[22/22] cirrus_vga: add QIDL annotations

diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index 623dd68..2f707a4 100644
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -197,17 +197,18 @@  typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
 typedef void (*cirrus_fill_t)(struct CirrusVGAState *s,
                               uint8_t *dst, int dst_pitch, int width, int height);
 
+QIDL_START(CirrusVGAState, state)
 typedef struct CirrusVGAState {
     VGACommonState vga;
 
-    MemoryRegion cirrus_linear_io;
-    MemoryRegion cirrus_linear_bitblt_io;
-    MemoryRegion cirrus_mmio_io;
-    MemoryRegion pci_bar;
+    MemoryRegion cirrus_linear_io QIDL(immutable);
+    MemoryRegion cirrus_linear_bitblt_io QIDL(immutable);
+    MemoryRegion cirrus_mmio_io QIDL(immutable);
+    MemoryRegion pci_bar QIDL(immutable);
     bool linear_vram;  /* vga.vram mapped over cirrus_linear_io */
-    MemoryRegion low_mem_container; /* container for 0xa0000-0xc0000 */
-    MemoryRegion low_mem;           /* always mapped, overridden by: */
-    MemoryRegion cirrus_bank[2];    /*   aliases at 0xa0000-0xb0000  */
+    MemoryRegion low_mem_container QIDL(immutable); /* container for 0xa0000-0xc0000 */
+    MemoryRegion low_mem QIDL(immutable);           /* always mapped, overridden by: */
+    MemoryRegion cirrus_bank[2] QIDL(immutable);    /*   aliases at 0xa0000-0xb0000  */
     uint32_t cirrus_addr_mask;
     uint32_t linear_mmio_mask;
     uint8_t cirrus_shadow_gr0;
@@ -230,11 +231,11 @@  typedef struct CirrusVGAState {
     uint32_t cirrus_blt_srcaddr;
     uint8_t cirrus_blt_mode;
     uint8_t cirrus_blt_modeext;
-    cirrus_bitblt_rop_t cirrus_rop;
+    cirrus_bitblt_rop_t cirrus_rop QIDL(immutable);
 #define CIRRUS_BLTBUFSIZE (2048 * 4) /* one line width */
     uint8_t cirrus_bltbuf[CIRRUS_BLTBUFSIZE];
-    uint8_t *cirrus_srcptr;
-    uint8_t *cirrus_srcptr_end;
+    uint8_t *cirrus_srcptr QIDL(derived);
+    uint8_t *cirrus_srcptr_end QIDL(derived);
     uint32_t cirrus_srccounter;
     /* hwcursor display state */
     int last_hw_cursor_size;
@@ -246,16 +247,21 @@  typedef struct CirrusVGAState {
     int device_id;
     int bustype;
 } CirrusVGAState;
+QIDL_END(CirrusVGAState)
 
+QIDL_START(PCICirrusVGAState, state)
 typedef struct PCICirrusVGAState {
     PCIDevice dev;
     CirrusVGAState cirrus_vga;
 } PCICirrusVGAState;
+QIDL_END(PCICirrusVGAState)
 
+QIDL_START(ISACirrusVGAState, state)
 typedef struct ISACirrusVGAState {
-    ISADevice dev;
+    ISADevice dev QIDL(immutable);
     CirrusVGAState cirrus_vga;
 } ISACirrusVGAState;
+QIDL_END(ISACirrusVGAState)
 
 static uint8_t rop_to_index[256];
 
@@ -2888,6 +2894,14 @@  static void cirrus_init_common(CirrusVGAState * s, int device_id, int is_pci,
  *
  ***************************************/
 
+static void isa_cirrus_vga_get_state(Object *obj, Visitor *v, void *opaque,
+                                     const char *name, Error **errp)
+{
+    ISADevice *isa = ISA_DEVICE(obj);
+    ISACirrusVGAState *s = DO_UPCAST(ISACirrusVGAState, dev, isa);
+    QIDL_VISIT_TYPE(ISACirrusVGAState, v, &s, name, errp);
+}
+
 static int vga_initfn(ISADevice *dev)
 {
     ISACirrusVGAState *d = DO_UPCAST(ISACirrusVGAState, dev, dev);
@@ -2903,6 +2917,9 @@  static int vga_initfn(ISADevice *dev)
     rom_add_vga(VGABIOS_CIRRUS_FILENAME);
     /* XXX ISA-LFB support */
     /* FIXME not qdev yet */
+    object_property_add(OBJECT(d), "state", "ISACirrusVGAState",
+                        isa_cirrus_vga_get_state, NULL, NULL, s, NULL);
+    QIDL_SCHEMA_ADD_LINK(ISACirrusVGAState, OBJECT(d), "state_schema", NULL);
     return 0;
 }
 
@@ -2928,6 +2945,14 @@  static TypeInfo isa_cirrus_vga_info = {
  *
  ***************************************/
 
+static void pci_cirrus_vga_get_state(Object *obj, Visitor *v, void *opaque,
+                                     const char *name, Error **errp)
+{
+    PCIDevice *pci = PCI_DEVICE(obj);
+    PCICirrusVGAState *s = DO_UPCAST(PCICirrusVGAState, dev, pci);
+    QIDL_VISIT_TYPE(PCICirrusVGAState, v, &s, name, errp);
+}
+
 static int pci_cirrus_vga_initfn(PCIDevice *dev)
 {
      PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);
@@ -2960,6 +2985,10 @@  static int pci_cirrus_vga_initfn(PCIDevice *dev)
      if (device_id == CIRRUS_ID_CLGD5446) {
          pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);
      }
+
+    object_property_add(OBJECT(d), "state", "PCICirrusVGAState",
+                        pci_cirrus_vga_get_state, NULL, NULL, s, NULL);
+    QIDL_SCHEMA_ADD_LINK(PCICirrusVGAState, OBJECT(d), "state_schema", NULL);
      return 0;
 }
 
diff --git a/hw/msix.c b/hw/msix.c
index ded3c55..0c9b03d 100644
--- a/hw/msix.c
+++ b/hw/msix.c
@@ -281,6 +281,7 @@  int msix_init(struct PCIDevice *dev, unsigned short nentries,
     dev->msix_entry_used = g_malloc0(MSIX_MAX_ENTRIES *
                                         sizeof *dev->msix_entry_used);
 
+    dev->msix_table_page_size = MSIX_PAGE_SIZE;
     dev->msix_table_page = g_malloc0(MSIX_PAGE_SIZE);
     msix_mask_all(dev, nentries);
 
@@ -301,6 +302,7 @@  err_config:
     memory_region_destroy(&dev->msix_mmio);
     g_free(dev->msix_table_page);
     dev->msix_table_page = NULL;
+    dev->msix_table_page_size = 0;
     g_free(dev->msix_entry_used);
     dev->msix_entry_used = NULL;
     return ret;
@@ -330,6 +332,7 @@  int msix_uninit(PCIDevice *dev, MemoryRegion *bar)
     memory_region_destroy(&dev->msix_mmio);
     g_free(dev->msix_table_page);
     dev->msix_table_page = NULL;
+    dev->msix_table_page_size = 0;
     g_free(dev->msix_entry_used);
     dev->msix_entry_used = NULL;
     dev->cap_present &= ~QEMU_PCI_CAP_MSIX;
diff --git a/hw/pci.h b/hw/pci.h
index 79d38fd..0caf834 100644
--- a/hw/pci.h
+++ b/hw/pci.h
@@ -177,38 +177,41 @@  typedef int (*MSIVectorUseNotifier)(PCIDevice *dev, unsigned int vector,
                                       MSIMessage msg);
 typedef void (*MSIVectorReleaseNotifier)(PCIDevice *dev, unsigned int vector);
 
+QIDL_START(PCIDevice, state)
 struct PCIDevice {
-    DeviceState qdev;
+    DeviceState qdev QIDL(immutable);
 
     /* PCI config space */
-    uint8_t *config;
+    uint8_t *config \
+        QIDL(size_is, (pci_is_express(*obj) ? \
+                       PCIE_CONFIG_SPACE_SIZE : PCI_CONFIG_SPACE_SIZE));
 
     /* Used to enable config checks on load. Note that writable bits are
      * never checked even if set in cmask. */
-    uint8_t *cmask;
+    uint8_t *cmask QIDL(immutable);
 
     /* Used to implement R/W bytes */
-    uint8_t *wmask;
+    uint8_t *wmask QIDL(immutable);
 
     /* Used to implement RW1C(Write 1 to Clear) bytes */
-    uint8_t *w1cmask;
+    uint8_t *w1cmask QIDL(immutable);
 
     /* Used to allocate config space for capabilities. */
-    uint8_t *used;
+    uint8_t *used QIDL(immutable);
 
     /* the following fields are read only */
-    PCIBus *bus;
-    int32_t devfn;
-    char name[64];
-    PCIIORegion io_regions[PCI_NUM_REGIONS];
-    DMAContext *dma;
+    PCIBus *bus QIDL(immutable);
+    int32_t devfn QIDL(immutable);
+    char name[64] QIDL(immutable);
+    PCIIORegion io_regions[PCI_NUM_REGIONS] QIDL(immutable);
+    DMAContext *dma QIDL(immutable);
 
     /* do not access the following fields */
-    PCIConfigReadFunc *config_read;
-    PCIConfigWriteFunc *config_write;
+    PCIConfigReadFunc *config_read QIDL(immutable);
+    PCIConfigWriteFunc *config_write QIDL(immutable);
 
     /* IRQ objects for the INTA-INTD pins.  */
-    qemu_irq *irq;
+    qemu_irq *irq QIDL(immutable);
 
     /* Current IRQ levels.  Used internally by the generic PCI code.  */
     uint8_t irq_state;
@@ -220,14 +223,17 @@  struct PCIDevice {
     uint8_t msix_cap;
 
     /* MSI-X entries */
-    int msix_entries_nr;
+    int32_t msix_entries_nr;
+
+    /* MSI-X table page size */
+    int32_t msix_table_page_size QIDL(immutable);
 
     /* Space to store MSIX table */
-    uint8_t *msix_table_page;
+    uint8_t *msix_table_page QIDL(size_is, msix_table_page_size);
     /* MMIO index used to map MSIX table and pending bit entries. */
-    MemoryRegion msix_mmio;
+    MemoryRegion msix_mmio QIDL(immutable);
     /* Reference-count for entries actually in use by driver. */
-    unsigned *msix_entry_used;
+    unsigned int *msix_entry_used QIDL(broken);
     /* Region including the MSI-X table */
     uint32_t msix_bar_size;
     /* MSIX function mask set or MSIX disabled */
@@ -239,21 +245,22 @@  struct PCIDevice {
     uint8_t msi_cap;
 
     /* PCI Express */
-    PCIExpressDevice exp;
+    PCIExpressDevice exp QIDL(immutable);
 
     /* SHPC */
-    SHPCDevice *shpc;
+    SHPCDevice *shpc QIDL(immutable);
 
     /* Location of option rom */
-    char *romfile;
+    char *romfile QIDL(immutable);
     bool has_rom;
-    MemoryRegion rom;
+    MemoryRegion rom QIDL(immutable);
     uint32_t rom_bar;
 
     /* MSI-X notifiers */
-    MSIVectorUseNotifier msix_vector_use_notifier;
-    MSIVectorReleaseNotifier msix_vector_release_notifier;
+    MSIVectorUseNotifier msix_vector_use_notifier QIDL(immutable);
+    MSIVectorReleaseNotifier msix_vector_release_notifier QIDL(immutable);
 };
+QIDL_END(PCIDevice)
 
 void pci_register_bar(PCIDevice *pci_dev, int region_num,
                       uint8_t attr, MemoryRegion *memory);
diff --git a/hw/vga_int.h b/hw/vga_int.h
index 8938093..a77cc41 100644
--- a/hw/vga_int.h
+++ b/hw/vga_int.h
@@ -101,15 +101,16 @@  struct VGACommonState;
 typedef uint8_t (* vga_retrace_fn)(struct VGACommonState *s);
 typedef void (* vga_update_retrace_info_fn)(struct VGACommonState *s);
 
+QIDL_START(VGACommonState, state)
 typedef struct VGACommonState {
-    MemoryRegion *legacy_address_space;
-    uint8_t *vram_ptr;
-    MemoryRegion vram;
-    MemoryRegion vram_vbe;
+    MemoryRegion *legacy_address_space QIDL(immutable);
+    uint8_t *vram_ptr QIDL(immutable);
+    MemoryRegion vram QIDL(immutable);
+    MemoryRegion vram_vbe QIDL(immutable);
     uint32_t vram_size;
     uint32_t vram_size_mb; /* property */
     uint32_t latch;
-    MemoryRegion *chain4_alias;
+    MemoryRegion *chain4_alias QIDL(immutable);
     uint8_t sr_index;
     uint8_t sr[256];
     uint8_t gr_index;
@@ -141,7 +142,7 @@  typedef struct VGACommonState {
                         int *pheight);
     VGA_STATE_COMMON_BOCHS_VBE
     /* display refresh support */
-    DisplayState *ds;
+    DisplayState *ds QIDL(immutable);
     uint32_t font_offsets[2];
     int graphic_mode;
     uint8_t shift_control;
@@ -161,10 +162,10 @@  typedef struct VGACommonState {
     uint32_t cursor_offset;
     unsigned int (*rgb_to_pixel)(unsigned int r,
                                  unsigned int g, unsigned b);
-    vga_hw_update_ptr update;
-    vga_hw_invalidate_ptr invalidate;
-    vga_hw_screen_dump_ptr screen_dump;
-    vga_hw_text_update_ptr text_update;
+    vga_hw_update_ptr update QIDL(immutable);
+    vga_hw_invalidate_ptr invalidate QIDL(immutable);
+    vga_hw_screen_dump_ptr screen_dump QIDL(immutable);
+    vga_hw_text_update_ptr text_update QIDL(immutable);
     /* hardware mouse cursor support */
     uint32_t invalidated_y_table[VGA_MAX_HEIGHT / 32];
     void (*cursor_invalidate)(struct VGACommonState *s);
@@ -173,11 +174,12 @@  typedef struct VGACommonState {
     uint32_t last_palette[256];
     uint32_t last_ch_attr[CH_ATTR_SIZE]; /* XXX: make it dynamic */
     /* retrace */
-    vga_retrace_fn retrace;
-    vga_update_retrace_info_fn update_retrace_info;
-    union vga_retrace retrace_info;
+    vga_retrace_fn retrace QIDL(immutable);
+    vga_update_retrace_info_fn update_retrace_info QIDL(immutable);
+    union vga_retrace retrace_info QIDL(immutable);
     uint8_t is_vbe_vmstate;
 } VGACommonState;
+QIDL_END(VGACommonState)
 
 static inline int c6_to_8(int v)
 {