Commit Graph

19257 Commits (b7c8e15a146a7b20021b524f41d6b8072ee093b5)

Author SHA1 Message Date
Blue Swirl b7c8e15a14 Merge branch 'arm-devs.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm
* 'arm-devs.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm:
  pl031: switch clock base to rtc_clock
  pl031: rearm alarm timer upon load
  arm: switch real-time clocks to rtc_clock
  omap: switch omap_lpg to vm_clock
  rtc: add -rtc clock=rt
2012-03-31 12:10:07 +00:00
Blue Swirl 4dec465460 Merge branch 'qom-cpu-unicore32.v3' of git://github.com/afaerber/qemu-cpu
* 'qom-cpu-unicore32.v3' of git://github.com/afaerber/qemu-cpu:
  target-unicore32: Move CPU-dependent init into initfn
  target-unicore32: QOM'ify CPU
  target-unicore32: License future contributions under GPLv2+
  target-unicore32: Relicense to GPLv2+
  MAINTAINERS: Add entry for UniCore32
2012-03-31 12:09:06 +00:00
Blue Swirl e7c56016f9 Merge branch 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm
* 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm:
  ARM: Permit any ARMv6K CPU to read the MVFR0 and MVFR1 VFP registers.
  target-arm: Minimalistic CPU QOM'ification
  target-arm: Drop cpu_arm_close()
2012-03-31 12:06:10 +00:00
Gerd Hoffmann 94dd53c5b6 buildfix: check for old pod2man versions
Older pod2man don't have a --utf8 switch, check for this in conffigure
and use it only when present.  Fixes build on RHEL-5.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-03-31 12:04:08 +00:00
Stefan Weil bb55b712e8 Fix conversion from lower to upper case with Turkish locale
Some locale settings let make fail or create wrong results
because tr '[:lower:]' '[:upper:]' which is used to convert
from lower to upper case depends on the locale.

With locale tr_TR.UTF-8, lower case 'i' is not converted to 'I'.
This results in wrong entries in config-host.h like these ones:

  #define CONFIG_QEMU_PREFiX "/usr/local"
  #define CONFIG_QEMU_BiNDiR "/usr/local/bin"

This problem was reported by Emre Ersin.

The same problem occurs when configure creates the target specific
files config-target.mak. They get wrong declarations:

TARGET_CRiS=y
TARGET_i386=y
TARGET_MiCROBLAZE=y
TARGET_MiPS64=y
TARGET_MiPS=y
TARGET_UNiCORE32=y

It is sufficient to restrict the conversion to the characters a-z.

Using this explicit range avoids the dependency on the locale
settings and is also shorter.

v2:
POSIX says that 'tr a-z' is unspecified outside of the POSIX
locale, so we must set LC_ALL=C to make sure that we are using
POSIX (hint from Eric Blake, thanks).

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-03-31 12:03:43 +00:00
Blue Swirl 02b3efcb75 qtest: avoid a warning with RTC test
Avoid this warning on OpenBSD:
  CC    tests/rtc-test.o
/src/qemu/tests/rtc-test.c: In function 'check_time':
/src/qemu/tests/rtc-test.c:171: warning: format '%ld' expects type 'long int', but argument 2 has type 'time_t'
/src/qemu/tests/rtc-test.c:173: warning: format '%ld' expects type 'long int', but argument 2 has type 'time_t'

Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-03-30 18:58:46 +00:00
Anthony Liguori 6b7cff76e0 qtest: fix 32-bit build
time_t appears to be an unsigned long so use %ld.

Reported-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 12:56:10 -05:00
Blue Swirl d2a16f74f2 qtest: fix out of tree build
Trace objects are also needed if tracing is enabled.

Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-03-30 17:39:33 +00:00
Anthony Liguori d1aaf543a7 qtest: add rtc-test test-case
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:12 -05:00
Anthony Liguori fd94be7ae6 rtc: split out macros into a header file and use in test case
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:12 -05:00
Anthony Liguori 49ee359077 qtest: add C version of test infrastructure
This also includes a qtest wrapper script to make it easier to launch qtest
tests directly.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:11 -05:00
Paolo Bonzini 8156be5610 qtest: add clock management
This patch combines qtest and -icount together to turn the vm_clock
into a source that can be fully managed by the client.  To this end new
commands clock_step and clock_set are added.  Hooking them with libqtest
is left as an exercise to the reader.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:11 -05:00
Paolo Bonzini 2028834574 qtest: IRQ interception infrastructure
Since /i440fx/piix3 is being removed from the composition tree, the
IO-APIC is placed under /i440fx.  This is wrong and should be changed
as soon as the /i440fx/piix3 path is put back.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:11 -05:00
Anthony Liguori c7f0f3b1c8 qtest: add test framework
The idea behind qtest is pretty simple.  Instead of executing a CPU via TCG or
KVM, rely on an external process to send events to the device model that the CPU
would normally generate.

qtest presents itself as an accelerator.  In addition, a new option is added to
establish a qtest server (-qtest) that takes a character device.  This is what
allows the external process to send CPU events to the device model.

qtest uses a simple line based protocol to send the events.  Documentation of
that protocol is in qtest.c.

I considered reusing the monitor for this job.  Adding interrupts would be a bit
difficult.  In addition, logging would also be difficult.

qtest has extensive logging support.  All protocol commands are logged with
time stamps using a new command line option (-qtest-log).  Logging is important
since ultimately, this is a feature for debugging.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:11 -05:00
Paolo Bonzini b93b63f574 test makefile overhaul
This introduces new test reporting infrastructure based on
gtester and gtester-report.

Also, all existing tests are moved to tests/, and tests/Makefile
is reorganized to factor out the commonalities in the rules.

Signed-off-by: Anthony Liguori <aliguori@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-30 08:14:11 -05:00
Paolo Bonzini b0f26631bc pl031: switch clock base to rtc_clock
This lets the user specify the desired semantics.  By default, the RTC
will follow adjustments from the host's NTP client, and will remain in
sync when the virtual machine is stopped.  The previous behavior, which
provides determinism with both icount and qtest, remains available with
"-rtc clock=vm".

pl031 supports migration, so we need to convert the time base from
rtc_clock to vm_clock and back for backwards compatibility.  (The
rtc_clock may not be synchronized on the two machines, especially with
savevm/loadvm, so the conversion is needed anyway.  And since any time
base will do, why not pick the one base that is backwards compatible).

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-30 10:31:23 +00:00
Paolo Bonzini ac204b8f67 pl031: rearm alarm timer upon load
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-30 10:31:22 +00:00
Paolo Bonzini 348abc86c8 arm: switch real-time clocks to rtc_clock
This lets the user specify the desired semantics.  By default, the RTC
will follow adjustments from the host's NTP client.  "-rtc clock=vm" will
improve determinism with both icount and qtest.  Finally, the previous
behavior is available with "-rtc clock=rt".

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-30 10:31:22 +00:00
Paolo Bonzini e230d4e8bd omap: switch omap_lpg to vm_clock
The output of the pulse generator needs to be deterministic when
running in -icount mode, and to remain constant whenever the VM is
stopped.  So the right clock to use is vm_clock.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-30 10:31:22 +00:00
Paolo Bonzini 788081417a rtc: add -rtc clock=rt
This will let people use backwards-compatible semantics for devices that
will be affected by the following patches.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-30 10:31:21 +00:00
Andrew Towers 06ed5d66f7 ARM: Permit any ARMv6K CPU to read the MVFR0 and MVFR1 VFP registers.
This patch replaces the ARM_FEATURE_VFP3 test when reading MVFR registers
with a test for a new feature flag ARM_FEATURE_MVFR, and sets this feature
for all ARMv6K cores (ARM1156 is not a v6K core, yet supports MVFR; qemu
does not support ARM1156 at this time.)

MVFR0 and MVFR1 were introduced in ARM1136JF-S r1p0 (ARMv6K, VFPv2) and are
present in ARM1156T2F-S (non-v6K), ARM1176JZF-S, ARM11MPCore and newer cores.
Reference: ARM DDI 0211H, 0290G, 0301H, 0360E.
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0211h/Ffbefjag.html

Without this change, the linux kernel will not boot with VFP support enabled
under ARM1176 system emulation, due to the unconditional use of MVFR1 at the
end of vfp_init() in arch/arm/vfp/vfpmodule.c:

  VFP support v0.3: implemetor 41 architecture 1 part 20 variant b rev 5
  Internal error: Oops - undefined instruction: 0 [#1]

Signed-off-by: Andrew Towers <atowers@gmail.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-30 10:10:49 +00:00
Andreas Färber 8df9082da6 target-unicore32: Move CPU-dependent init into initfn
Instead of setting values in a CPUID switch, do so in initfn functions.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
2012-03-30 11:09:31 +02:00
Andreas Färber ae0f5e9ea8 target-unicore32: QOM'ify CPU
Embed CPUUniCore32State as first member of UniCore32CPU.

Contributed under GPLv2+.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
2012-03-30 11:09:30 +02:00
Andreas Färber c3a8baa90d target-unicore32: License future contributions under GPLv2+
This is to limit relicensing obstacles to the pending IBM investigation.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
2012-03-30 11:09:30 +02:00
Andreas Färber 2b3bc6c0f5 target-unicore32: Relicense to GPLv2+
Adopt the license text suggested by Guan Xue-tao (with a minor
simplification) for all target-unicore/ files except helper.c.

To helper.c Anthony Liguori contributed a qemu_malloc() -> g_malloc()
conversion, still pending IBM relicensing approval, so that remains
GPLv2 for now.

By relicensing all possible parts now, we avoid having to formally
relicense new, e.g., QOM code.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Dor Laor <dlaor@redhat.com>
2012-03-30 11:09:30 +02:00
Andreas Färber a6ea7b4c5e MAINTAINERS: Add entry for UniCore32
Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
2012-03-30 11:09:30 +02:00
Anthony Liguori 040b66f3f9 Merge remote-tracking branch 'origin/master' into staging
* origin/master:
  qemu tcg: Remove one entry of INDEX_op_ld_i64 from ppc_op_defs
2012-03-29 13:32:41 -05:00
Andreas Färber dec9c2d430 target-arm: Minimalistic CPU QOM'ification
Introduce only one non-abstract type TYPE_ARM_CPU and do not touch
cp15 registers to not interfere with Peter's ongoing remodelling.
Embed CPUARMState as first (additional) field of ARMCPU.

Let CPUClass::reset() call cpu_state_reset() for now.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-29 15:42:50 +00:00
Andreas Färber 0bcd08b352 target-arm: Drop cpu_arm_close()
It's unused, so no need to QOM'ify it later.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-03-29 15:40:53 +00:00
Li Zhang f638f0d3ae qemu tcg: Remove one entry of INDEX_op_ld_i64 from ppc_op_defs
There two entries of INDEX_op_ld_i64 in the ppc_op_defs.  That causes an
assertion failure in tcg_add_target_add_op_defs() when --enable-debug is
used on a ppc64 backend (that's ppc64 host, not target).

Signed-off-by: Li Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: malc <av1474@comtv.ru>
2012-03-29 11:10:08 +04:00
Anthony Liguori cbd5979bb2 Merge remote-tracking branch 'sstabellini/disk_io' into staging
* sstabellini/disk_io:
  xen_disk: when using AIO flush after the operation is completed
  xen_disk: open disk with BDRV_O_NOCACHE | BDRV_O_CACHE_WB | BDRV_O_NATIVE_AIO
2012-03-28 12:46:39 -05:00
Anthony Liguori 49e00ba969 Merge remote-tracking branch 'sstabellini/xen-fixes' into staging
* sstabellini/xen-fixes:
  xen_disk: detach the blkdev before bdrv_delete
  xen_console: ignore console disconnect events from console/0
2012-03-28 12:46:11 -05:00
Anthony Liguori c76d1a9b3f Merge remote-tracking branch 'qmp/queue/qmp' into staging
* qmp/queue/qmp:
  qmp: document strict parsing
  qmp: parse commands in strict mode
  qmp: add and use q type specifier
  qapi: add strict mode to input visitor
  qapi: place outermost object on qiv stack
  qapi: untangle next_list
  qapi: allow freeing partially-allocated objects
  qapi: shortcut visits on errors
  qapi: fix memory leak on error
  qapi: fail hard on stack imbalance
  qapi: add a test case for type errors
  qapi: add struct-errors test case to test-qmp-output-visitor
  qapi: fix double free in qmp_output_visitor_cleanup()
2012-03-28 12:45:22 -05:00
Anthony Liguori 0a5a4e0568 Merge remote-tracking branch 'alon/libcacard' into staging
* alon/libcacard:
  libcacard/vcard_emul_nss: add warning for old coolkey
  libcacard/vcard_emul_nss: handle no readers at startup
  libcacard/vcard_emul_nss: don't stop thread when there are no slots
2012-03-28 12:44:04 -05:00
Blue Swirl 1658dd3240 sparc: pass page aligned addresses to tlb_set_page
Mask incoming page address early so that resolved addresses
are page aligned. Remove further address masking.

Tested-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-03-27 19:46:42 +00:00
Stefano Stabellini 7429f2e198 xen_disk: detach the blkdev before bdrv_delete
We need to detach the blkdev from the BlockDriverState before calling
bdrv_delete.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2012-03-27 16:05:21 +00:00
Stefano Stabellini 028c85f0ff xen_console: ignore console disconnect events from console/0
The first console has a different location compared to other PV devices
(console, rather than device/console/0) and doesn't obey the xenstore
state protocol. We already special case the first console in con_init
and con_initialise, we should also do it in con_disconnect.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2012-03-27 16:05:15 +00:00
Paolo Bonzini 1829851cfe qmp: document strict parsing
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:15:52 -03:00
Paolo Bonzini 6d36d7dc2b qmp: parse commands in strict mode
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:15:41 -03:00
Paolo Bonzini b9f8978cc4 qmp: add and use q type specifier
"O" is being used by the transaction and qom-set commands to mean "any
QObject", but it really means "do not validate the argument list".
Add a new specifier with the correct meaning.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:15:28 -03:00
Paolo Bonzini e38ac9621c qapi: add strict mode to input visitor
While QMP in general is designed so that it is possible to ignore
unknown arguments, in the case of the QMP server it is better to
reject them to detect bad clients.  In fact, we're already doing
this at the top level in the argument checker.  To extend this to
complex structures, add a mode to the input visitor where it checks
for unvisited keys and raises an error if it finds one.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:15:13 -03:00
Paolo Bonzini 4faaec6acf qapi: place outermost object on qiv stack
This is a slight change in the implementation of QMPInputVisitor
that helps when adding strict mode.

Const QObjects cannot be inc/decref-ed, and that's why QMPInputVisitor
relies heavily on weak references to inner objects.  I'm not removing
the weak references now, but since refcount+const is a lost battle in C
(C++ has "mutable") I think removing const is fine in this case.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:15:08 -03:00
Paolo Bonzini 3a86a0fa76 qapi: untangle next_list
Right now, the semantics of next_list are complicated.  The caller must:

* call start_list

* call next_list for each element *including the first*

* on the first call to next_list, the second argument should point to
NULL and the result is the head of the list.  On subsequent calls,
the second argument should point to the last node (last result of
next_list) and next_list itself tacks the element at the tail of the
list.

This works for both input and output visitor, but having the visitor
write memory when it is only reading the list is ugly.  Plus, relying
on *list to detect the first call is tricky and undocumented.

We can initialize so->entry in next_list instead of start_list, leaving
it NULL in start_list.  This way next_list sees clearly whether it is
on the first call---as a bonus, it discriminates the cases based on
internal state of the visitor rather than external state.  We can
also pull the assignment of the list head from generated code up to
next_list.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:14:19 -03:00
Paolo Bonzini 69b50071d8 qapi: allow freeing partially-allocated objects
Objects going through the dealloc visitor can be only partially allocated.
Detect the situation and avoid a segfault.  This also helps with the
input visitor, when there are errors.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:14:06 -03:00
Paolo Bonzini b6f0474fc0 qapi: shortcut visits on errors
We can exit very soon if we enter a visitor with a preexisting error.
This simplifies some cases because we will not have to deal with
obj being non-NULL while *obj is NULL.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:13:57 -03:00
Paolo Bonzini 8b714d3747 qapi: fix memory leak on error
QmpInputVisitor would leak the malloced struct if the stack was
overflowed.  This can be easily fixed using error_propagate.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:13:48 -03:00
Paolo Bonzini 2c7ff93359 qapi: fail hard on stack imbalance
QmpOutputVisitor will segfault if an imbalanced end function is
called.  So we can abort in QmpInputVisitor too.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:13:39 -03:00
Paolo Bonzini 3dcf71f632 qapi: add a test case for type errors
There is no test case for parse errors, add one.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:12:20 -03:00
Paolo Bonzini 9e9eace89e qapi: add struct-errors test case to test-qmp-output-visitor
This test case verifies that invalid native enums are caught, and causes
qapi to tear down the QObject tree under construction, exercising the
previous patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:11:00 -03:00
Laszlo Ersek f24582d6ad qapi: fix double free in qmp_output_visitor_cleanup()
Stack entries in QmpOutputVisitor are navigation links (weak references),
except the bottom (ie. least recently added) entry, which owns the root
QObject [1]. Make qmp_output_visitor_cleanup() drop the stack entries,
then release the QObject tree by the root.

Attempting to serialize an invalid enum inside a dictionary is an example
for triggering the double free.

[1] http://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg03276.html

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2012-03-27 09:11:00 -03:00