The TCTX object has both a pointer and a "cpu" property pointing to the vCPU object. Confusing bugs could arise if these ever go out of sync.
Change the property definition so that it explicitely sets the pointer. Signed-off-by: Greg Kurz <gr...@kaod.org> --- hw/intc/xive.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/hw/intc/xive.c b/hw/intc/xive.c index 75dce82fb205..5363fcaa416c 100644 --- a/hw/intc/xive.c +++ b/hw/intc/xive.c @@ -580,19 +580,11 @@ static void xive_tctx_realize(DeviceState *dev, Error **errp) XiveTCTX *tctx = XIVE_TCTX(dev); PowerPCCPU *cpu; CPUPPCState *env; - Object *obj; Error *local_err = NULL; - obj = object_property_get_link(OBJECT(dev), "cpu", &local_err); - if (!obj) { - error_propagate(errp, local_err); - error_prepend(errp, "required link 'cpu' not found: "); - return; - } - - cpu = POWERPC_CPU(obj); - tctx->cs = CPU(obj); + assert(tctx->cs); + cpu = POWERPC_CPU(tctx->cs); env = &cpu->env; switch (PPC_INPUT(env)) { case PPC_FLAGS_INPUT_POWER9: @@ -676,10 +668,19 @@ static void xive_tctx_class_init(ObjectClass *klass, void *data) dc->user_creatable = false; } +static void xive_tctx_instance_init(Object *obj) +{ + object_property_add_link(obj, "cpu", TYPE_CPU, + (Object **) &XIVE_TCTX(obj)->cs, + qdev_prop_allow_set_link_before_realize, + OBJ_PROP_LINK_STRONG, &error_abort); +} + static const TypeInfo xive_tctx_info = { .name = TYPE_XIVE_TCTX, .parent = TYPE_DEVICE, .instance_size = sizeof(XiveTCTX), + .instance_init = xive_tctx_instance_init, .class_init = xive_tctx_class_init, }; @@ -691,8 +692,7 @@ Object *xive_tctx_create(Object *cpu, XiveRouter *xrtr, Error **errp) obj = object_new(TYPE_XIVE_TCTX); object_property_add_child(cpu, TYPE_XIVE_TCTX, obj, &error_abort); object_unref(obj); - object_ref(cpu); - object_property_add_const_link(obj, "cpu", cpu, &error_abort); + object_property_set_link(obj, cpu, "cpu", &error_abort); object_property_set_bool(obj, true, "realized", &local_err); if (local_err) { goto error; @@ -710,7 +710,6 @@ void xive_tctx_destroy(XiveTCTX *tctx) { Object *obj = OBJECT(tctx); - object_unref(object_property_get_link(obj, "cpu", &error_abort)); object_unparent(obj); }