[Qemu-devel] [PATCH 00/10] fix memory leak

[Qemu-devel] [PATCH 00/10] fix memory leak

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

This patch series are going to fix the memory leak caused by
qemu_allocate_irqs. Patch 1-5 convert the device to QOM and store
the irqs in DeviceState. Patch 6-10 use qemu_allocate_irq instead of
qemu_allocate_irqs.

Shannon Zhao (10):
  hw/ppc/ppc4xx_devs.c: Convert ppcuic to QOM
  include/hw/sparc/grlib.h: Store irqs in DeviceState
  hw/m68k/mcf5206.c: convert m5206_mbar to QOM
  hw/m68k/mcf_intc.c: convert mcf_intc to QOM
  hw/sh4/r2d.c: convert r2d_fpga to QOM
  hw/arm/palm.c: Fix misusing qemu_allocate_irqs
  hw/arm/spitz.c: Fix misusing qemu_allocate_irqs
  hw/arm/tosa.c: Fix misusing qemu_allocate_irqs
  hw/mips/mips_int.c: use qemu_allocate_irq to fix memory leak
  hw/openrisc/pic_cpu.c: use qemu_allocate_irq to fix memory leak

 hw/arm/palm.c            | 24 +++++++++------
 hw/arm/spitz.c           | 23 ++++++++------
 hw/arm/tosa.c            | 13 +++++---
 hw/m68k/an5206.c         |  2 +-
 hw/m68k/mcf5206.c        | 75 ++++++++++++++++++++++++++++++++++++---------
 hw/m68k/mcf5208.c        | 22 +++++++------
 hw/m68k/mcf_intc.c       | 69 +++++++++++++++++++++++++++++++++++------
 hw/mips/mips_int.c       |  5 ++-
 hw/net/mcf_fec.c         | 14 ++++++---
 hw/openrisc/pic_cpu.c    |  4 +--
 hw/ppc/ppc405.h          |  6 ++--
 hw/ppc/ppc405_boards.c   |  6 ++--
 hw/ppc/ppc405_uc.c       | 68 ++++++++++++++++++++--------------------
 hw/ppc/ppc440_bamboo.c   | 19 +++++++-----
 hw/ppc/ppc4xx_devs.c     | 55 ++++++++++++++++++++++++++++-----
 hw/sh4/r2d.c             | 80 ++++++++++++++++++++++++++++++++++++++----------
 hw/sparc/leon3.c         | 10 +++---
 include/hw/m68k/mcf.h    | 11 +++----
 include/hw/ppc/ppc4xx.h  |  4 +--
 include/hw/sparc/grlib.h | 12 +++-----
 20 files changed, 358 insertions(+), 164 deletions(-)

-- 
2.0.4

[Qemu-devel] [PATCH 01/10] hw/ppc/ppc4xx_devs.c: Convert ppcuic to QOM

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Convert ppcuic to QOM and this fixes the memory leak caused by
qemu_allocate_irqs.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/ppc/ppc405.h         |  6 ++---
 hw/ppc/ppc405_boards.c  |  6 ++---
 hw/ppc/ppc405_uc.c      | 68 +++++++++++++++++++++++++------------------------
 hw/ppc/ppc440_bamboo.c  | 19 ++++++++------
 hw/ppc/ppc4xx_devs.c    | 55 +++++++++++++++++++++++++++++++++------
 include/hw/ppc/ppc4xx.h |  4 +--
 6 files changed, 99 insertions(+), 59 deletions(-)

diff --git a/hw/ppc/ppc405.h b/hw/ppc/ppc405.h
index 1c5f04f..fcd303a 100644
--- a/hw/ppc/ppc405.h
+++ b/hw/ppc/ppc405.h
@@ -63,14 +63,12 @@ CPUPPCState *ppc405cr_init(MemoryRegion *address_space_mem,
                         MemoryRegion ram_memories[4],
                         hwaddr ram_bases[4],
                         hwaddr ram_sizes[4],
-                        uint32_t sysclk, qemu_irq **picp,
-                        int do_init);
+                        uint32_t sysclk, int do_init);
 CPUPPCState *ppc405ep_init(MemoryRegion *address_space_mem,
                         MemoryRegion ram_memories[2],
                         hwaddr ram_bases[2],
                         hwaddr ram_sizes[2],
-                        uint32_t sysclk, qemu_irq **picp,
-                        int do_init);
+                        uint32_t sysclk, int do_init);
 /* IBM STBxxx microcontrollers */
 CPUPPCState *ppc_stb025_init (MemoryRegion ram_memories[2],
                            hwaddr ram_bases[2],
diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
index ec6c4cb..2dc967f 100644
--- a/hw/ppc/ppc405_boards.c
+++ b/hw/ppc/ppc405_boards.c
@@ -182,7 +182,6 @@ static void ref405ep_init(MachineState *machine)
     char *filename;
     ppc4xx_bd_info_t bd;
     CPUPPCState *env;
-    qemu_irq *pic;
     MemoryRegion *bios;
     MemoryRegion *sram = g_new(MemoryRegion, 1);
     ram_addr_t bdloc;
@@ -212,7 +211,7 @@ static void ref405ep_init(MachineState *machine)
     printf("%s: register cpu\n", __func__);
 #endif
     env = ppc405ep_init(sysmem, ram_memories, ram_bases, ram_sizes,
-                        33333333, &pic, kernel_filename == NULL ? 0 : 1);
+                        33333333, kernel_filename == NULL ? 0 : 1);
     /* allocate SRAM */
     sram_size = 512 * 1024;
     memory_region_init_ram(sram, NULL, "ef405ep.sram", sram_size, &error_abort);
@@ -510,7 +509,6 @@ static void taihu_405ep_init(MachineState *machine)
     const char *kernel_filename = machine->kernel_filename;
     const char *initrd_filename = machine->initrd_filename;
     char *filename;
-    qemu_irq *pic;
     MemoryRegion *sysmem = get_system_memory();
     MemoryRegion *bios;
     MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
@@ -542,7 +540,7 @@ static void taihu_405ep_init(MachineState *machine)
     printf("%s: register cpu\n", __func__);
 #endif
     ppc405ep_init(sysmem, ram_memories, ram_bases, ram_sizes,
-                  33333333, &pic, kernel_filename == NULL ? 0 : 1);
+                  33333333, kernel_filename == NULL ? 0 : 1);
     /* allocate and load BIOS */
 #ifdef DEBUG_BOARD_INIT
     printf("%s: register BIOS\n", __func__);
diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
index c77434a..bc82058 100644
--- a/hw/ppc/ppc405_uc.c
+++ b/hw/ppc/ppc405_uc.c
@@ -2113,14 +2113,14 @@ CPUPPCState *ppc405cr_init(MemoryRegion *address_space_mem,
                         MemoryRegion ram_memories[4],
                         hwaddr ram_bases[4],
                         hwaddr ram_sizes[4],
-                        uint32_t sysclk, qemu_irq **picp,
-                        int do_init)
+                        uint32_t sysclk, int do_init)
 {
     clk_setup_t clk_setup[PPC405CR_CLK_NB];
     qemu_irq dma_irqs[4];
     PowerPCCPU *cpu;
     CPUPPCState *env;
-    qemu_irq *pic, *irqs;
+    qemu_irq *irqs;
+    DeviceState *pic;
 
     memset(clk_setup, 0, sizeof(clk_setup));
     cpu = ppc4xx_init("405cr", &clk_setup[PPC405CR_CPU_CLK],
@@ -2140,31 +2140,32 @@ CPUPPCState *ppc405cr_init(MemoryRegion *address_space_mem,
     irqs[PPCUIC_OUTPUT_CINT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
-    *picp = pic;
     /* SDRAM controller */
-    ppc4xx_sdram_init(env, pic[14], 1, ram_memories,
+    ppc4xx_sdram_init(env, qdev_get_gpio_in(pic, 14), 1, ram_memories,
                       ram_bases, ram_sizes, do_init);
     /* External bus controller */
     ppc405_ebc_init(env);
     /* DMA controller */
-    dma_irqs[0] = pic[26];
-    dma_irqs[1] = pic[25];
-    dma_irqs[2] = pic[24];
-    dma_irqs[3] = pic[23];
+    dma_irqs[0] = qdev_get_gpio_in(pic, 26);
+    dma_irqs[1] = qdev_get_gpio_in(pic, 25);
+    dma_irqs[2] = qdev_get_gpio_in(pic, 24);
+    dma_irqs[3] = qdev_get_gpio_in(pic, 23);
     ppc405_dma_init(env, dma_irqs);
     /* Serial ports */
     if (serial_hds[0] != NULL) {
-        serial_mm_init(address_space_mem, 0xef600300, 0, pic[0],
+        serial_mm_init(address_space_mem, 0xef600300, 0,
+                       qdev_get_gpio_in(pic, 0),
                        PPC_SERIAL_MM_BAUDBASE, serial_hds[0],
                        DEVICE_BIG_ENDIAN);
     }
     if (serial_hds[1] != NULL) {
-        serial_mm_init(address_space_mem, 0xef600400, 0, pic[1],
+        serial_mm_init(address_space_mem, 0xef600400, 0,
+                       qdev_get_gpio_in(pic, 1),
                        PPC_SERIAL_MM_BAUDBASE, serial_hds[1],
                        DEVICE_BIG_ENDIAN);
     }
     /* IIC controller */
-    ppc405_i2c_init(0xef600500, pic[2]);
+    ppc405_i2c_init(0xef600500, qdev_get_gpio_in(pic, 2));
     /* GPIO */
     ppc405_gpio_init(0xef600700);
     /* CPU control */
@@ -2464,14 +2465,14 @@ CPUPPCState *ppc405ep_init(MemoryRegion *address_space_mem,
                         MemoryRegion ram_memories[2],
                         hwaddr ram_bases[2],
                         hwaddr ram_sizes[2],
-                        uint32_t sysclk, qemu_irq **picp,
-                        int do_init)
+                        uint32_t sysclk, int do_init)
 {
     clk_setup_t clk_setup[PPC405EP_CLK_NB], tlb_clk_setup;
     qemu_irq dma_irqs[4], gpt_irqs[5], mal_irqs[4];
     PowerPCCPU *cpu;
     CPUPPCState *env;
-    qemu_irq *pic, *irqs;
+    qemu_irq *irqs;
+    DeviceState *pic;
 
     memset(clk_setup, 0, sizeof(clk_setup));
     /* init CPUs */
@@ -2497,50 +2498,51 @@ CPUPPCState *ppc405ep_init(MemoryRegion *address_space_mem,
     irqs[PPCUIC_OUTPUT_CINT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
-    *picp = pic;
     /* SDRAM controller */
 	/* XXX 405EP has no ECC interrupt */
-    ppc4xx_sdram_init(env, pic[17], 2, ram_memories,
+    ppc4xx_sdram_init(env, qdev_get_gpio_in(pic, 17), 2, ram_memories,
                       ram_bases, ram_sizes, do_init);
     /* External bus controller */
     ppc405_ebc_init(env);
     /* DMA controller */
-    dma_irqs[0] = pic[5];
-    dma_irqs[1] = pic[6];
-    dma_irqs[2] = pic[7];
-    dma_irqs[3] = pic[8];
+    dma_irqs[0] = qdev_get_gpio_in(pic, 5);
+    dma_irqs[1] = qdev_get_gpio_in(pic, 6);
+    dma_irqs[2] = qdev_get_gpio_in(pic, 7);
+    dma_irqs[3] = qdev_get_gpio_in(pic, 8);
     ppc405_dma_init(env, dma_irqs);
     /* IIC controller */
-    ppc405_i2c_init(0xef600500, pic[2]);
+    ppc405_i2c_init(0xef600500, qdev_get_gpio_in(pic, 2));
     /* GPIO */
     ppc405_gpio_init(0xef600700);
     /* Serial ports */
     if (serial_hds[0] != NULL) {
-        serial_mm_init(address_space_mem, 0xef600300, 0, pic[0],
+        serial_mm_init(address_space_mem, 0xef600300, 0,
+                       qdev_get_gpio_in(pic, 0),
                        PPC_SERIAL_MM_BAUDBASE, serial_hds[0],
                        DEVICE_BIG_ENDIAN);
     }
     if (serial_hds[1] != NULL) {
-        serial_mm_init(address_space_mem, 0xef600400, 0, pic[1],
+        serial_mm_init(address_space_mem, 0xef600400, 0,
+                       qdev_get_gpio_in(pic, 1),
                        PPC_SERIAL_MM_BAUDBASE, serial_hds[1],
                        DEVICE_BIG_ENDIAN);
     }
     /* OCM */
     ppc405_ocm_init(env);
     /* GPT */
-    gpt_irqs[0] = pic[19];
-    gpt_irqs[1] = pic[20];
-    gpt_irqs[2] = pic[21];
-    gpt_irqs[3] = pic[22];
-    gpt_irqs[4] = pic[23];
+    gpt_irqs[0] = qdev_get_gpio_in(pic, 19);
+    gpt_irqs[1] = qdev_get_gpio_in(pic, 20);
+    gpt_irqs[2] = qdev_get_gpio_in(pic, 21);
+    gpt_irqs[3] = qdev_get_gpio_in(pic, 22);
+    gpt_irqs[4] = qdev_get_gpio_in(pic, 23);
     ppc4xx_gpt_init(0xef600000, gpt_irqs);
     /* PCI */
     /* Uses pic[3], pic[16], pic[18] */
     /* MAL */
-    mal_irqs[0] = pic[11];
-    mal_irqs[1] = pic[12];
-    mal_irqs[2] = pic[13];
-    mal_irqs[3] = pic[14];
+    mal_irqs[0] = qdev_get_gpio_in(pic, 11);
+    mal_irqs[1] = qdev_get_gpio_in(pic, 12);
+    mal_irqs[2] = qdev_get_gpio_in(pic, 13);
+    mal_irqs[3] = qdev_get_gpio_in(pic, 14);
     ppc405_mal_init(env, mal_irqs);
     /* Ethernet */
     /* Uses pic[9], pic[15], pic[17] */
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index 778970a..2f02ca4 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -170,7 +170,6 @@ static void bamboo_init(MachineState *machine)
         = g_malloc(PPC440EP_SDRAM_NR_BANKS * sizeof(*ram_memories));
     hwaddr ram_bases[PPC440EP_SDRAM_NR_BANKS];
     hwaddr ram_sizes[PPC440EP_SDRAM_NR_BANKS];
-    qemu_irq *pic;
     qemu_irq *irqs;
     PCIBus *pcibus;
     PowerPCCPU *cpu;
@@ -179,7 +178,7 @@ static void bamboo_init(MachineState *machine)
     uint64_t elf_lowaddr;
     hwaddr loadaddr = 0;
     target_long initrd_size = 0;
-    DeviceState *dev;
+    DeviceState *dev, *pic;
     int success;
     int i;
 
@@ -212,14 +211,16 @@ static void bamboo_init(MachineState *machine)
                                    ram_bases, ram_sizes,
                                    ppc440ep_sdram_bank_sizes);
     /* XXX 440EP's ECC interrupts are on UIC1, but we've only created UIC0. */
-    ppc4xx_sdram_init(env, pic[14], PPC440EP_SDRAM_NR_BANKS, ram_memories,
-                      ram_bases, ram_sizes, 1);
+    ppc4xx_sdram_init(env, qdev_get_gpio_in(pic, 14), PPC440EP_SDRAM_NR_BANKS,
+                      ram_memories, ram_bases, ram_sizes, 1);
 
     /* PCI */
     dev = sysbus_create_varargs(TYPE_PPC4xx_PCI_HOST_BRIDGE,
                                 PPC440EP_PCI_CONFIG,
-                                pic[pci_irq_nrs[0]], pic[pci_irq_nrs[1]],
-                                pic[pci_irq_nrs[2]], pic[pci_irq_nrs[3]],
+                                qdev_get_gpio_in(pic, pci_irq_nrs[0]),
+                                qdev_get_gpio_in(pic, pci_irq_nrs[1]),
+                                qdev_get_gpio_in(pic, pci_irq_nrs[2]),
+                                qdev_get_gpio_in(pic, pci_irq_nrs[3]),
                                 NULL);
     pcibus = (PCIBus *)qdev_get_child_bus(dev, "pci.0");
     if (!pcibus) {
@@ -232,12 +233,14 @@ static void bamboo_init(MachineState *machine)
     memory_region_add_subregion(get_system_memory(), PPC440EP_PCI_IO, isa);
 
     if (serial_hds[0] != NULL) {
-        serial_mm_init(address_space_mem, 0xef600300, 0, pic[0],
+        serial_mm_init(address_space_mem, 0xef600300, 0,
+                       qdev_get_gpio_in(pic, 0),
                        PPC_SERIAL_MM_BAUDBASE, serial_hds[0],
                        DEVICE_BIG_ENDIAN);
     }
     if (serial_hds[1] != NULL) {
-        serial_mm_init(address_space_mem, 0xef600400, 0, pic[1],
+        serial_mm_init(address_space_mem, 0xef600400, 0,
+                       qdev_get_gpio_in(pic, 1),
                        PPC_SERIAL_MM_BAUDBASE, serial_hds[1],
                        DEVICE_BIG_ENDIAN);
     }
diff --git a/hw/ppc/ppc4xx_devs.c b/hw/ppc/ppc4xx_devs.c
index 2f38ff7..e874897 100644
--- a/hw/ppc/ppc4xx_devs.c
+++ b/hw/ppc/ppc4xx_devs.c
@@ -24,6 +24,7 @@
 #include "hw/hw.h"
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/ppc4xx.h"
+#include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "qemu/log.h"
 #include "exec/address-spaces.h"
@@ -90,8 +91,15 @@ enum {
 };
 
 #define UIC_MAX_IRQ 32
+
+#define TYPE_PPCUIC "ppcuic"
+#define PPCUIC(obj) \
+    OBJECT_CHECK(ppcuic_t, (obj), TYPE_PPCUIC)
+
 typedef struct ppcuic_t ppcuic_t;
 struct ppcuic_t {
+    SysBusDevice parent;
+
     uint32_t dcr_base;
     int use_vectors;
     uint32_t level;  /* Remembers the state of level-triggered interrupts. */
@@ -281,11 +289,10 @@ static void dcr_write_uic (void *opaque, int dcrn, uint32_t val)
     }
 }
 
-static void ppcuic_reset (void *opaque)
+static void ppcuic_reset(DeviceState *dev)
 {
-    ppcuic_t *uic;
+    ppcuic_t *uic = PPCUIC(dev);
 
-    uic = opaque;
     uic->uiccr = 0x00000000;
     uic->uicer = 0x00000000;
     uic->uicpr = 0x00000000;
@@ -297,13 +304,46 @@ static void ppcuic_reset (void *opaque)
     }
 }
 
-qemu_irq *ppcuic_init (CPUPPCState *env, qemu_irq *irqs,
-                       uint32_t dcr_base, int has_ssr, int has_vr)
+static void ppcuic_initfn(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+
+    qdev_init_gpio_in(dev, ppcuic_set_irq, UIC_MAX_IRQ);
+}
+
+static void ppcuic_class_init(ObjectClass *klass, void *class_data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = ppcuic_reset;
+}
+
+static const TypeInfo ppcuic_info = {
+    .name = TYPE_PPCUIC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(ppcuic_t),
+    .instance_init = ppcuic_initfn,
+    .class_init = ppcuic_class_init,
+};
+
+static void ppcuic_register_types(void)
+{
+    type_register_static(&ppcuic_info);
+}
+
+type_init(ppcuic_register_types);
+
+DeviceState *ppcuic_init(CPUPPCState *env, qemu_irq *irqs,
+                         uint32_t dcr_base, int has_ssr, int has_vr)
 {
+    DeviceState *dev;
     ppcuic_t *uic;
     int i;
 
-    uic = g_malloc0(sizeof(ppcuic_t));
+    dev = qdev_create(NULL, TYPE_PPCUIC);
+    qdev_init_nofail(dev);
+
+    uic = PPCUIC(dev);
     uic->dcr_base = dcr_base;
     uic->irqs = irqs;
     if (has_vr)
@@ -312,9 +352,8 @@ qemu_irq *ppcuic_init (CPUPPCState *env, qemu_irq *irqs,
         ppc_dcr_register(env, dcr_base + i, uic,
                          &dcr_read_uic, &dcr_write_uic);
     }
-    qemu_register_reset(ppcuic_reset, uic);
 
-    return qemu_allocate_irqs(&ppcuic_set_irq, uic, UIC_MAX_IRQ);
+    return dev;
 }
 
 /*****************************************************************************/
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index 91d84ba..4ec8096 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -38,8 +38,8 @@ enum {
     PPCUIC_OUTPUT_CINT = 1,
     PPCUIC_OUTPUT_NB,
 };
-qemu_irq *ppcuic_init (CPUPPCState *env, qemu_irq *irqs,
-                       uint32_t dcr_base, int has_ssr, int has_vr);
+DeviceState *ppcuic_init(CPUPPCState *env, qemu_irq *irqs,
+                         uint32_t dcr_base, int has_ssr, int has_vr);
 
 ram_addr_t ppc4xx_sdram_adjust(ram_addr_t ram_size, int nr_banks,
                                MemoryRegion ram_memories[],
-- 
2.0.4

[Qemu-devel] [PATCH 02/10] include/hw/sparc/grlib.h: Store irqs in DeviceState

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Use qdev_init_gpio_in to allocate irqs instead of qemu_allocate_irqs.
This will store the irqs in DeviceState and use qdev_get_gpio_in to get
the irq.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/sparc/leon3.c         | 10 ++++++----
 include/hw/sparc/grlib.h | 12 ++++--------
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index 7f5dcd6..60a574a 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -113,7 +113,7 @@ static void leon3_generic_hw_init(MachineState *machine)
     MemoryRegion *prom = g_new(MemoryRegion, 1);
     int         ret;
     char       *filename;
-    qemu_irq   *cpu_irqs = NULL;
+    DeviceState *grlib_irqmp;
     int         bios_size;
     int         prom_size;
     ResetData  *reset_info;
@@ -139,7 +139,8 @@ static void leon3_generic_hw_init(MachineState *machine)
     qemu_register_reset(main_cpu_reset, reset_info);
 
     /* Allocate IRQ manager */
-    grlib_irqmp_create(0x80000200, env, &cpu_irqs, MAX_PILS, &leon3_set_pil_in);
+    grlib_irqmp = grlib_irqmp_create(0x80000200, env, MAX_PILS,
+                                     &leon3_set_pil_in);
 
     env->qemu_irq_ack = leon3_irq_manager;
 
@@ -208,11 +209,12 @@ static void leon3_generic_hw_init(MachineState *machine)
     }
 
     /* Allocate timers */
-    grlib_gptimer_create(0x80000300, 2, CPU_CLK, cpu_irqs, 6);
+    grlib_gptimer_create(0x80000300, 2, CPU_CLK, grlib_irqmp, 6);
 
     /* Allocate uart */
     if (serial_hds[0]) {
-        grlib_apbuart_create(0x80000100, serial_hds[0], cpu_irqs[3]);
+        grlib_apbuart_create(0x80000100, serial_hds[0],
+                             qdev_get_gpio_in(grlib_irqmp, 3));
     }
 }
 
diff --git a/include/hw/sparc/grlib.h b/include/hw/sparc/grlib.h
index 9a0db7b..05c2ea8 100644
--- a/include/hw/sparc/grlib.h
+++ b/include/hw/sparc/grlib.h
@@ -43,14 +43,11 @@ void grlib_irqmp_ack(DeviceState *dev, int intno);
 static inline
 DeviceState *grlib_irqmp_create(hwaddr   base,
                                 CPUSPARCState            *env,
-                                qemu_irq           **cpu_irqs,
                                 uint32_t             nr_irqs,
                                 set_pil_in_fn        set_pil_in)
 {
     DeviceState *dev;
 
-    assert(cpu_irqs != NULL);
-
     dev = qdev_create(NULL, "grlib,irqmp");
     qdev_prop_set_ptr(dev, "set_pil_in", set_pil_in);
     qdev_prop_set_ptr(dev, "set_pil_in_opaque", env);
@@ -61,9 +58,7 @@ DeviceState *grlib_irqmp_create(hwaddr   base,
 
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 
-    *cpu_irqs = qemu_allocate_irqs(grlib_irqmp_set_irq,
-                                   dev,
-                                   nr_irqs);
+    qdev_init_gpio_in(dev, grlib_irqmp_set_irq, nr_irqs);
 
     return dev;
 }
@@ -74,7 +69,7 @@ static inline
 DeviceState *grlib_gptimer_create(hwaddr  base,
                                   uint32_t            nr_timers,
                                   uint32_t            freq,
-                                  qemu_irq           *cpu_irqs,
+                                  DeviceState        *grlib_irqmp,
                                   int                 base_irq)
 {
     DeviceState *dev;
@@ -90,7 +85,8 @@ DeviceState *grlib_gptimer_create(hwaddr  base,
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 
     for (i = 0; i < nr_timers; i++) {
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, cpu_irqs[base_irq + i]);
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
+                           qdev_get_gpio_in(grlib_irqmp, base_irq + i));
     }
 
     return dev;
-- 
2.0.4

[Qemu-devel] [PATCH 03/10] hw/m68k/mcf5206.c: convert m5206_mbar to QOM

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Convert m5206_mbar to QOM and this fixes the memory leak caused by
qemu_allocate_irqs.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/m68k/an5206.c      |  2 +-
 hw/m68k/mcf5206.c     | 75 +++++++++++++++++++++++++++++++++++++++++----------
 include/hw/m68k/mcf.h |  3 +--
 3 files changed, 63 insertions(+), 17 deletions(-)

diff --git a/hw/m68k/an5206.c b/hw/m68k/an5206.c
index f63ab2b..6ca2d44 100644
--- a/hw/m68k/an5206.c
+++ b/hw/m68k/an5206.c
@@ -58,7 +58,7 @@ static void an5206_init(MachineState *machine)
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, AN5206_RAMBAR_ADDR, sram);
 
-    mcf5206_init(address_space_mem, AN5206_MBAR_ADDR, cpu);
+    mcf5206_init(address_space_mem, AN5206_MBAR_ADDR);
 
     /* Load kernel.  */
     if (!kernel_filename) {
diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
index 1727a46..cb9cf59 100644
--- a/hw/m68k/mcf5206.c
+++ b/hw/m68k/mcf5206.c
@@ -7,6 +7,7 @@
  */
 #include "hw/hw.h"
 #include "hw/m68k/mcf.h"
+#include "hw/sysbus.h"
 #include "qemu/timer.h"
 #include "hw/ptimer.h"
 #include "sysemu/sysemu.h"
@@ -142,9 +143,15 @@ static m5206_timer_state *m5206_timer_init(qemu_irq irq)
     return s;
 }
 
+#define TYPE_M5206_MBAR "m5206_mbar"
+#define M5206_MBAR(obj) \
+    OBJECT_CHECK(m5206_mbar_state, (obj), TYPE_M5206_MBAR)
+
 /* System Integration Module.  */
 
 typedef struct {
+    SysBusDevice parent;
+
     M68kCPU *cpu;
     MemoryRegion iomem;
     m5206_timer_state *timer[2];
@@ -242,8 +249,10 @@ static void m5206_mbar_set_irq(void *opaque, int irq, int level)
 
 /* System Integration Module.  */
 
-static void m5206_mbar_reset(m5206_mbar_state *s)
+static void m5206_mbar_reset(DeviceState *dev)
 {
+    m5206_mbar_state *s = M5206_MBAR(dev);
+
     s->scr = 0xc0;
     s->icr[1] = 0x04;
     s->icr[2] = 0x08;
@@ -525,24 +534,62 @@ static const MemoryRegionOps m5206_mbar_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-qemu_irq *mcf5206_init(MemoryRegion *sysmem, uint32_t base, M68kCPU *cpu)
+static void m5206_mbar_initfn(Object *obj)
 {
-    m5206_mbar_state *s;
-    qemu_irq *pic;
+    DeviceState *dev = DEVICE(obj);
+    m5206_mbar_state *s = M5206_MBAR(obj);
+    SysBusDevice *sysbus = SYS_BUS_DEVICE(obj);
+
+    qdev_init_gpio_in(dev, m5206_mbar_set_irq, 14);
+    sysbus_init_mmio(sysbus, &s->iomem);
+}
 
-    s = (m5206_mbar_state *)g_malloc0(sizeof(m5206_mbar_state));
+static void m5206_mbar_realize(DeviceState *dev, Error **errp)
+{
+    m5206_mbar_state *s = M5206_MBAR(dev);
 
     memory_region_init_io(&s->iomem, NULL, &m5206_mbar_ops, s,
                           "mbar", 0x00001000);
-    memory_region_add_subregion(sysmem, base, &s->iomem);
 
-    pic = qemu_allocate_irqs(m5206_mbar_set_irq, s, 14);
-    s->timer[0] = m5206_timer_init(pic[9]);
-    s->timer[1] = m5206_timer_init(pic[10]);
-    s->uart[0] = mcf_uart_init(pic[12], serial_hds[0]);
-    s->uart[1] = mcf_uart_init(pic[13], serial_hds[1]);
-    s->cpu = cpu;
+    s->timer[0] = m5206_timer_init(qdev_get_gpio_in(dev, 9));
+    s->timer[1] = m5206_timer_init(qdev_get_gpio_in(dev, 10));
+    s->uart[0] = mcf_uart_init(qdev_get_gpio_in(dev, 12), serial_hds[0]);
+    s->uart[1] = mcf_uart_init(qdev_get_gpio_in(dev, 13), serial_hds[1]);
+    s->cpu = M68K_CPU(first_cpu);
+}
+
+static void m5206_mbar_class_init(ObjectClass *klass, void *class_data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = m5206_mbar_realize;
+    dc->reset = m5206_mbar_reset;
+}
+
+static const TypeInfo m5206_mbar_info = {
+    .name = TYPE_M5206_MBAR,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(m5206_mbar_state),
+    .instance_init = m5206_mbar_initfn,
+    .class_init = m5206_mbar_class_init,
+};
+
+static void m5206_mbar_register_types(void)
+{
+    type_register_static(&m5206_mbar_info);
+}
+
+type_init(m5206_mbar_register_types);
+
+void mcf5206_init(MemoryRegion *sysmem, uint32_t base)
+{
+    DeviceState *dev;
+    SysBusDevice *sysbus;
+
+    dev = qdev_create(NULL, TYPE_M5206_MBAR);
+    qdev_init_nofail(dev);
 
-    m5206_mbar_reset(s);
-    return pic;
+    sysbus = SYS_BUS_DEVICE(dev);
+    memory_region_add_subregion(sysmem, base,
+                                sysbus_mmio_get_region(sysbus, 0));
 }
diff --git a/include/hw/m68k/mcf.h b/include/hw/m68k/mcf.h
index fbc8dc2..a64f4ad 100644
--- a/include/hw/m68k/mcf.h
+++ b/include/hw/m68k/mcf.h
@@ -24,7 +24,6 @@ void mcf_fec_init(struct MemoryRegion *sysmem, NICInfo *nd,
                   hwaddr base, qemu_irq *irq);
 
 /* mcf5206.c */
-qemu_irq *mcf5206_init(struct MemoryRegion *sysmem,
-                       uint32_t base, M68kCPU *cpu);
+void mcf5206_init(struct MemoryRegion *sysmem, uint32_t base);
 
 #endif
-- 
2.0.4

[Qemu-devel] [PATCH 04/10] hw/m68k/mcf_intc.c: convert mcf_intc to QOM

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Convert mcf_intc to QOM and this fixes the memory leak caused by
qemu_allocate_irqs.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/m68k/mcf5208.c     | 22 ++++++++--------
 hw/m68k/mcf_intc.c    | 69 +++++++++++++++++++++++++++++++++++++++++++--------
 hw/net/mcf_fec.c      | 14 +++++++----
 include/hw/m68k/mcf.h |  8 +++---
 4 files changed, 83 insertions(+), 30 deletions(-)

diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index 326a42d..697f154 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -165,7 +165,7 @@ static const MemoryRegionOps m5208_sys_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
+static void mcf5208_sys_init(MemoryRegion *address_space, DeviceState *dev)
 {
     MemoryRegion *iomem = g_new(MemoryRegion, 1);
     m5208_timer_state *s;
@@ -184,7 +184,7 @@ static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
                               "m5208-timer", 0x00004000);
         memory_region_add_subregion(address_space, 0xfc080000 + 0x4000 * i,
                                     &s->iomem);
-        s->irq = pic[4 + i];
+        s->irq = qdev_get_gpio_in(dev, 4 + i);
     }
 }
 
@@ -198,7 +198,7 @@ static void mcf5208evb_init(MachineState *machine)
     int kernel_size;
     uint64_t elf_entry;
     hwaddr entry;
-    qemu_irq *pic;
+    DeviceState *dev;
     MemoryRegion *address_space_mem = get_system_memory();
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *sram = g_new(MemoryRegion, 1);
@@ -227,21 +227,23 @@ static void mcf5208evb_init(MachineState *machine)
     memory_region_add_subregion(address_space_mem, 0x80000000, sram);
 
     /* Internal peripherals.  */
-    pic = mcf_intc_init(address_space_mem, 0xfc048000, cpu);
+    dev = mcf_intc_init(address_space_mem, 0xfc048000);
 
-    mcf_uart_mm_init(address_space_mem, 0xfc060000, pic[26], serial_hds[0]);
-    mcf_uart_mm_init(address_space_mem, 0xfc064000, pic[27], serial_hds[1]);
-    mcf_uart_mm_init(address_space_mem, 0xfc068000, pic[28], serial_hds[2]);
+    mcf_uart_mm_init(address_space_mem, 0xfc060000, qdev_get_gpio_in(dev, 26),
+                     serial_hds[0]);
+    mcf_uart_mm_init(address_space_mem, 0xfc064000, qdev_get_gpio_in(dev, 27),
+                     serial_hds[1]);
+    mcf_uart_mm_init(address_space_mem, 0xfc068000, qdev_get_gpio_in(dev, 28),
+                     serial_hds[2]);
 
-    mcf5208_sys_init(address_space_mem, pic);
+    mcf5208_sys_init(address_space_mem, dev);
 
     if (nb_nics > 1) {
         fprintf(stderr, "Too many NICs\n");
         exit(1);
     }
     if (nd_table[0].used)
-        mcf_fec_init(address_space_mem, &nd_table[0],
-                     0xfc030000, pic + 36);
+        mcf_fec_init(address_space_mem, &nd_table[0], 0xfc030000, dev, 36);
 
     /*  0xfc000000 SCM.  */
     /*  0xfc004000 XBS.  */
diff --git a/hw/m68k/mcf_intc.c b/hw/m68k/mcf_intc.c
index f13c7f3..4cbc8e5 100644
--- a/hw/m68k/mcf_intc.c
+++ b/hw/m68k/mcf_intc.c
@@ -7,9 +7,16 @@
  */
 #include "hw/hw.h"
 #include "hw/m68k/mcf.h"
+#include "hw/sysbus.h"
 #include "exec/address-spaces.h"
 
+#define TYPE_MCF_INTC "mcf_intc"
+#define MCF_INTC(obj) \
+    OBJECT_CHECK(mcf_intc_state, (obj), TYPE_MCF_INTC)
+
 typedef struct {
+    SysBusDevice parent;
+
     MemoryRegion iomem;
     uint64_t ipr;
     uint64_t imr;
@@ -135,8 +142,10 @@ static void mcf_intc_set_irq(void *opaque, int irq, int level)
     mcf_intc_update(s);
 }
 
-static void mcf_intc_reset(mcf_intc_state *s)
+static void mcf_intc_reset(DeviceState *dev)
 {
+    mcf_intc_state *s = MCF_INTC(dev);
+
     s->imr = ~0ull;
     s->ipr = 0;
     s->ifr = 0;
@@ -151,18 +160,58 @@ static const MemoryRegionOps mcf_intc_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-qemu_irq *mcf_intc_init(MemoryRegion *sysmem,
-                        hwaddr base,
-                        M68kCPU *cpu)
+static void mcf_intc_initfn(Object *obj)
 {
-    mcf_intc_state *s;
+    DeviceState *dev = DEVICE(obj);
+    mcf_intc_state *s = MCF_INTC(obj);
+    SysBusDevice *sysbus = SYS_BUS_DEVICE(obj);
 
-    s = g_malloc0(sizeof(mcf_intc_state));
-    s->cpu = cpu;
-    mcf_intc_reset(s);
+    qdev_init_gpio_in(dev, mcf_intc_set_irq, 64);
+    sysbus_init_mmio(sysbus, &s->iomem);
+}
+
+static void mcf_intc_realize(DeviceState *dev, Error **errp)
+{
+    mcf_intc_state *s = MCF_INTC(dev);
 
     memory_region_init_io(&s->iomem, NULL, &mcf_intc_ops, s, "mcf", 0x100);
-    memory_region_add_subregion(sysmem, base, &s->iomem);
+    s->cpu = M68K_CPU(first_cpu);
+}
+
+static void mcf_intc_class_init(ObjectClass *klass, void *class_data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = mcf_intc_realize;
+    dc->reset = mcf_intc_reset;
+}
+
+static const TypeInfo mcf_intc_info = {
+    .name = TYPE_MCF_INTC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(mcf_intc_state),
+    .instance_init = mcf_intc_initfn,
+    .class_init = mcf_intc_class_init,
+};
+
+static void mcf_intc_register_types(void)
+{
+    type_register_static(&mcf_intc_info);
+}
+
+type_init(mcf_intc_register_types);
+
+DeviceState *mcf_intc_init(MemoryRegion *sysmem, hwaddr base)
+{
+    DeviceState *dev;
+    SysBusDevice *sysbus;
+
+    dev = qdev_create(NULL, TYPE_MCF_INTC);
+    qdev_init_nofail(dev);
+
+    sysbus = SYS_BUS_DEVICE(dev);
+    memory_region_add_subregion(sysmem, base,
+                                sysbus_mmio_get_region(sysbus, 0));
 
-    return qemu_allocate_irqs(mcf_intc_set_irq, s, 64);
+    return dev;
 }
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
index 0255612..0003f84 100644
--- a/hw/net/mcf_fec.c
+++ b/hw/net/mcf_fec.c
@@ -22,11 +22,12 @@ do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
 #endif
 
 #define FEC_MAX_FRAME_SIZE 2032
+#define FEC_NUM_IRQ 13
 
 typedef struct {
     MemoryRegion *sysmem;
     MemoryRegion iomem;
-    qemu_irq *irq;
+    qemu_irq irq[FEC_NUM_IRQ];
     NICState *nic;
     NICConf conf;
     uint32_t irq_state;
@@ -65,7 +66,6 @@ typedef struct {
 #define FEC_RESET   1
 
 /* Map interrupt flags onto IRQ lines.  */
-#define FEC_NUM_IRQ 13
 static const uint32_t mcf_fec_irq_map[FEC_NUM_IRQ] = {
     FEC_INT_TXF,
     FEC_INT_TXB,
@@ -446,16 +446,20 @@ static NetClientInfo net_mcf_fec_info = {
     .receive = mcf_fec_receive,
 };
 
-void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd,
-                  hwaddr base, qemu_irq *irq)
+void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd, hwaddr base,
+                  DeviceState *dev, int irq_start)
 {
     mcf_fec_state *s;
+    int i;
 
     qemu_check_nic_model(nd, "mcf_fec");
 
     s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state));
     s->sysmem = sysmem;
-    s->irq = irq;
+
+    for (i = 0; i < FEC_NUM_IRQ; i++) {
+        s->irq[i] = qdev_get_gpio_in(dev, irq_start + i);
+    }
 
     memory_region_init_io(&s->iomem, NULL, &mcf_fec_ops, s, "fec", 0x400);
     memory_region_add_subregion(sysmem, base, &s->iomem);
diff --git a/include/hw/m68k/mcf.h b/include/hw/m68k/mcf.h
index a64f4ad..05add1d 100644
--- a/include/hw/m68k/mcf.h
+++ b/include/hw/m68k/mcf.h
@@ -15,13 +15,11 @@ void mcf_uart_mm_init(struct MemoryRegion *sysmem,
                       qemu_irq irq, CharDriverState *chr);
 
 /* mcf_intc.c */
-qemu_irq *mcf_intc_init(struct MemoryRegion *sysmem,
-                        hwaddr base,
-                        M68kCPU *cpu);
+DeviceState *mcf_intc_init(struct MemoryRegion *sysmem, hwaddr base);
 
 /* mcf_fec.c */
-void mcf_fec_init(struct MemoryRegion *sysmem, NICInfo *nd,
-                  hwaddr base, qemu_irq *irq);
+void mcf_fec_init(struct MemoryRegion *sysmem, NICInfo *nd, hwaddr base,
+                  DeviceState *dev, int irq_start);
 
 /* mcf5206.c */
 void mcf5206_init(struct MemoryRegion *sysmem, uint32_t base);
-- 
2.0.4

[Qemu-devel] [PATCH 05/10] hw/sh4/r2d.c: convert r2d_fpga to QOM

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Convert r2d_fpga to QOM and this fixes the memory leak caused by
qemu_allocate_irqs.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/sh4/r2d.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 64 insertions(+), 16 deletions(-)

diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 5e22ed7..b1bfad9 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -57,7 +57,13 @@
 #define PA_VERREG	0x32
 #define PA_OUTPORT	0x36
 
+#define TYPE_R2D_FPGA "r2d_fpga"
+#define R2D_FPGA(obj) \
+    OBJECT_CHECK(r2d_fpga_t, (obj), TYPE_R2D_FPGA)
+
 typedef struct {
+    SysBusDevice parent;
+
     uint16_t bcr;
     uint16_t irlmsk;
     uint16_t irlmon;
@@ -177,18 +183,61 @@ static const MemoryRegionOps r2d_fpga_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static qemu_irq *r2d_fpga_init(MemoryRegion *sysmem,
-                               hwaddr base, qemu_irq irl)
+static void r2d_fpga_initfn(Object *obj)
 {
-    r2d_fpga_t *s;
+    DeviceState *dev = DEVICE(obj);
+    r2d_fpga_t *s = R2D_FPGA(obj);
+    SysBusDevice *sysbus = SYS_BUS_DEVICE(obj);
 
-    s = g_malloc0(sizeof(r2d_fpga_t));
+    qdev_init_gpio_in(dev, r2d_fpga_irq_set, NR_IRQS);
+    sysbus_init_irq(sysbus, &s->irl);
+    sysbus_init_mmio(sysbus, &s->iomem);
+}
 
-    s->irl = irl;
+static void r2d_fpga_realize(DeviceState *dev, Error **errp)
+{
+    r2d_fpga_t *s = R2D_FPGA(dev);
 
     memory_region_init_io(&s->iomem, NULL, &r2d_fpga_ops, s, "r2d-fpga", 0x40);
-    memory_region_add_subregion(sysmem, base, &s->iomem);
-    return qemu_allocate_irqs(r2d_fpga_irq_set, s, NR_IRQS);
+}
+
+static void r2d_fpga_class_init(ObjectClass *klass, void *class_data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = r2d_fpga_realize;
+}
+
+static const TypeInfo r2d_fpga_info = {
+    .name = TYPE_R2D_FPGA,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(r2d_fpga_t),
+    .instance_init = r2d_fpga_initfn,
+    .class_init = r2d_fpga_class_init,
+};
+
+static void r2d_fpga_register_types(void)
+{
+    type_register_static(&r2d_fpga_info);
+}
+
+type_init(r2d_fpga_register_types);
+
+static DeviceState *r2d_fpga_init(MemoryRegion *sysmem,
+                                  hwaddr base, qemu_irq irl)
+{
+    DeviceState *dev;
+    SysBusDevice *sysbus;
+
+    dev = qdev_create(NULL, TYPE_R2D_FPGA);
+    qdev_init_nofail(dev);
+
+    sysbus = SYS_BUS_DEVICE(dev);
+    sysbus_connect_irq(sysbus, 0, irl);
+    memory_region_add_subregion(sysmem, base,
+                                sysbus_mmio_get_region(sysbus, 0));
+
+    return dev;
 }
 
 typedef struct ResetData {
@@ -230,10 +279,9 @@ static void r2d_init(MachineState *machine)
     ResetData *reset_info;
     struct SH7750State *s;
     MemoryRegion *sdram = g_new(MemoryRegion, 1);
-    qemu_irq *irq;
     DriveInfo *dinfo;
     int i;
-    DeviceState *dev;
+    DeviceState *dev, *r2d_fpga;
     SysBusDevice *busdev;
     MemoryRegion *address_space_mem = get_system_memory();
     PCIBus *pci_bus;
@@ -260,7 +308,7 @@ static void r2d_init(MachineState *machine)
     memory_region_add_subregion(address_space_mem, SDRAM_BASE, sdram);
     /* Register peripherals */
     s = sh7750_init(cpu, address_space_mem);
-    irq = r2d_fpga_init(address_space_mem, 0x04000000, sh7750_irl(s));
+    r2d_fpga = r2d_fpga_init(address_space_mem, 0x04000000, sh7750_irl(s));
 
     dev = qdev_create(NULL, "sh_pci");
     busdev = SYS_BUS_DEVICE(dev);
@@ -268,19 +316,19 @@ static void r2d_init(MachineState *machine)
     pci_bus = PCI_BUS(qdev_get_child_bus(dev, "pci"));
     sysbus_mmio_map(busdev, 0, P4ADDR(0x1e200000));
     sysbus_mmio_map(busdev, 1, A7ADDR(0x1e200000));
-    sysbus_connect_irq(busdev, 0, irq[PCI_INTA]);
-    sysbus_connect_irq(busdev, 1, irq[PCI_INTB]);
-    sysbus_connect_irq(busdev, 2, irq[PCI_INTC]);
-    sysbus_connect_irq(busdev, 3, irq[PCI_INTD]);
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(r2d_fpga, PCI_INTA));
+    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(r2d_fpga, PCI_INTB));
+    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(r2d_fpga, PCI_INTC));
+    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(r2d_fpga, PCI_INTD));
 
     sm501_init(address_space_mem, 0x10000000, SM501_VRAM_SIZE,
-               irq[SM501], serial_hds[2]);
+               qdev_get_gpio_in(r2d_fpga, SM501), serial_hds[2]);
 
     /* onboard CF (True IDE mode, Master only). */
     dinfo = drive_get(IF_IDE, 0, 0);
     dev = qdev_create(NULL, "mmio-ide");
     busdev = SYS_BUS_DEVICE(dev);
-    sysbus_connect_irq(busdev, 0, irq[CF_IDE]);
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(r2d_fpga, CF_IDE));
     qdev_prop_set_uint32(dev, "shift", 1);
     qdev_init_nofail(dev);
     sysbus_mmio_map(busdev, 0, 0x14001000);
-- 
2.0.4

[Qemu-devel] [PATCH 06/10] hw/arm/palm.c: Fix misusing qemu_allocate_irqs

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Use qemu_allocate_irq instead of qemu_allocate_irqs to fix memory leak.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/arm/palm.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index 7f1cfb8..f73c8a2 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -158,21 +158,25 @@ static void palmte_onoff_gpios(void *opaque, int line, int level)
 
 static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
 {
-    qemu_irq *misc_gpio;
-
     omap_mmc_handlers(cpu->mmc,
                     qdev_get_gpio_in(cpu->gpio, PALMTE_MMC_WP_GPIO),
                     qemu_irq_invert(omap_mpuio_in_get(cpu->mpuio)
                             [PALMTE_MMC_SWITCH_GPIO]));
 
-    misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
-    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,	misc_gpio[0]);
-    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,	misc_gpio[1]);
-    qdev_connect_gpio_out(cpu->gpio, 11,			misc_gpio[2]);
-    qdev_connect_gpio_out(cpu->gpio, 12,			misc_gpio[3]);
-    qdev_connect_gpio_out(cpu->gpio, 13,			misc_gpio[4]);
-    omap_mpuio_out_set(cpu->mpuio, 1,				misc_gpio[5]);
-    omap_mpuio_out_set(cpu->mpuio, 3,				misc_gpio[6]);
+    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,
+                          qemu_allocate_irq(palmte_onoff_gpios, cpu, 0));
+    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,
+                          qemu_allocate_irq(palmte_onoff_gpios, cpu, 1));
+    qdev_connect_gpio_out(cpu->gpio, 11,
+                          qemu_allocate_irq(palmte_onoff_gpios, cpu, 2));
+    qdev_connect_gpio_out(cpu->gpio, 12,
+                          qemu_allocate_irq(palmte_onoff_gpios, cpu, 3));
+    qdev_connect_gpio_out(cpu->gpio, 13,
+                          qemu_allocate_irq(palmte_onoff_gpios, cpu, 4));
+    omap_mpuio_out_set(cpu->mpuio, 1,
+                       qemu_allocate_irq(palmte_onoff_gpios, cpu, 5));
+    omap_mpuio_out_set(cpu->mpuio, 3,
+                       qemu_allocate_irq(palmte_onoff_gpios, cpu, 6));
 
     /* Reset some inputs to initial state.  */
     qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
-- 
2.0.4

[Qemu-devel] [PATCH 07/10] hw/arm/spitz.c: Fix misusing qemu_allocate_irqs

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Use qemu_allocate_irq instead of qemu_allocate_irqs to fix memory leak.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/arm/spitz.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index 5bf032a..d51180a 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -815,19 +815,24 @@ static void spitz_out_switch(void *opaque, int line, int level)
 static void spitz_scoop_gpio_setup(PXA2xxState *cpu,
                 DeviceState *scp0, DeviceState *scp1)
 {
-    qemu_irq *outsignals = qemu_allocate_irqs(spitz_out_switch, cpu, 8);
-
-    qdev_connect_gpio_out(scp0, SPITZ_SCP_CHRG_ON, outsignals[0]);
-    qdev_connect_gpio_out(scp0, SPITZ_SCP_JK_B, outsignals[1]);
-    qdev_connect_gpio_out(scp0, SPITZ_SCP_LED_GREEN, outsignals[2]);
-    qdev_connect_gpio_out(scp0, SPITZ_SCP_LED_ORANGE, outsignals[3]);
+    qdev_connect_gpio_out(scp0, SPITZ_SCP_CHRG_ON,
+                          qemu_allocate_irq(spitz_out_switch, cpu, 0));
+    qdev_connect_gpio_out(scp0, SPITZ_SCP_JK_B,
+                          qemu_allocate_irq(spitz_out_switch, cpu, 1));
+    qdev_connect_gpio_out(scp0, SPITZ_SCP_LED_GREEN,
+                          qemu_allocate_irq(spitz_out_switch, cpu, 2));
+    qdev_connect_gpio_out(scp0, SPITZ_SCP_LED_ORANGE,
+                          qemu_allocate_irq(spitz_out_switch, cpu, 3));
 
     if (scp1) {
-        qdev_connect_gpio_out(scp1, SPITZ_SCP2_BACKLIGHT_CONT, outsignals[4]);
-        qdev_connect_gpio_out(scp1, SPITZ_SCP2_BACKLIGHT_ON, outsignals[5]);
+        qdev_connect_gpio_out(scp1, SPITZ_SCP2_BACKLIGHT_CONT,
+                              qemu_allocate_irq(spitz_out_switch, cpu, 4));
+        qdev_connect_gpio_out(scp1, SPITZ_SCP2_BACKLIGHT_ON,
+                              qemu_allocate_irq(spitz_out_switch, cpu, 5));
     }
 
-    qdev_connect_gpio_out(scp0, SPITZ_SCP_ADC_TEMP_ON, outsignals[6]);
+    qdev_connect_gpio_out(scp0, SPITZ_SCP_ADC_TEMP_ON,
+                          qemu_allocate_irq(spitz_out_switch, cpu, 6));
 }
 
 #define SPITZ_GPIO_HSYNC		22
-- 
2.0.4

[Qemu-devel] [PATCH 08/10] hw/arm/tosa.c: Fix misusing qemu_allocate_irqs

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Use qemu_allocate_irq instead of qemu_allocate_irqs to fix memory leak.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/arm/tosa.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index 73572eb..6bfbc2b 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -90,7 +90,6 @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                 DeviceState *scp1,
                 TC6393xbState *tmio)
 {
-    qemu_irq *outsignals = qemu_allocate_irqs(tosa_out_switch, cpu, 4);
     /* MMC/SD host */
     pxa2xx_mmci_handlers(cpu->mmc,
                     qdev_get_gpio_in(scp0, TOSA_GPIO_SD_WP),
@@ -108,10 +107,14 @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                         qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_JC_CF_IRQ),
                         NULL);
 
-    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED, outsignals[0]);
-    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED, outsignals[1]);
-    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED, outsignals[2]);
-    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED, outsignals[3]);
+    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED,
+                          qemu_allocate_irq(tosa_out_switch, cpu, 0));
+    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED,
+                          qemu_allocate_irq(tosa_out_switch, cpu, 1));
+    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED,
+                          qemu_allocate_irq(tosa_out_switch, cpu, 2));
+    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED,
+                          qemu_allocate_irq(tosa_out_switch, cpu, 3));
 
     qdev_connect_gpio_out(scp1, TOSA_GPIO_TC6393XB_L3V_ON, tc6393xb_l3v_get(tmio));
 
-- 
2.0.4

[Qemu-devel] [PATCH 09/10] hw/mips/mips_int.c: use qemu_allocate_irq to fix memory leak

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/mips/mips_int.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/mips/mips_int.c b/hw/mips/mips_int.c
index d740046..e463a46 100644
--- a/hw/mips/mips_int.c
+++ b/hw/mips/mips_int.c
@@ -59,12 +59,11 @@ static void cpu_mips_irq_request(void *opaque, int irq, int level)
 
 void cpu_mips_irq_init_cpu(CPUMIPSState *env)
 {
-    qemu_irq *qi;
     int i;
 
-    qi = qemu_allocate_irqs(cpu_mips_irq_request, mips_env_get_cpu(env), 8);
     for (i = 0; i < 8; i++) {
-        env->irq[i] = qi[i];
+        env->irq[i] = qemu_allocate_irq(cpu_mips_irq_request,
+                                        mips_env_get_cpu(env), i);
     }
 }
 
-- 
2.0.4

[Qemu-devel] [PATCH 10/10] hw/openrisc/pic_cpu.c: use qemu_allocate_irq to fix memory leak

[Shannon Zhao]

From: Shannon Zhao <shannon.zhao@linaro.org>

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
---
 hw/openrisc/pic_cpu.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/openrisc/pic_cpu.c b/hw/openrisc/pic_cpu.c
index 2af1d60..5060214 100644
--- a/hw/openrisc/pic_cpu.c
+++ b/hw/openrisc/pic_cpu.c
@@ -51,10 +51,8 @@ static void openrisc_pic_cpu_handler(void *opaque, int irq, int level)
 void cpu_openrisc_pic_init(OpenRISCCPU *cpu)
 {
     int i;
-    qemu_irq *qi;
-    qi = qemu_allocate_irqs(openrisc_pic_cpu_handler, cpu, NR_IRQS);
 
     for (i = 0; i < NR_IRQS; i++) {
-        cpu->env.irq[i] = qi[i];
+        cpu->env.irq[i] = qemu_allocate_irq(openrisc_pic_cpu_handler, cpu, i);
     }
 }
-- 
2.0.4