Revert "char: use a fixed idx for child muxed chr"

That commit mis-used mux char: the frontend are multiplexed, not the
backend. Fix the regression preventing "c-a c" to switch the focus. The
following patches will fix the crash (when leaving or removing frontend)
by tracking frontends with handler tags.

This reverts commit 949055a2.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

include/sysemu/char.h

@@ -107,7 +107,6 @@ struct CharDriverState {
     int explicit_be_open;
     int avail_connections;
     int is_mux;
-    int mux_idx;
     guint fd_in_tag;
     bool replay;
     DECLARE_BITMAP(features, QEMU_CHAR_FEATURE_LAST);

qemu-char.c

@@ -165,7 +165,6 @@ CharDriverState *qemu_chr_alloc(ChardevCommon *backend, Error **errp)
     CharDriverState *chr = g_malloc0(sizeof(CharDriverState));
     qemu_mutex_init(&chr->chr_write_lock);
 
-    chr->mux_idx = -1;
     if (backend->has_logfile) {
         int flags = O_WRONLY | O_CREAT;
         if (backend->has_logappend &&
@@ -739,25 +738,17 @@ static void mux_chr_update_read_handler(CharDriverState *chr,
                                         GMainContext *context)
 {
     MuxDriver *d = chr->opaque;
-    int idx;
 
     if (d->mux_cnt >= MAX_MUX) {
         fprintf(stderr, "Cannot add I/O handlers, MUX array is full\n");
         return;
     }
-
-    if (chr->mux_idx == -1) {
-        chr->mux_idx = d->mux_cnt++;
-    }
-
-    idx = chr->mux_idx;
-    d->ext_opaque[idx] = chr->handler_opaque;
-    d->chr_can_read[idx] = chr->chr_can_read;
-    d->chr_read[idx] = chr->chr_read;
-    d->chr_event[idx] = chr->chr_event;
-
+    d->ext_opaque[d->mux_cnt] = chr->handler_opaque;
+    d->chr_can_read[d->mux_cnt] = chr->chr_can_read;
+    d->chr_read[d->mux_cnt] = chr->chr_read;
+    d->chr_event[d->mux_cnt] = chr->chr_event;
     /* Fix up the real driver with mux routines */
-    if (d->mux_cnt == 1) {
+    if (d->mux_cnt == 0) {
         qemu_chr_add_handlers_full(d->drv, mux_chr_can_read,
                                    mux_chr_read,
                                    mux_chr_event,
@@ -766,7 +757,8 @@ static void mux_chr_update_read_handler(CharDriverState *chr,
     if (d->focus != -1) {
         mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_OUT);
     }
-    d->focus = idx;
+    d->focus = d->mux_cnt;
+    d->mux_cnt++;
     mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_IN);
 }