We delete without check whether it existed during exit. This will lead NULL
pointer deference since it was created conditionally depends on guest driver
status and features. So add a check of existence before trying to delete it.

Cc: qemu-stable@nongnu.org
Signed-off-by: NJason Wang <jasowang@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383728288-28469-1-git-send-email-jasowang@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

This was once introduced by commit 100d9891 but was never used in-tree
and then got broken by commit 32e0c826. Time to clean up.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Message-id: 520B6A27.4040207@siemens.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

After calling dpy_gfx_replace_surface(s->con, surface), the outer
surface is invalid.

==5370== Invalid read of size 4
==5370==    at 0x460229: surface_bits_per_pixel (console.h:250)
==5370==    by 0x466A81: get_depth_index (vga.c:1173)
==5370==    by 0x467EC2: vga_draw_graphic (vga.c:1718)
==5370==    by 0x4687A5: vga_update_display (vga.c:1914)
==5370==    by 0x2A782E: qxl_hw_update (qxl.c:1766)
==5370==    by 0x3EB83B: graphic_hw_update (console.c:254)
==5370==    by 0x3FBE31: qemu_spice_display_refresh (spice-display.c:418)
==5370==    by 0x2A7D01: display_refresh (qxl.c:1886)
==5370==    by 0x3EEE1C: dpy_refresh (console.c:1436)
==5370==    by 0x3EB543: gui_update (console.c:192)
==5370==    by 0x3C43B3: timerlist_run_timers (qemu-timer.c:488)
==5370==    by 0x3C4416: qemu_clock_run_timers (qemu-timer.c:499)
==5370==  Address 0x22ffb1e0 is 0 bytes inside a block of size 56 free'd
==5370==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==5370==    by 0x4245FC: free_and_trace (vl.c:2771)
==5370==    by 0x50899AE: g_free (gmem.c:252)
==5370==    by 0x3EE8D3: qemu_free_displaysurface (console.c:1332)
==5370==    by 0x3EEDB7: dpy_gfx_replace_surface (console.c:1427)
==5370==    by 0x467EB6: vga_draw_graphic (vga.c:1714)
==5370==    by 0x4687A5: vga_update_display (vga.c:1914)
==5370==    by 0x2A782E: qxl_hw_update (qxl.c:1766)
==5370==    by 0x3EB83B: graphic_hw_update (console.c:254)
==5370==    by 0x3FBE31: qemu_spice_display_refresh (spice-display.c:418)
==5370==    by 0x2A7D01: display_refresh (qxl.c:1886)
==5370==    by 0x3EEE1C: dpy_refresh (console.c:1436)
Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Reviewed-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 1383664554-15248-1-git-send-email-marcandre.lureau@gmail.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy cpu_to_32wu() with stl_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-10-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy cpu_to_be32wu() with stl_be_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-8-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy cpu_to_be16wu() with stw_be_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-7-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy be32_to_cpupu() with ldl_be_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-6-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy le32_to_cpupu() with ldl_le_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-5-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy le16_to_cpupu() with lduw_le_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-4-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy cpu_to_le32wu() with stl_le_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-3-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Replace the legacy cpu_to_le16wu() with stw_le_p().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-2-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Turn it into a SysBusDevice and use a container MemoryRegion.

Add a link<pcmcia-card> property to the PCMCIACardState.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

All its users have finally been converted.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Add missing braces.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Turn PCMCIACardState into a device.
Move callbacks to new PCMCIACardClass.

Derive TYPE_MICRODRIVE from TYPE_PCMCIA_CARD.
Replace ide_init2_with_non_qdev_drives().
Signed-off-by: NOthmar Pasteka <pasteka@kabsi.at>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

The qdev_free() function name is misleading since all the function does
is unlink the device from its parent.  The device is not necessarily
freed.

The device will be freed when its QObject refcount reaches zero.  It is
usual for the parent (bus) to hold the final reference but there are
cases where something else holds a reference so "free" is a misleading
name.

Call object_unparent(obj) directly instead of having a qdev wrapper
function.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move state struct, type constant and cast macro to a new header.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Embed ARM11MPCorePriveState and RealViewGICState and replace SysBus
initfn with realizefn.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move state struct, type constant and cast macro to a new header.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Embed GICState and replace SysBus initfn with realizefn.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Embed child devices and replace SysBus initfn with realizefn.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Inspired by a9scu.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This allows to map the region directly after object initialization.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

"mpcode" -> "mpcore"
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

It does not have a target or ARMCPU dependency.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Turn SysBusDevice initfn into a QOM realizefn.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

This covers both emulated and KVM GIC.

Prepares for QOM realize.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Prepares for QOM realize.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Prepares for QOM realize.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Split the SysBusDevice initfn into instance_init and realizefn.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Prepares for QOM realize.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Rename A9SCUState::busdev field to parent_obj and turn realizefn into an
instance_init function to allow early MMIO mapping.
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Prepares for conversion to QOM realize.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

Rename NCPU to GIC_NCPU and move GICState away from gic_internal.h.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>