"
+#define ZYNQ_SLCR(obj) OBJECT_CHECK(ZynqSLCRState, (obj), TYPE_ZYNQ_SLCR)
+
+typedef struct ZynqSLCRState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     union {
@@ -158,9 +162,8 @@ typedef struct {
 
 static void zynq_slcr_reset(DeviceState *d)
 {
+    ZynqSLCRState *s = ZYNQ_SLCR(d);
     int i;
-    ZynqSLCRState *s =
-            FROM_SYSBUS(ZynqSLCRState, SYS_BUS_DEVICE(d));
 
     DB_PRINT("RESET\n");
 
@@ -492,7 +495,7 @@ static const MemoryRegionOps slcr_ops = {
 
 static int zynq_slcr_init(SysBusDevice *dev)
 {
-    ZynqSLCRState *s = FROM_SYSBUS(ZynqSLCRState, dev);
+    ZynqSLCRState *s = ZYNQ_SLCR(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &slcr_ops, s, "slcr", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -523,7 +526,7 @@ static void zynq_slcr_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo zynq_slcr_info = {
     .class_init = zynq_slcr_class_init,
-    .name  = "xilinx,zynq_slcr",
+    .name  = TYPE_ZYNQ_SLCR,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(ZynqSLCRState),
 };
commit f1a0a79f4faeac50ea490496e92d00d7260d9437
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:21:50 2013 +0200

    slavio_misc: QOM cast cleanup for APCState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index 1b93a01..767544e 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -57,8 +57,12 @@ typedef struct MiscState {
     uint16_t leds;
 } MiscState;
 
+#define TYPE_APC "apc"
+#define APC(obj) OBJECT_CHECK(APCState, (obj), TYPE_APC)
+
 typedef struct APCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq cpu_halt;
 } APCState;
@@ -411,7 +415,7 @@ static const VMStateDescription vmstate_misc = {
 
 static int apc_init1(SysBusDevice *dev)
 {
-    APCState *s = FROM_SYSBUS(APCState, dev);
+    APCState *s = APC(dev);
 
     sysbus_init_irq(dev, &s->cpu_halt);
 
@@ -498,7 +502,7 @@ static void apc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo apc_info = {
-    .name          = "apc",
+    .name          = TYPE_APC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MiscState),
     .class_init    = apc_class_init,
commit 95eb2084f9e59c50cb989ef0e717e0d933bd1480
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:19:11 2013 +0200

    slavio_misc: QOM cast cleanup for MiscState
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/slavio_misc.c b/hw/misc/slavio_misc.c
index 00d9542..1b93a01 100644
--- a/hw/misc/slavio_misc.c
+++ b/hw/misc/slavio_misc.c
@@ -34,8 +34,12 @@
  * This also includes the PMC CPU idle controller.
  */
 
+#define TYPE_SLAVIO_MISC "slavio_misc"
+#define SLAVIO_MISC(obj) OBJECT_CHECK(MiscState, (obj), TYPE_SLAVIO_MISC)
+
 typedef struct MiscState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion cfg_iomem;
     MemoryRegion diag_iomem;
     MemoryRegion mdm_iomem;
@@ -88,7 +92,7 @@ static void slavio_misc_update_irq(void *opaque)
 
 static void slavio_misc_reset(DeviceState *d)
 {
-    MiscState *s = container_of(d, MiscState, busdev.qdev);
+    MiscState *s = SLAVIO_MISC(d);
 
     // Diagnostic and system control registers not cleared in reset
     s->config = s->aux1 = s->aux2 = s->mctrl = 0;
@@ -418,52 +422,53 @@ static int apc_init1(SysBusDevice *dev)
     return 0;
 }
 
-static int slavio_misc_init1(SysBusDevice *dev)
+static int slavio_misc_init1(SysBusDevice *sbd)
 {
-    MiscState *s = FROM_SYSBUS(MiscState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    MiscState *s = SLAVIO_MISC(dev);
 
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fdc_tc);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fdc_tc);
 
     /* 8 bit registers */
     /* Slavio control */
     memory_region_init_io(&s->cfg_iomem, OBJECT(s), &slavio_cfg_mem_ops, s,
                           "configuration", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->cfg_iomem);
+    sysbus_init_mmio(sbd, &s->cfg_iomem);
 
     /* Diagnostics */
     memory_region_init_io(&s->diag_iomem, OBJECT(s), &slavio_diag_mem_ops, s,
                           "diagnostic", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->diag_iomem);
+    sysbus_init_mmio(sbd, &s->diag_iomem);
 
     /* Modem control */
     memory_region_init_io(&s->mdm_iomem, OBJECT(s), &slavio_mdm_mem_ops, s,
                           "modem", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->mdm_iomem);
+    sysbus_init_mmio(sbd, &s->mdm_iomem);
 
     /* 16 bit registers */
     /* ss600mp diag LEDs */
     memory_region_init_io(&s->led_iomem, OBJECT(s), &slavio_led_mem_ops, s,
                           "leds", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->led_iomem);
+    sysbus_init_mmio(sbd, &s->led_iomem);
 
     /* 32 bit registers */
     /* System control */
     memory_region_init_io(&s->sysctrl_iomem, OBJECT(s), &slavio_sysctrl_mem_ops, s,
                           "system-control", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->sysctrl_iomem);
+    sysbus_init_mmio(sbd, &s->sysctrl_iomem);
 
     /* AUX 1 (Misc System Functions) */
     memory_region_init_io(&s->aux1_iomem, OBJECT(s), &slavio_aux1_mem_ops, s,
                           "misc-system-functions", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->aux1_iomem);
+    sysbus_init_mmio(sbd, &s->aux1_iomem);
 
     /* AUX 2 (Software Powerdown Control) */
     memory_region_init_io(&s->aux2_iomem, OBJECT(s), &slavio_aux2_mem_ops, s,
                           "software-powerdown-control", MISC_SIZE);
-    sysbus_init_mmio(dev, &s->aux2_iomem);
+    sysbus_init_mmio(sbd, &s->aux2_iomem);
 
-    qdev_init_gpio_in(&dev->qdev, slavio_set_power_fail, 1);
+    qdev_init_gpio_in(dev, slavio_set_power_fail, 1);
 
     return 0;
 }
@@ -479,7 +484,7 @@ static void slavio_misc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo slavio_misc_info = {
-    .name          = "slavio_misc",
+    .name          = TYPE_SLAVIO_MISC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MiscState),
     .class_init    = slavio_misc_class_init,
commit af89a444932111807b4a5a5a799829c98bdab560
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 23:16:03 2013 +0200

    puv3_pm: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/puv3_pm.c b/hw/misc/puv3_pm.c
index 5592560..37f2369 100644
--- a/hw/misc/puv3_pm.c
+++ b/hw/misc/puv3_pm.c
@@ -14,8 +14,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_PM "puv3_pm"
+#define PUV3_PM(obj) OBJECT_CHECK(PUV3PMState, (obj), TYPE_PUV3_PM)
+
+typedef struct PUV3PMState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t reg_PMCR;
@@ -116,7 +120,7 @@ static const MemoryRegionOps puv3_pm_ops = {
 
 static int puv3_pm_init(SysBusDevice *dev)
 {
-    PUV3PMState *s = FROM_SYSBUS(PUV3PMState, dev);
+    PUV3PMState *s = PUV3_PM(dev);
 
     s->reg_PCGR = 0x0;
 
@@ -135,7 +139,7 @@ static void puv3_pm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_pm_info = {
-    .name = "puv3_pm",
+    .name = TYPE_PUV3_PM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3PMState),
     .class_init = puv3_pm_class_init,
commit 5c0e12f5a6f6da6cc63e4d0fd309f4699300daa0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 22:32:18 2013 +0200

    mst_fpga: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/mst_fpga.c b/hw/misc/mst_fpga.c
index 604be5e..c96810f 100644
--- a/hw/misc/mst_fpga.c
+++ b/hw/misc/mst_fpga.c
@@ -35,25 +35,30 @@
 #define MST_PCMCIA_CD0_IRQ	9
 #define MST_PCMCIA_CD1_IRQ	13
 
+#define TYPE_MAINSTONE_FPGA "mainstone-fpga"
+#define MAINSTONE_FPGA(obj) \
+    OBJECT_CHECK(mst_irq_state, (obj), TYPE_MAINSTONE_FPGA)
+
 typedef struct mst_irq_state{
-	SysBusDevice busdev;
-	MemoryRegion iomem;
-
-	qemu_irq parent;
-
-	uint32_t prev_level;
-	uint32_t leddat1;
-	uint32_t leddat2;
-	uint32_t ledctrl;
-	uint32_t gpswr;
-	uint32_t mscwr1;
-	uint32_t mscwr2;
-	uint32_t mscwr3;
-	uint32_t mscrd;
-	uint32_t intmskena;
-	uint32_t intsetclr;
-	uint32_t pcmcia0;
-	uint32_t pcmcia1;
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+
+    qemu_irq parent;
+
+    uint32_t prev_level;
+    uint32_t leddat1;
+    uint32_t leddat2;
+    uint32_t ledctrl;
+    uint32_t gpswr;
+    uint32_t mscwr1;
+    uint32_t mscwr2;
+    uint32_t mscwr3;
+    uint32_t mscrd;
+    uint32_t intmskena;
+    uint32_t intsetclr;
+    uint32_t pcmcia0;
+    uint32_t pcmcia1;
 }mst_irq_state;
 
 static void
@@ -194,24 +199,23 @@ static int mst_fpga_post_load(void *opaque, int version_id)
 	return 0;
 }
 
-static int mst_fpga_init(SysBusDevice *dev)
+static int mst_fpga_init(SysBusDevice *sbd)
 {
-	mst_irq_state *s;
-
-	s = FROM_SYSBUS(mst_irq_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mst_irq_state *s = MAINSTONE_FPGA(dev);
 
-	s->pcmcia0 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
-	s->pcmcia1 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
+    s->pcmcia0 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
+    s->pcmcia1 = MST_PCMCIAx_READY | MST_PCMCIAx_nCD;
 
-	sysbus_init_irq(dev, &s->parent);
+    sysbus_init_irq(sbd, &s->parent);
 
-	/* alloc the external 16 irqs */
-	qdev_init_gpio_in(&dev->qdev, mst_fpga_set_irq, MST_NUM_IRQS);
+    /* alloc the external 16 irqs */
+    qdev_init_gpio_in(dev, mst_fpga_set_irq, MST_NUM_IRQS);
 
-	memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
-			    "fpga", 0x00100000);
-	sysbus_init_mmio(dev, &s->iomem);
-	return 0;
+    memory_region_init_io(&s->iomem, OBJECT(s), &mst_fpga_ops, s,
+                          "fpga", 0x00100000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    return 0;
 }
 
 static VMStateDescription vmstate_mst_fpga_regs = {
@@ -249,7 +253,7 @@ static void mst_fpga_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mst_fpga_info = {
-    .name          = "mainstone-fpga",
+    .name          = TYPE_MAINSTONE_FPGA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mst_irq_state),
     .class_init    = mst_fpga_class_init,
commit aee31f7b4b7e23cfcdab604b6edc5e7df8d5c32f
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 22:27:57 2013 +0200

    milkymist-pfpu: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/milkymist-pfpu.c b/hw/misc/milkymist-pfpu.c
index 2b64ee7..b3b2143 100644
--- a/hw/misc/milkymist-pfpu.c
+++ b/hw/misc/milkymist-pfpu.c
@@ -116,8 +116,13 @@ static const char *opcode_to_str[] = {
 };
 #endif
 
+#define TYPE_MILKYMIST_PFPU "milkymist-pfpu"
+#define MILKYMIST_PFPU(obj) \
+    OBJECT_CHECK(MilkymistPFPUState, (obj), TYPE_MILKYMIST_PFPU)
+
 struct MilkymistPFPUState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -473,7 +478,7 @@ static const MemoryRegionOps pfpu_mmio_ops = {
 
 static void milkymist_pfpu_reset(DeviceState *d)
 {
-    MilkymistPFPUState *s = container_of(d, MilkymistPFPUState, busdev.qdev);
+    MilkymistPFPUState *s = MILKYMIST_PFPU(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -493,7 +498,7 @@ static void milkymist_pfpu_reset(DeviceState *d)
 
 static int milkymist_pfpu_init(SysBusDevice *dev)
 {
-    MilkymistPFPUState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistPFPUState *s = MILKYMIST_PFPU(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -530,7 +535,7 @@ static void milkymist_pfpu_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_pfpu_info = {
-    .name          = "milkymist-pfpu",
+    .name          = TYPE_MILKYMIST_PFPU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistPFPUState),
     .class_init    = milkymist_pfpu_class_init,
commit 829617a97cd4316872465db6b28d304e49f45f05
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 22:24:22 2013 +0200

    milkymist-hpdmc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/milkymist-hpdmc.c b/hw/misc/milkymist-hpdmc.c
index a498881..aef135e 100644
--- a/hw/misc/milkymist-hpdmc.c
+++ b/hw/misc/milkymist-hpdmc.c
@@ -40,8 +40,13 @@ enum {
     IODELAY_PLL2_LOCKED  = (1<<7),
 };
 
+#define TYPE_MILKYMIST_HPDMC "milkymist-hpdmc"
+#define MILKYMIST_HPDMC(obj) \
+    OBJECT_CHECK(MilkymistHpdmcState, (obj), TYPE_MILKYMIST_HPDMC)
+
 struct MilkymistHpdmcState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     uint32_t regs[R_MAX];
@@ -111,7 +116,7 @@ static const MemoryRegionOps hpdmc_mmio_ops = {
 
 static void milkymist_hpdmc_reset(DeviceState *d)
 {
-    MilkymistHpdmcState *s = container_of(d, MilkymistHpdmcState, busdev.qdev);
+    MilkymistHpdmcState *s = MILKYMIST_HPDMC(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -125,7 +130,7 @@ static void milkymist_hpdmc_reset(DeviceState *d)
 
 static int milkymist_hpdmc_init(SysBusDevice *dev)
 {
-    MilkymistHpdmcState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistHpdmcState *s = MILKYMIST_HPDMC(dev);
 
     memory_region_init_io(&s->regs_region, OBJECT(dev), &hpdmc_mmio_ops, s,
             "milkymist-hpdmc", R_MAX * 4);
@@ -156,7 +161,7 @@ static void milkymist_hpdmc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_hpdmc_info = {
-    .name          = "milkymist-hpdmc",
+    .name          = TYPE_MILKYMIST_HPDMC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistHpdmcState),
     .class_init    = milkymist_hpdmc_class_init,
commit 816d323be3e66b82cd92657c783c0e5e7b88d6d9
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:59:04 2013 +0200

    lm32_sys: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/lm32_sys.c b/hw/misc/lm32_sys.c
index 060a5bf..9bdb781 100644
--- a/hw/misc/lm32_sys.c
+++ b/hw/misc/lm32_sys.c
@@ -44,8 +44,12 @@ enum {
 
 #define MAX_TESTNAME_LEN 16
 
+#define TYPE_LM32_SYS "lm32-sys"
+#define LM32_SYS(obj) OBJECT_CHECK(LM32SysState, (obj), TYPE_LM32_SYS)
+
 struct LM32SysState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t base;
     uint32_t regs[R_MAX];
@@ -104,7 +108,7 @@ static const MemoryRegionOps sys_ops = {
 
 static void sys_reset(DeviceState *d)
 {
-    LM32SysState *s = container_of(d, LM32SysState, busdev.qdev);
+    LM32SysState *s = LM32_SYS(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -115,7 +119,7 @@ static void sys_reset(DeviceState *d)
 
 static int lm32_sys_init(SysBusDevice *dev)
 {
-    LM32SysState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32SysState *s = LM32_SYS(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &sys_ops , s,
                           "sys", R_MAX * 4);
@@ -158,7 +162,7 @@ static void lm32_sys_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_sys_info = {
-    .name          = "lm32-sys",
+    .name          = TYPE_LM32_SYS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32SysState),
     .class_init    = lm32_sys_class_init,
commit b6e1df2e91fbf89226605a9459bc86c2aa0a404e
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:47:58 2013 +0200

    exynos4210_pmu: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index 28395ba..cbf0795 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -386,8 +386,13 @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
 #define PMU_NUM_OF_REGISTERS     \
     (sizeof(exynos4210_pmu_regs) / sizeof(Exynos4210PmuReg))
 
+#define TYPE_EXYNOS4210_PMU "exynos4210.pmu"
+#define EXYNOS4210_PMU(obj) \
+    OBJECT_CHECK(Exynos4210PmuState, (obj), TYPE_EXYNOS4210_PMU)
+
 typedef struct Exynos4210PmuState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t reg[PMU_NUM_OF_REGISTERS];
 } Exynos4210PmuState;
@@ -443,8 +448,7 @@ static const MemoryRegionOps exynos4210_pmu_ops = {
 
 static void exynos4210_pmu_reset(DeviceState *dev)
 {
-    Exynos4210PmuState *s =
-            container_of(dev, Exynos4210PmuState, busdev.qdev);
+    Exynos4210PmuState *s = EXYNOS4210_PMU(dev);
     unsigned i;
 
     /* Set default values for registers */
@@ -455,7 +459,7 @@ static void exynos4210_pmu_reset(DeviceState *dev)
 
 static int exynos4210_pmu_init(SysBusDevice *dev)
 {
-    Exynos4210PmuState *s = FROM_SYSBUS(Exynos4210PmuState, dev);
+    Exynos4210PmuState *s = EXYNOS4210_PMU(dev);
 
     /* memory mapping */
     memory_region_init_io(&s->iomem, OBJECT(dev), &exynos4210_pmu_ops, s,
@@ -485,7 +489,7 @@ static void exynos4210_pmu_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_pmu_info = {
-    .name          = "exynos4210.pmu",
+    .name          = TYPE_EXYNOS4210_PMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210PmuState),
     .class_init    = exynos4210_pmu_class_init,
commit 100bb15cb8e8788cca36f708c51c3d8e03041759
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:39:54 2013 +0200

    eccmemctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/eccmemctl.c b/hw/misc/eccmemctl.c
index 3de9675..96a69d4 100644
--- a/hw/misc/eccmemctl.c
+++ b/hw/misc/eccmemctl.c
@@ -120,8 +120,12 @@
 #define ECC_DIAG_SIZE  4
 #define ECC_DIAG_MASK  (ECC_DIAG_SIZE - 1)
 
+#define TYPE_ECC_MEMCTL "eccmemctl"
+#define ECC_MEMCTL(obj) OBJECT_CHECK(ECCState, (obj), TYPE_ECC_MEMCTL)
+
 typedef struct ECCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem, iomem_diag;
     qemu_irq irq;
     uint32_t regs[ECC_NREGS];
@@ -273,13 +277,14 @@ static const VMStateDescription vmstate_ecc = {
 
 static void ecc_reset(DeviceState *d)
 {
-    ECCState *s = container_of(d, ECCState, busdev.qdev);
+    ECCState *s = ECC_MEMCTL(d);
 
-    if (s->version == ECC_MCC)
+    if (s->version == ECC_MCC) {
         s->regs[ECC_MER] &= ECC_MER_REU;
-    else
+    } else {
         s->regs[ECC_MER] &= (ECC_MER_VER | ECC_MER_IMPL | ECC_MER_MRR |
                              ECC_MER_DCI);
+    }
     s->regs[ECC_MDR] = 0x20;
     s->regs[ECC_MFSR] = 0;
     s->regs[ECC_VCR] = 0;
@@ -292,7 +297,7 @@ static void ecc_reset(DeviceState *d)
 
 static int ecc_init1(SysBusDevice *dev)
 {
-    ECCState *s = FROM_SYSBUS(ECCState, dev);
+    ECCState *s = ECC_MEMCTL(dev);
 
     sysbus_init_irq(dev, &s->irq);
     s->regs[0] = s->version;
@@ -325,7 +330,7 @@ static void ecc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ecc_info = {
-    .name          = "eccmemctl",
+    .name          = TYPE_ECC_MEMCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ECCState),
     .class_init    = ecc_class_init,
commit ba4ea5bd299c03a7af87b0881ea6d445c46beddf
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:34:18 2013 +0200

    arm_sysctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index 5906ae5..4a911d4 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -16,8 +16,13 @@
 
 #define LOCK_VALUE 0xa05f
 
+#define TYPE_ARM_SYSCTL "realview_sysctl"
+#define ARM_SYSCTL(obj) \
+    OBJECT_CHECK(arm_sysctl_state, (obj), TYPE_ARM_SYSCTL)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq pl110_mux_ctrl;
 
@@ -85,7 +90,7 @@ static int board_id(arm_sysctl_state *s)
 
 static void arm_sysctl_reset(DeviceState *d)
 {
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, SYS_BUS_DEVICE(d));
+    arm_sysctl_state *s = ARM_SYSCTL(d);
     int i;
 
     s->leds = 0;
@@ -587,7 +592,7 @@ static void arm_sysctl_init(Object *obj)
 {
     DeviceState *dev = DEVICE(obj);
     SysBusDevice *sd = SYS_BUS_DEVICE(obj);
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, sd);
+    arm_sysctl_state *s = ARM_SYSCTL(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &arm_sysctl_ops, s,
                           "arm-sysctl", 0x1000);
@@ -598,14 +603,15 @@ static void arm_sysctl_init(Object *obj)
 
 static void arm_sysctl_realize(DeviceState *d, Error **errp)
 {
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, SYS_BUS_DEVICE(d));
+    arm_sysctl_state *s = ARM_SYSCTL(d);
+
     s->db_clock = g_new0(uint32_t, s->db_num_clocks);
 }
 
 static void arm_sysctl_finalize(Object *obj)
 {
-    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-    arm_sysctl_state *s = FROM_SYSBUS(arm_sysctl_state, dev);
+    arm_sysctl_state *s = ARM_SYSCTL(obj);
+
     g_free(s->db_voltage);
     g_free(s->db_clock);
     g_free(s->db_clock_reset);
@@ -634,7 +640,7 @@ static void arm_sysctl_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo arm_sysctl_info = {
-    .name          = "realview_sysctl",
+    .name          = TYPE_ARM_SYSCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(arm_sysctl_state),
     .instance_init = arm_sysctl_init,
commit 0e8982e969304995dfa39e6767b0152564a72130
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:20:52 2013 +0200

    arm_l2x0: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index f3ce477..8e192cd 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -23,8 +23,12 @@
 /* L2C-310 r3p2 */
 #define CACHE_ID 0x410000c8
 
+#define TYPE_ARM_L2X0 "l2x0"
+#define ARM_L2X0(obj) OBJECT_CHECK(L2x0State, (obj), TYPE_ARM_L2X0)
+
 typedef struct L2x0State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t cache_type;
     uint32_t ctrl;
@@ -137,7 +141,7 @@ static void l2x0_priv_write(void *opaque, hwaddr offset,
 
 static void l2x0_priv_reset(DeviceState *dev)
 {
-    L2x0State *s = DO_UPCAST(L2x0State, busdev.qdev, dev);
+    L2x0State *s = ARM_L2X0(dev);
 
     s->ctrl = 0;
     s->aux_ctrl = 0x02020000;
@@ -155,7 +159,7 @@ static const MemoryRegionOps l2x0_mem_ops = {
 
 static int l2x0_priv_init(SysBusDevice *dev)
 {
-    L2x0State *s = FROM_SYSBUS(L2x0State, dev);
+    L2x0State *s = ARM_L2X0(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &l2x0_mem_ops, s,
                           "l2x0_cc", 0x1000);
@@ -181,7 +185,7 @@ static void l2x0_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo l2x0_info = {
-    .name = "l2x0",
+    .name = TYPE_ARM_L2X0,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(L2x0State),
     .class_init = l2x0_class_init,
commit ae1953d045eb1fdfc21279284d78c7f23aba9762
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:18:35 2013 +0200

    arm_l2x0: Rename l2x0_state to L2x0State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/arm_l2x0.c b/hw/misc/arm_l2x0.c
index 3d6acee..f3ce477 100644
--- a/hw/misc/arm_l2x0.c
+++ b/hw/misc/arm_l2x0.c
@@ -23,7 +23,7 @@
 /* L2C-310 r3p2 */
 #define CACHE_ID 0x410000c8
 
-typedef struct l2x0_state {
+typedef struct L2x0State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t cache_type;
@@ -33,19 +33,19 @@ typedef struct l2x0_state {
     uint32_t tag_ctrl;
     uint32_t filter_start;
     uint32_t filter_end;
-} l2x0_state;
+} L2x0State;
 
 static const VMStateDescription vmstate_l2x0 = {
     .name = "l2x0",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(ctrl, l2x0_state),
-        VMSTATE_UINT32(aux_ctrl, l2x0_state),
-        VMSTATE_UINT32(data_ctrl, l2x0_state),
-        VMSTATE_UINT32(tag_ctrl, l2x0_state),
-        VMSTATE_UINT32(filter_start, l2x0_state),
-        VMSTATE_UINT32(filter_end, l2x0_state),
+        VMSTATE_UINT32(ctrl, L2x0State),
+        VMSTATE_UINT32(aux_ctrl, L2x0State),
+        VMSTATE_UINT32(data_ctrl, L2x0State),
+        VMSTATE_UINT32(tag_ctrl, L2x0State),
+        VMSTATE_UINT32(filter_start, L2x0State),
+        VMSTATE_UINT32(filter_end, L2x0State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -55,7 +55,7 @@ static uint64_t l2x0_priv_read(void *opaque, hwaddr offset,
                                unsigned size)
 {
     uint32_t cache_data;
-    l2x0_state *s = (l2x0_state *)opaque;
+    L2x0State *s = (L2x0State *)opaque;
     offset &= 0xfff;
     if (offset >= 0x730 && offset < 0x800) {
         return 0; /* cache ops complete */
@@ -97,7 +97,7 @@ static uint64_t l2x0_priv_read(void *opaque, hwaddr offset,
 static void l2x0_priv_write(void *opaque, hwaddr offset,
                             uint64_t value, unsigned size)
 {
-    l2x0_state *s = (l2x0_state *)opaque;
+    L2x0State *s = (L2x0State *)opaque;
     offset &= 0xfff;
     if (offset >= 0x730 && offset < 0x800) {
         /* ignore */
@@ -137,7 +137,7 @@ static void l2x0_priv_write(void *opaque, hwaddr offset,
 
 static void l2x0_priv_reset(DeviceState *dev)
 {
-    l2x0_state *s = DO_UPCAST(l2x0_state, busdev.qdev, dev);
+    L2x0State *s = DO_UPCAST(L2x0State, busdev.qdev, dev);
 
     s->ctrl = 0;
     s->aux_ctrl = 0x02020000;
@@ -155,7 +155,7 @@ static const MemoryRegionOps l2x0_mem_ops = {
 
 static int l2x0_priv_init(SysBusDevice *dev)
 {
-    l2x0_state *s = FROM_SYSBUS(l2x0_state, dev);
+    L2x0State *s = FROM_SYSBUS(L2x0State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &l2x0_mem_ops, s,
                           "l2x0_cc", 0x1000);
@@ -164,7 +164,7 @@ static int l2x0_priv_init(SysBusDevice *dev)
 }
 
 static Property l2x0_properties[] = {
-    DEFINE_PROP_UINT32("cache-type", l2x0_state, cache_type, 0x1c100100),
+    DEFINE_PROP_UINT32("cache-type", L2x0State, cache_type, 0x1c100100),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -183,7 +183,7 @@ static void l2x0_class_init(ObjectClass *klass, void *data)
 static const TypeInfo l2x0_info = {
     .name = "l2x0",
     .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(l2x0_state),
+    .instance_size = sizeof(L2x0State),
     .class_init = l2x0_class_init,
 };
 
commit cc3e064ee948c612c38aa99a364f5af95422e5ec
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:46:22 2013 +0200

    xilinx_intc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/xilinx_intc.c b/hw/intc/xilinx_intc.c
index 25d2057..4a10398 100644
--- a/hw/intc/xilinx_intc.c
+++ b/hw/intc/xilinx_intc.c
@@ -37,9 +37,13 @@
 #define R_MER       7
 #define R_MAX       8
 
+#define TYPE_XILINX_INTC "xlnx.xps-intc"
+#define XILINX_INTC(obj) OBJECT_CHECK(struct xlx_pic, (obj), TYPE_XILINX_INTC)
+
 struct xlx_pic
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     qemu_irq parent_irq;
 
@@ -153,16 +157,17 @@ static void irq_handler(void *opaque, int irq, int level)
     update_irq(p);
 }
 
-static int xilinx_intc_init(SysBusDevice *dev)
+static int xilinx_intc_init(SysBusDevice *sbd)
 {
-    struct xlx_pic *p = FROM_SYSBUS(typeof (*p), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct xlx_pic *p = XILINX_INTC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &p->parent_irq);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &p->parent_irq);
 
     memory_region_init_io(&p->mmio, OBJECT(p), &pic_ops, p, "xlnx.xps-intc",
                           R_MAX * 4);
-    sysbus_init_mmio(dev, &p->mmio);
+    sysbus_init_mmio(sbd, &p->mmio);
     return 0;
 }
 
@@ -181,7 +186,7 @@ static void xilinx_intc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_intc_info = {
-    .name          = "xlnx.xps-intc",
+    .name          = TYPE_XILINX_INTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct xlx_pic),
     .class_init    = xilinx_intc_class_init,
commit 7abad863d7249b4b501923c3c28d952c473bf23a
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:40:40 2013 +0200

    slavio_intctl: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/slavio_intctl.c b/hw/intc/slavio_intctl.c
index b47d0f0..41a1672 100644
--- a/hw/intc/slavio_intctl.c
+++ b/hw/intc/slavio_intctl.c
@@ -53,8 +53,13 @@ typedef struct SLAVIO_CPUINTCTLState {
     uint32_t irl_out;
 } SLAVIO_CPUINTCTLState;
 
+#define TYPE_SLAVIO_INTCTL "slavio_intctl"
+#define SLAVIO_INTCTL(obj) \
+    OBJECT_CHECK(SLAVIO_INTCTLState, (obj), TYPE_SLAVIO_INTCTL)
+
 typedef struct SLAVIO_INTCTLState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 #ifdef DEBUG_IRQ_COUNT
     uint64_t irq_count[32];
@@ -206,12 +211,9 @@ static const MemoryRegionOps slavio_intctlm_mem_ops = {
 
 void slavio_pic_info(Monitor *mon, DeviceState *dev)
 {
-    SysBusDevice *sd;
-    SLAVIO_INTCTLState *s;
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     int i;
 
-    sd = SYS_BUS_DEVICE(dev);
-    s = FROM_SYSBUS(SLAVIO_INTCTLState, sd);
     for (i = 0; i < MAX_CPUS; i++) {
         monitor_printf(mon, "per-cpu %d: pending 0x%08x\n", i,
                        s->slaves[i].intreg_pending);
@@ -225,13 +227,11 @@ void slavio_irq_info(Monitor *mon, DeviceState *dev)
 #ifndef DEBUG_IRQ_COUNT
     monitor_printf(mon, "irq statistic code not compiled.\n");
 #else
-    SysBusDevice *sd;
-    SLAVIO_INTCTLState *s;
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     int i;
     int64_t count;
 
-    sd = SYS_BUS_DEVICE(dev);
-    s = FROM_SYSBUS(SLAVIO_INTCTLState, sd);
+    s = SLAVIO_INTCTL(dev);
     monitor_printf(mon, "IRQ statistics:\n");
     for (i = 0; i < 32; i++) {
         count = s->irq_count[i];
@@ -406,7 +406,7 @@ static const VMStateDescription vmstate_intctl = {
 
 static void slavio_intctl_reset(DeviceState *d)
 {
-    SLAVIO_INTCTLState *s = container_of(d, SLAVIO_INTCTLState, busdev.qdev);
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(d);
     int i;
 
     for (i = 0; i < MAX_CPUS; i++) {
@@ -419,27 +419,28 @@ static void slavio_intctl_reset(DeviceState *d)
     slavio_check_interrupts(s, 0);
 }
 
-static int slavio_intctl_init1(SysBusDevice *dev)
+static int slavio_intctl_init1(SysBusDevice *sbd)
 {
-    SLAVIO_INTCTLState *s = FROM_SYSBUS(SLAVIO_INTCTLState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    SLAVIO_INTCTLState *s = SLAVIO_INTCTL(dev);
     unsigned int i, j;
     char slave_name[45];
 
-    qdev_init_gpio_in(&dev->qdev, slavio_set_irq_all, 32 + MAX_CPUS);
+    qdev_init_gpio_in(dev, slavio_set_irq_all, 32 + MAX_CPUS);
     memory_region_init_io(&s->iomem, OBJECT(s), &slavio_intctlm_mem_ops, s,
                           "master-interrupt-controller", INTCTLM_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     for (i = 0; i < MAX_CPUS; i++) {
         snprintf(slave_name, sizeof(slave_name),
                  "slave-interrupt-controller-%i", i);
         for (j = 0; j < MAX_PILS; j++) {
-            sysbus_init_irq(dev, &s->cpu_irqs[i][j]);
+            sysbus_init_irq(sbd, &s->cpu_irqs[i][j]);
         }
         memory_region_init_io(&s->slaves[i].iomem, OBJECT(s),
                               &slavio_intctl_mem_ops,
                               &s->slaves[i], slave_name, INTCTL_SIZE);
-        sysbus_init_mmio(dev, &s->slaves[i].iomem);
+        sysbus_init_mmio(sbd, &s->slaves[i].iomem);
         s->slaves[i].cpu = i;
         s->slaves[i].master = s;
     }
@@ -458,7 +459,7 @@ static void slavio_intctl_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo slavio_intctl_info = {
-    .name          = "slavio_intctl",
+    .name          = TYPE_SLAVIO_INTCTL,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLAVIO_INTCTLState),
     .class_init    = slavio_intctl_class_init,
commit b09a6f7b30591a5de4c4ceb22e3063a81e7317c4
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:34:29 2013 +0200

    realview_gic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/realview_gic.c b/hw/intc/realview_gic.c
index e122c2c..ce80447 100644
--- a/hw/intc/realview_gic.c
+++ b/hw/intc/realview_gic.c
@@ -9,8 +9,13 @@
 
 #include "hw/sysbus.h"
 
+#define TYPE_REALVIEW_GIC "realview_gic"
+#define REALVIEW_GIC(obj) \
+    OBJECT_CHECK(RealViewGICState, (obj), TYPE_REALVIEW_GIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     DeviceState *gic;
     MemoryRegion container;
 } RealViewGICState;
@@ -21,9 +26,10 @@ static void realview_gic_set_irq(void *opaque, int irq, int level)
     qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);
 }
 
-static int realview_gic_init(SysBusDevice *dev)
+static int realview_gic_init(SysBusDevice *sbd)
 {
-    RealViewGICState *s = FROM_SYSBUS(RealViewGICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    RealViewGICState *s = REALVIEW_GIC(dev);
     SysBusDevice *busdev;
     /* The GICs on the RealView boards have a fixed nonconfigurable
      * number of interrupt lines, so we don't need to expose this as
@@ -38,10 +44,10 @@ static int realview_gic_init(SysBusDevice *dev)
     busdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, busdev);
+    sysbus_pass_irq(sbd, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, realview_gic_set_irq, numirq - 32);
+    qdev_init_gpio_in(dev, realview_gic_set_irq, numirq - 32);
 
     memory_region_init(&s->container, OBJECT(s),
                        "realview-gic-container", 0x2000);
@@ -49,7 +55,7 @@ static int realview_gic_init(SysBusDevice *dev)
                                 sysbus_mmio_get_region(busdev, 1));
     memory_region_add_subregion(&s->container, 0x1000,
                                 sysbus_mmio_get_region(busdev, 0));
-    sysbus_init_mmio(dev, &s->container);
+    sysbus_init_mmio(sbd, &s->container);
     return 0;
 }
 
@@ -61,7 +67,7 @@ static void realview_gic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo realview_gic_info = {
-    .name          = "realview_gic",
+    .name          = TYPE_REALVIEW_GIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(RealViewGICState),
     .class_init    = realview_gic_class_init,
commit 1ecdf4022ad968f4346905c269247ff3c5d2aa2d
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:30:57 2013 +0200

    puv3_intc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/puv3_intc.c b/hw/intc/puv3_intc.c
index 44b6651..c2803d0 100644
--- a/hw/intc/puv3_intc.c
+++ b/hw/intc/puv3_intc.c
@@ -13,8 +13,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_INTC "puv3_intc"
+#define PUV3_INTC(obj) OBJECT_CHECK(PUV3INTCState, (obj), TYPE_PUV3_INTC)
+
+typedef struct PUV3INTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq parent_irq;
 
@@ -96,19 +100,20 @@ static const MemoryRegionOps puv3_intc_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int puv3_intc_init(SysBusDevice *dev)
+static int puv3_intc_init(SysBusDevice *sbd)
 {
-    PUV3INTCState *s = FROM_SYSBUS(PUV3INTCState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PUV3INTCState *s = PUV3_INTC(dev);
 
-    qdev_init_gpio_in(&s->busdev.qdev, puv3_intc_handler, PUV3_IRQS_NR);
-    sysbus_init_irq(&s->busdev, &s->parent_irq);
+    qdev_init_gpio_in(dev, puv3_intc_handler, PUV3_IRQS_NR);
+    sysbus_init_irq(sbd, &s->parent_irq);
 
     s->reg_ICMR = 0;
     s->reg_ICPR = 0;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &puv3_intc_ops, s, "puv3_intc",
-            PUV3_REGS_OFFSET);
-    sysbus_init_mmio(dev, &s->iomem);
+                          PUV3_REGS_OFFSET);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -121,7 +126,7 @@ static void puv3_intc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_intc_info = {
-    .name = "puv3_intc",
+    .name = TYPE_PUV3_INTC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3INTCState),
     .class_init = puv3_intc_class_init,
commit 7fc3266f769880d5cb8d6c7995a1a5f898986baf
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:23:57 2013 +0200

    pl190: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index dfd6ebf..329680d 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -15,8 +15,12 @@
 
 #define PL190_NUM_PRIO 17
 
+#define TYPE_PL190 "pl190"
+#define PL190(obj) OBJECT_CHECK(PL190State, (obj), TYPE_PL190)
+
 typedef struct PL190State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t level;
     uint32_t soft_level;
@@ -218,29 +222,29 @@ static const MemoryRegionOps pl190_ops = {
 
 static void pl190_reset(DeviceState *d)
 {
-  PL190State *s = DO_UPCAST(PL190State, busdev.qdev, d);
-  int i;
+    PL190State *s = PL190(d);
+    int i;
 
-  for (i = 0; i < 16; i++)
-    {
-      s->vect_addr[i] = 0;
-      s->vect_control[i] = 0;
+    for (i = 0; i < 16; i++) {
+        s->vect_addr[i] = 0;
+        s->vect_control[i] = 0;
     }
-  s->vect_addr[16] = 0;
-  s->prio_mask[17] = 0xffffffff;
-  s->priority = PL190_NUM_PRIO;
-  pl190_update_vectors(s);
+    s->vect_addr[16] = 0;
+    s->prio_mask[17] = 0xffffffff;
+    s->priority = PL190_NUM_PRIO;
+    pl190_update_vectors(s);
 }
 
-static int pl190_init(SysBusDevice *dev)
+static int pl190_init(SysBusDevice *sbd)
 {
-    PL190State *s = FROM_SYSBUS(PL190State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL190State *s = PL190(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl190_ops, s, "pl190", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    qdev_init_gpio_in(&dev->qdev, pl190_set_irq, 32);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    qdev_init_gpio_in(dev, pl190_set_irq, 32);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
     return 0;
 }
 
@@ -275,7 +279,7 @@ static void pl190_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl190_info = {
-    .name          = "pl190",
+    .name          = TYPE_PL190,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL190State),
     .class_init    = pl190_class_init,
commit aefbc25695b00b6d6731ef0b8c53e12462bffd86
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:18:42 2013 +0200

    pl190: Rename pl190_state to PL190State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/pl190.c b/hw/intc/pl190.c
index fdb29d7..dfd6ebf 100644
--- a/hw/intc/pl190.c
+++ b/hw/intc/pl190.c
@@ -15,7 +15,7 @@
 
 #define PL190_NUM_PRIO 17
 
-typedef struct {
+typedef struct PL190State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t level;
@@ -32,18 +32,18 @@ typedef struct {
     int prev_prio[PL190_NUM_PRIO];
     qemu_irq irq;
     qemu_irq fiq;
-} pl190_state;
+} PL190State;
 
 static const unsigned char pl190_id[] =
 { 0x90, 0x11, 0x04, 0x00, 0x0D, 0xf0, 0x05, 0xb1 };
 
-static inline uint32_t pl190_irq_level(pl190_state *s)
+static inline uint32_t pl190_irq_level(PL190State *s)
 {
     return (s->level | s->soft_level) & s->irq_enable & ~s->fiq_select;
 }
 
 /* Update interrupts.  */
-static void pl190_update(pl190_state *s)
+static void pl190_update(PL190State *s)
 {
     uint32_t level = pl190_irq_level(s);
     int set;
@@ -56,7 +56,7 @@ static void pl190_update(pl190_state *s)
 
 static void pl190_set_irq(void *opaque, int irq, int level)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
 
     if (level)
         s->level |= 1u << irq;
@@ -65,7 +65,7 @@ static void pl190_set_irq(void *opaque, int irq, int level)
     pl190_update(s);
 }
 
-static void pl190_update_vectors(pl190_state *s)
+static void pl190_update_vectors(PL190State *s)
 {
     uint32_t mask;
     int i;
@@ -88,7 +88,7 @@ static void pl190_update_vectors(pl190_state *s)
 static uint64_t pl190_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
     int i;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -152,7 +152,7 @@ static uint64_t pl190_read(void *opaque, hwaddr offset,
 static void pl190_write(void *opaque, hwaddr offset,
                         uint64_t val, unsigned size)
 {
-    pl190_state *s = (pl190_state *)opaque;
+    PL190State *s = (PL190State *)opaque;
 
     if (offset >= 0x100 && offset < 0x140) {
         s->vect_addr[(offset - 0x100) >> 2] = val;
@@ -218,7 +218,7 @@ static const MemoryRegionOps pl190_ops = {
 
 static void pl190_reset(DeviceState *d)
 {
-  pl190_state *s = DO_UPCAST(pl190_state, busdev.qdev, d);
+  PL190State *s = DO_UPCAST(PL190State, busdev.qdev, d);
   int i;
 
   for (i = 0; i < 16; i++)
@@ -234,7 +234,7 @@ static void pl190_reset(DeviceState *d)
 
 static int pl190_init(SysBusDevice *dev)
 {
-    pl190_state *s = FROM_SYSBUS(pl190_state, dev);
+    PL190State *s = FROM_SYSBUS(PL190State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl190_ops, s, "pl190", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -249,16 +249,16 @@ static const VMStateDescription vmstate_pl190 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(level, pl190_state),
-        VMSTATE_UINT32(soft_level, pl190_state),
-        VMSTATE_UINT32(irq_enable, pl190_state),
-        VMSTATE_UINT32(fiq_select, pl190_state),
-        VMSTATE_UINT8_ARRAY(vect_control, pl190_state, 16),
-        VMSTATE_UINT32_ARRAY(vect_addr, pl190_state, PL190_NUM_PRIO),
-        VMSTATE_UINT32_ARRAY(prio_mask, pl190_state, PL190_NUM_PRIO+1),
-        VMSTATE_INT32(protected, pl190_state),
-        VMSTATE_INT32(priority, pl190_state),
-        VMSTATE_INT32_ARRAY(prev_prio, pl190_state, PL190_NUM_PRIO),
+        VMSTATE_UINT32(level, PL190State),
+        VMSTATE_UINT32(soft_level, PL190State),
+        VMSTATE_UINT32(irq_enable, PL190State),
+        VMSTATE_UINT32(fiq_select, PL190State),
+        VMSTATE_UINT8_ARRAY(vect_control, PL190State, 16),
+        VMSTATE_UINT32_ARRAY(vect_addr, PL190State, PL190_NUM_PRIO),
+        VMSTATE_UINT32_ARRAY(prio_mask, PL190State, PL190_NUM_PRIO+1),
+        VMSTATE_INT32(protected, PL190State),
+        VMSTATE_INT32(priority, PL190State),
+        VMSTATE_INT32_ARRAY(prev_prio, PL190State, PL190_NUM_PRIO),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -277,7 +277,7 @@ static void pl190_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl190_info = {
     .name          = "pl190",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl190_state),
+    .instance_size = sizeof(PL190State),
     .class_init    = pl190_class_init,
 };
 
commit 47edc5a479e0927c6ce04eaf3e84db0ba7ddbb41
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 20:14:20 2013 +0200

    omap_intc: QOM'ify omap-intc and omap2-intc
    
    Create a new abstract base type and let omap-intc and omap2-intc inherit
    from it. Introduce a type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/omap_intc.c b/hw/intc/omap_intc.c
index bca8585..7dd63da 100644
--- a/hw/intc/omap_intc.c
+++ b/hw/intc/omap_intc.c
@@ -32,8 +32,13 @@ struct omap_intr_handler_bank_s {
     unsigned char priority[32];
 };
 
+#define TYPE_OMAP_INTC "common-omap-intc"
+#define OMAP_INTC(obj) \
+    OBJECT_CHECK(struct omap_intr_handler_s, (obj), TYPE_OMAP_INTC)
+
 struct omap_intr_handler_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq *pins;
     qemu_irq parent_intr[2];
     MemoryRegion mmio;
@@ -328,8 +333,7 @@ static const MemoryRegionOps omap_inth_mem_ops = {
 
 static void omap_inth_reset(DeviceState *dev)
 {
-    struct omap_intr_handler_s *s = FROM_SYSBUS(struct omap_intr_handler_s,
-                                                SYS_BUS_DEVICE(dev));
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
     int i;
 
     for (i = 0; i < s->nbanks; ++i){
@@ -356,20 +360,21 @@ static void omap_inth_reset(DeviceState *dev)
     qemu_set_irq(s->parent_intr[1], 0);
 }
 
-static int omap_intc_init(SysBusDevice *dev)
+static int omap_intc_init(SysBusDevice *sbd)
 {
-    struct omap_intr_handler_s *s;
-    s = FROM_SYSBUS(struct omap_intr_handler_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
+
     if (!s->iclk) {
         hw_error("omap-intc: clk not connected\n");
     }
     s->nbanks = 1;
-    sysbus_init_irq(dev, &s->parent_intr[0]);
-    sysbus_init_irq(dev, &s->parent_intr[1]);
-    qdev_init_gpio_in(&dev->qdev, omap_set_intr, s->nbanks * 32);
+    sysbus_init_irq(sbd, &s->parent_intr[0]);
+    sysbus_init_irq(sbd, &s->parent_intr[1]);
+    qdev_init_gpio_in(dev, omap_set_intr, s->nbanks * 32);
     memory_region_init_io(&s->mmio, OBJECT(s), &omap_inth_mem_ops, s,
                           "omap-intc", s->size);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -391,8 +396,7 @@ static void omap_intc_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo omap_intc_info = {
     .name          = "omap-intc",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct omap_intr_handler_s),
+    .parent        = TYPE_OMAP_INTC,
     .class_init    = omap_intc_class_init,
 };
 
@@ -500,8 +504,9 @@ static void omap2_inth_write(void *opaque, hwaddr addr,
     case 0x10:	/* INTC_SYSCONFIG */
         s->autoidle &= 4;
         s->autoidle |= (value & 1) << 2;
-        if (value & 2)						/* SOFTRESET */
-            omap_inth_reset(&s->busdev.qdev);
+        if (value & 2) {                                        /* SOFTRESET */
+            omap_inth_reset(DEVICE(s));
+        }
         return;
 
     case 0x48:	/* INTC_CONTROL */
@@ -594,10 +599,11 @@ static const MemoryRegionOps omap2_inth_mem_ops = {
     },
 };
 
-static int omap2_intc_init(SysBusDevice *dev)
+static int omap2_intc_init(SysBusDevice *sbd)
 {
-    struct omap_intr_handler_s *s;
-    s = FROM_SYSBUS(struct omap_intr_handler_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_intr_handler_s *s = OMAP_INTC(dev);
+
     if (!s->iclk) {
         hw_error("omap2-intc: iclk not connected\n");
     }
@@ -606,12 +612,12 @@ static int omap2_intc_init(SysBusDevice *dev)
     }
     s->level_only = 1;
     s->nbanks = 3;
-    sysbus_init_irq(dev, &s->parent_intr[0]);
-    sysbus_init_irq(dev, &s->parent_intr[1]);
-    qdev_init_gpio_in(&dev->qdev, omap_set_intr_noedge, s->nbanks * 32);
+    sysbus_init_irq(sbd, &s->parent_intr[0]);
+    sysbus_init_irq(sbd, &s->parent_intr[1]);
+    qdev_init_gpio_in(dev, omap_set_intr_noedge, s->nbanks * 32);
     memory_region_init_io(&s->mmio, OBJECT(s), &omap2_inth_mem_ops, s,
                           "omap2-intc", 0x1000);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -635,13 +641,20 @@ static void omap2_intc_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo omap2_intc_info = {
     .name          = "omap2-intc",
+    .parent        = TYPE_OMAP_INTC,
+    .class_init    = omap2_intc_class_init,
+};
+
+static const TypeInfo omap_intc_type_info = {
+    .name          = TYPE_OMAP_INTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap_intr_handler_s),
-    .class_init    = omap2_intc_class_init,
+    .abstract      = true,
 };
 
 static void omap_intc_register_types(void)
 {
+    type_register_static(&omap_intc_type_info);
     type_register_static(&omap_intc_info);
     type_register_static(&omap2_intc_info);
 }
commit 1f8a9eac51427be2e9e63fcbe9d4d174640a0b19
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:53:49 2013 +0200

    lm32_pic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/lm32_pic.c b/hw/intc/lm32_pic.c
index b4e80c8..32d009f 100644
--- a/hw/intc/lm32_pic.c
+++ b/hw/intc/lm32_pic.c
@@ -26,8 +26,12 @@
 #include "trace.h"
 #include "hw/lm32/lm32_pic.h"
 
+#define TYPE_LM32_PIC "lm32-pic"
+#define LM32_PIC(obj) OBJECT_CHECK(LM32PicState, (obj), TYPE_LM32_PIC)
+
 struct LM32PicState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq parent_irq;
     uint32_t im;        /* interrupt mask */
     uint32_t ip;        /* interrupt pending */
@@ -99,7 +103,7 @@ static void irq_handler(void *opaque, int irq, int level)
 
 void lm32_pic_set_im(DeviceState *d, uint32_t im)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_set_im(im);
     s->im = im;
@@ -109,7 +113,7 @@ void lm32_pic_set_im(DeviceState *d, uint32_t im)
 
 void lm32_pic_set_ip(DeviceState *d, uint32_t ip)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_set_ip(ip);
 
@@ -121,7 +125,7 @@ void lm32_pic_set_ip(DeviceState *d, uint32_t ip)
 
 uint32_t lm32_pic_get_im(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_get_im(s->im);
     return s->im;
@@ -129,7 +133,7 @@ uint32_t lm32_pic_get_im(DeviceState *d)
 
 uint32_t lm32_pic_get_ip(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
 
     trace_lm32_pic_get_ip(s->ip);
     return s->ip;
@@ -137,7 +141,7 @@ uint32_t lm32_pic_get_ip(DeviceState *d)
 
 static void pic_reset(DeviceState *d)
 {
-    LM32PicState *s = container_of(d, LM32PicState, busdev.qdev);
+    LM32PicState *s = LM32_PIC(d);
     int i;
 
     s->im = 0;
@@ -148,12 +152,13 @@ static void pic_reset(DeviceState *d)
     }
 }
 
-static int lm32_pic_init(SysBusDevice *dev)
+static int lm32_pic_init(SysBusDevice *sbd)
 {
-    LM32PicState *s = FROM_SYSBUS(typeof(*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    LM32PicState *s = LM32_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
 
     pic = s;
 
@@ -185,7 +190,7 @@ static void lm32_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_pic_info = {
-    .name          = "lm32-pic",
+    .name          = TYPE_LM32_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32PicState),
     .class_init    = lm32_pic_class_init,
commit 730bf9323d799cc42520f4512dd76d843b26d480
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:26:18 2013 +0200

    grlib_irqmp: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/grlib_irqmp.c b/hw/intc/grlib_irqmp.c
index 181f614..42e00bc 100644
--- a/hw/intc/grlib_irqmp.c
+++ b/hw/intc/grlib_irqmp.c
@@ -45,10 +45,14 @@
 #define FORCE_OFFSET     0x80
 #define EXTENDED_OFFSET  0xC0
 
+#define TYPE_GRLIB_IRQMP "grlib,irqmp"
+#define GRLIB_IRQMP(obj) OBJECT_CHECK(IRQMP, (obj), TYPE_GRLIB_IRQMP)
+
 typedef struct IRQMPState IRQMPState;
 
 typedef struct IRQMP {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     void *set_pil_in;
@@ -102,19 +106,10 @@ static void grlib_irqmp_check_irqs(IRQMPState *state)
 
 void grlib_irqmp_ack(DeviceState *dev, int intno)
 {
-    SysBusDevice *sdev;
-    IRQMP        *irqmp;
+    IRQMP        *irqmp = GRLIB_IRQMP(dev);
     IRQMPState   *state;
     uint32_t      mask;
 
-    assert(dev != NULL);
-
-    sdev = SYS_BUS_DEVICE(dev);
-    assert(sdev != NULL);
-
-    irqmp = FROM_SYSBUS(typeof(*irqmp), sdev);
-    assert(irqmp != NULL);
-
     state = irqmp->state;
     assert(state != NULL);
 
@@ -132,15 +127,10 @@ void grlib_irqmp_ack(DeviceState *dev, int intno)
 
 void grlib_irqmp_set_irq(void *opaque, int irq, int level)
 {
-    IRQMP      *irqmp;
+    IRQMP      *irqmp = GRLIB_IRQMP(opaque);
     IRQMPState *s;
     int         i = 0;
 
-    assert(opaque != NULL);
-
-    irqmp = FROM_SYSBUS(typeof(*irqmp), SYS_BUS_DEVICE(opaque));
-    assert(irqmp != NULL);
-
     s = irqmp->state;
     assert(s         != NULL);
     assert(s->parent != NULL);
@@ -325,8 +315,7 @@ static const MemoryRegionOps grlib_irqmp_ops = {
 
 static void grlib_irqmp_reset(DeviceState *d)
 {
-    IRQMP *irqmp = container_of(d, IRQMP, busdev.qdev);
-    assert(irqmp        != NULL);
+    IRQMP *irqmp = GRLIB_IRQMP(d);
     assert(irqmp->state != NULL);
 
     memset(irqmp->state, 0, sizeof *irqmp->state);
@@ -335,9 +324,7 @@ static void grlib_irqmp_reset(DeviceState *d)
 
 static int grlib_irqmp_init(SysBusDevice *dev)
 {
-    IRQMP *irqmp = FROM_SYSBUS(typeof(*irqmp), dev);
-
-    assert(irqmp != NULL);
+    IRQMP *irqmp = GRLIB_IRQMP(dev);
 
     /* Check parameters */
     if (irqmp->set_pil_in == NULL) {
@@ -371,7 +358,7 @@ static void grlib_irqmp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo grlib_irqmp_info = {
-    .name          = "grlib,irqmp",
+    .name          = TYPE_GRLIB_IRQMP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IRQMP),
     .class_init    = grlib_irqmp_class_init,
commit c5e22ae3464b52789023dbdce2f565d0f6be08e2
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:19:19 2013 +0200

    exynos4210_gic: QOM cast cleanup for exynos4210.irq_gate
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index f9afb97..5b913f7 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -372,8 +372,13 @@ type_init(exynos4210_gic_register_types)
  * output sysbus IRQ line. The output IRQ level is formed as OR between all
  * gpio inputs.
  */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
+#define EXYNOS4210_IRQ_GATE(obj) \
+    OBJECT_CHECK(Exynos4210IRQGateState, (obj), TYPE_EXYNOS4210_IRQ_GATE)
+
+typedef struct Exynos4210IRQGateState {
+    SysBusDevice parent_obj;
 
     uint32_t n_in;      /* inputs amount */
     uint32_t *level;    /* input levels */
@@ -418,8 +423,7 @@ static void exynos4210_irq_gate_handler(void *opaque, int irq, int level)
 
 static void exynos4210_irq_gate_reset(DeviceState *d)
 {
-    Exynos4210IRQGateState *s =
-            DO_UPCAST(Exynos4210IRQGateState, busdev.qdev, d);
+    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
 
     memset(s->level, 0, s->n_in * sizeof(*s->level));
 }
@@ -427,17 +431,18 @@ static void exynos4210_irq_gate_reset(DeviceState *d)
 /*
  * IRQ Gate initialization.
  */
-static int exynos4210_irq_gate_init(SysBusDevice *dev)
+static int exynos4210_irq_gate_init(SysBusDevice *sbd)
 {
-    Exynos4210IRQGateState *s = FROM_SYSBUS(Exynos4210IRQGateState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
 
     /* Allocate general purpose input signals and connect a handler to each of
      * them */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_irq_gate_handler, s->n_in);
+    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
 
     s->level = g_malloc0(s->n_in * sizeof(*s->level));
 
-    sysbus_init_irq(dev, &s->out);
+    sysbus_init_irq(sbd, &s->out);
 
     return 0;
 }
@@ -454,7 +459,7 @@ static void exynos4210_irq_gate_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_irq_gate_info = {
-    .name          = "exynos4210.irq_gate",
+    .name          = TYPE_EXYNOS4210_IRQ_GATE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210IRQGateState),
     .class_init    = exynos4210_irq_gate_class_init,
commit 78c6abbd834e78a658e5910244397040c10a5b90
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:16:20 2013 +0200

    exynos4210_gic: QOM cast cleanup for exynos4210.gic
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index 6147f04..f9afb97 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -260,8 +260,13 @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
 
 /********* GIC part *********/
 
+#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
+#define EXYNOS4210_GIC(obj) \
+    OBJECT_CHECK(Exynos4210GicState, (obj), TYPE_EXYNOS4210_GIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion cpu_container;
     MemoryRegion dist_container;
     MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
@@ -276,9 +281,10 @@ static void exynos4210_gic_set_irq(void *opaque, int irq, int level)
     qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);
 }
 
-static int exynos4210_gic_init(SysBusDevice *dev)
+static int exynos4210_gic_init(SysBusDevice *sbd)
 {
-    Exynos4210GicState *s = FROM_SYSBUS(Exynos4210GicState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210GicState *s = EXYNOS4210_GIC(dev);
     uint32_t i;
     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
     const char dist_prefix[] = "exynos4210-gic-alias_dist";
@@ -293,10 +299,10 @@ static int exynos4210_gic_init(SysBusDevice *dev)
     busdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, busdev);
+    sysbus_pass_irq(sbd, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_gic_set_irq,
+    qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
                       EXYNOS4210_GIC_NIRQ - 32);
 
     memory_region_init(&s->cpu_container, OBJECT(s), "exynos4210-cpu-container",
@@ -326,8 +332,8 @@ static int exynos4210_gic_init(SysBusDevice *dev)
                 EXYNOS4210_EXT_GIC_DIST_GET_OFFSET(i), &s->dist_alias[i]);
     }
 
-    sysbus_init_mmio(dev, &s->cpu_container);
-    sysbus_init_mmio(dev, &s->dist_container);
+    sysbus_init_mmio(sbd, &s->cpu_container);
+    sysbus_init_mmio(sbd, &s->dist_container);
 
     return 0;
 }
@@ -347,7 +353,7 @@ static void exynos4210_gic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_gic_info = {
-    .name          = "exynos4210.gic",
+    .name          = TYPE_EXYNOS4210_GIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210GicState),
     .class_init    = exynos4210_gic_class_init,
commit c03c6b9ccaa696b90a662dfcce82d84c50f832b8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:11:37 2013 +0200

    exynos4210_combiner: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index 3b40976..ef5e8eb 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -56,8 +56,13 @@ typedef struct CombinerGroupState {
     uint8_t src_pending;        /* Pending source interrupts before masking */
 } CombinerGroupState;
 
+#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
+#define EXYNOS4210_COMBINER(obj) \
+    OBJECT_CHECK(Exynos4210CombinerState, (obj), TYPE_EXYNOS4210_COMBINER)
+
 typedef struct Exynos4210CombinerState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     struct CombinerGroupState group[IIC_NGRP];
@@ -402,24 +407,24 @@ static const MemoryRegionOps exynos4210_combiner_ops = {
 /*
  * Internal Combiner initialization.
  */
-static int exynos4210_combiner_init(SysBusDevice *dev)
+static int exynos4210_combiner_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    Exynos4210CombinerState *s = EXYNOS4210_COMBINER(dev);
     unsigned int i;
-    struct Exynos4210CombinerState *s =
-            FROM_SYSBUS(struct Exynos4210CombinerState, dev);
 
     /* Allocate general purpose input signals and connect a handler to each of
      * them */
-    qdev_init_gpio_in(&s->busdev.qdev, exynos4210_combiner_handler, IIC_NIRQ);
+    qdev_init_gpio_in(dev, exynos4210_combiner_handler, IIC_NIRQ);
 
     /* Connect SysBusDev irqs to device specific irqs */
     for (i = 0; i < IIC_NIRQ; i++) {
-        sysbus_init_irq(dev, &s->output_irq[i]);
+        sysbus_init_irq(sbd, &s->output_irq[i]);
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_combiner_ops, s,
-            "exynos4210-combiner", IIC_REGION_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+                          "exynos4210-combiner", IIC_REGION_SIZE);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -441,7 +446,7 @@ static void exynos4210_combiner_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_combiner_info = {
-    .name          = "exynos4210.combiner",
+    .name          = TYPE_EXYNOS4210_COMBINER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210CombinerState),
     .class_init    = exynos4210_combiner_class_init,
commit 9062143f9e71479e98a62950178e7d803f304425
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:05:58 2013 +0200

    etraxfs_pic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/etraxfs_pic.c b/hw/intc/etraxfs_pic.c
index ce3a3f6..e02da53 100644
--- a/hw/intc/etraxfs_pic.c
+++ b/hw/intc/etraxfs_pic.c
@@ -36,9 +36,14 @@
 #define R_R_GURU    4
 #define R_MAX       5
 
+#define TYPE_ETRAX_FS_PIC "etraxfs,pic"
+#define ETRAX_FS_PIC(obj) \
+    OBJECT_CHECK(struct etrax_pic, (obj), TYPE_ETRAX_FS_PIC)
+
 struct etrax_pic
 {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     void *interrupt_vector;
     qemu_irq parent_irq;
@@ -138,17 +143,18 @@ static void irq_handler(void *opaque, int irq, int level)
     pic_update(fs);
 }
 
-static int etraxfs_pic_init(SysBusDevice *dev)
+static int etraxfs_pic_init(SysBusDevice *sbd)
 {
-    struct etrax_pic *s = FROM_SYSBUS(typeof (*s), dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct etrax_pic *s = ETRAX_FS_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, irq_handler, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
-    sysbus_init_irq(dev, &s->parent_nmi);
+    qdev_init_gpio_in(dev, irq_handler, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
+    sysbus_init_irq(sbd, &s->parent_nmi);
 
     memory_region_init_io(&s->mmio, OBJECT(s), &pic_ops, s,
                           "etraxfs-pic", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_mmio(sbd, &s->mmio);
     return 0;
 }
 
@@ -167,7 +173,7 @@ static void etraxfs_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_pic_info = {
-    .name          = "etraxfs,pic",
+    .name          = TYPE_ETRAX_FS_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct etrax_pic),
     .class_init    = etraxfs_pic_class_init,
commit 285b4432da565ebcca0bc5eab1783b77ef3450c0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:57:48 2013 +0200

    arm_gic: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index 8e34004..d431b7a 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -639,6 +639,7 @@ static const MemoryRegionOps gic_cpu_ops = {
 
 void gic_init_irqs_and_distributor(GICState *s, int num_irq)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     int i;
 
     i = s->num_irq - GIC_INTERNAL;
@@ -652,9 +653,9 @@ void gic_init_irqs_and_distributor(GICState *s, int num_irq)
     if (s->revision != REV_NVIC) {
         i += (GIC_INTERNAL * s->num_cpu);
     }
-    qdev_init_gpio_in(&s->busdev.qdev, gic_set_irq, i);
+    qdev_init_gpio_in(DEVICE(s), gic_set_irq, i);
     for (i = 0; i < NUM_CPU(s); i++) {
-        sysbus_init_irq(&s->busdev, &s->parent_irq[i]);
+        sysbus_init_irq(sbd, &s->parent_irq[i]);
     }
     memory_region_init_io(&s->iomem, OBJECT(s), &gic_dist_ops, s,
                           "gic_dist", 0x1000);
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index 08560f2..709b5c2 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -110,7 +110,7 @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
 
 static void arm_gic_common_reset(DeviceState *dev)
 {
-    GICState *s = FROM_SYSBUS(GICState, SYS_BUS_DEVICE(dev));
+    GICState *s = ARM_GIC_COMMON(dev);
     int i;
     memset(s->irq_state, 0, GIC_MAXIRQ * sizeof(gic_irq_state));
     for (i = 0 ; i < s->num_cpu; i++) {
diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
index 99a3bc3..1426437 100644
--- a/hw/intc/gic_internal.h
+++ b/hw/intc/gic_internal.h
@@ -70,7 +70,10 @@ typedef struct gic_irq_state {
 } gic_irq_state;
 
 typedef struct GICState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     qemu_irq parent_irq[NCPU];
     bool enabled;
     bool cpu_enabled[NCPU];
commit 3e5dd364d933ccc066cbea8620bdc16525e19230
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:49:24 2013 +0200

    pl050: QOM'ify pl050_keyboard and pl050_mouse
    
    Introduce an abstract type pl050 and let pl050_keyboar and pl050_mouse
    inherit from it, using different instance_init functions.
    Introduce a type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 8493abd..c1b08d5 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -10,8 +10,12 @@
 #include "hw/sysbus.h"
 #include "hw/input/ps2.h"
 
+#define TYPE_PL050 "pl050"
+#define PL050(obj) OBJECT_CHECK(PL050State, (obj), TYPE_PL050)
+
 typedef struct PL050State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     void *dev;
     uint32_t cr;
@@ -19,7 +23,7 @@ typedef struct PL050State {
     uint32_t last;
     int pending;
     qemu_irq irq;
-    int is_mouse;
+    bool is_mouse;
 } PL050State;
 
 static const VMStateDescription vmstate_pl050 = {
@@ -133,65 +137,67 @@ static const MemoryRegionOps pl050_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl050_init(SysBusDevice *dev, int is_mouse)
+static int pl050_initfn(SysBusDevice *dev)
 {
-    PL050State *s = FROM_SYSBUS(PL050State, dev);
+    PL050State *s = PL050(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
     sysbus_init_irq(dev, &s->irq);
-    s->is_mouse = is_mouse;
-    if (s->is_mouse)
+    if (s->is_mouse) {
         s->dev = ps2_mouse_init(pl050_update, s);
-    else
+    } else {
         s->dev = ps2_kbd_init(pl050_update, s);
+    }
     return 0;
 }
 
-static int pl050_init_keyboard(SysBusDevice *dev)
+static void pl050_keyboard_init(Object *obj)
 {
-    return pl050_init(dev, 0);
-}
+    PL050State *s = PL050(obj);
 
-static int pl050_init_mouse(SysBusDevice *dev)
-{
-    return pl050_init(dev, 1);
+    s->is_mouse = false;
 }
 
-static void pl050_kbd_class_init(ObjectClass *klass, void *data)
+static void pl050_mouse_init(Object *obj)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    PL050State *s = PL050(obj);
 
-    k->init = pl050_init_keyboard;
-    dc->vmsd = &vmstate_pl050;
+    s->is_mouse = true;
 }
 
 static const TypeInfo pl050_kbd_info = {
     .name          = "pl050_keyboard",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL050State),
-    .class_init    = pl050_kbd_class_init,
+    .parent        = TYPE_PL050,
+    .instance_init = pl050_keyboard_init,
 };
 
-static void pl050_mouse_class_init(ObjectClass *klass, void *data)
+static const TypeInfo pl050_mouse_info = {
+    .name          = "pl050_mouse",
+    .parent        = TYPE_PL050,
+    .instance_init = pl050_mouse_init,
+};
+
+static void pl050_class_init(ObjectClass *oc, void *data)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc);
 
-    k->init = pl050_init_mouse;
+    sdc->init = pl050_initfn;
     dc->vmsd = &vmstate_pl050;
 }
 
-static const TypeInfo pl050_mouse_info = {
-    .name          = "pl050_mouse",
+static const TypeInfo pl050_type_info = {
+    .name          = TYPE_PL050,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL050State),
-    .class_init    = pl050_mouse_class_init,
+    .abstract      = true,
+    .class_init    = pl050_class_init,
 };
 
 static void pl050_register_types(void)
 {
+    type_register_static(&pl050_type_info);
     type_register_static(&pl050_kbd_info);
     type_register_static(&pl050_mouse_info);
 }
commit e607f25a620e769cb6a231314aa13804723ab734
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:40:25 2013 +0200

    pl050: Rename pl050_state to PL050State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/input/pl050.c b/hw/input/pl050.c
index 2312ffc..8493abd 100644
--- a/hw/input/pl050.c
+++ b/hw/input/pl050.c
@@ -10,7 +10,7 @@
 #include "hw/sysbus.h"
 #include "hw/input/ps2.h"
 
-typedef struct {
+typedef struct PL050State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     void *dev;
@@ -20,17 +20,17 @@ typedef struct {
     int pending;
     qemu_irq irq;
     int is_mouse;
-} pl050_state;
+} PL050State;
 
 static const VMStateDescription vmstate_pl050 = {
     .name = "pl050",
     .version_id = 2,
     .minimum_version_id = 2,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(cr, pl050_state),
-        VMSTATE_UINT32(clk, pl050_state),
-        VMSTATE_UINT32(last, pl050_state),
-        VMSTATE_INT32(pending, pl050_state),
+        VMSTATE_UINT32(cr, PL050State),
+        VMSTATE_UINT32(clk, PL050State),
+        VMSTATE_UINT32(last, PL050State),
+        VMSTATE_INT32(pending, PL050State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -48,7 +48,7 @@ static const unsigned char pl050_id[] =
 
 static void pl050_update(void *opaque, int level)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     int raise;
 
     s->pending = level;
@@ -60,7 +60,7 @@ static void pl050_update(void *opaque, int level)
 static uint64_t pl050_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     if (offset >= 0xfe0 && offset < 0x1000)
         return pl050_id[(offset - 0xfe0) >> 2];
 
@@ -103,7 +103,7 @@ static uint64_t pl050_read(void *opaque, hwaddr offset,
 static void pl050_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl050_state *s = (pl050_state *)opaque;
+    PL050State *s = (PL050State *)opaque;
     switch (offset >> 2) {
     case 0: /* KMICR */
         s->cr = value;
@@ -135,7 +135,7 @@ static const MemoryRegionOps pl050_ops = {
 
 static int pl050_init(SysBusDevice *dev, int is_mouse)
 {
-    pl050_state *s = FROM_SYSBUS(pl050_state, dev);
+    PL050State *s = FROM_SYSBUS(PL050State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl050_ops, s, "pl050", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -170,7 +170,7 @@ static void pl050_kbd_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl050_kbd_info = {
     .name          = "pl050_keyboard",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl050_state),
+    .instance_size = sizeof(PL050State),
     .class_init    = pl050_kbd_class_init,
 };
 
@@ -186,7 +186,7 @@ static void pl050_mouse_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl050_mouse_info = {
     .name          = "pl050_mouse",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl050_state),
+    .instance_size = sizeof(PL050State),
     .class_init    = pl050_mouse_class_init,
 };
 
commit 2a052f6bf11f00b358cf4e0abdd6e2cf59648a71
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:37:02 2013 +0200

    milkymist-softusb: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/input/milkymist-softusb.c b/hw/input/milkymist-softusb.c
index 942cb79..ecde33c 100644
--- a/hw/input/milkymist-softusb.c
+++ b/hw/input/milkymist-softusb.c
@@ -44,8 +44,13 @@ enum {
 #define COMLOC_KEVT_PRODUCE  0x1142
 #define COMLOC_KEVT_BASE     0x1143
 
+#define TYPE_MILKYMIST_SOFTUSB "milkymist-softusb"
+#define MILKYMIST_SOFTUSB(obj) \
+    OBJECT_CHECK(MilkymistSoftUsbState, (obj), TYPE_MILKYMIST_SOFTUSB)
+
 struct MilkymistSoftUsbState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     HIDState hid_kbd;
     HIDState hid_mouse;
 
@@ -242,8 +247,7 @@ static void softusb_mouse_hid_datain(HIDState *hs)
 
 static void milkymist_softusb_reset(DeviceState *d)
 {
-    MilkymistSoftUsbState *s =
-            container_of(d, MilkymistSoftUsbState, busdev.qdev);
+    MilkymistSoftUsbState *s = MILKYMIST_SOFTUSB(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -261,7 +265,7 @@ static void milkymist_softusb_reset(DeviceState *d)
 
 static int milkymist_softusb_init(SysBusDevice *dev)
 {
-    MilkymistSoftUsbState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistSoftUsbState *s = MILKYMIST_SOFTUSB(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -320,7 +324,7 @@ static void milkymist_softusb_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_softusb_info = {
-    .name          = "milkymist-softusb",
+    .name          = TYPE_MILKYMIST_SOFTUSB,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistSoftUsbState),
     .class_init    = milkymist_softusb_class_init,
commit 93e7f5f42d0d3663acb94b24c8a9a329b5b13917
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:28:26 2013 +0200

    versatile_i2c: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/versatile_i2c.c b/hw/i2c/versatile_i2c.c
index 204dd3d..02e9f17 100644
--- a/hw/i2c/versatile_i2c.c
+++ b/hw/i2c/versatile_i2c.c
@@ -24,8 +24,13 @@
 #include "hw/sysbus.h"
 #include "bitbang_i2c.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_VERSATILE_I2C "versatile_i2c"
+#define VERSATILE_I2C(obj) \
+    OBJECT_CHECK(VersatileI2CState, (obj), TYPE_VERSATILE_I2C)
+
+typedef struct VersatileI2CState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     bitbang_i2c_interface *bitbang;
     int out;
@@ -72,16 +77,17 @@ static const MemoryRegionOps versatile_i2c_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int versatile_i2c_init(SysBusDevice *dev)
+static int versatile_i2c_init(SysBusDevice *sbd)
 {
-    VersatileI2CState *s = FROM_SYSBUS(VersatileI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    VersatileI2CState *s = VERSATILE_I2C(dev);
     i2c_bus *bus;
 
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    bus = i2c_init_bus(dev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
     memory_region_init_io(&s->iomem, OBJECT(s), &versatile_i2c_ops, s,
                           "versatile_i2c", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -93,7 +99,7 @@ static void versatile_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo versatile_i2c_info = {
-    .name          = "versatile_i2c",
+    .name          = TYPE_VERSATILE_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(VersatileI2CState),
     .class_init    = versatile_i2c_class_init,
commit 60ecfcb354e526c29874af17bbadaabeff47409c
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:24:27 2013 +0200

    omap_i2c: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/omap_i2c.c b/hw/i2c/omap_i2c.c
index f0eb448..f528b2b 100644
--- a/hw/i2c/omap_i2c.c
+++ b/hw/i2c/omap_i2c.c
@@ -21,9 +21,12 @@
 #include "hw/arm/omap.h"
 #include "hw/sysbus.h"
 
+#define TYPE_OMAP_I2C "omap_i2c"
+#define OMAP_I2C(obj) OBJECT_CHECK(OMAPI2CState, (obj), TYPE_OMAP_I2C)
 
 typedef struct OMAPI2CState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     qemu_irq drq[2];
@@ -130,8 +133,8 @@ static void omap_i2c_fifo_run(OMAPI2CState *s)
 
 static void omap_i2c_reset(DeviceState *dev)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState,
-                                  SYS_BUS_DEVICE(dev));
+    OMAPI2CState *s = OMAP_I2C(dev);
+
     s->mask = 0;
     s->stat = 0;
     s->dma = 0;
@@ -316,15 +319,17 @@ static void omap_i2c_write(void *opaque, hwaddr addr,
             return;
         }
 
-        if (value & 2)
-            omap_i2c_reset(&s->busdev.qdev);
+        if (value & 2) {
+            omap_i2c_reset(DEVICE(s));
+        }
         break;
 
     case 0x24:	/* I2C_CON */
         s->control = value & 0xcf87;
         if (~value & (1 << 15)) {				/* I2C_EN */
-            if (s->revision < OMAP2_INTR_REV)
-                omap_i2c_reset(&s->busdev.qdev);
+            if (s->revision < OMAP2_INTR_REV) {
+                omap_i2c_reset(DEVICE(s));
+            }
             break;
         }
         if ((value & (1 << 15)) && !(value & (1 << 10))) {	/* MST */
@@ -434,9 +439,10 @@ static const MemoryRegionOps omap_i2c_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int omap_i2c_init(SysBusDevice *dev)
+static int omap_i2c_init(SysBusDevice *sbd)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    OMAPI2CState *s = OMAP_I2C(dev);
 
     if (!s->fclk) {
         hw_error("omap_i2c: fclk not connected\n");
@@ -445,13 +451,13 @@ static int omap_i2c_init(SysBusDevice *dev)
         /* Note that OMAP1 doesn't have a separate interface clock */
         hw_error("omap_i2c: iclk not connected\n");
     }
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->drq[0]);
-    sysbus_init_irq(dev, &s->drq[1]);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->drq[0]);
+    sysbus_init_irq(sbd, &s->drq[1]);
     memory_region_init_io(&s->iomem, OBJECT(s), &omap_i2c_ops, s, "omap.i2c",
                           (s->revision < OMAP2_INTR_REV) ? 0x800 : 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    s->bus = i2c_init_bus(&dev->qdev, NULL);
+    sysbus_init_mmio(sbd, &s->iomem);
+    s->bus = i2c_init_bus(dev, NULL);
     return 0;
 }
 
@@ -472,7 +478,7 @@ static void omap_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo omap_i2c_info = {
-    .name = "omap_i2c",
+    .name = TYPE_OMAP_I2C,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OMAPI2CState),
     .class_init = omap_i2c_class_init,
@@ -485,7 +491,7 @@ static void omap_i2c_register_types(void)
 
 i2c_bus *omap_i2c_bus(DeviceState *omap_i2c)
 {
-    OMAPI2CState *s = FROM_SYSBUS(OMAPI2CState, SYS_BUS_DEVICE(omap_i2c));
+    OMAPI2CState *s = OMAP_I2C(omap_i2c);
     return s->bus;
 }
 
commit cc3c3b8a2239a7a1d49a83c047ae2bc63d8a71e8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 18:13:46 2013 +0200

    bitbang_i2c: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index 853d455..ca59456 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -185,8 +185,13 @@ bitbang_i2c_interface *bitbang_i2c_init(i2c_bus *bus)
 }
 
 /* GPIO interface.  */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_GPIO_I2C "gpio_i2c"
+#define GPIO_I2C(obj) OBJECT_CHECK(GPIOI2CState, (obj), TYPE_GPIO_I2C)
+
+typedef struct GPIOI2CState {
+    SysBusDevice parent_obj;
+
     MemoryRegion dummy_iomem;
     bitbang_i2c_interface *bitbang;
     int last_level;
@@ -204,19 +209,20 @@ static void bitbang_i2c_gpio_set(void *opaque, int irq, int level)
     }
 }
 
-static int gpio_i2c_init(SysBusDevice *dev)
+static int gpio_i2c_init(SysBusDevice *sbd)
 {
-    GPIOI2CState *s = FROM_SYSBUS(GPIOI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    GPIOI2CState *s = GPIO_I2C(dev);
     i2c_bus *bus;
 
     memory_region_init(&s->dummy_iomem, OBJECT(s), "gpio_i2c", 0);
-    sysbus_init_mmio(dev, &s->dummy_iomem);
+    sysbus_init_mmio(sbd, &s->dummy_iomem);
 
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    bus = i2c_init_bus(dev, "i2c");
     s->bitbang = bitbang_i2c_init(bus);
 
-    qdev_init_gpio_in(&dev->qdev, bitbang_i2c_gpio_set, 2);
-    qdev_init_gpio_out(&dev->qdev, &s->out, 1);
+    qdev_init_gpio_in(dev, bitbang_i2c_gpio_set, 2);
+    qdev_init_gpio_out(dev, &s->out, 1);
 
     return 0;
 }
@@ -232,7 +238,7 @@ static void gpio_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo gpio_i2c_info = {
-    .name          = "gpio_i2c",
+    .name          = TYPE_GPIO_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(GPIOI2CState),
     .class_init    = gpio_i2c_class_init,
commit a009de46bd50c88d18f19a1405e1348c679e08d6
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:41:16 2013 +0200

    gpio/zaurus: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index c235c3e..dc79a8b 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -24,9 +24,13 @@
 
 /* SCOOP devices */
 
+#define TYPE_SCOOP "scoop"
+#define SCOOP(obj) OBJECT_CHECK(ScoopInfo, (obj), TYPE_SCOOP)
+
 typedef struct ScoopInfo ScoopInfo;
 struct ScoopInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq handler[16];
     MemoryRegion iomem;
     uint16_t status;
@@ -162,16 +166,17 @@ static void scoop_gpio_set(void *opaque, int line, int level)
         s->gpio_level &= ~(1 << line);
 }
 
-static int scoop_init(SysBusDevice *dev)
+static int scoop_init(SysBusDevice *sbd)
 {
-    ScoopInfo *s = FROM_SYSBUS(ScoopInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    ScoopInfo *s = SCOOP(dev);
 
     s->status = 0x02;
-    qdev_init_gpio_out(&s->busdev.qdev, s->handler, 16);
-    qdev_init_gpio_in(&s->busdev.qdev, scoop_gpio_set, 16);
+    qdev_init_gpio_out(dev, s->handler, 16);
+    qdev_init_gpio_in(dev, scoop_gpio_set, 16);
     memory_region_init_io(&s->iomem, OBJECT(s), &scoop_ops, s, "scoop", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -237,7 +242,7 @@ static void scoop_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo scoop_sysbus_info = {
-    .name          = "scoop",
+    .name          = TYPE_SCOOP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ScoopInfo),
     .class_init    = scoop_sysbus_class_init,
commit 1ed09e2f4360cba2c480e64077421aa0cbc6ebc8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:37:37 2013 +0200

    puv3_gpio: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/puv3_gpio.c b/hw/gpio/puv3_gpio.c
index 18671eb..39840aa 100644
--- a/hw/gpio/puv3_gpio.c
+++ b/hw/gpio/puv3_gpio.c
@@ -14,8 +14,12 @@
 #undef DEBUG_PUV3
 #include "hw/unicore32/puv3.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_GPIO "puv3_gpio"
+#define PUV3_GPIO(obj) OBJECT_CHECK(PUV3GPIOState, (obj), TYPE_PUV3_GPIO)
+
+typedef struct PUV3GPIOState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq[9];
 
@@ -96,7 +100,7 @@ static const MemoryRegionOps puv3_gpio_ops = {
 
 static int puv3_gpio_init(SysBusDevice *dev)
 {
-    PUV3GPIOState *s = FROM_SYSBUS(PUV3GPIOState, dev);
+    PUV3GPIOState *s = PUV3_GPIO(dev);
 
     s->reg_GPLR = 0;
     s->reg_GPDR = 0;
@@ -127,7 +131,7 @@ static void puv3_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_gpio_info = {
-    .name = "puv3_gpio",
+    .name = TYPE_PUV3_GPIO,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3GPIOState),
     .class_init = puv3_gpio_class_init,
commit 692a76d1c4a32573bf3cc19110c7fa6cc8c93f60
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:31:46 2013 +0200

    pl061: QOM'ify pl061 and pl061_luminary
    
    Let pl061_luminary inherit from pl061, with differing instance_init.
    Introduce type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index e97ad8a..dd4ea29 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -28,8 +28,12 @@ static const uint8_t pl061_id[12] =
 static const uint8_t pl061_id_luminary[12] =
   { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
+#define TYPE_PL061 "pl061"
+#define PL061(obj) OBJECT_CHECK(PL061State, (obj), TYPE_PL061)
+
 typedef struct PL061State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t locked;
     uint32_t data;
@@ -272,27 +276,32 @@ static const MemoryRegionOps pl061_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl061_init(SysBusDevice *dev, const unsigned char *id)
+static int pl061_initfn(SysBusDevice *sbd)
 {
-    PL061State *s = FROM_SYSBUS(PL061State, dev);
-    s->id = id;
+    DeviceState *dev = DEVICE(sbd);
+    PL061State *s = PL061(dev);
+
     memory_region_init_io(&s->iomem, OBJECT(s), &pl061_ops, s, "pl061", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&dev->qdev, pl061_set_irq, 8);
-    qdev_init_gpio_out(&dev->qdev, s->out, 8);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, pl061_set_irq, 8);
+    qdev_init_gpio_out(dev, s->out, 8);
     pl061_reset(s);
     return 0;
 }
 
-static int pl061_init_luminary(SysBusDevice *dev)
+static void pl061_luminary_init(Object *obj)
 {
-    return pl061_init(dev, pl061_id_luminary);
+    PL061State *s = PL061(obj);
+
+    s->id = pl061_id_luminary;
 }
 
-static int pl061_init_arm(SysBusDevice *dev)
+static void pl061_init(Object *obj)
 {
-    return pl061_init(dev, pl061_id);
+    PL061State *s = PL061(obj);
+
+    s->id = pl061_id;
 }
 
 static void pl061_class_init(ObjectClass *klass, void *data)
@@ -300,31 +309,22 @@ static void pl061_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pl061_init_arm;
+    k->init = pl061_initfn;
     dc->vmsd = &vmstate_pl061;
 }
 
 static const TypeInfo pl061_info = {
-    .name          = "pl061",
+    .name          = TYPE_PL061,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL061State),
+    .instance_init = pl061_init,
     .class_init    = pl061_class_init,
 };
 
-static void pl061_luminary_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl061_init_luminary;
-    dc->vmsd = &vmstate_pl061;
-}
-
 static const TypeInfo pl061_luminary_info = {
     .name          = "pl061_luminary",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL061State),
-    .class_init    = pl061_luminary_class_init,
+    .parent        = TYPE_PL061,
+    .instance_init = pl061_luminary_init,
 };
 
 static void pl061_register_types(void)
commit ee663e96e4db735d19dc2672150b6ccc87cc29fe
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:21:21 2013 +0200

    pl061: Rename pl061_state to PL061State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index a0bbf08..e97ad8a 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -28,7 +28,7 @@ static const uint8_t pl061_id[12] =
 static const uint8_t pl061_id_luminary[12] =
   { 0x00, 0x00, 0x00, 0x00, 0x61, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
-typedef struct {
+typedef struct PL061State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t locked;
@@ -55,39 +55,39 @@ typedef struct {
     qemu_irq irq;
     qemu_irq out[8];
     const unsigned char *id;
-} pl061_state;
+} PL061State;
 
 static const VMStateDescription vmstate_pl061 = {
     .name = "pl061",
     .version_id = 2,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(locked, pl061_state),
-        VMSTATE_UINT32(data, pl061_state),
-        VMSTATE_UINT32(old_data, pl061_state),
-        VMSTATE_UINT32(dir, pl061_state),
-        VMSTATE_UINT32(isense, pl061_state),
-        VMSTATE_UINT32(ibe, pl061_state),
-        VMSTATE_UINT32(iev, pl061_state),
-        VMSTATE_UINT32(im, pl061_state),
-        VMSTATE_UINT32(istate, pl061_state),
-        VMSTATE_UINT32(afsel, pl061_state),
-        VMSTATE_UINT32(dr2r, pl061_state),
-        VMSTATE_UINT32(dr4r, pl061_state),
-        VMSTATE_UINT32(dr8r, pl061_state),
-        VMSTATE_UINT32(odr, pl061_state),
-        VMSTATE_UINT32(pur, pl061_state),
-        VMSTATE_UINT32(pdr, pl061_state),
-        VMSTATE_UINT32(slr, pl061_state),
-        VMSTATE_UINT32(den, pl061_state),
-        VMSTATE_UINT32(cr, pl061_state),
-        VMSTATE_UINT32(float_high, pl061_state),
-        VMSTATE_UINT32_V(amsel, pl061_state, 2),
+        VMSTATE_UINT32(locked, PL061State),
+        VMSTATE_UINT32(data, PL061State),
+        VMSTATE_UINT32(old_data, PL061State),
+        VMSTATE_UINT32(dir, PL061State),
+        VMSTATE_UINT32(isense, PL061State),
+        VMSTATE_UINT32(ibe, PL061State),
+        VMSTATE_UINT32(iev, PL061State),
+        VMSTATE_UINT32(im, PL061State),
+        VMSTATE_UINT32(istate, PL061State),
+        VMSTATE_UINT32(afsel, PL061State),
+        VMSTATE_UINT32(dr2r, PL061State),
+        VMSTATE_UINT32(dr4r, PL061State),
+        VMSTATE_UINT32(dr8r, PL061State),
+        VMSTATE_UINT32(odr, PL061State),
+        VMSTATE_UINT32(pur, PL061State),
+        VMSTATE_UINT32(pdr, PL061State),
+        VMSTATE_UINT32(slr, PL061State),
+        VMSTATE_UINT32(den, PL061State),
+        VMSTATE_UINT32(cr, PL061State),
+        VMSTATE_UINT32(float_high, PL061State),
+        VMSTATE_UINT32_V(amsel, PL061State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static void pl061_update(pl061_state *s)
+static void pl061_update(PL061State *s)
 {
     uint8_t changed;
     uint8_t mask;
@@ -116,7 +116,7 @@ static void pl061_update(pl061_state *s)
 static uint64_t pl061_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
 
     if (offset >= 0xfd0 && offset < 0x1000) {
         return s->id[(offset - 0xfd0) >> 2];
@@ -173,7 +173,7 @@ static uint64_t pl061_read(void *opaque, hwaddr offset,
 static void pl061_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
     uint8_t mask;
 
     if (offset < 0x400) {
@@ -246,7 +246,7 @@ static void pl061_write(void *opaque, hwaddr offset,
     pl061_update(s);
 }
 
-static void pl061_reset(pl061_state *s)
+static void pl061_reset(PL061State *s)
 {
   s->locked = 1;
   s->cr = 0xff;
@@ -254,7 +254,7 @@ static void pl061_reset(pl061_state *s)
 
 static void pl061_set_irq(void * opaque, int irq, int level)
 {
-    pl061_state *s = (pl061_state *)opaque;
+    PL061State *s = (PL061State *)opaque;
     uint8_t mask;
 
     mask = 1 << irq;
@@ -274,7 +274,7 @@ static const MemoryRegionOps pl061_ops = {
 
 static int pl061_init(SysBusDevice *dev, const unsigned char *id)
 {
-    pl061_state *s = FROM_SYSBUS(pl061_state, dev);
+    PL061State *s = FROM_SYSBUS(PL061State, dev);
     s->id = id;
     memory_region_init_io(&s->iomem, OBJECT(s), &pl061_ops, s, "pl061", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -307,7 +307,7 @@ static void pl061_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl061_info = {
     .name          = "pl061",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl061_state),
+    .instance_size = sizeof(PL061State),
     .class_init    = pl061_class_init,
 };
 
@@ -323,7 +323,7 @@ static void pl061_luminary_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl061_luminary_info = {
     .name          = "pl061_luminary",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl061_state),
+    .instance_size = sizeof(PL061State),
     .class_init    = pl061_luminary_class_init,
 };
 
commit 74d1e352be53d8208996772bb51c5a965fae7d06
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:19:36 2013 +0200

    omap_gpio: QOM cast cleanup for omap2_gpif_s
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 295caad..b8f572b 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -208,8 +208,13 @@ struct omap2_gpio_s {
     uint8_t delay;
 };
 
+#define TYPE_OMAP2_GPIO "omap2-gpio"
+#define OMAP2_GPIO(obj) \
+    OBJECT_CHECK(struct omap2_gpif_s, (obj), TYPE_OMAP2_GPIO)
+
 struct omap2_gpif_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int mpu_model;
     void *iclk;
@@ -599,9 +604,9 @@ static void omap_gpif_reset(DeviceState *dev)
 
 static void omap2_gpif_reset(DeviceState *dev)
 {
+    struct omap2_gpif_s *s = OMAP2_GPIO(dev);
     int i;
-    struct omap2_gpif_s *s = FROM_SYSBUS(struct omap2_gpif_s,
-                    SYS_BUS_DEVICE(dev));
+
     for (i = 0; i < s->modulecount; i++) {
         omap2_gpio_module_reset(&s->modules[i]);
     }
@@ -653,7 +658,7 @@ static void omap2_gpif_top_write(void *opaque, hwaddr addr,
 
     case 0x10:	/* IPGENERICOCPSPL_SYSCONFIG */
         if (value & (1 << 1))					/* SOFTRESET */
-            omap2_gpif_reset(&s->busdev.qdev);
+            omap2_gpif_reset(DEVICE(s));
         s->autoidle = value & 1;
         break;
 
@@ -690,10 +695,12 @@ static int omap_gpio_init(SysBusDevice *sbd)
     return 0;
 }
 
-static int omap2_gpio_init(SysBusDevice *dev)
+static int omap2_gpio_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    struct omap2_gpif_s *s = OMAP2_GPIO(dev);
     int i;
-    struct omap2_gpif_s *s = FROM_SYSBUS(struct omap2_gpif_s, dev);
+
     if (!s->iclk) {
         hw_error("omap2-gpio: iclk not connected\n");
     }
@@ -701,14 +708,14 @@ static int omap2_gpio_init(SysBusDevice *dev)
         s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;
         memory_region_init_io(&s->iomem, OBJECT(s), &omap2_gpif_top_ops, s,
                               "omap2.gpio", 0x1000);
-        sysbus_init_mmio(dev, &s->iomem);
+        sysbus_init_mmio(sbd, &s->iomem);
     } else {
         s->modulecount = 6;
     }
     s->modules = g_malloc0(s->modulecount * sizeof(struct omap2_gpio_s));
     s->handler = g_malloc0(s->modulecount * 32 * sizeof(qemu_irq));
-    qdev_init_gpio_in(&dev->qdev, omap2_gpio_set, s->modulecount * 32);
-    qdev_init_gpio_out(&dev->qdev, s->handler, s->modulecount * 32);
+    qdev_init_gpio_in(dev, omap2_gpio_set, s->modulecount * 32);
+    qdev_init_gpio_out(dev, s->handler, s->modulecount * 32);
     for (i = 0; i < s->modulecount; i++) {
         struct omap2_gpio_s *m = &s->modules[i];
         if (!s->fclk[i]) {
@@ -716,12 +723,12 @@ static int omap2_gpio_init(SysBusDevice *dev)
         }
         m->revision = (s->mpu_model < omap3430) ? 0x18 : 0x25;
         m->handler = &s->handler[i * 32];
-        sysbus_init_irq(dev, &m->irq[0]); /* mpu irq */
-        sysbus_init_irq(dev, &m->irq[1]); /* dsp irq */
-        sysbus_init_irq(dev, &m->wkup);
+        sysbus_init_irq(sbd, &m->irq[0]); /* mpu irq */
+        sysbus_init_irq(sbd, &m->irq[1]); /* dsp irq */
+        sysbus_init_irq(sbd, &m->wkup);
         memory_region_init_io(&m->iomem, OBJECT(s), &omap2_gpio_module_ops, m,
                               "omap.gpio-module", 0x1000);
-        sysbus_init_mmio(dev, &m->iomem);
+        sysbus_init_mmio(sbd, &m->iomem);
     }
     return 0;
 }
@@ -784,7 +791,7 @@ static void omap2_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo omap2_gpio_info = {
-    .name          = "omap2-gpio",
+    .name          = TYPE_OMAP2_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap2_gpif_s),
     .class_init    = omap2_gpio_class_init,
commit 1d300b5f6f759f5d0a7866d3da320ebae0f0b79c
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 17:14:40 2013 +0200

    omap_gpio: QOM cast cleanup for omap_gpif_s
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 855afae..295caad 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -35,8 +35,13 @@ struct omap_gpio_s {
     uint16_t pins;
 };
 
+#define TYPE_OMAP1_GPIO "omap-gpio"
+#define OMAP1_GPIO(obj) \
+    OBJECT_CHECK(struct omap_gpif_s, (obj), TYPE_OMAP1_GPIO)
+
 struct omap_gpif_s {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int mpu_model;
     void *clk;
@@ -587,8 +592,8 @@ static const MemoryRegionOps omap2_gpio_module_ops = {
 
 static void omap_gpif_reset(DeviceState *dev)
 {
-    struct omap_gpif_s *s = FROM_SYSBUS(struct omap_gpif_s,
-                    SYS_BUS_DEVICE(dev));
+    struct omap_gpif_s *s = OMAP1_GPIO(dev);
+
     omap_gpio_reset(&s->omap1);
 }
 
@@ -668,18 +673,20 @@ static const MemoryRegionOps omap2_gpif_top_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int omap_gpio_init(SysBusDevice *dev)
+static int omap_gpio_init(SysBusDevice *sbd)
 {
-    struct omap_gpif_s *s = FROM_SYSBUS(struct omap_gpif_s, dev);
+    DeviceState *dev = DEVICE(sbd);
+    struct omap_gpif_s *s = OMAP1_GPIO(dev);
+
     if (!s->clk) {
         hw_error("omap-gpio: clk not connected\n");
     }
-    qdev_init_gpio_in(&dev->qdev, omap_gpio_set, 16);
-    qdev_init_gpio_out(&dev->qdev, s->omap1.handler, 16);
-    sysbus_init_irq(dev, &s->omap1.irq);
+    qdev_init_gpio_in(dev, omap_gpio_set, 16);
+    qdev_init_gpio_out(dev, s->omap1.handler, 16);
+    sysbus_init_irq(sbd, &s->omap1.irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &omap_gpio_ops, &s->omap1,
                           "omap.gpio", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -748,7 +755,7 @@ static void omap_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo omap_gpio_info = {
-    .name          = "omap-gpio",
+    .name          = TYPE_OMAP1_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(struct omap_gpif_s),
     .class_init    = omap_gpio_class_init,
commit 049e7d226e08bbf50c17ffdc3a6793c6e45e77f2
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:58:49 2013 +0200

    sun4m_iommu: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/sun4m_iommu.c b/hw/dma/sun4m_iommu.c
index edb93f3..a04409a 100644
--- a/hw/dma/sun4m_iommu.c
+++ b/hw/dma/sun4m_iommu.c
@@ -126,8 +126,12 @@
 #define IOMMU_PAGE_SIZE     (1 << IOMMU_PAGE_SHIFT)
 #define IOMMU_PAGE_MASK     ~(IOMMU_PAGE_SIZE - 1)
 
+#define TYPE_SUN4M_IOMMU "iommu"
+#define SUN4M_IOMMU(obj) OBJECT_CHECK(IOMMUState, (obj), TYPE_SUN4M_IOMMU)
+
 typedef struct IOMMUState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t regs[IOMMU_NREGS];
     hwaddr iostart;
@@ -332,7 +336,7 @@ static const VMStateDescription vmstate_iommu = {
 
 static void iommu_reset(DeviceState *d)
 {
-    IOMMUState *s = container_of(d, IOMMUState, busdev.qdev);
+    IOMMUState *s = SUN4M_IOMMU(d);
 
     memset(s->regs, 0, IOMMU_NREGS * 4);
     s->iostart = 0;
@@ -345,7 +349,7 @@ static void iommu_reset(DeviceState *d)
 
 static int iommu_init1(SysBusDevice *dev)
 {
-    IOMMUState *s = FROM_SYSBUS(IOMMUState, dev);
+    IOMMUState *s = SUN4M_IOMMU(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -373,7 +377,7 @@ static void iommu_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo iommu_info = {
-    .name          = "iommu",
+    .name          = TYPE_SUN4M_IOMMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IOMMUState),
     .class_init    = iommu_class_init,
commit 70cd8d4b75e91272a28a140818a52f5e32ef4375
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:55:59 2013 +0200

    sparc32_dma: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/sparc32_dma.c b/hw/dma/sparc32_dma.c
index be6275f..2a92ffb 100644
--- a/hw/dma/sparc32_dma.c
+++ b/hw/dma/sparc32_dma.c
@@ -60,10 +60,14 @@
 /* XXX SCSI and ethernet should have different read-only bit masks */
 #define DMA_CSR_RO_MASK 0xfe000007
 
+#define TYPE_SPARC32_DMA "sparc32_dma"
+#define SPARC32_DMA(obj) OBJECT_CHECK(DMAState, (obj), TYPE_SPARC32_DMA)
+
 typedef struct DMAState DMAState;
 
 struct DMAState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t dmaregs[DMA_REGS];
     qemu_irq irq;
@@ -249,7 +253,7 @@ static const MemoryRegionOps dma_mem_ops = {
 
 static void dma_reset(DeviceState *d)
 {
-    DMAState *s = container_of(d, DMAState, busdev.qdev);
+    DMAState *s = SPARC32_DMA(d);
 
     memset(s->dmaregs, 0, DMA_SIZE);
     s->dmaregs[0] = DMA_VER;
@@ -266,20 +270,21 @@ static const VMStateDescription vmstate_dma = {
     }
 };
 
-static int sparc32_dma_init1(SysBusDevice *dev)
+static int sparc32_dma_init1(SysBusDevice *sbd)
 {
-    DMAState *s = FROM_SYSBUS(DMAState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    DMAState *s = SPARC32_DMA(dev);
     int reg_size;
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     reg_size = s->is_ledma ? DMA_ETH_SIZE : DMA_SIZE;
     memory_region_init_io(&s->iomem, OBJECT(s), &dma_mem_ops, s,
                           "dma", reg_size);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
-    qdev_init_gpio_out(&dev->qdev, s->gpio, 2);
+    qdev_init_gpio_in(dev, dma_set_irq, 1);
+    qdev_init_gpio_out(dev, s->gpio, 2);
 
     return 0;
 }
@@ -302,7 +307,7 @@ static void sparc32_dma_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sparc32_dma_info = {
-    .name          = "sparc32_dma",
+    .name          = TYPE_SPARC32_DMA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(DMAState),
     .class_init    = sparc32_dma_class_init,
commit 358cd7ac59ffbb4cef126439f829443d343e2b94
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:43:17 2013 +0200

    pxa2xx_dma: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index bc7bf4c..c013abb 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -26,8 +26,12 @@ typedef struct {
     int request;
 } PXA2xxDMAChannel;
 
+#define TYPE_PXA2XX_DMA "pxa2xx-dma"
+#define PXA2XX_DMA(obj) OBJECT_CHECK(PXA2xxDMAState, (obj), TYPE_PXA2XX_DMA)
+
 typedef struct PXA2xxDMAState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -445,11 +449,11 @@ static void pxa2xx_dma_request(void *opaque, int req_num, int on)
     }
 }
 
-static int pxa2xx_dma_init(SysBusDevice *dev)
+static int pxa2xx_dma_init(SysBusDevice *sbd)
 {
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxDMAState *s = PXA2XX_DMA(dev);
     int i;
-    PXA2xxDMAState *s;
-    s = FROM_SYSBUS(PXA2xxDMAState, dev);
 
     if (s->channels <= 0) {
         return -1;
@@ -463,12 +467,12 @@ static int pxa2xx_dma_init(SysBusDevice *dev)
 
     memset(s->req, 0, sizeof(uint8_t) * PXA2XX_DMA_NUM_REQUESTS);
 
-    qdev_init_gpio_in(&dev->qdev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
+    qdev_init_gpio_in(dev, pxa2xx_dma_request, PXA2XX_DMA_NUM_REQUESTS);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_dma_ops, s,
                           "pxa2xx.dma", 0x00010000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     return 0;
 }
@@ -560,7 +564,7 @@ static void pxa2xx_dma_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_dma_info = {
-    .name          = "pxa2xx-dma",
+    .name          = TYPE_PXA2XX_DMA,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxDMAState),
     .class_init    = pxa2xx_dma_class_init,
commit 6df7cdee0b0e3667a0e7f811a9682e492f21c738
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 16:04:39 2013 +0200

    puv3_dma: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/puv3_dma.c b/hw/dma/puv3_dma.c
index 36004ae..101bd7f 100644
--- a/hw/dma/puv3_dma.c
+++ b/hw/dma/puv3_dma.c
@@ -18,8 +18,12 @@
 #define PUV3_DMA_CH_MASK        (0xff)
 #define PUV3_DMA_CH(offset)     ((offset) >> 8)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_PUV3_DMA "puv3_dma"
+#define PUV3_DMA(obj) OBJECT_CHECK(PUV3DMAState, (obj), TYPE_PUV3_DMA)
+
+typedef struct PUV3DMAState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t reg_CFG[PUV3_DMA_CH_NR];
 } PUV3DMAState;
@@ -73,7 +77,7 @@ static const MemoryRegionOps puv3_dma_ops = {
 
 static int puv3_dma_init(SysBusDevice *dev)
 {
-    PUV3DMAState *s = FROM_SYSBUS(PUV3DMAState, dev);
+    PUV3DMAState *s = PUV3_DMA(dev);
     int i;
 
     for (i = 0; i < PUV3_DMA_CH_NR; i++) {
@@ -95,7 +99,7 @@ static void puv3_dma_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo puv3_dma_info = {
-    .name = "puv3_dma",
+    .name = TYPE_PUV3_DMA,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PUV3DMAState),
     .class_init = puv3_dma_class_init,
commit 4f800554f2b324b3cd5ea6a0e69e9e9b409aa65b
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 12:47:17 2013 +0200

    pl080: QOM'ify pl080 and pl081
    
    Let pl081 inherit from pl080 and replace triple SysBus initfn with two
    instance_inits.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 189a922..35b9015 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -35,8 +35,12 @@ typedef struct {
     uint32_t conf;
 } pl080_channel;
 
+#define TYPE_PL080 "pl080"
+#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
+
 typedef struct PL080State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint8_t tc_int;
     uint8_t tc_mask;
@@ -355,59 +359,44 @@ static const MemoryRegionOps pl080_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int pl08x_init(SysBusDevice *dev, int nchannels)
+static void pl080_init(Object *obj)
 {
-    PL080State *s = FROM_SYSBUS(PL080State, dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    PL080State *s = PL080(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->nchannels = nchannels;
-    return 0;
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    s->nchannels = 8;
 }
 
-static int pl080_init(SysBusDevice *dev)
+static void pl081_init(Object *obj)
 {
-    return pl08x_init(dev, 8);
-}
+    PL080State *s = PL080(obj);
 
-static int pl081_init(SysBusDevice *dev)
-{
-    return pl08x_init(dev, 2);
+    s->nchannels = 2;
 }
 
-static void pl080_class_init(ObjectClass *klass, void *data)
+static void pl080_class_init(ObjectClass *oc, void *data)
 {
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-    k->init = pl080_init;
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl080;
 }
 
 static const TypeInfo pl080_info = {
-    .name          = "pl080",
+    .name          = TYPE_PL080,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL080State),
+    .instance_init = pl080_init,
     .class_init    = pl080_class_init,
 };
 
-static void pl081_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl081_init;
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl080;
-}
-
 static const TypeInfo pl081_info = {
     .name          = "pl081",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL080State),
-    .class_init    = pl081_class_init,
+    .parent        = TYPE_PL080,
+    .instance_init = pl081_init,
 };
 
 /* The PL080 and PL081 are the same except for the number of channels
commit d7ba0a62c58c3a30bc75377b1209dafc613c73be
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 12:37:06 2013 +0200

    pl080: Rename pl080_state to PL080State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index 7937c3e..189a922 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -35,7 +35,7 @@ typedef struct {
     uint32_t conf;
 } pl080_channel;
 
-typedef struct {
+typedef struct PL080State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint8_t tc_int;
@@ -51,7 +51,7 @@ typedef struct {
     /* Flag to avoid recursive DMA invocations.  */
     int running;
     qemu_irq irq;
-} pl080_state;
+} PL080State;
 
 static const VMStateDescription vmstate_pl080_channel = {
     .name = "pl080_channel",
@@ -72,20 +72,20 @@ static const VMStateDescription vmstate_pl080 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_mask, pl080_state),
-        VMSTATE_UINT8(err_int, pl080_state),
-        VMSTATE_UINT8(err_mask, pl080_state),
-        VMSTATE_UINT32(conf, pl080_state),
-        VMSTATE_UINT32(sync, pl080_state),
-        VMSTATE_UINT32(req_single, pl080_state),
-        VMSTATE_UINT32(req_burst, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_UINT8(tc_int, pl080_state),
-        VMSTATE_STRUCT_ARRAY(chan, pl080_state, PL080_MAX_CHANNELS,
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_mask, PL080State),
+        VMSTATE_UINT8(err_int, PL080State),
+        VMSTATE_UINT8(err_mask, PL080State),
+        VMSTATE_UINT32(conf, PL080State),
+        VMSTATE_UINT32(sync, PL080State),
+        VMSTATE_UINT32(req_single, PL080State),
+        VMSTATE_UINT32(req_burst, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_UINT8(tc_int, PL080State),
+        VMSTATE_STRUCT_ARRAY(chan, PL080State, PL080_MAX_CHANNELS,
                              1, vmstate_pl080_channel, pl080_channel),
-        VMSTATE_INT32(running, pl080_state),
+        VMSTATE_INT32(running, PL080State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -96,7 +96,7 @@ static const unsigned char pl080_id[] =
 static const unsigned char pl081_id[] =
 { 0x81, 0x10, 0x04, 0x0a, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl080_update(pl080_state *s)
+static void pl080_update(PL080State *s)
 {
     if ((s->tc_int & s->tc_mask)
             || (s->err_int & s->err_mask))
@@ -105,7 +105,7 @@ static void pl080_update(pl080_state *s)
         qemu_irq_lower(s->irq);
 }
 
-static void pl080_run(pl080_state *s)
+static void pl080_run(PL080State *s)
 {
     int c;
     int flow;
@@ -221,7 +221,7 @@ again:
 static uint64_t pl080_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl080_state *s = (pl080_state *)opaque;
+    PL080State *s = (PL080State *)opaque;
     uint32_t i;
     uint32_t mask;
 
@@ -290,7 +290,7 @@ static uint64_t pl080_read(void *opaque, hwaddr offset,
 static void pl080_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl080_state *s = (pl080_state *)opaque;
+    PL080State *s = (PL080State *)opaque;
     int i;
 
     if (offset >= 0x100 && offset < 0x200) {
@@ -357,7 +357,7 @@ static const MemoryRegionOps pl080_ops = {
 
 static int pl08x_init(SysBusDevice *dev, int nchannels)
 {
-    pl080_state *s = FROM_SYSBUS(pl080_state, dev);
+    PL080State *s = FROM_SYSBUS(PL080State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -389,7 +389,7 @@ static void pl080_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl080_info = {
     .name          = "pl080",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl080_state),
+    .instance_size = sizeof(PL080State),
     .class_init    = pl080_class_init,
 };
 
@@ -406,7 +406,7 @@ static void pl081_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl081_info = {
     .name          = "pl081",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl080_state),
+    .instance_size = sizeof(PL080State),
     .class_init    = pl081_class_init,
 };
 
commit 8df81c4b11f19eae16b88d5da3ab85704d49e6b0
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:48:30 2013 +0200

    empty_slot: QOM cast cleanup
    
    Introduce type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/core/empty_slot.c b/hw/core/empty_slot.c
index e624991..612b109 100644
--- a/hw/core/empty_slot.c
+++ b/hw/core/empty_slot.c
@@ -22,8 +22,12 @@
 #define DPRINTF(fmt, ...) do {} while (0)
 #endif
 
+#define TYPE_EMPTY_SLOT "empty_slot"
+#define EMPTY_SLOT(obj) OBJECT_CHECK(EmptySlot, (obj), TYPE_EMPTY_SLOT)
+
 typedef struct EmptySlot {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint64_t size;
 } EmptySlot;
@@ -55,9 +59,9 @@ void empty_slot_init(hwaddr addr, uint64_t slot_size)
         SysBusDevice *s;
         EmptySlot *e;
 
-        dev = qdev_create(NULL, "empty_slot");
+        dev = qdev_create(NULL, TYPE_EMPTY_SLOT);
         s = SYS_BUS_DEVICE(dev);
-        e = FROM_SYSBUS(EmptySlot, s);
+        e = EMPTY_SLOT(dev);
         e->size = slot_size;
 
         qdev_init_nofail(dev);
@@ -68,7 +72,7 @@ void empty_slot_init(hwaddr addr, uint64_t slot_size)
 
 static int empty_slot_init1(SysBusDevice *dev)
 {
-    EmptySlot *s = FROM_SYSBUS(EmptySlot, dev);
+    EmptySlot *s = EMPTY_SLOT(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &empty_slot_ops, s,
                           "empty-slot", s->size);
@@ -84,7 +88,7 @@ static void empty_slot_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo empty_slot_info = {
-    .name          = "empty_slot",
+    .name          = TYPE_EMPTY_SLOT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(EmptySlot),
     .class_init    = empty_slot_class_init,
commit 71ffe1a01faa90fa08805e8030120b3be0efda25
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:29:17 2013 +0200

    pl011: QOM'ify pl011 and pl011_luminary
    
    Let the Luminary variant inherit from the ARM one, overwriting its ID on
    instance_init. Introduce type constant and use QOM casts. Replace
    triplicated SysBusDevice initfn with QOM realizefn and instance_init.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index e0f7071..a8ae6f4 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -10,8 +10,12 @@
 #include "hw/sysbus.h"
 #include "sysemu/char.h"
 
+#define TYPE_PL011 "pl011"
+#define PL011(obj) OBJECT_CHECK(PL011State, (obj), TYPE_PL011)
+
 typedef struct PL011State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t readbuff;
     uint32_t flags;
@@ -261,64 +265,62 @@ static const VMStateDescription vmstate_pl011 = {
     }
 };
 
-static int pl011_init(SysBusDevice *dev, const unsigned char *id)
+static void pl011_init(Object *obj)
 {
-    PL011State *s = FROM_SYSBUS(PL011State, dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    PL011State *s = PL011(obj);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl011_ops, s, "pl011", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    s->id = id;
-    s->chr = qemu_char_get_next_serial();
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     s->read_trigger = 1;
     s->ifl = 0x12;
     s->cr = 0x300;
     s->flags = 0x90;
-    if (s->chr) {
-        qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
-                              pl011_event, s);
-    }
-    vmstate_register(&dev->qdev, -1, &vmstate_pl011, s);
-    return 0;
-}
 
-static int pl011_arm_init(SysBusDevice *dev)
-{
-    return pl011_init(dev, pl011_id_arm);
+    s->id = pl011_id_arm;
 }
 
-static int pl011_luminary_init(SysBusDevice *dev)
+static void pl011_realize(DeviceState *dev, Error **errp)
 {
-    return pl011_init(dev, pl011_id_luminary);
+    PL011State *s = PL011(dev);
+
+    s->chr = qemu_char_get_next_serial();
+
+    if (s->chr) {
+        qemu_chr_add_handlers(s->chr, pl011_can_receive, pl011_receive,
+                              pl011_event, s);
+    }
 }
 
-static void pl011_arm_class_init(ObjectClass *klass, void *data)
+static void pl011_class_init(ObjectClass *oc, void *data)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
-    sdc->init = pl011_arm_init;
+    dc->realize = pl011_realize;
+    dc->vmsd = &vmstate_pl011;
 }
 
 static const TypeInfo pl011_arm_info = {
-    .name          = "pl011",
+    .name          = TYPE_PL011,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL011State),
-    .class_init    = pl011_arm_class_init,
+    .instance_init = pl011_init,
+    .class_init    = pl011_class_init,
 };
 
-static void pl011_luminary_class_init(ObjectClass *klass, void *data)
+static void pl011_luminary_init(Object *obj)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    PL011State *s = PL011(obj);
 
-    sdc->init = pl011_luminary_init;
+    s->id = pl011_id_luminary;
 }
 
 static const TypeInfo pl011_luminary_info = {
     .name          = "pl011_luminary",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL011State),
-    .class_init    = pl011_luminary_class_init,
+    .parent        = TYPE_PL011,
+    .instance_init = pl011_luminary_init,
 };
 
 static void pl011_register_types(void)
commit ab640bfc2e0ae70ce7d11122ad30957ad53a1836
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:13:57 2013 +0200

    pl011: Rename pl011_state
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index ebec64f..e0f7071 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -10,7 +10,7 @@
 #include "hw/sysbus.h"
 #include "sysemu/char.h"
 
-typedef struct {
+typedef struct PL011State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     uint32_t readbuff;
@@ -31,7 +31,7 @@ typedef struct {
     CharDriverState *chr;
     qemu_irq irq;
     const unsigned char *id;
-} pl011_state;
+} PL011State;
 
 #define PL011_INT_TX 0x20
 #define PL011_INT_RX 0x10
@@ -46,7 +46,7 @@ static const unsigned char pl011_id_arm[8] =
 static const unsigned char pl011_id_luminary[8] =
   { 0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
 
-static void pl011_update(pl011_state *s)
+static void pl011_update(PL011State *s)
 {
     uint32_t flags;
 
@@ -57,7 +57,7 @@ static void pl011_update(pl011_state *s)
 static uint64_t pl011_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     uint32_t c;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
@@ -113,7 +113,7 @@ static uint64_t pl011_read(void *opaque, hwaddr offset,
     }
 }
 
-static void pl011_set_read_trigger(pl011_state *s)
+static void pl011_set_read_trigger(PL011State *s)
 {
 #if 0
     /* The docs say the RX interrupt is triggered when the FIFO exceeds
@@ -130,7 +130,7 @@ static void pl011_set_read_trigger(pl011_state *s)
 static void pl011_write(void *opaque, hwaddr offset,
                         uint64_t value, unsigned size)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     unsigned char ch;
 
     switch (offset >> 2) {
@@ -191,7 +191,7 @@ static void pl011_write(void *opaque, hwaddr offset,
 
 static int pl011_can_receive(void *opaque)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
 
     if (s->lcr & 0x10)
         return s->read_count < 16;
@@ -201,7 +201,7 @@ static int pl011_can_receive(void *opaque)
 
 static void pl011_put_fifo(void *opaque, uint32_t value)
 {
-    pl011_state *s = (pl011_state *)opaque;
+    PL011State *s = (PL011State *)opaque;
     int slot;
 
     slot = s->read_pos + s->read_count;
@@ -242,28 +242,28 @@ static const VMStateDescription vmstate_pl011 = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
-        VMSTATE_UINT32(readbuff, pl011_state),
-        VMSTATE_UINT32(flags, pl011_state),
-        VMSTATE_UINT32(lcr, pl011_state),
-        VMSTATE_UINT32(cr, pl011_state),
-        VMSTATE_UINT32(dmacr, pl011_state),
-        VMSTATE_UINT32(int_enabled, pl011_state),
-        VMSTATE_UINT32(int_level, pl011_state),
-        VMSTATE_UINT32_ARRAY(read_fifo, pl011_state, 16),
-        VMSTATE_UINT32(ilpr, pl011_state),
-        VMSTATE_UINT32(ibrd, pl011_state),
-        VMSTATE_UINT32(fbrd, pl011_state),
-        VMSTATE_UINT32(ifl, pl011_state),
-        VMSTATE_INT32(read_pos, pl011_state),
-        VMSTATE_INT32(read_count, pl011_state),
-        VMSTATE_INT32(read_trigger, pl011_state),
+        VMSTATE_UINT32(readbuff, PL011State),
+        VMSTATE_UINT32(flags, PL011State),
+        VMSTATE_UINT32(lcr, PL011State),
+        VMSTATE_UINT32(cr, PL011State),
+        VMSTATE_UINT32(dmacr, PL011State),
+        VMSTATE_UINT32(int_enabled, PL011State),
+        VMSTATE_UINT32(int_level, PL011State),
+        VMSTATE_UINT32_ARRAY(read_fifo, PL011State, 16),
+        VMSTATE_UINT32(ilpr, PL011State),
+        VMSTATE_UINT32(ibrd, PL011State),
+        VMSTATE_UINT32(fbrd, PL011State),
+        VMSTATE_UINT32(ifl, PL011State),
+        VMSTATE_INT32(read_pos, PL011State),
+        VMSTATE_INT32(read_count, PL011State),
+        VMSTATE_INT32(read_trigger, PL011State),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static int pl011_init(SysBusDevice *dev, const unsigned char *id)
 {
-    pl011_state *s = FROM_SYSBUS(pl011_state, dev);
+    PL011State *s = FROM_SYSBUS(PL011State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl011_ops, s, "pl011", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -303,7 +303,7 @@ static void pl011_arm_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl011_arm_info = {
     .name          = "pl011",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl011_state),
+    .instance_size = sizeof(PL011State),
     .class_init    = pl011_arm_class_init,
 };
 
@@ -317,7 +317,7 @@ static void pl011_luminary_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl011_luminary_info = {
     .name          = "pl011_luminary",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl011_state),
+    .instance_size = sizeof(PL011State),
     .class_init    = pl011_luminary_class_init,
 };
 
commit 79bbe8bf3dbd701a13e2abe0ca0acdfae3e2231d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:08:14 2013 +0200

    milkymist-uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/milkymist-uart.c b/hw/char/milkymist-uart.c
index 46deab2..2e4b5c5 100644
--- a/hw/char/milkymist-uart.c
+++ b/hw/char/milkymist-uart.c
@@ -52,8 +52,13 @@ enum {
     DBG_BREAK_EN = (1<<0),
 };
 
+#define TYPE_MILKYMIST_UART "milkymist-uart"
+#define MILKYMIST_UART(obj) \
+    OBJECT_CHECK(MilkymistUartState, (obj), TYPE_MILKYMIST_UART)
+
 struct MilkymistUartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -179,7 +184,7 @@ static void uart_event(void *opaque, int event)
 
 static void milkymist_uart_reset(DeviceState *d)
 {
-    MilkymistUartState *s = container_of(d, MilkymistUartState, busdev.qdev);
+    MilkymistUartState *s = MILKYMIST_UART(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -192,12 +197,12 @@ static void milkymist_uart_reset(DeviceState *d)
 
 static int milkymist_uart_init(SysBusDevice *dev)
 {
-    MilkymistUartState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistUartState *s = MILKYMIST_UART(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
     memory_region_init_io(&s->regs_region, OBJECT(s), &uart_mmio_ops, s,
-            "milkymist-uart", R_MAX * 4);
+                          "milkymist-uart", R_MAX * 4);
     sysbus_init_mmio(dev, &s->regs_region);
 
     s->chr = qemu_char_get_next_serial();
@@ -230,7 +235,7 @@ static void milkymist_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_uart_info = {
-    .name          = "milkymist-uart",
+    .name          = TYPE_MILKYMIST_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistUartState),
     .class_init    = milkymist_uart_class_init,
commit 85f3d3024588d27453788167566c34c3c658881d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:59:55 2013 +0200

    lm32_uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/lm32_uart.c b/hw/char/lm32_uart.c
index 37b38ba..85d7265 100644
--- a/hw/char/lm32_uart.c
+++ b/hw/char/lm32_uart.c
@@ -89,8 +89,12 @@ enum {
     MSR_DCD  = (1<<7),
 };
 
+#define TYPE_LM32_UART "lm32-uart"
+#define LM32_UART(obj) OBJECT_CHECK(LM32UartState, (obj), TYPE_LM32_UART)
+
 struct LM32UartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CharDriverState *chr;
     qemu_irq irq;
@@ -233,7 +237,7 @@ static void uart_event(void *opaque, int event)
 
 static void uart_reset(DeviceState *d)
 {
-    LM32UartState *s = container_of(d, LM32UartState, busdev.qdev);
+    LM32UartState *s = LM32_UART(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -246,7 +250,7 @@ static void uart_reset(DeviceState *d)
 
 static int lm32_uart_init(SysBusDevice *dev)
 {
-    LM32UartState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32UartState *s = LM32_UART(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -284,7 +288,7 @@ static void lm32_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_uart_info = {
-    .name          = "lm32-uart",
+    .name          = TYPE_LM32_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32UartState),
     .class_init    = lm32_uart_class_init,
commit a0b97927e34903ed280250f90deb6d3261cdc62f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:56:36 2013 +0200

    lm32_juart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index 154511e..252fe46 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -38,8 +38,11 @@ enum {
     JRX_FULL = (1<<8),
 };
 
+#define LM32_JUART(obj) OBJECT_CHECK(LM32JuartState, (obj), TYPE_LM32_JUART)
+
 struct LM32JuartState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     CharDriverState *chr;
 
     uint32_t jtx;
@@ -49,7 +52,7 @@ typedef struct LM32JuartState LM32JuartState;
 
 uint32_t lm32_juart_get_jtx(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_get_jtx(s->jtx);
     return s->jtx;
@@ -57,7 +60,7 @@ uint32_t lm32_juart_get_jtx(DeviceState *d)
 
 uint32_t lm32_juart_get_jrx(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_get_jrx(s->jrx);
     return s->jrx;
@@ -65,7 +68,7 @@ uint32_t lm32_juart_get_jrx(DeviceState *d)
 
 void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
     unsigned char ch = jtx & 0xff;
 
     trace_lm32_juart_set_jtx(s->jtx);
@@ -78,7 +81,7 @@ void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx)
 
 void lm32_juart_set_jrx(DeviceState *d, uint32_t jtx)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     trace_lm32_juart_set_jrx(s->jrx);
     s->jrx &= ~JRX_FULL;
@@ -104,7 +107,7 @@ static void juart_event(void *opaque, int event)
 
 static void juart_reset(DeviceState *d)
 {
-    LM32JuartState *s = container_of(d, LM32JuartState, busdev.qdev);
+    LM32JuartState *s = LM32_JUART(d);
 
     s->jtx = 0;
     s->jrx = 0;
@@ -112,7 +115,7 @@ static void juart_reset(DeviceState *d)
 
 static int lm32_juart_init(SysBusDevice *dev)
 {
-    LM32JuartState *s = FROM_SYSBUS(typeof(*s), dev);
+    LM32JuartState *s = LM32_JUART(dev);
 
     s->chr = qemu_char_get_next_serial();
     if (s->chr) {
@@ -145,7 +148,7 @@ static void lm32_juart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo lm32_juart_info = {
-    .name          = "lm32-juart",
+    .name          = TYPE_LM32_JUART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LM32JuartState),
     .class_init    = lm32_juart_class_init,
diff --git a/hw/lm32/lm32.h b/hw/lm32/lm32.h
index 236686e..18aa6fd 100644
--- a/hw/lm32/lm32.h
+++ b/hw/lm32/lm32.h
@@ -1,8 +1,7 @@
 #ifndef HW_LM32_H
 #define HW_LM32_H 1
 
-
-#include "qemu-common.h"
+#include "hw/char/lm32_juart.h"
 
 static inline DeviceState *lm32_pic_init(qemu_irq cpu_irq)
 {
@@ -21,7 +20,7 @@ static inline DeviceState *lm32_juart_init(void)
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "lm32-juart");
+    dev = qdev_create(NULL, TYPE_LM32_JUART);
     qdev_init_nofail(dev);
 
     return dev;
diff --git a/include/hw/char/lm32_juart.h b/include/hw/char/lm32_juart.h
index 1cd3148..70dc416 100644
--- a/include/hw/char/lm32_juart.h
+++ b/include/hw/char/lm32_juart.h
@@ -3,6 +3,8 @@
 
 #include "hw/qdev.h"
 
+#define TYPE_LM32_JUART "lm32-juart"
+
 uint32_t lm32_juart_get_jtx(DeviceState *d);
 uint32_t lm32_juart_get_jrx(DeviceState *d);
 void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx);
commit 0ee10242fd5c40ef0268147b23ba225b843e2d20
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:49:02 2013 +0200

    lm32_juart: Relocate and tidy header
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index 93ad19d..82ca5fb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -80,6 +80,7 @@ M: Michael Walle <michael at walle.cc>
 S: Maintained
 F: target-lm32/
 F: hw/lm32/
+F: hw/char/lm32_*
 
 M68K
 M: Paul Brook <paul at codesourcery.com>
diff --git a/hw/char/lm32_juart.c b/hw/char/lm32_juart.c
index 839f3eb..154511e 100644
--- a/hw/char/lm32_juart.c
+++ b/hw/char/lm32_juart.c
@@ -22,7 +22,7 @@
 #include "trace.h"
 #include "sysemu/char.h"
 
-#include "hw/lm32/lm32_juart.h"
+#include "hw/char/lm32_juart.h"
 
 enum {
     LM32_JUART_MIN_SAVE_VERSION = 0,
diff --git a/include/hw/char/lm32_juart.h b/include/hw/char/lm32_juart.h
new file mode 100644
index 0000000..1cd3148
--- /dev/null
+++ b/include/hw/char/lm32_juart.h
@@ -0,0 +1,11 @@
+#ifndef QEMU_HW_CHAR_LM32_JUART_H
+#define QEMU_HW_CHAR_LM32_JUART_H
+
+#include "hw/qdev.h"
+
+uint32_t lm32_juart_get_jtx(DeviceState *d);
+uint32_t lm32_juart_get_jrx(DeviceState *d);
+void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx);
+void lm32_juart_set_jrx(DeviceState *d, uint32_t jrx);
+
+#endif /* QEMU_HW_LM32_JUART_H */
diff --git a/include/hw/lm32/lm32_juart.h b/include/hw/lm32/lm32_juart.h
deleted file mode 100644
index 67fc586..0000000
--- a/include/hw/lm32/lm32_juart.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef QEMU_HW_LM32_JUART_H
-#define QEMU_HW_LM32_JUART_H
-
-#include "qemu-common.h"
-
-uint32_t lm32_juart_get_jtx(DeviceState *d);
-uint32_t lm32_juart_get_jrx(DeviceState *d);
-void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx);
-void lm32_juart_set_jrx(DeviceState *d, uint32_t jrx);
-
-#endif /* QEMU_HW_LM32_JUART_H */
diff --git a/target-lm32/op_helper.c b/target-lm32/op_helper.c
index f106873..2dab9f2 100644
--- a/target-lm32/op_helper.c
+++ b/target-lm32/op_helper.c
@@ -4,7 +4,7 @@
 #include "qemu/host-utils.h"
 
 #include "hw/lm32/lm32_pic.h"
-#include "hw/lm32/lm32_juart.h"
+#include "hw/char/lm32_juart.h"
 
 #if !defined(CONFIG_USER_ONLY)
 #define MMUSUFFIX _mmu
commit 8d8e34815e46a45afaa2689b49d5f97b6306b7f3
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:43:22 2013 +0200

    imx_serial: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 5c17eaa..7f16835 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -43,8 +43,12 @@ do { printf("imx_serial: " fmt , ##args); } while (0)
 #  define IPRINTF(fmt, args...) do {} while (0)
 #endif
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_SERIAL "imx-serial"
+#define IMX_SERIAL(obj) OBJECT_CHECK(IMXSerialState, (obj), TYPE_IMX_SERIAL)
+
+typedef struct IMXSerialState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     int32_t readbuff;
 
@@ -169,7 +173,7 @@ static void imx_serial_reset(IMXSerialState *s)
 
 static void imx_serial_reset_at_boot(DeviceState *dev)
 {
-    IMXSerialState *s = container_of(dev, IMXSerialState, busdev.qdev);
+    IMXSerialState *s = IMX_SERIAL(dev);
 
     imx_serial_reset(s);
 
@@ -383,7 +387,7 @@ static const struct MemoryRegionOps imx_serial_ops = {
 
 static int imx_serial_init(SysBusDevice *dev)
 {
-    IMXSerialState *s = FROM_SYSBUS(IMXSerialState, dev);
+    IMXSerialState *s = IMX_SERIAL(dev);
 
 
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_serial_ops, s,
@@ -410,7 +414,7 @@ void imx_serial_create(int uart, const hwaddr addr, qemu_irq irq)
     const char chr_name[] = "serial";
     char label[ARRAY_SIZE(chr_name) + 1];
 
-    dev = qdev_create(NULL, "imx-serial");
+    dev = qdev_create(NULL, TYPE_IMX_SERIAL);
 
     if (uart >= MAX_SERIAL_PORTS) {
         hw_error("Cannot assign uart %d: QEMU supports only %d ports\n",
@@ -455,7 +459,7 @@ static void imx_serial_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_serial_info = {
-    .name = "imx-serial",
+    .name = TYPE_IMX_SERIAL,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXSerialState),
     .class_init = imx_serial_class_init,
commit ae8e04903138a51d15faaf501ea83569cd6cffa5
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:38:10 2013 +0200

    grlib_apbuart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index 82e1b95..35ef661 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -67,8 +67,13 @@
 
 #define FIFO_LENGTH 1024
 
+#define TYPE_GRLIB_APB_UART "grlib,apbuart"
+#define GRLIB_APB_UART(obj) \
+    OBJECT_CHECK(UART, (obj), TYPE_GRLIB_APB_UART)
+
 typedef struct UART {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -232,7 +237,7 @@ static const MemoryRegionOps grlib_apbuart_ops = {
 
 static int grlib_apbuart_init(SysBusDevice *dev)
 {
-    UART *uart = FROM_SYSBUS(typeof(*uart), dev);
+    UART *uart = GRLIB_APB_UART(dev);
 
     qemu_chr_add_handlers(uart->chr,
                           grlib_apbuart_can_receive,
@@ -252,7 +257,7 @@ static int grlib_apbuart_init(SysBusDevice *dev)
 
 static void grlib_apbuart_reset(DeviceState *d)
 {
-    UART *uart = container_of(d, UART, busdev.qdev);
+    UART *uart = GRLIB_APB_UART(d);
 
     /* Transmitter FIFO and shift registers are always empty in QEMU */
     uart->status =  UART_TRANSMIT_FIFO_EMPTY | UART_TRANSMIT_SHIFT_EMPTY;
@@ -279,7 +284,7 @@ static void grlib_apbuart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo grlib_apbuart_info = {
-    .name          = "grlib,apbuart",
+    .name          = TYPE_GRLIB_APB_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(UART),
     .class_init    = grlib_apbuart_class_init,
commit 61149ff6876dffd0de6f527424d9373e4ed2ad59
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 22:21:05 2013 +0200

    exynos4210_uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index 855ce7a..eef23a0 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -166,8 +166,13 @@ typedef struct {
     uint32_t    size;
 } Exynos4210UartFIFO;
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_EXYNOS4210_UART "exynos4210.uart"
+#define EXYNOS4210_UART(obj) \
+    OBJECT_CHECK(Exynos4210UartState, (obj), TYPE_EXYNOS4210_UART)
+
+typedef struct Exynos4210UartState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t             reg[EXYNOS4210_UART_REGS_MEM_SIZE / sizeof(uint32_t)];
@@ -538,8 +543,7 @@ static void exynos4210_uart_event(void *opaque, int event)
 
 static void exynos4210_uart_reset(DeviceState *dev)
 {
-    Exynos4210UartState *s =
-            container_of(dev, Exynos4210UartState, busdev.qdev);
+    Exynos4210UartState *s = EXYNOS4210_UART(dev);
     int regs_number = sizeof(exynos4210_uart_regs)/sizeof(Exynos4210UartReg);
     int i;
 
@@ -582,10 +586,10 @@ static const VMStateDescription vmstate_exynos4210_uart = {
 };
 
 DeviceState *exynos4210_uart_create(hwaddr addr,
-                                 int fifo_size,
-                                 int channel,
-                                 CharDriverState *chr,
-                                 qemu_irq irq)
+                                    int fifo_size,
+                                    int channel,
+                                    CharDriverState *chr,
+                                    qemu_irq irq)
 {
     DeviceState  *dev;
     SysBusDevice *bus;
@@ -593,7 +597,7 @@ DeviceState *exynos4210_uart_create(hwaddr addr,
     const char chr_name[] = "serial";
     char label[ARRAY_SIZE(chr_name) + 1];
 
-    dev = qdev_create(NULL, "exynos4210.uart");
+    dev = qdev_create(NULL, TYPE_EXYNOS4210_UART);
 
     if (!chr) {
         if (channel >= MAX_SERIAL_PORTS) {
@@ -627,7 +631,7 @@ DeviceState *exynos4210_uart_create(hwaddr addr,
 
 static int exynos4210_uart_init(SysBusDevice *dev)
 {
-    Exynos4210UartState *s = FROM_SYSBUS(Exynos4210UartState, dev);
+    Exynos4210UartState *s = EXYNOS4210_UART(dev);
 
     /* memory mapping */
     memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_uart_ops, s,
@@ -662,7 +666,7 @@ static void exynos4210_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_uart_info = {
-    .name          = "exynos4210.uart",
+    .name          = TYPE_EXYNOS4210_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210UartState),
     .class_init    = exynos4210_uart_class_init,
commit 81069b20549b3f465f172efb86f7f5034b89463a
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 21:30:40 2013 +0200

    escc: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/escc.c b/hw/char/escc.c
index 4c42198..6397f6f 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -96,8 +96,11 @@ typedef struct ChannelState {
     uint8_t rx, tx;
 } ChannelState;
 
+#define ESCC(obj) OBJECT_CHECK(ESCCState, (obj), TYPE_ESCC)
+
 typedef struct ESCCState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     struct ChannelState chn[2];
     uint32_t it_shift;
     MemoryRegion mmio;
@@ -309,7 +312,7 @@ static void escc_reset_chn(ChannelState *s)
 
 static void escc_reset(DeviceState *d)
 {
-    ESCCState *s = container_of(d, ESCCState, busdev.qdev);
+    ESCCState *s = ESCC(d);
 
     escc_reset_chn(&s->chn[0]);
     escc_reset_chn(&s->chn[1]);
@@ -534,7 +537,7 @@ static void escc_mem_write(void *opaque, hwaddr addr,
                 escc_reset_chn(&serial->chn[1]);
                 return;
             case MINTR_RST_ALL:
-                escc_reset(&serial->busdev.qdev);
+                escc_reset(DEVICE(serial));
                 return;
             }
             break;
@@ -691,7 +694,7 @@ MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
     SysBusDevice *s;
     ESCCState *d;
 
-    dev = qdev_create(NULL, "escc");
+    dev = qdev_create(NULL, TYPE_ESCC);
     qdev_prop_set_uint32(dev, "disabled", 0);
     qdev_prop_set_uint32(dev, "frequency", clock);
     qdev_prop_set_uint32(dev, "it_shift", it_shift);
@@ -707,7 +710,7 @@ MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
         sysbus_mmio_map(s, 0, base);
     }
 
-    d = FROM_SYSBUS(ESCCState, s);
+    d = ESCC(s);
     return &d->mmio;
 }
 
@@ -852,7 +855,7 @@ void slavio_serial_ms_kbd_init(hwaddr base, qemu_irq irq,
     DeviceState *dev;
     SysBusDevice *s;
 
-    dev = qdev_create(NULL, "escc");
+    dev = qdev_create(NULL, TYPE_ESCC);
     qdev_prop_set_uint32(dev, "disabled", disabled);
     qdev_prop_set_uint32(dev, "frequency", clock);
     qdev_prop_set_uint32(dev, "it_shift", it_shift);
@@ -869,7 +872,7 @@ void slavio_serial_ms_kbd_init(hwaddr base, qemu_irq irq,
 
 static int escc_init1(SysBusDevice *dev)
 {
-    ESCCState *s = FROM_SYSBUS(ESCCState, dev);
+    ESCCState *s = ESCC(dev);
     unsigned int i;
 
     s->chn[0].disabled = s->disabled;
@@ -924,7 +927,7 @@ static void escc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo escc_info = {
-    .name          = "escc",
+    .name          = TYPE_ESCC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ESCCState),
     .class_init    = escc_class_init,
diff --git a/include/hw/char/escc.h b/include/hw/char/escc.h
index bda3213..2742d70 100644
--- a/include/hw/char/escc.h
+++ b/include/hw/char/escc.h
@@ -2,6 +2,7 @@
 #define HW_ESCC_H 1
 
 /* escc.c */
+#define TYPE_ESCC "escc"
 #define ESCC_SIZE 4
 MemoryRegion *escc_init(hwaddr base, qemu_irq irqA, qemu_irq irqB,
               CharDriverState *chrA, CharDriverState *chrB,
commit 534f6ff925cd7c9c8cc10094173e691938ac723f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 21:23:29 2013 +0200

    cadence_uart: QOM cast cleanup
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 4d457f8..3c2e960 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -106,8 +106,12 @@
 
 #define R_MAX (R_TTRIG + 1)
 
+#define TYPE_CADENCE_UART "cadence_uart"
+#define CADENCE_UART(obj) OBJECT_CHECK(UartState, (obj), TYPE_CADENCE_UART)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t r[R_MAX];
     uint8_t r_fifo[RX_FIFO_SIZE];
@@ -442,7 +446,7 @@ static void cadence_uart_reset(UartState *s)
 
 static int cadence_uart_init(SysBusDevice *dev)
 {
-    UartState *s = FROM_SYSBUS(UartState, dev);
+    UartState *s = CADENCE_UART(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &uart_ops, s, "uart", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -504,7 +508,7 @@ static void cadence_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo cadence_uart_info = {
-    .name          = "cadence_uart",
+    .name          = TYPE_CADENCE_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(UartState),
     .class_init    = cadence_uart_class_init,
commit cfc6b24578fdd55c26ed383c910fa18c4137b159
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:37:20 2013 +0200

    versatilepb: QOM cast cleanup for vpb_sic_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 725f60f..b48d84c 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -25,15 +25,19 @@
 
 /* Primary interrupt controller.  */
 
-typedef struct vpb_sic_state
-{
-  SysBusDevice busdev;
-  MemoryRegion iomem;
-  uint32_t level;
-  uint32_t mask;
-  uint32_t pic_enable;
-  qemu_irq parent[32];
-  int irq;
+#define TYPE_VERSATILE_PB_SIC "versatilepb_sic"
+#define VERSATILE_PB_SIC(obj) \
+    OBJECT_CHECK(vpb_sic_state, (obj), TYPE_VERSATILE_PB_SIC)
+
+typedef struct vpb_sic_state {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    uint32_t level;
+    uint32_t mask;
+    uint32_t pic_enable;
+    qemu_irq parent[32];
+    int irq;
 } vpb_sic_state;
 
 static const VMStateDescription vmstate_vpb_sic = {
@@ -144,19 +148,20 @@ static const MemoryRegionOps vpb_sic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int vpb_sic_init(SysBusDevice *dev)
+static int vpb_sic_init(SysBusDevice *sbd)
 {
-    vpb_sic_state *s = FROM_SYSBUS(vpb_sic_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    vpb_sic_state *s = VERSATILE_PB_SIC(dev);
     int i;
 
-    qdev_init_gpio_in(&dev->qdev, vpb_sic_set_irq, 32);
+    qdev_init_gpio_in(dev, vpb_sic_set_irq, 32);
     for (i = 0; i < 32; i++) {
-        sysbus_init_irq(dev, &s->parent[i]);
+        sysbus_init_irq(sbd, &s->parent[i]);
     }
     s->irq = 31;
     memory_region_init_io(&s->iomem, OBJECT(s), &vpb_sic_ops, s,
                           "vpb-sic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -213,7 +218,7 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
     for (n = 0; n < 32; n++) {
         pic[n] = qdev_get_gpio_in(dev, n);
     }
-    dev = sysbus_create_simple("versatilepb_sic", 0x10003000, NULL);
+    dev = sysbus_create_simple(TYPE_VERSATILE_PB_SIC, 0x10003000, NULL);
     for (n = 0; n < 32; n++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), n, pic[n]);
         sic[n] = qdev_get_gpio_in(dev, n);
@@ -393,7 +398,7 @@ static void vpb_sic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo vpb_sic_info = {
-    .name          = "versatilepb_sic",
+    .name          = TYPE_VERSATILE_PB_SIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(vpb_sic_state),
     .class_init    = vpb_sic_class_init,
commit 0ca81872f741e6b93a5951d9a4f524829a911d40
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:32:06 2013 +0200

    strongarm: QOM cast cleanup for StrongARMSSPState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 61c2b22..82a9492 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -1336,8 +1336,14 @@ static const TypeInfo strongarm_uart_info = {
 };
 
 /* Synchronous Serial Ports */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_STRONGARM_SSP "strongarm-ssp"
+#define STRONGARM_SSP(obj) \
+    OBJECT_CHECK(StrongARMSSPState, (obj), TYPE_STRONGARM_SSP)
+
+typedef struct StrongARMSSPState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     SSIBus *bus;
@@ -1519,23 +1525,25 @@ static int strongarm_ssp_post_load(void *opaque, int version_id)
     return 0;
 }
 
-static int strongarm_ssp_init(SysBusDevice *dev)
+static int strongarm_ssp_init(SysBusDevice *sbd)
 {
-    StrongARMSSPState *s = FROM_SYSBUS(StrongARMSSPState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMSSPState *s = STRONGARM_SSP(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ssp_ops, s,
                           "ssp", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    s->bus = ssi_create_bus(&dev->qdev, "ssi");
+    s->bus = ssi_create_bus(dev, "ssi");
     return 0;
 }
 
 static void strongarm_ssp_reset(DeviceState *dev)
 {
-    StrongARMSSPState *s = DO_UPCAST(StrongARMSSPState, busdev.qdev, dev);
+    StrongARMSSPState *s = STRONGARM_SSP(dev);
+
     s->sssr = 0x03; /* 3 bit data, SPI, disabled */
     s->rx_start = 0;
     s->rx_level = 0;
@@ -1569,7 +1577,7 @@ static void strongarm_ssp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_ssp_info = {
-    .name          = "strongarm-ssp",
+    .name          = TYPE_STRONGARM_SSP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMSSPState),
     .class_init    = strongarm_ssp_class_init,
@@ -1633,7 +1641,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
                 qdev_get_gpio_in(s->pic, sa_serial[i].irq));
     }
 
-    s->ssp = sysbus_create_varargs("strongarm-ssp", 0x80070000,
+    s->ssp = sysbus_create_varargs(TYPE_STRONGARM_SSP, 0x80070000,
                 qdev_get_gpio_in(s->pic, SA_PIC_SSP), NULL);
     s->ssp_bus = (SSIBus *)qdev_get_child_bus(s->ssp, "ssi");
 
commit fff3af97b9e1b1a482d8951eddac2c45ede9bf08
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:29:14 2013 +0200

    strongarm: QOM cast cleanup for StrongARMUARTState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 421ac54..61c2b22 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -908,8 +908,13 @@ static const TypeInfo strongarm_ppc_info = {
 #define RX_FIFO_FRE (1 << 9)
 #define RX_FIFO_ROR (1 << 10)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_STRONGARM_UART "strongarm-uart"
+#define STRONGARM_UART(obj) \
+    OBJECT_CHECK(StrongARMUARTState, (obj), TYPE_STRONGARM_UART)
+
+typedef struct StrongARMUARTState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     CharDriverState *chr;
     qemu_irq irq;
@@ -1225,7 +1230,7 @@ static const MemoryRegionOps strongarm_uart_ops = {
 
 static int strongarm_uart_init(SysBusDevice *dev)
 {
-    StrongARMUARTState *s = FROM_SYSBUS(StrongARMUARTState, dev);
+    StrongARMUARTState *s = STRONGARM_UART(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_uart_ops, s,
                           "uart", 0x10000);
@@ -1248,7 +1253,7 @@ static int strongarm_uart_init(SysBusDevice *dev)
 
 static void strongarm_uart_reset(DeviceState *dev)
 {
-    StrongARMUARTState *s = DO_UPCAST(StrongARMUARTState, busdev.qdev, dev);
+    StrongARMUARTState *s = STRONGARM_UART(dev);
 
     s->utcr0 = UTCR0_DSS; /* 8 data, no parity */
     s->brd = 23;    /* 9600 */
@@ -1324,7 +1329,7 @@ static void strongarm_uart_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_uart_info = {
-    .name          = "strongarm-uart",
+    .name          = TYPE_STRONGARM_UART,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMUARTState),
     .class_init    = strongarm_uart_class_init,
@@ -1619,7 +1624,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
     s->ppc = sysbus_create_varargs(TYPE_STRONGARM_PPC, 0x90060000, NULL);
 
     for (i = 0; sa_serial[i].io_base; i++) {
-        DeviceState *dev = qdev_create(NULL, "strongarm-uart");
+        DeviceState *dev = qdev_create(NULL, TYPE_STRONGARM_UART);
         qdev_prop_set_chr(dev, "chardev", serial_hds[i]);
         qdev_init_nofail(dev);
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
commit c71e67329188ee1081de53ef685e627c6e99cc87
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:26:04 2013 +0200

    strongarm: QOM cast cleanup for StrongARMPPCInfo
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index efb56b3..421ac54 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -706,9 +706,14 @@ static const TypeInfo strongarm_gpio_info = {
 #define PSDR 0x0c
 #define PPFR 0x10
 
+#define TYPE_STRONGARM_PPC "strongarm-ppc"
+#define STRONGARM_PPC(obj) \
+    OBJECT_CHECK(StrongARMPPCInfo, (obj), TYPE_STRONGARM_PPC)
+
 typedef struct StrongARMPPCInfo StrongARMPPCInfo;
 struct StrongARMPPCInfo {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq handler[28];
 
@@ -817,19 +822,18 @@ static const MemoryRegionOps strongarm_ppc_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int strongarm_ppc_init(SysBusDevice *dev)
+static int strongarm_ppc_init(SysBusDevice *sbd)
 {
-    StrongARMPPCInfo *s;
-
-    s = FROM_SYSBUS(StrongARMPPCInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMPPCInfo *s = STRONGARM_PPC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, strongarm_ppc_set, 22);
-    qdev_init_gpio_out(&dev->qdev, s->handler, 22);
+    qdev_init_gpio_in(dev, strongarm_ppc_set, 22);
+    qdev_init_gpio_out(dev, s->handler, 22);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_ppc_ops, s,
                           "ppc", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     return 0;
 }
@@ -860,7 +864,7 @@ static void strongarm_ppc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_ppc_info = {
-    .name          = "strongarm-ppc",
+    .name          = TYPE_STRONGARM_PPC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMPPCInfo),
     .class_init    = strongarm_ppc_class_init,
@@ -1612,7 +1616,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
 
     s->gpio = strongarm_gpio_init(0x90040000, s->pic);
 
-    s->ppc = sysbus_create_varargs("strongarm-ppc", 0x90060000, NULL);
+    s->ppc = sysbus_create_varargs(TYPE_STRONGARM_PPC, 0x90060000, NULL);
 
     for (i = 0; sa_serial[i].io_base; i++) {
         DeviceState *dev = qdev_create(NULL, "strongarm-uart");
commit f55beb8477e005f49514410cc00f6913729b01bd
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:23:14 2013 +0200

    strongarm: QOM cast cleanup for StrongARMGPIOInfo
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 78211a0..efb56b3 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -464,6 +464,10 @@ static const TypeInfo strongarm_rtc_sysbus_info = {
 #define GEDR 0x18
 #define GAFR 0x1c
 
+#define TYPE_STRONGARM_GPIO "strongarm-gpio"
+#define STRONGARM_GPIO(obj) \
+    OBJECT_CHECK(StrongARMGPIOInfo, (obj), TYPE_STRONGARM_GPIO)
+
 typedef struct StrongARMGPIOInfo StrongARMGPIOInfo;
 struct StrongARMGPIOInfo {
     SysBusDevice busdev;
@@ -630,7 +634,7 @@ static DeviceState *strongarm_gpio_init(hwaddr base,
     DeviceState *dev;
     int i;
 
-    dev = qdev_create(NULL, "strongarm-gpio");
+    dev = qdev_create(NULL, TYPE_STRONGARM_GPIO);
     qdev_init_nofail(dev);
 
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
@@ -641,24 +645,23 @@ static DeviceState *strongarm_gpio_init(hwaddr base,
     return dev;
 }
 
-static int strongarm_gpio_initfn(SysBusDevice *dev)
+static int strongarm_gpio_initfn(SysBusDevice *sbd)
 {
-    StrongARMGPIOInfo *s;
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMGPIOInfo *s = STRONGARM_GPIO(dev);
     int i;
 
-    s = FROM_SYSBUS(StrongARMGPIOInfo, dev);
-
-    qdev_init_gpio_in(&dev->qdev, strongarm_gpio_set, 28);
-    qdev_init_gpio_out(&dev->qdev, s->handler, 28);
+    qdev_init_gpio_in(dev, strongarm_gpio_set, 28);
+    qdev_init_gpio_out(dev, s->handler, 28);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_gpio_ops, s,
                           "gpio", 0x1000);
 
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     for (i = 0; i < 11; i++) {
-        sysbus_init_irq(dev, &s->irqs[i]);
+        sysbus_init_irq(sbd, &s->irqs[i]);
     }
-    sysbus_init_irq(dev, &s->irqX);
+    sysbus_init_irq(sbd, &s->irqX);
 
     return 0;
 }
@@ -690,7 +693,7 @@ static void strongarm_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_gpio_info = {
-    .name          = "strongarm-gpio",
+    .name          = TYPE_STRONGARM_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMGPIOInfo),
     .class_init    = strongarm_gpio_class_init,
commit 4e00210522ecbbeb81d091cfca1f2cf3f3ae00d8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:20:15 2013 +0200

    strongarm: QOM cast cleanup for StrongARMRTCState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 457f9c7..78211a0 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -242,8 +242,13 @@ static const TypeInfo strongarm_pic_info = {
  * trim delete isn't emulated, so
  * f = 32 768 / (RTTR_trim + 1) */
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_STRONGARM_RTC "strongarm-rtc"
+#define STRONGARM_RTC(obj) \
+    OBJECT_CHECK(StrongARMRTCState, (obj), TYPE_STRONGARM_RTC)
+
+typedef struct StrongARMRTCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t rttr;
     uint32_t rtsr;
@@ -374,7 +379,7 @@ static const MemoryRegionOps strongarm_rtc_ops = {
 
 static int strongarm_rtc_init(SysBusDevice *dev)
 {
-    StrongARMRTCState *s = FROM_SYSBUS(StrongARMRTCState, dev);
+    StrongARMRTCState *s = STRONGARM_RTC(dev);
     struct tm tm;
 
     s->rttr = 0x0;
@@ -443,7 +448,7 @@ static void strongarm_rtc_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_rtc_sysbus_info = {
-    .name          = "strongarm-rtc",
+    .name          = TYPE_STRONGARM_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMRTCState),
     .class_init    = strongarm_rtc_sysbus_class_init,
@@ -1599,7 +1604,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
                     qdev_get_gpio_in(s->pic, SA_PIC_OSTC3),
                     NULL);
 
-    sysbus_create_simple("strongarm-rtc", 0x90010000,
+    sysbus_create_simple(TYPE_STRONGARM_RTC, 0x90010000,
                     qdev_get_gpio_in(s->pic, SA_PIC_RTC_ALARM));
 
     s->gpio = strongarm_gpio_init(0x90040000, s->pic);
commit 74e075f6fbb40992b698c2418aa19ad541abf71e
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:17:13 2013 +0200

    strongarm: QOM cast cleanup for StrongARMPICState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index feaaf45..457f9c7 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -70,8 +70,14 @@ static struct {
 };
 
 /* Interrupt Controller */
-typedef struct {
-    SysBusDevice busdev;
+
+#define TYPE_STRONGARM_PIC "strongarm_pic"
+#define STRONGARM_PIC(obj) \
+    OBJECT_CHECK(StrongARMPICState, (obj), TYPE_STRONGARM_PIC)
+
+typedef struct StrongARMPICState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq    irq;
     qemu_irq    fiq;
@@ -168,16 +174,17 @@ static const MemoryRegionOps strongarm_pic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int strongarm_pic_initfn(SysBusDevice *dev)
+static int strongarm_pic_initfn(SysBusDevice *sbd)
 {
-    StrongARMPICState *s = FROM_SYSBUS(StrongARMPICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    StrongARMPICState *s = STRONGARM_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, strongarm_pic_set_irq, SA_PIC_SRCS);
+    qdev_init_gpio_in(dev, strongarm_pic_set_irq, SA_PIC_SRCS);
     memory_region_init_io(&s->iomem, OBJECT(s), &strongarm_pic_ops, s,
                           "pic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
 
     return 0;
 }
@@ -214,7 +221,7 @@ static void strongarm_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo strongarm_pic_info = {
-    .name          = "strongarm_pic",
+    .name          = TYPE_STRONGARM_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(StrongARMPICState),
     .class_init    = strongarm_pic_class_init,
commit 7df7f67ae1bf6b2c81788a58de9cdf9cf9c03bc8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:13:06 2013 +0200

    stellaris: QOM cast cleanup for stellaris_adc_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 05d1a0d..79f6b4e 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -897,9 +897,13 @@ static int stellaris_i2c_init(SysBusDevice *sbd)
 #define STELLARIS_ADC_FIFO_EMPTY    0x0100
 #define STELLARIS_ADC_FIFO_FULL     0x1000
 
-typedef struct
-{
-    SysBusDevice busdev;
+#define TYPE_STELLARIS_ADC "stellaris-adc"
+#define STELLARIS_ADC(obj) \
+    OBJECT_CHECK(stellaris_adc_state, (obj), TYPE_STELLARIS_ADC)
+
+typedef struct StellarisADCState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t actss;
     uint32_t ris;
@@ -1148,21 +1152,22 @@ static const VMStateDescription vmstate_stellaris_adc = {
     }
 };
 
-static int stellaris_adc_init(SysBusDevice *dev)
+static int stellaris_adc_init(SysBusDevice *sbd)
 {
-    stellaris_adc_state *s = FROM_SYSBUS(stellaris_adc_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_adc_state *s = STELLARIS_ADC(dev);
     int n;
 
     for (n = 0; n < 4; n++) {
-        sysbus_init_irq(dev, &s->irq[n]);
+        sysbus_init_irq(sbd, &s->irq[n]);
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_adc_ops, s,
                           "adc", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     stellaris_adc_reset(s);
-    qdev_init_gpio_in(&dev->qdev, stellaris_adc_trigger, 1);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_adc, s);
+    qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
+    vmstate_register(dev, -1, &vmstate_stellaris_adc, s);
     return 0;
 }
 
@@ -1219,7 +1224,7 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
                       flash_size, sram_size, kernel_filename, cpu_model);
 
     if (board->dc1 & (1 << 16)) {
-        dev = sysbus_create_varargs("stellaris-adc", 0x40038000,
+        dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     pic[14], pic[15], pic[16], pic[17], NULL);
         adc = qdev_get_gpio_in(dev, 0);
     } else {
@@ -1397,7 +1402,7 @@ static void stellaris_adc_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_adc_info = {
-    .name          = "stellaris-adc",
+    .name          = TYPE_STELLARIS_ADC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_adc_state),
     .class_init    = stellaris_adc_class_init,
commit d94a40156b357cd519f9385ca1f57ea7850b9e18
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:08:23 2013 +0200

    stellaris: QOM cast cleanup for stellaris_i2c_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 9a7fafb..05d1a0d 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -685,8 +685,13 @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
 
 /* I2C controller.  */
 
+#define TYPE_STELLARIS_I2C "stellaris-i2c"
+#define STELLARIS_I2C(obj) \
+    OBJECT_CHECK(stellaris_i2c_state, (obj), TYPE_STELLARIS_I2C)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     i2c_bus *bus;
     qemu_irq irq;
     MemoryRegion iomem;
@@ -859,21 +864,22 @@ static const VMStateDescription vmstate_stellaris_i2c = {
     }
 };
 
-static int stellaris_i2c_init(SysBusDevice * dev)
+static int stellaris_i2c_init(SysBusDevice *sbd)
 {
-    stellaris_i2c_state *s = FROM_SYSBUS(stellaris_i2c_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    stellaris_i2c_state *s = STELLARIS_I2C(dev);
     i2c_bus *bus;
 
-    sysbus_init_irq(dev, &s->irq);
-    bus = i2c_init_bus(&dev->qdev, "i2c");
+    sysbus_init_irq(sbd, &s->irq);
+    bus = i2c_init_bus(dev, "i2c");
     s->bus = bus;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &stellaris_i2c_ops, s,
                           "i2c", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     /* ??? For now we only implement the master interface.  */
     stellaris_i2c_reset(s);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_i2c, s);
+    vmstate_register(dev, -1, &vmstate_stellaris_i2c, s);
     return 0;
 }
 
@@ -1244,7 +1250,7 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
     }
 
     if (board->dc2 & (1 << 12)) {
-        dev = sysbus_create_simple("stellaris-i2c", 0x40020000, pic[8]);
+        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000, pic[8]);
         i2c = (i2c_bus *)qdev_get_child_bus(dev, "i2c");
         if (board->peripherals & BP_OLED_I2C) {
             i2c_create_slave(i2c, "ssd0303", 0x3d);
@@ -1363,7 +1369,7 @@ static void stellaris_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_i2c_info = {
-    .name          = "stellaris-i2c",
+    .name          = TYPE_STELLARIS_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(stellaris_i2c_state),
     .class_init    = stellaris_i2c_class_init,
commit 8ef1d3947efd4044b6a33dcd0ccc5c857149e194
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 09:03:33 2013 +0200

    stellaris: QOM cast cleanup for gptm_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index a2b6b17..9a7fafb 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -43,8 +43,13 @@ typedef const struct {
 
 /* General purpose timer module.  */
 
+#define TYPE_STELLARIS_GPTM "stellaris-gptm"
+#define STELLARIS_GPTM(obj) \
+    OBJECT_CHECK(gptm_state, (obj), TYPE_STELLARIS_GPTM)
+
 typedef struct gptm_state {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t config;
     uint32_t mode[2];
@@ -300,21 +305,22 @@ static const VMStateDescription vmstate_stellaris_gptm = {
     }
 };
 
-static int stellaris_gptm_init(SysBusDevice *dev)
+static int stellaris_gptm_init(SysBusDevice *sbd)
 {
-    gptm_state *s = FROM_SYSBUS(gptm_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    gptm_state *s = STELLARIS_GPTM(dev);
 
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_out(&dev->qdev, &s->trigger, 1);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_out(dev, &s->trigger, 1);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &gptm_ops, s,
                           "gptm", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     s->opaque[0] = s->opaque[1] = s;
     s->timer[0] = qemu_new_timer_ns(vm_clock, gptm_tick, &s->opaque[0]);
     s->timer[1] = qemu_new_timer_ns(vm_clock, gptm_tick, &s->opaque[1]);
-    vmstate_register(&dev->qdev, -1, &vmstate_stellaris_gptm, s);
+    vmstate_register(dev, -1, &vmstate_stellaris_gptm, s);
     return 0;
 }
 
@@ -1215,7 +1221,7 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
     }
     for (i = 0; i < 4; i++) {
         if (board->dc2 & (0x10000 << i)) {
-            dev = sysbus_create_simple("stellaris-gptm",
+            dev = sysbus_create_simple(TYPE_STELLARIS_GPTM,
                                        0x40030000 + i * 0x1000,
                                        pic[timer_irq[i]]);
             /* TODO: This is incorrect, but we get away with it because
@@ -1371,7 +1377,7 @@ static void stellaris_gptm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo stellaris_gptm_info = {
-    .name          = "stellaris-gptm",
+    .name          = TYPE_STELLARIS_GPTM,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(gptm_state),
     .class_init    = stellaris_gptm_class_init,
commit 73e9d965dd071ecde5cb31327b58469275691667
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 08:58:32 2013 +0200

    spitz: QOM cast cleanup for SpitzKeyboardState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 0bf5c5c..34f9582 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -215,8 +215,13 @@ static const int spitz_gpiomap[5] = {
     SPITZ_GPIO_SWA, SPITZ_GPIO_SWB,
 };
 
+#define TYPE_SPITZ_KEYBOARD "spitz-keyboard"
+#define SPITZ_KEYBOARD(obj) \
+    OBJECT_CHECK(SpitzKeyboardState, (obj), TYPE_SPITZ_KEYBOARD)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     qemu_irq sense[SPITZ_KEY_SENSE_NUM];
     qemu_irq gpiomap[5];
     int keymap[0x80];
@@ -461,8 +466,8 @@ static void spitz_keyboard_register(PXA2xxState *cpu)
     DeviceState *dev;
     SpitzKeyboardState *s;
 
-    dev = sysbus_create_simple("spitz-keyboard", -1, NULL);
-    s = FROM_SYSBUS(SpitzKeyboardState, SYS_BUS_DEVICE(dev));
+    dev = sysbus_create_simple(TYPE_SPITZ_KEYBOARD, -1, NULL);
+    s = SPITZ_KEYBOARD(dev);
 
     for (i = 0; i < SPITZ_KEY_SENSE_NUM; i ++)
         qdev_connect_gpio_out(dev, i, qdev_get_gpio_in(cpu->gpio, spitz_gpio_key_sense[i]));
@@ -485,13 +490,12 @@ static void spitz_keyboard_register(PXA2xxState *cpu)
     qemu_add_kbd_event_handler(spitz_keyboard_handler, s);
 }
 
-static int spitz_keyboard_init(SysBusDevice *dev)
+static int spitz_keyboard_init(SysBusDevice *sbd)
 {
-    SpitzKeyboardState *s;
+    DeviceState *dev = DEVICE(sbd);
+    SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);
     int i, j;
 
-    s = FROM_SYSBUS(SpitzKeyboardState, dev);
-
     for (i = 0; i < 0x80; i ++)
         s->keymap[i] = -1;
     for (i = 0; i < SPITZ_KEY_SENSE_NUM + 1; i ++)
@@ -502,8 +506,8 @@ static int spitz_keyboard_init(SysBusDevice *dev)
     spitz_keyboard_pre_map(s);
 
     s->kbdtimer = qemu_new_timer_ns(vm_clock, spitz_keyboard_tick, s);
-    qdev_init_gpio_in(&dev->qdev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
-    qdev_init_gpio_out(&dev->qdev, s->sense, SPITZ_KEY_SENSE_NUM);
+    qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);
+    qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);
 
     return 0;
 }
@@ -1065,7 +1069,7 @@ static void spitz_keyboard_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo spitz_keyboard_info = {
-    .name          = "spitz-keyboard",
+    .name          = TYPE_SPITZ_KEYBOARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SpitzKeyboardState),
     .class_init    = spitz_keyboard_class_init,
commit 7eb8104a9cd274a14b9a8a6caf38d0720e56cd21
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 08:54:33 2013 +0200

    spitz: QOM cast cleanup for SLNANDState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 593b75e..0bf5c5c 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -50,8 +50,12 @@
 #define FLASHCTL_RYBY		(1 << 5)
 #define FLASHCTL_NCE		(FLASHCTL_CE0 | FLASHCTL_CE1)
 
+#define TYPE_SL_NAND "sl-nand"
+#define SL_NAND(obj) OBJECT_CHECK(SLNANDState, (obj), TYPE_SL_NAND)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     DeviceState *nand;
     uint8_t ctl;
@@ -147,7 +151,7 @@ static void sl_flash_register(PXA2xxState *cpu, int size)
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "sl-nand");
+    dev = qdev_create(NULL, TYPE_SL_NAND);
 
     qdev_prop_set_uint8(dev, "manf_id", NAND_MFR_SAMSUNG);
     if (size == FLASH_128M)
@@ -159,12 +163,11 @@ static void sl_flash_register(PXA2xxState *cpu, int size)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, FLASH_BASE);
 }
 
-static int sl_nand_init(SysBusDevice *dev) {
-    SLNANDState *s;
+static int sl_nand_init(SysBusDevice *dev)
+{
+    SLNANDState *s = SL_NAND(dev);
     DriveInfo *nand;
 
-    s = FROM_SYSBUS(SLNANDState, dev);
-
     s->ctl = 0;
     nand = drive_get(IF_MTD, 0, 0);
     s->nand = nand_init(nand ? nand->bdrv : NULL, s->manf_id, s->chip_id);
@@ -1027,7 +1030,7 @@ static void sl_nand_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo sl_nand_info = {
-    .name          = "sl-nand",
+    .name          = TYPE_SL_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(SLNANDState),
     .class_init    = sl_nand_class_init,
commit 6050ed5fb98822220f71d69c46870bdf1f3bc076
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 02:08:09 2013 +0200

    pxa2xx_pic: QOM cast cleanup for PXA2xxPICState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx_pic.c b/hw/arm/pxa2xx_pic.c
index 8929b6d..46d337c 100644
--- a/hw/arm/pxa2xx_pic.c
+++ b/hw/arm/pxa2xx_pic.c
@@ -31,8 +31,15 @@
 
 #define PXA2XX_PIC_SRCS	40
 
+#define TYPE_PXA2XX_PIC "pxa2xx_pic"
+#define PXA2XX_PIC(obj) \
+    OBJECT_CHECK(PXA2xxPICState, (obj), TYPE_PXA2XX_PIC)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     ARMCPU *cpu;
     uint32_t int_enabled[2];
@@ -260,9 +267,8 @@ static int pxa2xx_pic_post_load(void *opaque, int version_id)
 
 DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
 {
-    CPUARMState *env = &cpu->env;
-    DeviceState *dev = qdev_create(NULL, "pxa2xx_pic");
-    PXA2xxPICState *s = FROM_SYSBUS(PXA2xxPICState, SYS_BUS_DEVICE(dev));
+    DeviceState *dev = qdev_create(NULL, TYPE_PXA2XX_PIC);
+    PXA2xxPICState *s = PXA2XX_PIC(dev);
 
     s->cpu = cpu;
 
@@ -284,7 +290,7 @@ DeviceState *pxa2xx_pic_init(hwaddr base, ARMCPU *cpu)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 
     /* Enable IC coprocessor access.  */
-    define_arm_cp_regs_with_opaque(arm_env_get_cpu(env), pxa_pic_cp_reginfo, s);
+    define_arm_cp_regs_with_opaque(cpu, pxa_pic_cp_reginfo, s);
 
     return dev;
 }
@@ -321,7 +327,7 @@ static void pxa2xx_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_pic_info = {
-    .name          = "pxa2xx_pic",
+    .name          = TYPE_PXA2XX_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxPICState),
     .class_init    = pxa2xx_pic_class_init,
commit 922bb317e488300c50344742cbd5e0028a8b3d77
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 02:03:39 2013 +0200

    pxa2xx_gpio: QOM cast cleanup for PXA2xxGPIOInfo
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx_gpio.c b/hw/arm/pxa2xx_gpio.c
index f8c3ee0..ca77f56 100644
--- a/hw/arm/pxa2xx_gpio.c
+++ b/hw/arm/pxa2xx_gpio.c
@@ -13,9 +13,16 @@
 
 #define PXA2XX_GPIO_BANKS	4
 
+#define TYPE_PXA2XX_GPIO "pxa2xx-gpio"
+#define PXA2XX_GPIO(obj) \
+    OBJECT_CHECK(PXA2xxGPIOInfo, (obj), TYPE_PXA2XX_GPIO)
+
 typedef struct PXA2xxGPIOInfo PXA2xxGPIOInfo;
 struct PXA2xxGPIOInfo {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq0, irq1, irqX;
     int lines;
@@ -256,7 +263,7 @@ DeviceState *pxa2xx_gpio_init(hwaddr base,
     CPUState *cs = CPU(cpu);
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "pxa2xx-gpio");
+    dev = qdev_create(NULL, TYPE_PXA2XX_GPIO);
     qdev_prop_set_int32(dev, "lines", lines);
     qdev_prop_set_int32(dev, "ncpu", cs->cpu_index);
     qdev_init_nofail(dev);
@@ -272,22 +279,21 @@ DeviceState *pxa2xx_gpio_init(hwaddr base,
     return dev;
 }
 
-static int pxa2xx_gpio_initfn(SysBusDevice *dev)
+static int pxa2xx_gpio_initfn(SysBusDevice *sbd)
 {
-    PXA2xxGPIOInfo *s;
-
-    s = FROM_SYSBUS(PXA2xxGPIOInfo, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxGPIOInfo *s = PXA2XX_GPIO(dev);
 
     s->cpu = ARM_CPU(qemu_get_cpu(s->ncpu));
 
-    qdev_init_gpio_in(&dev->qdev, pxa2xx_gpio_set, s->lines);
-    qdev_init_gpio_out(&dev->qdev, s->handler, s->lines);
+    qdev_init_gpio_in(dev, pxa2xx_gpio_set, s->lines);
+    qdev_init_gpio_out(dev, s->handler, s->lines);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa_gpio_ops, s, "pxa2xx-gpio", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq0);
-    sysbus_init_irq(dev, &s->irq1);
-    sysbus_init_irq(dev, &s->irqX);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq0);
+    sysbus_init_irq(sbd, &s->irq1);
+    sysbus_init_irq(sbd, &s->irqX);
 
     return 0;
 }
@@ -298,7 +304,8 @@ static int pxa2xx_gpio_initfn(SysBusDevice *dev)
  */
 void pxa2xx_gpio_read_notifier(DeviceState *dev, qemu_irq handler)
 {
-    PXA2xxGPIOInfo *s = FROM_SYSBUS(PXA2xxGPIOInfo, SYS_BUS_DEVICE(dev));
+    PXA2xxGPIOInfo *s = PXA2XX_GPIO(dev);
+
     s->read_notify = handler;
 }
 
@@ -337,7 +344,7 @@ static void pxa2xx_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_gpio_info = {
-    .name          = "pxa2xx-gpio",
+    .name          = TYPE_PXA2XX_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxGPIOInfo),
     .class_init    = pxa2xx_gpio_class_init,
commit 5354c21ef905ab36015900e7d27d352bca47f285
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:56:59 2013 +0200

    pxa2xx: QOM cast cleanup for PXA2xxI2CState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 6548338..7de6453 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -1224,8 +1224,15 @@ typedef struct {
     PXA2xxI2CState *host;
 } PXA2xxI2CSlaveState;
 
+#define TYPE_PXA2XX_I2C "pxa2xx_i2c"
+#define PXA2XX_I2C(obj) \
+    OBJECT_CHECK(PXA2xxI2CState, (obj), TYPE_PXA2XX_I2C)
+
 struct PXA2xxI2CState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     PXA2xxI2CSlaveState *slave;
     i2c_bus *bus;
@@ -1473,16 +1480,16 @@ PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
     SysBusDevice *i2c_dev;
     PXA2xxI2CState *s;
 
-    i2c_dev = SYS_BUS_DEVICE(qdev_create(NULL, "pxa2xx_i2c"));
-    qdev_prop_set_uint32(&i2c_dev->qdev, "size", region_size + 1);
-    qdev_prop_set_uint32(&i2c_dev->qdev, "offset", base & region_size);
-
-    qdev_init_nofail(&i2c_dev->qdev);
+    dev = qdev_create(NULL, TYPE_PXA2XX_I2C);
+    qdev_prop_set_uint32(dev, "size", region_size + 1);
+    qdev_prop_set_uint32(dev, "offset", base & region_size);
+    qdev_init_nofail(dev);
 
+    i2c_dev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(i2c_dev, 0, base & ~region_size);
     sysbus_connect_irq(i2c_dev, 0, irq);
 
-    s = FROM_SYSBUS(PXA2xxI2CState, i2c_dev);
+    s = PXA2XX_I2C(i2c_dev);
     /* FIXME: Should the slave device really be on a separate bus?  */
     dev = i2c_create_slave(i2c_init_bus(NULL, "dummy"), "pxa2xx-i2c-slave", 0);
     s->slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, I2C_SLAVE(dev));
@@ -1491,16 +1498,17 @@ PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
     return s;
 }
 
-static int pxa2xx_i2c_initfn(SysBusDevice *dev)
+static int pxa2xx_i2c_initfn(SysBusDevice *sbd)
 {
-    PXA2xxI2CState *s = FROM_SYSBUS(PXA2xxI2CState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxI2CState *s = PXA2XX_I2C(dev);
 
-    s->bus = i2c_init_bus(&dev->qdev, "i2c");
+    s->bus = i2c_init_bus(dev, "i2c");
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_i2c_ops, s,
                           "pxa2xx-i2c", s->region_size);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
 
     return 0;
 }
@@ -1528,7 +1536,7 @@ static void pxa2xx_i2c_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_i2c_info = {
-    .name          = "pxa2xx_i2c",
+    .name          = TYPE_PXA2XX_I2C,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxI2CState),
     .class_init    = pxa2xx_i2c_class_init,
commit 548c6f188ecfbb09b42a29393fc18252ab7bbf7d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:50:26 2013 +0200

    pxa2xx: QOM cast cleanup for PXA2xxRTCState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index babe22e..6548338 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -798,8 +798,15 @@ static int pxa2xx_ssp_init(SysBusDevice *sbd)
 #define RTCPICR		0x34	/* RTC Periodic Interrupt Counter register */
 #define PIAR		0x38	/* RTC Periodic Interrupt Alarm register */
 
+#define TYPE_PXA2XX_RTC "pxa2xx_rtc"
+#define PXA2XX_RTC(obj) \
+    OBJECT_CHECK(PXA2xxRTCState, (obj), TYPE_PXA2XX_RTC)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t rttr;
     uint32_t rtsr;
@@ -1110,7 +1117,7 @@ static const MemoryRegionOps pxa2xx_rtc_ops = {
 
 static int pxa2xx_rtc_init(SysBusDevice *dev)
 {
-    PXA2xxRTCState *s = FROM_SYSBUS(PXA2xxRTCState, dev);
+    PXA2xxRTCState *s = PXA2XX_RTC(dev);
     struct tm tm;
     int wom;
 
@@ -1205,7 +1212,7 @@ static void pxa2xx_rtc_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_rtc_sysbus_info = {
-    .name          = "pxa2xx_rtc",
+    .name          = TYPE_PXA2XX_RTC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxRTCState),
     .class_init    = pxa2xx_rtc_sysbus_class_init,
@@ -2128,7 +2135,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
 
-    sysbus_create_simple("pxa2xx_rtc", 0x40900000,
+    sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
 
     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
@@ -2259,7 +2266,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
 
-    sysbus_create_simple("pxa2xx_rtc", 0x40900000,
+    sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM));
 
     s->i2c[0] = pxa2xx_i2c_init(0x40301600,
commit 12a828041c666cf96d69cde85bd7ec03a7e8719f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:45:10 2013 +0200

    pxa2xx: QOM cast cleanup for PXA2xxSSPState
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 3c520d7..babe22e 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -457,9 +457,16 @@ static const VMStateDescription vmstate_pxa2xx_mm = {
     }
 };
 
+#define TYPE_PXA2XX_SSP "pxa2xx-ssp"
+#define PXA2XX_SSP(obj) \
+    OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
+
 /* Synchronous Serial Ports */
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq;
     int enable;
@@ -757,19 +764,20 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
     return 0;
 }
 
-static int pxa2xx_ssp_init(SysBusDevice *dev)
+static int pxa2xx_ssp_init(SysBusDevice *sbd)
 {
-    PXA2xxSSPState *s = FROM_SYSBUS(PXA2xxSSPState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PXA2xxSSPState *s = PXA2XX_SSP(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_ssp_ops, s,
                           "pxa2xx-ssp", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    register_savevm(&dev->qdev, "pxa2xx_ssp", -1, 0,
+    sysbus_init_mmio(sbd, &s->iomem);
+    register_savevm(dev, "pxa2xx_ssp", -1, 0,
                     pxa2xx_ssp_save, pxa2xx_ssp_load, s);
 
-    s->bus = ssi_create_bus(&dev->qdev, "ssi");
+    s->bus = ssi_create_bus(dev, "ssi");
     return 0;
 }
 
@@ -2107,7 +2115,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
         DeviceState *dev;
-        dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
+        dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
                         qdev_get_gpio_in(s->pic, pxa27x_ssp[i].irqn));
         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
     }
@@ -2238,7 +2246,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
         DeviceState *dev;
-        dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
+        dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
                         qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn));
         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
     }
@@ -2278,7 +2286,7 @@ static void pxa2xx_ssp_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pxa2xx_ssp_info = {
-    .name          = "pxa2xx-ssp",
+    .name          = TYPE_PXA2XX_SSP,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PXA2xxSSPState),
     .class_init    = pxa2xx_ssp_class_init,
commit 3bdf5327c9b3e449a3ea212d063baa7fac576b1b
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:38:59 2013 +0200

    musicpal: QOM cast cleanup for musicpal_key_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index ab54b2e..d715143 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -1436,8 +1436,15 @@ static const TypeInfo musicpal_gpio_info = {
 #define MP_KEY_BTN_VOLUME      (1 << 6)
 #define MP_KEY_BTN_NAVIGATION  (1 << 7)
 
+#define TYPE_MUSICPAL_KEY "musicpal_key"
+#define MUSICPAL_KEY(obj) \
+    OBJECT_CHECK(musicpal_key_state, (obj), TYPE_MUSICPAL_KEY)
+
 typedef struct musicpal_key_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t kbd_extended;
     uint32_t pressed_keys;
@@ -1521,17 +1528,18 @@ static void musicpal_key_event(void *opaque, int keycode)
     s->kbd_extended = 0;
 }
 
-static int musicpal_key_init(SysBusDevice *dev)
+static int musicpal_key_init(SysBusDevice *sbd)
 {
-    musicpal_key_state *s = FROM_SYSBUS(musicpal_key_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_key_state *s = MUSICPAL_KEY(dev);
 
     memory_region_init(&s->iomem, OBJECT(s), "dummy", 0);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
     s->kbd_extended = 0;
     s->pressed_keys = 0;
 
-    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
+    qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
 
     qemu_add_kbd_event_handler(musicpal_key_event, s);
 
@@ -1560,7 +1568,7 @@ static void musicpal_key_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo musicpal_key_info = {
-    .name          = "musicpal_key",
+    .name          = TYPE_MUSICPAL_KEY,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_key_state),
     .class_init    = musicpal_key_class_init,
@@ -1684,7 +1692,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
     lcd_dev = sysbus_create_simple(TYPE_MUSICPAL_LCD, MP_LCD_BASE, NULL);
-    key_dev = sysbus_create_simple("musicpal_key", -1, NULL);
+    key_dev = sysbus_create_simple(TYPE_MUSICPAL_KEY, -1, NULL);
 
     /* I2C read data */
     qdev_connect_gpio_out(i2c_dev, 0,
commit 7012d4b46b68dcffde1f12a5dfbce5c4c02dc3ff
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:36:24 2013 +0200

    musicpal: QOM cast cleanup for musicpal_gpio_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 21ec541..ab54b2e 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -1183,8 +1183,15 @@ static int mv88w8618_wlan_init(SysBusDevice *dev)
 /* LCD brightness bits in GPIO_OE_HI */
 #define MP_OE_LCD_BRIGHTNESS    0x0007
 
+#define TYPE_MUSICPAL_GPIO "musicpal_gpio"
+#define MUSICPAL_GPIO(obj) \
+    OBJECT_CHECK(musicpal_gpio_state, (obj), TYPE_MUSICPAL_GPIO)
+
 typedef struct musicpal_gpio_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t lcd_brightness;
     uint32_t out_state;
@@ -1344,8 +1351,7 @@ static const MemoryRegionOps musicpal_gpio_ops = {
 
 static void musicpal_gpio_reset(DeviceState *d)
 {
-    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state,
-                                         SYS_BUS_DEVICE(d));
+    musicpal_gpio_state *s = MUSICPAL_GPIO(d);
 
     s->lcd_brightness = 0;
     s->out_state = 0;
@@ -1355,19 +1361,20 @@ static void musicpal_gpio_reset(DeviceState *d)
     s->isr = 0;
 }
 
-static int musicpal_gpio_init(SysBusDevice *dev)
+static int musicpal_gpio_init(SysBusDevice *sbd)
 {
-    musicpal_gpio_state *s = FROM_SYSBUS(musicpal_gpio_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_gpio_state *s = MUSICPAL_GPIO(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_gpio_ops, s,
                           "musicpal-gpio", MP_GPIO_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_out(&dev->qdev, s->out, ARRAY_SIZE(s->out));
+    qdev_init_gpio_out(dev, s->out, ARRAY_SIZE(s->out));
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_gpio_pin_event, 32);
+    qdev_init_gpio_in(dev, musicpal_gpio_pin_event, 32);
 
     return 0;
 }
@@ -1399,7 +1406,7 @@ static void musicpal_gpio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo musicpal_gpio_info = {
-    .name          = "musicpal_gpio",
+    .name          = TYPE_MUSICPAL_GPIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_gpio_state),
     .class_init    = musicpal_gpio_class_init,
@@ -1671,7 +1678,8 @@ static void musicpal_init(QEMUMachineInitArgs *args)
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
-    dev = sysbus_create_simple("musicpal_gpio", MP_GPIO_BASE, pic[MP_GPIO_IRQ]);
+    dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
+                               pic[MP_GPIO_IRQ]);
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
commit 5952b01cf82ba2385065c8fc9976b8907f215b36
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:32:00 2013 +0200

    musicpal: QOM cast cleanup for mv88w8618_flashcfg
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index b2a28d9..21ec541 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -982,8 +982,15 @@ static const TypeInfo mv88w8618_pit_info = {
 /* Flash config register offsets */
 #define MP_FLASHCFG_CFGR0    0x04
 
+#define TYPE_MV88W8618_FLASHCFG "mv88w8618_flashcfg"
+#define MV88W8618_FLASHCFG(obj) \
+    OBJECT_CHECK(mv88w8618_flashcfg_state, (obj), TYPE_MV88W8618_FLASHCFG)
+
 typedef struct mv88w8618_flashcfg_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t cfgr0;
 } mv88w8618_flashcfg_state;
@@ -1023,7 +1030,7 @@ static const MemoryRegionOps mv88w8618_flashcfg_ops = {
 
 static int mv88w8618_flashcfg_init(SysBusDevice *dev)
 {
-    mv88w8618_flashcfg_state *s = FROM_SYSBUS(mv88w8618_flashcfg_state, dev);
+    mv88w8618_flashcfg_state *s = MV88W8618_FLASHCFG(dev);
 
     s->cfgr0 = 0xfffe4285; /* Default as set by U-Boot for 8 MB flash */
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_flashcfg_ops, s,
@@ -1053,7 +1060,7 @@ static void mv88w8618_flashcfg_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_flashcfg_info = {
-    .name          = "mv88w8618_flashcfg",
+    .name          = TYPE_MV88W8618_FLASHCFG,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_flashcfg_state),
     .class_init    = mv88w8618_flashcfg_class_init,
@@ -1651,7 +1658,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
 #endif
 
     }
-    sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE, NULL);
+    sysbus_create_simple(TYPE_MV88W8618_FLASHCFG, MP_FLASHCFG_BASE, NULL);
 
     qemu_check_nic_model(&nd_table[0], "mv88w8618");
     dev = qdev_create(NULL, TYPE_MV88W8618_ETH);
commit 4adc8541d970f5a52a8cb05f893f4afeec255d5b
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:27:32 2013 +0200

    musicpal: QOM cast cleanup for mv88w8618_pit_state
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index d6f593b..b2a28d9 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -816,8 +816,15 @@ typedef struct mv88w8618_timer_state {
     qemu_irq irq;
 } mv88w8618_timer_state;
 
+#define TYPE_MV88W8618_PIT "mv88w8618_pit"
+#define MV88W8618_PIT(obj) \
+    OBJECT_CHECK(mv88w8618_pit_state, (obj), TYPE_MV88W8618_PIT)
+
 typedef struct mv88w8618_pit_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     mv88w8618_timer_state timer[4];
 } mv88w8618_pit_state;
@@ -899,8 +906,7 @@ static void mv88w8618_pit_write(void *opaque, hwaddr offset,
 
 static void mv88w8618_pit_reset(DeviceState *d)
 {
-    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state,
-                                         SYS_BUS_DEVICE(d));
+    mv88w8618_pit_state *s = MV88W8618_PIT(d);
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -917,7 +923,7 @@ static const MemoryRegionOps mv88w8618_pit_ops = {
 
 static int mv88w8618_pit_init(SysBusDevice *dev)
 {
-    mv88w8618_pit_state *s = FROM_SYSBUS(mv88w8618_pit_state, dev);
+    mv88w8618_pit_state *s = MV88W8618_PIT(dev);
     int i;
 
     /* Letting them all run at 1 MHz is likely just a pragmatic
@@ -967,7 +973,7 @@ static void mv88w8618_pit_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_pit_info = {
-    .name          = "mv88w8618_pit",
+    .name          = TYPE_MV88W8618_PIT,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_pit_state),
     .class_init    = mv88w8618_pit_class_init,
@@ -1598,7 +1604,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
     }
-    sysbus_create_varargs("mv88w8618_pit", MP_PIT_BASE, pic[MP_TIMER1_IRQ],
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
commit c7bd0fd945c3f7f1d93a226dbe89a2ccf0503a58
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:22:07 2013 +0200

    musicpal: QOM cast cleanup mv88w8618_pic_state
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 0bc69e9..d6f593b 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -677,9 +677,15 @@ static const TypeInfo musicpal_lcd_info = {
 #define MP_PIC_ENABLE_SET       0x08
 #define MP_PIC_ENABLE_CLR       0x0C
 
-typedef struct mv88w8618_pic_state
-{
-    SysBusDevice busdev;
+#define TYPE_MV88W8618_PIC "mv88w8618_pic"
+#define MV88W8618_PIC(obj) \
+    OBJECT_CHECK(mv88w8618_pic_state, (obj), TYPE_MV88W8618_PIC)
+
+typedef struct mv88w8618_pic_state {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t level;
     uint32_t enabled;
@@ -737,8 +743,7 @@ static void mv88w8618_pic_write(void *opaque, hwaddr offset,
 
 static void mv88w8618_pic_reset(DeviceState *d)
 {
-    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state,
-                                         SYS_BUS_DEVICE(d));
+    mv88w8618_pic_state *s = MV88W8618_PIC(d);
 
     s->level = 0;
     s->enabled = 0;
@@ -752,9 +757,9 @@ static const MemoryRegionOps mv88w8618_pic_ops = {
 
 static int mv88w8618_pic_init(SysBusDevice *dev)
 {
-    mv88w8618_pic_state *s = FROM_SYSBUS(mv88w8618_pic_state, dev);
+    mv88w8618_pic_state *s = MV88W8618_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, mv88w8618_pic_set_irq, 32);
+    qdev_init_gpio_in(DEVICE(dev), mv88w8618_pic_set_irq, 32);
     sysbus_init_irq(dev, &s->parent_irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_pic_ops, s,
                           "musicpal-pic", MP_PIC_SIZE);
@@ -785,7 +790,7 @@ static void mv88w8618_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_pic_info = {
-    .name          = "mv88w8618_pic",
+    .name          = TYPE_MV88W8618_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_pic_state),
     .class_init    = mv88w8618_pic_class_init,
@@ -1588,7 +1593,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple("mv88w8618_pic", MP_PIC_BASE,
+    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                cpu_pic[ARM_PIC_CPU_IRQ]);
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
commit 2cca58fdc28fb860827a9f0bae1cd736df76cfa0
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:16:13 2013 +0200

    musicpal: QOM cast cleanup for musicpal_lcd_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 760630b..0bc69e9 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -462,8 +462,15 @@ static const TypeInfo mv88w8618_eth_info = {
 
 #define MP_LCD_TEXTCOLOR        0xe0e0ff /* RRGGBB */
 
+#define TYPE_MUSICPAL_LCD "musicpal_lcd"
+#define MUSICPAL_LCD(obj) \
+    OBJECT_CHECK(musicpal_lcd_state, (obj), TYPE_MUSICPAL_LCD)
+
 typedef struct musicpal_lcd_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t brightness;
     uint32_t mode;
@@ -614,20 +621,21 @@ static const GraphicHwOps musicpal_gfx_ops = {
     .gfx_update  = lcd_refresh,
 };
 
-static int musicpal_lcd_init(SysBusDevice *dev)
+static int musicpal_lcd_init(SysBusDevice *sbd)
 {
-    musicpal_lcd_state *s = FROM_SYSBUS(musicpal_lcd_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    musicpal_lcd_state *s = MUSICPAL_LCD(dev);
 
     s->brightness = 7;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &musicpal_lcd_ops, s,
                           "musicpal-lcd", MP_LCD_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    s->con = graphic_console_init(DEVICE(dev), &musicpal_gfx_ops, s);
+    s->con = graphic_console_init(dev, &musicpal_gfx_ops, s);
     qemu_console_resize(s->con, 128*3, 64*3);
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brightness_in, 3);
+    qdev_init_gpio_in(dev, musicpal_lcd_gpio_brightness_in, 3);
 
     return 0;
 }
@@ -658,7 +666,7 @@ static void musicpal_lcd_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo musicpal_lcd_info = {
-    .name          = "musicpal_lcd",
+    .name          = TYPE_MUSICPAL_LCD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(musicpal_lcd_state),
     .class_init    = musicpal_lcd_class_init,
@@ -1649,7 +1657,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (i2c_bus *)qdev_get_child_bus(i2c_dev, "i2c");
 
-    lcd_dev = sysbus_create_simple("musicpal_lcd", MP_LCD_BASE, NULL);
+    lcd_dev = sysbus_create_simple(TYPE_MUSICPAL_LCD, MP_LCD_BASE, NULL);
     key_dev = sysbus_create_simple("musicpal_key", -1, NULL);
 
     /* I2C read data */
commit a77d90e68a6a277f53bf9051c8fbc2b0d0cff1c1
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:12:52 2013 +0200

    musicpal: QOM cast cleanup for mv88w8618_eth_state
    
    Introduce type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index ddddd27..760630b 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -146,8 +146,15 @@ typedef struct mv88w8618_rx_desc {
     uint32_t next;
 } mv88w8618_rx_desc;
 
+#define TYPE_MV88W8618_ETH "mv88w8618_eth"
+#define MV88W8618_ETH(obj) \
+    OBJECT_CHECK(mv88w8618_eth_state, (obj), TYPE_MV88W8618_ETH)
+
 typedef struct mv88w8618_eth_state {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t smir;
@@ -382,16 +389,17 @@ static NetClientInfo net_mv88w8618_info = {
     .cleanup = eth_cleanup,
 };
 
-static int mv88w8618_eth_init(SysBusDevice *dev)
+static int mv88w8618_eth_init(SysBusDevice *sbd)
 {
-    mv88w8618_eth_state *s = FROM_SYSBUS(mv88w8618_eth_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mv88w8618_eth_state *s = MV88W8618_ETH(dev);
 
-    sysbus_init_irq(dev, &s->irq);
+    sysbus_init_irq(sbd, &s->irq);
     s->nic = qemu_new_nic(&net_mv88w8618_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+                          object_get_typename(OBJECT(dev)), dev->id, s);
     memory_region_init_io(&s->iomem, OBJECT(s), &mv88w8618_eth_ops, s,
                           "mv88w8618-eth", MP_ETH_SIZE);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -429,7 +437,7 @@ static void mv88w8618_eth_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_eth_info = {
-    .name          = "mv88w8618_eth",
+    .name          = TYPE_MV88W8618_ETH,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_eth_state),
     .class_init    = mv88w8618_eth_class_init,
@@ -1627,7 +1635,7 @@ static void musicpal_init(QEMUMachineInitArgs *args)
     sysbus_create_simple("mv88w8618_flashcfg", MP_FLASHCFG_BASE, NULL);
 
     qemu_check_nic_model(&nd_table[0], "mv88w8618");
-    dev = qdev_create(NULL, "mv88w8618_eth");
+    dev = qdev_create(NULL, TYPE_MV88W8618_ETH);
     qdev_set_nic_properties(dev, &nd_table[0]);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
commit 2c79fed33be49cb13c9ce01a6fc42240ee7dedc8
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Jul 28 07:54:55 2013 +0200

    musicpal: Fix typo in name of local function
    
    The misspelling was spotted by Andreas Färber.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Jan Kiszka <jan.kiszka at web.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index b06d442..ddddd27 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -534,7 +534,7 @@ static void lcd_invalidate(void *opaque)
 {
 }
 
-static void musicpal_lcd_gpio_brigthness_in(void *opaque, int irq, int level)
+static void musicpal_lcd_gpio_brightness_in(void *opaque, int irq, int level)
 {
     musicpal_lcd_state *s = opaque;
     s->brightness &= ~(1 << irq);
@@ -619,7 +619,7 @@ static int musicpal_lcd_init(SysBusDevice *dev)
     s->con = graphic_console_init(DEVICE(dev), &musicpal_gfx_ops, s);
     qemu_console_resize(s->con, 128*3, 64*3);
 
-    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brigthness_in, 3);
+    qdev_init_gpio_in(&dev->qdev, musicpal_lcd_gpio_brightness_in, 3);
 
     return 0;
 }
commit 91b646264e1c1f37c9ffb3a602ad748b2a6b050c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:08:01 2013 +0200

    integratorcp: QOM cast cleanup for icp_pic_state
    
    Introduce type constant and use QOM cast.
    Fix indentation.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 58f4ed7..d518188 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -271,15 +271,21 @@ static int integratorcm_init(SysBusDevice *dev)
 /* Integrator/CP hardware emulation.  */
 /* Primary interrupt controller.  */
 
-typedef struct icp_pic_state
-{
-  SysBusDevice busdev;
-  MemoryRegion iomem;
-  uint32_t level;
-  uint32_t irq_enabled;
-  uint32_t fiq_enabled;
-  qemu_irq parent_irq;
-  qemu_irq parent_fiq;
+#define TYPE_INTEGRATOR_PIC "integrator_pic"
+#define INTEGRATOR_PIC(obj) \
+   OBJECT_CHECK(icp_pic_state, (obj), TYPE_INTEGRATOR_PIC)
+
+typedef struct icp_pic_state {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    MemoryRegion iomem;
+    uint32_t level;
+    uint32_t irq_enabled;
+    uint32_t fiq_enabled;
+    qemu_irq parent_irq;
+    qemu_irq parent_fiq;
 } icp_pic_state;
 
 static void icp_pic_update(icp_pic_state *s)
@@ -374,16 +380,17 @@ static const MemoryRegionOps icp_pic_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int icp_pic_init(SysBusDevice *dev)
+static int icp_pic_init(SysBusDevice *sbd)
 {
-    icp_pic_state *s = FROM_SYSBUS(icp_pic_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    icp_pic_state *s = INTEGRATOR_PIC(dev);
 
-    qdev_init_gpio_in(&dev->qdev, icp_pic_set_irq, 32);
-    sysbus_init_irq(dev, &s->parent_irq);
-    sysbus_init_irq(dev, &s->parent_fiq);
+    qdev_init_gpio_in(dev, icp_pic_set_irq, 32);
+    sysbus_init_irq(sbd, &s->parent_irq);
+    sysbus_init_irq(sbd, &s->parent_fiq);
     memory_region_init_io(&s->iomem, OBJECT(s), &icp_pic_ops, s,
                           "icp-pic", 0x00800000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
     return 0;
 }
 
@@ -487,13 +494,13 @@ static void integratorcp_init(QEMUMachineInitArgs *args)
     sysbus_mmio_map((SysBusDevice *)dev, 0, 0x10000000);
 
     cpu_pic = arm_pic_init_cpu(cpu);
-    dev = sysbus_create_varargs("integrator_pic", 0x14000000,
+    dev = sysbus_create_varargs(TYPE_INTEGRATOR_PIC, 0x14000000,
                                 cpu_pic[ARM_PIC_CPU_IRQ],
                                 cpu_pic[ARM_PIC_CPU_FIQ], NULL);
     for (i = 0; i < 32; i++) {
         pic[i] = qdev_get_gpio_in(dev, i);
     }
-    sysbus_create_simple("integrator_pic", 0xca000000, pic[26]);
+    sysbus_create_simple(TYPE_INTEGRATOR_PIC, 0xca000000, pic[26]);
     sysbus_create_varargs("integrator_pit", 0x13000000,
                           pic[5], pic[6], pic[7], NULL);
     sysbus_create_simple("pl031", 0x15000000, pic[8]);
@@ -559,7 +566,7 @@ static void icp_pic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo icp_pic_info = {
-    .name          = "integrator_pic",
+    .name          = TYPE_INTEGRATOR_PIC,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(icp_pic_state),
     .class_init    = icp_pic_class_init,
commit 257ec289b297586f45d5ea5ea01adf8672aa6a05
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 01:00:27 2013 +0200

    integratorcp: QOM cast cleanup for integratorcm_state
    
    Rename to IntegratorCMState, introduce type constant and use QOM cast.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index 249a430..58f4ed7 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -15,8 +15,15 @@
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_INTEGRATOR_CM "integrator_core"
+#define INTEGRATOR_CM(obj) \
+    OBJECT_CHECK(IntegratorCMState, (obj), TYPE_INTEGRATOR_CM)
+
+typedef struct IntegratorCMState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t memsz;
     MemoryRegion flash;
@@ -31,7 +38,7 @@ typedef struct {
     uint32_t int_level;
     uint32_t irq_enabled;
     uint32_t fiq_enabled;
-} integratorcm_state;
+} IntegratorCMState;
 
 static uint8_t integrator_spd[128] = {
    128, 8, 4, 11, 9, 1, 64, 0,  2, 0xa0, 0xa0, 0, 0, 8, 0, 1,
@@ -41,7 +48,7 @@ static uint8_t integrator_spd[128] = {
 static uint64_t integratorcm_read(void *opaque, hwaddr offset,
                                   unsigned size)
 {
-    integratorcm_state *s = (integratorcm_state *)opaque;
+    IntegratorCMState *s = opaque;
     if (offset >= 0x100 && offset < 0x200) {
         /* CM_SPD */
         if (offset >= 0x180)
@@ -108,7 +115,7 @@ static uint64_t integratorcm_read(void *opaque, hwaddr offset,
     }
 }
 
-static void integratorcm_do_remap(integratorcm_state *s)
+static void integratorcm_do_remap(IntegratorCMState *s)
 {
     /* Sync memory region state with CM_CTRL REMAP bit:
      * bit 0 => flash at address 0; bit 1 => RAM
@@ -116,7 +123,7 @@ static void integratorcm_do_remap(integratorcm_state *s)
     memory_region_set_enabled(&s->flash, !(s->cm_ctrl & 4));
 }
 
-static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
+static void integratorcm_set_ctrl(IntegratorCMState *s, uint32_t value)
 {
     if (value & 8) {
         qemu_system_reset_request();
@@ -133,7 +140,7 @@ static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
     integratorcm_do_remap(s);
 }
 
-static void integratorcm_update(integratorcm_state *s)
+static void integratorcm_update(IntegratorCMState *s)
 {
     /* ??? The CPU irq/fiq is raised when either the core module or base PIC
        are active.  */
@@ -144,7 +151,7 @@ static void integratorcm_update(integratorcm_state *s)
 static void integratorcm_write(void *opaque, hwaddr offset,
                                uint64_t value, unsigned size)
 {
-    integratorcm_state *s = (integratorcm_state *)opaque;
+    IntegratorCMState *s = opaque;
     switch (offset >> 2) {
     case 2: /* CM_OSC */
         if (s->cm_lock == 0xa05f)
@@ -226,7 +233,7 @@ static const MemoryRegionOps integratorcm_ops = {
 
 static int integratorcm_init(SysBusDevice *dev)
 {
-    integratorcm_state *s = FROM_SYSBUS(integratorcm_state, dev);
+    IntegratorCMState *s = INTEGRATOR_CM(dev);
 
     s->cm_osc = 0x01000048;
     /* ??? What should the high bits of this value be?  */
@@ -474,7 +481,7 @@ static void integratorcp_init(QEMUMachineInitArgs *args)
     memory_region_init_alias(ram_alias, NULL, "ram.alias", ram, 0, ram_size);
     memory_region_add_subregion(address_space_mem, 0x80000000, ram_alias);
 
-    dev = qdev_create(NULL, "integrator_core");
+    dev = qdev_create(NULL, TYPE_INTEGRATOR_CM);
     qdev_prop_set_uint32(dev, "memsz", ram_size >> 20);
     qdev_init_nofail(dev);
     sysbus_mmio_map((SysBusDevice *)dev, 0, 0x10000000);
@@ -524,7 +531,7 @@ static void integratorcp_machine_init(void)
 machine_init(integratorcp_machine_init);
 
 static Property core_properties[] = {
-    DEFINE_PROP_UINT32("memsz", integratorcm_state, memsz, 0),
+    DEFINE_PROP_UINT32("memsz", IntegratorCMState, memsz, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -538,9 +545,9 @@ static void core_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo core_info = {
-    .name          = "integrator_core",
+    .name          = TYPE_INTEGRATOR_CM,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(integratorcm_state),
+    .instance_size = sizeof(IntegratorCMState),
     .class_init    = core_class_init,
 };
 
commit 426533faed4338f228c715fbec21a887692ad47c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 00:52:40 2013 +0200

    highbank: QOM cast cleanup for HighbankRegsState
    
    Add type constant and use QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index be264d3..35d5511 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -116,8 +116,15 @@ static const MemoryRegionOps hb_mem_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+#define TYPE_HIGHBANK_REGISTERS "highbank-regs"
+#define HIGHBANK_REGISTERS(obj) \
+    OBJECT_CHECK(HighbankRegsState, (obj), TYPE_HIGHBANK_REGISTERS)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion *iomem;
     uint32_t regs[NUM_REGS];
 } HighbankRegsState;
@@ -135,8 +142,7 @@ static VMStateDescription vmstate_highbank_regs = {
 
 static void highbank_regs_reset(DeviceState *dev)
 {
-    SysBusDevice *sys_dev = SYS_BUS_DEVICE(dev);
-    HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, sys_dev);
+    HighbankRegsState *s = HIGHBANK_REGISTERS(dev);
 
     s->regs[0x40] = 0x05F20121;
     s->regs[0x41] = 0x2;
@@ -146,7 +152,7 @@ static void highbank_regs_reset(DeviceState *dev)
 
 static int highbank_regs_init(SysBusDevice *dev)
 {
-    HighbankRegsState *s = FROM_SYSBUS(HighbankRegsState, dev);
+    HighbankRegsState *s = HIGHBANK_REGISTERS(dev);
 
     s->iomem = g_new(MemoryRegion, 1);
     memory_region_init_io(s->iomem, OBJECT(s), &hb_mem_ops, s->regs,
@@ -168,7 +174,7 @@ static void highbank_regs_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo highbank_regs_info = {
-    .name          = "highbank-regs",
+    .name          = TYPE_HIGHBANK_REGISTERS,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(HighbankRegsState),
     .class_init    = highbank_regs_class_init,
commit 936230a713208659c664da20287fcb5e5811743a
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 00:46:43 2013 +0200

    armv7m: QOM cast cleanup for BitBandState
    
    Introduce TYPE_* constant and use QOM cast.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 5b22e84..82d36fb 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -114,15 +114,21 @@ static const MemoryRegionOps bitband_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+#define TYPE_BITBAND "ARM,bitband-memory"
+#define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     MemoryRegion iomem;
     uint32_t base;
 } BitBandState;
 
 static int bitband_init(SysBusDevice *dev)
 {
-    BitBandState *s = FROM_SYSBUS(BitBandState, dev);
+    BitBandState *s = BITBAND(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &bitband_ops, &s->base,
                           "bitband", 0x02000000);
@@ -134,12 +140,12 @@ static void armv7m_bitband_init(void)
 {
     DeviceState *dev;
 
-    dev = qdev_create(NULL, "ARM,bitband-memory");
+    dev = qdev_create(NULL, TYPE_BITBAND);
     qdev_prop_set_uint32(dev, "base", 0x20000000);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x22000000);
 
-    dev = qdev_create(NULL, "ARM,bitband-memory");
+    dev = qdev_create(NULL, TYPE_BITBAND);
     qdev_prop_set_uint32(dev, "base", 0x40000000);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0x42000000);
@@ -270,7 +276,7 @@ static void bitband_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo bitband_info = {
-    .name          = "ARM,bitband-memory",
+    .name          = TYPE_BITBAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(BitBandState),
     .class_init    = bitband_class_init,
commit bcb34c7a61bce00136d42442c592011e56d87161
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 21:50:54 2013 +0200

    imx_ccm: QOM cast cleanup
    
    Introduce type constant and use QOM casts.
    
    Acked-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index 816d5e8..63e33a4 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -29,8 +29,12 @@ do { printf("imx_ccm: " fmt , ##args); } while (0)
 
 static int imx_ccm_post_load(void *opaque, int version_id);
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_CCM "imx_ccm"
+#define IMX_CCM(obj) OBJECT_CHECK(IMXCCMState, (obj), TYPE_IMX_CCM)
+
+typedef struct IMXCCMState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
 
     uint32_t ccmr;
@@ -108,7 +112,7 @@ static const VMStateDescription vmstate_imx_ccm = {
 
 uint32_t imx_clock_frequency(DeviceState *dev, IMXClk clock)
 {
-    IMXCCMState *s = container_of(dev, IMXCCMState, busdev.qdev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     switch (clock) {
     case NOCLK:
@@ -178,7 +182,7 @@ static void update_clocks(IMXCCMState *s)
 
 static void imx_ccm_reset(DeviceState *dev)
 {
-    IMXCCMState *s = container_of(dev, IMXCCMState, busdev.qdev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     s->ccmr = 0x074b0b7b;
     s->pdr0 = 0xff870b48;
@@ -279,7 +283,7 @@ static const struct MemoryRegionOps imx_ccm_ops = {
 
 static int imx_ccm_init(SysBusDevice *dev)
 {
-    IMXCCMState *s = FROM_SYSBUS(typeof(*s), dev);
+    IMXCCMState *s = IMX_CCM(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &imx_ccm_ops, s,
                           "imx_ccm", 0x1000);
@@ -308,7 +312,7 @@ static void imx_ccm_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_ccm_info = {
-    .name = "imx_ccm",
+    .name = TYPE_IMX_CCM,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXCCMState),
     .class_init = imx_ccm_class_init,
commit 5ff94a61c461111e25b67c7b9cabef035aa30225
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 26 19:31:08 2013 +0200

    imx_avic: QOM cast cleanup
    
    Introduce type constant, use QOM casts and prepare SysBus initfn for QOM
    realize by resolving SysBusDevice vs. DeviceState "dev" name conflict.
    
    Acked-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/intc/imx_avic.c b/hw/intc/imx_avic.c
index 75c8ffd..fb00e91 100644
--- a/hw/intc/imx_avic.c
+++ b/hw/intc/imx_avic.c
@@ -55,8 +55,13 @@ do { printf("imx_avic: " fmt , ##args); } while (0)
 #define PRIO_PER_WORD (sizeof(uint32_t) * 8 / 4)
 #define PRIO_WORDS (IMX_AVIC_NUM_IRQS/PRIO_PER_WORD)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_IMX_AVIC "imx_avic"
+#define IMX_AVIC(obj) \
+    OBJECT_CHECK(IMXAVICState, (obj), TYPE_IMX_AVIC)
+
+typedef struct IMXAVICState {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint64_t pending;
     uint64_t enabled;
@@ -359,7 +364,8 @@ static const MemoryRegionOps imx_avic_ops = {
 
 static void imx_avic_reset(DeviceState *dev)
 {
-    IMXAVICState *s = container_of(dev, IMXAVICState, busdev.qdev);
+    IMXAVICState *s = IMX_AVIC(dev);
+
     s->pending = 0;
     s->enabled = 0;
     s->is_fiq = 0;
@@ -368,17 +374,18 @@ static void imx_avic_reset(DeviceState *dev)
     memset(s->prio, 0, sizeof s->prio);
 }
 
-static int imx_avic_init(SysBusDevice *dev)
+static int imx_avic_init(SysBusDevice *sbd)
 {
-    IMXAVICState *s = FROM_SYSBUS(IMXAVICState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    IMXAVICState *s = IMX_AVIC(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_avic_ops, s,
                           "imx_avic", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
+    sysbus_init_mmio(sbd, &s->iomem);
 
-    qdev_init_gpio_in(&dev->qdev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_irq(dev, &s->fiq);
+    qdev_init_gpio_in(dev, imx_avic_set_irq, IMX_AVIC_NUM_IRQS);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->fiq);
 
     return 0;
 }
@@ -395,7 +402,7 @@ static void imx_avic_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo imx_avic_info = {
-    .name = "imx_avic",
+    .name = TYPE_IMX_AVIC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IMXAVICState),
     .class_init = imx_avic_class_init,
commit 01774ddbcf42c9521fa66679f947eb49327b8e18
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 01:13:54 2013 +0200

    tcx: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 9fd48b5..24876d3 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -34,8 +34,12 @@
 #define TCX_THC_NREGS_24 0x1000
 #define TCX_TEC_NREGS    0x1000
 
+#define TYPE_TCX "SUNW,tcx"
+#define TCX(obj) OBJECT_CHECK(TCXState, (obj), TYPE_TCX)
+
 typedef struct TCXState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     QemuConsole *con;
     uint8_t *vram;
     uint32_t *vram24, *cplane;
@@ -423,7 +427,7 @@ static const VMStateDescription vmstate_tcx = {
 
 static void tcx_reset(DeviceState *d)
 {
-    TCXState *s = container_of(d, TCXState, busdev.qdev);
+    TCXState *s = TCX(d);
 
     /* Initialize palette */
     memset(s->r, 0, 256);
@@ -523,7 +527,7 @@ static const GraphicHwOps tcx24_ops = {
 
 static int tcx_init1(SysBusDevice *dev)
 {
-    TCXState *s = FROM_SYSBUS(TCXState, dev);
+    TCXState *s = TCX(dev);
     ram_addr_t vram_offset = 0;
     int size;
     uint8_t *vram_base;
@@ -609,7 +613,7 @@ static void tcx_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo tcx_info = {
-    .name          = "SUNW,tcx",
+    .name          = TYPE_TCX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(TCXState),
     .class_init    = tcx_class_init,
commit 5d7a11e438f78a2656000a8d549f0dea412f3dc5
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 01:09:03 2013 +0200

    pl110: QOM'ify pl110, pl110_versatile and pl111
    
    Let pl110_versatile and pl111 inherit from pl110 and use PL110() cast;
    set their version index in an instance_init.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Set version PL110 explicitly, suggested by Hu Tao; fixed inheritence]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 1e36258..e79ab4b 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -39,8 +39,12 @@ enum pl110_version
     PL111
 };
 
+#define TYPE_PL110 "pl110"
+#define PL110(obj) OBJECT_CHECK(PL110State, (obj), TYPE_PL110)
+
 typedef struct PL110State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QemuConsole *con;
 
@@ -129,6 +133,7 @@ static int pl110_enabled(PL110State *s)
 static void pl110_update_display(void *opaque)
 {
     PL110State *s = (PL110State *)opaque;
+    SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
     drawfn* fntable;
     drawfn fn;
@@ -138,8 +143,11 @@ static void pl110_update_display(void *opaque)
     int first;
     int last;
 
-    if (!pl110_enabled(s))
+    if (!pl110_enabled(s)) {
         return;
+    }
+
+    sbd = SYS_BUS_DEVICE(s);
 
     switch (surface_bits_per_pixel(surface)) {
     case 0:
@@ -232,7 +240,7 @@ static void pl110_update_display(void *opaque)
     }
     dest_width *= s->cols;
     first = 0;
-    framebuffer_update_display(surface, sysbus_address_space(&s->busdev),
+    framebuffer_update_display(surface, sysbus_address_space(sbd),
                                s->upbase, s->cols, s->rows,
                                src_width, dest_width, 0,
                                s->invalidate,
@@ -449,30 +457,38 @@ static const GraphicHwOps pl110_gfx_ops = {
     .gfx_update  = pl110_update_display,
 };
 
-static int pl110_init(SysBusDevice *dev)
+static int pl110_initfn(SysBusDevice *sbd)
 {
-    PL110State *s = FROM_SYSBUS(PL110State, dev);
+    DeviceState *dev = DEVICE(sbd);
+    PL110State *s = PL110(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
-    sysbus_init_mmio(dev, &s->iomem);
-    sysbus_init_irq(dev, &s->irq);
-    qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);
-    s->con = graphic_console_init(DEVICE(dev), &pl110_gfx_ops, s);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
+    s->con = graphic_console_init(dev, &pl110_gfx_ops, s);
     return 0;
 }
 
-static int pl110_versatile_init(SysBusDevice *dev)
+static void pl110_init(Object *obj)
+{
+    PL110State *s = PL110(obj);
+
+    s->version = PL110;
+}
+
+static void pl110_versatile_init(Object *obj)
 {
-    PL110State *s = FROM_SYSBUS(PL110State, dev);
+    PL110State *s = PL110(obj);
+
     s->version = PL110_VERSATILE;
-    return pl110_init(dev);
 }
 
-static int pl111_init(SysBusDevice *dev)
+static void pl111_init(Object *obj)
 {
-    PL110State *s = FROM_SYSBUS(PL110State, dev);
+    PL110State *s = PL110(obj);
+
     s->version = PL111;
-    return pl110_init(dev);
 }
 
 static void pl110_class_init(ObjectClass *klass, void *data)
@@ -480,53 +496,30 @@ static void pl110_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = pl110_init;
+    k->init = pl110_initfn;
     set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
 
 static const TypeInfo pl110_info = {
-    .name          = "pl110",
+    .name          = TYPE_PL110,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL110State),
+    .instance_init = pl110_init,
     .class_init    = pl110_class_init,
 };
 
-static void pl110_versatile_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl110_versatile_init;
-    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl110;
-}
-
 static const TypeInfo pl110_versatile_info = {
     .name          = "pl110_versatile",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL110State),
-    .class_init    = pl110_versatile_class_init,
+    .parent        = TYPE_PL110,
+    .instance_init = pl110_versatile_init,
 };
 
-static void pl111_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
-
-    k->init = pl111_init;
-    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
-    dc->no_user = 1;
-    dc->vmsd = &vmstate_pl110;
-}
-
 static const TypeInfo pl111_info = {
     .name          = "pl111",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PL110State),
-    .class_init    = pl111_class_init,
+    .parent        = TYPE_PL110,
+    .instance_init = pl111_init,
 };
 
 static void pl110_register_types(void)
commit 513960eaae0f33616e2f59d3b887b4d810763866
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:57:23 2013 +0200

    pl110: Rename pl110_state to PL110State
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 31993a7..1e36258 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -39,7 +39,7 @@ enum pl110_version
     PL111
 };
 
-typedef struct {
+typedef struct PL110State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     QemuConsole *con;
@@ -59,7 +59,7 @@ typedef struct {
     uint32_t palette[256];
     uint32_t raw_palette[128];
     qemu_irq irq;
-} pl110_state;
+} PL110State;
 
 static int vmstate_pl110_post_load(void *opaque, int version_id);
 
@@ -69,20 +69,20 @@ static const VMStateDescription vmstate_pl110 = {
     .minimum_version_id = 1,
     .post_load = vmstate_pl110_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_INT32(version, pl110_state),
-        VMSTATE_UINT32_ARRAY(timing, pl110_state, 4),
-        VMSTATE_UINT32(cr, pl110_state),
-        VMSTATE_UINT32(upbase, pl110_state),
-        VMSTATE_UINT32(lpbase, pl110_state),
-        VMSTATE_UINT32(int_status, pl110_state),
-        VMSTATE_UINT32(int_mask, pl110_state),
-        VMSTATE_INT32(cols, pl110_state),
-        VMSTATE_INT32(rows, pl110_state),
-        VMSTATE_UINT32(bpp, pl110_state),
-        VMSTATE_INT32(invalidate, pl110_state),
-        VMSTATE_UINT32_ARRAY(palette, pl110_state, 256),
-        VMSTATE_UINT32_ARRAY(raw_palette, pl110_state, 128),
-        VMSTATE_UINT32_V(mux_ctrl, pl110_state, 2),
+        VMSTATE_INT32(version, PL110State),
+        VMSTATE_UINT32_ARRAY(timing, PL110State, 4),
+        VMSTATE_UINT32(cr, PL110State),
+        VMSTATE_UINT32(upbase, PL110State),
+        VMSTATE_UINT32(lpbase, PL110State),
+        VMSTATE_UINT32(int_status, PL110State),
+        VMSTATE_UINT32(int_mask, PL110State),
+        VMSTATE_INT32(cols, PL110State),
+        VMSTATE_INT32(rows, PL110State),
+        VMSTATE_UINT32(bpp, PL110State),
+        VMSTATE_INT32(invalidate, PL110State),
+        VMSTATE_UINT32_ARRAY(palette, PL110State, 256),
+        VMSTATE_UINT32_ARRAY(raw_palette, PL110State, 128),
+        VMSTATE_UINT32_V(mux_ctrl, PL110State, 2),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -121,14 +121,14 @@ static const unsigned char *idregs[] = {
 #define BITS 32
 #include "pl110_template.h"
 
-static int pl110_enabled(pl110_state *s)
+static int pl110_enabled(PL110State *s)
 {
   return (s->cr & PL110_CR_EN) && (s->cr & PL110_CR_PWR);
 }
 
 static void pl110_update_display(void *opaque)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     DisplaySurface *surface = qemu_console_surface(s->con);
     drawfn* fntable;
     drawfn fn;
@@ -246,14 +246,14 @@ static void pl110_update_display(void *opaque)
 
 static void pl110_invalidate_display(void * opaque)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     s->invalidate = 1;
     if (pl110_enabled(s)) {
         qemu_console_resize(s->con, s->cols, s->rows);
     }
 }
 
-static void pl110_update_palette(pl110_state *s, int n)
+static void pl110_update_palette(PL110State *s, int n)
 {
     DisplaySurface *surface = qemu_console_surface(s->con);
     int i;
@@ -289,7 +289,7 @@ static void pl110_update_palette(pl110_state *s, int n)
     }
 }
 
-static void pl110_resize(pl110_state *s, int width, int height)
+static void pl110_resize(PL110State *s, int width, int height)
 {
     if (width != s->cols || height != s->rows) {
         if (pl110_enabled(s)) {
@@ -301,7 +301,7 @@ static void pl110_resize(pl110_state *s, int width, int height)
 }
 
 /* Update interrupts.  */
-static void pl110_update(pl110_state *s)
+static void pl110_update(PL110State *s)
 {
   /* TODO: Implement interrupts.  */
 }
@@ -309,7 +309,7 @@ static void pl110_update(pl110_state *s)
 static uint64_t pl110_read(void *opaque, hwaddr offset,
                            unsigned size)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
 
     if (offset >= 0xfe0 && offset < 0x1000) {
         return idregs[s->version][(offset - 0xfe0) >> 2];
@@ -359,7 +359,7 @@ static uint64_t pl110_read(void *opaque, hwaddr offset,
 static void pl110_write(void *opaque, hwaddr offset,
                         uint64_t val, unsigned size)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     int n;
 
     /* For simplicity invalidate the display whenever a control register
@@ -432,13 +432,13 @@ static const MemoryRegionOps pl110_ops = {
 
 static void pl110_mux_ctrl_set(void *opaque, int line, int level)
 {
-    pl110_state *s = (pl110_state *)opaque;
+    PL110State *s = (PL110State *)opaque;
     s->mux_ctrl = level;
 }
 
 static int vmstate_pl110_post_load(void *opaque, int version_id)
 {
-    pl110_state *s = opaque;
+    PL110State *s = opaque;
     /* Make sure we redraw, and at the right size */
     pl110_invalidate_display(s);
     return 0;
@@ -451,7 +451,7 @@ static const GraphicHwOps pl110_gfx_ops = {
 
 static int pl110_init(SysBusDevice *dev)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = FROM_SYSBUS(PL110State, dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
     sysbus_init_mmio(dev, &s->iomem);
@@ -463,14 +463,14 @@ static int pl110_init(SysBusDevice *dev)
 
 static int pl110_versatile_init(SysBusDevice *dev)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = FROM_SYSBUS(PL110State, dev);
     s->version = PL110_VERSATILE;
     return pl110_init(dev);
 }
 
 static int pl111_init(SysBusDevice *dev)
 {
-    pl110_state *s = FROM_SYSBUS(pl110_state, dev);
+    PL110State *s = FROM_SYSBUS(PL110State, dev);
     s->version = PL111;
     return pl110_init(dev);
 }
@@ -489,7 +489,7 @@ static void pl110_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl110_info = {
     .name          = "pl110",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
     .class_init    = pl110_class_init,
 };
 
@@ -507,7 +507,7 @@ static void pl110_versatile_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl110_versatile_info = {
     .name          = "pl110_versatile",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
     .class_init    = pl110_versatile_class_init,
 };
 
@@ -525,7 +525,7 @@ static void pl111_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl111_info = {
     .name          = "pl111",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl110_state),
+    .instance_size = sizeof(PL110State),
     .class_init    = pl111_class_init,
 };
 
commit 54df97bb0c625114ac8c7d8e236fbb7a2456e334
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:53:39 2013 +0200

    milkymist-vgafb: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/milkymist-vgafb.c b/hw/display/milkymist-vgafb.c
index 870b339..5150cb4 100644
--- a/hw/display/milkymist-vgafb.c
+++ b/hw/display/milkymist-vgafb.c
@@ -63,8 +63,13 @@ enum {
     CTRL_RESET = (1<<0),
 };
 
+#define TYPE_MILKYMIST_VGAFB "milkymist-vgafb"
+#define MILKYMIST_VGAFB(obj) \
+    OBJECT_CHECK(MilkymistVgafbState, (obj), TYPE_MILKYMIST_VGAFB)
+
 struct MilkymistVgafbState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     QemuConsole *con;
 
@@ -84,6 +89,7 @@ static int vgafb_enabled(MilkymistVgafbState *s)
 static void vgafb_update_display(void *opaque)
 {
     MilkymistVgafbState *s = opaque;
+    SysBusDevice *sbd;
     DisplaySurface *surface = qemu_console_surface(s->con);
     int first = 0;
     int last = 0;
@@ -93,6 +99,7 @@ static void vgafb_update_display(void *opaque)
         return;
     }
 
+    sbd = SYS_BUS_DEVICE(s);
     int dest_width = s->regs[R_HRES];
 
     switch (surface_bits_per_pixel(surface)) {
@@ -122,7 +129,7 @@ static void vgafb_update_display(void *opaque)
         break;
     }
 
-    framebuffer_update_display(surface, sysbus_address_space(&s->busdev),
+    framebuffer_update_display(surface, sysbus_address_space(sbd),
                                s->regs[R_BASEADDRESS] + s->fb_offset,
                                s->regs[R_HRES],
                                s->regs[R_VRES],
@@ -256,7 +263,7 @@ static const MemoryRegionOps vgafb_mmio_ops = {
 
 static void milkymist_vgafb_reset(DeviceState *d)
 {
-    MilkymistVgafbState *s = container_of(d, MilkymistVgafbState, busdev.qdev);
+    MilkymistVgafbState *s = MILKYMIST_VGAFB(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -277,7 +284,7 @@ static const GraphicHwOps vgafb_ops = {
 
 static int milkymist_vgafb_init(SysBusDevice *dev)
 {
-    MilkymistVgafbState *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistVgafbState *s = MILKYMIST_VGAFB(dev);
 
     memory_region_init_io(&s->regs_region, OBJECT(s), &vgafb_mmio_ops, s,
             "milkymist-vgafb", R_MAX * 4);
@@ -324,7 +331,7 @@ static void milkymist_vgafb_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_vgafb_info = {
-    .name          = "milkymist-vgafb",
+    .name          = TYPE_MILKYMIST_VGAFB,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistVgafbState),
     .class_init    = milkymist_vgafb_class_init,
commit 56299135f5c32a8b606e4b62af9200a3cee65985
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:48:23 2013 +0200

    milkymist-tmu2: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/milkymist-tmu2.c b/hw/display/milkymist-tmu2.c
index efda082..b2a5fba 100644
--- a/hw/display/milkymist-tmu2.c
+++ b/hw/display/milkymist-tmu2.c
@@ -75,8 +75,13 @@ struct vertex {
     int y;
 } QEMU_PACKED;
 
+#define TYPE_MILKYMIST_TMU2 "milkymist-tmu2"
+#define MILKYMIST_TMU2(obj) \
+    OBJECT_CHECK(MilkymistTMU2State, (obj), TYPE_MILKYMIST_TMU2)
+
 struct MilkymistTMU2State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
     CharDriverState *chr;
     qemu_irq irq;
@@ -429,7 +434,7 @@ static const MemoryRegionOps tmu2_mmio_ops = {
 
 static void milkymist_tmu2_reset(DeviceState *d)
 {
-    MilkymistTMU2State *s = container_of(d, MilkymistTMU2State, busdev.qdev);
+    MilkymistTMU2State *s = MILKYMIST_TMU2(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -439,7 +444,7 @@ static void milkymist_tmu2_reset(DeviceState *d)
 
 static int milkymist_tmu2_init(SysBusDevice *dev)
 {
-    MilkymistTMU2State *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistTMU2State *s = MILKYMIST_TMU2(dev);
 
     if (tmu2_glx_init(s)) {
         return 1;
@@ -476,7 +481,7 @@ static void milkymist_tmu2_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_tmu2_info = {
-    .name          = "milkymist-tmu2",
+    .name          = TYPE_MILKYMIST_TMU2,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistTMU2State),
     .class_init    = milkymist_tmu2_class_init,
commit 66c2de562f504895eeb407a04dddd4c76ab70c50
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:35:51 2013 +0200

    jazz_led: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/jazz_led.c b/hw/display/jazz_led.c
index 7f82037..8407e6c 100644
--- a/hw/display/jazz_led.c
+++ b/hw/display/jazz_led.c
@@ -32,8 +32,12 @@ typedef enum {
     REDRAW_NONE = 0, REDRAW_SEGMENTS = 1, REDRAW_BACKGROUND = 2,
 } screen_state_t;
 
+#define TYPE_JAZZ_LED "jazz-led"
+#define JAZZ_LED(obj) OBJECT_CHECK(LedState, (obj), TYPE_JAZZ_LED)
+
 typedef struct LedState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint8_t segments;
     QemuConsole *con;
@@ -262,7 +266,7 @@ static const GraphicHwOps jazz_led_ops = {
 
 static int jazz_led_init(SysBusDevice *dev)
 {
-    LedState *s = FROM_SYSBUS(LedState, dev);
+    LedState *s = JAZZ_LED(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &led_ops, s, "led", 1);
     sysbus_init_mmio(dev, &s->iomem);
@@ -274,7 +278,7 @@ static int jazz_led_init(SysBusDevice *dev)
 
 static void jazz_led_reset(DeviceState *d)
 {
-    LedState *s = DO_UPCAST(LedState, busdev.qdev, d);
+    LedState *s = JAZZ_LED(d);
 
     s->segments = 0;
     s->state = REDRAW_SEGMENTS | REDRAW_BACKGROUND;
@@ -293,7 +297,7 @@ static void jazz_led_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo jazz_led_info = {
-    .name          = "jazz-led",
+    .name          = TYPE_JAZZ_LED,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LedState),
     .class_init    = jazz_led_class_init,
commit 0f31aa86255e97295b4d81e3d03a527974746d63
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:30:30 2013 +0200

    g364fb: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field and
    prepare for QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 2d3e912..7082171 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -493,26 +493,33 @@ static void g364fb_init(DeviceState *dev, G364State *s)
     memory_region_set_coalescing(&s->mem_vram);
 }
 
+#define TYPE_G364 "sysbus-g364"
+#define G364(obj) OBJECT_CHECK(G364SysBusState, (obj), TYPE_G364)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     G364State g364;
 } G364SysBusState;
 
-static int g364fb_sysbus_init(SysBusDevice *dev)
+static int g364fb_sysbus_init(SysBusDevice *sbd)
 {
-    G364State *s = &FROM_SYSBUS(G364SysBusState, dev)->g364;
+    DeviceState *dev = DEVICE(sbd);
+    G364SysBusState *sbs = G364(dev);
+    G364State *s = &sbs->g364;
 
-    g364fb_init(&dev->qdev, s);
-    sysbus_init_irq(dev, &s->irq);
-    sysbus_init_mmio(dev, &s->mem_ctrl);
-    sysbus_init_mmio(dev, &s->mem_vram);
+    g364fb_init(dev, s);
+    sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_mmio(sbd, &s->mem_ctrl);
+    sysbus_init_mmio(sbd, &s->mem_vram);
 
     return 0;
 }
 
 static void g364fb_sysbus_reset(DeviceState *d)
 {
-    G364SysBusState *s = DO_UPCAST(G364SysBusState, busdev.qdev, d);
+    G364SysBusState *s = G364(d);
+
     g364fb_reset(&s->g364);
 }
 
@@ -536,7 +543,7 @@ static void g364fb_sysbus_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo g364fb_sysbus_info = {
-    .name          = "sysbus-g364",
+    .name          = TYPE_G364,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(G364SysBusState),
     .class_init    = g364fb_sysbus_class_init,
commit f27321aa3a4368c1dbdd03f7e7629572c0fe18b3
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:24:50 2013 +0200

    exynos4210_fimd: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index eb168ea..65cca1d 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -292,8 +292,13 @@ struct Exynos4210fimdWindow {
     hwaddr fb_len;       /* Framebuffer length */
 };
 
+#define TYPE_EXYNOS4210_FIMD "exynos4210.fimd"
+#define EXYNOS4210_FIMD(obj) \
+    OBJECT_CHECK(Exynos4210fimdState, (obj), TYPE_EXYNOS4210_FIMD)
+
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     QemuConsole *console;
     qemu_irq irq[3];
@@ -1108,6 +1113,7 @@ static inline int fimd_get_buffer_id(Exynos4210fimdWindow *w)
  * VIDOSDA, VIDOSDB, VIDWADDx and SHADOWCON registers */
 static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     Exynos4210fimdWindow *w = &s->window[win];
     hwaddr fb_start_addr, fb_mapped_len;
 
@@ -1131,8 +1137,8 @@ static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
      * does not support hot-unplug.
      */
     memory_region_unref(w->mem_section.mr);
-    w->mem_section = memory_region_find(sysbus_address_space(&s->busdev),
-            fb_start_addr, w->fb_len);
+    w->mem_section = memory_region_find(sysbus_address_space(sbd),
+                                        fb_start_addr, w->fb_len);
     assert(w->mem_section.mr);
     assert(w->mem_section.offset_within_address_space == fb_start_addr);
     DPRINT_TRACE("Window %u framebuffer changed: address=0x%08x, len=0x%x\n",
@@ -1328,7 +1334,7 @@ static void exynos4210_fimd_update(void *opaque)
 
 static void exynos4210_fimd_reset(DeviceState *d)
 {
-    Exynos4210fimdState *s = DO_UPCAST(Exynos4210fimdState, busdev.qdev, d);
+    Exynos4210fimdState *s = EXYNOS4210_FIMD(d);
     unsigned w;
 
     DPRINT_TRACE("Display controller reset\n");
@@ -1900,7 +1906,7 @@ static const GraphicHwOps exynos4210_fimd_ops = {
 
 static int exynos4210_fimd_init(SysBusDevice *dev)
 {
-    Exynos4210fimdState *s = FROM_SYSBUS(Exynos4210fimdState, dev);
+    Exynos4210fimdState *s = EXYNOS4210_FIMD(dev);
 
     s->ifb = NULL;
 
@@ -1927,7 +1933,7 @@ static void exynos4210_fimd_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo exynos4210_fimd_info = {
-    .name = "exynos4210.fimd",
+    .name = TYPE_EXYNOS4210_FIMD,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Exynos4210fimdState),
     .class_init = exynos4210_fimd_class_init,
commit af073cd9de7fa120129815cf4d2ba64156571347
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:44:48 2013 +0200

    onenand: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field and
    prepare for QOM realize.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 2776f64..aae9ee7 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -34,8 +34,12 @@
 /* Fixed */
 #define BLOCK_SHIFT	(PAGE_SHIFT + 6)
 
-typedef struct {
-    SysBusDevice busdev;
+#define TYPE_ONE_NAND "onenand"
+#define ONE_NAND(obj) OBJECT_CHECK(OneNANDState, (obj), TYPE_ONE_NAND)
+
+typedef struct OneNANDState {
+    SysBusDevice parent_obj;
+
     struct {
         uint16_t man;
         uint16_t dev;
@@ -226,7 +230,9 @@ static void onenand_reset(OneNANDState *s, int cold)
 
 static void onenand_system_reset(DeviceState *dev)
 {
-    onenand_reset(FROM_SYSBUS(OneNANDState, SYS_BUS_DEVICE(dev)), 1);
+    OneNANDState *s = ONE_NAND(dev);
+
+    onenand_reset(s, 1);
 }
 
 static inline int onenand_load_main(OneNANDState *s, int sec, int secn,
@@ -757,11 +763,13 @@ static const MemoryRegionOps onenand_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static int onenand_initfn(SysBusDevice *dev)
+static int onenand_initfn(SysBusDevice *sbd)
 {
-    OneNANDState *s = (OneNANDState *)dev;
+    DeviceState *dev = DEVICE(sbd);
+    OneNANDState *s = ONE_NAND(dev);
     uint32_t size = 1 << (24 + ((s->id.dev >> 4) & 7));
     void *ram;
+
     s->base = (hwaddr)-1;
     s->rdy = NULL;
     s->blocks = size >> BLOCK_SHIFT;
@@ -794,9 +802,9 @@ static int onenand_initfn(SysBusDevice *dev)
     s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
     s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);
     onenand_mem_setup(s);
-    sysbus_init_irq(dev, &s->intr);
-    sysbus_init_mmio(dev, &s->container);
-    vmstate_register(&dev->qdev,
+    sysbus_init_irq(sbd, &s->intr);
+    sysbus_init_mmio(sbd, &s->container);
+    vmstate_register(dev,
                      ((s->shift & 0x7f) << 24)
                      | ((s->id.man & 0xff) << 16)
                      | ((s->id.dev & 0xff) << 8)
@@ -825,7 +833,7 @@ static void onenand_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo onenand_info = {
-    .name          = "onenand",
+    .name          = TYPE_ONE_NAND,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(OneNANDState),
     .class_init    = onenand_class_init,
@@ -838,7 +846,9 @@ static void onenand_register_types(void)
 
 void *onenand_raw_otp(DeviceState *onenand_device)
 {
-    return FROM_SYSBUS(OneNANDState, SYS_BUS_DEVICE(onenand_device))->otp;
+    OneNANDState *s = ONE_NAND(onenand_device);
+
+    return s->otp;
 }
 
 type_init(onenand_register_types)
commit b354f03c5c044beeb758935890b7e48c70e2ff9d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:19:32 2013 +0200

    pl041: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index c4d4f75..5393b52 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -70,8 +70,12 @@ typedef struct {
     uint8_t rx_sample_size;
 } pl041_channel;
 
+#define TYPE_PL041 "pl041"
+#define PL041(obj) OBJECT_CHECK(PL041State, (obj), TYPE_PL041)
+
 typedef struct PL041State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
 
@@ -504,7 +508,7 @@ static void pl041_write(void *opaque, hwaddr offset,
 
 static void pl041_device_reset(DeviceState *d)
 {
-    PL041State *s = DO_UPCAST(PL041State, busdev.qdev, d);
+    PL041State *s = PL041(d);
 
     pl041_reset(s);
 }
@@ -517,7 +521,7 @@ static const MemoryRegionOps pl041_ops = {
 
 static int pl041_init(SysBusDevice *dev)
 {
-    PL041State *s = FROM_SYSBUS(PL041State, dev);
+    PL041State *s = PL041(dev);
 
     DBG_L1("pl041_init 0x%08x\n", (uint32_t)s);
 
@@ -635,7 +639,7 @@ static void pl041_device_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pl041_device_info = {
-    .name          = "pl041",
+    .name          = TYPE_PL041,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PL041State),
     .class_init    = pl041_device_class_init,
commit baae672597b90e364131241ec3a03730fe774052
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 19:45:52 2013 +0200

    pl041: Rename pl041_state to PL041State
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    [AF: Split off renaming from QOM cast changes]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index b66d6d2..c4d4f75 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -70,7 +70,7 @@ typedef struct {
     uint8_t rx_sample_size;
 } pl041_channel;
 
-typedef struct {
+typedef struct PL041State {
     SysBusDevice busdev;
     MemoryRegion iomem;
     qemu_irq irq;
@@ -80,7 +80,7 @@ typedef struct {
     pl041_regfile regs;
     pl041_channel fifo1;
     lm4549_state codec;
-} pl041_state;
+} PL041State;
 
 
 static const unsigned char pl041_default_id[8] = {
@@ -107,7 +107,7 @@ static const char *get_reg_name(hwaddr offset)
 }
 #endif
 
-static uint8_t pl041_compute_periphid3(pl041_state *s)
+static uint8_t pl041_compute_periphid3(PL041State *s)
 {
     uint8_t id3 = 1; /* One channel */
 
@@ -142,7 +142,7 @@ static uint8_t pl041_compute_periphid3(pl041_state *s)
     return id3;
 }
 
-static void pl041_reset(pl041_state *s)
+static void pl041_reset(PL041State *s)
 {
     DBG_L1("pl041_reset\n");
 
@@ -156,7 +156,7 @@ static void pl041_reset(pl041_state *s)
 }
 
 
-static void pl041_fifo1_write(pl041_state *s, uint32_t value)
+static void pl041_fifo1_write(PL041State *s, uint32_t value)
 {
     pl041_channel *channel = &s->fifo1;
     pl041_fifo *fifo = &s->fifo1.tx_fifo;
@@ -239,7 +239,7 @@ static void pl041_fifo1_write(pl041_state *s, uint32_t value)
     DBG_L2("fifo1_push sr1 = 0x%08x\n", s->regs.sr1);
 }
 
-static void pl041_fifo1_transmit(pl041_state *s)
+static void pl041_fifo1_transmit(PL041State *s)
 {
     pl041_channel *channel = &s->fifo1;
     pl041_fifo *fifo = &s->fifo1.tx_fifo;
@@ -291,7 +291,7 @@ static void pl041_fifo1_transmit(pl041_state *s)
     }
 }
 
-static void pl041_isr1_update(pl041_state *s)
+static void pl041_isr1_update(PL041State *s)
 {
     /* Update ISR1 */
     if (s->regs.sr1 & TXUNDERRUN) {
@@ -320,7 +320,7 @@ static void pl041_isr1_update(pl041_state *s)
 
 static void pl041_request_data(void *opaque)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
 
     /* Trigger pending transfers */
     pl041_fifo1_transmit(s);
@@ -330,7 +330,7 @@ static void pl041_request_data(void *opaque)
 static uint64_t pl041_read(void *opaque, hwaddr offset,
                                 unsigned size)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
     int value;
 
     if ((offset >= PL041_periphid0) && (offset <= PL041_pcellid3)) {
@@ -364,7 +364,7 @@ static uint64_t pl041_read(void *opaque, hwaddr offset,
 static void pl041_write(void *opaque, hwaddr offset,
                              uint64_t value, unsigned size)
 {
-    pl041_state *s = (pl041_state *)opaque;
+    PL041State *s = (PL041State *)opaque;
     uint16_t control, data;
     uint32_t result;
 
@@ -504,7 +504,7 @@ static void pl041_write(void *opaque, hwaddr offset,
 
 static void pl041_device_reset(DeviceState *d)
 {
-    pl041_state *s = DO_UPCAST(pl041_state, busdev.qdev, d);
+    PL041State *s = DO_UPCAST(PL041State, busdev.qdev, d);
 
     pl041_reset(s);
 }
@@ -517,7 +517,7 @@ static const MemoryRegionOps pl041_ops = {
 
 static int pl041_init(SysBusDevice *dev)
 {
-    pl041_state *s = FROM_SYSBUS(pl041_state, dev);
+    PL041State *s = FROM_SYSBUS(PL041State, dev);
 
     DBG_L1("pl041_init 0x%08x\n", (uint32_t)s);
 
@@ -603,12 +603,12 @@ static const VMStateDescription vmstate_pl041 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(fifo_depth, pl041_state),
-        VMSTATE_STRUCT(regs, pl041_state, 0,
+        VMSTATE_UINT32(fifo_depth, PL041State),
+        VMSTATE_STRUCT(regs, PL041State, 0,
                        vmstate_pl041_regfile, pl041_regfile),
-        VMSTATE_STRUCT(fifo1, pl041_state, 0,
+        VMSTATE_STRUCT(fifo1, PL041State, 0,
                        vmstate_pl041_channel, pl041_channel),
-        VMSTATE_STRUCT(codec, pl041_state, 0,
+        VMSTATE_STRUCT(codec, PL041State, 0,
                        vmstate_lm4549_state, lm4549_state),
         VMSTATE_END_OF_LIST()
     }
@@ -616,7 +616,8 @@ static const VMStateDescription vmstate_pl041 = {
 
 static Property pl041_device_properties[] = {
     /* Non-compact FIFO depth property */
-    DEFINE_PROP_UINT32("nc_fifo_depth", pl041_state, fifo_depth, DEFAULT_FIFO_DEPTH),
+    DEFINE_PROP_UINT32("nc_fifo_depth", PL041State, fifo_depth,
+                       DEFAULT_FIFO_DEPTH),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -636,7 +637,7 @@ static void pl041_device_class_init(ObjectClass *klass, void *data)
 static const TypeInfo pl041_device_info = {
     .name          = "pl041",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(pl041_state),
+    .instance_size = sizeof(PL041State),
     .class_init    = pl041_device_class_init,
 };
 
commit 922cc6010e09ed5b976b2e60228b3d6fb09aa3a5
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:15:29 2013 +0200

    milkymist-ac97: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/milkymist-ac97.c b/hw/audio/milkymist-ac97.c
index 133de4e..9c0f7a0 100644
--- a/hw/audio/milkymist-ac97.c
+++ b/hw/audio/milkymist-ac97.c
@@ -51,8 +51,13 @@ enum {
     CTRL_EN = (1<<0),
 };
 
+#define TYPE_MILKYMIST_AC97 "milkymist-ac97"
+#define MILKYMIST_AC97(obj) \
+    OBJECT_CHECK(MilkymistAC97State, (obj), TYPE_MILKYMIST_AC97)
+
 struct MilkymistAC97State {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion regs_region;
 
     QEMUSoundCard card;
@@ -258,7 +263,7 @@ static void ac97_out_cb(void *opaque, int free_b)
 
 static void milkymist_ac97_reset(DeviceState *d)
 {
-    MilkymistAC97State *s = container_of(d, MilkymistAC97State, busdev.qdev);
+    MilkymistAC97State *s = MILKYMIST_AC97(d);
     int i;
 
     for (i = 0; i < R_MAX; i++) {
@@ -280,7 +285,7 @@ static int ac97_post_load(void *opaque, int version_id)
 
 static int milkymist_ac97_init(SysBusDevice *dev)
 {
-    MilkymistAC97State *s = FROM_SYSBUS(typeof(*s), dev);
+    MilkymistAC97State *s = MILKYMIST_AC97(dev);
 
     struct audsettings as;
     sysbus_init_irq(dev, &s->crrequest_irq);
@@ -330,7 +335,7 @@ static void milkymist_ac97_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo milkymist_ac97_info = {
-    .name          = "milkymist-ac97",
+    .name          = TYPE_MILKYMIST_AC97,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistAC97State),
     .class_init    = milkymist_ac97_class_init,
commit 9e3f8599fc9b3a408fdaaa5a38d6bc328c08c4bb
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:10:44 2013 +0200

    audio/marvell_88w8618: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index b40ea43..97194ce 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -36,8 +36,13 @@
 #define MP_AUDIO_CLOCK_24MHZ    (1 << 9)
 #define MP_AUDIO_MONO           (1 << 14)
 
+#define TYPE_MV88W8618_AUDIO "mv88w8618_audio"
+#define MV88W8618_AUDIO(obj) \
+    OBJECT_CHECK(mv88w8618_audio_state, (obj), TYPE_MV88W8618_AUDIO)
+
 typedef struct mv88w8618_audio_state {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t playback_mode;
@@ -219,8 +224,7 @@ static void mv88w8618_audio_write(void *opaque, hwaddr offset,
 
 static void mv88w8618_audio_reset(DeviceState *d)
 {
-    mv88w8618_audio_state *s = FROM_SYSBUS(mv88w8618_audio_state,
-                                           SYS_BUS_DEVICE(d));
+    mv88w8618_audio_state *s = MV88W8618_AUDIO(d);
 
     s->playback_mode = 0;
     s->status = 0;
@@ -238,7 +242,7 @@ static const MemoryRegionOps mv88w8618_audio_ops = {
 
 static int mv88w8618_audio_init(SysBusDevice *dev)
 {
-    mv88w8618_audio_state *s = FROM_SYSBUS(mv88w8618_audio_state, dev);
+    mv88w8618_audio_state *s = MV88W8618_AUDIO(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -287,7 +291,7 @@ static void mv88w8618_audio_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mv88w8618_audio_info = {
-    .name          = "mv88w8618_audio",
+    .name          = TYPE_MV88W8618_AUDIO,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mv88w8618_audio_state),
     .class_init    = mv88w8618_audio_class_init,
commit f9e741903982e55c0dc138ab2e61059a4f3c9a76
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 10:04:31 2013 +0200

    cs4231: QOM cast cleanup
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/audio/cs4231.c b/hw/audio/cs4231.c
index fabe9e6..d19195a 100644
--- a/hw/audio/cs4231.c
+++ b/hw/audio/cs4231.c
@@ -33,8 +33,13 @@
 #define CS_DREGS 32
 #define CS_MAXDREG (CS_DREGS - 1)
 
+#define TYPE_CS4231 "SUNW,CS4231"
+#define CS4231(obj) \
+    OBJECT_CHECK(CSState, (obj), TYPE_CS4231)
+
 typedef struct CSState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     qemu_irq irq;
     uint32_t regs[CS_REGS];
@@ -47,7 +52,7 @@ typedef struct CSState {
 
 static void cs_reset(DeviceState *d)
 {
-    CSState *s = container_of(d, CSState, busdev.qdev);
+    CSState *s = CS4231(d);
 
     memset(s->regs, 0, CS_REGS * 4);
     memset(s->dregs, 0, CS_DREGS);
@@ -111,7 +116,7 @@ static void cs_mem_write(void *opaque, hwaddr addr,
         break;
     case 4:
         if (val & 1) {
-            cs_reset(&s->busdev.qdev);
+            cs_reset(DEVICE(s));
         }
         val &= 0x7f;
         s->regs[saddr] = val;
@@ -142,7 +147,7 @@ static const VMStateDescription vmstate_cs4231 = {
 
 static int cs4231_init1(SysBusDevice *dev)
 {
-    CSState *s = FROM_SYSBUS(CSState, dev);
+    CSState *s = CS4231(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &cs_mem_ops, s, "cs4321",
                           CS_SIZE);
@@ -168,7 +173,7 @@ static void cs4231_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo cs4231_info = {
-    .name          = "SUNW,CS4231",
+    .name          = TYPE_CS4231,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(CSState),
     .class_init    = cs4231_class_init,
commit 24bf6c1f2a0ab42e4f183a10b9e9cfe468a840b3
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:37:28 2013 +0200

    xilinx_uartlite: QOM cast cleanups
    
    Introduce type constant and use QOM casts.
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 929743c..b0d1d04 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -46,8 +46,13 @@
 #define CONTROL_RST_RX    0x02
 #define CONTROL_IE        0x10
 
+#define TYPE_XILINX_UARTLITE "xlnx.xps-uartlite"
+#define XILINX_UARTLITE(obj) \
+    OBJECT_CHECK(XilinxUARTLite, (obj), TYPE_XILINX_UARTLITE)
+
 typedef struct XilinxUARTLite {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     CharDriverState *chr;
     qemu_irq irq;
@@ -193,7 +198,7 @@ static void uart_event(void *opaque, int event)
 
 static int xilinx_uartlite_init(SysBusDevice *dev)
 {
-    XilinxUARTLite *s = FROM_SYSBUS(typeof (*s), dev);
+    XilinxUARTLite *s = XILINX_UARTLITE(dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -216,7 +221,7 @@ static void xilinx_uartlite_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo xilinx_uartlite_info = {
-    .name          = "xlnx.xps-uartlite",
+    .name          = TYPE_XILINX_UARTLITE,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(XilinxUARTLite),
     .class_init    = xilinx_uartlite_class_init,
commit 144712ca149f49b24e27b537d05943ee8ac9e22b
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:34:25 2013 +0200

    xilinx_uartlite: Rename xlx_uartlite to XilinxUARTLite
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index feca497..929743c 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -46,8 +46,7 @@
 #define CONTROL_RST_RX    0x02
 #define CONTROL_IE        0x10
 
-struct xlx_uartlite
-{
+typedef struct XilinxUARTLite {
     SysBusDevice busdev;
     MemoryRegion mmio;
     CharDriverState *chr;
@@ -58,9 +57,9 @@ struct xlx_uartlite
     unsigned int rx_fifo_len;
 
     uint32_t regs[R_MAX];
-};
+} XilinxUARTLite;
 
-static void uart_update_irq(struct xlx_uartlite *s)
+static void uart_update_irq(XilinxUARTLite *s)
 {
     unsigned int irq;
 
@@ -71,7 +70,7 @@ static void uart_update_irq(struct xlx_uartlite *s)
     qemu_set_irq(s->irq, irq);
 }
 
-static void uart_update_status(struct xlx_uartlite *s)
+static void uart_update_status(XilinxUARTLite *s)
 {
     uint32_t r;
 
@@ -86,7 +85,7 @@ static void uart_update_status(struct xlx_uartlite *s)
 static uint64_t
 uart_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
     uint32_t r = 0;
     addr >>= 2;
     switch (addr)
@@ -113,7 +112,7 @@ static void
 uart_write(void *opaque, hwaddr addr,
            uint64_t val64, unsigned int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
     uint32_t value = val64;
     unsigned char ch = value;
 
@@ -164,7 +163,7 @@ static const MemoryRegionOps uart_ops = {
 
 static void uart_rx(void *opaque, const uint8_t *buf, int size)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
 
     /* Got a byte.  */
     if (s->rx_fifo_len >= 8) {
@@ -182,7 +181,7 @@ static void uart_rx(void *opaque, const uint8_t *buf, int size)
 
 static int uart_can_rx(void *opaque)
 {
-    struct xlx_uartlite *s = opaque;
+    XilinxUARTLite *s = opaque;
 
     return s->rx_fifo_len < sizeof(s->rx_fifo);
 }
@@ -194,7 +193,7 @@ static void uart_event(void *opaque, int event)
 
 static int xilinx_uartlite_init(SysBusDevice *dev)
 {
-    struct xlx_uartlite *s = FROM_SYSBUS(typeof (*s), dev);
+    XilinxUARTLite *s = FROM_SYSBUS(typeof (*s), dev);
 
     sysbus_init_irq(dev, &s->irq);
 
@@ -219,7 +218,7 @@ static void xilinx_uartlite_class_init(ObjectClass *klass, void *data)
 static const TypeInfo xilinx_uartlite_info = {
     .name          = "xlnx.xps-uartlite",
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof (struct xlx_uartlite),
+    .instance_size = sizeof(XilinxUARTLite),
     .class_init    = xilinx_uartlite_class_init,
 };
 
commit b85423fe756e52b373c58c328bb59790ca081ec8
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 21:52:26 2013 +0200

    etraxfs_ser: QOM cast cleanups
    
    Rename etrax_serial to ETRAXSerial, introduce type constant and use QOM
    casts.
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/char/etraxfs_ser.c b/hw/char/etraxfs_ser.c
index d19af00..460094e 100644
--- a/hw/char/etraxfs_ser.c
+++ b/hw/char/etraxfs_ser.c
@@ -44,9 +44,13 @@
 #define STAT_TR_IDLE 22
 #define STAT_TR_RDY  24
 
-struct etrax_serial
-{
-    SysBusDevice busdev;
+#define TYPE_ETRAX_FS_SERIAL "etraxfs,serial"
+#define ETRAX_SERIAL(obj) \
+    OBJECT_CHECK(ETRAXSerial, (obj), TYPE_ETRAX_FS_SERIAL)
+
+typedef struct ETRAXSerial {
+    SysBusDevice parent_obj;
+
     MemoryRegion mmio;
     CharDriverState *chr;
     qemu_irq irq;
@@ -59,9 +63,9 @@ struct etrax_serial
 
     /* Control registers.  */
     uint32_t regs[R_MAX];
-};
+} ETRAXSerial;
 
-static void ser_update_irq(struct etrax_serial *s)
+static void ser_update_irq(ETRAXSerial *s)
 {
 
     if (s->rx_fifo_len) {
@@ -77,7 +81,7 @@ static void ser_update_irq(struct etrax_serial *s)
 static uint64_t
 ser_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     uint32_t r = 0;
 
     addr >>= 2;
@@ -112,7 +116,7 @@ static void
 ser_write(void *opaque, hwaddr addr,
           uint64_t val64, unsigned int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     uint32_t value = val64;
     unsigned char ch = val64;
 
@@ -156,7 +160,7 @@ static const MemoryRegionOps ser_ops = {
 
 static void serial_receive(void *opaque, const uint8_t *buf, int size)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     int i;
 
     /* Got a byte.  */
@@ -177,7 +181,7 @@ static void serial_receive(void *opaque, const uint8_t *buf, int size)
 
 static int serial_can_receive(void *opaque)
 {
-    struct etrax_serial *s = opaque;
+    ETRAXSerial *s = opaque;
     int r;
 
     /* Is the receiver enabled?  */
@@ -196,7 +200,7 @@ static void serial_event(void *opaque, int event)
 
 static void etraxfs_ser_reset(DeviceState *d)
 {
-    struct etrax_serial *s = container_of(d, typeof(*s), busdev.qdev);
+    ETRAXSerial *s = ETRAX_SERIAL(d);
 
     /* transmitter begins ready and idle.  */
     s->regs[RS_STAT_DIN] |= (1 << STAT_TR_RDY);
@@ -208,7 +212,7 @@ static void etraxfs_ser_reset(DeviceState *d)
 
 static int etraxfs_ser_init(SysBusDevice *dev)
 {
-    struct etrax_serial *s = FROM_SYSBUS(typeof (*s), dev);
+    ETRAXSerial *s = ETRAX_SERIAL(dev);
 
     sysbus_init_irq(dev, &s->irq);
     memory_region_init_io(&s->mmio, OBJECT(s), &ser_ops, s,
@@ -216,10 +220,11 @@ static int etraxfs_ser_init(SysBusDevice *dev)
     sysbus_init_mmio(dev, &s->mmio);
 
     s->chr = qemu_char_get_next_serial();
-    if (s->chr)
+    if (s->chr) {
         qemu_chr_add_handlers(s->chr,
-                      serial_can_receive, serial_receive,
-                      serial_event, s);
+                              serial_can_receive, serial_receive,
+                              serial_event, s);
+    }
     return 0;
 }
 
@@ -233,9 +238,9 @@ static void etraxfs_ser_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo etraxfs_ser_info = {
-    .name          = "etraxfs,serial",
+    .name          = TYPE_ETRAX_FS_SERIAL,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(struct etrax_serial),
+    .instance_size = sizeof(ETRAXSerial),
     .class_init    = etraxfs_ser_class_init,
 };
 
commit bcb7575068581a7589234bdd55e8d9a9351611d9
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 12 19:56:00 2013 +0200

    pcie_port: Turn PCIEPort and PCIESlot into abstract QOM types
    
    Move PCIEPort's "port" property to the new type, same for "aer_log_max".
    Move PCIESlot's "chassis" and "slot" properties to the new type.
    
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index 815bed4..0f7f209 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -92,9 +92,8 @@ static void ioh3420_reset(DeviceState *qdev)
 
 static int ioh3420_initfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIEPort *p = PCIE_PORT(d);
+    PCIESlot *s = PCIE_SLOT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -148,9 +147,7 @@ err_bridge:
 
 static void ioh3420_exitfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIESlot *s = PCIE_SLOT(d);
 
     pcie_aer_exit(d);
     pcie_chassis_del_slot(s);
@@ -180,7 +177,7 @@ PCIESlot *ioh3420_init(PCIBus *bus, int devfn, bool multifunction,
     qdev_prop_set_uint16(qdev, "slot", slot);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIESlot, port, DO_UPCAST(PCIEPort, br, br));
+    return PCIE_SLOT(d);
 }
 
 static const VMStateDescription vmstate_ioh3420 = {
@@ -190,23 +187,13 @@ static const VMStateDescription vmstate_ioh3420 = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
-        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
-                       vmstate_pcie_aer_log, PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(parent_obj.parent_obj.parent_obj.exp.aer_log,
+                       PCIESlot, 0, vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property ioh3420_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIESlot, port.port, 0),
-    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
-    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-                       port.br.parent_obj.exp.aer_log.log_max,
-                       PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void ioh3420_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -224,13 +211,11 @@ static void ioh3420_class_init(ObjectClass *klass, void *data)
     dc->desc = "Intel IOH device id 3420 PCIE Root Port";
     dc->reset = ioh3420_reset;
     dc->vmsd = &vmstate_ioh3420;
-    dc->props = ioh3420_properties;
 }
 
 static const TypeInfo ioh3420_info = {
     .name          = "ioh3420",
-    .parent        = TYPE_PCI_BRIDGE,
-    .instance_size = sizeof(PCIESlot),
+    .parent        = TYPE_PCIE_SLOT,
     .class_init    = ioh3420_class_init,
 };
 
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 227a335..94f9781 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -56,9 +56,8 @@ static void xio3130_downstream_reset(DeviceState *qdev)
 
 static int xio3130_downstream_initfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIEPort *p = PCIE_PORT(d);
+    PCIESlot *s = PCIE_SLOT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -113,9 +112,7 @@ err_bridge:
 
 static void xio3130_downstream_exitfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
-    PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
+    PCIESlot *s = PCIE_SLOT(d);
 
     pcie_aer_exit(d);
     pcie_chassis_del_slot(s);
@@ -147,7 +144,7 @@ PCIESlot *xio3130_downstream_init(PCIBus *bus, int devfn, bool multifunction,
     qdev_prop_set_uint16(qdev, "slot", slot);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIESlot, port, DO_UPCAST(PCIEPort, br, br));
+    return PCIE_SLOT(d);
 }
 
 static const VMStateDescription vmstate_xio3130_downstream = {
@@ -157,23 +154,13 @@ static const VMStateDescription vmstate_xio3130_downstream = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
-        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
-                       vmstate_pcie_aer_log, PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(parent_obj.parent_obj.parent_obj.exp.aer_log,
+                       PCIESlot, 0, vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property xio3130_downstream_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIESlot, port.port, 0),
-    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
-    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-                       port.br.parent_obj.exp.aer_log.log_max,
-                       PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -191,13 +178,11 @@ static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
     dc->desc = "TI X3130 Downstream Port of PCI Express Switch";
     dc->reset = xio3130_downstream_reset;
     dc->vmsd = &vmstate_xio3130_downstream;
-    dc->props = xio3130_downstream_properties;
 }
 
 static const TypeInfo xio3130_downstream_info = {
     .name          = "xio3130-downstream",
-    .parent        = TYPE_PCI_BRIDGE,
-    .instance_size = sizeof(PCIESlot),
+    .parent        = TYPE_PCIE_SLOT,
     .class_init    = xio3130_downstream_class_init,
 };
 
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index b146253..59f97f6 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -53,8 +53,7 @@ static void xio3130_upstream_reset(DeviceState *qdev)
 
 static int xio3130_upstream_initfn(PCIDevice *d)
 {
-    PCIBridge *br = PCI_BRIDGE(d);
-    PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
+    PCIEPort *p = PCIE_PORT(d);
     int rc;
 
     rc = pci_bridge_initfn(d, TYPE_PCIE_BUS);
@@ -125,7 +124,7 @@ PCIEPort *xio3130_upstream_init(PCIBus *bus, int devfn, bool multifunction,
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_init_nofail(qdev);
 
-    return DO_UPCAST(PCIEPort, br, br);
+    return PCIE_PORT(d);
 }
 
 static const VMStateDescription vmstate_xio3130_upstream = {
@@ -134,21 +133,13 @@ static const VMStateDescription vmstate_xio3130_upstream = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(br.parent_obj, PCIEPort),
-        VMSTATE_STRUCT(br.parent_obj.exp.aer_log, PCIEPort, 0,
+        VMSTATE_PCIE_DEVICE(parent_obj.parent_obj, PCIEPort),
+        VMSTATE_STRUCT(parent_obj.parent_obj.exp.aer_log, PCIEPort, 0,
                        vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
-static Property xio3130_upstream_properties[] = {
-    DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
-                       br.parent_obj.exp.aer_log.log_max,
-                       PCIE_AER_LOG_MAX_DEFAULT),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -166,13 +157,11 @@ static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
     dc->desc = "TI X3130 Upstream Port of PCI Express Switch";
     dc->reset = xio3130_upstream_reset;
     dc->vmsd = &vmstate_xio3130_upstream;
-    dc->props = xio3130_upstream_properties;
 }
 
 static const TypeInfo xio3130_upstream_info = {
     .name          = "x3130-upstream",
-    .parent        = TYPE_PCI_BRIDGE,
-    .instance_size = sizeof(PCIEPort),
+    .parent        = TYPE_PCIE_PORT,
     .class_init    = xio3130_upstream_class_init,
 };
 
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index 91b53a0..2adb030 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -116,3 +116,55 @@ void pcie_chassis_del_slot(PCIESlot *s)
 {
     QLIST_REMOVE(s, next);
 }
+
+static Property pcie_port_props[] = {
+    DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
+    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
+                       parent_obj.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void pcie_port_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->props = pcie_port_props;
+}
+
+static const TypeInfo pcie_port_type_info = {
+    .name = TYPE_PCIE_PORT,
+    .parent = TYPE_PCI_BRIDGE,
+    .instance_size = sizeof(PCIEPort),
+    .abstract = true,
+    .class_init = pcie_port_class_init,
+};
+
+static Property pcie_slot_props[] = {
+    DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
+    DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void pcie_slot_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->props = pcie_slot_props;
+}
+
+static const TypeInfo pcie_slot_type_info = {
+    .name = TYPE_PCIE_SLOT,
+    .parent = TYPE_PCIE_PORT,
+    .instance_size = sizeof(PCIESlot),
+    .abstract = true,
+    .class_init = pcie_slot_class_init,
+};
+
+static void pcie_port_register_types(void)
+{
+    type_register_static(&pcie_port_type_info);
+    type_register_static(&pcie_slot_type_info);
+}
+
+type_init(pcie_port_register_types)
diff --git a/include/hw/pci/pcie_port.h b/include/hw/pci/pcie_port.h
index d89aa61..e167bf7 100644
--- a/include/hw/pci/pcie_port.h
+++ b/include/hw/pci/pcie_port.h
@@ -24,8 +24,13 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_bus.h"
 
+#define TYPE_PCIE_PORT "pcie-port"
+#define PCIE_PORT(obj) OBJECT_CHECK(PCIEPort, (obj), TYPE_PCIE_PORT)
+
 struct PCIEPort {
-    PCIBridge   br;
+    /*< private >*/
+    PCIBridge   parent_obj;
+    /*< public >*/
 
     /* pci express switch port */
     uint8_t     port;
@@ -33,8 +38,13 @@ struct PCIEPort {
 
 void pcie_port_init_reg(PCIDevice *d);
 
+#define TYPE_PCIE_SLOT "pcie-slot"
+#define PCIE_SLOT(obj) OBJECT_CHECK(PCIESlot, (obj), TYPE_PCIE_SLOT)
+
 struct PCIESlot {
-    PCIEPort    port;
+    /*< private >*/
+    PCIEPort    parent_obj;
+    /*< public >*/
 
     /* pci express switch port with slot */
     uint8_t     chassis;
commit 5315dc78d089191e6a34a9f9f8913b7f365d504a
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 12 19:21:22 2013 +0200

    pci-bridge/i82801b11: Rename parent field
    
    Rename it to avoid accidental use.
    
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 82e92d8..8a5e426 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -52,7 +52,9 @@
 #define I82801ba_SSVID_SSID     0
 
 typedef struct I82801b11Bridge {
-    PCIBridge br;
+    /*< private >*/
+    PCIBridge parent_obj;
+    /*< public >*/
 } I82801b11Bridge;
 
 static int i82801b11_bridge_initfn(PCIDevice *d)
commit 57524e14cf12cbc148b0a268d93b3e8457a010a3
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jul 12 19:16:46 2013 +0200

    pci-bridge-dev: QOM parent field cleanup
    
    Rename it to avoid accidental use.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index af750c2..a9392c7 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -27,8 +27,15 @@
 #include "exec/memory.h"
 #include "hw/pci/pci_bus.h"
 
+#define TYPE_PCI_BRIDGE_DEV "pci-bridge"
+#define PCI_BRIDGE_DEV(obj) \
+    OBJECT_CHECK(PCIBridgeDev, (obj), TYPE_PCI_BRIDGE_DEV)
+
 struct PCIBridgeDev {
-    PCIBridge bridge;
+    /*< private >*/
+    PCIBridge parent_obj;
+    /*< public >*/
+
     MemoryRegion bar;
     uint8_t chassis_nr;
 #define PCI_BRIDGE_DEV_F_MSI_REQ 0
@@ -39,7 +46,7 @@ typedef struct PCIBridgeDev PCIBridgeDev;
 static int pci_bridge_dev_initfn(PCIDevice *dev)
 {
     PCIBridge *br = PCI_BRIDGE(dev);
-    PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
+    PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
     int err;
 
     err = pci_bridge_initfn(dev, TYPE_PCI_BUS);
@@ -81,8 +88,7 @@ bridge_error:
 
 static void pci_bridge_dev_exitfn(PCIDevice *dev)
 {
-    PCIBridge *br = PCI_BRIDGE(dev);
-    PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
+    PCIBridgeDev *bridge_dev = PCI_BRIDGE_DEV(dev);
     if (msi_present(dev)) {
         msi_uninit(dev);
     }
@@ -104,7 +110,7 @@ static void pci_bridge_dev_write_config(PCIDevice *d,
 
 static void qdev_pci_bridge_dev_reset(DeviceState *qdev)
 {
-    PCIDevice *dev = DO_UPCAST(PCIDevice, qdev, qdev);
+    PCIDevice *dev = PCI_DEVICE(qdev);
 
     pci_bridge_reset(qdev);
     shpc_reset(dev);
@@ -120,8 +126,8 @@ static Property pci_bridge_dev_properties[] = {
 static const VMStateDescription pci_bridge_dev_vmstate = {
     .name = "pci_bridge",
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(bridge.parent_obj, PCIBridgeDev),
-        SHPC_VMSTATE(bridge.parent_obj.shpc, PCIBridgeDev),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIBridge),
+        SHPC_VMSTATE(shpc, PCIDevice),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -145,7 +151,7 @@ static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo pci_bridge_dev_info = {
-    .name = "pci-bridge",
+    .name          = TYPE_PCI_BRIDGE_DEV,
     .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridgeDev),
     .class_init = pci_bridge_dev_class_init,
commit f055e96bd4311d287c0e03faec02a1bdbc351925
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 11 17:13:43 2013 +0200

    pci-bridge: Turn PCIBridge into abstract QOM type
    
    Introduce TYPE_PCI_BRIDGE as base type and use PCI_BRIDGE() casts.
    
    Reviewed-by: Don Koch <dkoch at verizon.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    [AF: Updated pbm-bridge parent to TYPE_PCI_BRIDGE]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pci-bridge/dec.c b/hw/pci-bridge/dec.c
index efc07c4..e5e3be8 100644
--- a/hw/pci-bridge/dec.c
+++ b/hw/pci-bridge/dec.c
@@ -74,7 +74,7 @@ static void dec_21154_pci_bridge_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo dec_21154_pci_bridge_info = {
     .name          = "dec-21154-p2p-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridge),
     .class_init    = dec_21154_pci_bridge_class_init,
 };
@@ -86,7 +86,7 @@ PCIBus *pci_dec_21154_init(PCIBus *parent_bus, int devfn)
 
     dev = pci_create_multifunction(parent_bus, devfn, false,
                                    "dec-21154-p2p-bridge");
-    br = DO_UPCAST(PCIBridge, dev, dev);
+    br = PCI_BRIDGE(dev);
     pci_bridge_map_irq(br, "DEC 21154 PCI-PCI bridge", dec_map_irq);
     qdev_init_nofail(&dev->qdev);
     return pci_bridge_get_sec_bus(br);
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 0e521a8..82e92d8 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -93,7 +93,7 @@ static void i82801b11_bridge_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo i82801b11_bridge_info = {
     .name          = "i82801b11-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(I82801b11Bridge),
     .class_init    = i82801b11_bridge_class_init,
 };
@@ -109,8 +109,8 @@ PCIBus *ich9_d2pbr_init(PCIBus *bus, int devfn, int sec_bus)
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
-    qdev = &br->dev.qdev;
+    br = PCI_BRIDGE(d);
+    qdev = DEVICE(d);
 
     snprintf(buf, sizeof(buf), "pci.%d", sec_bus);
     pci_bridge_map_irq(br, buf, pci_swizzle_map_irq_fn);
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index 47122c5..815bed4 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -92,7 +92,7 @@ static void ioh3420_reset(DeviceState *qdev)
 
 static int ioh3420_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
     int rc;
@@ -148,7 +148,7 @@ err_bridge:
 
 static void ioh3420_exitfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
 
@@ -171,9 +171,9 @@ PCIESlot *ioh3420_init(PCIBus *bus, int devfn, bool multifunction,
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_prop_set_uint8(qdev, "chassis", chassis);
@@ -190,8 +190,8 @@ static const VMStateDescription vmstate_ioh3420 = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.dev, PCIESlot),
-        VMSTATE_STRUCT(port.br.dev.exp.aer_log, PCIESlot, 0,
+        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
                        vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
@@ -202,8 +202,8 @@ static Property ioh3420_properties[] = {
     DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
     DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
     DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-    port.br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
+                       port.br.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -229,7 +229,7 @@ static void ioh3420_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo ioh3420_info = {
     .name          = "ioh3420",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIESlot),
     .class_init    = ioh3420_class_init,
 };
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index a00642c..af750c2 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -38,7 +38,7 @@ typedef struct PCIBridgeDev PCIBridgeDev;
 
 static int pci_bridge_dev_initfn(PCIDevice *dev)
 {
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
     int err;
 
@@ -81,7 +81,7 @@ bridge_error:
 
 static void pci_bridge_dev_exitfn(PCIDevice *dev)
 {
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBridgeDev *bridge_dev = DO_UPCAST(PCIBridgeDev, bridge, br);
     if (msi_present(dev)) {
         msi_uninit(dev);
@@ -120,8 +120,8 @@ static Property pci_bridge_dev_properties[] = {
 static const VMStateDescription pci_bridge_dev_vmstate = {
     .name = "pci_bridge",
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(bridge.dev, PCIBridgeDev),
-        SHPC_VMSTATE(bridge.dev.shpc, PCIBridgeDev),
+        VMSTATE_PCI_DEVICE(bridge.parent_obj, PCIBridgeDev),
+        SHPC_VMSTATE(bridge.parent_obj.shpc, PCIBridgeDev),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -146,7 +146,7 @@ static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo pci_bridge_dev_info = {
     .name = "pci-bridge",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIBridgeDev),
     .class_init = pci_bridge_dev_class_init,
 };
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 33eff37..227a335 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -56,7 +56,7 @@ static void xio3130_downstream_reset(DeviceState *qdev)
 
 static int xio3130_downstream_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
     int rc;
@@ -113,7 +113,7 @@ err_bridge:
 
 static void xio3130_downstream_exitfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     PCIESlot *s = DO_UPCAST(PCIESlot, port, p);
 
@@ -138,9 +138,9 @@ PCIESlot *xio3130_downstream_init(PCIBus *bus, int devfn, bool multifunction,
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_prop_set_uint8(qdev, "chassis", chassis);
@@ -157,8 +157,8 @@ static const VMStateDescription vmstate_xio3130_downstream = {
     .minimum_version_id_old = 1,
     .post_load = pcie_cap_slot_post_load,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(port.br.dev, PCIESlot),
-        VMSTATE_STRUCT(port.br.dev.exp.aer_log, PCIESlot, 0,
+        VMSTATE_PCIE_DEVICE(port.br.parent_obj, PCIESlot),
+        VMSTATE_STRUCT(port.br.parent_obj.exp.aer_log, PCIESlot, 0,
                        vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
@@ -169,8 +169,8 @@ static Property xio3130_downstream_properties[] = {
     DEFINE_PROP_UINT8("chassis", PCIESlot, chassis, 0),
     DEFINE_PROP_UINT16("slot", PCIESlot, slot, 0),
     DEFINE_PROP_UINT16("aer_log_max", PCIESlot,
-    port.br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
+                       port.br.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -196,7 +196,7 @@ static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo xio3130_downstream_info = {
     .name          = "xio3130-downstream",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIESlot),
     .class_init    = xio3130_downstream_class_init,
 };
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index e9969a9..b146253 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -53,7 +53,7 @@ static void xio3130_upstream_reset(DeviceState *qdev)
 
 static int xio3130_upstream_initfn(PCIDevice *d)
 {
-    PCIBridge* br = DO_UPCAST(PCIBridge, dev, d);
+    PCIBridge *br = PCI_BRIDGE(d);
     PCIEPort *p = DO_UPCAST(PCIEPort, br, br);
     int rc;
 
@@ -118,9 +118,9 @@ PCIEPort *xio3130_upstream_init(PCIBus *bus, int devfn, bool multifunction,
     if (!d) {
         return NULL;
     }
-    br = DO_UPCAST(PCIBridge, dev, d);
+    br = PCI_BRIDGE(d);
 
-    qdev = &br->dev.qdev;
+    qdev = DEVICE(d);
     pci_bridge_map_irq(br, bus_name, map_irq);
     qdev_prop_set_uint8(qdev, "port", port);
     qdev_init_nofail(qdev);
@@ -134,17 +134,18 @@ static const VMStateDescription vmstate_xio3130_upstream = {
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PCIE_DEVICE(br.dev, PCIEPort),
-        VMSTATE_STRUCT(br.dev.exp.aer_log, PCIEPort, 0, vmstate_pcie_aer_log,
-                       PCIEAERLog),
+        VMSTATE_PCIE_DEVICE(br.parent_obj, PCIEPort),
+        VMSTATE_STRUCT(br.parent_obj.exp.aer_log, PCIEPort, 0,
+                       vmstate_pcie_aer_log, PCIEAERLog),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static Property xio3130_upstream_properties[] = {
     DEFINE_PROP_UINT8("port", PCIEPort, port, 0),
-    DEFINE_PROP_UINT16("aer_log_max", PCIEPort, br.dev.exp.aer_log.log_max,
-    PCIE_AER_LOG_MAX_DEFAULT),
+    DEFINE_PROP_UINT16("aer_log_max", PCIEPort,
+                       br.parent_obj.exp.aer_log.log_max,
+                       PCIE_AER_LOG_MAX_DEFAULT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -170,7 +171,7 @@ static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo xio3130_upstream_info = {
     .name          = "x3130-upstream",
-    .parent        = TYPE_PCI_DEVICE,
+    .parent        = TYPE_PCI_BRIDGE,
     .instance_size = sizeof(PCIEPort),
     .class_init    = xio3130_upstream_class_init,
 };
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index bef7be1..92f289f 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -423,7 +423,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
     /* APB secondary busses */
     pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 0), true,
                                    "pbm-bridge");
-    br = DO_UPCAST(PCIBridge, dev, pci_dev);
+    br = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 1",
                        pci_apb_map_irq);
     qdev_init_nofail(&pci_dev->qdev);
@@ -431,7 +431,7 @@ PCIBus *pci_apb_init(hwaddr special_base,
 
     pci_dev = pci_create_multifunction(phb->bus, PCI_DEVFN(1, 1), true,
                                    "pbm-bridge");
-    br = DO_UPCAST(PCIBridge, dev, pci_dev);
+    br = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(br, "Advanced PCI Bus secondary bridge 2",
                        pci_apb_map_irq);
     qdev_init_nofail(&pci_dev->qdev);
@@ -566,8 +566,7 @@ static void pbm_pci_bridge_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo pbm_pci_bridge_info = {
     .name          = "pbm-bridge",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIBridge),
+    .parent        = TYPE_PCI_BRIDGE,
     .class_init    = pbm_pci_bridge_class_init,
 };
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 81cf5a9..4c004f5 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -397,7 +397,7 @@ static int get_pci_config_device(QEMUFile *f, void *pv, size_t size)
 
     pci_update_mappings(s);
     if (pc->is_bridge) {
-        PCIBridge *b = container_of(s, PCIBridge, dev);
+        PCIBridge *b = PCI_BRIDGE(s);
         pci_bridge_update_mappings(b);
     }
 
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 02a396b..a90671d 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -141,8 +141,9 @@ static void pci_bridge_init_alias(PCIBridge *bridge, MemoryRegion *alias,
                                   MemoryRegion *parent_space,
                                   bool enabled)
 {
-    pcibus_t base = pci_bridge_get_base(&bridge->dev, type);
-    pcibus_t limit = pci_bridge_get_limit(&bridge->dev, type);
+    PCIDevice *bridge_dev = PCI_DEVICE(bridge);
+    pcibus_t base = pci_bridge_get_base(bridge_dev, type);
+    pcibus_t limit = pci_bridge_get_limit(bridge_dev, type);
     /* TODO: this doesn't handle base = 0 limit = 2^64 - 1 correctly.
      * Apparently no way to do this with existing memory APIs. */
     pcibus_t size = enabled && limit >= base ? limit + 1 - base : 0;
@@ -154,7 +155,8 @@ static void pci_bridge_init_alias(PCIBridge *bridge, MemoryRegion *alias,
 static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
                                         MemoryRegion *alias_vga)
 {
-    uint16_t brctl = pci_get_word(br->dev.config + PCI_BRIDGE_CONTROL);
+    PCIDevice *pd = PCI_DEVICE(br);
+    uint16_t brctl = pci_get_word(pd->config + PCI_BRIDGE_CONTROL);
 
     memory_region_init_alias(&alias_vga[QEMU_PCI_VGA_IO_LO], OBJECT(br),
                              "pci_bridge_vga_io_lo", &br->address_space_io,
@@ -167,7 +169,7 @@ static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
                              QEMU_PCI_VGA_MEM_BASE, QEMU_PCI_VGA_MEM_SIZE);
 
     if (brctl & PCI_BRIDGE_CTL_VGA) {
-        pci_register_vga(&br->dev, &alias_vga[QEMU_PCI_VGA_MEM],
+        pci_register_vga(pd, &alias_vga[QEMU_PCI_VGA_MEM],
                          &alias_vga[QEMU_PCI_VGA_IO_LO],
                          &alias_vga[QEMU_PCI_VGA_IO_HI]);
     }
@@ -175,9 +177,10 @@ static void pci_bridge_init_vga_aliases(PCIBridge *br, PCIBus *parent,
 
 static PCIBridgeWindows *pci_bridge_region_init(PCIBridge *br)
 {
-    PCIBus *parent = br->dev.bus;
+    PCIDevice *pd = PCI_DEVICE(br);
+    PCIBus *parent = pd->bus;
     PCIBridgeWindows *w = g_new(PCIBridgeWindows, 1);
-    uint16_t cmd = pci_get_word(br->dev.config + PCI_COMMAND);
+    uint16_t cmd = pci_get_word(pd->config + PCI_COMMAND);
 
     pci_bridge_init_alias(br, &w->alias_pref_mem,
                           PCI_BASE_ADDRESS_MEM_PREFETCH,
@@ -205,12 +208,13 @@ static PCIBridgeWindows *pci_bridge_region_init(PCIBridge *br)
 
 static void pci_bridge_region_del(PCIBridge *br, PCIBridgeWindows *w)
 {
-    PCIBus *parent = br->dev.bus;
+    PCIDevice *pd = PCI_DEVICE(br);
+    PCIBus *parent = pd->bus;
 
     memory_region_del_subregion(parent->address_space_io, &w->alias_io);
     memory_region_del_subregion(parent->address_space_mem, &w->alias_mem);
     memory_region_del_subregion(parent->address_space_mem, &w->alias_pref_mem);
-    pci_unregister_vga(&br->dev);
+    pci_unregister_vga(pd);
 }
 
 static void pci_bridge_region_cleanup(PCIBridge *br, PCIBridgeWindows *w)
@@ -241,7 +245,7 @@ void pci_bridge_update_mappings(PCIBridge *br)
 void pci_bridge_write_config(PCIDevice *d,
                              uint32_t address, uint32_t val, int len)
 {
-    PCIBridge *s = container_of(d, PCIBridge, dev);
+    PCIBridge *s = PCI_BRIDGE(d);
     uint16_t oldctl = pci_get_word(d->config + PCI_BRIDGE_CONTROL);
     uint16_t newctl;
 
@@ -331,7 +335,7 @@ void pci_bridge_reset(DeviceState *qdev)
 int pci_bridge_initfn(PCIDevice *dev, const char *typename)
 {
     PCIBus *parent = dev->bus;
-    PCIBridge *br = DO_UPCAST(PCIBridge, dev, dev);
+    PCIBridge *br = PCI_BRIDGE(dev);
     PCIBus *sec_bus = &br->sec_bus;
 
     pci_word_test_and_set_mask(dev->config + PCI_STATUS,
@@ -379,7 +383,7 @@ int pci_bridge_initfn(PCIDevice *dev, const char *typename)
 /* default qdev clean up function for PCI-to-PCI bridge */
 void pci_bridge_exitfn(PCIDevice *pci_dev)
 {
-    PCIBridge *s = DO_UPCAST(PCIBridge, dev, pci_dev);
+    PCIBridge *s = PCI_BRIDGE(pci_dev);
     assert(QLIST_EMPTY(&s->sec_bus.child));
     QLIST_REMOVE(&s->sec_bus, sibling);
     pci_bridge_region_del(s, s->windows);
@@ -400,3 +404,17 @@ void pci_bridge_map_irq(PCIBridge *br, const char* bus_name,
     br->map_irq = map_irq;
     br->bus_name = bus_name;
 }
+
+static const TypeInfo pci_bridge_type_info = {
+    .name = TYPE_PCI_BRIDGE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCIBridge),
+    .abstract = true,
+};
+
+static void pci_bridge_register_types(void)
+{
+    type_register_static(&pci_bridge_type_info);
+}
+
+type_init(pci_bridge_register_types)
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 62bd0b8..50af3c1 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -305,7 +305,7 @@ void pcie_cap_slot_init(PCIDevice *dev, uint16_t slot)
 
     dev->exp.hpev_notified = false;
 
-    pci_bus_hotplug(pci_bridge_get_sec_bus(DO_UPCAST(PCIBridge, dev, dev)),
+    pci_bus_hotplug(pci_bridge_get_sec_bus(PCI_BRIDGE(dev)),
                     pcie_cap_slot_hotplug, &dev->qdev);
 }
 
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
index 66762f6..9df1788 100644
--- a/include/hw/pci/pci_bus.h
+++ b/include/hw/pci/pci_bus.h
@@ -53,8 +53,13 @@ struct PCIBridgeWindows {
     MemoryRegion alias_vga[QEMU_PCI_VGA_NUM_REGIONS];
 };
 
+#define TYPE_PCI_BRIDGE "base-pci-bridge"
+#define PCI_BRIDGE(obj) OBJECT_CHECK(PCIBridge, (obj), TYPE_PCI_BRIDGE)
+
 struct PCIBridge {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
 
     /* private member */
     PCIBus sec_bus;
commit 45c0a675f9572f236b4be881576de9a626d2618f
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jul 25 00:11:10 2013 +0200

    arm11mpcore: QOM cast cleanups for mpcore_rirq_state
    
    Introduce a type constant, use QOM casts, rename the parent field and
    prepare for QOM realize.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 31c9d5a..a786c62 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -161,11 +161,16 @@ static int mpcore_priv_init(SysBusDevice *sbd)
     return 0;
 }
 
+#define TYPE_REALVIEW_MPCORE_RIRQ "realview_mpcore"
+#define REALVIEW_MPCORE_RIRQ(obj) \
+    OBJECT_CHECK(mpcore_rirq_state, (obj), TYPE_REALVIEW_MPCORE_RIRQ)
+
 /* Dummy PIC to route IRQ lines.  The baseboard has 4 independent IRQ
    controllers.  The output of these, plus some of the raw input lines
    are fed into a single SMP-aware interrupt controller on the CPU.  */
 typedef struct {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     SysBusDevice *priv;
     qemu_irq cpuic[32];
     qemu_irq rvic[4][64];
@@ -196,9 +201,10 @@ static void mpcore_rirq_set_irq(void *opaque, int irq, int level)
     }
 }
 
-static int realview_mpcore_init(SysBusDevice *dev)
+static int realview_mpcore_init(SysBusDevice *sbd)
 {
-    mpcore_rirq_state *s = FROM_SYSBUS(mpcore_rirq_state, dev);
+    DeviceState *dev = DEVICE(sbd);
+    mpcore_rirq_state *s = REALVIEW_MPCORE_RIRQ(dev);
     DeviceState *gic;
     DeviceState *priv;
     int n;
@@ -208,7 +214,7 @@ static int realview_mpcore_init(SysBusDevice *dev)
     qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
     qdev_init_nofail(priv);
     s->priv = SYS_BUS_DEVICE(priv);
-    sysbus_pass_irq(dev, s->priv);
+    sysbus_pass_irq(sbd, s->priv);
     for (i = 0; i < 32; i++) {
         s->cpuic[i] = qdev_get_gpio_in(priv, i);
     }
@@ -220,8 +226,8 @@ static int realview_mpcore_init(SysBusDevice *dev)
             s->rvic[n][i] = qdev_get_gpio_in(gic, i);
         }
     }
-    qdev_init_gpio_in(&dev->qdev, mpcore_rirq_set_irq, 64);
-    sysbus_init_mmio(dev, sysbus_mmio_get_region(s->priv, 0));
+    qdev_init_gpio_in(dev, mpcore_rirq_set_irq, 64);
+    sysbus_init_mmio(sbd, sysbus_mmio_get_region(s->priv, 0));
     return 0;
 }
 
@@ -240,7 +246,7 @@ static void mpcore_rirq_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mpcore_rirq_info = {
-    .name          = "realview_mpcore",
+    .name          = TYPE_REALVIEW_MPCORE_RIRQ,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(mpcore_rirq_state),
     .class_init    = mpcore_rirq_class_init,
commit 56fc028166d00ecc8eb61cdfbec5a0305e15d670
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 24 23:59:01 2013 +0200

    arm11mpcore: QOM cast cleanups for ARM11MPCorePriveState
    
    Introduce a type constant, use QOM casts and rename the parent field.
    
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index 8eeb53e..31c9d5a 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -12,8 +12,13 @@
 
 /* MPCore private memory region.  */
 
+#define TYPE_ARM11MPCORE_PRIV "arm11mpcore_priv"
+#define ARM11MPCORE_PRIV(obj) \
+    OBJECT_CHECK(ARM11MPCorePriveState, (obj), TYPE_ARM11MPCORE_PRIV)
+
 typedef struct ARM11MPCorePriveState {
-    SysBusDevice busdev;
+    SysBusDevice parent_obj;
+
     uint32_t scu_control;
     int iomemtype;
     uint32_t old_timer_status[8];
@@ -125,9 +130,10 @@ static void mpcore_priv_map_setup(ARM11MPCorePriveState *s)
     }
 }
 
-static int mpcore_priv_init(SysBusDevice *dev)
+static int mpcore_priv_init(SysBusDevice *sbd)
 {
-    ARM11MPCorePriveState *s = FROM_SYSBUS(ARM11MPCorePriveState, dev);
+    DeviceState *dev = DEVICE(sbd);
+    ARM11MPCorePriveState *s = ARM11MPCORE_PRIV(dev);
 
     s->gic = qdev_create(NULL, "arm_gic");
     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
@@ -137,10 +143,10 @@ static int mpcore_priv_init(SysBusDevice *dev)
     qdev_init_nofail(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(dev, SYS_BUS_DEVICE(s->gic));
+    sysbus_pass_irq(sbd, SYS_BUS_DEVICE(s->gic));
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, mpcore_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(dev, mpcore_priv_set_irq, s->num_irq - 32);
 
     s->mptimer = qdev_create(NULL, "arm_mptimer");
     qdev_prop_set_uint32(s->mptimer, "num-cpu", s->num_cpu);
@@ -151,7 +157,7 @@ static int mpcore_priv_init(SysBusDevice *dev)
     qdev_init_nofail(s->wdtimer);
 
     mpcore_priv_map_setup(s);
-    sysbus_init_mmio(dev, &s->container);
+    sysbus_init_mmio(sbd, &s->container);
     return 0;
 }
 
@@ -198,7 +204,7 @@ static int realview_mpcore_init(SysBusDevice *dev)
     int n;
     int i;
 
-    priv = qdev_create(NULL, "arm11mpcore_priv");
+    priv = qdev_create(NULL, TYPE_ARM11MPCORE_PRIV);
     qdev_prop_set_uint32(priv, "num-cpu", s->num_cpu);
     qdev_init_nofail(priv);
     s->priv = SYS_BUS_DEVICE(priv);
@@ -264,7 +270,7 @@ static void mpcore_priv_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo mpcore_priv_info = {
-    .name          = "arm11mpcore_priv",
+    .name          = TYPE_ARM11MPCORE_PRIV,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARM11MPCorePriveState),
     .class_init    = mpcore_priv_class_init,
commit 97da11d8571af72b714f5a45c171bed95a38368c
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sun Jun 30 21:03:27 2013 +0200

    cpu/a15mpcore: QOM cast cleanup
    
    Introduce type constant and cast macro and rename A15MPPrivState::busdev
    field to parent_obj to enforce its use.
    
    Prepares for QOM realize.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/cpu/a15mpcore.c b/hw/cpu/a15mpcore.c
index c736257..4f37964 100644
--- a/hw/cpu/a15mpcore.c
+++ b/hw/cpu/a15mpcore.c
@@ -23,8 +23,15 @@
 
 /* A15MP private memory region.  */
 
+#define TYPE_A15MPCORE_PRIV "a15mpcore_priv"
+#define A15MPCORE_PRIV(obj) \
+    OBJECT_CHECK(A15MPPrivState, (obj), TYPE_A15MPCORE_PRIV)
+
 typedef struct A15MPPrivState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     uint32_t num_irq;
     MemoryRegion container;
@@ -39,7 +46,7 @@ static void a15mp_priv_set_irq(void *opaque, int irq, int level)
 
 static int a15mp_priv_init(SysBusDevice *dev)
 {
-    A15MPPrivState *s = FROM_SYSBUS(A15MPPrivState, dev);
+    A15MPPrivState *s = A15MPCORE_PRIV(dev);
     SysBusDevice *busdev;
     const char *gictype = "arm_gic";
 
@@ -58,7 +65,7 @@ static int a15mp_priv_init(SysBusDevice *dev)
     sysbus_pass_irq(dev, busdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, a15mp_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(DEVICE(dev), a15mp_priv_set_irq, s->num_irq - 32);
 
     /* Memory map (addresses are offsets from PERIPHBASE):
      *  0x0000-0x0fff -- reserved
@@ -101,7 +108,7 @@ static void a15mp_priv_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo a15mp_priv_info = {
-    .name  = "a15mpcore_priv",
+    .name  = TYPE_A15MPCORE_PRIV,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size  = sizeof(A15MPPrivState),
     .class_init = a15mp_priv_class_init,
commit 68653fd671d3e9b167aa2423dde67dad1b217340
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sun Jun 30 19:37:10 2013 +0200

    timer/arm_mptimer: QOM cast cleanup
    
    Introduce type constant and cast macro and rename
    ARMMPTimerState::busdev to enforce its use.
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 0ceb240..9277315 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -41,8 +41,15 @@ typedef struct {
     MemoryRegion iomem;
 } TimerBlock;
 
+#define TYPE_ARM_MPTIMER "arm_mptimer"
+#define ARM_MPTIMER(obj) \
+    OBJECT_CHECK(ARMMPTimerState, (obj), TYPE_ARM_MPTIMER)
+
 typedef struct {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     TimerBlock timerblock[MAX_CPUS];
     MemoryRegion iomem;
@@ -210,9 +217,9 @@ static void timerblock_reset(TimerBlock *tb)
 
 static void arm_mptimer_reset(DeviceState *dev)
 {
-    ARMMPTimerState *s =
-        FROM_SYSBUS(ARMMPTimerState, SYS_BUS_DEVICE(dev));
+    ARMMPTimerState *s = ARM_MPTIMER(dev);
     int i;
+
     for (i = 0; i < ARRAY_SIZE(s->timerblock); i++) {
         timerblock_reset(&s->timerblock[i]);
     }
@@ -220,8 +227,9 @@ static void arm_mptimer_reset(DeviceState *dev)
 
 static int arm_mptimer_init(SysBusDevice *dev)
 {
-    ARMMPTimerState *s = FROM_SYSBUS(ARMMPTimerState, dev);
+    ARMMPTimerState *s = ARM_MPTIMER(dev);
     int i;
+
     if (s->num_cpu < 1 || s->num_cpu > MAX_CPUS) {
         hw_error("%s: num-cpu must be between 1 and %d\n", __func__, MAX_CPUS);
     }
@@ -294,7 +302,7 @@ static void arm_mptimer_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo arm_mptimer_info = {
-    .name          = "arm_mptimer",
+    .name          = TYPE_ARM_MPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARMMPTimerState),
     .class_init    = arm_mptimer_class_init,
commit 5126fec766a3100de896cb92db45d862bd84a969
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sun Jun 30 19:07:29 2013 +0200

    cpu/a9mpcore: QOM casting cleanup
    
    Introduce type constant and cast macro and enforce its use by
    renaming A9MPPrivState::busdev field to parent_obj.
    
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index 6c00a59..3e675e3 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -10,8 +10,15 @@
 
 #include "hw/sysbus.h"
 
+#define TYPE_A9MPCORE_PRIV "a9mpcore_priv"
+#define A9MPCORE_PRIV(obj) \
+    OBJECT_CHECK(A9MPPrivState, (obj), TYPE_A9MPCORE_PRIV)
+
 typedef struct A9MPPrivState {
-    SysBusDevice busdev;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     uint32_t num_cpu;
     MemoryRegion container;
     DeviceState *mptimer;
@@ -29,7 +36,7 @@ static void a9mp_priv_set_irq(void *opaque, int irq, int level)
 
 static int a9mp_priv_init(SysBusDevice *dev)
 {
-    A9MPPrivState *s = FROM_SYSBUS(A9MPPrivState, dev);
+    A9MPPrivState *s = A9MPCORE_PRIV(dev);
     SysBusDevice *timerbusdev, *wdtbusdev, *gicbusdev, *scubusdev;
     int i;
 
@@ -43,7 +50,7 @@ static int a9mp_priv_init(SysBusDevice *dev)
     sysbus_pass_irq(dev, gicbusdev);
 
     /* Pass through inbound GPIO lines to the GIC */
-    qdev_init_gpio_in(&s->busdev.qdev, a9mp_priv_set_irq, s->num_irq - 32);
+    qdev_init_gpio_in(DEVICE(dev), a9mp_priv_set_irq, s->num_irq - 32);
 
     s->scu = qdev_create(NULL, "a9-scu");
     qdev_prop_set_uint32(s->scu, "num-cpu", s->num_cpu);
@@ -124,7 +131,7 @@ static void a9mp_priv_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo a9mp_priv_info = {
-    .name          = "a9mpcore_priv",
+    .name          = TYPE_A9MPCORE_PRIV,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(A9MPPrivState),
     .class_init    = a9mp_priv_class_init,
commit f6c11d56442fafa5357ef1f1659b9e39e7bf578d
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 17 18:44:48 2013 +0200

    ide: Introduce abstract QOM type for PCIIDEState
    
    Needed for QOM casts.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index 33be386..d6ef799 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -127,7 +127,7 @@ static uint64_t bmdma_read(void *opaque, hwaddr addr,
                            unsigned size)
 {
     BMDMAState *bm = opaque;
-    PCIIDEState *pci_dev = bm->pci_dev;
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     uint32_t val;
 
     if (size != 1) {
@@ -139,16 +139,16 @@ static uint64_t bmdma_read(void *opaque, hwaddr addr,
         val = bm->cmd;
         break;
     case 1:
-        val = pci_dev->dev.config[MRDMODE];
+        val = pci_dev->config[MRDMODE];
         break;
     case 2:
         val = bm->status;
         break;
     case 3:
-        if (bm == &pci_dev->bmdma[0]) {
-            val = pci_dev->dev.config[UDIDETCR0];
+        if (bm == &bm->pci_dev->bmdma[0]) {
+            val = pci_dev->config[UDIDETCR0];
         } else {
-            val = pci_dev->dev.config[UDIDETCR1];
+            val = pci_dev->config[UDIDETCR1];
         }
         break;
     default:
@@ -165,7 +165,7 @@ static void bmdma_write(void *opaque, hwaddr addr,
                         uint64_t val, unsigned size)
 {
     BMDMAState *bm = opaque;
-    PCIIDEState *pci_dev = bm->pci_dev;
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
 
     if (size != 1) {
         return;
@@ -179,18 +179,19 @@ static void bmdma_write(void *opaque, hwaddr addr,
         bmdma_cmd_writeb(bm, val);
         break;
     case 1:
-        pci_dev->dev.config[MRDMODE] =
-            (pci_dev->dev.config[MRDMODE] & ~0x30) | (val & 0x30);
-        cmd646_update_irq(pci_dev);
+        pci_dev->config[MRDMODE] =
+            (pci_dev->config[MRDMODE] & ~0x30) | (val & 0x30);
+        cmd646_update_irq(bm->pci_dev);
         break;
     case 2:
         bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
         break;
     case 3:
-        if (bm == &pci_dev->bmdma[0])
-            pci_dev->dev.config[UDIDETCR0] = val;
-        else
-            pci_dev->dev.config[UDIDETCR1] = val;
+        if (bm == &bm->pci_dev->bmdma[0]) {
+            pci_dev->config[UDIDETCR0] = val;
+        } else {
+            pci_dev->config[UDIDETCR1] = val;
+        }
         break;
     }
 }
@@ -222,25 +223,29 @@ static void bmdma_setup_bar(PCIIDEState *d)
    registers */
 static void cmd646_update_irq(PCIIDEState *d)
 {
+    PCIDevice *pd = PCI_DEVICE(d);
     int pci_level;
-    pci_level = ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH0) &&
-                 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH0)) ||
-        ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH1) &&
-         !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH1));
-    qemu_set_irq(d->dev.irq[0], pci_level);
+
+    pci_level = ((pd->config[MRDMODE] & MRDMODE_INTR_CH0) &&
+                 !(pd->config[MRDMODE] & MRDMODE_BLK_CH0)) ||
+        ((pd->config[MRDMODE] & MRDMODE_INTR_CH1) &&
+         !(pd->config[MRDMODE] & MRDMODE_BLK_CH1));
+    qemu_set_irq(pd->irq[0], pci_level);
 }
 
 /* the PCI irq level is the logical OR of the two channels */
 static void cmd646_set_irq(void *opaque, int channel, int level)
 {
     PCIIDEState *d = opaque;
+    PCIDevice *pd = PCI_DEVICE(d);
     int irq_mask;
 
     irq_mask = MRDMODE_INTR_CH0 << channel;
-    if (level)
-        d->dev.config[MRDMODE] |= irq_mask;
-    else
-        d->dev.config[MRDMODE] &= ~irq_mask;
+    if (level) {
+        pd->config[MRDMODE] |= irq_mask;
+    } else {
+        pd->config[MRDMODE] &= ~irq_mask;
+    }
     cmd646_update_irq(d);
 }
 
@@ -257,8 +262,8 @@ static void cmd646_reset(void *opaque)
 /* CMD646 PCI IDE controller */
 static int pci_cmd646_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
     qemu_irq *irq;
     int i;
 
@@ -284,7 +289,7 @@ static int pci_cmd646_ide_initfn(PCIDevice *dev)
 
     irq = qemu_allocate_irqs(cmd646_set_irq, d, 2);
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(dev), i, 2);
         ide_init2(&d->bus[i], irq[i]);
 
         bmdma_init(&d->bus[i], &d->bmdma[i], d);
@@ -293,14 +298,14 @@ static int pci_cmd646_ide_initfn(PCIDevice *dev)
                                          &d->bmdma[i].dma);
     }
 
-    vmstate_register(&dev->qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
     qemu_register_reset(cmd646_reset, d);
     return 0;
 }
 
 static void pci_cmd646_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -347,8 +352,7 @@ static void cmd646_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo cmd646_ide_info = {
     .name          = "cmd646-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = cmd646_ide_class_init,
 };
 
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 635a364..91151fc 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -56,13 +56,14 @@ static int bmdma_prepare_buf(IDEDMA *dma, int is_write)
 {
     BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
     IDEState *s = bmdma_active_if(bm);
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     struct {
         uint32_t addr;
         uint32_t size;
     } prd;
     int l, len;
 
-    pci_dma_sglist_init(&s->sg, &bm->pci_dev->dev,
+    pci_dma_sglist_init(&s->sg, pci_dev,
                         s->nsector / (BMDMA_PAGE_SIZE / 512) + 1);
     s->io_buffer_size = 0;
     for(;;) {
@@ -71,7 +72,7 @@ static int bmdma_prepare_buf(IDEDMA *dma, int is_write)
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
                 return s->io_buffer_size != 0;
-            pci_dma_read(&bm->pci_dev->dev, bm->cur_addr, &prd, 8);
+            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);
@@ -98,6 +99,7 @@ static int bmdma_rw_buf(IDEDMA *dma, int is_write)
 {
     BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
     IDEState *s = bmdma_active_if(bm);
+    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
     struct {
         uint32_t addr;
         uint32_t size;
@@ -113,7 +115,7 @@ static int bmdma_rw_buf(IDEDMA *dma, int is_write)
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
                 return 0;
-            pci_dma_read(&bm->pci_dev->dev, bm->cur_addr, &prd, 8);
+            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);
@@ -128,10 +130,10 @@ static int bmdma_rw_buf(IDEDMA *dma, int is_write)
             l = bm->cur_prd_len;
         if (l > 0) {
             if (is_write) {
-                pci_dma_write(&bm->pci_dev->dev, bm->cur_prd_addr,
+                pci_dma_write(pci_dev, bm->cur_prd_addr,
                               s->io_buffer + s->io_buffer_index, l);
             } else {
-                pci_dma_read(&bm->pci_dev->dev, bm->cur_prd_addr,
+                pci_dma_read(pci_dev, bm->cur_prd_addr,
                              s->io_buffer + s->io_buffer_index, l);
             }
             bm->cur_prd_addr += l;
@@ -480,7 +482,7 @@ const VMStateDescription vmstate_ide_pci = {
     .minimum_version_id_old = 0,
     .post_load = ide_pci_post_load,
     .fields      = (VMStateField []) {
-        VMSTATE_PCI_DEVICE(dev, PCIIDEState),
+        VMSTATE_PCI_DEVICE(parent_obj, PCIIDEState),
         VMSTATE_STRUCT_ARRAY(bmdma, PCIIDEState, 2, 0,
                              vmstate_bmdma, BMDMAState),
         VMSTATE_IDE_BUS_ARRAY(bus, PCIIDEState, 2),
@@ -492,7 +494,7 @@ const VMStateDescription vmstate_ide_pci = {
 
 void pci_ide_create_devs(PCIDevice *dev, DriveInfo **hd_table)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     static const int bus[4]  = { 0, 0, 1, 1 };
     static const int unit[4] = { 0, 1, 0, 1 };
     int i;
@@ -531,3 +533,17 @@ void bmdma_init(IDEBus *bus, BMDMAState *bm, PCIIDEState *d)
     bus->irq = *irq;
     bm->pci_dev = d;
 }
+
+static const TypeInfo pci_ide_type_info = {
+    .name = TYPE_PCI_IDE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCIIDEState),
+    .abstract = true,
+};
+
+static void pci_ide_register_types(void)
+{
+    type_register_static(&pci_ide_type_info);
+}
+
+type_init(pci_ide_register_types)
diff --git a/hw/ide/pci.h b/hw/ide/pci.h
index a694e54..2428275 100644
--- a/hw/ide/pci.h
+++ b/hw/ide/pci.h
@@ -37,8 +37,14 @@ typedef struct CMD646BAR {
     struct PCIIDEState *pci_dev;
 } CMD646BAR;
 
+#define TYPE_PCI_IDE "pci-ide"
+#define PCI_IDE(obj) OBJECT_CHECK(PCIIDEState, (obj), TYPE_PCI_IDE)
+
 typedef struct PCIIDEState {
-    PCIDevice dev;
+    /*< private >*/
+    PCIDevice parent_obj;
+    /*< public >*/
+
     IDEBus bus[2];
     BMDMAState bmdma[2];
     uint32_t secondary; /* used only for cmd646 */
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 238e758..e6e6c0b 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -106,7 +106,8 @@ static void bmdma_setup_bar(PCIIDEState *d)
 static void piix3_reset(void *opaque)
 {
     PCIIDEState *d = opaque;
-    uint8_t *pci_conf = d->dev.config;
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
     int i;
 
     for (i = 0; i < 2; i++) {
@@ -149,15 +150,15 @@ static void pci_piix_init_ports(PCIIDEState *d) {
 
 static int pci_piix_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
 
     pci_conf[PCI_CLASS_PROG] = 0x80; // legacy ATA mode
 
     qemu_register_reset(piix3_reset, d);
 
     bmdma_setup_bar(d);
-    pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
     vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
@@ -168,13 +169,11 @@ static int pci_piix_ide_initfn(PCIDevice *dev)
 
 static int pci_piix3_xen_ide_unplug(DeviceState *dev)
 {
-    PCIDevice *pci_dev;
     PCIIDEState *pci_ide;
     DriveInfo *di;
     int i = 0;
 
-    pci_dev = PCI_DEVICE(dev);
-    pci_ide = DO_UPCAST(PCIIDEState, dev, pci_dev);
+    pci_ide = PCI_IDE(dev);
 
     for (; i < 3; i++) {
         di = drive_get_by_index(IF_IDE, i);
@@ -203,7 +202,7 @@ PCIDevice *pci_piix3_xen_ide_init(PCIBus *bus, DriveInfo **hd_table, int devfn)
 
 static void pci_piix_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -254,8 +253,7 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo piix3_ide_info = {
     .name          = "piix3-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix3_ide_class_init,
 };
 
@@ -275,8 +273,7 @@ static void piix3_ide_xen_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo piix3_ide_xen_info = {
     .name          = "piix3-ide-xen",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix3_ide_xen_class_init,
 };
 
@@ -297,8 +294,7 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo piix4_ide_info = {
     .name          = "piix4-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = piix4_ide_class_init,
 };
 
diff --git a/hw/ide/via.c b/hw/ide/via.c
index d324884..e5fb297 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -108,7 +108,8 @@ static void bmdma_setup_bar(PCIIDEState *d)
 static void via_reset(void *opaque)
 {
     PCIIDEState *d = opaque;
-    uint8_t *pci_conf = d->dev.config;
+    PCIDevice *pd = PCI_DEVICE(d);
+    uint8_t *pci_conf = pd->config;
     int i;
 
     for (i = 0; i < 2; i++) {
@@ -158,7 +159,7 @@ static void vt82c686b_init_ports(PCIIDEState *d) {
     int i;
 
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(d), i, 2);
         ide_init_ioport(&d->bus[i], NULL, port_info[i].iobase,
                         port_info[i].iobase2);
         ide_init2(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
@@ -173,17 +174,17 @@ static void vt82c686b_init_ports(PCIIDEState *d) {
 /* via ide func */
 static int vt82c686b_ide_initfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
-    uint8_t *pci_conf = d->dev.config;
+    PCIIDEState *d = PCI_IDE(dev);
+    uint8_t *pci_conf = dev->config;
 
     pci_config_set_prog_interface(pci_conf, 0x8a); /* legacy ATA mode */
     pci_set_long(pci_conf + PCI_CAPABILITY_LIST, 0x000000c0);
 
     qemu_register_reset(via_reset, d);
     bmdma_setup_bar(d);
-    pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
+    pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(&dev->qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
     vt82c686b_init_ports(d);
 
@@ -192,7 +193,7 @@ static int vt82c686b_ide_initfn(PCIDevice *dev)
 
 static void vt82c686b_ide_exitfn(PCIDevice *dev)
 {
-    PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);
+    PCIIDEState *d = PCI_IDE(dev);
     unsigned i;
 
     for (i = 0; i < 2; ++i) {
@@ -229,8 +230,7 @@ static void via_ide_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo via_ide_info = {
     .name          = "via-ide",
-    .parent        = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(PCIIDEState),
+    .parent        = TYPE_PCI_IDE,
     .class_init    = via_ide_class_init,
 };
 
commit 02a9594b4f0cb8a341fe91edb41c6424ad5ae4f9
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Mon Jun 24 16:56:30 2013 +1000

    ide/piix: QOM casting sweep
    
    Use standard QOM cast macro. Remove usage of DO_UPCAST() and
    direct -> style upcasting.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 56cf00e..238e758 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -135,7 +135,7 @@ static void pci_piix_init_ports(PCIIDEState *d) {
     int i;
 
     for (i = 0; i < 2; i++) {
-        ide_bus_new(&d->bus[i], &d->dev.qdev, i, 2);
+        ide_bus_new(&d->bus[i], DEVICE(d), i, 2);
         ide_init_ioport(&d->bus[i], NULL, port_info[i].iobase,
                         port_info[i].iobase2);
         ide_init2(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
@@ -159,7 +159,7 @@ static int pci_piix_ide_initfn(PCIDevice *dev)
     bmdma_setup_bar(d);
     pci_register_bar(&d->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(&d->dev.qdev, 0, &vmstate_ide_pci, d);
+    vmstate_register(DEVICE(dev), 0, &vmstate_ide_pci, d);
 
     pci_piix_init_ports(d);
 
@@ -173,7 +173,7 @@ static int pci_piix3_xen_ide_unplug(DeviceState *dev)
     DriveInfo *di;
     int i = 0;
 
-    pci_dev = DO_UPCAST(PCIDevice, qdev, dev);
+    pci_dev = PCI_DEVICE(dev);
     pci_ide = DO_UPCAST(PCIIDEState, dev, pci_dev);
 
     for (; i < 3; i++) {
@@ -188,7 +188,7 @@ static int pci_piix3_xen_ide_unplug(DeviceState *dev)
             drive_put_ref(di);
         }
     }
-    qdev_reset_all(&(pci_ide->dev.qdev));
+    qdev_reset_all(DEVICE(dev));
     return 0;
 }
 
commit 19d46d711d93cb3a37dada945cb3410278b94bc3
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 01:55:26 2013 +0200

    fdc: Fix inheritence for SUNW,fdtwo
    
    Since commit dd3be7420774f7dc8f37a96ca24d07f0b6f31b3b SUNW,fdtwo's
    initfn (realizefn since 940194c2369e50d91d1abf6f36d43853eea5e539)
    was using SYSBUS_FDC() cast. This uses type sysbus-fdc rather than
    SUNW,fdtwo.
    
    Fix this by letting SUNW,fdtwo and sysbus-fdc both inherit from an
    abstract type base-sysbus-fdc.
    
    This allows to consolidate realizefns by using instance_init functions.
    Clean up variable names and variable order while at it.
    
    Reported-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Cc: Hu Tao <hutao at cn.fujitsu.com>
    Tested-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 50a350f..e35ed2e 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -544,7 +544,7 @@ struct FDCtrl {
     uint8_t timer1;
 };
 
-#define TYPE_SYSBUS_FDC "sysbus-fdc"
+#define TYPE_SYSBUS_FDC "base-sysbus-fdc"
 #define SYSBUS_FDC(obj) OBJECT_CHECK(FDCtrlSysBus, (obj), TYPE_SYSBUS_FDC)
 
 typedef struct FDCtrlSysBus {
@@ -2055,7 +2055,7 @@ void fdctrl_init_sysbus(qemu_irq irq, int dma_chann,
     SysBusDevice *sbd;
     FDCtrlSysBus *sys;
 
-    dev = qdev_create(NULL, TYPE_SYSBUS_FDC);
+    dev = qdev_create(NULL, "sysbus-fdc");
     sys = SYSBUS_FDC(dev);
     fdctrl = &sys->state;
     fdctrl->dma_chann = dma_chann; /* FIXME */
@@ -2153,60 +2153,49 @@ static void isabus_fdc_realize(DeviceState *dev, Error **errp)
 
 static void sysbus_fdc_initfn(Object *obj)
 {
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
 
+    fdctrl->dma_chann = -1;
+
     memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_ops, fdctrl,
                           "fdc", 0x08);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
 }
 
-static void sysbus_fdc_realize(DeviceState *dev, Error **errp)
+static void sun4m_fdc_initfn(Object *obj)
 {
-    FDCtrlSysBus *sys = SYSBUS_FDC(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
-    SysBusDevice *b = SYS_BUS_DEVICE(dev);
-    Error *err = NULL;
 
-    sysbus_init_mmio(b, &fdctrl->iomem);
-    sysbus_init_irq(b, &fdctrl->irq);
-    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
-    fdctrl->dma_chann = -1;
+    fdctrl->sun4m = 1;
 
-    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    fdctrl_realize_common(fdctrl, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
-        return;
-    }
+    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
+                          fdctrl, "fdctrl", 0x08);
+    sysbus_init_mmio(sbd, &fdctrl->iomem);
 }
 
-static void sun4m_fdc_initfn(Object *obj)
+static void sysbus_fdc_common_initfn(Object *obj)
 {
+    DeviceState *dev = DEVICE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
     FDCtrl *fdctrl = &sys->state;
 
-    memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
-                          fdctrl, "fdctrl", 0x08);
+    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
+
+    sysbus_init_irq(sbd, &fdctrl->irq);
+    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
 }
 
-static void sun4m_fdc_realize(DeviceState *dev, Error **errp)
+static void sysbus_fdc_common_realize(DeviceState *dev, Error **errp)
 {
     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
     FDCtrl *fdctrl = &sys->state;
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    Error *err = NULL;
 
-    sysbus_init_mmio(sbd, &fdctrl->iomem);
-    sysbus_init_irq(sbd, &fdctrl->irq);
-    qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
-
-    fdctrl->sun4m = 1;
-    qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
-    fdctrl_realize_common(fdctrl, &err);
-    if (err != NULL) {
-        error_propagate(errp, err);
-        return;
-    }
+    fdctrl_realize_common(fdctrl, errp);
 }
 
 FDriveType isa_fdc_get_drive_type(ISADevice *fdc, int i)
@@ -2279,17 +2268,13 @@ static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = sysbus_fdc_realize;
-    dc->reset = fdctrl_external_reset_sysbus;
-    dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sysbus_fdc_properties;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_fdc_info = {
-    .name          = TYPE_SYSBUS_FDC,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FDCtrlSysBus),
+    .name          = "sysbus-fdc",
+    .parent        = TYPE_SYSBUS_FDC,
     .instance_init = sysbus_fdc_initfn,
     .class_init    = sysbus_fdc_class_init,
 };
@@ -2303,24 +2288,39 @@ static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = sun4m_fdc_realize;
-    dc->reset = fdctrl_external_reset_sysbus;
-    dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sun4m_fdc_properties;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sun4m_fdc_info = {
     .name          = "SUNW,fdtwo",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(FDCtrlSysBus),
+    .parent        = TYPE_SYSBUS_FDC,
     .instance_init = sun4m_fdc_initfn,
     .class_init    = sun4m_fdc_class_init,
 };
 
+static void sysbus_fdc_common_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = sysbus_fdc_common_realize;
+    dc->reset = fdctrl_external_reset_sysbus;
+    dc->vmsd = &vmstate_sysbus_fdc;
+}
+
+static const TypeInfo sysbus_fdc_type_info = {
+    .name          = TYPE_SYSBUS_FDC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(FDCtrlSysBus),
+    .instance_init = sysbus_fdc_common_initfn,
+    .abstract      = true,
+    .class_init    = sysbus_fdc_common_class_init,
+};
+
 static void fdc_register_types(void)
 {
     type_register_static(&isa_fdc_info);
+    type_register_static(&sysbus_fdc_type_info);
     type_register_static(&sysbus_fdc_info);
     type_register_static(&sun4m_fdc_info);
 }
commit eddbf0ab9db8385d7cb57e23891c1d41488b303e
Merge: 4ff1fac b0f2027
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 11:33:48 2013 -0500

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Stefan Hajnoczi (4) and others
    # Via Stefan Hajnoczi
    * stefanha/block:
      dataplane: refuse to start if device is already in use
      dataplane: enable virtio-blk x-data-plane=on live migration
      migration: fix spice migration
      migration: notify migration state before starting thread
      block: Repair the throttling code.
      gluster: Add image resize support
    
    Message-id: 1375112172-24863-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 4ff1fac4305f78d9cf987ca8abf3bda7f29c856e
Merge: 3a1da42 9337e3b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 11:33:34 2013 -0500

    Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into staging
    
    QOM CPUState refactorings
    
    * Fix x86 cpu-add
    * Change KVM PMU behavior for 1.6
    
    # gpg: Signature made Mon 29 Jul 2013 10:28:18 AM CDT using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Eduardo Habkost (2) and Andreas Färber (1)
    # Via Andreas Färber
    * afaerber/tags/qom-cpu-for-anthony:
      target-i386: Disable PMU CPUID leaf by default
      target-i386: Pass X86CPU object to cpu_x86_find_by_name()
      cpu: Partially revert "cpu: Change qemu_init_vcpu() argument to CPUState"

commit 3a1da42eb35a67d0dbc899dd571ea386fa11c4dd
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jul 26 16:44:34 2013 +0200

    qapi: Rename ChardevBackend member "memory" to "ringbuf"
    
    Commit 1da48c6 called the new member "memory" after commit 3949e59
    standardized "ringbuf".  Rename for consistency.
    
    However, member name "memory" is visible in QMP since 1.5.  It's
    undocumented just like the driver name.  Keep it working anyway.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374849874-25531-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index a56de74..a51f7d2 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3364,9 +3364,9 @@
 ##
 # @ChardevRingbuf:
 #
-# Configuration info for memory chardevs
+# Configuration info for ring buffer chardevs.
 #
-# @size: #optional Ringbuffer size, must be power of two, default is 65536
+# @size: #optional ring buffer size, must be power of two, default is 65536
 #
 # Since: 1.5
 ##
@@ -3397,6 +3397,8 @@
                                        'spicevmc' : 'ChardevSpiceChannel',
                                        'spiceport' : 'ChardevSpicePort',
                                        'vc'     : 'ChardevVC',
+                                       'ringbuf': 'ChardevRingbuf',
+                                       # next one is just for compatibility
                                        'memory' : 'ChardevRingbuf' } }
 
 ##
diff --git a/qemu-char.c b/qemu-char.c
index 742b73b..3f606c9 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3110,12 +3110,12 @@ static void qemu_chr_parse_ringbuf(QemuOpts *opts, ChardevBackend *backend,
 {
     int val;
 
-    backend->memory = g_new0(ChardevRingbuf, 1);
+    backend->ringbuf = g_new0(ChardevRingbuf, 1);
 
     val = qemu_opt_get_size(opts, "size", 0);
     if (val != 0) {
-        backend->memory->has_size = true;
-        backend->memory->size = val;
+        backend->ringbuf->has_size = true;
+        backend->ringbuf->size = val;
     }
 }
 
@@ -3723,8 +3723,9 @@ ChardevReturn *qmp_chardev_add(const char *id, ChardevBackend *backend,
     case CHARDEV_BACKEND_KIND_VC:
         chr = vc_init(backend->vc);
         break;
+    case CHARDEV_BACKEND_KIND_RINGBUF:
     case CHARDEV_BACKEND_KIND_MEMORY:
-        chr = qemu_chr_open_ringbuf(backend->memory, errp);
+        chr = qemu_chr_open_ringbuf(backend->ringbuf, errp);
         break;
     default:
         error_setg(errp, "unknown chardev backend (%d)", backend->kind);
@@ -3774,7 +3775,7 @@ static void register_types(void)
     register_char_driver_qapi("null", CHARDEV_BACKEND_KIND_NULL, NULL);
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
-    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_MEMORY,
+    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_RINGBUF,
                               qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
commit c11ed9666d69abaf217c8800f299c519b487b7d3
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jul 26 16:44:33 2013 +0200

    qemu-char: Register ring buffer driver with correct name "ringbuf"
    
    The driver is new in 1.4, with the documented name "ringbuf".
    However, it's actual name is the completely undocumented "memory".
    Screwed up in commit 3949e59.  Fix code to match documentation.
    
    Keep the undocumented name working as an alias for compatibility.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374849874-25531-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index bd1aefb..742b73b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3774,7 +3774,7 @@ static void register_types(void)
     register_char_driver_qapi("null", CHARDEV_BACKEND_KIND_NULL, NULL);
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
-    register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
+    register_char_driver_qapi("ringbuf", CHARDEV_BACKEND_KIND_MEMORY,
                               qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
@@ -3794,6 +3794,9 @@ static void register_types(void)
                               qemu_chr_parse_pipe);
     register_char_driver_qapi("mux", CHARDEV_BACKEND_KIND_MUX,
                               qemu_chr_parse_mux);
+    /* Bug-compatibility: */
+    register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
+                              qemu_chr_parse_ringbuf);
 }
 
 type_init(register_types);
commit 4f57378fe69836ee2585c4ca631ff50746940fa6
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Jul 26 16:44:32 2013 +0200

    Revert "chardev: Make the name of memory device consistent"
    
    This reverts commit 6a85e60cb994bd95d1537aafbff65816f3de4637.
    
    Commit 51767e7 "qemu-char: Add new char backend CirMemCharDriver"
    introduced a memory ring buffer character device driver named
    "memory".  Commit 3949e59 "qemu-char: Saner naming of memchar stuff &
    doc fixes" changed the driver name to "ringbuf", along with a whole
    bunch of other names, with the following rationale:
    
        Naming is a mess.  The code calls the device driver
        CirMemCharDriver, the public API calls it "memory", "memchardev",
        or "memchar", and the special commands are named like
        "memchar-FOO".  "memory" is a particularly unfortunate choice,
        because there's another character device driver called
        MemoryDriver.  Moreover, the device's distinctive property is that
        it's a ring buffer, not that's in memory.
    
    This is what we released in 1.4.0.
    
    Unfortunately, the rename missed a critical instance of "memory": the
    actual driver name.  Thus, the new device could be used only by an
    entirely undocumented name.  The documented name did not work.
    Bummer.
    
    Commit 6a85e60 fixes this by changing the documentation to match the
    code.  It also changes some, but not all related occurences of
    "ringbuf" to "memory".  Left alone are identifiers in C code, HMP and
    QMP commands.  The latter are external interface, so they can't be
    changed.
    
    The result is an inconsistent mess.  Moreover, "memory" is a rotten
    name.  The device's distinctive property is that it's a ring buffer,
    not that's in memory.  User's don't care whether it's in RAM, flash,
    or carved into chocolate tablets by Oompa Loompas.
    
    Revert the commit.  Next commit will fix just the bug.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374849874-25531-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index f82d829..a56de74 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3362,7 +3362,7 @@
                                  '*rows'   : 'int' } }
 
 ##
-# @ChardevMemory:
+# @ChardevRingbuf:
 #
 # Configuration info for memory chardevs
 #
@@ -3370,7 +3370,7 @@
 #
 # Since: 1.5
 ##
-{ 'type': 'ChardevMemory', 'data': { '*size'  : 'int' } }
+{ 'type': 'ChardevRingbuf', 'data': { '*size'  : 'int' } }
 
 ##
 # @ChardevBackend:
@@ -3397,7 +3397,7 @@
                                        'spicevmc' : 'ChardevSpiceChannel',
                                        'spiceport' : 'ChardevSpicePort',
                                        'vc'     : 'ChardevVC',
-                                       'memory' : 'ChardevMemory' } }
+                                       'memory' : 'ChardevRingbuf' } }
 
 ##
 # @ChardevReturn:
diff --git a/qemu-char.c b/qemu-char.c
index c86ce4b..bd1aefb 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2783,8 +2783,8 @@ static void ringbuf_chr_close(struct CharDriverState *chr)
     chr->opaque = NULL;
 }
 
-static CharDriverState *qemu_chr_open_memory(ChardevMemory *opts,
-                                             Error **errp)
+static CharDriverState *qemu_chr_open_ringbuf(ChardevRingbuf *opts,
+                                              Error **errp)
 {
     CharDriverState *chr;
     RingBufCharDriver *d;
@@ -2796,7 +2796,7 @@ static CharDriverState *qemu_chr_open_memory(ChardevMemory *opts,
 
     /* The size must be power of 2 */
     if (d->size & (d->size - 1)) {
-        error_setg(errp, "size of memory chardev must be power of two");
+        error_setg(errp, "size of ringbuf chardev must be power of two");
         goto fail;
     }
 
@@ -3105,12 +3105,12 @@ static void qemu_chr_parse_pipe(QemuOpts *opts, ChardevBackend *backend,
     backend->pipe->device = g_strdup(device);
 }
 
-static void qemu_chr_parse_memory(QemuOpts *opts, ChardevBackend *backend,
-                                  Error **errp)
+static void qemu_chr_parse_ringbuf(QemuOpts *opts, ChardevBackend *backend,
+                                   Error **errp)
 {
     int val;
 
-    backend->memory = g_new0(ChardevMemory, 1);
+    backend->memory = g_new0(ChardevRingbuf, 1);
 
     val = qemu_opt_get_size(opts, "size", 0);
     if (val != 0) {
@@ -3724,7 +3724,7 @@ ChardevReturn *qmp_chardev_add(const char *id, ChardevBackend *backend,
         chr = vc_init(backend->vc);
         break;
     case CHARDEV_BACKEND_KIND_MEMORY:
-        chr = qemu_chr_open_memory(backend->memory, errp);
+        chr = qemu_chr_open_ringbuf(backend->memory, errp);
         break;
     default:
         error_setg(errp, "unknown chardev backend (%d)", backend->kind);
@@ -3775,7 +3775,7 @@ static void register_types(void)
     register_char_driver("socket", qemu_chr_open_socket);
     register_char_driver("udp", qemu_chr_open_udp);
     register_char_driver_qapi("memory", CHARDEV_BACKEND_KIND_MEMORY,
-                              qemu_chr_parse_memory);
+                              qemu_chr_parse_ringbuf);
     register_char_driver_qapi("file", CHARDEV_BACKEND_KIND_FILE,
                               qemu_chr_parse_file_out);
     register_char_driver_qapi("stdio", CHARDEV_BACKEND_KIND_STDIO,
diff --git a/qemu-options.hx b/qemu-options.hx
index 25ecb55..d15338e 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1783,7 +1783,7 @@ DEF("chardev", HAS_ARG, QEMU_OPTION_chardev,
     "-chardev msmouse,id=id[,mux=on|off]\n"
     "-chardev vc,id=id[[,width=width][,height=height]][[,cols=cols][,rows=rows]]\n"
     "         [,mux=on|off]\n"
-    "-chardev memory,id=id[,size=size]\n"
+    "-chardev ringbuf,id=id[,size=size]\n"
     "-chardev file,id=id,path=path[,mux=on|off]\n"
     "-chardev pipe,id=id,path=path[,mux=on|off]\n"
 #ifdef _WIN32
@@ -1821,7 +1821,7 @@ Backend is one of:
 @option{udp},
 @option{msmouse},
 @option{vc},
- at option{memory},
+ at option{ringbuf},
 @option{file},
 @option{pipe},
 @option{console},
@@ -1930,7 +1930,7 @@ the console, in pixels.
 @option{cols} and @option{rows} specify that the console be sized to fit a text
 console with the given dimensions.
 
- at item -chardev memory ,id=@var{id} [,size=@var{size}]
+ at item -chardev ringbuf ,id=@var{id} [,size=@var{size}]
 
 Create a ring buffer with fixed size @option{size}.
 @var{size} must be a power of two, and defaults to @code{64K}).
commit f1a145e154b0a227a1e192009ca30b351de0a8ef
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:42:01 2013 +0200

    qapi.py: Permit comments starting anywhere on the line
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-10-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index f64b7b2..0ebea94 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -68,13 +68,12 @@ class QAPISchema:
 
     def accept(self):
         while True:
-            bol = self.cursor == 0 or self.src[self.cursor-1] == '\n'
             self.tok = self.src[self.cursor]
             self.pos = self.cursor
             self.cursor += 1
             self.val = None
 
-            if self.tok == '#' and bol:
+            if self.tok == '#':
                 self.cursor = self.src.find('\n', self.cursor)
             elif self.tok in ['{', '}', ':', ',', '[', ']']:
                 return
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
index 4a82b26..e69de29 100644
--- a/tests/qapi-schema/comments.err
+++ b/tests/qapi-schema/comments.err
@@ -1 +0,0 @@
-<stdin>:2:33: Stray "#"
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
index d00491f..573541a 100644
--- a/tests/qapi-schema/comments.exit
+++ b/tests/qapi-schema/comments.exit
@@ -1 +1 @@
-1
+0
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
index e69de29..e3bd904 100644
--- a/tests/qapi-schema/comments.out
+++ b/tests/qapi-schema/comments.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
commit 28b8bd4c759389bdc8430acfa588a23e4a9a7fb8
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:42:00 2013 +0200

    qapi.py: Rename expr_eval to expr in parse_schema()
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-9-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 75fc282..f64b7b2 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -168,15 +168,15 @@ def parse_schema(fp):
 
     exprs = []
 
-    for expr_eval in schema.exprs:
-        if expr_eval.has_key('enum'):
-            add_enum(expr_eval['enum'])
-        elif expr_eval.has_key('union'):
-            add_union(expr_eval)
-            add_enum('%sKind' % expr_eval['union'])
-        elif expr_eval.has_key('type'):
-            add_struct(expr_eval)
-        exprs.append(expr_eval)
+    for expr in schema.exprs:
+        if expr.has_key('enum'):
+            add_enum(expr['enum'])
+        elif expr.has_key('union'):
+            add_union(expr)
+            add_enum('%sKind' % expr['union'])
+        elif expr.has_key('type'):
+            add_struct(expr)
+        exprs.append(expr)
 
     return exprs
 
commit 5f3cd2b717c949f3afb502fb4c81193eb18ce6aa
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:59 2013 +0200

    qapi.py: Fix diagnosing non-objects at a schema's top-level
    
    Report syntax error instead of crashing.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-8-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 12fb29a..75fc282 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -64,7 +64,7 @@ class QAPISchema:
         self.accept()
 
         while self.tok != None:
-            self.exprs.append(self.get_expr())
+            self.exprs.append(self.get_expr(False))
 
     def accept(self):
         while True:
@@ -117,7 +117,7 @@ class QAPISchema:
             if self.tok != ':':
                 raise QAPISchemaError(self, 'Expected ":"')
             self.accept()
-            expr[key] = self.get_expr()
+            expr[key] = self.get_expr(True)
             if self.tok == '}':
                 self.accept()
                 return expr
@@ -135,7 +135,7 @@ class QAPISchema:
         if not self.tok in [ '{', '[', "'" ]:
             raise QAPISchemaError(self, 'Expected "{", "[", "]" or string')
         while True:
-            expr.append(self.get_expr())
+            expr.append(self.get_expr(True))
             if self.tok == ']':
                 self.accept()
                 return expr
@@ -143,7 +143,9 @@ class QAPISchema:
                 raise QAPISchemaError(self, 'Expected "," or "]"')
             self.accept()
 
-    def get_expr(self):
+    def get_expr(self, nested):
+        if self.tok != '{' and not nested:
+            raise QAPISchemaError(self, 'Expected "{"')
         if self.tok == '{':
             self.accept()
             expr = self.get_members()
diff --git a/tests/qapi-schema/non-objects.err b/tests/qapi-schema/non-objects.err
index 48c849d..a6c2dc2 100644
--- a/tests/qapi-schema/non-objects.err
+++ b/tests/qapi-schema/non-objects.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.AttributeError'>
+<stdin>:1:1: Expected "{"
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
index 48c849d..a6c2dc2 100644
--- a/tests/qapi-schema/quoted-structural-chars.err
+++ b/tests/qapi-schema/quoted-structural-chars.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.AttributeError'>
+<stdin>:1:1: Expected "{"
commit 6974ccd542d11ae5fb1e56dd3d753f2de5cc097e
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:58 2013 +0200

    qapi.py: Fix schema parser to check syntax systematically
    
    Fixes at least the following parser bugs:
    
    * accepts any token in place of a colon
    
    * treats comma as optional
    
    * crashes when closing braces or brackets are missing
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-7-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 0b48a1e..12fb29a 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -106,24 +106,42 @@ class QAPISchema:
 
     def get_members(self):
         expr = OrderedDict()
-        while self.tok != '}':
+        if self.tok == '}':
+            self.accept()
+            return expr
+        if self.tok != "'":
+            raise QAPISchemaError(self, 'Expected string or "}"')
+        while True:
             key = self.val
             self.accept()
-            self.accept()        # :
+            if self.tok != ':':
+                raise QAPISchemaError(self, 'Expected ":"')
+            self.accept()
             expr[key] = self.get_expr()
-            if self.tok == ',':
+            if self.tok == '}':
                 self.accept()
-        self.accept()
-        return expr
+                return expr
+            if self.tok != ',':
+                raise QAPISchemaError(self, 'Expected "," or "}"')
+            self.accept()
+            if self.tok != "'":
+                raise QAPISchemaError(self, 'Expected string')
 
     def get_values(self):
         expr = []
-        while self.tok != ']':
+        if self.tok == ']':
+            self.accept()
+            return expr
+        if not self.tok in [ '{', '[', "'" ]:
+            raise QAPISchemaError(self, 'Expected "{", "[", "]" or string')
+        while True:
             expr.append(self.get_expr())
-            if self.tok == ',':
+            if self.tok == ']':
                 self.accept()
-        self.accept()
-        return expr
+                return expr
+            if self.tok != ',':
+                raise QAPISchemaError(self, 'Expected "," or "]"')
+            self.accept()
 
     def get_expr(self):
         if self.tok == '{':
@@ -132,9 +150,11 @@ class QAPISchema:
         elif self.tok == '[':
             self.accept()
             expr = self.get_values()
-        else:
+        elif self.tok == "'":
             expr = self.val
             self.accept()
+        else:
+            raise QAPISchemaError(self, 'Expected "{", "[" or string')
         return expr
 
 def parse_schema(fp):
diff --git a/tests/qapi-schema/missing-colon.err b/tests/qapi-schema/missing-colon.err
index e69de29..9f2a355 100644
--- a/tests/qapi-schema/missing-colon.err
+++ b/tests/qapi-schema/missing-colon.err
@@ -0,0 +1 @@
+<stdin>:1:10: Expected ":"
diff --git a/tests/qapi-schema/missing-colon.exit b/tests/qapi-schema/missing-colon.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/missing-colon.exit
+++ b/tests/qapi-schema/missing-colon.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
index e67068c..e69de29 100644
--- a/tests/qapi-schema/missing-colon.out
+++ b/tests/qapi-schema/missing-colon.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', None), ('data', ['good', 'bad', 'ugly'])])]
-[None]
-[]
diff --git a/tests/qapi-schema/missing-comma-list.err b/tests/qapi-schema/missing-comma-list.err
index e69de29..4fe0700 100644
--- a/tests/qapi-schema/missing-comma-list.err
+++ b/tests/qapi-schema/missing-comma-list.err
@@ -0,0 +1 @@
+<stdin>:2:20: Expected "," or "]"
diff --git a/tests/qapi-schema/missing-comma-list.exit b/tests/qapi-schema/missing-comma-list.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/missing-comma-list.exit
+++ b/tests/qapi-schema/missing-comma-list.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/missing-comma-list.out b/tests/qapi-schema/missing-comma-list.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/missing-comma-list.out
+++ b/tests/qapi-schema/missing-comma-list.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/missing-comma-object.err b/tests/qapi-schema/missing-comma-object.err
index e69de29..b0121b5 100644
--- a/tests/qapi-schema/missing-comma-object.err
+++ b/tests/qapi-schema/missing-comma-object.err
@@ -0,0 +1 @@
+<stdin>:2:3: Expected "," or "}"
diff --git a/tests/qapi-schema/missing-comma-object.exit b/tests/qapi-schema/missing-comma-object.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/missing-comma-object.exit
+++ b/tests/qapi-schema/missing-comma-object.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/missing-comma-object.out b/tests/qapi-schema/missing-comma-object.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/missing-comma-object.out
+++ b/tests/qapi-schema/missing-comma-object.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/trailing-comma-list.err b/tests/qapi-schema/trailing-comma-list.err
index e69de29..ff839a3 100644
--- a/tests/qapi-schema/trailing-comma-list.err
+++ b/tests/qapi-schema/trailing-comma-list.err
@@ -0,0 +1 @@
+<stdin>:2:36: Expected "{", "[" or string
diff --git a/tests/qapi-schema/trailing-comma-list.exit b/tests/qapi-schema/trailing-comma-list.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/trailing-comma-list.exit
+++ b/tests/qapi-schema/trailing-comma-list.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/trailing-comma-list.out b/tests/qapi-schema/trailing-comma-list.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/trailing-comma-list.out
+++ b/tests/qapi-schema/trailing-comma-list.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/trailing-comma-object.err b/tests/qapi-schema/trailing-comma-object.err
index e69de29..f540962 100644
--- a/tests/qapi-schema/trailing-comma-object.err
+++ b/tests/qapi-schema/trailing-comma-object.err
@@ -0,0 +1 @@
+<stdin>:2:38: Expected string
diff --git a/tests/qapi-schema/trailing-comma-object.exit b/tests/qapi-schema/trailing-comma-object.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/trailing-comma-object.exit
+++ b/tests/qapi-schema/trailing-comma-object.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/trailing-comma-object.out b/tests/qapi-schema/trailing-comma-object.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/trailing-comma-object.out
+++ b/tests/qapi-schema/trailing-comma-object.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/unclosed-list.err b/tests/qapi-schema/unclosed-list.err
index f9a9c2a..0e837a7 100644
--- a/tests/qapi-schema/unclosed-list.err
+++ b/tests/qapi-schema/unclosed-list.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.IndexError'>
+<stdin>:1:20: Expected "," or "]"
diff --git a/tests/qapi-schema/unclosed-object.err b/tests/qapi-schema/unclosed-object.err
index f9a9c2a..e6dc950 100644
--- a/tests/qapi-schema/unclosed-object.err
+++ b/tests/qapi-schema/unclosed-object.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.IndexError'>
+<stdin>:1:21: Expected "," or "}"
commit 9213aa5391f7c8d3766420d96888f1353af4c890
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:57 2013 +0200

    qapi.py: Reject invalid characters in schema file
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-6-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 342d16c..0b48a1e 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -101,6 +101,8 @@ class QAPISchema:
                 if self.cursor == len(self.src):
                     self.tok = None
                     return
+            elif not self.tok.isspace():
+                raise QAPISchemaError(self, 'Stray "%s"' % self.tok)
 
     def get_members(self):
         expr = OrderedDict()
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
index e69de29..4a82b26 100644
--- a/tests/qapi-schema/comments.err
+++ b/tests/qapi-schema/comments.err
@@ -0,0 +1 @@
+<stdin>:2:33: Stray "#"
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/comments.exit
+++ b/tests/qapi-schema/comments.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/comments.out
+++ b/tests/qapi-schema/comments.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
diff --git a/tests/qapi-schema/funny-char.err b/tests/qapi-schema/funny-char.err
index e69de29..d3dd293 100644
--- a/tests/qapi-schema/funny-char.err
+++ b/tests/qapi-schema/funny-char.err
@@ -0,0 +1 @@
+<stdin>:2:36: Stray ";"
diff --git a/tests/qapi-schema/funny-char.exit b/tests/qapi-schema/funny-char.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/funny-char.exit
+++ b/tests/qapi-schema/funny-char.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/funny-char.out b/tests/qapi-schema/funny-char.out
index e3bd904..e69de29 100644
--- a/tests/qapi-schema/funny-char.out
+++ b/tests/qapi-schema/funny-char.out
@@ -1,3 +0,0 @@
-[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
-['Status']
-[]
commit 2caba36cc61ee3993334bc423f0852f8006fdfcf
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:56 2013 +0200

    qapi.py: Decent syntax error reporting
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-5-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 58e315b..342d16c 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -12,6 +12,7 @@
 # See the COPYING.LIB file in the top-level directory.
 
 from ordereddict import OrderedDict
+import sys
 
 builtin_types = [
     'str', 'int', 'number', 'bool',
@@ -34,6 +35,23 @@ builtin_type_qtypes = {
     'uint64':   'QTYPE_QINT',
 }
 
+class QAPISchemaError(Exception):
+    def __init__(self, schema, msg):
+        self.fp = schema.fp
+        self.msg = msg
+        self.line = self.col = 1
+        for ch in schema.src[0:schema.pos]:
+            if ch == '\n':
+                self.line += 1
+                self.col = 1
+            elif ch == '\t':
+                self.col = (self.col + 7) % 8 + 1
+            else:
+                self.col += 1
+
+    def __str__(self):
+        return "%s:%s:%s: %s" % (self.fp.name, self.line, self.col, self.msg)
+
 class QAPISchema:
 
     def __init__(self, fp):
@@ -52,6 +70,7 @@ class QAPISchema:
         while True:
             bol = self.cursor == 0 or self.src[self.cursor-1] == '\n'
             self.tok = self.src[self.cursor]
+            self.pos = self.cursor
             self.cursor += 1
             self.val = None
 
@@ -66,7 +85,8 @@ class QAPISchema:
                     ch = self.src[self.cursor]
                     self.cursor += 1
                     if ch == '\n':
-                        raise Exception("Mismatched quotes")
+                        raise QAPISchemaError(self,
+                                              'Missing terminating "\'"')
                     if esc:
                         string += ch
                         esc = False
@@ -116,7 +136,12 @@ class QAPISchema:
         return expr
 
 def parse_schema(fp):
-    schema = QAPISchema(fp)
+    try:
+        schema = QAPISchema(fp)
+    except QAPISchemaError as e:
+        print >>sys.stderr, e
+        exit(1)
+
     exprs = []
 
     for expr_eval in schema.exprs:
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
index 3280eff..b3d1e1d 100644
--- a/tests/qapi-schema/test-qapi.py
+++ b/tests/qapi-schema/test-qapi.py
@@ -16,6 +16,8 @@ import sys
 
 try:
     exprs = parse_schema(sys.stdin)
+except SystemExit:
+    raise
 except:
     print >>sys.stderr, "Crashed:", sys.exc_info()[0]
     exit(1)
diff --git a/tests/qapi-schema/unclosed-string.err b/tests/qapi-schema/unclosed-string.err
index 5af46c2..948d883 100644
--- a/tests/qapi-schema/unclosed-string.err
+++ b/tests/qapi-schema/unclosed-string.err
@@ -1 +1 @@
-Crashed: <type 'exceptions.Exception'>
+<stdin>:1:11: Missing terminating "'"
commit c7a3f25200c8692e969f21c7f2555630ec0d0d30
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:55 2013 +0200

    qapi.py: Restructure lexer and parser
    
    The parser has a rather unorthodox structure:
    
        Until EOF:
    
            Read a section:
    
                Generator function get_expr() yields one section after the
                other, as a string.  An unindented, non-empty line that
                isn't a comment starts a new section.
    
            Lexing:
    
                Split section into a list of tokens (strings), with help
                of generator function tokenize().
    
            Parsing:
    
                Parse the first expression from the list of tokens, with
                parse(), throw away any remaining tokens.
    
                In parse_schema(): record value of an enum, union or
                struct key (if any) in the appropriate global table,
                append expression to the list of expressions.
    
        Return list of expressions.
    
    Known issues:
    
    (1) Indentation is significant, unlike in real JSON.
    
    (2) Neither lexer nor parser have any idea of source positions.  Error
        reporting is hard, let's go shopping.
    
    (3) The one error we bother to detect, we "report" via raise.
    
    (4) The lexer silently ignores invalid characters.
    
    (5) If everything in a section gets ignored, the parser crashes.
    
    (6) The lexer treats a string containing a structural character exactly
        like the structural character.
    
    (7) Tokens trailing the first expression in a section are silently
        ignored.
    
    (8) The parser accepts any token in place of a colon.
    
    (9) The parser treats comma as optional.
    
    (10) parse() crashes on unexpected EOF.
    
    (11) parse_schema() crashes when a section's expression isn't a JSON
        object.
    
    Replace this piece of original art by a thoroughly unoriginal design.
    Takes care of (1), (2), (5), (6) and (7), and lays the groundwork for
    addressing the others.  Generated source files remain unchanged.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/scripts/qapi.py b/scripts/qapi.py
index 38c808e..58e315b 100644
--- a/scripts/qapi.py
+++ b/scripts/qapi.py
@@ -2,9 +2,11 @@
 # QAPI helper library
 #
 # Copyright IBM, Corp. 2011
+# Copyright (c) 2013 Red Hat Inc.
 #
 # Authors:
 #  Anthony Liguori <aliguori at us.ibm.com>
+#  Markus Armbruster <armbru at redhat.com>
 #
 # This work is licensed under the terms of the GNU GPLv2.
 # See the COPYING.LIB file in the top-level directory.
@@ -32,91 +34,92 @@ builtin_type_qtypes = {
     'uint64':   'QTYPE_QINT',
 }
 
-def tokenize(data):
-    while len(data):
-        ch = data[0]
-        data = data[1:]
-        if ch in ['{', '}', ':', ',', '[', ']']:
-            yield ch
-        elif ch in ' \n':
-            None
-        elif ch == "'":
-            string = ''
-            esc = False
-            while True:
-                if (data == ''):
-                    raise Exception("Mismatched quotes")
-                ch = data[0]
-                data = data[1:]
-                if esc:
-                    string += ch
-                    esc = False
-                elif ch == "\\":
-                    esc = True
-                elif ch == "'":
-                    break
-                else:
-                    string += ch
-            yield string
-
-def parse(tokens):
-    if tokens[0] == '{':
-        ret = OrderedDict()
-        tokens = tokens[1:]
-        while tokens[0] != '}':
-            key = tokens[0]
-            tokens = tokens[1:]
-
-            tokens = tokens[1:] # :
-
-            value, tokens = parse(tokens)
-
-            if tokens[0] == ',':
-                tokens = tokens[1:]
-
-            ret[key] = value
-        tokens = tokens[1:]
-        return ret, tokens
-    elif tokens[0] == '[':
-        ret = []
-        tokens = tokens[1:]
-        while tokens[0] != ']':
-            value, tokens = parse(tokens)
-            if tokens[0] == ',':
-                tokens = tokens[1:]
-            ret.append(value)
-        tokens = tokens[1:]
-        return ret, tokens
-    else:
-        return tokens[0], tokens[1:]
-
-def evaluate(string):
-    return parse(map(lambda x: x, tokenize(string)))[0]
-
-def get_expr(fp):
-    expr = ''
-
-    for line in fp:
-        if line.startswith('#') or line == '\n':
-            continue
-
-        if line.startswith(' '):
-            expr += line
-        elif expr:
-            yield expr
-            expr = line
+class QAPISchema:
+
+    def __init__(self, fp):
+        self.fp = fp
+        self.src = fp.read()
+        if self.src == '' or self.src[-1] != '\n':
+            self.src += '\n'
+        self.cursor = 0
+        self.exprs = []
+        self.accept()
+
+        while self.tok != None:
+            self.exprs.append(self.get_expr())
+
+    def accept(self):
+        while True:
+            bol = self.cursor == 0 or self.src[self.cursor-1] == '\n'
+            self.tok = self.src[self.cursor]
+            self.cursor += 1
+            self.val = None
+
+            if self.tok == '#' and bol:
+                self.cursor = self.src.find('\n', self.cursor)
+            elif self.tok in ['{', '}', ':', ',', '[', ']']:
+                return
+            elif self.tok == "'":
+                string = ''
+                esc = False
+                while True:
+                    ch = self.src[self.cursor]
+                    self.cursor += 1
+                    if ch == '\n':
+                        raise Exception("Mismatched quotes")
+                    if esc:
+                        string += ch
+                        esc = False
+                    elif ch == "\\":
+                        esc = True
+                    elif ch == "'":
+                        self.val = string
+                        return
+                    else:
+                        string += ch
+            elif self.tok == '\n':
+                if self.cursor == len(self.src):
+                    self.tok = None
+                    return
+
+    def get_members(self):
+        expr = OrderedDict()
+        while self.tok != '}':
+            key = self.val
+            self.accept()
+            self.accept()        # :
+            expr[key] = self.get_expr()
+            if self.tok == ',':
+                self.accept()
+        self.accept()
+        return expr
+
+    def get_values(self):
+        expr = []
+        while self.tok != ']':
+            expr.append(self.get_expr())
+            if self.tok == ',':
+                self.accept()
+        self.accept()
+        return expr
+
+    def get_expr(self):
+        if self.tok == '{':
+            self.accept()
+            expr = self.get_members()
+        elif self.tok == '[':
+            self.accept()
+            expr = self.get_values()
         else:
-            expr += line
-
-    if expr:
-        yield expr
+            expr = self.val
+            self.accept()
+        return expr
 
 def parse_schema(fp):
+    schema = QAPISchema(fp)
     exprs = []
 
-    for expr in get_expr(fp):
-        expr_eval = evaluate(expr)
-
+    for expr_eval in schema.exprs:
         if expr_eval.has_key('enum'):
             add_enum(expr_eval['enum'])
         elif expr_eval.has_key('union'):
diff --git a/tests/qapi-schema/indented-expr.out b/tests/qapi-schema/indented-expr.out
index 98ae692..98af89a 100644
--- a/tests/qapi-schema/indented-expr.out
+++ b/tests/qapi-schema/indented-expr.out
@@ -1,3 +1,3 @@
-[OrderedDict([('id', 'eins')])]
+[OrderedDict([('id', 'eins')]), OrderedDict([('id', 'zwei')])]
 []
 []
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
index 50f827e..e67068c 100644
--- a/tests/qapi-schema/missing-colon.out
+++ b/tests/qapi-schema/missing-colon.out
@@ -1,3 +1,3 @@
-[OrderedDict([('enum', ','), ('data', ['good', 'bad', 'ugly'])])]
-[',']
+[OrderedDict([('enum', None), ('data', ['good', 'bad', 'ugly'])])]
+[None]
 []
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
index e69de29..48c849d 100644
--- a/tests/qapi-schema/quoted-structural-chars.err
+++ b/tests/qapi-schema/quoted-structural-chars.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.AttributeError'>
diff --git a/tests/qapi-schema/quoted-structural-chars.exit b/tests/qapi-schema/quoted-structural-chars.exit
index 573541a..d00491f 100644
--- a/tests/qapi-schema/quoted-structural-chars.exit
+++ b/tests/qapi-schema/quoted-structural-chars.exit
@@ -1 +1 @@
-0
+1
diff --git a/tests/qapi-schema/quoted-structural-chars.out b/tests/qapi-schema/quoted-structural-chars.out
index 85405be..e69de29 100644
--- a/tests/qapi-schema/quoted-structural-chars.out
+++ b/tests/qapi-schema/quoted-structural-chars.out
@@ -1,3 +0,0 @@
-[OrderedDict([('key1', 'value1'), ('key2', [])])]
-[]
-[]
commit 4f193e34c6c41abdd06c134e584312077def2bda
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:54 2013 +0200

    tests: Use qapi-schema-test.json as schema parser test
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1374939721-7876-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema-test.json b/qapi-schema-test.json
deleted file mode 100644
index 4434fa3..0000000
--- a/qapi-schema-test.json
+++ /dev/null
@@ -1,53 +0,0 @@
-# *-*- Mode: Python -*-*
-
-# for testing enums
-{ 'enum': 'EnumOne',
-  'data': [ 'value1', 'value2', 'value3' ] }
-{ 'type': 'NestedEnumsOne',
-  'data': { 'enum1': 'EnumOne', '*enum2': 'EnumOne', 'enum3': 'EnumOne', '*enum4': 'EnumOne' } }
-
-# for testing nested structs
-{ 'type': 'UserDefOne',
-  'data': { 'integer': 'int', 'string': 'str', '*enum1': 'EnumOne' } }
-
-{ 'type': 'UserDefTwo',
-  'data': { 'string': 'str',
-            'dict': { 'string': 'str',
-                      'dict': { 'userdef': 'UserDefOne', 'string': 'str' },
-                      '*dict2': { 'userdef': 'UserDefOne', 'string': 'str' } } } }
-
-{ 'type': 'UserDefNested',
-  'data': { 'string0': 'str',
-            'dict1': { 'string1': 'str',
-                       'dict2': { 'userdef1': 'UserDefOne', 'string2': 'str' },
-                       '*dict3': { 'userdef2': 'UserDefOne', 'string3': 'str' } } } }
-
-# for testing unions
-{ 'type': 'UserDefA',
-  'data': { 'boolean': 'bool' } }
-
-{ 'type': 'UserDefB',
-  'data': { 'integer': 'int' } }
-
-{ 'union': 'UserDefUnion',
-  'data': { 'a' : 'UserDefA', 'b' : 'UserDefB' } }
-
-# for testing native lists
-{ 'union': 'UserDefNativeListUnion',
-  'data': { 'integer': ['int'],
-            's8': ['int8'],
-            's16': ['int16'],
-            's32': ['int32'],
-            's64': ['int64'],
-            'u8': ['uint8'],
-            'u16': ['uint16'],
-            'u32': ['uint32'],
-            'u64': ['uint64'],
-            'number': ['number'],
-            'boolean': ['bool'],
-            'string': ['str'] } }
-
-# testing commands
-{ 'command': 'user_def_cmd', 'data': {} }
-{ 'command': 'user_def_cmd1', 'data': {'ud1a': 'UserDefOne'} }
-{ 'command': 'user_def_cmd2', 'data': {'ud1a': 'UserDefOne', 'ud1b': 'UserDefOne'}, 'returns': 'UserDefTwo' }
diff --git a/tests/Makefile b/tests/Makefile
index ddb957c..d044908 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -87,7 +87,7 @@ check-qapi-schema-y := $(addprefix tests/qapi-schema/, \
         comments.json empty.json funny-char.json indented-expr.json \
         missing-colon.json missing-comma-list.json \
         missing-comma-object.json non-objects.json \
-        quoted-structural-chars.json \
+        qapi-schema-test.json quoted-structural-chars.json \
         trailing-comma-list.json trailing-comma-object.json \
         unclosed-list.json unclosed-object.json unclosed-string.json)
 
@@ -125,13 +125,13 @@ tests/test-cutils$(EXESUF): tests/test-cutils.o util/cutils.o
 tests/test-int128$(EXESUF): tests/test-int128.o
 
 tests/test-qapi-types.c tests/test-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 tests/test-qapi-visit.c tests/test-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 tests/test-qmp-commands.h tests/test-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
+$(SRC_PATH)/tests/qapi-schema/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o tests -p "test-" < $<, "  GEN   $@")
 
 tests/test-string-output-visitor$(EXESUF): tests/test-string-output-visitor.o $(test-qapi-obj-y) libqemuutil.a libqemustub.a
diff --git a/tests/qapi-schema/qapi-schema-test.err b/tests/qapi-schema/qapi-schema-test.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/qapi-schema-test.exit b/tests/qapi-schema/qapi-schema-test.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/qapi-schema-test.json b/tests/qapi-schema/qapi-schema-test.json
new file mode 100644
index 0000000..4434fa3
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.json
@@ -0,0 +1,53 @@
+# *-*- Mode: Python -*-*
+
+# for testing enums
+{ 'enum': 'EnumOne',
+  'data': [ 'value1', 'value2', 'value3' ] }
+{ 'type': 'NestedEnumsOne',
+  'data': { 'enum1': 'EnumOne', '*enum2': 'EnumOne', 'enum3': 'EnumOne', '*enum4': 'EnumOne' } }
+
+# for testing nested structs
+{ 'type': 'UserDefOne',
+  'data': { 'integer': 'int', 'string': 'str', '*enum1': 'EnumOne' } }
+
+{ 'type': 'UserDefTwo',
+  'data': { 'string': 'str',
+            'dict': { 'string': 'str',
+                      'dict': { 'userdef': 'UserDefOne', 'string': 'str' },
+                      '*dict2': { 'userdef': 'UserDefOne', 'string': 'str' } } } }
+
+{ 'type': 'UserDefNested',
+  'data': { 'string0': 'str',
+            'dict1': { 'string1': 'str',
+                       'dict2': { 'userdef1': 'UserDefOne', 'string2': 'str' },
+                       '*dict3': { 'userdef2': 'UserDefOne', 'string3': 'str' } } } }
+
+# for testing unions
+{ 'type': 'UserDefA',
+  'data': { 'boolean': 'bool' } }
+
+{ 'type': 'UserDefB',
+  'data': { 'integer': 'int' } }
+
+{ 'union': 'UserDefUnion',
+  'data': { 'a' : 'UserDefA', 'b' : 'UserDefB' } }
+
+# for testing native lists
+{ 'union': 'UserDefNativeListUnion',
+  'data': { 'integer': ['int'],
+            's8': ['int8'],
+            's16': ['int16'],
+            's32': ['int32'],
+            's64': ['int64'],
+            'u8': ['uint8'],
+            'u16': ['uint16'],
+            'u32': ['uint32'],
+            'u64': ['uint64'],
+            'number': ['number'],
+            'boolean': ['bool'],
+            'string': ['str'] } }
+
+# testing commands
+{ 'command': 'user_def_cmd', 'data': {} }
+{ 'command': 'user_def_cmd1', 'data': {'ud1a': 'UserDefOne'} }
+{ 'command': 'user_def_cmd2', 'data': {'ud1a': 'UserDefOne', 'ud1b': 'UserDefOne'}, 'returns': 'UserDefTwo' }
diff --git a/tests/qapi-schema/qapi-schema-test.out b/tests/qapi-schema/qapi-schema-test.out
new file mode 100644
index 0000000..fb00344
--- /dev/null
+++ b/tests/qapi-schema/qapi-schema-test.out
@@ -0,0 +1,19 @@
+[OrderedDict([('enum', 'EnumOne'), ('data', ['value1', 'value2', 'value3'])]),
+ OrderedDict([('type', 'NestedEnumsOne'), ('data', OrderedDict([('enum1', 'EnumOne'), ('*enum2', 'EnumOne'), ('enum3', 'EnumOne'), ('*enum4', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefOne'), ('data', OrderedDict([('integer', 'int'), ('string', 'str'), ('*enum1', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefTwo'), ('data', OrderedDict([('string', 'str'), ('dict', OrderedDict([('string', 'str'), ('dict', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')])), ('*dict2', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefNested'), ('data', OrderedDict([('string0', 'str'), ('dict1', OrderedDict([('string1', 'str'), ('dict2', OrderedDict([('userdef1', 'UserDefOne'), ('string2', 'str')])), ('*dict3', OrderedDict([('userdef2', 'UserDefOne'), ('string3', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefA'), ('data', OrderedDict([('boolean', 'bool')]))]),
+ OrderedDict([('type', 'UserDefB'), ('data', OrderedDict([('integer', 'int')]))]),
+ OrderedDict([('union', 'UserDefUnion'), ('data', OrderedDict([('a', 'UserDefA'), ('b', 'UserDefB')]))]),
+ OrderedDict([('union', 'UserDefNativeListUnion'), ('data', OrderedDict([('integer', ['int']), ('s8', ['int8']), ('s16', ['int16']), ('s32', ['int32']), ('s64', ['int64']), ('u8', ['uint8']), ('u16', ['uint16']), ('u32', ['uint32']), ('u64', ['uint64']), ('number', ['number']), ('boolean', ['bool']), ('string', ['str'])]))]),
+ OrderedDict([('command', 'user_def_cmd'), ('data', OrderedDict())]),
+ OrderedDict([('command', 'user_def_cmd1'), ('data', OrderedDict([('ud1a', 'UserDefOne')]))]),
+ OrderedDict([('command', 'user_def_cmd2'), ('data', OrderedDict([('ud1a', 'UserDefOne'), ('ud1b', 'UserDefOne')])), ('returns', 'UserDefTwo')])]
+['EnumOne', 'UserDefUnionKind', 'UserDefNativeListUnionKind']
+[OrderedDict([('type', 'NestedEnumsOne'), ('data', OrderedDict([('enum1', 'EnumOne'), ('*enum2', 'EnumOne'), ('enum3', 'EnumOne'), ('*enum4', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefOne'), ('data', OrderedDict([('integer', 'int'), ('string', 'str'), ('*enum1', 'EnumOne')]))]),
+ OrderedDict([('type', 'UserDefTwo'), ('data', OrderedDict([('string', 'str'), ('dict', OrderedDict([('string', 'str'), ('dict', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')])), ('*dict2', OrderedDict([('userdef', 'UserDefOne'), ('string', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefNested'), ('data', OrderedDict([('string0', 'str'), ('dict1', OrderedDict([('string1', 'str'), ('dict2', OrderedDict([('userdef1', 'UserDefOne'), ('string2', 'str')])), ('*dict3', OrderedDict([('userdef2', 'UserDefOne'), ('string3', 'str')]))]))]))]),
+ OrderedDict([('type', 'UserDefA'), ('data', OrderedDict([('boolean', 'bool')]))]),
+ OrderedDict([('type', 'UserDefB'), ('data', OrderedDict([('integer', 'int')]))])]
commit 98626572f18ddc61c08588c32a1773bc91f8624e
Author: Markus Armbruster <armbru at redhat.com>
Date:   Sat Jul 27 17:41:53 2013 +0200

    tests: QAPI schema parser tests
    
    The parser handles erroneous input badly.  To be improved shortly.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1374939721-7876-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index 1c0cc81..f0761ea 100755
--- a/configure
+++ b/configure
@@ -4502,7 +4502,7 @@ if [ "$dtc_internal" = "yes" ]; then
 fi
 
 # build tree in object directory in case the source is not in the current directory
-DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos"
+DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos tests/qapi-schema"
 DIRS="$DIRS pc-bios/optionrom pc-bios/spapr-rtas pc-bios/s390-ccw"
 DIRS="$DIRS roms/seabios roms/vgabios"
 DIRS="$DIRS qapi-generated"
diff --git a/tests/Makefile b/tests/Makefile
index cdbb79e..ddb957c 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -83,6 +83,14 @@ gcov-files-arm-y += hw/tmp105.c
 check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
 check-qtest-ppc64-y += tests/boot-order-test$(EXESUF)
 
+check-qapi-schema-y := $(addprefix tests/qapi-schema/, \
+        comments.json empty.json funny-char.json indented-expr.json \
+        missing-colon.json missing-comma-list.json \
+        missing-comma-object.json non-objects.json \
+        quoted-structural-chars.json \
+        trailing-comma-list.json trailing-comma-object.json \
+        unclosed-list.json unclosed-object.json unclosed-string.json)
+
 GENERATED_HEADERS += tests/test-qapi-types.h tests/test-qapi-visit.h tests/test-qmp-commands.h
 
 test-obj-y = tests/check-qint.o tests/check-qstring.o tests/check-qdict.o \
@@ -171,6 +179,7 @@ check-help:
 	@echo " make check-qtest-TARGET   Run qtest tests for given target"
 	@echo " make check-qtest          Run qtest tests"
 	@echo " make check-unit           Run qobject tests"
+	@echo " make check-qapi-schema    Run QAPI schema tests"
 	@echo " make check-block          Run block tests"
 	@echo " make check-report.html    Generates an HTML test report"
 	@echo
@@ -233,13 +242,24 @@ check-report.html: check-report.xml
 check-tests/qemu-iotests-quick.sh: tests/qemu-iotests-quick.sh qemu-img$(EXESUF) qemu-io$(EXESUF)
 	$<
 
+.PHONY: check-tests/test-qapi.py
+check-tests/test-qapi.py: tests/test-qapi.py
+
+.PHONY: $(patsubst %, check-%, $(check-qapi-schema-y))
+$(patsubst %, check-%, $(check-qapi-schema-y)): check-%.json: $(SRC_PATH)/%.json
+	$(call quiet-command, PYTHONPATH=$(SRC_PATH)/scripts $(PYTHON) $(SRC_PATH)/tests/qapi-schema/test-qapi.py <$^ >$*.out 2>$*.err; echo $$? >$*.exit, "  TEST  $*.out")
+	@diff -q $(SRC_PATH)/$*.out $*.out
+	@diff -q $(SRC_PATH)/$*.err $*.err
+	@diff -q $(SRC_PATH)/$*.exit $*.exit
+
 # Consolidated targets
 
-.PHONY: check-qtest check-unit check
+.PHONY: check-qapi-schema check-qtest check-unit check
+check-qapi-schema: $(patsubst %,check-%, $(check-qapi-schema-y))
 check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
 check-unit: $(patsubst %,check-%, $(check-unit-y))
 check-block: $(patsubst %,check-%, $(check-block-y))
-check: check-unit check-qtest
+check: check-qapi-schema check-unit check-qtest
 
 -include $(wildcard tests/*.d)
 -include $(wildcard tests/libqos/*.d)
diff --git a/tests/qapi-schema/comments.err b/tests/qapi-schema/comments.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/comments.exit b/tests/qapi-schema/comments.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/comments.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/comments.json b/tests/qapi-schema/comments.json
new file mode 100644
index 0000000..e643f3a
--- /dev/null
+++ b/tests/qapi-schema/comments.json
@@ -0,0 +1,4 @@
+# Unindented comment
+{ 'enum': 'Status',             # Comment to the right of code
+  # Indented comment
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/comments.out b/tests/qapi-schema/comments.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/comments.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/empty.err b/tests/qapi-schema/empty.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/empty.exit b/tests/qapi-schema/empty.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/empty.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/empty.json b/tests/qapi-schema/empty.json
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/empty.out b/tests/qapi-schema/empty.out
new file mode 100644
index 0000000..b7f89a4
--- /dev/null
+++ b/tests/qapi-schema/empty.out
@@ -0,0 +1,3 @@
+[]
+[]
+[]
diff --git a/tests/qapi-schema/funny-char.err b/tests/qapi-schema/funny-char.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/funny-char.exit b/tests/qapi-schema/funny-char.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/funny-char.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/funny-char.json b/tests/qapi-schema/funny-char.json
new file mode 100644
index 0000000..d4973a2
--- /dev/null
+++ b/tests/qapi-schema/funny-char.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly' ]; }
diff --git a/tests/qapi-schema/funny-char.out b/tests/qapi-schema/funny-char.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/funny-char.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/indented-expr.err b/tests/qapi-schema/indented-expr.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/indented-expr.exit b/tests/qapi-schema/indented-expr.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/indented-expr.json b/tests/qapi-schema/indented-expr.json
new file mode 100644
index 0000000..d80af60
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.json
@@ -0,0 +1,2 @@
+{ 'id' : 'eins' }
+ { 'id' : 'zwei' }
diff --git a/tests/qapi-schema/indented-expr.out b/tests/qapi-schema/indented-expr.out
new file mode 100644
index 0000000..98ae692
--- /dev/null
+++ b/tests/qapi-schema/indented-expr.out
@@ -0,0 +1,3 @@
+[OrderedDict([('id', 'eins')])]
+[]
+[]
diff --git a/tests/qapi-schema/missing-colon.err b/tests/qapi-schema/missing-colon.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/missing-colon.exit b/tests/qapi-schema/missing-colon.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/missing-colon.json b/tests/qapi-schema/missing-colon.json
new file mode 100644
index 0000000..6fc27ce
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.json
@@ -0,0 +1,2 @@
+{ 'enum' 'Status',
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-colon.out b/tests/qapi-schema/missing-colon.out
new file mode 100644
index 0000000..50f827e
--- /dev/null
+++ b/tests/qapi-schema/missing-colon.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', ','), ('data', ['good', 'bad', 'ugly'])])]
+[',']
+[]
diff --git a/tests/qapi-schema/missing-comma-list.err b/tests/qapi-schema/missing-comma-list.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/missing-comma-list.exit b/tests/qapi-schema/missing-comma-list.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/missing-comma-list.json b/tests/qapi-schema/missing-comma-list.json
new file mode 100644
index 0000000..1af39b2
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good' 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-comma-list.out b/tests/qapi-schema/missing-comma-list.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-list.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/missing-comma-object.err b/tests/qapi-schema/missing-comma-object.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/missing-comma-object.exit b/tests/qapi-schema/missing-comma-object.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/missing-comma-object.json b/tests/qapi-schema/missing-comma-object.json
new file mode 100644
index 0000000..50f5178
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status'
+  'data': [ 'good', 'bad', 'ugly' ] }
diff --git a/tests/qapi-schema/missing-comma-object.out b/tests/qapi-schema/missing-comma-object.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/missing-comma-object.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/non-objects.err b/tests/qapi-schema/non-objects.err
new file mode 100644
index 0000000..48c849d
--- /dev/null
+++ b/tests/qapi-schema/non-objects.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.AttributeError'>
diff --git a/tests/qapi-schema/non-objects.exit b/tests/qapi-schema/non-objects.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/non-objects.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/non-objects.json b/tests/qapi-schema/non-objects.json
new file mode 100644
index 0000000..f3fa851
--- /dev/null
+++ b/tests/qapi-schema/non-objects.json
@@ -0,0 +1,2 @@
+'string'
+[ ]
diff --git a/tests/qapi-schema/non-objects.out b/tests/qapi-schema/non-objects.out
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/quoted-structural-chars.err b/tests/qapi-schema/quoted-structural-chars.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/quoted-structural-chars.exit b/tests/qapi-schema/quoted-structural-chars.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/quoted-structural-chars.json b/tests/qapi-schema/quoted-structural-chars.json
new file mode 100644
index 0000000..9fe657a
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.json
@@ -0,0 +1 @@
+'{' 'key1' ':' 'value1' ',' 'key2' ':' '[' ']' '}'
diff --git a/tests/qapi-schema/quoted-structural-chars.out b/tests/qapi-schema/quoted-structural-chars.out
new file mode 100644
index 0000000..85405be
--- /dev/null
+++ b/tests/qapi-schema/quoted-structural-chars.out
@@ -0,0 +1,3 @@
+[OrderedDict([('key1', 'value1'), ('key2', [])])]
+[]
+[]
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
new file mode 100644
index 0000000..3280eff
--- /dev/null
+++ b/tests/qapi-schema/test-qapi.py
@@ -0,0 +1,25 @@
+#
+# QAPI parser test harness
+#
+# Copyright (c) 2013 Red Hat Inc.
+#
+# Authors:
+#  Markus Armbruster <armbru at redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or later.
+# See the COPYING file in the top-level directory.
+#
+
+from qapi import *
+from pprint import pprint
+import sys
+
+try:
+    exprs = parse_schema(sys.stdin)
+except:
+    print >>sys.stderr, "Crashed:", sys.exc_info()[0]
+    exit(1)
+
+pprint(exprs)
+pprint(enum_types)
+pprint(struct_types)
diff --git a/tests/qapi-schema/trailing-comma-list.err b/tests/qapi-schema/trailing-comma-list.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/trailing-comma-list.exit b/tests/qapi-schema/trailing-comma-list.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/trailing-comma-list.json b/tests/qapi-schema/trailing-comma-list.json
new file mode 100644
index 0000000..9b0c8bd
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly', ] }
diff --git a/tests/qapi-schema/trailing-comma-list.out b/tests/qapi-schema/trailing-comma-list.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-list.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/trailing-comma-object.err b/tests/qapi-schema/trailing-comma-object.err
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/trailing-comma-object.exit b/tests/qapi-schema/trailing-comma-object.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/qapi-schema/trailing-comma-object.json b/tests/qapi-schema/trailing-comma-object.json
new file mode 100644
index 0000000..bbaea55
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.json
@@ -0,0 +1,2 @@
+{ 'enum': 'Status',
+  'data': [ 'good', 'bad', 'ugly' ], }
diff --git a/tests/qapi-schema/trailing-comma-object.out b/tests/qapi-schema/trailing-comma-object.out
new file mode 100644
index 0000000..e3bd904
--- /dev/null
+++ b/tests/qapi-schema/trailing-comma-object.out
@@ -0,0 +1,3 @@
+[OrderedDict([('enum', 'Status'), ('data', ['good', 'bad', 'ugly'])])]
+['Status']
+[]
diff --git a/tests/qapi-schema/unclosed-list.err b/tests/qapi-schema/unclosed-list.err
new file mode 100644
index 0000000..f9a9c2a
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.IndexError'>
diff --git a/tests/qapi-schema/unclosed-list.exit b/tests/qapi-schema/unclosed-list.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-list.json b/tests/qapi-schema/unclosed-list.json
new file mode 100644
index 0000000..e3e9566
--- /dev/null
+++ b/tests/qapi-schema/unclosed-list.json
@@ -0,0 +1 @@
+{ 'key': [ 'value' }
diff --git a/tests/qapi-schema/unclosed-list.out b/tests/qapi-schema/unclosed-list.out
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/unclosed-object.err b/tests/qapi-schema/unclosed-object.err
new file mode 100644
index 0000000..f9a9c2a
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.IndexError'>
diff --git a/tests/qapi-schema/unclosed-object.exit b/tests/qapi-schema/unclosed-object.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-object.json b/tests/qapi-schema/unclosed-object.json
new file mode 100644
index 0000000..8ac069d
--- /dev/null
+++ b/tests/qapi-schema/unclosed-object.json
@@ -0,0 +1 @@
+{ 'key': [ 'value' ]
diff --git a/tests/qapi-schema/unclosed-object.out b/tests/qapi-schema/unclosed-object.out
new file mode 100644
index 0000000..e69de29
diff --git a/tests/qapi-schema/unclosed-string.err b/tests/qapi-schema/unclosed-string.err
new file mode 100644
index 0000000..5af46c2
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.err
@@ -0,0 +1 @@
+Crashed: <type 'exceptions.Exception'>
diff --git a/tests/qapi-schema/unclosed-string.exit b/tests/qapi-schema/unclosed-string.exit
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/qapi-schema/unclosed-string.json b/tests/qapi-schema/unclosed-string.json
new file mode 100644
index 0000000..8c16b6b
--- /dev/null
+++ b/tests/qapi-schema/unclosed-string.json
@@ -0,0 +1,2 @@
+{ 'text': 'lorem ips
+}
diff --git a/tests/qapi-schema/unclosed-string.out b/tests/qapi-schema/unclosed-string.out
new file mode 100644
index 0000000..e69de29
commit 55d5d04884305e17b24f378a9ec616bf7354c1ca
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Sun Jul 28 14:57:22 2013 +0200

    memory: add tracepoints for MMIO reads/writes
    
    This is quite handy to debug softmmu targets.
    
    Reviewed-by: Andreas Faerber <afaerber at suse.de>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1375016242-32651-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/memory.c b/memory.c
index 1494e95..ac6f3c6 100644
--- a/memory.c
+++ b/memory.c
@@ -19,6 +19,7 @@
 #include "qemu/bitops.h"
 #include "qom/object.h"
 #include "sysemu/kvm.h"
+#include "trace.h"
 #include <assert.h>
 
 #include "exec/memory-internal.h"
@@ -388,6 +389,7 @@ static void memory_region_oldmmio_read_accessor(MemoryRegion *mr,
     uint64_t tmp;
 
     tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr);
+    trace_memory_region_ops_read(mr, addr, tmp, size);
     *value |= (tmp & mask) << shift;
 }
 
@@ -404,6 +406,7 @@ static void memory_region_read_accessor(MemoryRegion *mr,
         qemu_flush_coalesced_mmio_buffer();
     }
     tmp = mr->ops->read(mr->opaque, addr, size);
+    trace_memory_region_ops_read(mr, addr, tmp, size);
     *value |= (tmp & mask) << shift;
 }
 
@@ -417,6 +420,7 @@ static void memory_region_oldmmio_write_accessor(MemoryRegion *mr,
     uint64_t tmp;
 
     tmp = (*value >> shift) & mask;
+    trace_memory_region_ops_write(mr, addr, tmp, size);
     mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, tmp);
 }
 
@@ -433,6 +437,7 @@ static void memory_region_write_accessor(MemoryRegion *mr,
         qemu_flush_coalesced_mmio_buffer();
     }
     tmp = (*value >> shift) & mask;
+    trace_memory_region_ops_write(mr, addr, tmp, size);
     mr->ops->write(mr->opaque, addr, tmp, size);
 }
 
diff --git a/trace-events b/trace-events
index 0f7c8b4..3856b5c 100644
--- a/trace-events
+++ b/trace-events
@@ -1165,6 +1165,10 @@ kvm_vm_ioctl(int type, void *arg) "type %d, arg %p"
 kvm_vcpu_ioctl(int cpu_index, int type, void *arg) "cpu_index %d, type %d, arg %p"
 kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 
+# memory.c
+memory_region_ops_read(void *mr, uint64_t addr, uint64_t value, unsigned size) "mr %p addr %#"PRIx64" value %#"PRIx64" size %u"
+memory_region_ops_write(void *mr, uint64_t addr, uint64_t value, unsigned size) "mr %p addr %#"PRIx64" value %#"PRIx64" size %u"
+
 # qom/object.c
 object_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
 object_class_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
commit 8cdd2e0abbf593a38a146d8dfc998754cefbc27a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 29 12:22:11 2013 +0100

    tpm.c: Don't try to put -1 in a variable of type TpmModel
    
    The TpmModel type is an enum (valid values 0 and 1), which means
    the compiler can legitimately decide that comparisons like
    'tpm_models[i] == -1' are never true. (For example it could
    pick 'unsigned char' as its type for representing the enum.)
    
    Avoid this issue by using TPM_MODEL_MAX to mark entries in
    the tpm_models[] array which aren't filled in, instead of -1.
    
    This silences a clang warning:
    
     tpm.c:43:27: error: comparison of constant -1 with expression of type
          'enum TpmModel' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
            if (tpm_models[i] == -1) {
                ~~~~~~~~~~~~~ ^  ~~
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1375096931-13842-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tpm.c b/tpm.c
index f13c9bc..d68d69f 100644
--- a/tpm.c
+++ b/tpm.c
@@ -32,7 +32,7 @@ static TPMDriverOps const *be_drivers[TPM_MAX_DRIVERS] = {
 };
 
 static enum TpmModel tpm_models[TPM_MAX_MODELS] = {
-    -1,
+    TPM_MODEL_MAX,
 };
 
 int tpm_register_model(enum TpmModel model)
@@ -40,7 +40,7 @@ int tpm_register_model(enum TpmModel model)
     int i;
 
     for (i = 0; i < TPM_MAX_MODELS; i++) {
-        if (tpm_models[i] == -1) {
+        if (tpm_models[i] == TPM_MODEL_MAX) {
             tpm_models[i] = model;
             return 0;
         }
commit 125ee0ed9cad04307498ac2b7b0d51ad8a807360
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Mon Jul 29 17:17:45 2013 +0300

    devices: Associate devices to their logical category
    
    The category will be used to sort the devices displayed in
    the command line help.
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Message-id: 1375107465-25767-4-git-send-email-marcel.a at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 35e2af4..de6f0fe 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -149,6 +149,7 @@ static void virtio_9p_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->props = virtio_9p_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_9p_device_init;
     vdc->get_features = virtio_9p_get_features;
     vdc->get_config = virtio_9p_get_config;
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 365b2f1..01b4dfb 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1420,6 +1420,7 @@ static void ac97_class_init (ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82801AA_5;
     k->revision = 0x01;
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel 82801AA AC97 Audio";
     dc->vmsd = &vmstate_ac97;
     dc->props = ac97_properties;
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index f72e6ee..0421d47 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -364,6 +364,7 @@ static void adlib_class_initfn (ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = adlib_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = ADLIB_DESC;
     dc->props = adlib_properties;
 }
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 7365c3c..666096b 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -685,6 +685,7 @@ static void cs4231a_class_initfn (ObjectClass *klass, void *data)
 
     dc->realize = cs4231a_realizefn;
     dc->reset = cs4231a_reset;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Crystal Semiconductor CS4231A";
     dc->vmsd = &vmstate_cs4231a;
     dc->props = cs4231a_properties;
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index f2c40da..adb66ce 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -1069,6 +1069,7 @@ static void es1370_class_init (ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
     k->subsystem_vendor_id = 0x4942;
     k->subsystem_id = 0x4c4c;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "ENSONIQ AudioPCI ES1370";
     dc->vmsd = &vmstate_es1370;
 }
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index f45ed0b..71be3c6 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -315,6 +315,7 @@ static void gus_class_initfn (ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = gus_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Gravis Ultrasound GF1";
     dc->vmsd = &vmstate_gus;
     dc->props = gus_properties;
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 362d8c0..9550c97 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -1034,6 +1034,7 @@ static void hda_audio_output_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, output-only (line-out)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
@@ -1055,6 +1056,7 @@ static void hda_audio_duplex_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, duplex (line-out, line-in)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
@@ -1076,6 +1078,7 @@ static void hda_audio_micro_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "HDA Audio Codec, duplex (speaker, microphone)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 58984dc..32e44ad 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1258,6 +1258,7 @@ static void intel_hda_class_init_ich6(ObjectClass *klass, void *data)
 
     k->device_id = 0x2668;
     k->revision = 1;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel HD Audio Controller (ich6)";
 }
 
@@ -1268,6 +1269,7 @@ static void intel_hda_class_init_ich9(ObjectClass *klass, void *data)
 
     k->device_id = 0x293e;
     k->revision = 3;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Intel HD Audio Controller (ich9)";
 }
 
@@ -1296,6 +1298,7 @@ static void hda_codec_device_class_init(ObjectClass *klass, void *data)
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = hda_codec_dev_init;
     k->exit = hda_codec_dev_exit;
+    set_bit(DEVICE_CATEGORY_SOUND, k->categories);
     k->bus_type = TYPE_HDA_BUS;
     k->props = hda_props;
 }
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 7ad59a1..9004ce3 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -191,6 +191,7 @@ static void pcspk_class_initfn(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = pcspk_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->no_user = 1;
     dc->props = pcspk_properties;
 }
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index 7d331b9..b66d6d2 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -626,6 +626,7 @@ static void pl041_device_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl041_init;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->no_user = 1;
     dc->reset = pl041_device_reset;
     dc->vmsd = &vmstate_pl041;
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index e697bc1..3e58688 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -1412,6 +1412,7 @@ static void sb16_class_initfn (ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->realize = sb16_realizefn;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "Creative Sound Blaster 16";
     dc->vmsd = &vmstate_sb16;
     dc->props = sb16_properties;
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index d32f6ba..50a350f 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -2249,6 +2249,7 @@ static void isabus_fdc_class_init(ObjectClass *klass, void *data)
     dc->reset = fdctrl_external_reset_isa;
     dc->vmsd = &vmstate_isa_fdc;
     dc->props = isa_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo isa_fdc_info = {
@@ -2282,6 +2283,7 @@ static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
     dc->reset = fdctrl_external_reset_sysbus;
     dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sysbus_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_fdc_info = {
@@ -2305,6 +2307,7 @@ static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
     dc->reset = fdctrl_external_reset_sysbus;
     dc->vmsd = &vmstate_sysbus_fdc;
     dc->props = sun4m_fdc_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sun4m_fdc_info = {
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index f15f04a..0263e5c 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -866,6 +866,7 @@ static void nvme_class_init(ObjectClass *oc, void *data)
     pc->revision = 1;
     pc->is_express = 1;
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "Non-Volatile Memory Express";
     dc->props = nvme_props;
     dc->vmsd = &nvme_vmstate;
diff --git a/hw/block/pc_sysfw.c b/hw/block/pc_sysfw.c
index 0669410..7db68f0 100644
--- a/hw/block/pc_sysfw.c
+++ b/hw/block/pc_sysfw.c
@@ -286,6 +286,7 @@ static void pcsysfw_class_init (ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "PC System Firmware";
     dc->init = pcsysfw_init;
     dc->props = pcsysfw_properties;
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 2973859..825011d 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -723,6 +723,7 @@ static void pflash_cfi01_class_init(ObjectClass *klass, void *data)
     dc->realize = pflash_cfi01_realize;
     dc->props = pflash_cfi01_properties;
     dc->vmsd = &vmstate_pflash;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index cf12469..a786233 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -704,6 +704,7 @@ static void virtio_blk_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_blk_device_exit;
     dc->props = virtio_blk_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_blk_device_init;
     vdc->get_config = virtio_blk_update_config;
     vdc->set_config = virtio_blk_set_config;
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index 03db12f..02d0d57 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -122,6 +122,7 @@ static void debugcon_isa_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = debugcon_isa_realizefn;
     dc->props = debugcon_isa_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo debugcon_isa_info = {
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index 69b9ed2..5c17eaa 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -449,6 +449,7 @@ static void imx_serial_class_init(ObjectClass *klass, void *data)
     k->init = imx_serial_init;
     dc->vmsd = &vmstate_imx_serial;
     dc->reset = imx_serial_reset_at_boot;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "i.MX series UART";
     dc->props = imx32_serial_properties;
 }
diff --git a/hw/char/ipack.c b/hw/char/ipack.c
index e15540d..f890471 100644
--- a/hw/char/ipack.c
+++ b/hw/char/ipack.c
@@ -74,6 +74,7 @@ static Property ipack_device_props[] = {
 static void ipack_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
+    set_bit(DEVICE_CATEGORY_INPUT, k->categories);
     k->bus_type = TYPE_IPACK_BUS;
     k->init = ipack_device_dev_init;
     k->exit = ipack_device_dev_exit;
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index c9698a6..88e2cca 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -585,6 +585,7 @@ static void ipoctal_class_init(ObjectClass *klass, void *data)
     ic->mem_read8   = mem_read8;
     ic->mem_write8  = mem_write8;
 
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc    = "GE IP-Octal 232 8-channel RS-232 IndustryPack";
     dc->props   = ipoctal_properties;
     dc->vmsd    = &vmstate_ipoctal;
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index ad96ea5..7a3b264 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -607,6 +607,7 @@ static void parallel_isa_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = parallel_isa_realizefn;
     dc->props = parallel_isa_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo parallel_isa_info = {
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index cea8212..5cb77b3 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -102,6 +102,7 @@ static void serial_isa_class_initfn(ObjectClass *klass, void *data)
     dc->realize = serial_isa_realizefn;
     dc->vmsd = &vmstate_isa_serial;
     dc->props = serial_isa_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_isa_info = {
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index a17c702..aec6705 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -205,6 +205,7 @@ static void serial_pci_class_initfn(ObjectClass *klass, void *data)
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_serial;
     dc->props = serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
@@ -219,6 +220,7 @@ static void multi_2x_serial_pci_class_initfn(ObjectClass *klass, void *data)
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_multi_serial;
     dc->props = multi_2x_serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static void multi_4x_serial_pci_class_initfn(ObjectClass *klass, void *data)
@@ -233,6 +235,7 @@ static void multi_4x_serial_pci_class_initfn(ObjectClass *klass, void *data)
     pc->class_id = PCI_CLASS_COMMUNICATION_SERIAL;
     dc->vmsd = &vmstate_pci_multi_serial;
     dc->props = multi_4x_serial_pci_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_pci_info = {
diff --git a/hw/char/tpci200.c b/hw/char/tpci200.c
index a199e57..d9e17b2 100644
--- a/hw/char/tpci200.c
+++ b/hw/char/tpci200.c
@@ -652,6 +652,7 @@ static void tpci200_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_BRIDGE_OTHER;
     k->subsystem_vendor_id = PCI_VENDOR_ID_TEWS;
     k->subsystem_id = 0x300A;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "TEWS TPCI200 IndustryPack carrier";
     dc->vmsd = &vmstate_tpci200;
 }
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index cc3d1dd..da417c7 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -971,6 +971,7 @@ static void virtio_serial_port_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = virtser_port_qdev_init;
+    set_bit(DEVICE_CATEGORY_INPUT, k->categories);
     k->bus_type = TYPE_VIRTIO_SERIAL_BUS;
     k->exit = virtser_port_qdev_exit;
     k->unplug = qdev_simple_unplug_cb;
@@ -1017,6 +1018,7 @@ static void virtio_serial_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_serial_device_exit;
     dc->props = virtio_serial_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     vdc->init = virtio_serial_device_init;
     vdc->get_features = get_features;
     vdc->get_config = get_config;
diff --git a/hw/cpu/icc_bus.c b/hw/cpu/icc_bus.c
index 8788144..8748cc5 100644
--- a/hw/cpu/icc_bus.c
+++ b/hw/cpu/icc_bus.c
@@ -101,11 +101,19 @@ static void icc_bridge_init(Object *obj)
     s->icc_bus.apic_address_space = &s->apic_container;
 }
 
+static void icc_bridge_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
 static const TypeInfo icc_bridge_info = {
     .name  = TYPE_ICC_BRIDGE,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_init  = icc_bridge_init,
     .instance_size  = sizeof(ICCBridgeState),
+    .class_init = icc_bridge_class_init,
 };
 
 
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index a440575..dbd1f4a 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2937,6 +2937,7 @@ static void isa_cirrus_vga_class_init(ObjectClass *klass, void *data)
     dc->vmsd  = &vmstate_cirrus_vga;
     dc->realize = isa_cirrus_vga_realizefn;
     dc->props = isa_cirrus_vga_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo isa_cirrus_vga_info = {
@@ -3002,6 +3003,7 @@ static void cirrus_vga_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_CIRRUS;
     k->device_id = CIRRUS_ID_CLGD5446;
     k->class_id = PCI_CLASS_DISPLAY_VGA;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Cirrus CLGD 54xx VGA";
     dc->vmsd = &vmstate_pci_cirrus_vga;
     dc->props = pci_vga_cirrus_properties;
diff --git a/hw/display/g364fb.c b/hw/display/g364fb.c
index 79a0a50..2d3e912 100644
--- a/hw/display/g364fb.c
+++ b/hw/display/g364fb.c
@@ -528,6 +528,7 @@ static void g364fb_sysbus_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = g364fb_sysbus_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "G364 framebuffer";
     dc->reset = g364fb_sysbus_reset;
     dc->vmsd = &vmstate_g364fb;
diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index 60afcf3..31993a7 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -481,6 +481,7 @@ static void pl110_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl110_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
@@ -498,6 +499,7 @@ static void pl110_versatile_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl110_versatile_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
@@ -515,6 +517,7 @@ static void pl111_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pl111_init;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->no_user = 1;
     dc->vmsd = &vmstate_pl110;
 }
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index ddefa06..c537057 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2323,6 +2323,7 @@ static void qxl_primary_class_init(ObjectClass *klass, void *data)
     k->vendor_id = REDHAT_PCI_VENDOR_ID;
     k->device_id = QXL_DEVICE_ID_STABLE;
     k->class_id = PCI_CLASS_DISPLAY_VGA;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Spice QXL GPU (primary, vga compatible)";
     dc->reset = qxl_reset_handler;
     dc->vmsd = &qxl_vmstate;
@@ -2345,6 +2346,7 @@ static void qxl_secondary_class_init(ObjectClass *klass, void *data)
     k->vendor_id = REDHAT_PCI_VENDOR_ID;
     k->device_id = QXL_DEVICE_ID_STABLE;
     k->class_id = PCI_CLASS_DISPLAY_OTHER;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->desc = "Spice QXL GPU (secondary)";
     dc->reset = qxl_reset_handler;
     dc->vmsd = &qxl_vmstate;
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 8d560ec..c2a19ad 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -87,6 +87,7 @@ static void vga_isa_class_initfn(ObjectClass *klass, void *data)
     dc->reset = vga_isa_reset;
     dc->vmsd = &vmstate_vga_common;
     dc->props = vga_isa_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vga_isa_info = {
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index 3e150ab..b3a45c8 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -198,6 +198,7 @@ static void vga_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_DISPLAY_VGA;
     dc->vmsd = &vmstate_vga_pci;
     dc->props = vga_pci_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vga_info = {
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index 3536cde..a6a8cdc 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -1306,6 +1306,7 @@ static void vmsvga_class_init(ObjectClass *klass, void *data)
     dc->reset = vmsvga_reset;
     dc->vmsd = &vmstate_vmware_vga;
     dc->props = vga_vmware_properties;
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
 }
 
 static const TypeInfo vmsvga_info = {
diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index 5f8b972..853d455 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -227,6 +227,7 @@ static void gpio_i2c_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = gpio_i2c_init;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Virtual GPIO to I2C bridge";
 }
 
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index 22ef3b9..c97e7f7 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -224,6 +224,7 @@ static void i2c_slave_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = i2c_slave_qdev_init;
+    set_bit(DEVICE_CATEGORY_MISC, k->categories);
     k->bus_type = TYPE_I2C_BUS;
     k->props = i2c_props;
 }
diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index ff33dc8..5618173 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -1856,6 +1856,7 @@ static void assign_class_init(ObjectClass *klass, void *data)
     dc->props       = assigned_dev_properties;
     dc->vmsd        = &vmstate_assigned_device;
     dc->reset       = reset_assigned_device;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc        = "KVM-based PCI passthrough";
 }
 
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 419adde..bba150f 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1338,6 +1338,7 @@ static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_sysbus_ahci;
     dc->props = sysbus_ahci_properties;
     dc->reset = sysbus_ahci_reset;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_ahci_info = {
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index 4eb5488..bff952b 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -160,6 +160,7 @@ static void ich_ahci_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_SATA;
     dc->vmsd = &vmstate_ich9_ahci;
     dc->reset = pci_ich9_reset;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo ich_ahci_info = {
diff --git a/hw/ide/isa.c b/hw/ide/isa.c
index 7243c82..bbc8c6b 100644
--- a/hw/ide/isa.c
+++ b/hw/ide/isa.c
@@ -118,6 +118,7 @@ static void isa_ide_class_initfn(ObjectClass *klass, void *data)
     dc->fw_name = "ide";
     dc->reset = isa_ide_reset;
     dc->props = isa_ide_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo isa_ide_info = {
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 58532fe..56cf00e 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -248,6 +248,7 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
@@ -267,6 +268,7 @@ static void piix3_ide_xen_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
     dc->unplug = pci_piix3_xen_ide_unplug;
 }
@@ -289,6 +291,7 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82371AB;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
index 6a272b0..1d84e15 100644
--- a/hw/ide/qdev.c
+++ b/hw/ide/qdev.c
@@ -282,6 +282,7 @@ static void ide_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
     k->init = ide_qdev_init;
+    set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
     k->bus_type = TYPE_IDE_BUS;
     k->props = ide_props;
 }
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 5a83191..d324884 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -223,6 +223,7 @@ static void via_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIA_IDE;
     k->revision = 0x06;
     k->class_id = PCI_CLASS_STORAGE_IDE;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->no_user = 1;
 }
 
diff --git a/hw/isa/i82378.c b/hw/isa/i82378.c
index b25ed04..a542134 100644
--- a/hw/isa/i82378.c
+++ b/hw/isa/i82378.c
@@ -261,6 +261,7 @@ static void pci_i82378_class_init(ObjectClass *klass, void *data)
     k->subsystem_vendor_id = 0x0;
     k->subsystem_id = 0x0;
     dc->vmsd = &vmstate_pci_i82378;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = i82378_properties;
 }
 
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index d1921aa..5633d08 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -600,6 +600,7 @@ static void ich9_lpc_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = ich9_lpc_reset;
     k->init = ich9_lpc_initfn;
     dc->vmsd = &vmstate_ich9_lpc;
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 2174eaa..8fe4fcb 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -281,6 +281,7 @@ static void via_ac97_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIA_AC97;
     k->revision = 0x50;
     k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->desc = "AC97";
 }
 
@@ -322,6 +323,7 @@ static void via_mc97_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIA_MC97;
     k->class_id = PCI_CLASS_COMMUNICATION_OTHER;
     k->revision = 0x30;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "MC97";
 }
 
@@ -401,6 +403,7 @@ static void via_pm_class_init(ObjectClass *klass, void *data)
     k->revision = 0x40;
     dc->desc = "PM";
     dc->vmsd = &vmstate_acpi;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = via_pm_properties;
 }
 
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index bfafa51..1e8d183 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -263,6 +263,7 @@ static void qdev_applesmc_class_init(ObjectClass *klass, void *data)
     dc->realize = applesmc_isa_realize;
     dc->reset = qdev_applesmc_isa_reset;
     dc->props = applesmc_isa_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo applesmc_isa_info = {
diff --git a/hw/misc/debugexit.c b/hw/misc/debugexit.c
index d754cf1..9db5680 100644
--- a/hw/misc/debugexit.c
+++ b/hw/misc/debugexit.c
@@ -58,6 +58,7 @@ static void debug_exit_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = debug_exit_realizefn;
     dc->props = debug_exit_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo debug_exit_info = {
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 4a74856..2838866 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -821,6 +821,7 @@ static void ivshmem_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_MEMORY_RAM;
     dc->reset = ivshmem_reset;
     dc->props = ivshmem_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo ivshmem_info = {
diff --git a/hw/misc/pc-testdev.c b/hw/misc/pc-testdev.c
index 5867c70..18e94e0 100644
--- a/hw/misc/pc-testdev.c
+++ b/hw/misc/pc-testdev.c
@@ -188,6 +188,7 @@ static void testdev_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->realize = testdev_realizefn;
 }
 
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
index d69ff33..ca53b3f 100644
--- a/hw/misc/pci-testdev.c
+++ b/hw/misc/pci-testdev.c
@@ -315,6 +315,7 @@ static void pci_testdev_class_init(ObjectClass *klass, void *data)
     k->revision = 0x00;
     k->class_id = PCI_CLASS_OTHERS;
     dc->desc = "PCI Test Device";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->reset = qdev_pci_testdev_reset;
 }
 
diff --git a/hw/misc/sga.c b/hw/misc/sga.c
index 08803e7..83d2fd9 100644
--- a/hw/misc/sga.c
+++ b/hw/misc/sga.c
@@ -47,6 +47,7 @@ static void sga_class_initfn(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
     dc->realize = sga_realizefn;
     dc->desc = "Serial Graphics Adapter";
 }
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index ad8ce77..017e693 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -3299,6 +3299,7 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
     dc->props = vfio_pci_dev_properties;
     dc->vmsd = &vfio_pci_vmstate;
     dc->desc = "VFIO-based PCI device assignment";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     pdc->init = vfio_initfn;
     pdc->exit = vfio_exitfn;
     pdc->config_read = vfio_pci_read_config;
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index b952d8d..fdb1f89 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1400,6 +1400,7 @@ static void e1000_class_init(ObjectClass *klass, void *data)
     k->device_id = E1000_DEVID;
     k->revision = 0x03;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "Intel Gigabit Ethernet";
     dc->reset = qdev_e1000_reset;
     dc->vmsd = &vmstate_e1000;
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index 25b7d0c..ffa60d5 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -2083,6 +2083,7 @@ static void eepro100_class_init(ObjectClass *klass, void *data)
 
     info = eepro100_get_class_by_name(object_class_get_name(klass));
 
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = e100_properties;
     dc->desc = info->desc;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
diff --git a/hw/net/lance.c b/hw/net/lance.c
index 98bcdfc..1be7b72 100644
--- a/hw/net/lance.c
+++ b/hw/net/lance.c
@@ -150,6 +150,7 @@ static void lance_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = lance_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->fw_name = "ethernet";
     dc->reset = lance_reset;
     dc->vmsd = &vmstate_lance;
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 9080850..61578ed 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -264,6 +264,7 @@ static void mipsnet_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = mipsnet_sysbus_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "MIPS Simulator network device";
     dc->reset = mipsnet_sysbus_reset;
     dc->vmsd = &vmstate_mipsnet;
diff --git a/hw/net/ne2000-isa.c b/hw/net/ne2000-isa.c
index e3c8076..26b83ce 100644
--- a/hw/net/ne2000-isa.c
+++ b/hw/net/ne2000-isa.c
@@ -98,6 +98,7 @@ static void isa_ne2000_class_initfn(ObjectClass *klass, void *data)
 
     dc->realize = isa_ne2000_realizefn;
     dc->props = ne2000_isa_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo ne2000_isa_info = {
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 8d43fd9..31afd28 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -772,6 +772,7 @@ static void ne2000_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
     dc->vmsd = &vmstate_pci_ne2000;
     dc->props = ne2000_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo ne2000_info = {
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index 4637557..513f345 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -713,6 +713,7 @@ static void open_eth_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = sysbus_open_eth_init;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->desc = "Opencores 10/100 Mbit Ethernet";
     dc->reset = qdev_open_eth_reset;
     dc->props = open_eth_properties;
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index 6ef28f7..2c2301c 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -366,6 +366,7 @@ static void pcnet_class_init(ObjectClass *klass, void *data)
     dc->reset = pci_reset;
     dc->vmsd = &vmstate_pci_pcnet;
     dc->props = pcnet_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo pcnet_info = {
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 6552034..ee3b690 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3563,6 +3563,7 @@ static void rtl8139_class_init(ObjectClass *klass, void *data)
     dc->reset = rtl8139_reset;
     dc->vmsd = &vmstate_rtl8139;
     dc->props = rtl8139_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo rtl8139_info = {
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 679f50c..aa1880c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1638,6 +1638,7 @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_net_device_exit;
     dc->props = virtio_net_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     vdc->init = virtio_net_device_init;
     vdc->get_config = virtio_net_get_config;
     vdc->set_config = virtio_net_set_config;
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 0f3c58c..49c2466 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -2453,6 +2453,7 @@ static void vmxnet3_class_init(ObjectClass *class, void *data)
     dc->reset = vmxnet3_qdev_reset;
     dc->vmsd = &vmstate_vmxnet3;
     dc->props = vmxnet3_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo vmxnet3_info = {
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index b98bfb0..0e521a8 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -81,12 +81,14 @@ err_bridge:
 static void i82801b11_bridge_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     k->is_bridge = 1;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_INTEL_82801BA_11;
     k->revision = ICH9_D2P_A2_REVISION;
     k->init = i82801b11_bridge_initfn;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo i82801b11_bridge_info = {
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bb541eb..47122c5 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -220,6 +220,7 @@ static void ioh3420_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_INTEL;
     k->device_id = PCI_DEVICE_ID_IOH_EPORT;
     k->revision = PCI_DEVICE_ID_IOH_REV;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Intel IOH device id 3420 PCIE Root Port";
     dc->reset = ioh3420_reset;
     dc->vmsd = &vmstate_ioh3420;
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 5f11323..a00642c 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -141,6 +141,7 @@ static void pci_bridge_dev_class_init(ObjectClass *klass, void *data)
     dc->reset = qdev_pci_bridge_dev_reset;
     dc->props = pci_bridge_dev_properties;
     dc->vmsd = &pci_bridge_dev_vmstate;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo pci_bridge_dev_info = {
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 1810dd2..33eff37 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -187,6 +187,7 @@ static void xio3130_downstream_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_TI;
     k->device_id = PCI_DEVICE_ID_TI_XIO3130D;
     k->revision = XIO3130_REVISION;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "TI X3130 Downstream Port of PCI Express Switch";
     dc->reset = xio3130_downstream_reset;
     dc->vmsd = &vmstate_xio3130_downstream;
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 8e0d97a..e9969a9 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -161,6 +161,7 @@ static void xio3130_upstream_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_TI;
     k->device_id = PCI_DEVICE_ID_TI_XIO3130U;
     k->revision = XIO3130_REVISION;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "TI X3130 Upstream Port of PCI Express Switch";
     dc->reset = xio3130_upstream_reset;
     dc->vmsd = &vmstate_xio3130_upstream;
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index 3756ce9..bef7be1 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -536,6 +536,7 @@ static void pbm_host_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = pci_pbm_init_device;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = pci_pbm_reset;
 }
 
@@ -558,6 +559,7 @@ static void pbm_pci_bridge_class_init(ObjectClass *klass, void *data)
     k->revision = 0x11;
     k->config_write = pci_bridge_write_config;
     k->is_bridge = 1;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->reset = pci_bridge_reset;
     dc->vmsd = &vmstate_pci_device;
 }
diff --git a/hw/pci-host/ppce500.c b/hw/pci-host/ppce500.c
index 646204e..f00793d 100644
--- a/hw/pci-host/ppce500.c
+++ b/hw/pci-host/ppce500.c
@@ -407,6 +407,7 @@ static void e500_pcihost_class_init(ObjectClass *klass, void *data)
     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
     k->init = e500_pcihost_initfn;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->props = pcihost_properties;
     dc->vmsd = &vmstate_ppce500_pci;
 }
diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index b41d564..09d3b32 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -210,6 +210,7 @@ static void raven_pcihost_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->realize = raven_pcihost_realizefn;
     dc->fw_name = "pci";
     dc->no_user = 1;
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 6b1b3b7..69234de 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -78,6 +78,7 @@ static void q35_host_class_init(ObjectClass *klass, void *data)
     hc->root_bus_path = q35_host_root_bus_path;
     dc->realize = q35_host_realize;
     dc->props = mch_props;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->fw_name = "pci";
 }
 
@@ -306,6 +307,7 @@ static void mch_class_init(ObjectClass *klass, void *data)
     k->init = mch_init;
     k->config_write = mch_write_config;
     dc->reset = mch_reset;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "Host bridge";
     dc->vmsd = &vmstate_mch;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
diff --git a/hw/scsi/esp-pci.c b/hw/scsi/esp-pci.c
index 2ac21d4..d7ec173 100644
--- a/hw/scsi/esp-pci.c
+++ b/hw/scsi/esp-pci.c
@@ -392,6 +392,7 @@ static void esp_pci_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_AMD_SCSI;
     k->revision = 0x10;
     k->class_id = PCI_CLASS_STORAGE_SCSI;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "AMD Am53c974 PCscsi-PCI SCSI adapter";
     dc->reset = esp_pci_hard_reset;
     dc->vmsd = &vmstate_esp_pci_scsi;
@@ -512,6 +513,7 @@ static void dc390_class_init(ObjectClass *klass, void *data)
     k->init = dc390_scsi_init;
     k->config_read = dc390_read_config;
     k->config_write = dc390_write_config;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "Tekram DC-390 SCSI adapter";
 }
 
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 94639b8..101e957 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -720,6 +720,7 @@ static void sysbus_esp_class_init(ObjectClass *klass, void *data)
     dc->realize = sysbus_esp_realize;
     dc->reset = sysbus_esp_hard_reset;
     dc->vmsd = &vmstate_sysbus_esp_scsi;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo sysbus_esp_info = {
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 776e31a..611f2aa 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -2141,6 +2141,7 @@ static void lsi_class_init(ObjectClass *klass, void *data)
     k->subsystem_id = 0x1000;
     dc->reset = lsi_scsi_reset;
     dc->vmsd = &vmstate_lsi_scsi;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static const TypeInfo lsi_info = {
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index eb52164..a6d5285 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2213,6 +2213,7 @@ static void megasas_class_init(ObjectClass *oc, void *data)
     dc->props = megasas_properties;
     dc->reset = megasas_scsi_reset;
     dc->vmsd = &vmstate_megasas;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->desc = "LSI MegaRAID SAS 1078";
 }
 
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index b5a863a..fbf9173 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -1881,6 +1881,7 @@ const VMStateDescription vmstate_scsi_device = {
 static void scsi_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
+    set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
     k->bus_type = TYPE_SCSI_BUS;
     k->init     = scsi_qdev_init;
     k->unplug   = scsi_qdev_unplug;
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 785e93f..9e770fb 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -267,6 +267,7 @@ static void vhost_scsi_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = vhost_scsi_exit;
     dc->props = vhost_scsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = vhost_scsi_init;
     vdc->get_features = vhost_scsi_get_features;
     vdc->set_config = vhost_scsi_set_config;
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 42cb73b..05da56b 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -669,8 +669,10 @@ static Property virtio_scsi_properties[] = {
 static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
 {
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     vdc->get_config = virtio_scsi_get_config;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 }
 
 static void virtio_scsi_class_init(ObjectClass *klass, void *data)
@@ -679,6 +681,7 @@ static void virtio_scsi_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_scsi_device_exit;
     dc->props = virtio_scsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     vdc->init = virtio_scsi_device_init;
     vdc->set_config = virtio_scsi_set_config;
     vdc->get_features = virtio_scsi_get_features;
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index e1074e1..d42b359 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1197,6 +1197,7 @@ static void pvscsi_class_init(ObjectClass *klass, void *data)
     dc->reset = pvscsi_reset;
     dc->vmsd = &vmstate_pvscsi;
     dc->props = pvscsi_properties;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     k->config_write = pvscsi_write_config;
 }
 
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index deb6d47..aa913df 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -592,6 +592,7 @@ static void emulated_class_initfn(ObjectClass *klass, void *data)
     cc->exitfn = emulated_exitfn;
     cc->get_atr = emulated_get_atr;
     cc->apdu_from_guest = emulated_apdu_from_guest;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "emulated smartcard";
     dc->props = emulated_card_properties;
 }
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 5f01ff1..10f1d30 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -392,6 +392,7 @@ static void passthru_class_initfn(ObjectClass *klass, void *data)
     cc->exitfn = passthru_exitfn;
     cc->get_atr = passthru_get_atr;
     cc->apdu_from_guest = passthru_apdu_from_guest;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "passthrough smartcard";
     dc->vmsd = &passthru_vmstate;
     dc->props = passthru_card_properties;
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index 04933a9..c5420eb 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -673,6 +673,7 @@ static void usb_audio_class_init(ObjectClass *klass, void *data)
 
     dc->vmsd          = &vmstate_usb_audio;
     dc->props         = usb_audio_properties;
+    set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     k->product_desc   = "QEMU USB Audio Interface";
     k->usb_desc       = &desc_audio;
     k->init           = usb_audio_initfn;
diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index 68cc1d4..f2fc2a8 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -553,6 +553,7 @@ static void usb_bt_class_initfn(ObjectClass *klass, void *data)
     uc->handle_data    = usb_bt_handle_data;
     uc->handle_destroy = usb_bt_handle_destroy;
     dc->vmsd = &vmstate_usb_bt;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
 }
 
 static const TypeInfo bt_info = {
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 31f3cde..66c6331 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -658,6 +658,7 @@ static void usb_tablet_class_initfn(ObjectClass *klass, void *data)
     uc->product_desc   = "QEMU USB Tablet";
     dc->vmsd = &vmstate_usb_ptr;
     dc->props = usb_tablet_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo usb_tablet_info = {
@@ -677,6 +678,7 @@ static void usb_mouse_class_initfn(ObjectClass *klass, void *data)
     uc->product_desc   = "QEMU USB Mouse";
     uc->usb_desc       = &desc_mouse;
     dc->vmsd = &vmstate_usb_ptr;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo usb_mouse_info = {
@@ -696,6 +698,7 @@ static void usb_keyboard_class_initfn(ObjectClass *klass, void *data)
     uc->product_desc   = "QEMU USB Keyboard";
     uc->usb_desc       = &desc_keyboard;
     dc->vmsd = &vmstate_usb_kbd;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo usb_keyboard_info = {
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 0b71abd..e865a98 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -574,6 +574,7 @@ static void usb_hub_class_initfn(ObjectClass *klass, void *data)
     uc->handle_control = usb_hub_handle_control;
     uc->handle_data    = usb_hub_handle_data;
     uc->handle_destroy = usb_hub_handle_destroy;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->fw_name = "hub";
     dc->vmsd = &vmstate_usb_hub;
 }
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 5473ac2..660d774 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1429,6 +1429,7 @@ static void usb_net_class_initfn(ObjectClass *klass, void *data)
     uc->handle_control = usb_net_handle_control;
     uc->handle_data    = usb_net_handle_data;
     uc->handle_destroy = usb_net_handle_destroy;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->fw_name = "network";
     dc->vmsd = &vmstate_usb_net;
     dc->props = net_properties;
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 2fc8a3b..0b150d4 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -590,6 +590,7 @@ static void usb_serial_class_initfn(ObjectClass *klass, void *data)
     uc->handle_data    = usb_serial_handle_data;
     dc->vmsd = &vmstate_usb_serial;
     dc->props = serial_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo serial_info = {
@@ -617,6 +618,7 @@ static void usb_braille_class_initfn(ObjectClass *klass, void *data)
     uc->handle_data    = usb_serial_handle_data;
     dc->vmsd = &vmstate_usb_serial;
     dc->props = braille_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo braille_info = {
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index b33eb25..2233c54 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1449,6 +1449,7 @@ static void ccid_class_initfn(ObjectClass *klass, void *data)
     dc->desc = "CCID Rev 1.1 smartcard reader";
     dc->vmsd = &ccid_vmstate;
     dc->props = ccid_properties;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo ccid_info = {
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 1954811..a8dc2fa 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -746,6 +746,7 @@ static void usb_msd_class_initfn_common(ObjectClass *klass)
     uc->handle_reset   = usb_msd_handle_reset;
     uc->handle_control = usb_msd_handle_control;
     uc->handle_data    = usb_msd_handle_data;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->fw_name = "storage";
     dc->vmsd = &vmstate_usb_msd;
 }
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 6efab62..63ad12e 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -916,6 +916,7 @@ static void usb_uas_class_initfn(ObjectClass *klass, void *data)
     uc->handle_control = usb_uas_handle_control;
     uc->handle_data    = usb_uas_handle_data;
     uc->handle_destroy = usb_uas_handle_destroy;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->fw_name = "storage";
     dc->vmsd = &vmstate_usb_uas;
 }
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index 3be5cde..1b09235 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -362,6 +362,7 @@ static void usb_wacom_class_init(ObjectClass *klass, void *data)
     uc->handle_control = usb_wacom_handle_control;
     uc->handle_data    = usb_wacom_handle_data;
     uc->handle_destroy = usb_wacom_handle_destroy;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "QEMU PenPartner Tablet";
     dc->vmsd = &vmstate_usb_wacom;
 }
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 5d229bc..4d21a0b 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -140,11 +140,13 @@ static const TypeInfo ehci_pci_type_info = {
 static void ehci_data_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
     EHCIPCIInfo *i = data;
 
     k->vendor_id = i->vendor_id;
     k->device_id = i->device_id;
     k->revision = i->revision;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static struct EHCIPCIInfo ehci_pci_info[] = {
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 54147b5..fe6eea5 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -70,6 +70,7 @@ static void ehci_sysbus_class_init(ObjectClass *klass, void *data)
     dc->realize = usb_ehci_sysbus_realize;
     dc->vmsd = &vmstate_ehci_sysbus;
     dc->props = ehci_sysbus_properties;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_type_info = {
@@ -85,7 +86,9 @@ static const TypeInfo ehci_type_info = {
 static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     sec->capsbase = 0x100;
     sec->opregbase = 0x140;
 }
@@ -99,9 +102,11 @@ static const TypeInfo ehci_xlnx_type_info = {
 static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x0;
     sec->opregbase = 0x10;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_exynos4210_type_info = {
@@ -113,9 +118,11 @@ static const TypeInfo ehci_exynos4210_type_info = {
 static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x100;
     sec->opregbase = 0x140;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_tegra2_type_info = {
@@ -183,11 +190,13 @@ static void fusbh200_ehci_init(Object *obj)
 static void fusbh200_ehci_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
 
     sec->capsbase = 0x0;
     sec->opregbase = 0x10;
     sec->portscbase = 0x20;
     sec->portnr = 1;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
 }
 
 static const TypeInfo ehci_fusbh200_type_info = {
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 2bab8ff..d438d64 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1917,6 +1917,7 @@ static void ohci_pci_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_APPLE_IPID_USB;
     k->class_id = PCI_CLASS_SERIAL_USB;
     k->no_hotplug = 1;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     dc->desc = "Apple USB Controller";
     dc->props = ohci_pci_properties;
 }
@@ -1939,6 +1940,7 @@ static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = ohci_realize_pxa;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     dc->desc = "OHCI USB Controller";
     dc->props = ohci_sysbus_properties;
 }
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 066072e..cb44abc 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1315,6 +1315,7 @@ static void uhci_class_init(ObjectClass *klass, void *data)
     k->no_hotplug = 1;
     dc->vmsd = &vmstate_uhci;
     dc->props = uhci_properties;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     u->info = *info;
 }
 
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 9ba3e3e..58f311d 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3591,6 +3591,7 @@ static void xhci_class_init(ObjectClass *klass, void *data)
     dc->vmsd    = &vmstate_xhci;
     dc->props   = xhci_properties;
     dc->reset   = xhci_reset;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
     k->init         = usb_xhci_initfn;
     k->vendor_id    = PCI_VENDOR_ID_NEC;
     k->device_id    = PCI_DEVICE_ID_NEC_UPD720200;
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index e2f3cc8..f660770 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1351,6 +1351,7 @@ static void usb_host_class_initfn(ObjectClass *klass, void *data)
     uc->flush_ep_queue = usb_host_flush_ep_queue;
     dc->vmsd = &vmstate_usb_host;
     dc->props = usb_host_dev_properties;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static TypeInfo usb_host_dev_info = {
diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index ca09a89..7901f4c 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -1530,6 +1530,7 @@ static void usb_host_class_initfn(ObjectClass *klass, void *data)
     uc->handle_destroy = usb_host_handle_destroy;
     dc->vmsd = &vmstate_usb_host;
     dc->props = usb_host_dev_properties;
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
 }
 
 static const TypeInfo usb_host_dev_info = {
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index a594e95..8b8c010 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -2362,6 +2362,7 @@ static void usbredir_class_initfn(ObjectClass *klass, void *data)
     uc->ep_stopped     = usbredir_ep_stopped;
     dc->vmsd           = &usbredir_vmstate;
     dc->props          = usbredir_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo usbredir_dev_info = {
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 337cfa5..aac7f83 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -392,6 +392,7 @@ static void virtio_balloon_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_balloon_device_exit;
     dc->props = virtio_balloon_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     vdc->init = virtio_balloon_device_init;
     vdc->get_config = virtio_balloon_get_config;
     vdc->set_config = virtio_balloon_set_config;
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 54d6679..88cf994 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -370,6 +370,7 @@ static void virtio_mmio_class_init(ObjectClass *klass, void *data)
 
     dc->realize = virtio_mmio_realizefn;
     dc->reset = virtio_mmio_reset;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo virtio_mmio_info = {
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c38cfd1..d37037e 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -911,6 +911,7 @@ static void virtio_9p_pci_class_init(ObjectClass *klass, void *data)
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_9P;
     pcidev_k->revision = VIRTIO_PCI_ABI_VERSION;
     pcidev_k->class_id = 0x2;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_9p_pci_properties;
 }
 
@@ -1065,6 +1066,7 @@ static void virtio_blk_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_blk_pci_properties;
     k->init = virtio_blk_pci_init;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
@@ -1135,6 +1137,7 @@ static void virtio_scsi_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_scsi_pci_init_pci;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = virtio_scsi_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
@@ -1191,6 +1194,7 @@ static void vhost_scsi_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = vhost_scsi_pci_init_pci;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = vhost_scsi_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
@@ -1271,6 +1275,7 @@ static void virtio_balloon_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_balloon_pci_init;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = virtio_balloon_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_BALLOON;
@@ -1356,6 +1361,7 @@ static void virtio_serial_pci_class_init(ObjectClass *klass, void *data)
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     k->init = virtio_serial_pci_init;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->props = virtio_serial_pci_properties;
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
     pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_CONSOLE;
@@ -1417,6 +1423,7 @@ static void virtio_net_pci_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_VIRTIO_NET;
     k->revision = VIRTIO_PCI_ABI_VERSION;
     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = virtio_net_properties;
     vpciklass->init = virtio_net_pci_init;
 }
@@ -1468,6 +1475,7 @@ static void virtio_rng_pci_class_init(ObjectClass *klass, void *data)
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
     k->init = virtio_rng_pci_init;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = virtio_rng_pci_properties;
 
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index cb787c7..bac8421 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -207,6 +207,7 @@ static void virtio_rng_class_init(ObjectClass *klass, void *data)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
     dc->exit = virtio_rng_device_exit;
     dc->props = virtio_rng_properties;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     vdc->init = virtio_rng_device_init;
     vdc->get_features = get_features;
 }
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 85aebc2..2e064ba 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -451,6 +451,7 @@ static void i6300esb_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_SYSTEM_OTHER;
     dc->reset = i6300esb_reset;
     dc->vmsd = &vmstate_i6300esb;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo i6300esb_info = {
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index c788554..e97b4c3 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -137,6 +137,7 @@ static void wdt_ib700_class_init(ObjectClass *klass, void *data)
     dc->realize = wdt_ib700_realize;
     dc->reset = wdt_ib700_reset;
     dc->vmsd = &vmstate_ib700;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 }
 
 static const TypeInfo wdt_ib700_info = {
diff --git a/hw/xen/xen_platform.c b/hw/xen/xen_platform.c
index 6a8ba7e..79bf0b3 100644
--- a/hw/xen/xen_platform.c
+++ b/hw/xen/xen_platform.c
@@ -428,6 +428,7 @@ static void xen_platform_class_init(ObjectClass *klass, void *data)
     k->subsystem_vendor_id = PCI_VENDOR_ID_XEN;
     k->subsystem_id = PCI_DEVICE_ID_XEN_PLATFORM;
     k->revision = 1;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc = "XEN platform pci device";
     dc->reset = platform_reset;
     dc->vmsd = &vmstate_xen_platform;
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index d15a729..ca2d460 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -830,6 +830,7 @@ static void xen_pci_passthrough_class_init(ObjectClass *klass, void *data)
     k->exit = xen_pt_unregister_device;
     k->config_read = xen_pt_pci_read_config;
     k->config_write = xen_pt_pci_write_config;
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->desc = "Assign an host PCI device with Xen";
     dc->props = xen_pci_passthrough_properties;
 };
commit 3d1237fb2ab4edb926c717767bb5e31d6053a7c5
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Mon Jul 29 17:17:44 2013 +0300

    qemu-help: Sort devices by logical functionality
    
    Categorize devices that appear as output to "-device ?" command
    by logical functionality. Sort the devices by logical categories
    before showing them to user.
    
    The sort is done by functionality rather than alphabetical.
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Message-id: 1375107465-25767-3-git-send-email-marcel.a at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index e8b89b1..46972f4 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -18,6 +18,34 @@ enum {
 #define DEVICE_CLASS(klass) OBJECT_CLASS_CHECK(DeviceClass, (klass), TYPE_DEVICE)
 #define DEVICE_GET_CLASS(obj) OBJECT_GET_CLASS(DeviceClass, (obj), TYPE_DEVICE)
 
+typedef enum DeviceCategory {
+    DEVICE_CATEGORY_BRIDGE,
+    DEVICE_CATEGORY_USB,
+    DEVICE_CATEGORY_STORAGE,
+    DEVICE_CATEGORY_NETWORK,
+    DEVICE_CATEGORY_INPUT,
+    DEVICE_CATEGORY_DISPLAY,
+    DEVICE_CATEGORY_SOUND,
+    DEVICE_CATEGORY_MISC,
+    DEVICE_CATEGORY_MAX
+} DeviceCategory;
+
+static inline const char *qdev_category_get_name(DeviceCategory category)
+{
+    static const char *category_names[DEVICE_CATEGORY_MAX] = {
+        [DEVICE_CATEGORY_BRIDGE]  = "Controller/Bridge/Hub",
+        [DEVICE_CATEGORY_USB]     = "USB",
+        [DEVICE_CATEGORY_STORAGE] = "Storage",
+        [DEVICE_CATEGORY_NETWORK] = "Network",
+        [DEVICE_CATEGORY_INPUT]   = "Input",
+        [DEVICE_CATEGORY_DISPLAY] = "Display",
+        [DEVICE_CATEGORY_SOUND]   = "Sound",
+        [DEVICE_CATEGORY_MISC]    = "Misc",
+    };
+
+    return category_names[category];
+};
+
 typedef int (*qdev_initfn)(DeviceState *dev);
 typedef int (*qdev_event)(DeviceState *dev);
 typedef void (*qdev_resetfn)(DeviceState *dev);
@@ -81,6 +109,7 @@ typedef struct DeviceClass {
     ObjectClass parent_class;
     /*< public >*/
 
+    DECLARE_BITMAP(categories, DEVICE_CATEGORY_MAX);
     const char *fw_name;
     const char *desc;
     Property *props;
diff --git a/qdev-monitor.c b/qdev-monitor.c
index e5adf6c..410cdcb 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -75,24 +75,27 @@ static bool qdev_class_has_alias(DeviceClass *dc)
     return (qdev_class_get_alias(dc) != NULL);
 }
 
-static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
+static void qdev_print_class_devinfo(DeviceClass *dc)
 {
-    DeviceClass *dc;
-    bool *show_no_user = opaque;
-
-    dc = (DeviceClass *)object_class_dynamic_cast(klass, TYPE_DEVICE);
+    DeviceCategory category;
 
-    if (!dc || (show_no_user && !*show_no_user && dc->no_user)) {
+    if (!dc) {
         return;
     }
 
-    error_printf("name \"%s\"", object_class_get_name(klass));
+    error_printf("name \"%s\"", object_class_get_name(OBJECT_CLASS(dc)));
     if (dc->bus_type) {
         error_printf(", bus %s", dc->bus_type);
     }
     if (qdev_class_has_alias(dc)) {
         error_printf(", alias \"%s\"", qdev_class_get_alias(dc));
     }
+    error_printf(", categories");
+    for (category = 0; category < DEVICE_CATEGORY_MAX; ++category) {
+        if (test_bit(category, dc->categories)) {
+            error_printf(" \"%s\"", qdev_category_get_name(category));
+        }
+    }
     if (dc->desc) {
         error_printf(", desc \"%s\"", dc->desc);
     }
@@ -102,6 +105,15 @@ static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
     error_printf("\n");
 }
 
+static void qdev_print_devinfo(ObjectClass *klass, void *opaque)
+{
+    DeviceClass *dc;
+
+    dc = (DeviceClass *)object_class_dynamic_cast(klass, TYPE_DEVICE);
+
+    qdev_print_class_devinfo(dc);
+}
+
 static int set_property(const char *name, const char *value, void *opaque)
 {
     DeviceState *dev = opaque;
@@ -139,6 +151,21 @@ static const char *find_typename_by_alias(const char *alias)
     return NULL;
 }
 
+static void qdev_print_category_devices(DeviceCategory category)
+{
+    DeviceClass *dc;
+    GSList *list, *curr;
+
+    list = object_class_get_list(TYPE_DEVICE, false);
+    for (curr = list; curr; curr = g_slist_next(curr)) {
+        dc = (DeviceClass *)object_class_dynamic_cast(curr->data, TYPE_DEVICE);
+        if (!dc->no_user && test_bit(category, dc->categories)) {
+            qdev_print_class_devinfo(dc);
+        }
+    }
+    g_slist_free(list);
+}
+
 int qdev_device_help(QemuOpts *opts)
 {
     const char *driver;
@@ -147,8 +174,11 @@ int qdev_device_help(QemuOpts *opts)
 
     driver = qemu_opt_get(opts, "driver");
     if (driver && is_help_option(driver)) {
-        bool show_no_user = false;
-        object_class_foreach(qdev_print_devinfo, TYPE_DEVICE, false, &show_no_user);
+        DeviceCategory category;
+        for (category = 0; category < DEVICE_CATEGORY_MAX; ++category) {
+            qdev_print_category_devices(category);
+        }
+
         return 1;
     }
 
commit 949fc82314cc84162e64a5323764527a542421ce
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Mon Jul 29 17:17:43 2013 +0300

    hw: import bitmap operations in qdev-core header
    
    Made small tweaks in code to prevent compilation issues
    when importing qemu/bitmap.h in qdev-core
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Message-id: 1375107465-25767-2-git-send-email-marcel.a at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 3a324fb..6e1ed1e 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -74,13 +74,14 @@ static void bit_prop_set(DeviceState *dev, Property *props, bool val)
     }
 }
 
-static int print_bit(DeviceState *dev, Property *prop, char *dest, size_t len)
+static int prop_print_bit(DeviceState *dev, Property *prop, char *dest,
+                          size_t len)
 {
     uint32_t *p = qdev_get_prop_ptr(dev, prop);
     return snprintf(dest, len, (*p & qdev_get_prop_mask(prop)) ? "on" : "off");
 }
 
-static void get_bit(Object *obj, Visitor *v, void *opaque,
+static void prop_get_bit(Object *obj, Visitor *v, void *opaque,
                     const char *name, Error **errp)
 {
     DeviceState *dev = DEVICE(obj);
@@ -91,7 +92,7 @@ static void get_bit(Object *obj, Visitor *v, void *opaque,
     visit_type_bool(v, &value, name, errp);
 }
 
-static void set_bit(Object *obj, Visitor *v, void *opaque,
+static void prop_set_bit(Object *obj, Visitor *v, void *opaque,
                     const char *name, Error **errp)
 {
     DeviceState *dev = DEVICE(obj);
@@ -115,9 +116,9 @@ static void set_bit(Object *obj, Visitor *v, void *opaque,
 PropertyInfo qdev_prop_bit = {
     .name  = "boolean",
     .legacy_name  = "on/off",
-    .print = print_bit,
-    .get   = get_bit,
-    .set   = set_bit,
+    .print = prop_print_bit,
+    .get   = prop_get_bit,
+    .set   = prop_set_bit,
 };
 
 /* --- bool --- */
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index e0befb2..25b7d0c 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -47,6 +47,7 @@
 #include "hw/nvram/eeprom93xx.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/dma.h"
+#include "qemu/bitops.h"
 
 /* QEMU sends frames smaller than 60 bytes to ethernet nics.
  * Such frames are rejected by real nics and their emulations.
@@ -105,7 +106,6 @@
 #define PCI_IO_SIZE             64
 #define PCI_FLASH_SIZE          (128 * KiB)
 
-#define BIT(n) (1 << (n))
 #define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
 
 /* The SCB accepts the following controls for the Tx and Rx units: */
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 7fbffcb..e8b89b1 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -4,6 +4,7 @@
 #include "qemu/queue.h"
 #include "qemu/option.h"
 #include "qemu/typedefs.h"
+#include "qemu/bitmap.h"
 #include "qom/object.h"
 #include "hw/irq.h"
 #include "qapi/error.h"
commit dbd94f8e4a0a3c4164af7be5bbf6d4e907f3cc03
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Mon Jul 29 14:48:39 2013 +1000

    spapr-vscsi: fix SOLNT bit in SRP_RSP
    
    The driver calculates SOLNT bit from UCSOLNT and  SCSOLNT bits from
    the request. The iu pointer has a type of srp_iu* which points to a union,
    so cmd and rsp overlap. As the vscsi_send_rsp function calls
    memset(iu, 0, sizeof(rsp)), it clears first 36 bytes of both cmd and rsp
    so cmd.sol_not is always zero at the moment of calculating rsp.sol_not.
    
    This fixes the bug.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1375073319-17488-1-git-send-email-aik at ozlabs.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 46f4455..3f4c53f 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -216,6 +216,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     union viosrp_iu *iu = &req->iu;
     uint64_t tag = iu->srp.rsp.tag;
     int total_len = sizeof(iu->srp.rsp);
+    uint8_t sol_not = iu->srp.cmd.sol_not;
 
     dprintf("VSCSI: Sending resp status: 0x%x, "
             "res_in: %d, res_out: %d\n", status, res_in, res_out);
@@ -248,7 +249,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     /* Handle success vs. failure */
     iu->srp.rsp.status = status;
     if (status) {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x04) >> 2;
+        iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2;
         if (req->senselen) {
             req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID;
             req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen);
@@ -256,7 +257,7 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
             total_len += req->senselen;
         }
     } else {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x02) >> 1;
+        iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1;
     }
 
     vscsi_send_iu(s, req, total_len, VIOSRP_SRP_FORMAT);
commit c04d6cfa3f17a335942f430a3d40e6041100f0c2
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 14:33:04 2013 -0500

    xics: rename types to be sane and follow coding style
    
        Basically, in HW the layout of the interrupt network is:
    
         - One ICP per processor thread (the "presenter"). This contains the
        registers to fetch a pending interrupt (ack), EOI, and control the
        processor priority.
    
         - One ICS per logical source of interrupts (ie, one per PCI host
        bridge, and a few others here or there). This contains the per-interrupt
        source configuration (target processor(s), priority, mask) and the
        per-interrupt internal state.
    
        Under PAPR, there is a single "virtual" ICS ... somewhat (it's a bit
        oddball what pHyp does here, arguably there are two but we can ignore
        that distinction). There is no register level access. A pair of firmware
        (RTAS) calls is used to configure each virtual interrupt.
    
        So our model here is somewhat the same. We have one ICS in the emulated
        XICS which arguably *is* the emulated XICS, there's no point making it a
        separate "device", that would just be gross, and each VCPU has an
        associated ICP.
    
    Yet we call the "XICS" struct icp_state and then the ICPs
    'struct icp_server_state'.  It's particularly confusing when all of the
    functions have xics_prefixes yet take *icp arguments.
    
    Rename:
    
      struct icp_state -> XICSState
      struct icp_server_state -> ICPState
      struct ics_state -> ICSState
      struct ics_irq_state -> ICSIRQState
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-12-git-send-email-aliguori at us.ibm.com
    [aik: added ics_resend() on post_load]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 091912e..6b3c071 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -34,34 +34,19 @@
  * ICP: Presentation layer
  */
 
-struct icp_server_state {
-    uint32_t xirr;
-    uint8_t pending_priority;
-    uint8_t mfrr;
-    qemu_irq output;
-};
-
 #define XISR_MASK  0x00ffffff
 #define CPPR_MASK  0xff000000
 
 #define XISR(ss)   (((ss)->xirr) & XISR_MASK)
 #define CPPR(ss)   (((ss)->xirr) >> 24)
 
-struct ics_state;
-
-struct icp_state {
-    long nr_servers;
-    struct icp_server_state *ss;
-    struct ics_state *ics;
-};
-
-static void ics_reject(struct ics_state *ics, int nr);
-static void ics_resend(struct ics_state *ics);
-static void ics_eoi(struct ics_state *ics, int nr);
+static void ics_reject(ICSState *ics, int nr);
+static void ics_resend(ICSState *ics);
+static void ics_eoi(ICSState *ics, int nr);
 
-static void icp_check_ipi(struct icp_state *icp, int server)
+static void icp_check_ipi(XICSState *icp, int server)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     if (XISR(ss) && (ss->pending_priority <= ss->mfrr)) {
         return;
@@ -78,9 +63,9 @@ static void icp_check_ipi(struct icp_state *icp, int server)
     qemu_irq_raise(ss->output);
 }
 
-static void icp_resend(struct icp_state *icp, int server)
+static void icp_resend(XICSState *icp, int server)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     if (ss->mfrr < CPPR(ss)) {
         icp_check_ipi(icp, server);
@@ -88,9 +73,9 @@ static void icp_resend(struct icp_state *icp, int server)
     ics_resend(icp->ics);
 }
 
-static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
+static void icp_set_cppr(XICSState *icp, int server, uint8_t cppr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
     uint8_t old_cppr;
     uint32_t old_xisr;
 
@@ -112,9 +97,9 @@ static void icp_set_cppr(struct icp_state *icp, int server, uint8_t cppr)
     }
 }
 
-static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
+static void icp_set_mfrr(XICSState *icp, int server, uint8_t mfrr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     ss->mfrr = mfrr;
     if (mfrr < CPPR(ss)) {
@@ -122,7 +107,7 @@ static void icp_set_mfrr(struct icp_state *icp, int server, uint8_t mfrr)
     }
 }
 
-static uint32_t icp_accept(struct icp_server_state *ss)
+static uint32_t icp_accept(ICPState *ss)
 {
     uint32_t xirr = ss->xirr;
 
@@ -135,9 +120,9 @@ static uint32_t icp_accept(struct icp_server_state *ss)
     return xirr;
 }
 
-static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
+static void icp_eoi(XICSState *icp, int server, uint32_t xirr)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     /* Send EOI -> ICS */
     ss->xirr = (ss->xirr & ~CPPR_MASK) | (xirr & CPPR_MASK);
@@ -148,9 +133,9 @@ static void icp_eoi(struct icp_state *icp, int server, uint32_t xirr)
     }
 }
 
-static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
+static void icp_irq(XICSState *icp, int server, int nr, uint8_t priority)
 {
-    struct icp_server_state *ss = icp->ss + server;
+    ICPState *ss = icp->ss + server;
 
     trace_xics_icp_irq(server, nr, priority);
 
@@ -168,39 +153,59 @@ static void icp_irq(struct icp_state *icp, int server, int nr, uint8_t priority)
     }
 }
 
-/*
- * ICS: Source layer
- */
-
-struct ics_irq_state {
-    int server;
-    uint8_t priority;
-    uint8_t saved_priority;
-#define XICS_STATUS_ASSERTED           0x1
-#define XICS_STATUS_SENT               0x2
-#define XICS_STATUS_REJECTED           0x4
-#define XICS_STATUS_MASKED_PENDING     0x8
-    uint8_t status;
+static const VMStateDescription vmstate_icp_server = {
+    .name = "icp/server",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32(xirr, ICPState),
+        VMSTATE_UINT8(pending_priority, ICPState),
+        VMSTATE_UINT8(mfrr, ICPState),
+        VMSTATE_END_OF_LIST()
+    },
 };
 
-struct ics_state {
-    int nr_irqs;
-    int offset;
-    qemu_irq *qirqs;
-    bool *islsi;
-    struct ics_irq_state *irqs;
-    struct icp_state *icp;
+static void icp_reset(DeviceState *dev)
+{
+    ICPState *icp = ICP(dev);
+
+    icp->xirr = 0;
+    icp->pending_priority = 0xff;
+    icp->mfrr = 0xff;
+
+    /* Make all outputs are deasserted */
+    qemu_set_irq(icp->output, 0);
+}
+
+static void icp_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = icp_reset;
+    dc->vmsd = &vmstate_icp_server;
+}
+
+static TypeInfo icp_info = {
+    .name = TYPE_ICP,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(ICPState),
+    .class_init = icp_class_init,
 };
 
-static int ics_valid_irq(struct ics_state *ics, uint32_t nr)
+/*
+ * ICS: Source layer
+ */
+static int ics_valid_irq(ICSState *ics, uint32_t nr)
 {
     return (nr >= ics->offset)
         && (nr < (ics->offset + ics->nr_irqs));
 }
 
-static void resend_msi(struct ics_state *ics, int srcno)
+static void resend_msi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     /* FIXME: filter by server#? */
     if (irq->status & XICS_STATUS_REJECTED) {
@@ -212,9 +217,9 @@ static void resend_msi(struct ics_state *ics, int srcno)
     }
 }
 
-static void resend_lsi(struct ics_state *ics, int srcno)
+static void resend_lsi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     if ((irq->priority != 0xff)
         && (irq->status & XICS_STATUS_ASSERTED)
@@ -224,9 +229,9 @@ static void resend_lsi(struct ics_state *ics, int srcno)
     }
 }
 
-static void set_irq_msi(struct ics_state *ics, int srcno, int val)
+static void set_irq_msi(ICSState *ics, int srcno, int val)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_set_irq_msi(srcno, srcno + ics->offset);
 
@@ -240,9 +245,9 @@ static void set_irq_msi(struct ics_state *ics, int srcno, int val)
     }
 }
 
-static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
+static void set_irq_lsi(ICSState *ics, int srcno, int val)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_set_irq_lsi(srcno, srcno + ics->offset);
     if (val) {
@@ -255,7 +260,7 @@ static void set_irq_lsi(struct ics_state *ics, int srcno, int val)
 
 static void ics_set_irq(void *opaque, int srcno, int val)
 {
-    struct ics_state *ics = (struct ics_state *)opaque;
+    ICSState *ics = (ICSState *)opaque;
 
     if (ics->islsi[srcno]) {
         set_irq_lsi(ics, srcno, val);
@@ -264,9 +269,9 @@ static void ics_set_irq(void *opaque, int srcno, int val)
     }
 }
 
-static void write_xive_msi(struct ics_state *ics, int srcno)
+static void write_xive_msi(ICSState *ics, int srcno)
 {
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     if (!(irq->status & XICS_STATUS_MASKED_PENDING)
         || (irq->priority == 0xff)) {
@@ -277,16 +282,16 @@ static void write_xive_msi(struct ics_state *ics, int srcno)
     icp_irq(ics->icp, irq->server, srcno + ics->offset, irq->priority);
 }
 
-static void write_xive_lsi(struct ics_state *ics, int srcno)
+static void write_xive_lsi(ICSState *ics, int srcno)
 {
     resend_lsi(ics, srcno);
 }
 
-static void ics_write_xive(struct ics_state *ics, int nr, int server,
+static void ics_write_xive(ICSState *ics, int nr, int server,
                            uint8_t priority, uint8_t saved_priority)
 {
     int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     irq->server = server;
     irq->priority = priority;
@@ -301,16 +306,16 @@ static void ics_write_xive(struct ics_state *ics, int nr, int server,
     }
 }
 
-static void ics_reject(struct ics_state *ics, int nr)
+static void ics_reject(ICSState *ics, int nr)
 {
-    struct ics_irq_state *irq = ics->irqs + nr - ics->offset;
+    ICSIRQState *irq = ics->irqs + nr - ics->offset;
 
     trace_xics_ics_reject(nr, nr - ics->offset);
     irq->status |= XICS_STATUS_REJECTED; /* Irrelevant but harmless for LSI */
     irq->status &= ~XICS_STATUS_SENT; /* Irrelevant but harmless for MSI */
 }
 
-static void ics_resend(struct ics_state *ics)
+static void ics_resend(ICSState *ics)
 {
     int i;
 
@@ -324,10 +329,10 @@ static void ics_resend(struct ics_state *ics)
     }
 }
 
-static void ics_eoi(struct ics_state *ics, int nr)
+static void ics_eoi(ICSState *ics, int nr)
 {
     int srcno = nr - ics->offset;
-    struct ics_irq_state *irq = ics->irqs + srcno;
+    ICSIRQState *irq = ics->irqs + srcno;
 
     trace_xics_ics_eoi(nr);
 
@@ -336,11 +341,92 @@ static void ics_eoi(struct ics_state *ics, int nr)
     }
 }
 
+static void ics_reset(DeviceState *dev)
+{
+    ICSState *ics = ICS(dev);
+    int i;
+
+    memset(ics->irqs, 0, sizeof(ICSIRQState) * ics->nr_irqs);
+    for (i = 0; i < ics->nr_irqs; i++) {
+        ics->irqs[i].priority = 0xff;
+        ics->irqs[i].saved_priority = 0xff;
+    }
+}
+
+static int ics_post_load(void *opaque, int version_id)
+{
+    int i;
+    ICSState *ics = opaque;
+
+    for (i = 0; i < ics->icp->nr_servers; i++) {
+        icp_resend(ics->icp, i);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_ics_irq = {
+    .name = "ics/irq",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(server, ICSIRQState),
+        VMSTATE_UINT8(priority, ICSIRQState),
+        VMSTATE_UINT8(saved_priority, ICSIRQState),
+        VMSTATE_UINT8(status, ICSIRQState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_ics = {
+    .name = "ics",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .post_load = ics_post_load,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(nr_irqs, ICSState),
+
+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(irqs, ICSState, nr_irqs,
+                                             vmstate_ics_irq, ICSIRQState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static int ics_realize(DeviceState *dev)
+{
+    ICSState *ics = ICS(dev);
+
+    ics->irqs = g_malloc0(ics->nr_irqs * sizeof(ICSIRQState));
+    ics->islsi = g_malloc0(ics->nr_irqs * sizeof(bool));
+    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, ics->nr_irqs);
+
+    return 0;
+}
+
+static void ics_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->init = ics_realize;
+    dc->vmsd = &vmstate_ics;
+    dc->reset = ics_reset;
+}
+
+static TypeInfo ics_info = {
+    .name = TYPE_ICS,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(ICSState),
+    .class_init = ics_class_init,
+};
+
 /*
  * Exported functions
  */
 
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
+qemu_irq xics_get_qirq(XICSState *icp, int irq)
 {
     if (!ics_valid_irq(icp->ics, irq)) {
         return NULL;
@@ -349,13 +435,17 @@ qemu_irq xics_get_qirq(struct icp_state *icp, int irq)
     return icp->ics->qirqs[irq - icp->ics->offset];
 }
 
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi)
+void xics_set_irq_type(XICSState *icp, int irq, bool lsi)
 {
     assert(ics_valid_irq(icp->ics, irq));
 
     icp->ics->islsi[irq - icp->ics->offset] = lsi;
 }
 
+/*
+ * Guest interfaces
+ */
+
 static target_ulong h_cppr(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                            target_ulong opcode, target_ulong *args)
 {
@@ -405,7 +495,7 @@ static void rtas_set_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr, server, priority;
 
     if ((nargs != 3) || (nret != 1)) {
@@ -433,7 +523,7 @@ static void rtas_get_xive(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                           uint32_t nargs, target_ulong args,
                           uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 3)) {
@@ -458,7 +548,7 @@ static void rtas_int_off(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                          uint32_t nargs, target_ulong args,
                          uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 1)) {
@@ -484,7 +574,7 @@ static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                         uint32_t nargs, target_ulong args,
                         uint32_t nret, target_ulong rets)
 {
-    struct ics_state *ics = spapr->icp->ics;
+    ICSState *ics = spapr->icp->ics;
     uint32_t nr;
 
     if ((nargs != 1) || (nret != 1)) {
@@ -506,32 +596,27 @@ static void rtas_int_on(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     rtas_st(rets, 0, 0); /* Success */
 }
 
-static void xics_reset(void *opaque)
+/*
+ * XICS
+ */
+
+static void xics_reset(DeviceState *d)
 {
-    struct icp_state *icp = (struct icp_state *)opaque;
-    struct ics_state *ics = icp->ics;
+    XICSState *icp = XICS(d);
     int i;
 
     for (i = 0; i < icp->nr_servers; i++) {
-        icp->ss[i].xirr = 0;
-        icp->ss[i].pending_priority = 0xff;
-        icp->ss[i].mfrr = 0xff;
-        /* Make all outputs are deasserted */
-        qemu_set_irq(icp->ss[i].output, 0);
+        device_reset(DEVICE(&icp->ss[i]));
     }
 
-    memset(ics->irqs, 0, sizeof(struct ics_irq_state) * ics->nr_irqs);
-    for (i = 0; i < ics->nr_irqs; i++) {
-        ics->irqs[i].priority = 0xff;
-        ics->irqs[i].saved_priority = 0xff;
-    }
+    device_reset(DEVICE(icp->ics));
 }
 
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
+void xics_cpu_setup(XICSState *icp, PowerPCCPU *cpu)
 {
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
-    struct icp_server_state *ss = &icp->ss[cs->cpu_index];
+    ICPState *ss = &icp->ss[cs->cpu_index];
 
     assert(cs->cpu_index < icp->nr_servers);
 
@@ -551,37 +636,73 @@ void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu)
     }
 }
 
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs)
+static void xics_realize(DeviceState *dev, Error **errp)
 {
-    struct icp_state *icp;
-    struct ics_state *ics;
-
-    icp = g_malloc0(sizeof(*icp));
-    icp->nr_servers = nr_servers;
-    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
+    XICSState *icp = XICS(dev);
+    ICSState *ics = icp->ics;
+    int i;
 
-    ics = g_malloc0(sizeof(*ics));
-    ics->nr_irqs = nr_irqs;
+    ics->nr_irqs = icp->nr_irqs;
     ics->offset = XICS_IRQ_BASE;
-    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
-    ics->islsi = g_malloc0(nr_irqs * sizeof(bool));
-
-    icp->ics = ics;
     ics->icp = icp;
+    qdev_init_nofail(DEVICE(ics));
 
-    ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
+    icp->ss = g_malloc0(icp->nr_servers*sizeof(ICPState));
+    for (i = 0; i < icp->nr_servers; i++) {
+        char buffer[32];
+        object_initialize(&icp->ss[i], TYPE_ICP);
+        snprintf(buffer, sizeof(buffer), "icp[%d]", i);
+        object_property_add_child(OBJECT(icp), buffer, OBJECT(&icp->ss[i]), NULL);
+        qdev_init_nofail(DEVICE(&icp->ss[i]));
+    }
+}
 
-    spapr_register_hypercall(H_CPPR, h_cppr);
-    spapr_register_hypercall(H_IPI, h_ipi);
-    spapr_register_hypercall(H_XIRR, h_xirr);
-    spapr_register_hypercall(H_EOI, h_eoi);
+static void xics_initfn(Object *obj)
+{
+    XICSState *xics = XICS(obj);
+
+    xics->ics = ICS(object_new(TYPE_ICS));
+    object_property_add_child(obj, "ics", OBJECT(xics->ics), NULL);
+}
+
+static Property xics_properties[] = {
+    DEFINE_PROP_UINT32("nr_servers", XICSState, nr_servers, -1),
+    DEFINE_PROP_UINT32("nr_irqs", XICSState, nr_irqs, -1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xics_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = xics_realize;
+    dc->props = xics_properties;
+    dc->reset = xics_reset;
 
     spapr_rtas_register("ibm,set-xive", rtas_set_xive);
     spapr_rtas_register("ibm,get-xive", rtas_get_xive);
     spapr_rtas_register("ibm,int-off", rtas_int_off);
     spapr_rtas_register("ibm,int-on", rtas_int_on);
 
-    qemu_register_reset(xics_reset, icp);
+    spapr_register_hypercall(H_CPPR, h_cppr);
+    spapr_register_hypercall(H_IPI, h_ipi);
+    spapr_register_hypercall(H_XIRR, h_xirr);
+    spapr_register_hypercall(H_EOI, h_eoi);
+}
+
+static const TypeInfo xics_info = {
+    .name          = TYPE_XICS,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XICSState),
+    .class_init    = xics_class_init,
+    .instance_init = xics_initfn,
+};
 
-    return icp;
+static void xics_register_types(void)
+{
+    type_register_static(&xics_info);
+    type_register_static(&ics_info);
+    type_register_static(&icp_info);
 }
+
+type_init(xics_register_types)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 7144829..16bfab9 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -129,6 +129,34 @@ int spapr_allocate_irq_block(int num, bool lsi)
     return first;
 }
 
+static XICSState *try_create_xics(const char *type, int nr_servers,
+                                  int nr_irqs)
+{
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, type);
+    qdev_prop_set_uint32(dev, "nr_servers", nr_servers);
+    qdev_prop_set_uint32(dev, "nr_irqs", nr_irqs);
+    if (qdev_init(dev) < 0) {
+        return NULL;
+    }
+
+    return XICS(dev);
+}
+
+static XICSState *xics_system_init(int nr_servers, int nr_irqs)
+{
+    XICSState *icp = NULL;
+
+    icp = try_create_xics(TYPE_XICS, nr_servers, nr_irqs);
+    if (!icp) {
+        perror("Failed to create XICS\n");
+        abort();
+    }
+
+    return icp;
+}
+
 static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
 {
     int ret = 0, offset;
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index b06ce79..9fc1972 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -7,7 +7,6 @@
 struct VIOsPAPRBus;
 struct sPAPRPHBState;
 struct sPAPRNVRAM;
-struct icp_state;
 
 #define HPTE64_V_HPTE_DIRTY     0x0000000000000040ULL
 
@@ -15,7 +14,7 @@ typedef struct sPAPREnvironment {
     struct VIOsPAPRBus *vio_bus;
     QLIST_HEAD(, sPAPRPHBState) phbs;
     struct sPAPRNVRAM *nvram;
-    struct icp_state *icp;
+    XICSState *icp;
 
     hwaddr ram_limit;
     void *htab;
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index 6bce042..66364c5 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -27,15 +27,77 @@
 #if !defined(__XICS_H__)
 #define __XICS_H__
 
+#include "hw/sysbus.h"
+
+#define TYPE_XICS "xics"
+#define XICS(obj) OBJECT_CHECK(XICSState, (obj), TYPE_XICS)
+
 #define XICS_IPI        0x2
-#define XICS_IRQ_BASE   0x10
+#define XICS_BUID       0x1
+#define XICS_IRQ_BASE   (XICS_BUID << 12)
+
+/*
+ * We currently only support one BUID which is our interrupt base
+ * (the kernel implementation supports more but we don't exploit
+ *  that yet)
+ */
+typedef struct XICSState XICSState;
+typedef struct ICPState ICPState;
+typedef struct ICSState ICSState;
+typedef struct ICSIRQState ICSIRQState;
+
+struct XICSState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+    uint32_t nr_servers;
+    uint32_t nr_irqs;
+    ICPState *ss;
+    ICSState *ics;
+};
+
+#define TYPE_ICP "icp"
+#define ICP(obj) OBJECT_CHECK(ICPState, (obj), TYPE_ICP)
+
+struct ICPState {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+    uint32_t xirr;
+    uint8_t pending_priority;
+    uint8_t mfrr;
+    qemu_irq output;
+};
+
+#define TYPE_ICS "ics"
+#define ICS(obj) OBJECT_CHECK(ICSState, (obj), TYPE_ICS)
+
+struct ICSState {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+    uint32_t nr_irqs;
+    uint32_t offset;
+    qemu_irq *qirqs;
+    bool *islsi;
+    ICSIRQState *irqs;
+    XICSState *icp;
+};
 
-struct icp_state;
+struct ICSIRQState {
+    uint32_t server;
+    uint8_t priority;
+    uint8_t saved_priority;
+#define XICS_STATUS_ASSERTED           0x1
+#define XICS_STATUS_SENT               0x2
+#define XICS_STATUS_REJECTED           0x4
+#define XICS_STATUS_MASKED_PENDING     0x8
+    uint8_t status;
+};
 
-qemu_irq xics_get_qirq(struct icp_state *icp, int irq);
-void xics_set_irq_type(struct icp_state *icp, int irq, bool lsi);
+qemu_irq xics_get_qirq(XICSState *icp, int irq);
+void xics_set_irq_type(XICSState *icp, int irq, bool lsi);
 
-struct icp_state *xics_system_init(int nr_servers, int nr_irqs);
-void xics_cpu_setup(struct icp_state *icp, PowerPCCPU *cpu);
+void xics_cpu_setup(XICSState *icp, PowerPCCPU *cpu);
 
 #endif /* __XICS_H__ */
commit e68cb8b4fa7e20e666a3bfc571a0e075733d22bd
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 18 14:33:03 2013 -0500

    pseries: savevm support with KVM
    
    At present, the savevm / migration support for the pseries machine will not
    work when KVM is enabled.  That's because KVM manages the guest's hash page
    table in the host kernel, so qemu has no visibility of it.  This patch
    fixes this by using new kernel interfaces to extract and reinsert the
    guest's hash table during the migration process.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Message-id: 1374175984-8930-11-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 734a782..7144829 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -735,17 +735,27 @@ static int htab_save_setup(QEMUFile *f, void *opaque)
 {
     sPAPREnvironment *spapr = opaque;
 
-    spapr->htab_save_index = 0;
-    spapr->htab_first_pass = true;
-
     /* "Iteration" header */
     qemu_put_be32(f, spapr->htab_shift);
 
+    if (spapr->htab) {
+        spapr->htab_save_index = 0;
+        spapr->htab_first_pass = true;
+    } else {
+        assert(kvm_enabled());
+
+        spapr->htab_fd = kvmppc_get_htab_fd(false);
+        if (spapr->htab_fd < 0) {
+            fprintf(stderr, "Unable to open fd for reading hash table from KVM: %s\n",
+                    strerror(errno));
+            return -1;
+        }
+    }
+
+
     return 0;
 }
 
-#define MAX_ITERATION_NS    5000000 /* 5 ms */
-
 static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
                                  int64_t max_ns)
 {
@@ -796,8 +806,8 @@ static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
     spapr->htab_save_index = index;
 }
 
-static bool htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
-                                 int64_t max_ns)
+static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                int64_t max_ns)
 {
     bool final = max_ns < 0;
     int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
@@ -870,21 +880,32 @@ static bool htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
 
     spapr->htab_save_index = index;
 
-    return (examined >= htabslots) && (sent == 0);
+    return (examined >= htabslots) && (sent == 0) ? 1 : 0;
 }
 
+#define MAX_ITERATION_NS    5000000 /* 5 ms */
+#define MAX_KVM_BUF_SIZE    2048
+
 static int htab_save_iterate(QEMUFile *f, void *opaque)
 {
     sPAPREnvironment *spapr = opaque;
-    bool nothingleft = false;;
+    int rc = 0;
 
     /* Iteration header */
     qemu_put_be32(f, 0);
 
-    if (spapr->htab_first_pass) {
+    if (!spapr->htab) {
+        assert(kvm_enabled());
+
+        rc = kvmppc_save_htab(f, spapr->htab_fd,
+                              MAX_KVM_BUF_SIZE, MAX_ITERATION_NS);
+        if (rc < 0) {
+            return rc;
+        }
+    } else  if (spapr->htab_first_pass) {
         htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
     } else {
-        nothingleft = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
+        rc = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
     }
 
     /* End marker */
@@ -892,7 +913,7 @@ static int htab_save_iterate(QEMUFile *f, void *opaque)
     qemu_put_be16(f, 0);
     qemu_put_be16(f, 0);
 
-    return nothingleft ? 1 : 0;
+    return rc;
 }
 
 static int htab_save_complete(QEMUFile *f, void *opaque)
@@ -902,7 +923,20 @@ static int htab_save_complete(QEMUFile *f, void *opaque)
     /* Iteration header */
     qemu_put_be32(f, 0);
 
-    htab_save_later_pass(f, spapr, -1);
+    if (!spapr->htab) {
+        int rc;
+
+        assert(kvm_enabled());
+
+        rc = kvmppc_save_htab(f, spapr->htab_fd, MAX_KVM_BUF_SIZE, -1);
+        if (rc < 0) {
+            return rc;
+        }
+        close(spapr->htab_fd);
+        spapr->htab_fd = -1;
+    } else {
+        htab_save_later_pass(f, spapr, -1);
+    }
 
     /* End marker */
     qemu_put_be32(f, 0);
@@ -916,6 +950,7 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
 {
     sPAPREnvironment *spapr = opaque;
     uint32_t section_hdr;
+    int fd = -1;
 
     if (version_id < 1 || version_id > 1) {
         fprintf(stderr, "htab_load() bad version\n");
@@ -932,6 +967,16 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
         return 0;
     }
 
+    if (!spapr->htab) {
+        assert(kvm_enabled());
+
+        fd = kvmppc_get_htab_fd(true);
+        if (fd < 0) {
+            fprintf(stderr, "Unable to open fd to restore KVM hash table: %s\n",
+                    strerror(errno));
+        }
+    }
+
     while (true) {
         uint32_t index;
         uint16_t n_valid, n_invalid;
@@ -945,24 +990,41 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
             break;
         }
 
-        if ((index + n_valid + n_invalid) >=
+        if ((index + n_valid + n_invalid) >
             (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
             /* Bad index in stream */
             fprintf(stderr, "htab_load() bad index %d (%hd+%hd entries) "
-                    "in htab stream\n", index, n_valid, n_invalid);
+                    "in htab stream (htab_shift=%d)\n", index, n_valid, n_invalid,
+                    spapr->htab_shift);
             return -EINVAL;
         }
 
-        if (n_valid) {
-            qemu_get_buffer(f, HPTE(spapr->htab, index),
-                            HASH_PTE_SIZE_64 * n_valid);
-        }
-        if (n_invalid) {
-            memset(HPTE(spapr->htab, index + n_valid), 0,
-                   HASH_PTE_SIZE_64 * n_invalid);
+        if (spapr->htab) {
+            if (n_valid) {
+                qemu_get_buffer(f, HPTE(spapr->htab, index),
+                                HASH_PTE_SIZE_64 * n_valid);
+            }
+            if (n_invalid) {
+                memset(HPTE(spapr->htab, index + n_valid), 0,
+                       HASH_PTE_SIZE_64 * n_invalid);
+            }
+        } else {
+            int rc;
+
+            assert(fd >= 0);
+
+            rc = kvmppc_load_htab_chunk(f, fd, index, n_valid, n_invalid);
+            if (rc < 0) {
+                return rc;
+            }
         }
     }
 
+    if (!spapr->htab) {
+        assert(fd >= 0);
+        close(fd);
+    }
+
     return 0;
 }
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 00a6f58..b06ce79 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -37,6 +37,7 @@ typedef struct sPAPREnvironment {
     /* Migration state */
     int htab_save_index;
     bool htab_first_pass;
+    int htab_fd;
 } sPAPREnvironment;
 
 #define H_SUCCESS         0
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 9f2e4f0..27e2aaf 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -65,6 +65,7 @@ static int cap_one_reg;
 static int cap_epr;
 static int cap_ppc_watchdog;
 static int cap_papr;
+static int cap_htab_fd;
 
 /* XXX We have a race condition where we actually have a level triggered
  *     interrupt, but the infrastructure can't expose that yet, so the guest
@@ -101,6 +102,7 @@ int kvm_arch_init(KVMState *s)
     cap_ppc_watchdog = kvm_check_extension(s, KVM_CAP_PPC_BOOKE_WATCHDOG);
     /* Note: we don't set cap_papr here, because this capability is
      * only activated after this by kvmppc_set_papr() */
+    cap_htab_fd = kvm_check_extension(s, KVM_CAP_PPC_HTAB_FD);
 
     if (!cap_interrupt_level) {
         fprintf(stderr, "KVM: Couldn't find level irq capability. Expect the "
@@ -1788,6 +1790,73 @@ static int kvm_ppc_register_host_cpu_type(void)
 }
 
 
+int kvmppc_get_htab_fd(bool write)
+{
+    struct kvm_get_htab_fd s = {
+        .flags = write ? KVM_GET_HTAB_WRITE : 0,
+        .start_index = 0,
+    };
+
+    if (!cap_htab_fd) {
+        fprintf(stderr, "KVM version doesn't support saving the hash table\n");
+        return -1;
+    }
+
+    return kvm_vm_ioctl(kvm_state, KVM_PPC_GET_HTAB_FD, &s);
+}
+
+int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns)
+{
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+    uint8_t buf[bufsize];
+    ssize_t rc;
+
+    do {
+        rc = read(fd, buf, bufsize);
+        if (rc < 0) {
+            fprintf(stderr, "Error reading data from KVM HTAB fd: %s\n",
+                    strerror(errno));
+            return rc;
+        } else if (rc) {
+            /* Kernel already retuns data in BE format for the file */
+            qemu_put_buffer(f, buf, rc);
+        }
+    } while ((rc != 0)
+             && ((max_ns < 0)
+                 || ((qemu_get_clock_ns(rt_clock) - starttime) < max_ns)));
+
+    return (rc == 0) ? 1 : 0;
+}
+
+int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                           uint16_t n_valid, uint16_t n_invalid)
+{
+    struct kvm_get_htab_header *buf;
+    size_t chunksize = sizeof(*buf) + n_valid*HASH_PTE_SIZE_64;
+    ssize_t rc;
+
+    buf = alloca(chunksize);
+    /* This is KVM on ppc, so this is all big-endian */
+    buf->index = index;
+    buf->n_valid = n_valid;
+    buf->n_invalid = n_invalid;
+
+    qemu_get_buffer(f, (void *)(buf + 1), HASH_PTE_SIZE_64*n_valid);
+
+    rc = write(fd, buf, chunksize);
+    if (rc < 0) {
+        fprintf(stderr, "Error writing KVM hash table: %s\n",
+                strerror(errno));
+        return rc;
+    }
+    if (rc != chunksize) {
+        /* We should never get a short write on a single chunk */
+        fprintf(stderr, "Short write, restoring KVM hash table\n");
+        return -1;
+    }
+    return 0;
+}
+
 bool kvm_arch_stop_on_emulation_error(CPUState *cpu)
 {
     return true;
diff --git a/target-ppc/kvm_ppc.h b/target-ppc/kvm_ppc.h
index 771cfbe..4ae7bf2 100644
--- a/target-ppc/kvm_ppc.h
+++ b/target-ppc/kvm_ppc.h
@@ -38,6 +38,10 @@ uint64_t kvmppc_rma_size(uint64_t current_size, unsigned int hash_shift);
 #endif /* !CONFIG_USER_ONLY */
 int kvmppc_fixup_cpu(PowerPCCPU *cpu);
 bool kvmppc_has_cap_epr(void);
+int kvmppc_get_htab_fd(bool write);
+int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns);
+int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                           uint16_t n_valid, uint16_t n_invalid);
 
 #else
 
@@ -159,6 +163,24 @@ static inline bool kvmppc_has_cap_epr(void)
 {
     return false;
 }
+
+static inline int kvmppc_get_htab_fd(bool write)
+{
+    return -1;
+}
+
+static inline int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize,
+                                   int64_t max_ns)
+{
+    abort();
+}
+
+static inline int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
+                                         uint16_t n_valid, uint16_t n_invalid)
+{
+    abort();
+}
+
 #endif
 
 #ifndef CONFIG_KVM
commit 1112cf94c82dfc743b62b5bcb96dd20f47b683a8
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:33:02 2013 -0500

    pseries: savevm support for PCI host bridge
    
    This adds the necessary support for saving the state of the PAPR virtual
    PCI host bridge (or host bridges).
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-10-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 9dc6ca3..3156fdd 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -662,6 +662,54 @@ static Property spapr_phb_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_pci_lsi = {
+    .name = "spapr_pci/lsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32_EQUAL(irq, struct spapr_pci_lsi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_spapr_pci_msi = {
+    .name = "spapr_pci/lsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(config_addr, struct spapr_pci_msi),
+        VMSTATE_UINT32(irq, struct spapr_pci_msi),
+        VMSTATE_UINT32(nvec, struct spapr_pci_msi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_spapr_pci = {
+    .name = "spapr_pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64_EQUAL(buid, sPAPRPHBState),
+        VMSTATE_UINT32_EQUAL(dma_liobn, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(mem_win_addr, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(mem_win_size, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(io_win_addr, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(io_win_size, sPAPRPHBState),
+        VMSTATE_UINT64_EQUAL(msi_win_addr, sPAPRPHBState),
+        VMSTATE_STRUCT_ARRAY(lsi_table, sPAPRPHBState, PCI_NUM_PINS, 0,
+                             vmstate_spapr_pci_lsi, struct spapr_pci_lsi),
+        VMSTATE_STRUCT_ARRAY(msi_table, sPAPRPHBState, SPAPR_MSIX_MAX_DEVS, 0,
+                             vmstate_spapr_pci_msi, struct spapr_pci_msi),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const char *spapr_phb_root_bus_path(PCIHostState *host_bridge,
                                            PCIBus *rootbus)
 {
@@ -680,6 +728,7 @@ static void spapr_phb_class_init(ObjectClass *klass, void *data)
     sdc->init = spapr_phb_init;
     dc->props = spapr_phb_properties;
     dc->reset = spapr_phb_reset;
+    dc->vmsd = &vmstate_spapr_pci;
 }
 
 static const TypeInfo spapr_phb_info = {
diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
index 1e23dbf..93f9511 100644
--- a/include/hw/pci-host/spapr.h
+++ b/include/hw/pci-host/spapr.h
@@ -52,14 +52,14 @@ typedef struct sPAPRPHBState {
     sPAPRTCETable *tcet;
     AddressSpace iommu_as;
 
-    struct {
+    struct spapr_pci_lsi {
         uint32_t irq;
     } lsi_table[PCI_NUM_PINS];
 
-    struct {
+    struct spapr_pci_msi {
         uint32_t config_addr;
         uint32_t irq;
-        int nvec;
+        uint32_t nvec;
     } msi_table[SPAPR_MSIX_MAX_DEVS];
 
     QLIST_ENTRY(sPAPRPHBState) list;
commit 4be21d561d59da9d6f20f872882652bc3561f871
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:33:01 2013 -0500

    pseries: savevm support for pseries machine
    
    This adds the necessary pieces to implement savevm / migration for the
    pseries machine.  The most complex part here is migrating the hash
    table - for the paravirtualized pseries machine the guest's hash page
    table is not stored within guest memory, but externally and the guest
    accesses it via hypercalls.
    
    This patch uses a hypervisor reserved bit of the HPTE as a dirty bit
    (tracking changes to the HPTE itself, not the page it references).
    This is used to implement a live migration style incremental save and
    restore of the hash table contents.
    
    Normally a hash table is 16MB but it can get bigger depending on how
    much RAM the guest has. Due to its nature, updates to it are random so
    the live migration style is used for it.
    
    In addition it adds VMStateDescription information to save and restore
    the (few) remaining pieces of state information needed by the pseries
    machine.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-9-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index e340708..734a782 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -32,6 +32,7 @@
 #include "sysemu/cpus.h"
 #include "sysemu/kvm.h"
 #include "kvm_ppc.h"
+#include "mmu-hash64.h"
 
 #include "hw/boards.h"
 #include "hw/ppc/ppc.h"
@@ -666,7 +667,7 @@ static void spapr_cpu_reset(void *opaque)
 
     env->spr[SPR_HIOR] = 0;
 
-    env->external_htab = spapr->htab;
+    env->external_htab = (uint8_t *)spapr->htab;
     env->htab_base = -1;
     env->htab_mask = HTAB_SIZE(spapr) - 1;
     env->spr[SPR_SDR1] = (target_ulong)(uintptr_t)spapr->htab |
@@ -710,6 +711,268 @@ static int spapr_vga_init(PCIBus *pci_bus)
     }
 }
 
+static const VMStateDescription vmstate_spapr = {
+    .name = "spapr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(next_irq, sPAPREnvironment),
+
+        /* RTC offset */
+        VMSTATE_UINT64(rtc_offset, sPAPREnvironment),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+#define HPTE(_table, _i)   (void *)(((uint64_t *)(_table)) + ((_i) * 2))
+#define HPTE_VALID(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_VALID)
+#define HPTE_DIRTY(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_HPTE_DIRTY)
+#define CLEAN_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) &= tswap64(~HPTE64_V_HPTE_DIRTY))
+
+static int htab_save_setup(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+
+    spapr->htab_save_index = 0;
+    spapr->htab_first_pass = true;
+
+    /* "Iteration" header */
+    qemu_put_be32(f, spapr->htab_shift);
+
+    return 0;
+}
+
+#define MAX_ITERATION_NS    5000000 /* 5 ms */
+
+static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                 int64_t max_ns)
+{
+    int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
+    int index = spapr->htab_save_index;
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+
+    assert(spapr->htab_first_pass);
+
+    do {
+        int chunkstart;
+
+        /* Consume invalid HPTEs */
+        while ((index < htabslots)
+               && !HPTE_VALID(HPTE(spapr->htab, index))) {
+            index++;
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+        }
+
+        /* Consume valid HPTEs */
+        chunkstart = index;
+        while ((index < htabslots)
+               && HPTE_VALID(HPTE(spapr->htab, index))) {
+            index++;
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+        }
+
+        if (index > chunkstart) {
+            int n_valid = index - chunkstart;
+
+            qemu_put_be32(f, chunkstart);
+            qemu_put_be16(f, n_valid);
+            qemu_put_be16(f, 0);
+            qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
+                            HASH_PTE_SIZE_64 * n_valid);
+
+            if ((qemu_get_clock_ns(rt_clock) - starttime) > max_ns) {
+                break;
+            }
+        }
+    } while ((index < htabslots) && !qemu_file_rate_limit(f));
+
+    if (index >= htabslots) {
+        assert(index == htabslots);
+        index = 0;
+        spapr->htab_first_pass = false;
+    }
+    spapr->htab_save_index = index;
+}
+
+static bool htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
+                                 int64_t max_ns)
+{
+    bool final = max_ns < 0;
+    int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
+    int examined = 0, sent = 0;
+    int index = spapr->htab_save_index;
+    int64_t starttime = qemu_get_clock_ns(rt_clock);
+
+    assert(!spapr->htab_first_pass);
+
+    do {
+        int chunkstart, invalidstart;
+
+        /* Consume non-dirty HPTEs */
+        while ((index < htabslots)
+               && !HPTE_DIRTY(HPTE(spapr->htab, index))) {
+            index++;
+            examined++;
+        }
+
+        chunkstart = index;
+        /* Consume valid dirty HPTEs */
+        while ((index < htabslots)
+               && HPTE_DIRTY(HPTE(spapr->htab, index))
+               && HPTE_VALID(HPTE(spapr->htab, index))) {
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+            index++;
+            examined++;
+        }
+
+        invalidstart = index;
+        /* Consume invalid dirty HPTEs */
+        while ((index < htabslots)
+               && HPTE_DIRTY(HPTE(spapr->htab, index))
+               && !HPTE_VALID(HPTE(spapr->htab, index))) {
+            CLEAN_HPTE(HPTE(spapr->htab, index));
+            index++;
+            examined++;
+        }
+
+        if (index > chunkstart) {
+            int n_valid = invalidstart - chunkstart;
+            int n_invalid = index - invalidstart;
+
+            qemu_put_be32(f, chunkstart);
+            qemu_put_be16(f, n_valid);
+            qemu_put_be16(f, n_invalid);
+            qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
+                            HASH_PTE_SIZE_64 * n_valid);
+            sent += index - chunkstart;
+
+            if (!final && (qemu_get_clock_ns(rt_clock) - starttime) > max_ns) {
+                break;
+            }
+        }
+
+        if (examined >= htabslots) {
+            break;
+        }
+
+        if (index >= htabslots) {
+            assert(index == htabslots);
+            index = 0;
+        }
+    } while ((examined < htabslots) && (!qemu_file_rate_limit(f) || final));
+
+    if (index >= htabslots) {
+        assert(index == htabslots);
+        index = 0;
+    }
+
+    spapr->htab_save_index = index;
+
+    return (examined >= htabslots) && (sent == 0);
+}
+
+static int htab_save_iterate(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+    bool nothingleft = false;;
+
+    /* Iteration header */
+    qemu_put_be32(f, 0);
+
+    if (spapr->htab_first_pass) {
+        htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
+    } else {
+        nothingleft = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
+    }
+
+    /* End marker */
+    qemu_put_be32(f, 0);
+    qemu_put_be16(f, 0);
+    qemu_put_be16(f, 0);
+
+    return nothingleft ? 1 : 0;
+}
+
+static int htab_save_complete(QEMUFile *f, void *opaque)
+{
+    sPAPREnvironment *spapr = opaque;
+
+    /* Iteration header */
+    qemu_put_be32(f, 0);
+
+    htab_save_later_pass(f, spapr, -1);
+
+    /* End marker */
+    qemu_put_be32(f, 0);
+    qemu_put_be16(f, 0);
+    qemu_put_be16(f, 0);
+
+    return 0;
+}
+
+static int htab_load(QEMUFile *f, void *opaque, int version_id)
+{
+    sPAPREnvironment *spapr = opaque;
+    uint32_t section_hdr;
+
+    if (version_id < 1 || version_id > 1) {
+        fprintf(stderr, "htab_load() bad version\n");
+        return -EINVAL;
+    }
+
+    section_hdr = qemu_get_be32(f);
+
+    if (section_hdr) {
+        /* First section, just the hash shift */
+        if (spapr->htab_shift != section_hdr) {
+            return -EINVAL;
+        }
+        return 0;
+    }
+
+    while (true) {
+        uint32_t index;
+        uint16_t n_valid, n_invalid;
+
+        index = qemu_get_be32(f);
+        n_valid = qemu_get_be16(f);
+        n_invalid = qemu_get_be16(f);
+
+        if ((index == 0) && (n_valid == 0) && (n_invalid == 0)) {
+            /* End of Stream */
+            break;
+        }
+
+        if ((index + n_valid + n_invalid) >=
+            (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
+            /* Bad index in stream */
+            fprintf(stderr, "htab_load() bad index %d (%hd+%hd entries) "
+                    "in htab stream\n", index, n_valid, n_invalid);
+            return -EINVAL;
+        }
+
+        if (n_valid) {
+            qemu_get_buffer(f, HPTE(spapr->htab, index),
+                            HASH_PTE_SIZE_64 * n_valid);
+        }
+        if (n_invalid) {
+            memset(HPTE(spapr->htab, index + n_valid), 0,
+                   HASH_PTE_SIZE_64 * n_invalid);
+        }
+    }
+
+    return 0;
+}
+
+static SaveVMHandlers savevm_htab_handlers = {
+    .save_live_setup = htab_save_setup,
+    .save_live_iterate = htab_save_iterate,
+    .save_live_complete = htab_save_complete,
+    .load_state = htab_load,
+};
+
 /* pSeries LPAR / sPAPR hardware init */
 static void ppc_spapr_init(QEMUMachineInitArgs *args)
 {
@@ -950,6 +1213,10 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
 
     spapr->entry_point = 0x100;
 
+    vmstate_register(NULL, 0, &vmstate_spapr, spapr);
+    register_savevm_live(NULL, "spapr/htab", -1, 1,
+                         &savevm_htab_handlers, spapr);
+
     /* Prepare the device tree */
     spapr->fdt_skel = spapr_create_fdt_skel(cpu_model,
                                             initrd_base, initrd_size,
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index ed32dec..67d6cd9 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -115,7 +115,7 @@ static target_ulong h_enter(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     }
     ppc_hash64_store_hpte1(env, hpte, ptel);
     /* eieio();  FIXME: need some sort of barrier for smp? */
-    ppc_hash64_store_hpte0(env, hpte, pteh);
+    ppc_hash64_store_hpte0(env, hpte, pteh | HPTE64_V_HPTE_DIRTY);
 
     args[0] = pte_index + i;
     return H_SUCCESS;
@@ -152,7 +152,7 @@ static RemoveResult remove_hpte(CPUPPCState *env, target_ulong ptex,
     }
     *vp = v;
     *rp = r;
-    ppc_hash64_store_hpte0(env, hpte, 0);
+    ppc_hash64_store_hpte0(env, hpte, HPTE64_V_HPTE_DIRTY);
     rb = compute_tlbie_rb(v, r, ptex);
     ppc_tlb_invalidate_one(env, rb);
     return REMOVE_SUCCESS;
@@ -282,11 +282,11 @@ static target_ulong h_protect(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     r |= (flags << 48) & HPTE64_R_KEY_HI;
     r |= flags & (HPTE64_R_PP | HPTE64_R_N | HPTE64_R_KEY_LO);
     rb = compute_tlbie_rb(v, r, pte_index);
-    ppc_hash64_store_hpte0(env, hpte, v & ~HPTE64_V_VALID);
+    ppc_hash64_store_hpte0(env, hpte, (v & ~HPTE64_V_VALID) | HPTE64_V_HPTE_DIRTY);
     ppc_tlb_invalidate_one(env, rb);
     ppc_hash64_store_hpte1(env, hpte, r);
     /* Don't need a memory barrier, due to qemu's global lock */
-    ppc_hash64_store_hpte0(env, hpte, v);
+    ppc_hash64_store_hpte0(env, hpte, v | HPTE64_V_HPTE_DIRTY);
     return H_SUCCESS;
 }
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 82ad7c0..00a6f58 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -9,6 +9,8 @@ struct sPAPRPHBState;
 struct sPAPRNVRAM;
 struct icp_state;
 
+#define HPTE64_V_HPTE_DIRTY     0x0000000000000040ULL
+
 typedef struct sPAPREnvironment {
     struct VIOsPAPRBus *vio_bus;
     QLIST_HEAD(, sPAPRPHBState) phbs;
@@ -17,20 +19,24 @@ typedef struct sPAPREnvironment {
 
     hwaddr ram_limit;
     void *htab;
-    long htab_shift;
+    uint32_t htab_shift;
     hwaddr rma_size;
     int vrma_adjust;
     hwaddr fdt_addr, rtas_addr;
     long rtas_size;
     void *fdt_skel;
     target_ulong entry_point;
-    int next_irq;
-    int rtc_offset;
+    uint32_t next_irq;
+    uint64_t rtc_offset;
     char *cpu_model;
     bool has_graphics;
 
     uint32_t epow_irq;
     Notifier epow_notifier;
+
+    /* Migration state */
+    int htab_save_index;
+    bool htab_first_pass;
 } sPAPREnvironment;
 
 #define H_SUCCESS         0
commit 1168ec7da182d417125d9dea46908c0cfa2c40b7
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:33:00 2013 -0500

    pseries: savevm support for PAPR virtual SCSI
    
    This patch adds the necessary support for saving the state of the PAPR VIO
    virtual SCSI device. This also saves and restores active SCSI requests.
    
    [aik: implemented vscsi_req save/restore]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-8-git-send-email-aliguori at us.ibm.com
    Cc: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index b0858e9..46f4455 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -578,6 +578,69 @@ static void vscsi_request_cancelled(SCSIRequest *sreq)
     vscsi_put_req(req);
 }
 
+static const VMStateDescription vmstate_spapr_vscsi_req = {
+    .name = "spapr_vscsi_req",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_BUFFER(crq.raw, vscsi_req),
+        VMSTATE_BUFFER(iu.srp.reserved, vscsi_req),
+        VMSTATE_UINT32(qtag, vscsi_req),
+        VMSTATE_BOOL(active, vscsi_req),
+        VMSTATE_UINT32(data_len, vscsi_req),
+        VMSTATE_BOOL(writing, vscsi_req),
+        VMSTATE_UINT32(senselen, vscsi_req),
+        VMSTATE_BUFFER(sense, vscsi_req),
+        VMSTATE_UINT8(dma_fmt, vscsi_req),
+        VMSTATE_UINT16(local_desc, vscsi_req),
+        VMSTATE_UINT16(total_desc, vscsi_req),
+        VMSTATE_UINT16(cdb_offset, vscsi_req),
+      /*Restart SCSI request from the beginning for now */
+      /*VMSTATE_UINT16(cur_desc_num, vscsi_req),
+        VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
+{
+    vscsi_req *req = sreq->hba_private;
+    assert(req->active);
+
+    vmstate_save_state(f, &vmstate_spapr_vscsi_req, req);
+
+    dprintf("VSCSI: saving tag=%u, current desc#%d, offset=%x\n",
+            req->qtag, req->cur_desc_num, req->cur_desc_offset);
+}
+
+static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
+{
+    SCSIBus *bus = sreq->bus;
+    VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(bus->qbus.parent);
+    vscsi_req *req;
+    int rc;
+
+    assert(sreq->tag < VSCSI_REQ_LIMIT);
+    req = &s->reqs[sreq->tag];
+    assert(!req->active);
+
+    memset(req, 0, sizeof(*req));
+    rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1);
+    if (rc) {
+        fprintf(stderr, "VSCSI: failed loading request tag#%u\n", sreq->tag);
+        return NULL;
+    }
+    assert(req->active);
+
+    req->sreq = scsi_req_ref(sreq);
+
+    dprintf("VSCSI: restoring tag=%u, current desc#%d, offset=%x\n",
+            req->qtag, req->cur_desc_num, req->cur_desc_offset);
+
+    return req;
+}
+
 static void vscsi_process_login(VSCSIState *s, vscsi_req *req)
 {
     union viosrp_iu *iu = &req->iu;
@@ -932,7 +995,9 @@ static const struct SCSIBusInfo vscsi_scsi_info = {
 
     .transfer_data = vscsi_transfer_data,
     .complete = vscsi_command_complete,
-    .cancel = vscsi_request_cancelled
+    .cancel = vscsi_request_cancelled,
+    .save_request = vscsi_save_request,
+    .load_request = vscsi_load_request,
 };
 
 static void spapr_vscsi_reset(VIOsPAPRDevice *dev)
@@ -996,6 +1061,20 @@ static Property spapr_vscsi_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_vscsi = {
+    .name = "spapr_vscsi",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(vdev, VSCSIState),
+        /* VSCSI state */
+        /* ???? */
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1010,6 +1089,7 @@ static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
     k->signal_mask = 0x00000001;
     dc->props = spapr_vscsi_properties;
     k->rtce_window_size = 0x10000000;
+    dc->vmsd = &vmstate_spapr_vscsi;
 }
 
 static const TypeInfo spapr_vscsi_info = {
commit 8ca8a17c9a16eb3b2fedb3c74687c429e9cfc6aa
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 18 14:32:59 2013 -0500

    pseries: rework PAPR virtual SCSI
    
    The patch reimplements handling of indirect requests in order to
    simplify upcoming live migration support.
    - all pointers (except SCSIRequest*) were replaces with integer
    indexes and offsets;
    - DMA'ed srp_direct_buf kept untouched (ie. BE format);
    - vscsi_fetch_desc() is added, now it is the only place where
    descriptors are fetched and byteswapped;
    - vscsi_req struct fields converted to migration-friendly types;
    - many dprintf()'s fixed.
    
    This also removed an unused field 'lun' from the spapr_vscsi device
    which is assigned, but never used.  So, remove it.
    
    [David Gibson: removed unused 'lun']
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-7-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 55b44b9..b0858e9 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -75,20 +75,19 @@ typedef struct vscsi_req {
     /* SCSI request tracking */
     SCSIRequest             *sreq;
     uint32_t                qtag; /* qemu tag != srp tag */
-    int                     lun;
-    int                     active;
-    long                    data_len;
-    int                     writing;
-    int                     senselen;
+    bool                    active;
+    uint32_t                data_len;
+    bool                    writing;
+    uint32_t                senselen;
     uint8_t                 sense[SCSI_SENSE_BUF_SIZE];
 
     /* RDMA related bits */
     uint8_t                 dma_fmt;
-    struct srp_direct_buf   ext_desc;
-    struct srp_direct_buf   *cur_desc;
-    struct srp_indirect_buf *ind_desc;
-    int                     local_desc;
-    int                     total_desc;
+    uint16_t                local_desc;
+    uint16_t                total_desc;
+    uint16_t                cdb_offset;
+    uint16_t                cur_desc_num;
+    uint16_t                cur_desc_offset;
 } vscsi_req;
 
 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi"
@@ -264,93 +263,138 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     return 0;
 }
 
-static inline void vscsi_swap_desc(struct srp_direct_buf *desc)
+static inline struct srp_direct_buf vscsi_swap_desc(struct srp_direct_buf desc)
 {
-    desc->va = be64_to_cpu(desc->va);
-    desc->len = be32_to_cpu(desc->len);
+    desc.va = be64_to_cpu(desc.va);
+    desc.len = be32_to_cpu(desc.len);
+    return desc;
+}
+
+static int vscsi_fetch_desc(VSCSIState *s, struct vscsi_req *req,
+                            unsigned n, unsigned buf_offset,
+                            struct srp_direct_buf *ret)
+{
+    struct srp_cmd *cmd = &req->iu.srp.cmd;
+
+    switch (req->dma_fmt) {
+    case SRP_NO_DATA_DESC: {
+        dprintf("VSCSI: no data descriptor\n");
+        return 0;
+    }
+    case SRP_DATA_DESC_DIRECT: {
+        memcpy(ret, cmd->add_data + req->cdb_offset, sizeof(*ret));
+        assert(req->cur_desc_num == 0);
+        dprintf("VSCSI: direct segment\n");
+        break;
+    }
+    case SRP_DATA_DESC_INDIRECT: {
+        struct srp_indirect_buf *tmp = (struct srp_indirect_buf *)
+                                       (cmd->add_data + req->cdb_offset);
+        if (n < req->local_desc) {
+            *ret = tmp->desc_list[n];
+            dprintf("VSCSI: indirect segment local tag=0x%x desc#%d/%d\n",
+                    req->qtag, n, req->local_desc);
+
+        } else if (n < req->total_desc) {
+            int rc;
+            struct srp_direct_buf tbl_desc = vscsi_swap_desc(tmp->table_desc);
+            unsigned desc_offset = n * sizeof(struct srp_direct_buf);
+
+            if (desc_offset >= tbl_desc.len) {
+                dprintf("VSCSI:   #%d is ouf of range (%d bytes)\n",
+                        n, desc_offset);
+                return -1;
+            }
+            rc = spapr_vio_dma_read(&s->vdev, tbl_desc.va + desc_offset,
+                                    ret, sizeof(struct srp_direct_buf));
+            if (rc) {
+                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
+                        rc);
+                return -1;
+            }
+            dprintf("VSCSI: indirect segment ext. tag=0x%x desc#%d/%d { va=%"PRIx64" len=%x }\n",
+                    req->qtag, n, req->total_desc, tbl_desc.va, tbl_desc.len);
+        } else {
+            dprintf("VSCSI:   Out of descriptors !\n");
+            return 0;
+        }
+        break;
+    }
+    default:
+        fprintf(stderr, "VSCSI:   Unknown format %x\n", req->dma_fmt);
+        return -1;
+    }
+
+    *ret = vscsi_swap_desc(*ret);
+    if (buf_offset > ret->len) {
+        dprintf("   offset=%x is out of a descriptor #%d boundary=%x\n",
+                buf_offset, req->cur_desc_num, ret->len);
+        return -1;
+    }
+    ret->va += buf_offset;
+    ret->len -= buf_offset;
+
+    dprintf("   cur=%d offs=%x ret { va=%"PRIx64" len=%x }\n",
+            req->cur_desc_num, req->cur_desc_offset, ret->va, ret->len);
+
+    return ret->len ? 1 : 0;
 }
 
 static int vscsi_srp_direct_data(VSCSIState *s, vscsi_req *req,
                                  uint8_t *buf, uint32_t len)
 {
-    struct srp_direct_buf *md = req->cur_desc;
+    struct srp_direct_buf md;
     uint32_t llen;
     int rc = 0;
 
-    dprintf("VSCSI: direct segment 0x%x bytes, va=0x%llx desc len=0x%x\n",
-            len, (unsigned long long)md->va, md->len);
+    rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
+    if (rc < 0) {
+        return -1;
+    } else if (rc == 0) {
+        return 0;
+    }
 
-    llen = MIN(len, md->len);
+    llen = MIN(len, md.len);
     if (llen) {
         if (req->writing) { /* writing = to device = reading from memory */
-            rc = spapr_vio_dma_read(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
         } else {
-            rc = spapr_vio_dma_write(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
     }
-    md->len -= llen;
-    md->va += llen;
 
     if (rc) {
         return -1;
     }
+    req->cur_desc_offset += llen;
+
     return llen;
 }
 
 static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
                                    uint8_t *buf, uint32_t len)
 {
-    struct srp_direct_buf *td = &req->ind_desc->table_desc;
-    struct srp_direct_buf *md = req->cur_desc;
+    struct srp_direct_buf md;
     int rc = 0;
     uint32_t llen, total = 0;
 
-    dprintf("VSCSI: indirect segment 0x%x bytes, td va=0x%llx len=0x%x\n",
-            len, (unsigned long long)td->va, td->len);
+    dprintf("VSCSI: indirect segment 0x%x bytes\n", len);
 
     /* While we have data ... */
     while (len) {
-        /* If we have a descriptor but it's empty, go fetch a new one */
-        if (md && md->len == 0) {
-            /* More local available, use one */
-            if (req->local_desc) {
-                md = ++req->cur_desc;
-                --req->local_desc;
-                --req->total_desc;
-                td->va += sizeof(struct srp_direct_buf);
-            } else {
-                md = req->cur_desc = NULL;
-            }
-        }
-        /* No descriptor at hand, fetch one */
-        if (!md) {
-            if (!req->total_desc) {
-                dprintf("VSCSI:   Out of descriptors !\n");
-                break;
-            }
-            md = req->cur_desc = &req->ext_desc;
-            dprintf("VSCSI:   Reading desc from 0x%llx\n",
-                    (unsigned long long)td->va);
-            rc = spapr_vio_dma_read(&s->vdev, td->va, md,
-                                    sizeof(struct srp_direct_buf));
-            if (rc) {
-                dprintf("VSCSI: spapr_vio_dma_read -> %d reading ext_desc\n",
-                        rc);
-                break;
-            }
-            vscsi_swap_desc(md);
-            td->va += sizeof(struct srp_direct_buf);
-            --req->total_desc;
+        rc = vscsi_fetch_desc(s, req, req->cur_desc_num, req->cur_desc_offset, &md);
+        if (rc < 0) {
+            return -1;
+        } else if (rc == 0) {
+            break;
         }
-        dprintf("VSCSI:   [desc va=0x%llx,len=0x%x] remaining=0x%x\n",
-                (unsigned long long)md->va, md->len, len);
 
         /* Perform transfer */
-        llen = MIN(len, md->len);
+        llen = MIN(len, md.len);
         if (req->writing) { /* writing = to device = reading from memory */
-            rc = spapr_vio_dma_read(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_read(&s->vdev, md.va, buf, llen);
         } else {
-            rc = spapr_vio_dma_write(&s->vdev, md->va, buf, llen);
+            rc = spapr_vio_dma_write(&s->vdev, md.va, buf, llen);
         }
         if (rc) {
             dprintf("VSCSI: spapr_vio_dma_r/w(%d) -> %d\n", req->writing, rc);
@@ -361,10 +405,18 @@ static int vscsi_srp_indirect_data(VSCSIState *s, vscsi_req *req,
 
         len -= llen;
         buf += llen;
+
         total += llen;
-        md->va += llen;
-        md->len -= llen;
+
+        /* Update current position in the current descriptor */
+        req->cur_desc_offset += llen;
+        if (md.len == llen) {
+            /* Go to the next descriptor if the current one finished */
+            ++req->cur_desc_num;
+            req->cur_desc_offset = 0;
+        }
     }
+
     return rc ? -1 : total;
 }
 
@@ -412,14 +464,13 @@ static int data_out_desc_size(struct srp_cmd *cmd)
 static int vscsi_preprocess_desc(vscsi_req *req)
 {
     struct srp_cmd *cmd = &req->iu.srp.cmd;
-    int offset, i;
 
-    offset = cmd->add_cdb_len & ~3;
+    req->cdb_offset = cmd->add_cdb_len & ~3;
 
     if (req->writing) {
         req->dma_fmt = cmd->buf_fmt >> 4;
     } else {
-        offset += data_out_desc_size(cmd);
+        req->cdb_offset += data_out_desc_size(cmd);
         req->dma_fmt = cmd->buf_fmt & ((1U << 4) - 1);
     }
 
@@ -427,31 +478,18 @@ static int vscsi_preprocess_desc(vscsi_req *req)
     case SRP_NO_DATA_DESC:
         break;
     case SRP_DATA_DESC_DIRECT:
-        req->cur_desc = (struct srp_direct_buf *)(cmd->add_data + offset);
         req->total_desc = req->local_desc = 1;
-        vscsi_swap_desc(req->cur_desc);
-        dprintf("VSCSI: using direct RDMA %s, 0x%x bytes MD: 0x%llx\n",
-                req->writing ? "write" : "read",
-                req->cur_desc->len, (unsigned long long)req->cur_desc->va);
         break;
-    case SRP_DATA_DESC_INDIRECT:
-        req->ind_desc = (struct srp_indirect_buf *)(cmd->add_data + offset);
-        vscsi_swap_desc(&req->ind_desc->table_desc);
-        req->total_desc = req->ind_desc->table_desc.len /
-            sizeof(struct srp_direct_buf);
+    case SRP_DATA_DESC_INDIRECT: {
+        struct srp_indirect_buf *ind_tmp = (struct srp_indirect_buf *)
+                (cmd->add_data + req->cdb_offset);
+
+        req->total_desc = be32_to_cpu(ind_tmp->table_desc.len) /
+                          sizeof(struct srp_direct_buf);
         req->local_desc = req->writing ? cmd->data_out_desc_cnt :
-            cmd->data_in_desc_cnt;
-        for (i = 0; i < req->local_desc; i++) {
-            vscsi_swap_desc(&req->ind_desc->desc_list[i]);
-        }
-        req->cur_desc = req->local_desc ? &req->ind_desc->desc_list[0] : NULL;
-        dprintf("VSCSI: using indirect RDMA %s, 0x%x bytes %d descs "
-                "(%d local) VA: 0x%llx\n",
-                req->writing ? "read" : "write",
-                be32_to_cpu(req->ind_desc->len),
-                req->total_desc, req->local_desc,
-                (unsigned long long)req->ind_desc->table_desc.va);
+                          cmd->data_in_desc_cnt;
         break;
+    }
     default:
         fprintf(stderr,
                 "vscsi_preprocess_desc: Unknown format %x\n", req->dma_fmt);
@@ -499,8 +537,8 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     vscsi_req *req = sreq->hba_private;
     int32_t res_in = 0, res_out = 0;
 
-    dprintf("VSCSI: SCSI cmd complete, r=0x%x tag=0x%x status=0x%x, req=%p\n",
-            reason, sreq->tag, status, req);
+    dprintf("VSCSI: SCSI cmd complete, tag=0x%x status=0x%x, req=%p\n",
+            sreq->tag, status, req);
     if (req == NULL) {
         fprintf(stderr, "VSCSI: Can't find request for tag 0x%x\n", sreq->tag);
         return;
@@ -509,7 +547,7 @@ static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status, size_t re
     if (status == CHECK_CONDITION) {
         req->senselen = scsi_req_get_sense(req->sreq, req->sense,
                                            sizeof(req->sense));
-        dprintf("VSCSI: Sense data, %d bytes:\n", len);
+        dprintf("VSCSI: Sense data, %d bytes:\n", req->senselen);
         dprintf("       %02x  %02x  %02x  %02x  %02x  %02x  %02x  %02x\n",
                 req->sense[0], req->sense[1], req->sense[2], req->sense[3],
                 req->sense[4], req->sense[5], req->sense[6], req->sense[7]);
@@ -621,12 +659,11 @@ static int vscsi_queue_cmd(VSCSIState *s, vscsi_req *req)
         } return 1;
     }
 
-    req->lun = lun;
     req->sreq = scsi_req_new(sdev, req->qtag, lun, srp->cmd.cdb, req);
     n = scsi_req_enqueue(req->sreq);
 
-    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x ID %d LUN %d ret: %d\n",
-            req->qtag, srp->cmd.cdb[0], id, lun, n);
+    dprintf("VSCSI: Queued command tag 0x%x CMD 0x%x LUN %d ret: %d\n",
+            req->qtag, srp->cmd.cdb[0], lun, n);
 
     if (n) {
         /* Transfer direction must be set before preprocessing the
commit a83000f5e3fac30a7f213af1ba6a8f827622854d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Jul 18 14:32:58 2013 -0500

    spapr-tce: make sPAPRTCETable a proper device
    
    Model TCE tables as a device that's hooked up as a child object to
    the owner.  Besides the code cleanup, we get a few nice benefits:
    
    1) free actually works now (it was dead code before)
    
    2) the TCE information is visible in the device tree
    
    3) we can expose table information as properties such that if we
       change the window_size, we can use globals to keep migration
       working.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-6-git-send-email-aliguori at us.ibm.com
    [dwg: pseries: savevm support for PAPR TCE tables]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    [alexey: ppc kvm: fix to compile]
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 48ae092..e340708 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -848,9 +848,6 @@ static void ppc_spapr_init(QEMUMachineInitArgs *args)
     /* Set up EPOW events infrastructure */
     spapr_events_init(spapr);
 
-    /* Set up IOMMU */
-    spapr_iommu_init();
-
     /* Set up VIO bus */
     spapr->vio_bus = spapr_vio_bus_init();
 
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 89b33a5..3d4a1fc 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -36,17 +36,6 @@ enum sPAPRTCEAccess {
     SPAPR_TCE_RW = 3,
 };
 
-struct sPAPRTCETable {
-    uint32_t liobn;
-    uint32_t window_size;
-    sPAPRTCE *table;
-    bool bypass;
-    int fd;
-    MemoryRegion iommu;
-    QLIST_ENTRY(sPAPRTCETable) list;
-};
-
-
 QLIST_HEAD(spapr_tce_tables, sPAPRTCETable) spapr_tce_tables;
 
 static sPAPRTCETable *spapr_tce_find_by_liobn(uint32_t liobn)
@@ -96,7 +85,7 @@ static IOMMUTLBEntry spapr_tce_translate_iommu(MemoryRegion *iommu, hwaddr addr)
         return (IOMMUTLBEntry) { .perm = IOMMU_NONE };
     }
 
-    tce = tcet->table[addr >> SPAPR_TCE_PAGE_SHIFT].tce;
+    tce = tcet->table[addr >> SPAPR_TCE_PAGE_SHIFT];
 
 #ifdef DEBUG_TCE
     fprintf(stderr, " ->  *paddr=0x%llx, *len=0x%llx\n",
@@ -112,55 +101,97 @@ static IOMMUTLBEntry spapr_tce_translate_iommu(MemoryRegion *iommu, hwaddr addr)
     };
 }
 
+static int spapr_tce_table_pre_load(void *opaque)
+{
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(opaque);
+
+    tcet->nb_table = tcet->window_size >> SPAPR_TCE_PAGE_SHIFT;
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_spapr_tce_table = {
+    .name = "spapr_iommu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .pre_load = spapr_tce_table_pre_load,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(liobn, sPAPRTCETable),
+        VMSTATE_UINT32_EQUAL(window_size, sPAPRTCETable),
+
+        /* IOMMU state */
+        VMSTATE_BOOL(bypass, sPAPRTCETable),
+        VMSTATE_VARRAY_UINT32(table, sPAPRTCETable, nb_table, 0, vmstate_info_uint64, uint64_t),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static MemoryRegionIOMMUOps spapr_iommu_ops = {
     .translate = spapr_tce_translate_iommu,
 };
 
-sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, size_t window_size)
+static int spapr_tce_table_realize(DeviceState *dev)
 {
-    sPAPRTCETable *tcet;
-
-    if (spapr_tce_find_by_liobn(liobn)) {
-        fprintf(stderr, "Attempted to create TCE table with duplicate"
-                " LIOBN 0x%x\n", liobn);
-        return NULL;
-    }
-
-    if (!window_size) {
-        return NULL;
-    }
-
-    tcet = g_malloc0(sizeof(*tcet));
-    tcet->liobn = liobn;
-    tcet->window_size = window_size;
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);
 
     if (kvm_enabled()) {
-        tcet->table = kvmppc_create_spapr_tce(liobn,
-                                              window_size,
+        tcet->table = kvmppc_create_spapr_tce(tcet->liobn,
+                                              tcet->window_size,
                                               &tcet->fd);
     }
 
     if (!tcet->table) {
-        size_t table_size = (window_size >> SPAPR_TCE_PAGE_SHIFT)
-            * sizeof(sPAPRTCE);
+        size_t table_size = (tcet->window_size >> SPAPR_TCE_PAGE_SHIFT)
+            * sizeof(uint64_t);
         tcet->table = g_malloc0(table_size);
     }
+    tcet->nb_table = tcet->window_size >> SPAPR_TCE_PAGE_SHIFT;
 
 #ifdef DEBUG_TCE
     fprintf(stderr, "spapr_iommu: New TCE table @ %p, liobn=0x%x, "
             "table @ %p, fd=%d\n", tcet, liobn, tcet->table, tcet->fd);
 #endif
 
-    memory_region_init_iommu(&tcet->iommu, OBJECT(owner), &spapr_iommu_ops,
+    memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
                              "iommu-spapr", UINT64_MAX);
 
     QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
 
+    return 0;
+}
+
+sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn, size_t window_size)
+{
+    sPAPRTCETable *tcet;
+
+    if (spapr_tce_find_by_liobn(liobn)) {
+        fprintf(stderr, "Attempted to create TCE table with duplicate"
+                " LIOBN 0x%x\n", liobn);
+        return NULL;
+    }
+
+    if (!window_size) {
+        return NULL;
+    }
+
+    tcet = SPAPR_TCE_TABLE(object_new(TYPE_SPAPR_TCE_TABLE));
+    tcet->liobn = liobn;
+    tcet->window_size = window_size;
+
+    object_property_add_child(OBJECT(owner), "tce-table", OBJECT(tcet), NULL);
+
+    qdev_init_nofail(DEVICE(tcet));
+
     return tcet;
 }
 
-void spapr_tce_free(sPAPRTCETable *tcet)
+static void spapr_tce_table_finalize(Object *obj)
 {
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(obj);
+
     QLIST_REMOVE(tcet, list);
 
     if (!kvm_enabled() ||
@@ -168,8 +199,6 @@ void spapr_tce_free(sPAPRTCETable *tcet)
                                  tcet->window_size) != 0)) {
         g_free(tcet->table);
     }
-
-    g_free(tcet);
 }
 
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet)
@@ -182,10 +211,11 @@ void spapr_tce_set_bypass(sPAPRTCETable *tcet, bool bypass)
     tcet->bypass = bypass;
 }
 
-void spapr_tce_reset(sPAPRTCETable *tcet)
+static void spapr_tce_reset(DeviceState *dev)
 {
+    sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);
     size_t table_size = (tcet->window_size >> SPAPR_TCE_PAGE_SHIFT)
-        * sizeof(sPAPRTCE);
+        * sizeof(uint64_t);
 
     tcet->bypass = false;
     memset(tcet->table, 0, table_size);
@@ -194,7 +224,6 @@ void spapr_tce_reset(sPAPRTCETable *tcet)
 static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,
                                 target_ulong tce)
 {
-    sPAPRTCE *tcep;
     IOMMUTLBEntry entry;
 
     if (ioba >= tcet->window_size) {
@@ -203,8 +232,7 @@ static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,
         return H_PARAMETER;
     }
 
-    tcep = tcet->table + (ioba >> SPAPR_TCE_PAGE_SHIFT);
-    tcep->tce = tce;
+    tcet->table[ioba >> SPAPR_TCE_PAGE_SHIFT] = tce;
 
     entry.target_as = &address_space_memory,
     entry.iova = ioba & ~SPAPR_TCE_PAGE_MASK;
@@ -238,14 +266,6 @@ static target_ulong h_put_tce(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     return H_PARAMETER;
 }
 
-void spapr_iommu_init(void)
-{
-    QLIST_INIT(&spapr_tce_tables);
-
-    /* hcall-tce */
-    spapr_register_hypercall(H_PUT_TCE, h_put_tce);
-}
-
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
                  uint32_t liobn, uint64_t window, uint32_t size)
 {
@@ -286,3 +306,31 @@ int spapr_tcet_dma_dt(void *fdt, int node_off, const char *propname,
     return spapr_dma_dt(fdt, node_off, propname,
                         tcet->liobn, 0, tcet->window_size);
 }
+
+static void spapr_tce_table_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    dc->vmsd = &vmstate_spapr_tce_table;
+    dc->init = spapr_tce_table_realize;
+    dc->reset = spapr_tce_reset;
+
+    QLIST_INIT(&spapr_tce_tables);
+
+    /* hcall-tce */
+    spapr_register_hypercall(H_PUT_TCE, h_put_tce);
+}
+
+static TypeInfo spapr_tce_table_info = {
+    .name = TYPE_SPAPR_TCE_TABLE,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(sPAPRTCETable),
+    .class_init = spapr_tce_table_class_init,
+    .instance_finalize = spapr_tce_table_finalize,
+};
+
+static void register_types(void)
+{
+    type_register_static(&spapr_tce_table_info);
+}
+
+type_init(register_types);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c880a75..9dc6ca3 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -645,7 +645,7 @@ static void spapr_phb_reset(DeviceState *qdev)
     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
 
     /* Reset the IOMMU state */
-    spapr_tce_reset(sphb->tcet);
+    device_reset(DEVICE(sphb->tcet));
 }
 
 static Property spapr_phb_properties[] = {
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 75ce19f..c3f85bf 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -316,7 +316,7 @@ int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq)
 static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)
 {
     if (dev->tcet) {
-        spapr_tce_reset(dev->tcet);
+        device_reset(DEVICE(dev->tcet));
     }
     free_crq(dev);
 }
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index de95480..82ad7c0 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -334,10 +334,6 @@ int spapr_rtas_device_tree_setup(void *fdt, hwaddr rtas_addr,
 #define SPAPR_TCE_PAGE_SIZE    (1ULL << SPAPR_TCE_PAGE_SHIFT)
 #define SPAPR_TCE_PAGE_MASK    (SPAPR_TCE_PAGE_SIZE - 1)
 
-typedef struct sPAPRTCE {
-    uint64_t tce;
-} sPAPRTCE;
-
 #define SPAPR_VIO_BASE_LIOBN    0x00000000
 #define SPAPR_PCI_BASE_LIOBN    0x80000000
 
@@ -345,14 +341,27 @@ typedef struct sPAPRTCE {
 
 typedef struct sPAPRTCETable sPAPRTCETable;
 
-void spapr_iommu_init(void);
+#define TYPE_SPAPR_TCE_TABLE "spapr-tce-table"
+#define SPAPR_TCE_TABLE(obj) \
+    OBJECT_CHECK(sPAPRTCETable, (obj), TYPE_SPAPR_TCE_TABLE)
+
+struct sPAPRTCETable {
+    DeviceState parent;
+    uint32_t liobn;
+    uint32_t window_size;
+    uint32_t nb_table;
+    uint64_t *table;
+    bool bypass;
+    int fd;
+    MemoryRegion iommu;
+    QLIST_ENTRY(sPAPRTCETable) list;
+};
+
 void spapr_events_init(sPAPREnvironment *spapr);
 void spapr_events_fdt_skel(void *fdt, uint32_t epow_irq);
 sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn,
                                    size_t window_size);
 MemoryRegion *spapr_tce_get_iommu(sPAPRTCETable *tcet);
-void spapr_tce_free(sPAPRTCETable *tcet);
-void spapr_tce_reset(sPAPRTCETable *tcet);
 void spapr_tce_set_bypass(sPAPRTCETable *tcet, bool bypass);
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
                  uint32_t liobn, uint64_t window, uint32_t size);
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index b0099e1..9f2e4f0 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1626,7 +1626,7 @@ void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t window_size, int *pfd)
         return NULL;
     }
 
-    len = (window_size / SPAPR_TCE_PAGE_SIZE) * sizeof(sPAPRTCE);
+    len = (window_size / SPAPR_TCE_PAGE_SIZE) * sizeof(uint64_t);
     /* FIXME: round this up to page size */
 
     table = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
@@ -1649,7 +1649,7 @@ int kvmppc_remove_spapr_tce(void *table, int fd, uint32_t window_size)
         return -1;
     }
 
-    len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(sPAPRTCE);
+    len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(uint64_t);
     if ((munmap(table, len) < 0) ||
         (close(fd) < 0)) {
         fprintf(stderr, "KVM: Unexpected error removing TCE table: %s",
commit db1b58e937fd80513a4bb14432808495a5846ffe
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:32:57 2013 -0500

    pseries: savevm support for PAPR VIO logical tty
    
    This patch adds the necessary VMStateDescription information to support
    savevm/loadvm for the spapr_tty (PAPR logical serial) device.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-5-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 2993848..a799721 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -142,6 +142,21 @@ static Property spapr_vty_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_vty = {
+    .name = "spapr_vty",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVTYDevice),
+
+        VMSTATE_UINT32(in, VIOsPAPRVTYDevice),
+        VMSTATE_UINT32(out, VIOsPAPRVTYDevice),
+        VMSTATE_BUFFER(buf, VIOsPAPRVTYDevice),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vty_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -152,6 +167,7 @@ static void spapr_vty_class_init(ObjectClass *klass, void *data)
     k->dt_type = "serial";
     k->dt_compatible = "hvterm1";
     dc->props = spapr_vty_properties;
+    dc->vmsd = &vmstate_spapr_vty;
 }
 
 static const TypeInfo spapr_vty_info = {
commit 686fefe48375c448bc2141973008818cd9b9c671
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:32:56 2013 -0500

    pseries: savevm support for PAPR VIO logical lan
    
    This patch adds the necessary VMStateDescription information to support
    savevm/loadvm for the spapr_llan (PAPR logical lan) device.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-4-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 03a09f2..46f7d5f 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -81,9 +81,9 @@ typedef struct VIOsPAPRVLANDevice {
     VIOsPAPRDevice sdev;
     NICConf nicconf;
     NICState *nic;
-    int isopen;
+    bool isopen;
     target_ulong buf_list;
-    int add_buf_ptr, use_buf_ptr, rx_bufs;
+    uint32_t add_buf_ptr, use_buf_ptr, rx_bufs;
     target_ulong rxq_ptr;
 } VIOsPAPRVLANDevice;
 
@@ -500,6 +500,25 @@ static Property spapr_vlan_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static const VMStateDescription vmstate_spapr_llan = {
+    .name = "spapr_llan",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_SPAPR_VIO(sdev, VIOsPAPRVLANDevice),
+        /* LLAN state */
+        VMSTATE_BOOL(isopen, VIOsPAPRVLANDevice),
+        VMSTATE_UINTTL(buf_list, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(add_buf_ptr, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(use_buf_ptr, VIOsPAPRVLANDevice),
+        VMSTATE_UINT32(rx_bufs, VIOsPAPRVLANDevice),
+        VMSTATE_UINTTL(rxq_ptr, VIOsPAPRVLANDevice),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void spapr_vlan_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -514,6 +533,7 @@ static void spapr_vlan_class_init(ObjectClass *klass, void *data)
     k->signal_mask = 0x1;
     dc->props = spapr_vlan_properties;
     k->rtce_window_size = 0x10000000;
+    dc->vmsd = &vmstate_spapr_llan;
 }
 
 static const TypeInfo spapr_vlan_info = {
commit b368a7d864d6f32caba4ac9fb3b9738d1180315d
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Thu Jul 18 14:32:55 2013 -0500

    pseries: savevm support for VIO devices
    
    This patch adds helpers to allow PAPR VIO devices to save state common
    to all VIO devices during savevm.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1374175984-8930-3-git-send-email-aliguori at us.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 7c6f6e4..75ce19f 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -542,6 +542,26 @@ static const TypeInfo spapr_vio_bridge_info = {
     .class_init    = spapr_vio_bridge_class_init,
 };
 
+const VMStateDescription vmstate_spapr_vio = {
+    .name = "spapr_vio",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        /* Sanity check */
+        VMSTATE_UINT32_EQUAL(reg, VIOsPAPRDevice),
+        VMSTATE_UINT32_EQUAL(irq, VIOsPAPRDevice),
+
+        /* General VIO device state */
+        VMSTATE_UINTTL(signal_state, VIOsPAPRDevice),
+        VMSTATE_UINT64(crq.qladdr, VIOsPAPRDevice),
+        VMSTATE_UINT32(crq.qsize, VIOsPAPRDevice),
+        VMSTATE_UINT32(crq.qnext, VIOsPAPRDevice),
+
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static void vio_spapr_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *k = DEVICE_CLASS(klass);
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 3609327..46edc2a 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -134,4 +134,9 @@ VIOsPAPRDevice *spapr_vty_get_default(VIOsPAPRBus *bus);
 
 void spapr_vio_quiesce(void);
 
+extern const VMStateDescription vmstate_spapr_vio;
+
+#define VMSTATE_SPAPR_VIO(_f, _s) \
+    VMSTATE_STRUCT(_f, _s, 0, vmstate_spapr_vio, VIOsPAPRDevice)
+
 #endif /* _HW_SPAPR_VIO_H */
commit a90db1584a00dc1d1439dc7729d99674b666b85e
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 18 14:32:54 2013 -0500

    target-ppc: Convert ppc cpu savevm to VMStateDescription
    
    The savevm code for the powerpc cpu emulation is currently based around
    the old register_savevm() rather than register_vmstate() method.  It's also
    rather broken, missing some important state on some CPU models.
    
    This patch completely rewrites the savevm for target-ppc, using the new
    VMStateDescription approach.  Exactly what needs to be saved in what
    configurations has been more carefully examined, too.  This introduces a
    new version (5) of the cpu save format.  The old load function is retained
    to support version 4 images.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1374175984-8930-2-git-send-email-aliguori at us.ibm.com
    [aik: ppc cpu savevm convertion fixed to use PowerPCCPU instead of CPUPPCState]
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index fc0d737..f3c710a 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -109,4 +109,8 @@ hwaddr ppc_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 int ppc_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int ppc_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_ppc_cpu;
+#endif
+
 #endif
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 6f51e1f..711db08 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -948,7 +948,7 @@ struct CPUPPCState {
 #if defined(TARGET_PPC64)
     /* PowerPC 64 SLB area */
     ppc_slb_t slb[64];
-    int slb_nr;
+    int32_t slb_nr;
 #endif
     /* segment registers */
     hwaddr htab_base;
@@ -957,11 +957,11 @@ struct CPUPPCState {
     /* externally stored hash table */
     uint8_t *external_htab;
     /* BATs */
-    int nb_BATs;
+    uint32_t nb_BATs;
     target_ulong DBAT[2][8];
     target_ulong IBAT[2][8];
     /* PowerPC TLB registers (for 4xx, e500 and 60x software driven TLBs) */
-    int nb_tlb;      /* Total number of TLB                                  */
+    int32_t nb_tlb;      /* Total number of TLB                              */
     int tlb_per_way; /* Speed-up helper: used to avoid divisions at run time */
     int nb_ways;     /* Number of ways in the TLB set                        */
     int last_way;    /* Last used way used to allocate TLB in a LRU way      */
@@ -1176,8 +1176,6 @@ static inline CPUPPCState *cpu_init(const char *cpu_model)
 #define cpu_signal_handler cpu_ppc_signal_handler
 #define cpu_list ppc_cpu_list
 
-#define CPU_SAVE_VERSION 4
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _user
 #define MMU_MODE1_SUFFIX _kernel
diff --git a/target-ppc/machine.c b/target-ppc/machine.c
index 2d10adb..12e1512 100644
--- a/target-ppc/machine.c
+++ b/target-ppc/machine.c
@@ -1,96 +1,12 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
 #include "sysemu/kvm.h"
+#include "helper_regs.h"
 
-void cpu_save(QEMUFile *f, void *opaque)
+static int cpu_load_old(QEMUFile *f, void *opaque, int version_id)
 {
-    CPUPPCState *env = (CPUPPCState *)opaque;
-    unsigned int i, j;
-    uint32_t fpscr;
-    target_ulong xer;
-
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->gpr[i]);
-#if !defined(TARGET_PPC64)
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->gprh[i]);
-#endif
-    qemu_put_betls(f, &env->lr);
-    qemu_put_betls(f, &env->ctr);
-    for (i = 0; i < 8; i++)
-        qemu_put_be32s(f, &env->crf[i]);
-    xer = cpu_read_xer(env);
-    qemu_put_betls(f, &xer);
-    qemu_put_betls(f, &env->reserve_addr);
-    qemu_put_betls(f, &env->msr);
-    for (i = 0; i < 4; i++)
-        qemu_put_betls(f, &env->tgpr[i]);
-    for (i = 0; i < 32; i++) {
-        union {
-            float64 d;
-            uint64_t l;
-        } u;
-        u.d = env->fpr[i];
-        qemu_put_be64(f, u.l);
-    }
-    fpscr = env->fpscr;
-    qemu_put_be32s(f, &fpscr);
-    qemu_put_sbe32s(f, &env->access_type);
-#if defined(TARGET_PPC64)
-    qemu_put_betls(f, &env->spr[SPR_ASR]);
-    qemu_put_sbe32s(f, &env->slb_nr);
-#endif
-    qemu_put_betls(f, &env->spr[SPR_SDR1]);
-    for (i = 0; i < 32; i++)
-        qemu_put_betls(f, &env->sr[i]);
-    for (i = 0; i < 2; i++)
-        for (j = 0; j < 8; j++)
-            qemu_put_betls(f, &env->DBAT[i][j]);
-    for (i = 0; i < 2; i++)
-        for (j = 0; j < 8; j++)
-            qemu_put_betls(f, &env->IBAT[i][j]);
-    qemu_put_sbe32s(f, &env->nb_tlb);
-    qemu_put_sbe32s(f, &env->tlb_per_way);
-    qemu_put_sbe32s(f, &env->nb_ways);
-    qemu_put_sbe32s(f, &env->last_way);
-    qemu_put_sbe32s(f, &env->id_tlbs);
-    qemu_put_sbe32s(f, &env->nb_pids);
-    if (env->tlb.tlb6) {
-        // XXX assumes 6xx
-        for (i = 0; i < env->nb_tlb; i++) {
-            qemu_put_betls(f, &env->tlb.tlb6[i].pte0);
-            qemu_put_betls(f, &env->tlb.tlb6[i].pte1);
-            qemu_put_betls(f, &env->tlb.tlb6[i].EPN);
-        }
-    }
-    for (i = 0; i < 4; i++)
-        qemu_put_betls(f, &env->pb[i]);
-    for (i = 0; i < 1024; i++)
-        qemu_put_betls(f, &env->spr[i]);
-    qemu_put_be32s(f, &env->vscr);
-    qemu_put_be64s(f, &env->spe_acc);
-    qemu_put_be32s(f, &env->spe_fscr);
-    qemu_put_betls(f, &env->msr_mask);
-    qemu_put_be32s(f, &env->flags);
-    qemu_put_sbe32s(f, &env->error_code);
-    qemu_put_be32s(f, &env->pending_interrupts);
-    qemu_put_be32s(f, &env->irq_input_state);
-    for (i = 0; i < POWERPC_EXCP_NB; i++)
-        qemu_put_betls(f, &env->excp_vectors[i]);
-    qemu_put_betls(f, &env->excp_prefix);
-    qemu_put_betls(f, &env->ivor_mask);
-    qemu_put_betls(f, &env->ivpr_mask);
-    qemu_put_betls(f, &env->hreset_vector);
-    qemu_put_betls(f, &env->nip);
-    qemu_put_betls(f, &env->hflags);
-    qemu_put_betls(f, &env->hflags_nmsr);
-    qemu_put_sbe32s(f, &env->mmu_idx);
-    qemu_put_sbe32(f, 0);
-}
-
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
-{
-    CPUPPCState *env = (CPUPPCState *)opaque;
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
     unsigned int i, j;
     target_ulong sdr1;
     uint32_t fpscr;
@@ -177,3 +93,442 @@ int cpu_load(QEMUFile *f, void *opaque, int version_id)
 
     return 0;
 }
+
+static int get_avr(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_avr_t *v = pv;
+
+    v->u64[0] = qemu_get_be64(f);
+    v->u64[1] = qemu_get_be64(f);
+
+    return 0;
+}
+
+static void put_avr(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_avr_t *v = pv;
+
+    qemu_put_be64(f, v->u64[0]);
+    qemu_put_be64(f, v->u64[1]);
+}
+
+const VMStateInfo vmstate_info_avr = {
+    .name = "avr",
+    .get  = get_avr,
+    .put  = put_avr,
+};
+
+#define VMSTATE_AVR_ARRAY_V(_f, _s, _n, _v)                       \
+    VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_avr, ppc_avr_t)
+
+#define VMSTATE_AVR_ARRAY(_f, _s, _n)                             \
+    VMSTATE_AVR_ARRAY_V(_f, _s, _n, 0)
+
+static void cpu_pre_save(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    env->spr[SPR_LR] = env->lr;
+    env->spr[SPR_CTR] = env->ctr;
+    env->spr[SPR_XER] = env->xer;
+#if defined(TARGET_PPC64)
+    env->spr[SPR_CFAR] = env->cfar;
+#endif
+    env->spr[SPR_BOOKE_SPEFSCR] = env->spe_fscr;
+
+    for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
+        env->spr[SPR_DBAT0U + 2*i] = env->DBAT[0][i];
+        env->spr[SPR_DBAT0U + 2*i + 1] = env->DBAT[1][i];
+        env->spr[SPR_IBAT0U + 2*i] = env->IBAT[0][i];
+        env->spr[SPR_IBAT0U + 2*i + 1] = env->IBAT[1][i];
+    }
+    for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
+        env->spr[SPR_DBAT4U + 2*i] = env->DBAT[0][i+4];
+        env->spr[SPR_DBAT4U + 2*i + 1] = env->DBAT[1][i+4];
+        env->spr[SPR_IBAT4U + 2*i] = env->IBAT[0][i+4];
+        env->spr[SPR_IBAT4U + 2*i + 1] = env->IBAT[1][i+4];
+    }
+}
+
+static int cpu_post_load(void *opaque, int version_id)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+    int i;
+
+    env->lr = env->spr[SPR_LR];
+    env->ctr = env->spr[SPR_CTR];
+    env->xer = env->spr[SPR_XER];
+#if defined(TARGET_PPC64)
+    env->cfar = env->spr[SPR_CFAR];
+#endif
+    env->spe_fscr = env->spr[SPR_BOOKE_SPEFSCR];
+
+    for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
+        env->DBAT[0][i] = env->spr[SPR_DBAT0U + 2*i];
+        env->DBAT[1][i] = env->spr[SPR_DBAT0U + 2*i + 1];
+        env->IBAT[0][i] = env->spr[SPR_IBAT0U + 2*i];
+        env->IBAT[1][i] = env->spr[SPR_IBAT0U + 2*i + 1];
+    }
+    for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
+        env->DBAT[0][i+4] = env->spr[SPR_DBAT4U + 2*i];
+        env->DBAT[1][i+4] = env->spr[SPR_DBAT4U + 2*i + 1];
+        env->IBAT[0][i+4] = env->spr[SPR_IBAT4U + 2*i];
+        env->IBAT[1][i+4] = env->spr[SPR_IBAT4U + 2*i + 1];
+    }
+
+    /* Restore htab_base and htab_mask variables */
+    ppc_store_sdr1(env, env->spr[SPR_SDR1]);
+
+    hreg_compute_hflags(env);
+    hreg_compute_mem_idx(env);
+
+    return 0;
+}
+
+static bool fpu_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags & PPC_FLOAT);
+}
+
+static const VMStateDescription vmstate_fpu = {
+    .name = "cpu/fpu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_FLOAT64_ARRAY(env.fpr, PowerPCCPU, 32),
+        VMSTATE_UINTTL(env.fpscr, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool altivec_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags & PPC_ALTIVEC);
+}
+
+static const VMStateDescription vmstate_altivec = {
+    .name = "cpu/altivec",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_AVR_ARRAY(env.avr, PowerPCCPU, 32),
+        VMSTATE_UINT32(env.vscr, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool vsx_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return (cpu->env.insns_flags2 & PPC2_VSX);
+}
+
+static const VMStateDescription vmstate_vsx = {
+    .name = "cpu/vsx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64_ARRAY(env.vsr, PowerPCCPU, 32),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool sr_needed(void *opaque)
+{
+#ifdef TARGET_PPC64
+    PowerPCCPU *cpu = opaque;
+
+    return !(cpu->env.mmu_model & POWERPC_MMU_64);
+#else
+    return true;
+#endif
+}
+
+static const VMStateDescription vmstate_sr = {
+    .name = "cpu/sr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL_ARRAY(env.sr, PowerPCCPU, 32),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+#ifdef TARGET_PPC64
+static int get_slbe(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_slb_t *v = pv;
+
+    v->esid = qemu_get_be64(f);
+    v->vsid = qemu_get_be64(f);
+
+    return 0;
+}
+
+static void put_slbe(QEMUFile *f, void *pv, size_t size)
+{
+    ppc_slb_t *v = pv;
+
+    qemu_put_be64(f, v->esid);
+    qemu_put_be64(f, v->vsid);
+}
+
+const VMStateInfo vmstate_info_slbe = {
+    .name = "slbe",
+    .get  = get_slbe,
+    .put  = put_slbe,
+};
+
+#define VMSTATE_SLB_ARRAY_V(_f, _s, _n, _v)                       \
+    VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_slbe, ppc_slb_t)
+
+#define VMSTATE_SLB_ARRAY(_f, _s, _n)                             \
+    VMSTATE_SLB_ARRAY_V(_f, _s, _n, 0)
+
+static bool slb_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    /* We don't support any of the old segment table based 64-bit CPUs */
+    return (cpu->env.mmu_model & POWERPC_MMU_64);
+}
+
+static const VMStateDescription vmstate_slb = {
+    .name = "cpu/slb",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.slb_nr, PowerPCCPU),
+        VMSTATE_SLB_ARRAY(env.slb, PowerPCCPU, 64),
+        VMSTATE_END_OF_LIST()
+    }
+};
+#endif /* TARGET_PPC64 */
+
+static const VMStateDescription vmstate_tlb6xx_entry = {
+    .name = "cpu/tlb6xx_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL(pte0, ppc6xx_tlb_t),
+        VMSTATE_UINTTL(pte1, ppc6xx_tlb_t),
+        VMSTATE_UINTTL(EPN, ppc6xx_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlb6xx_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_6XX);
+}
+
+static const VMStateDescription vmstate_tlb6xx = {
+    .name = "cpu/tlb6xx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlb6, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlb6xx_entry,
+                                            ppc6xx_tlb_t),
+        VMSTATE_UINTTL_ARRAY(env.tgpr, PowerPCCPU, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_tlbemb_entry = {
+    .name = "cpu/tlbemb_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(RPN, ppcemb_tlb_t),
+        VMSTATE_UINTTL(EPN, ppcemb_tlb_t),
+        VMSTATE_UINTTL(PID, ppcemb_tlb_t),
+        VMSTATE_UINTTL(size, ppcemb_tlb_t),
+        VMSTATE_UINT32(prot, ppcemb_tlb_t),
+        VMSTATE_UINT32(attr, ppcemb_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlbemb_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_EMB);
+}
+
+static bool pbr403_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    uint32_t pvr = cpu->env.spr[SPR_PVR];
+
+    return (pvr & 0xffff0000) == 0x00200000;
+}
+
+static const VMStateDescription vmstate_pbr403 = {
+    .name = "cpu/pbr403",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINTTL_ARRAY(env.pb, PowerPCCPU, 4),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static const VMStateDescription vmstate_tlbemb = {
+    .name = "cpu/tlb6xx",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbe, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlbemb_entry,
+                                            ppcemb_tlb_t),
+        /* 403 protection registers */
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection []) {
+        {
+            .vmsd = &vmstate_pbr403,
+            .needed = pbr403_needed,
+        } , {
+            /* empty */
+        }
+    }
+};
+
+static const VMStateDescription vmstate_tlbmas_entry = {
+    .name = "cpu/tlbmas_entry",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT32(mas8, ppcmas_tlb_t),
+        VMSTATE_UINT32(mas1, ppcmas_tlb_t),
+        VMSTATE_UINT64(mas2, ppcmas_tlb_t),
+        VMSTATE_UINT64(mas7_3, ppcmas_tlb_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool tlbmas_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+    CPUPPCState *env = &cpu->env;
+
+    return env->nb_tlb && (env->tlb_type == TLB_MAS);
+}
+
+static const VMStateDescription vmstate_tlbmas = {
+    .name = "cpu/tlbmas",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbm, PowerPCCPU,
+                                            env.nb_tlb,
+                                            vmstate_tlbmas_entry,
+                                            ppcmas_tlb_t),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+const VMStateDescription vmstate_ppc_cpu = {
+    .name = "cpu",
+    .version_id = 5,
+    .minimum_version_id = 5,
+    .minimum_version_id_old = 4,
+    .load_state_old = cpu_load_old,
+    .pre_save = cpu_pre_save,
+    .post_load = cpu_post_load,
+    .fields      = (VMStateField []) {
+        /* Verify we haven't changed the pvr */
+        VMSTATE_UINTTL_EQUAL(env.spr[SPR_PVR], PowerPCCPU),
+
+        /* User mode architected state */
+        VMSTATE_UINTTL_ARRAY(env.gpr, PowerPCCPU, 32),
+#if !defined(TARGET_PPC64)
+        VMSTATE_UINTTL_ARRAY(env.gprh, PowerPCCPU, 32),
+#endif
+        VMSTATE_UINT32_ARRAY(env.crf, PowerPCCPU, 8),
+        VMSTATE_UINTTL(env.nip, PowerPCCPU),
+
+        /* SPRs */
+        VMSTATE_UINTTL_ARRAY(env.spr, PowerPCCPU, 1024),
+        VMSTATE_UINT64(env.spe_acc, PowerPCCPU),
+
+        /* Reservation */
+        VMSTATE_UINTTL(env.reserve_addr, PowerPCCPU),
+
+        /* Supervisor mode architected state */
+        VMSTATE_UINTTL(env.msr, PowerPCCPU),
+
+        /* Internal state */
+        VMSTATE_UINTTL(env.hflags_nmsr, PowerPCCPU),
+        /* FIXME: access_type? */
+
+        /* Sanity checking */
+        VMSTATE_UINTTL_EQUAL(env.msr_mask, PowerPCCPU),
+        VMSTATE_UINT64_EQUAL(env.insns_flags, PowerPCCPU),
+        VMSTATE_UINT64_EQUAL(env.insns_flags2, PowerPCCPU),
+        VMSTATE_UINT32_EQUAL(env.nb_BATs, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection []) {
+        {
+            .vmsd = &vmstate_fpu,
+            .needed = fpu_needed,
+        } , {
+            .vmsd = &vmstate_altivec,
+            .needed = altivec_needed,
+        } , {
+            .vmsd = &vmstate_vsx,
+            .needed = vsx_needed,
+        } , {
+            .vmsd = &vmstate_sr,
+            .needed = sr_needed,
+        } , {
+#ifdef TARGET_PPC64
+            .vmsd = &vmstate_slb,
+            .needed = slb_needed,
+        } , {
+#endif /* TARGET_PPC64 */
+            .vmsd = &vmstate_tlb6xx,
+            .needed = tlb6xx_needed,
+        } , {
+            .vmsd = &vmstate_tlbemb,
+            .needed = tlbemb_needed,
+        } , {
+            .vmsd = &vmstate_tlbmas,
+            .needed = tlbmas_needed,
+        } , {
+            /* empty */
+        }
+    }
+};
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 8215946..44069e6 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8462,6 +8462,7 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     cc->gdb_write_register = ppc_cpu_gdb_write_register;
 #ifndef CONFIG_USER_ONLY
     cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;
+    cc->vmsd = &vmstate_ppc_cpu;
 #endif
 
     cc->gdb_num_core_regs = 71;
commit b0f2027cde31c645524256763672e09eeb204a9a
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:02:00 2013 +0200

    dataplane: refuse to start if device is already in use
    
    Dataplane must check whether a block device is in use before launching
    the dataplane thread.  This is necessary since the thread does not
    synchronize with the main loop and I/O requests could cause corruption.
    
    One example is when a drive is added and a block job is started before
    hotplugging the virtio-blk-pci adapter.  In this case we must not use
    dataplane mode.
    
    Cc: qemu-stable at nongnu.org
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 63c3ffa..411becc 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -415,6 +415,14 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *blk,
         return false;
     }
 
+    /* If dataplane is (re-)enabled while the guest is running there could be
+     * block jobs that can conflict.
+     */
+    if (bdrv_in_use(blk->conf.bs)) {
+        error_report("cannot start dataplane thread while device is in use");
+        return false;
+    }
+
     fd = raw_get_aio_fd(blk->conf.bs);
     if (fd < 0) {
         error_report("drive is incompatible with x-data-plane, "
commit 84db52d059f3296abf7783968645c4a96d21b099
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:01:59 2013 +0200

    dataplane: enable virtio-blk x-data-plane=on live migration
    
    Although the dataplane thread does not cooperate with dirty memory
    logging yet it's fairly easy to temporarily disable dataplane during
    live migration.  This way virtio-blk can live migrate when
    x-data-plane=on.
    
    The dataplane thread will restart after migration is cancelled or if the
    guest resuming virtio-blk operation after migration completes.
    
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 2faed43..63c3ffa 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -18,7 +18,6 @@
 #include "qemu/error-report.h"
 #include "hw/virtio/dataplane/vring.h"
 #include "ioq.h"
-#include "migration/migration.h"
 #include "block/block.h"
 #include "hw/virtio/virtio-blk.h"
 #include "virtio-blk.h"
@@ -69,8 +68,6 @@ struct VirtIOBlockDataPlane {
                                              queue */
 
     unsigned int num_reqs;
-
-    Error *migration_blocker;
 };
 
 /* Raise an interrupt to signal guest, if necessary */
@@ -433,10 +430,6 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *blk,
     /* Prevent block operations that conflict with data plane thread */
     bdrv_set_in_use(blk->conf.bs, 1);
 
-    error_setg(&s->migration_blocker,
-            "x-data-plane does not support migration");
-    migrate_add_blocker(s->migration_blocker);
-
     *dataplane = s;
     return true;
 }
@@ -448,8 +441,6 @@ void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
     }
 
     virtio_blk_data_plane_stop(s);
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
     bdrv_set_in_use(s->blk->conf.bs, 0);
     g_free(s);
 }
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index cf12469..1237b6a 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -19,6 +19,7 @@
 #include "hw/virtio/virtio-blk.h"
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
 # include "dataplane/virtio-blk.h"
+# include "migration/migration.h"
 #endif
 #include "block/scsi.h"
 #ifdef __linux__
@@ -628,6 +629,34 @@ void virtio_blk_set_conf(DeviceState *dev, VirtIOBlkConf *blk)
     memcpy(&(s->blk), blk, sizeof(struct VirtIOBlkConf));
 }
 
+#ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+/* Disable dataplane thread during live migration since it does not
+ * update the dirty memory bitmap yet.
+ */
+static void virtio_blk_migration_state_changed(Notifier *notifier, void *data)
+{
+    VirtIOBlock *s = container_of(notifier, VirtIOBlock,
+                                  migration_state_notifier);
+    MigrationState *mig = data;
+
+    if (migration_in_setup(mig)) {
+        if (!s->dataplane) {
+            return;
+        }
+        virtio_blk_data_plane_destroy(s->dataplane);
+        s->dataplane = NULL;
+    } else if (migration_has_finished(mig) ||
+               migration_has_failed(mig)) {
+        if (s->dataplane) {
+            return;
+        }
+        bdrv_drain_all(); /* complete in-flight non-dataplane requests */
+        virtio_blk_data_plane_create(VIRTIO_DEVICE(s), &s->blk,
+                                     &s->dataplane);
+    }
+}
+#endif /* CONFIG_VIRTIO_BLK_DATA_PLANE */
+
 static int virtio_blk_device_init(VirtIODevice *vdev)
 {
     DeviceState *qdev = DEVICE(vdev);
@@ -664,6 +693,8 @@ static int virtio_blk_device_init(VirtIODevice *vdev)
         virtio_cleanup(vdev);
         return -1;
     }
+    s->migration_state_notifier.notify = virtio_blk_migration_state_changed;
+    add_migration_state_change_notifier(&s->migration_state_notifier);
 #endif
 
     s->change = qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
@@ -683,6 +714,7 @@ static int virtio_blk_device_exit(DeviceState *dev)
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIOBlock *s = VIRTIO_BLK(dev);
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    remove_migration_state_change_notifier(&s->migration_state_notifier);
     virtio_blk_data_plane_destroy(s->dataplane);
     s->dataplane = NULL;
 #endif
diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index fc71853..b87cf49 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -125,6 +125,7 @@ typedef struct VirtIOBlock {
     unsigned short sector_mask;
     VMChangeStateEntry *change;
 #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+    Notifier migration_state_notifier;
     struct VirtIOBlockDataPlane *dataplane;
 #endif
 } VirtIOBlock;
commit 02edd2e7665bceb307bedd8afe625c0f7e8d7cfa
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:01:58 2013 +0200

    migration: fix spice migration
    
    Commit 29ae8a4133082e16970c9d4be09f4b6a15034617 ("rdma: introduce
    MIG_STATE_NONE and change MIG_STATE_SETUP state transition") changed the
    state transitions during migration setup.
    
    Spice used to be notified with MIG_STATE_ACTIVE and it detected this
    using migration_is_active().  Spice is now notified with
    MIG_STATE_SETUP and migration_is_active() no longer works.
    
    Replace migration_is_active() with migration_in_setup() to fix spice
    migration.
    
    Cc: Michael R. Hines <mrhines at us.ibm.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/include/migration/migration.h b/include/migration/migration.h
index 08c772d..140e6b4 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -90,7 +90,7 @@ int migrate_fd_close(MigrationState *s);
 
 void add_migration_state_change_notifier(Notifier *notify);
 void remove_migration_state_change_notifier(Notifier *notify);
-bool migration_is_active(MigrationState *);
+bool migration_in_setup(MigrationState *);
 bool migration_has_finished(MigrationState *);
 bool migration_has_failed(MigrationState *);
 MigrationState *migrate_get_current(void);
diff --git a/migration.c b/migration.c
index a5ed26b..9fc7294 100644
--- a/migration.c
+++ b/migration.c
@@ -338,9 +338,9 @@ void remove_migration_state_change_notifier(Notifier *notify)
     notifier_remove(notify);
 }
 
-bool migration_is_active(MigrationState *s)
+bool migration_in_setup(MigrationState *s)
 {
-    return s->state == MIG_STATE_ACTIVE;
+    return s->state == MIG_STATE_SETUP;
 }
 
 bool migration_has_finished(MigrationState *s)
diff --git a/ui/spice-core.c b/ui/spice-core.c
index f308fd9..033fd89 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -563,7 +563,7 @@ static void migration_state_notifier(Notifier *notifier, void *data)
 {
     MigrationState *s = data;
 
-    if (migration_is_active(s)) {
+    if (migration_in_setup(s)) {
         spice_server_migrate_start(spice_server);
     } else if (migration_has_finished(s)) {
         spice_server_migrate_end(spice_server, true);
commit 9287ac271d83166f99e050a0e0a4ebd462f7eb2b
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Jul 29 15:01:57 2013 +0200

    migration: notify migration state before starting thread
    
    The migration thread runs outside the QEMU global mutex when possible.
    Therefore we must notify migration state change *before* starting the
    migration thread.
    
    This allows registered listeners to act before live migration iterations
    begin.  Therefore they can get into a state that allows for live
    migration.  When the migration thread starts everything will be ready.
    
    Without this patch there is a race condition during migration setup,
    depending on whether the migration thread has already transitioned from
    SETUP to ACTIVE state.
    
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/migration.c b/migration.c
index e12e784..a5ed26b 100644
--- a/migration.c
+++ b/migration.c
@@ -658,7 +658,9 @@ void migrate_fd_connect(MigrationState *s)
     qemu_file_set_rate_limit(s->file,
                              s->bandwidth_limit / XFER_LIMIT_RATIO);
 
+    /* Notify before starting migration thread */
+    notifier_list_notify(&migration_state_notifiers, s);
+
     qemu_thread_create(&s->thread, migration_thread, s,
                        QEMU_THREAD_JOINABLE);
-    notifier_list_notify(&migration_state_notifiers, s);
 }
commit b681a1c73e15e08c70c10cccd9c9f5b65cca12e8
Author: Benoît Canet <benoit at irqsave.net>
Date:   Fri Jul 26 22:39:22 2013 +0200

    block: Repair the throttling code.
    
    The throttling code was segfaulting since commit
    02ffb504485f0920cfc75a0982a602f824a9a4f4 because some qemu_co_queue_next caller
    does not run in a coroutine.
    qemu_co_queue_do_restart assume that the caller is a coroutinne.
    As suggested by Stefan fix this by entering the coroutine directly.
    Also make sure like suggested that qemu_co_queue_next() and
    qemu_co_queue_restart_all() can be called only in coroutines.
    
    Signed-off-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index c77cfd1..01b66d8 100644
--- a/block.c
+++ b/block.c
@@ -127,7 +127,7 @@ void bdrv_io_limits_disable(BlockDriverState *bs)
 {
     bs->io_limits_enabled = false;
 
-    while (qemu_co_queue_next(&bs->throttled_reqs));
+    do {} while (qemu_co_enter_next(&bs->throttled_reqs));
 
     if (bs->block_timer) {
         qemu_del_timer(bs->block_timer);
@@ -143,7 +143,7 @@ static void bdrv_block_timer(void *opaque)
 {
     BlockDriverState *bs = opaque;
 
-    qemu_co_queue_next(&bs->throttled_reqs);
+    qemu_co_enter_next(&bs->throttled_reqs);
 }
 
 void bdrv_io_limits_enable(BlockDriverState *bs)
@@ -1452,8 +1452,7 @@ void bdrv_drain_all(void)
          * a busy wait.
          */
         QTAILQ_FOREACH(bs, &bdrv_states, list) {
-            if (!qemu_co_queue_empty(&bs->throttled_reqs)) {
-                qemu_co_queue_restart_all(&bs->throttled_reqs);
+            while (qemu_co_enter_next(&bs->throttled_reqs)) {
                 busy = true;
             }
         }
diff --git a/include/block/coroutine.h b/include/block/coroutine.h
index 377805a..1f2db3e 100644
--- a/include/block/coroutine.h
+++ b/include/block/coroutine.h
@@ -130,12 +130,17 @@ void coroutine_fn qemu_co_queue_wait_insert_head(CoQueue *queue);
  *
  * Returns true if a coroutine was restarted, false if the queue is empty.
  */
-bool qemu_co_queue_next(CoQueue *queue);
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
 
 /**
  * Restarts all coroutines in the CoQueue and leaves the queue empty.
  */
-void qemu_co_queue_restart_all(CoQueue *queue);
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
+
+/**
+ * Enter the next coroutine in the queue
+ */
+bool qemu_co_enter_next(CoQueue *queue);
 
 /**
  * Checks if the CoQueue is empty.
diff --git a/qemu-coroutine-lock.c b/qemu-coroutine-lock.c
index d9fea49..aeb33b9 100644
--- a/qemu-coroutine-lock.c
+++ b/qemu-coroutine-lock.c
@@ -88,16 +88,32 @@ static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
     return true;
 }
 
-bool qemu_co_queue_next(CoQueue *queue)
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue)
 {
+    assert(qemu_in_coroutine());
     return qemu_co_queue_do_restart(queue, true);
 }
 
-void qemu_co_queue_restart_all(CoQueue *queue)
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue)
 {
+    assert(qemu_in_coroutine());
     qemu_co_queue_do_restart(queue, false);
 }
 
+bool qemu_co_enter_next(CoQueue *queue)
+{
+    Coroutine *next;
+
+    next = QTAILQ_FIRST(&queue->entries);
+    if (!next) {
+        return false;
+    }
+
+    QTAILQ_REMOVE(&queue->entries, next, co_queue_next);
+    qemu_coroutine_enter(next, NULL);
+    return true;
+}
+
 bool qemu_co_queue_empty(CoQueue *queue)
 {
     return (QTAILQ_FIRST(&queue->entries) == NULL);
commit 42ec24e2851674e0899f71933e0d7d9125f31d76
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Jul 19 19:51:33 2013 +0530

    gluster: Add image resize support
    
    Implement .bdrv_truncate in GlusterFS block driver so that GlusterFS backend
    can support image resizing.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Bharata B Rao <bharata at linux.vnet.ibm.com>
    Tested-by: Bharata B Rao <bharata at linux.vnet.ibm.com>
    Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/gluster.c b/block/gluster.c
index 6de418c..645b7f1 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -493,6 +493,19 @@ out:
     return NULL;
 }
 
+static int qemu_gluster_truncate(BlockDriverState *bs, int64_t offset)
+{
+    int ret;
+    BDRVGlusterState *s = bs->opaque;
+
+    ret = glfs_ftruncate(s->fd, offset);
+    if (ret < 0) {
+        return -errno;
+    }
+
+    return 0;
+}
+
 static BlockDriverAIOCB *qemu_gluster_aio_readv(BlockDriverState *bs,
         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque)
@@ -631,6 +644,7 @@ static BlockDriver bdrv_gluster = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -650,6 +664,7 @@ static BlockDriver bdrv_gluster_tcp = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -669,6 +684,7 @@ static BlockDriver bdrv_gluster_unix = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
@@ -688,6 +704,7 @@ static BlockDriver bdrv_gluster_rdma = {
     .bdrv_create                  = qemu_gluster_create,
     .bdrv_getlength               = qemu_gluster_getlength,
     .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
+    .bdrv_truncate                = qemu_gluster_truncate,
     .bdrv_aio_readv               = qemu_gluster_aio_readv,
     .bdrv_aio_writev              = qemu_gluster_aio_writev,
     .bdrv_aio_flush               = qemu_gluster_aio_flush,
commit 9337e3b6e1d779215423d9b419d42200506deaab
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Fri Jul 26 17:09:36 2013 -0300

    target-i386: Disable PMU CPUID leaf by default
    
    Bug description: QEMU currently gets all bits from GET_SUPPORTED_CPUID
    for CPUID leaf 0xA and passes them directly to the guest. This makes
    the guest ABI depend on host kernel and host CPU capabilities, and
    breaks live migration if we migrate between hosts with different
    capabilities (e.g., different number of PMU counters).
    
    Add a "pmu" property to X86CPU, and set it to true only on "-cpu host",
    or on pc-*-1.5 and older machine-types.
    
    For now, setting pmu=on will enable the current passthrough mode that
    doesn't have any ABI stability guarantees, but in the future we may
    implement a mode where the PMU CPUID bits are stable and configurable.
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Cc: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 7fb97b0..09c2dd4 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -235,6 +235,10 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
             .driver   = "virtio-net-pci",\
             .property = "any_layout",\
             .value    = "off",\
+        },{\
+            .driver = TYPE_X86_CPU,\
+            .property = "pmu",\
+            .value = "on",\
         }
 
 #define PC_COMPAT_1_4 \
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 60d2b5d..53b4c34 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -68,6 +68,13 @@ typedef struct X86CPU {
 
     /* Features that were filtered out because of missing host capabilities */
     uint32_t filtered_features[FEATURE_WORDS];
+
+    /* Enable PMU CPUID bits. This can't be enabled by default yet because
+     * it doesn't have ABI stability guarantees, as it passes all PMU CPUID
+     * bits returned by GET_SUPPORTED_CPUID (that depend on host CPU and kernel
+     * capabilities) directly to the guest.
+     */
+    bool enable_pmu;
 } X86CPU;
 
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 80143bf..71ab915 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1479,6 +1479,7 @@ static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
                                 const char *name)
 {
     x86_def_t *def;
+    Error *err = NULL;
     int i;
 
     if (name == NULL) {
@@ -1486,6 +1487,8 @@ static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
     }
     if (kvm_enabled() && strcmp(name, "host") == 0) {
         kvm_cpu_fill_host(x86_cpu_def);
+        object_property_set_bool(OBJECT(cpu), true, "pmu", &err);
+        assert_no_error(err);
         return 0;
     }
 
@@ -2017,7 +2020,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         break;
     case 0xA:
         /* Architectural Performance Monitoring Leaf */
-        if (kvm_enabled()) {
+        if (kvm_enabled() && cpu->enable_pmu) {
             KVMState *s = cs->kvm_state;
 
             *eax = kvm_arch_get_supported_cpuid(s, 0xA, count, R_EAX);
@@ -2523,6 +2526,11 @@ static void x86_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
     cpu->env.eip = tb->pc - tb->cs_base;
 }
 
+static Property x86_cpu_properties[] = {
+    DEFINE_PROP_BOOL("pmu", X86CPU, enable_pmu, false),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
@@ -2532,6 +2540,7 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
     xcc->parent_realize = dc->realize;
     dc->realize = x86_cpu_realizefn;
     dc->bus_type = TYPE_ICC_BUS;
+    dc->props = x86_cpu_properties;
 
     xcc->parent_reset = cc->reset;
     cc->reset = x86_cpu_reset;
commit c139911261c5acc9dae56b1180db320ba25636bd
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Fri Jul 26 17:09:35 2013 -0300

    target-i386: Pass X86CPU object to cpu_x86_find_by_name()
    
    This will help us change the initialization code to not require carrying
    some intermediate values in a x86_def_t struct (and eventually kill the
    x86_def_t struct entirely).
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index df2fb1b..80143bf 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1475,7 +1475,8 @@ static void x86_cpu_get_feature_words(Object *obj, Visitor *v, void *opaque,
     error_propagate(errp, err);
 }
 
-static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *name)
+static int cpu_x86_find_by_name(X86CPU *cpu, x86_def_t *x86_cpu_def,
+                                const char *name)
 {
     x86_def_t *def;
     int i;
@@ -1742,7 +1743,7 @@ static void cpu_x86_register(X86CPU *cpu, const char *name, Error **errp)
 
     memset(def, 0, sizeof(*def));
 
-    if (cpu_x86_find_by_name(def, name) < 0) {
+    if (cpu_x86_find_by_name(cpu, def, name) < 0) {
         error_setg(errp, "Unable to find CPU definition: %s", name);
         return;
     }
commit 14a10fc39923b3af07c8c46d22cb20843bee3a72
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jul 27 02:53:25 2013 +0200

    cpu: Partially revert "cpu: Change qemu_init_vcpu() argument to CPUState"
    
    Commit c643bed99 moved qemu_init_vcpu() calls to common CPUState code.
    This causes x86 cpu-add to fail with "KVM: setting VAPIC address failed".
    
    The reason for the failure is that CPUClass::kvm_fd is not yet
    initialized in the following call graph:
    ->x86_cpu_realizefn
     ->x86_cpu_apic_realize
      ->qdev_init
       ->device_set_realized
        ->device_reset (hotplugged == 1)
         ->apic_reset_common
          ->vapic_base_update
           ->kvm_apic_vapic_base_update
    This causes attempted KVM vCPU ioctls to fail.
    
    By contrast, in the non-hotplug case the APIC is reset much later, when
    the vCPU is already initialized.
    
    As a quick and safe solution, move the qemu_init_vcpu() call back into
    the targets' realize functions.
    
    Reported-by: Chen Fan <chen.fan.fnst at cn.fujitsu.com>
    Acked-by: Igor Mammedov <imammedo at redhat.com> (for i386)
    Tested-by: Jia Liu <proljc at gmail.com> (for openrisc)
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/qom/cpu.c b/qom/cpu.c
index dbc9fb6..aa95108 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -228,8 +228,6 @@ static void cpu_common_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cpu = CPU(dev);
 
-    qemu_init_vcpu(cpu);
-
     if (dev->hotplugged) {
         cpu_synchronize_post_init(cpu);
         notifier_list_notify(&cpu_added_notifiers, dev);
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 64c70bc..cfad2ea 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -33,8 +33,11 @@ static void alpha_cpu_set_pc(CPUState *cs, vaddr value)
 
 static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     AlphaCPUClass *acc = ALPHA_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(cs);
+
     acc->parent_realize(dev, errp);
 }
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 87d35c6..5a7566b 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -159,6 +159,7 @@ static void arm_cpu_finalizefn(Object *obj)
 
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     ARMCPU *cpu = ARM_CPU(dev);
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
     CPUARMState *env = &cpu->env;
@@ -214,7 +215,8 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
     init_cpreg_list(cpu);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     acc->parent_realize(dev, errp);
 }
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 45f2d6b..44301a4 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -137,10 +137,11 @@ void cris_cpu_list(FILE *f, fprintf_function cpu_fprintf)
 
 static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    CRISCPU *cpu = CRIS_CPU(dev);
+    CPUState *cs = CPU(dev);
     CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     ccc->parent_realize(dev, errp);
 }
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 2b59b7d..df2fb1b 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2333,6 +2333,7 @@ static void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
 
 static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     X86CPU *cpu = X86_CPU(dev);
     X86CPUClass *xcc = X86_CPU_GET_CLASS(dev);
     CPUX86State *env = &cpu->env;
@@ -2387,12 +2388,13 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 #endif
 
     mce_init(cpu);
+    qemu_init_vcpu(cs);
 
     x86_cpu_apic_realize(cpu, &local_err);
     if (local_err != NULL) {
         goto out;
     }
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
 
     xcc->parent_realize(dev, &local_err);
 out:
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 962d553..869878c 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -46,10 +46,12 @@ static void lm32_cpu_reset(CPUState *s)
 
 static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    LM32CPU *cpu = LM32_CPU(dev);
+    CPUState *cs = CPU(dev);
     LM32CPUClass *lcc = LM32_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+
+    qemu_init_vcpu(cs);
 
     lcc->parent_realize(dev, errp);
 }
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index c0bcb0d..008d8db 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -143,12 +143,14 @@ static const M68kCPUInfo m68k_cpus[] = {
 
 static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
 {
+    CPUState *cs = CPU(dev);
     M68kCPU *cpu = M68K_CPU(dev);
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(dev);
 
     m68k_cpu_init_gdb(cpu);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index c75d1bd..0ef9aa4 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -90,10 +90,11 @@ static void mb_cpu_reset(CPUState *s)
 
 static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MicroBlazeCPU *cpu = MICROBLAZE_CPU(dev);
+    CPUState *cs = CPU(dev);
     MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index f81f9e9..9dd47e8 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -62,10 +62,11 @@ static void mips_cpu_reset(CPUState *s)
 
 static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MIPSCPU *cpu = MIPS_CPU(dev);
+    CPUState *cs = CPU(dev);
     MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-moxie/cpu.c b/target-moxie/cpu.c
index 6550be5..d97a091 100644
--- a/target-moxie/cpu.c
+++ b/target-moxie/cpu.c
@@ -45,10 +45,11 @@ static void moxie_cpu_reset(CPUState *s)
 
 static void moxie_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    MoxieCPU *cpu = MOXIE_CPU(dev);
+    CPUState *cs = CPU(dev);
     MoxieCPUClass *mcc = MOXIE_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     mcc->parent_realize(dev, errp);
 }
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index aa269fb..075f00a 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -66,10 +66,11 @@ static inline void set_feature(OpenRISCCPU *cpu, int feature)
 
 static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    OpenRISCCPU *cpu = OPENRISC_CPU(dev);
+    CPUState *cs = CPU(dev);
     OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     occ->parent_realize(dev, errp);
 }
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 8215946..3c81798 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -7861,6 +7861,8 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
                                  34, "power-spe.xml", 0);
     }
 
+    qemu_init_vcpu(cs);
+
     pcc->parent_realize(dev, errp);
 
 #if defined(PPC_DUMP_CPU)
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 1d16da3..9b82495 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -101,10 +101,11 @@ static void s390_cpu_machine_reset_cb(void *opaque)
 
 static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    S390CPU *cpu = S390_CPU(dev);
+    CPUState *cs = CPU(dev);
     S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(cs);
+    cpu_reset(cs);
 
     scc->parent_realize(dev, errp);
 }
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index bda3c51..34b2b57 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -240,10 +240,11 @@ static const TypeInfo sh7785_type_info = {
 
 static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    SuperHCPU *cpu = SUPERH_CPU(dev);
+    CPUState *cs = CPU(dev);
     SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(dev);
 
-    cpu_reset(CPU(cpu));
+    cpu_reset(cs);
+    qemu_init_vcpu(cs);
 
     scc->parent_realize(dev, errp);
 }
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index c7b4a90..47ce60d 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -743,6 +743,8 @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(CPU(dev));
+
     scc->parent_realize(dev, errp);
 }
 
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 46813e5..3f78208 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -92,6 +92,8 @@ static void uc32_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     UniCore32CPUClass *ucc = UNICORE32_CPU_GET_CLASS(dev);
 
+    qemu_init_vcpu(CPU(dev));
+
     ucc->parent_realize(dev, errp);
 }
 
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index e966aa0..c19d17a 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -90,6 +90,8 @@ static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
 
     cs->gdb_num_regs = xcc->config->gdb_regmap.num_regs;
 
+    qemu_init_vcpu(cs);
+
     xcc->parent_realize(dev, errp);
 }
 
commit fdc43322c978d78e79e692872dcec7b4f6a447f1
Merge: b0a71c3 8fbab3b
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 07:30:31 2013 -0500

    Merge remote-tracking branch 'sstabellini/xen-130729' into staging
    
    # By Paul Durrant (1) and Stefano Stabellini (1)
    # Via Stefano Stabellini
    * sstabellini/xen-130729:
      Xen PV Device
      xen_disk: support "direct-io-safe" backend option
    
    Message-id: 1375096790-12815-1-git-send-email-stefano.stabellini at eu.citrix.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit b0a71c3b397b12db727ce483f01b3336160ef6a1
Merge: f60a0d6 867b18d
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 07:30:21 2013 -0500

    Merge remote-tracking branch 'agraf/s390-for-upstream' into staging
    
    # By Alexander Graf (1) and others
    # Via Alexander Graf
    * agraf/s390-for-upstream:
      s390: update s390-ccw.img
      s390/ipl: Fix boot order
      s390/IPL: Allow boot from other ssid than 0
    
    Message-id: 1375092324-23943-1-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit f60a0d6ab9ea9ba900ba3936c3471851f28f7bc4
Merge: 200a063 f53ec69
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Jul 29 07:30:06 2013 -0500

    Merge remote-tracking branch 'sweil/w32' into staging
    
    # By Stefan Weil (10) and others
    # Via Aurelien Jarno (1) and Stefan Weil (1)
    * sweil/w32: (27 commits)
      w32, w64: Add build rule for installer
      target-mips: fix mipsdsp_mul_q31_q31
      mips_malta: fix copy of the 0x1fc00000 region
      linux-user: correct argument number for sys_mremap and sys_splice
      target-mips: Remove assignment to a variable which is never used
      target-mips: fix mipsdsp_trunc16_sat16_round
      hw/mips: align initrd to 64KB to avoid kernel error
      pflash_cfi01: duplicate status byte from bits 23:16 for 32bit reads
      mips_malta: generate SMBUS EEPROM data
      mips_malta: cap BIOS endian swap length at 0x3e0000 bytes
      mips_malta: generate SPD EEPROM data at runtime
      mips_malta: correct reading MIPS revision at 0x1fc00010
      mips_malta: fix BIOS endianness swapping
      mips_malta: QOM cast cleanup
      target-mips: fix branch in likely delay slot tcg assert
      target-mips: fix multiplication in mipsdsp_rndq15_mul_q15_q15
      target-mips: Remove assignment to a variable which is never used
      misc: Use g_assert_not_reached for code which is expected to be unreachable
      qemu-options: mention C-a h in the -nographic doc
      misc: Fix new typos in comments and strings
      ...
    
    Message-id: 1374989579-24933-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 8fbab3b62a271526c782110aed0ae160eb38c296
Author: Paul Durrant <paul.durrant at citrix.com>
Date:   Mon Jul 29 10:58:01 2013 +0000

    Xen PV Device
    
    Introduces a new Xen PV PCI device which will act as a binding point for
    PV drivers for Xen.
    The device has parameterized vendor-id, device-id and revision to allow to
    be configured as a binding point for any vendor's PV drivers.
    
    Signed-off-by: Paul Durrant <paul.durrant at citrix.com>
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/xen/Makefile.objs b/hw/xen/Makefile.objs
index 2017560..ce640c6 100644
--- a/hw/xen/Makefile.objs
+++ b/hw/xen/Makefile.objs
@@ -1,6 +1,6 @@
 # xen backend driver support
 common-obj-$(CONFIG_XEN_BACKEND) += xen_backend.o xen_devconfig.o
 
-obj-$(CONFIG_XEN_I386) += xen_platform.o xen_apic.o
+obj-$(CONFIG_XEN_I386) += xen_platform.o xen_apic.o xen_pvdevice.o
 obj-$(CONFIG_XEN_PCI_PASSTHROUGH) += xen-host-pci-device.o
 obj-$(CONFIG_XEN_PCI_PASSTHROUGH) += xen_pt.o xen_pt_config_init.o xen_pt_msi.o
diff --git a/hw/xen/xen_pvdevice.c b/hw/xen/xen_pvdevice.c
new file mode 100644
index 0000000..1132c89
--- /dev/null
+++ b/hw/xen/xen_pvdevice.c
@@ -0,0 +1,131 @@
+/* Copyright (c) Citrix Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms,
+ * with or without modification, are permitted provided
+ * that the following conditions are met:
+ *
+ * *   Redistributions of source code must retain the above
+ *     copyright notice, this list of conditions and the
+ *     following disclaimer.
+ * *   Redistributions in binary form must reproduce the above
+ *     copyright notice, this list of conditions and the
+ *     following disclaimer in the documentation and/or other
+ *     materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+ * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "hw/hw.h"
+#include "hw/pci/pci.h"
+#include "trace.h"
+
+#define TYPE_XEN_PV_DEVICE  "xen-pvdevice"
+
+#define XEN_PV_DEVICE(obj) \
+     OBJECT_CHECK(XenPVDevice, (obj), TYPE_XEN_PV_DEVICE)
+
+typedef struct XenPVDevice {
+    /*< private >*/
+    PCIDevice       parent_obj;
+    /*< public >*/
+    uint16_t        vendor_id;
+    uint16_t        device_id;
+    uint8_t         revision;
+    uint32_t        size;
+    MemoryRegion    mmio;
+} XenPVDevice;
+
+static uint64_t xen_pv_mmio_read(void *opaque, hwaddr addr,
+                                 unsigned size)
+{
+    trace_xen_pv_mmio_read(addr);
+
+    return ~(uint64_t)0;
+}
+
+static void xen_pv_mmio_write(void *opaque, hwaddr addr,
+                              uint64_t val, unsigned size)
+{
+    trace_xen_pv_mmio_write(addr);
+}
+
+static const MemoryRegionOps xen_pv_mmio_ops = {
+    .read = &xen_pv_mmio_read,
+    .write = &xen_pv_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static int xen_pv_init(PCIDevice *pci_dev)
+{
+    XenPVDevice *d = XEN_PV_DEVICE(pci_dev);
+    uint8_t *pci_conf;
+
+    pci_conf = pci_dev->config;
+
+    pci_set_word(pci_conf + PCI_VENDOR_ID, d->vendor_id);
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, d->vendor_id);
+    pci_set_word(pci_conf + PCI_DEVICE_ID, d->device_id);
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, d->device_id);
+    pci_set_byte(pci_conf + PCI_REVISION_ID, d->revision);
+
+    pci_set_word(pci_conf + PCI_COMMAND, PCI_COMMAND_MEMORY);
+
+    pci_config_set_prog_interface(pci_conf, 0);
+
+    pci_conf[PCI_INTERRUPT_PIN] = 1;
+
+    memory_region_init_io(&d->mmio, NULL, &xen_pv_mmio_ops, d,
+                          "mmio", d->size);
+
+    pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_MEM_PREFETCH,
+                     &d->mmio);
+
+    return 0;
+}
+
+static Property xen_pv_props[] = {
+    DEFINE_PROP_UINT16("vendor-id", XenPVDevice, vendor_id, PCI_VENDOR_ID_XEN),
+    DEFINE_PROP_UINT16("device-id", XenPVDevice, device_id, PCI_DEVICE_ID_XEN_PVDEVICE),
+    DEFINE_PROP_UINT8("revision", XenPVDevice, revision, 0x01),
+    DEFINE_PROP_UINT32("size", XenPVDevice, size, 0x400000),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void xen_pv_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->init = xen_pv_init;
+    k->class_id = PCI_CLASS_SYSTEM_OTHER;
+    dc->desc = "Xen PV Device";
+    dc->props = xen_pv_props;
+}
+
+static const TypeInfo xen_pv_type_info = {
+    .name          = TYPE_XEN_PV_DEVICE,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(XenPVDevice),
+    .class_init    = xen_pv_class_init,
+};
+
+static void xen_pv_register_types(void)
+{
+    type_register_static(&xen_pv_type_info);
+}
+
+type_init(xen_pv_register_types)
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index d7933bf..3ddaf6a 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -143,8 +143,9 @@
 
 #define PCI_DEVICE_ID_INTEL_Q35_MCH      0x29c0
 
-#define PCI_VENDOR_ID_XEN               0x5853
-#define PCI_DEVICE_ID_XEN_PLATFORM      0x0001
+#define PCI_VENDOR_ID_XEN                0x5853
+#define PCI_DEVICE_ID_XEN_PLATFORM       0x0001
+#define PCI_DEVICE_ID_XEN_PVDEVICE       0x0002
 
 #define PCI_VENDOR_ID_NEC                0x1033
 #define PCI_DEVICE_ID_NEC_UPD720200      0x0194
diff --git a/trace-events b/trace-events
index 002df83..0f7c8b4 100644
--- a/trace-events
+++ b/trace-events
@@ -1168,3 +1168,7 @@ kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 # qom/object.c
 object_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
 object_class_dynamic_cast_assert(const char *type, const char *target, const char *file, int line, const char *func) "%s->%s (%s:%d:%s)"
+
+# hw/xen/xen_pvdevice.c
+xen_pv_mmio_read(uint64_t addr) "WARNING: read from Xen PV Device MMIO space (address %"PRIx64")"
+xen_pv_mmio_write(uint64_t addr) "WARNING: write to Xen PV Device MMIO space (address %"PRIx64")"
commit 454ae734f1d9f591345fa78376435a8e74bb4edd
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Mon Jul 29 10:56:38 2013 +0000

    xen_disk: support "direct-io-safe" backend option
    
    Support backend option "direct-io-safe".  This is documented as
    follows in the Xen backend specification:
    
     * direct-io-safe
     *      Values:         0/1 (boolean)
     *      Default Value:  0
     *
     *      The underlying storage is not affected by the direct IO memory
     *      lifetime bug.  See:
     *        http://lists.xen.org/archives/html/xen-devel/2012-12/msg01154.html
     *
     *      Therefore this option gives the backend permission to use
     *      O_DIRECT, notwithstanding that bug.
     *
     *      That is, if this option is enabled, use of O_DIRECT is safe,
     *      in circumstances where we would normally have avoided it as a
     *      workaround for that bug.  This option is not relevant for all
     *      backends, and even not necessarily supported for those for
     *      which it is relevant.  A backend which knows that it is not
     *      affected by the bug can ignore this option.
     *
     *      This option doesn't require a backend to use O_DIRECT, so it
     *      should not be used to try to control the caching behaviour.
    
    Also, BDRV_O_NATIVE_AIO is ignored if BDRV_O_NOCACHE, so clarify the
    default flags passed to the qemu block layer.
    
    The original proposal for a "cache" backend option has been dropped
    because it was believed too wide, especially considering that at the
    moment the backend doesn't have a way to tell the toolstack that it is
    capable of supporting it.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Signed-off-by: Ian Jackson <Ian.Jackson at eu.citrix.com>

diff --git a/hw/block/xen_disk.c b/hw/block/xen_disk.c
index 247f32f..727f433 100644
--- a/hw/block/xen_disk.c
+++ b/hw/block/xen_disk.c
@@ -93,6 +93,7 @@ struct XenBlkDev {
     char                *type;
     char                *dev;
     char                *devtype;
+    bool                directiosafe;
     const char          *fileproto;
     const char          *filename;
     int                 ring_ref;
@@ -701,6 +702,7 @@ static int blk_init(struct XenDevice *xendev)
 {
     struct XenBlkDev *blkdev = container_of(xendev, struct XenBlkDev, xendev);
     int info = 0;
+    char *directiosafe = NULL;
 
     /* read xenstore entries */
     if (blkdev->params == NULL) {
@@ -733,6 +735,8 @@ static int blk_init(struct XenDevice *xendev)
     if (blkdev->devtype == NULL) {
         blkdev->devtype = xenstore_read_be_str(&blkdev->xendev, "device-type");
     }
+    directiosafe = xenstore_read_be_str(&blkdev->xendev, "direct-io-safe");
+    blkdev->directiosafe = (directiosafe && atoi(directiosafe));
 
     /* do we have all we need? */
     if (blkdev->params == NULL ||
@@ -760,6 +764,8 @@ static int blk_init(struct XenDevice *xendev)
     xenstore_write_be_int(&blkdev->xendev, "feature-flush-cache", 1);
     xenstore_write_be_int(&blkdev->xendev, "feature-persistent", 1);
     xenstore_write_be_int(&blkdev->xendev, "info", info);
+
+    g_free(directiosafe);
     return 0;
 
 out_error:
@@ -773,6 +779,8 @@ out_error:
     blkdev->dev = NULL;
     g_free(blkdev->devtype);
     blkdev->devtype = NULL;
+    g_free(directiosafe);
+    blkdev->directiosafe = false;
     return -1;
 }
 
@@ -783,7 +791,11 @@ static int blk_connect(struct XenDevice *xendev)
     bool readonly = true;
 
     /* read-only ? */
-    qflags = BDRV_O_CACHE_WB | BDRV_O_NATIVE_AIO;
+    if (blkdev->directiosafe) {
+        qflags = BDRV_O_NOCACHE | BDRV_O_NATIVE_AIO;
+    } else {
+        qflags = BDRV_O_CACHE_WB;
+    }
     if (strcmp(blkdev->mode, "w") == 0) {
         qflags |= BDRV_O_RDWR;
         readonly = false;
commit 867b18db2155c0c99ab767c4ac563e144c85871d
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Jun 24 14:56:51 2013 +0200

    s390: update s390-ccw.img
    
    This enables the following patches:
    
      s390/IPL: Allow boot from other ssid than 0
      s390/ipl: Fix spurious errors in virtio
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/pc-bios/s390-ccw.img b/pc-bios/s390-ccw.img
index 1b2a11e..05fc7c2 100644
Binary files a/pc-bios/s390-ccw.img and b/pc-bios/s390-ccw.img differ
commit 5c8ded6ef55761e80353f42d8e59c6e233a2f51a
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Tue Jun 18 14:31:52 2013 +0200

    s390/ipl: Fix boot order
    
    The latest ipl code adaptions collided with some of the virtio
    refactoring rework. This resulted in always booting the first
    disk. Let's fix booting from a given ID.
    The new code also checks for command lines without bootindex to
    avoid random behaviour when accessing dev_st (==0).
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 0aeb003..d69adb2 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -154,17 +154,19 @@ static void s390_ipl_reset(DeviceState *dev)
     env->psw.mask = IPL_PSW_MASK;
 
     if (!ipl->kernel) {
-        /* booting firmware, tell what device to boot from */
+        /* Tell firmware, if there is a preferred boot device */
+        env->regs[7] = -1;
         DeviceState *dev_st = get_boot_device(0);
-        VirtioCcwDevice *ccw_dev = (VirtioCcwDevice *) object_dynamic_cast(
-                OBJECT(&(dev_st->parent_obj)), "virtio-blk-ccw");
-
-        if (ccw_dev) {
-            env->regs[7] = ccw_dev->sch->cssid << 24 |
-                           ccw_dev->sch->ssid << 16 |
-                           ccw_dev->sch->devno;
-        } else {
-            env->regs[7] = -1;
+        if (dev_st) {
+            VirtioCcwDevice *ccw_dev = (VirtioCcwDevice *) object_dynamic_cast(
+                OBJECT(qdev_get_parent_bus(dev_st)->parent),
+                TYPE_VIRTIO_CCW_DEVICE);
+
+            if (ccw_dev) {
+                env->regs[7] = ccw_dev->sch->cssid << 24 |
+                               ccw_dev->sch->ssid << 16 |
+                               ccw_dev->sch->devno;
+            }
         }
     }
 
commit c8cda8748eceeeb06f1952e7e765a0919103644d
Author: Dominik Dingel <dingel at linux.vnet.ibm.com>
Date:   Mon Jun 17 14:29:42 2013 +0200

    s390/IPL: Allow boot from other ssid than 0
    
    We now take the subchannel set id also into account to find the boot device.
    If we want to use a subchannel set other than the default set 0, we first
    need to enable the mss facility.
    
    Signed-off-by: Dominik Dingel <dingel at linux.vnet.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/pc-bios/s390-ccw/cio.h b/pc-bios/s390-ccw/cio.h
index cb5815a..f5b4549 100644
--- a/pc-bios/s390-ccw/cio.h
+++ b/pc-bios/s390-ccw/cio.h
@@ -93,6 +93,26 @@ struct subchannel_id {
         __u32 sch_no : 16;
 } __attribute__ ((packed, aligned(4)));
 
+struct chsc_header {
+    __u16 length;
+    __u16 code;
+} __attribute__((packed));
+
+struct chsc_area_sda {
+    struct chsc_header request;
+    __u8 reserved1:4;
+    __u8 format:4;
+    __u8 reserved2;
+    __u16 operation_code;
+    __u32 reserved3;
+    __u32 reserved4;
+    __u32 operation_data_area[252];
+    struct chsc_header response;
+    __u32 reserved5:4;
+    __u32 format2:4;
+    __u32 reserved6:24;
+} __attribute__((packed));
+
 /*
  * TPI info structure
  */
diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
index 1665c57..c5d5332 100644
--- a/pc-bios/s390-ccw/main.c
+++ b/pc-bios/s390-ccw/main.c
@@ -35,6 +35,13 @@ static void virtio_setup(uint64_t dev_info)
         check_devno = true;
         dev_no = dev_info & 0xffff;
         debug_print_int("device no. ", dev_no);
+        blk_schid.ssid = (dev_info >> 16) & 0x3;
+        if (blk_schid.ssid != 0) {
+            debug_print_int("ssid ", blk_schid.ssid);
+            if (enable_mss_facility() != 0) {
+                virtio_panic("Failed to enable mss facility\n");
+            }
+        }
     }
 
     for (i = 0; i < 0x10000; i++) {
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index 8241b0a..5e871ac 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -61,6 +61,7 @@ unsigned long virtio_load_direct(ulong rec_list1, ulong rec_list2,
 bool virtio_is_blk(struct subchannel_id schid);
 void virtio_setup_block(struct subchannel_id schid);
 int virtio_read(ulong sector, void *load_addr);
+int enable_mss_facility(void);
 
 /* bootmap.c */
 int zipl_load(void);
diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
index f438af1..49f2d29 100644
--- a/pc-bios/s390-ccw/virtio.c
+++ b/pc-bios/s390-ccw/virtio.c
@@ -13,6 +13,8 @@
 
 struct vring block;
 
+static char chsc_page[PAGE_SIZE] __attribute__((__aligned__(PAGE_SIZE)));
+
 static long kvm_hypercall(unsigned long nr, unsigned long param1,
                           unsigned long param2)
 {
@@ -301,3 +303,19 @@ bool virtio_is_blk(struct subchannel_id schid)
     return true;
 }
 
+int enable_mss_facility(void)
+{
+    int ret;
+    struct chsc_area_sda *sda_area = (struct chsc_area_sda *) chsc_page;
+
+    memset(sda_area, 0, PAGE_SIZE);
+    sda_area->request.length = 0x0400;
+    sda_area->request.code = 0x0031;
+    sda_area->operation_code = 0x2;
+
+    ret = chsc(sda_area);
+    if ((ret == 0) && (sda_area->response.code == 0x0001)) {
+        return 0;
+    }
+    return -EIO;
+}
commit f53ec6999287bfdc4f0dfdb6427baa1853f8952a
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Jul 15 23:49:57 2013 +0200

    w32, w64: Add build rule for installer
    
    The new rules in Makefile allow building installers for QEMU on Windows
    using NSIS, a package which is also available for Linux distributions
    (so cross builds are possible).
    
    The rules for NSIS are in qemu.nsi which also uses two new images.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/Makefile b/Makefile
index c06bfab..29f1043 100644
--- a/Makefile
+++ b/Makefile
@@ -437,6 +437,61 @@ qemu-doc.dvi qemu-doc.html qemu-doc.info qemu-doc.pdf: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
 	qemu-monitor.texi qemu-img-cmds.texi
 
+ifdef CONFIG_WIN32
+
+INSTALLER = qemu-setup-$(VERSION)$(EXESUF)
+
+nsisflags = -V2 -NOCD
+
+ifneq ($(wildcard $(SRC_PATH)/dll),)
+ifeq ($(ARCH),x86_64)
+# 64 bit executables
+DLL_PATH = $(SRC_PATH)/dll/w64
+nsisflags += -DW64
+else
+# 32 bit executables
+DLL_PATH = $(SRC_PATH)/dll/w32
+endif
+endif
+
+.PHONY: installer
+installer: $(INSTALLER)
+
+INSTDIR=/tmp/qemu-nsis
+
+$(INSTALLER): $(SRC_PATH)/qemu.nsi
+	make install prefix=${INSTDIR}
+ifdef SIGNCODE
+	(cd ${INSTDIR}; \
+         for i in *.exe; do \
+           $(SIGNCODE) $${i}; \
+         done \
+        )
+endif # SIGNCODE
+	(cd ${INSTDIR}; \
+         for i in qemu-system-*.exe; do \
+           arch=$${i%.exe}; \
+           arch=$${arch#qemu-system-}; \
+           echo Section \"$$arch\" Section_$$arch; \
+           echo SetOutPath \"\$$INSTDIR\"; \
+           echo File \"\$${BINDIR}\\$$i\"; \
+           echo SectionEnd; \
+         done \
+        ) >${INSTDIR}/system-emulations.nsh
+	makensis $(nsisflags) \
+                $(if $(BUILD_DOCS),-DCONFIG_DOCUMENTATION="y") \
+                $(if $(CONFIG_GTK),-DCONFIG_GTK="y") \
+                -DBINDIR="${INSTDIR}" \
+                $(if $(DLL_PATH),-DDLLDIR="$(DLL_PATH)") \
+                -DSRCDIR="$(SRC_PATH)" \
+                -DOUTFILE="$(INSTALLER)" \
+                $(SRC_PATH)/qemu.nsi
+	rm -r ${INSTDIR}
+ifdef SIGNCODE
+	$(SIGNCODE) $(INSTALLER)
+endif # SIGNCODE
+endif # CONFIG_WIN
+
 # Add a dependency on the generated files, so that they are always
 # rebuilt before other object files
 ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
diff --git a/pc-bios/qemu-nsis.bmp b/pc-bios/qemu-nsis.bmp
new file mode 100644
index 0000000..ae82cd2
Binary files /dev/null and b/pc-bios/qemu-nsis.bmp differ
diff --git a/pc-bios/qemu-nsis.ico b/pc-bios/qemu-nsis.ico
new file mode 100644
index 0000000..1d0128c
Binary files /dev/null and b/pc-bios/qemu-nsis.ico differ
diff --git a/qemu.nsi b/qemu.nsi
new file mode 100644
index 0000000..1d57455
--- /dev/null
+++ b/qemu.nsi
@@ -0,0 +1,250 @@
+;!/usr/bin/makensis
+
+; This NSIS script creates an installer for QEMU on Windows.
+
+; Copyright (C) 2006-2012 Stefan Weil
+;
+; This program is free software: you can redistribute it and/or modify
+; it under the terms of the GNU General Public License as published by
+; the Free Software Foundation, either version 2 of the License, or
+; (at your option) version 3 or any later version.
+;
+; This program is distributed in the hope that it will be useful,
+; but WITHOUT ANY WARRANTY; without even the implied warranty of
+; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+; GNU General Public License for more details.
+;
+; You should have received a copy of the GNU General Public License
+; along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+; NSIS_WIN32_MAKENSIS
+
+!define PRODUCT "QEMU"
+!define URL     "http://www.qemu.org/"
+
+!define UNINST_EXE "$INSTDIR\qemu-uninstall.exe"
+!define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\${PRODUCT}"
+
+!ifndef BINDIR
+!define BINDIR nsis.tmp
+!endif
+!ifndef SRCDIR
+!define SRCDIR .
+!endif
+!ifndef OUTFILE
+!define OUTFILE "qemu-setup.exe"
+!endif
+
+; Optionally install documentation.
+!ifndef CONFIG_DOCUMENTATION
+!define CONFIG_DOCUMENTATION
+!endif
+
+; Use maximum compression.
+SetCompressor /SOLID lzma
+
+!include "MUI2.nsh"
+
+; The name of the installer.
+Name "QEMU"
+
+; The file to write
+OutFile "${OUTFILE}"
+
+; The default installation directory.
+!ifdef W64
+InstallDir $PROGRAMFILES64\qemu
+!else
+InstallDir $PROGRAMFILES\qemu
+!endif
+
+; Registry key to check for directory (so if you install again, it will
+; overwrite the old one automatically)
+InstallDirRegKey HKLM "Software\qemu" "Install_Dir"
+
+; Request administrator privileges for Windows Vista.
+RequestExecutionLevel admin
+
+;--------------------------------
+; Interface Settings.
+;!define MUI_HEADERIMAGE "qemu-nsis.bmp"
+; !define MUI_SPECIALBITMAP "qemu.bmp"
+!define MUI_ICON "${SRCDIR}\pc-bios\qemu-nsis.ico"
+!define MUI_UNICON "${SRCDIR}\pc-bios\qemu-nsis.ico"
+!define MUI_WELCOMEFINISHPAGE_BITMAP "${SRCDIR}\pc-bios\qemu-nsis.bmp"
+; !define MUI_HEADERIMAGE_BITMAP "qemu-install.bmp"
+; !define MUI_HEADERIMAGE_UNBITMAP "qemu-uninstall.bmp"
+; !define MUI_COMPONENTSPAGE_SMALLDESC
+; !define MUI_WELCOMEPAGE_TEXT "Insert text here.$\r$\n$\r$\n$\r$\n$_CLICK"
+
+;--------------------------------
+; Pages.
+
+!insertmacro MUI_PAGE_WELCOME
+!insertmacro MUI_PAGE_LICENSE "${SRCDIR}\COPYING"
+!insertmacro MUI_PAGE_COMPONENTS
+!insertmacro MUI_PAGE_DIRECTORY
+!insertmacro MUI_PAGE_INSTFILES
+!define MUI_FINISHPAGE_LINK "Visit the QEMU Wiki online!"
+!define MUI_FINISHPAGE_LINK_LOCATION "${URL}"
+!insertmacro MUI_PAGE_FINISH
+
+!insertmacro MUI_UNPAGE_CONFIRM
+!insertmacro MUI_UNPAGE_INSTFILES
+
+;--------------------------------
+; Languages.
+
+!insertmacro MUI_LANGUAGE "English"
+!insertmacro MUI_LANGUAGE "French"
+!insertmacro MUI_LANGUAGE "German"
+
+;--------------------------------
+
+; The stuff to install.
+Section "${PRODUCT} (required)"
+
+    SectionIn RO
+
+    ; Set output path to the installation directory.
+    SetOutPath "$INSTDIR"
+
+    File "${SRCDIR}\Changelog"
+    File "${SRCDIR}\COPYING"
+    File "${SRCDIR}\COPYING.LIB"
+    File "${SRCDIR}\README"
+    File "${SRCDIR}\VERSION"
+
+    File "${BINDIR}\*.bmp"
+    File "${BINDIR}\*.bin"
+    File "${BINDIR}\*.dtb"
+    File "${BINDIR}\*.rom"
+    File "${BINDIR}\openbios-*"
+
+    File /r "${BINDIR}\keymaps"
+!ifdef CONFIG_GTK
+    File /r "${BINDIR}\share"
+!endif
+
+!ifdef W64
+    SetRegView 64
+!endif
+
+    ; Write the installation path into the registry
+    WriteRegStr HKLM SOFTWARE\${PRODUCT} "Install_Dir" "$INSTDIR"
+
+    ; Write the uninstall keys for Windows
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayName" "QEMU"
+    WriteRegStr HKLM "${UNINST_KEY}" "UninstallString" '"${UNINST_EXE}"'
+    WriteRegDWORD HKLM "${UNINST_KEY}" "NoModify" 1
+    WriteRegDWORD HKLM "${UNINST_KEY}" "NoRepair" 1
+    WriteUninstaller "qemu-uninstall.exe"
+SectionEnd
+
+Section "Tools" SectionTools
+    SetOutPath "$INSTDIR"
+    File "${BINDIR}\qemu-img.exe"
+    File "${BINDIR}\qemu-io.exe"
+SectionEnd
+
+SectionGroup "System Emulations" SectionSystem
+
+!include "${BINDIR}\system-emulations.nsh"
+
+SectionGroupEnd
+
+!ifdef DLLDIR
+Section "Libraries (DLL)" SectionDll
+    SetOutPath "$INSTDIR"
+    File "${DLLDIR}\*.dll"
+SectionEnd
+!endif
+
+!ifdef CONFIG_DOCUMENTATION
+Section "Documentation" SectionDoc
+    SetOutPath "$INSTDIR"
+    File "${BINDIR}\qemu-doc.html"
+    File "${BINDIR}\qemu-tech.html"
+    CreateDirectory "$SMPROGRAMS\${PRODUCT}"
+    CreateShortCut "$SMPROGRAMS\${PRODUCT}\User Documentation.lnk" "$INSTDIR\qemu-doc.html" "" "$INSTDIR\qemu-doc.html" 0
+    CreateShortCut "$SMPROGRAMS\${PRODUCT}\Technical Documentation.lnk" "$INSTDIR\qemu-tech.html" "" "$INSTDIR\qemu-tech.html" 0
+SectionEnd
+!endif
+
+; Optional section (can be disabled by the user)
+Section "Start Menu Shortcuts" SectionMenu
+    CreateDirectory "$SMPROGRAMS\${PRODUCT}"
+    CreateShortCut "$SMPROGRAMS\${PRODUCT}\Uninstall.lnk" "${UNINST_EXE}" "" "${UNINST_EXE}" 0
+SectionEnd
+
+;--------------------------------
+
+; Uninstaller
+
+Section "Uninstall"
+    ; Remove registry keys
+!ifdef W64
+    SetRegView 64
+!endif
+    DeleteRegKey HKLM "${UNINST_KEY}"
+    DeleteRegKey HKLM SOFTWARE\${PRODUCT}
+
+    ; Remove shortcuts, if any
+    Delete "$SMPROGRAMS\${PRODUCT}\User Documentation.lnk"
+    Delete "$SMPROGRAMS\${PRODUCT}\Technical Documentation.lnk"
+    Delete "$SMPROGRAMS\${PRODUCT}\Uninstall.lnk"
+    RMDir "$SMPROGRAMS\${PRODUCT}"
+
+    ; Remove files and directories used
+    Delete "$INSTDIR\Changelog"
+    Delete "$INSTDIR\COPYING"
+    Delete "$INSTDIR\COPYING.LIB"
+    Delete "$INSTDIR\README"
+    Delete "$INSTDIR\VERSION"
+    Delete "$INSTDIR\*.bmp"
+    Delete "$INSTDIR\*.bin"
+    Delete "$INSTDIR\*.dll"
+    Delete "$INSTDIR\*.dtb"
+    Delete "$INSTDIR\*.rom"
+    Delete "$INSTDIR\openbios-*"
+    Delete "$INSTDIR\qemu-img.exe"
+    Delete "$INSTDIR\qemu-io.exe"
+    Delete "$INSTDIR\qemu.exe"
+    Delete "$INSTDIR\qemu-system-*.exe"
+    Delete "$INSTDIR\qemu-doc.html"
+    Delete "$INSTDIR\qemu-tech.html"
+    RMDir /r "$INSTDIR\keymaps"
+    RMDir /r "$INSTDIR\share"
+    ; Remove generated files
+    Delete "$INSTDIR\stderr.txt"
+    Delete "$INSTDIR\stdout.txt"
+    ; Remove uninstaller
+    Delete "${UNINST_EXE}"
+    RMDir "$INSTDIR"
+SectionEnd
+
+;--------------------------------
+
+; Descriptions (mouse-over).
+!insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem}  "System emulation."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha}  "Alpha system emulation."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386}   "PC i386 system emulation."
+    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w}  "PC i386 system emulation (GUI)."
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."
+!ifdef DLLDIR
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionDll}   "Runtime Libraries (DLL)."
+!endif
+!ifdef CONFIG_DOCUMENTATION
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionDoc}   "Documentation."
+!endif
+    !insertmacro MUI_DESCRIPTION_TEXT ${SectionMenu}  "Menu entries."
+!insertmacro MUI_FUNCTION_DESCRIPTION_END
+
+;--------------------------------
+; Functions.
+
+Function .onInit
+    !insertmacro MUI_LANGDLL_DISPLAY
+FunctionEnd
commit 461bdb3414c40d6806194bf68c91521496b1042d
Merge: b6a9f46 6c86f40
Author: Aurelien Jarno <aurelien at aurel32.net>
Date:   Mon Jul 29 09:03:23 2013 +0200

    Merge branch 'trivial-patches' of git://git.corpit.ru/qemu
    
    * 'trivial-patches' of git://git.corpit.ru/qemu:
      target-mips: Remove assignment to a variable which is never used
      misc: Use g_assert_not_reached for code which is expected to be unreachable
      qemu-options: mention C-a h in the -nographic doc
      misc: Fix new typos in comments and strings
      linux-user: correct argument number for sys_mremap and sys_splice
      PPC: dbdma: macio: Fix format specifiers (build regression)
      watchdog: Remove break after exit
      exec: Remove env from list of poisoned names
      hw/9pfs: Fix potential memory leak and avoid reuse of freed memory
      timer: make timers_state static
      aes: Remove unused code (NDEBUG, u16)

commit b6a9f4682e62c686995cc1a1fe2ef4a57a92020b
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Mon Jul 29 04:06:12 2013 +0200

    target-mips: fix mipsdsp_mul_q31_q31
    
    Multiplication of two fractional word elements is not correct when sign
    extension/promotion is needed. This change fixes it by adding correct
    casts from unsigned to signed values.
    In addition, the tests (dpaq_sa_l_w.c and dpsq_sa_l_w.c) have been extended
    to trigger the current issue.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-mips/dsp_helper.c b/target-mips/dsp_helper.c
index 93f5d9e..b088a25 100644
--- a/target-mips/dsp_helper.c
+++ b/target-mips/dsp_helper.c
@@ -583,7 +583,7 @@ static inline int64_t mipsdsp_mul_q31_q31(int32_t ac, uint32_t a, uint32_t b,
         temp = (0x01ull << 63) - 1;
         set_DSPControl_overflow_flag(1, 16 + ac, env);
     } else {
-        temp = ((uint64_t)a * (uint64_t)b) << 1;
+        temp = ((int64_t)(int32_t)a * (int32_t)b) << 1;
     }
 
     return temp;
diff --git a/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c b/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c
index ce86484..cbf9007 100644
--- a/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c
+++ b/tests/tcg/mips/mips32-dsp/dpaq_sa_l_w.c
@@ -14,7 +14,7 @@ int main()
     resultdsp = 0x01;