[Qemu-devel] [PATCH v2 00/12] qdev: correct reference counting

[Qemu-devel] [PATCH v2 00/12] qdev: correct reference counting

[Paolo Bonzini]

This series makes the ref_count field of device and bus objects actually
match the number of references that the objects have.  Once this is
done, the question "how do I delete an object?"  has a simple answer:
use object_unparent if the object is reachable from the QOM tree, else use
object_unref.  qdev_free and qbus_free become equivalent to simply
object_unparent.  object_delete instead is replaced by object_unref.

Patches 1-3 fix some warts in the last minute patches that went in 1.3.
Patches 4-9 are the bulk of the series.  Patches 11-12 touches the CPU
classes instead.

There is a new patch (#4) that documents how link properties are
reference counted, and the transfer of ownership when the property
is created/deleted.  I renamed qbus_remove_children to bus_unparent,
and rebased for the conversion of ->state to ->realized.  PPC was also
using object_delete for its CPU, too.  Otherwise, there are no changes.

Paolo

Paolo Bonzini (12):
  qdev: export and use qbus_init
  qdev: use object_new, not g_malloc to create buses
  qom: preserve object while unparenting it
  qom: document reference counting of link properties
  qdev: add reference count to a device for the BusChild
  qdev: move deletion of children from finalize to unparent
  qdev: move unrealization of devices from finalize to unparent
  qdev: add reference for the bus while it is referred to by the DeviceState
  qdev: inline object_delete into qbus_free/qdev_free
  qdev: drop extra references at creation time
  cpu: do not use object_delete
  qom: remove object_delete

 hw/pci/pci.c                |  11 +++--
 hw/pci/pci.h                |   5 ---
 hw/qdev-core.h              |   1 +
 hw/qdev-monitor.c           |   5 ++-
 hw/qdev.c                   | 105 +++++++++++++++++++++++++-------------------
 hw/sysbus.c                 |   6 +--
 include/qom/object.h        |  22 +++-------
 linux-user/syscall.c        |   2 +-
 qom/object.c                |   9 +---
 target-i386/helper.c        |   4 +-
 target-ppc/translate_init.c |   2 +-
 target-sparc/cpu.c          |   2 +-
 vl.c                        |   1 +
 13 files changed, 88 insertions(+), 87 deletions(-)

-- 
1.8.1

[Qemu-devel] [PATCH v2 01/12] qdev: export and use qbus_init

[Paolo Bonzini]

BusState subclasses need to do their own allocation because
qbus_create_inplace calls object_initialize (which wipes out the
"free" callback).  This patch separates the initialization of the object
(object_initialize) from its insertion in the qdev tree (qbus_realize); to
do so, it moves the remaining bits of qbus_create_inplace to qbus_realize
and export it as qbus_init.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/qdev-core.h |  1 +
 hw/qdev.c      | 18 +++++++-----------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/hw/qdev-core.h b/hw/qdev-core.h
index 731aadd..c9f7fa1 100644
--- a/hw/qdev-core.h
+++ b/hw/qdev-core.h
@@ -229,6 +229,7 @@ DeviceState *qdev_find_recursive(BusState *bus, const char *id);
 typedef int (qbus_walkerfn)(BusState *bus, void *opaque);
 typedef int (qdev_walkerfn)(DeviceState *dev, void *opaque);
 
+void qbus_init(BusState *bus, DeviceState *parent, const char *name);
 void qbus_create_inplace(BusState *bus, const char *typename,
                          DeviceState *parent, const char *name);
 BusState *qbus_create(const char *typename, DeviceState *parent, const char *name);
diff --git a/hw/qdev.c b/hw/qdev.c
index 9761016..b473bd7 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -390,14 +390,16 @@ DeviceState *qdev_find_recursive(BusState *bus, const char *id)
     return NULL;
 }
 
-static void qbus_realize(BusState *bus)
+void qbus_init(BusState *bus, DeviceState *parent, const char *name)
 {
     const char *typename = object_get_typename(OBJECT(bus));
     char *buf;
     int i,len;
 
-    if (bus->name) {
-        /* use supplied name */
+    bus->parent = parent;
+
+    if (name) {
+        bus->name = g_strdup(name);
     } else if (bus->parent && bus->parent->id) {
         /* parent device has id -> use it for bus name */
         len = strlen(bus->parent->id) + 16;
@@ -430,10 +432,7 @@ void qbus_create_inplace(BusState *bus, const char *typename,
                          DeviceState *parent, const char *name)
 {
     object_initialize(bus, typename);
-
-    bus->parent = parent;
-    bus->name = name ? g_strdup(name) : NULL;
-    qbus_realize(bus);
+    qbus_init(bus, parent, name);
 }
 
 BusState *qbus_create(const char *typename, DeviceState *parent, const char *name)
@@ -441,10 +440,7 @@ BusState *qbus_create(const char *typename, DeviceState *parent, const char *nam
     BusState *bus;
 
     bus = BUS(object_new(typename));
-
-    bus->parent = parent;
-    bus->name = name ? g_strdup(name) : NULL;
-    qbus_realize(bus);
+    qbus_init(bus, parent, name);
 
     return bus;
 }
-- 
1.8.1

Re: [Qemu-devel] [PATCH v2 01/12] qdev: export and use qbus_init

[Andreas Färber]

Am 21.01.2013 13:30, schrieb Paolo Bonzini:
> BusState subclasses need to do their own allocation because
> qbus_create_inplace calls object_initialize (which wipes out the
> "free" callback).  This patch separates the initialization of the object
> (object_initialize) from its insertion in the qdev tree (qbus_realize); to
> do so, it moves the remaining bits of qbus_create_inplace to qbus_realize
> and export it as qbus_init.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

I think I left some comments on v1: Would it be possible to leave a
bus_initialize() function (without q ;)) in place that calls
object_initialize() plus the-artist-formerly-known-as-qbus_realize(),
shared between object_new() and object_initialize()? ->free was always
set afterwards. The issue I am trying to contain here is a surge of
*_init functions beyond class_init, instance_init, DeviceClass::init.
Sticking to the QOM naming of having *bus_initialize() and *bus_new()
would address that.

Maybe if we reorder the two patches, dropping the use of g_malloc0() first?

Currently care needs to be taken with the in-place bus initialization
functions to not apply PCI_BUS() etc. on the uninitialized variable.
Having a pci_bus_initialize(void *, ...) -> bus_initialize(void *, ...)
-> object_initialize(void *, ...) call chain would solve that.

Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] [PATCH v2 02/12] qdev: use object_new, not g_malloc to create buses

[Paolo Bonzini]

After the previous patch, creation of heap-allocated buses can
use qbus_init and does not need to hack the "free" callback.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci/pci.c | 11 +++++------
 hw/pci/pci.h |  5 -----
 hw/sysbus.c  |  6 ++----
 3 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 5fd1bcf..2dd57e2 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -274,13 +274,13 @@ int pci_find_domain(const PCIBus *bus)
     return -1;
 }
 
-void pci_bus_new_inplace(PCIBus *bus, DeviceState *parent,
+static void pci_bus_init(PCIBus *bus, DeviceState *parent,
                          const char *name,
                          MemoryRegion *address_space_mem,
                          MemoryRegion *address_space_io,
                          uint8_t devfn_min)
 {
-    qbus_create_inplace(&bus->qbus, TYPE_PCI_BUS, parent, name);
+    qbus_init(&bus->qbus, parent, name);
     assert(PCI_FUNC(devfn_min) == 0);
     bus->devfn_min = devfn_min;
     bus->address_space_mem = address_space_mem;
@@ -300,10 +300,9 @@ PCIBus *pci_bus_new(DeviceState *parent, const char *name,
 {
     PCIBus *bus;
 
-    bus = g_malloc0(sizeof(*bus));
-    pci_bus_new_inplace(bus, parent, name, address_space_mem,
-                        address_space_io, devfn_min);
-    OBJECT(bus)->free = g_free;
+    bus = PCI_BUS(object_new(TYPE_PCI_BUS));
+    pci_bus_init(bus, parent, name, address_space_mem,
+                 address_space_io, devfn_min);
     return bus;
 }
 
diff --git a/hw/pci/pci.h b/hw/pci/pci.h
index f340fe5..a435106 100644
--- a/hw/pci/pci.h
+++ b/hw/pci/pci.h
@@ -318,11 +318,6 @@ typedef enum {
 
 typedef int (*pci_hotplug_fn)(DeviceState *qdev, PCIDevice *pci_dev,
                               PCIHotplugState state);
-void pci_bus_new_inplace(PCIBus *bus, DeviceState *parent,
-                         const char *name,
-                         MemoryRegion *address_space_mem,
-                         MemoryRegion *address_space_io,
-                         uint8_t devfn_min);
 PCIBus *pci_bus_new(DeviceState *parent, const char *name,
                     MemoryRegion *address_space_mem,
                     MemoryRegion *address_space_io,
diff --git a/hw/sysbus.c b/hw/sysbus.c
index f0ab8a8..43875bd 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -271,10 +271,8 @@ static void main_system_bus_create(void)
 {
     /* assign main_system_bus before qbus_create_inplace()
      * in order to make "if (bus != sysbus_get_default())" work */
-    main_system_bus = g_malloc0(system_bus_info.instance_size);
-    qbus_create_inplace(main_system_bus, TYPE_SYSTEM_BUS, NULL,
-                        "main-system-bus");
-    OBJECT(main_system_bus)->free = g_free;
+    main_system_bus = BUS(object_new(TYPE_SYSTEM_BUS));
+    qbus_init(main_system_bus, NULL, "main-system-bus");
     object_property_add_child(container_get(qdev_get_machine(),
                                             "/unattached"),
                               "sysbus", OBJECT(main_system_bus), NULL);
-- 
1.8.1

[Qemu-devel] [PATCH v2 03/12] qom: preserve object while unparenting it

[Paolo Bonzini]

Avoid that the object disappears after it's deleted from the QOM
composition tree, in case that was the only reference to it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qom/object.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/qom/object.c b/qom/object.c
index 03e6f24..1a123da 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -361,12 +361,14 @@ static void object_property_del_child(Object *obj, Object *child, Error **errp)
 
 void object_unparent(Object *obj)
 {
+    object_ref(obj);
     if (obj->parent) {
         object_property_del_child(obj->parent, obj, NULL);
     }
     if (obj->class->unparent) {
         (obj->class->unparent)(obj);
     }
+    object_unref(obj);
 }
 
 static void object_deinit(Object *obj, TypeImpl *type)
-- 
1.8.1

Re: [Qemu-devel] [PATCH v2 03/12] qom: preserve object while unparenting it

[Andreas Färber]

Am 21.01.2013 13:30, schrieb Paolo Bonzini:
> Avoid that the object disappears after it's deleted from the QOM
> composition tree, in case that was the only reference to it.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Acked-by: Andreas Färber <afaerber@suse.de>

Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] [PATCH v2 04/12] qom: document reference counting of link properties

[Paolo Bonzini]

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qom/object.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/qom/object.h b/include/qom/object.h
index 8e16ea8..5e8e528 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -1033,6 +1033,11 @@ void object_property_add_child(Object *obj, const char *name,
  * between objects.
  *
  * Links form the graph in the object model.
+ *
+ * Ownership of the pointer that @child points to is transferred to the
+ * link property.  The reference count for <code>*@child</code> is
+ * managed by the property from after the function returns till the
+ * property is deleted with object_property_del().
  */
 void object_property_add_link(Object *obj, const char *name,
                               const char *type, Object **child,
-- 
1.8.1

[Qemu-devel] [PATCH v2 05/12] qdev: add reference count to a device for the BusChild

[Paolo Bonzini]

Each device has a reference through the BusChild.  This reference
was not accounted for, add it now.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/qdev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/qdev.c b/hw/qdev.c
index b473bd7..f88a8a4 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -64,7 +64,10 @@ static void bus_remove_child(BusState *bus, DeviceState *child)
 
             snprintf(name, sizeof(name), "child[%d]", kid->index);
             QTAILQ_REMOVE(&bus->children, kid, sibling);
+
+            /* This gives back ownership of kid->child back to us.  */
             object_property_del(OBJECT(bus), name, NULL);
+            object_unref(OBJECT(kid->child));
             g_free(kid);
             return;
         }
@@ -82,9 +85,11 @@ static void bus_add_child(BusState *bus, DeviceState *child)
 
     kid->index = bus->max_index++;
     kid->child = child;
+    object_ref(OBJECT(kid->child));
 
     QTAILQ_INSERT_HEAD(&bus->children, kid, sibling);
 
+    /* This transfers ownership of kid->child to the property.  */
     snprintf(name, sizeof(name), "child[%d]", kid->index);
     object_property_add_link(OBJECT(bus), name,
                              object_get_typename(OBJECT(child)),
-- 
1.8.1

[Qemu-devel] [PATCH v2 06/12] qdev: move deletion of children from finalize to unparent

[Paolo Bonzini]

A device will never be finalized as long as it has a reference from
other devices that sit on its buses.  To ensure that the references
go away, deassociate a bus from its children in the unparent callback
for the bus.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/qdev.c | 37 +++++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/hw/qdev.c b/hw/qdev.c
index f88a8a4..83420ac 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -433,6 +433,25 @@ void qbus_init(BusState *bus, DeviceState *parent, const char *name)
     }
 }
 
+static void bus_unparent(Object *obj)
+{
+    BusState *bus = BUS(obj);
+    BusChild *kid;
+
+    while ((kid = QTAILQ_FIRST(&bus->children)) != NULL) {
+        DeviceState *dev = kid->child;
+        qdev_free(dev);
+    }
+    if (bus->parent) {
+        QLIST_REMOVE(bus, sibling);
+        bus->parent->num_child_bus--;
+        bus->parent = NULL;
+    } else {
+        assert(bus != sysbus_get_default()); /* main_system_bus is never freed */
+        qemu_unregister_reset(qbus_reset_all_fn, bus);
+    }
+}
+
 void qbus_create_inplace(BusState *bus, const char *typename,
                          DeviceState *parent, const char *name)
 {
@@ -805,22 +824,15 @@ static void qbus_initfn(Object *obj)
     QTAILQ_INIT(&bus->children);
 }
 
+static void bus_class_init(ObjectClass *class, void *data)
+{
+    class->unparent = bus_unparent;
+}
+
 static void qbus_finalize(Object *obj)
 {
     BusState *bus = BUS(obj);
-    BusChild *kid;
 
-    while ((kid = QTAILQ_FIRST(&bus->children)) != NULL) {
-        DeviceState *dev = kid->child;
-        qdev_free(dev);
-    }
-    if (bus->parent) {
-        QLIST_REMOVE(bus, sibling);
-        bus->parent->num_child_bus--;
-    } else {
-        assert(bus != sysbus_get_default()); /* main_system_bus is never freed */
-        qemu_unregister_reset(qbus_reset_all_fn, bus);
-    }
     g_free((char *)bus->name);
 }
 
@@ -832,6 +844,7 @@ static const TypeInfo bus_info = {
     .class_size = sizeof(BusClass),
     .instance_init = qbus_initfn,
     .instance_finalize = qbus_finalize,
+    .class_init = bus_class_init,
 };
 
 static void qdev_register_types(void)
-- 
1.8.1

[Qemu-devel] [PATCH v2 07/12] qdev: move unrealization of devices from finalize to unparent

[Paolo Bonzini]

Similarly, a bus holds a reference back to the device, and this will
prevent the device from going away as soon as this reference is counted
properly.  To avoid this, move the unrealization of devices to the
unparent callback.  This includes recursively unparenting all the buses
and (after the previous patch) the devices on those buses, which ensures
that the web of references completely disappears for all devices that
reside (in the qdev tree) below the one being unplugged.

After this patch, the qdev tree and the bus<->child relationship is
defined as "A is above B, iff unplugging A will automatically unplug B".

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/qdev.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/hw/qdev.c b/hw/qdev.c
index 83420ac..aad360f 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -738,23 +738,8 @@ static void device_initfn(Object *obj)
 static void device_finalize(Object *obj)
 {
     DeviceState *dev = DEVICE(obj);
-    BusState *bus;
-    DeviceClass *dc = DEVICE_GET_CLASS(dev);
-
-    if (dev->realized) {
-        while (dev->num_child_bus) {
-            bus = QLIST_FIRST(&dev->child_bus);
-            qbus_free(bus);
-        }
-        if (qdev_get_vmsd(dev)) {
-            vmstate_unregister(dev, qdev_get_vmsd(dev), dev);
-        }
-        if (dc->exit) {
-            dc->exit(dev);
-        }
-        if (dev->opts) {
-            qemu_opts_del(dev->opts);
-        }
+    if (dev->opts) {
+        qemu_opts_del(dev->opts);
     }
 }
 
@@ -771,8 +756,22 @@ static void device_class_base_init(ObjectClass *class, void *data)
 static void device_unparent(Object *obj)
 {
     DeviceState *dev = DEVICE(obj);
+    DeviceClass *dc = DEVICE_GET_CLASS(dev);
+    BusState *bus;
 
-    if (dev->parent_bus != NULL) {
+    while (dev->num_child_bus) {
+        bus = QLIST_FIRST(&dev->child_bus);
+        qbus_free(bus);
+    }
+    if (dev->realized) {
+        if (qdev_get_vmsd(dev)) {
+            vmstate_unregister(dev, qdev_get_vmsd(dev), dev);
+        }
+        if (dc->exit) {
+            dc->exit(dev);
+        }
+    }
+    if (dev->parent_bus) {
         bus_remove_child(dev->parent_bus, dev);
     }
 }
-- 
1.8.1

[Qemu-devel] [PATCH v2 08/12] qdev: add reference for the bus while it is referred to by the DeviceState

[Paolo Bonzini]

Now that the unparent callbacks are complete, we can correctly account
more missing references.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/qdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/qdev.c b/hw/qdev.c
index aad360f..24bb19a 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -100,6 +100,7 @@ static void bus_add_child(BusState *bus, DeviceState *child)
 void qdev_set_parent_bus(DeviceState *dev, BusState *bus)
 {
     dev->parent_bus = bus;
+    object_ref(OBJECT(bus));
     bus_add_child(bus, dev);
 }
 
@@ -773,6 +774,8 @@ static void device_unparent(Object *obj)
     }
     if (dev->parent_bus) {
         bus_remove_child(dev->parent_bus, dev);
+        object_unref(OBJECT(dev->parent_bus));
+        dev->parent_bus = NULL;
     }
 }
 
-- 
1.8.1

[Qemu-devel] [PATCH v2 09/12] qdev: inline object_delete into qbus_free/qdev_free

[Paolo Bonzini]

We want object_delete to disappear, and we will do this one class at a
time.  Inline it for the qdev case, which we will tackle first.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/qdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/qdev.c b/hw/qdev.c
index 24bb19a..e65b32f 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -267,7 +267,8 @@ void qdev_init_nofail(DeviceState *dev)
 /* Unlink device from bus and free the structure.  */
 void qdev_free(DeviceState *dev)
 {
-    object_delete(OBJECT(dev));
+    object_unparent(OBJECT(dev));
+    object_unref(OBJECT(dev));
 }
 
 void qdev_machine_creation_done(void)
@@ -472,7 +473,8 @@ BusState *qbus_create(const char *typename, DeviceState *parent, const char *nam
 
 void qbus_free(BusState *bus)
 {
-    object_delete(OBJECT(bus));
+    object_unparent(OBJECT(bus));
+    object_unref(OBJECT(bus));
 }
 
 static char *bus_get_fw_dev_path(BusState *bus, DeviceState *dev)
-- 
1.8.1

[Qemu-devel] [PATCH v2 11/12] cpu: do not use object_delete

[Paolo Bonzini]

CPUs are never added to the composition tree, so delete is achieved
simply by removing the last references to them.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-user/syscall.c        | 2 +-
 target-i386/helper.c        | 4 ++--
 target-ppc/translate_init.c | 2 +-
 target-sparc/cpu.c          | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 693e66f..a148d9f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5202,7 +5202,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                         NULL, NULL, 0);
           }
           thread_env = NULL;
-          object_delete(OBJECT(ENV_GET_CPU(cpu_env)));
+          object_unref(OBJECT(ENV_GET_CPU(cpu_env)));
           g_free(ts);
           pthread_exit(NULL);
       }
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 547c25e..269549d 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1276,14 +1276,14 @@ X86CPU *cpu_x86_init(const char *cpu_model)
     env->cpu_model_str = cpu_model;
 
     if (cpu_x86_register(cpu, cpu_model) < 0) {
-        object_delete(OBJECT(cpu));
+        object_unref(OBJECT(cpu));
         return NULL;
     }
 
     x86_cpu_realize(OBJECT(cpu), &error);
     if (error) {
         error_free(error);
-        object_delete(OBJECT(cpu));
+        object_unref(OBJECT(cpu));
         return NULL;
     }
     return cpu;
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 2d78529..ee51419 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -10346,7 +10346,7 @@ PowerPCCPU *cpu_ppc_init(const char *cpu_model)
     if (err != NULL) {
         fprintf(stderr, "%s\n", error_get_pretty(err));
         error_free(err);
-        object_delete(OBJECT(cpu));
+        object_unref(OBJECT(cpu));
         return NULL;
     }
 
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index f404aa8..4bc1afc 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -119,7 +119,7 @@ SPARCCPU *cpu_sparc_init(const char *cpu_model)
     }
 
     if (cpu_sparc_register(env, cpu_model) < 0) {
-        object_delete(OBJECT(cpu));
+        object_unref(OBJECT(cpu));
         return NULL;
     }
     qemu_init_vcpu(env);
-- 
1.8.1