Peter Crosthwaite <peter.crosthwa...@xilinx.com> writes:
> num_interfaces only tells you how many interfaces the concrete child class has
> (as defined in the TypeInfo). This means if you have a child class which
> defines
> no interfaces of its own, but its parent has interfaces you cannot cast to
> those
> parent interfaces.
>
> Fixed changing the guard to check the class->interfaces list instead (which is
> a complete flattened list of implemented interfaces).
>
> Signed-off-by: Peter Crosthwaite <peter.crosthwa...@xilinx.com>
I must admit I don't understand it yet, but this breaks hot unplug.
Here is the qemu-test output:
[aliguori@ccnode4 qemu-test]$ QEMU_TEST_SEED=45240 ./qemu-test
~/build/qemu/x86_64-softmmu/qemu-system-x86_64 tests/device-del.sh
Using RANDOM seed 45240
Testing nic
Formatting '.tmp-31849/disk.img', fmt=qcow2 size=10737418240 encryption=off
cluster_size=65536 lazy_refcounts=off
/home/aliguori/build/qemu/x86_64-softmmu/qemu-system-x86_64 -kernel
/usr/local/share/qemu-jeos/kernel-x86_64-pc -initrd
.tmp-31849/initramfs-31849.img.gz -device isa-debug-exit -append console=ttyS0
seed=45240 -nographic -enable-kvm -device virtio-balloon-pci -pidfile
.tmp-31849/pidfile-31849.pid -qmp
unix:.tmp-31849/qmpsock-31849.sock,server,nowait
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.4.0 (root@ccnode4) (gcc version 4.6.4 20120830
(prerelease) (GCC) ) #2 SMP Mon Dec 3 19:40:41 CST 2012
[ 0.000000] Command line: console=ttyS0 seed=45240
[ 0.000000] BIOS-provided physical RAM map:
<- snip ->
[ 0.865631] Freeing unused kernel memory: 584k freed
[ 0.866320] Write protecting the kernel read-only data: 12288k
[ 0.868626] Freeing unused kernel memory: 640k freed
[ 0.873366] Freeing unused kernel memory: 1724k freed
Setting guest RANDOM seed to 45240
*** Running tests ***
/tests/device-del.sh
Running test /tests/device-del.sh...
** waiting for hotplug **
./tests/device-del.sh: line 36: test: !=: unary operator expected
** waiting for remove **
** waiting for guest to see device **
./qemu-test: line 99: 31883 Segmentation fault (core dumped) "$@"
The backtrace is:
Program terminated with signal 11, Segmentation fault.
#0 qemu_bh_delete (bh=0x0) at /home/aliguori/git/qemu/async.c:116
116 bh->scheduled = 0;
Missing separate debuginfos, use: debuginfo-install
bzip2-libs-1.0.6-7.fc18.x86_64 glib2-2.34.2-2.fc18.x86_64
glibc-2.16-28.fc18.x86_64 libaio-0.3.109-6.fc18.x86_64
libgcc-4.7.2-8.fc18.x86_64 pixman-0.26.2-5.fc18.x86_64
xen-libs-4.2.1-5.fc18.x86_64 xz-libs-5.1.2-2alpha.fc18.x86_64
zlib-1.2.7-9.fc18.x86_64
(gdb) bt
#0 qemu_bh_delete (bh=0x0) at /home/aliguori/git/qemu/async.c:116
#1 0x00007f55cac9bd95 in virtio_net_exit (vdev=0x7f55cd6eb960)
at /home/aliguori/git/qemu/hw/virtio-net.c:1413
#2 0x00007f55cabde7f9 in virtio_net_exit_pci (pci_dev=0x7f55cd668260)
at /home/aliguori/git/qemu/hw/virtio-pci.c:1016
#3 0x00007f55cab92e4a in pci_unregister_device (dev=<optimized out>)
at /home/aliguori/git/qemu/hw/pci/pci.c:889
#4 0x00007f55caba7485 in device_unparent (obj=<optimized out>)
at /home/aliguori/git/qemu/hw/qdev.c:773
#5 0x00007f55cac1ea0f in object_unparent (obj=0x7f55cd668260)
at /home/aliguori/git/qemu/qom/object.c:370
#6 0x00007f55caba7a4d in qdev_free (dev=<optimized out>)
at /home/aliguori/git/qemu/hw/qdev.c:270
#7 0x00007f55cab38da0 in acpi_piix_eject_slot (s=0x7f55cd68fd50,
slots=<optimized out>) at /home/aliguori/git/qemu/hw/acpi_piix4.c:306
#8 0x00007f55caca70f2 in access_with_adjusted_size (addr=addr@entry=8,
value=value@entry=0x7f55c8104c28, size=4, access_size_min=<optimized out>,
access_size_max=<optimized out>, access=access@entry=
0x7f55caca7710 <memory_region_write_accessor>, opaque=opaque@entry=
0x7f55cd690540) at /home/aliguori/git/qemu/memory.c:364
#9 0x00007f55caca8767 in memory_region_iorange_write (
iorange=<optimized out>, offset=8, width=4, data=32)
at /home/aliguori/git/qemu/memory.c:439
It very much looks like a double free to me of the device.
The test is doing a simple device_del in the monitor.
Regards,
Anthony Liguori
> ---
> changed from v1:
> Change guard implementation rather than removed it (Paolo review)
>
> qom/object.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/qom/object.c b/qom/object.c
> index 4b72a64..3d638ff 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -449,7 +449,8 @@ ObjectClass *object_class_dynamic_cast(ObjectClass *class,
> TypeImpl *type = class->type;
> ObjectClass *ret = NULL;
>
> - if (type->num_interfaces && type_is_ancestor(target_type,
> type_interface)) {
> + if (type->class->interfaces &&
> + type_is_ancestor(target_type, type_interface)) {
> int found = 0;
> GSList *i;
>
> --
> 1.7.0.4
