Re: [Qemu-devel] [PATCH v4 13/28] qapi: Add new clone visitor

[Markus Armbruster]

Eric Blake <address@hidden> writes:

> We have a couple places in the code base that want to deep-clone
> one QAPI object into another, and they were resorting to serializing
> the struct out to QObject then reparsing it.  A much more efficient
> version can be done by adding a new clone visitor.
>
> Since cloning is still relatively uncommon, expose the use of the
> new visitor via a QAPI_CLONE() macro that takes care of type-punning
> the underlying function pointer, rather than generating lots of
> unused functions for types that won't be cloned.  And yes, we're
> relying on the compiler treating all pointers equally, even though
> a strict C program cannot portably do so - but we're not the first
> one in the qemu code base to expect it to work (hello, glib!).
>
> Note that we can only clone objects (including alternates) and lists,
> not built-ins or enums.  The visitor core hides integer width from
> the actual visitor (since commit 04e070d), and as long as that's the
> case, we can't clone top-level integers.  Then again, those can
> always be cloned by direct copy, since they are not objects with
> deep pointers, so it's no real loss.  And restricting cloning to
> just objects and lists is cleaner than restricting it to non-integers.
> As such, I documented that the clone visitor is for direct use only
> by code internal to QAPI.
>
> Scalars not at the root of the clone copy just fine, by virtue of a
> g_memdup() each time we push another struct onto the stack.
>
> Cloning an 'any' type could be possible by incrementing the QObject
> refcnt, but it's not obvious whether that is better than implementing
> a QObject deep clone.  So for now, we document it as unsupported,
> and intentionally omit the .type_any() callback to let a developer
> know their usage needs implementation.
>
> The choice of adding a fourth visitor type deserves some explanation.
> On the surface, the clone visitor is mostly an input visitor (it
> takes arbitrary input - in this case, another QAPI object - and
> creates a new QAPI object during the course of the visit).  But
> ever since commit da72ab0 consolidated enum visits based on the
> visitor type, using VISITOR_INPUT would cause us to run
> visit_type_str(), even though for cloning there is nothing to do
> (we just copy the enum value across, without regards to its mapping
> to strings).   Also, since our input happens to be a QAPI object,
> we can also satisfy the internal checks for VISITOR_OUTPUT.  So in
> the end, I settled with a new VISITOR_CLONE, and chose its value
> such that many internal checks can use 'v->type & mask', sticking
> to 'v->type == value' where the difference matters.
>
> Add testsuite coverage for several different clone situations, to
> ensure that the code is working.  I also tested that valgrind was
> happy with the test.
>
> Signed-off-by: Eric Blake <address@hidden>
>
> ---
> v4: hoist earlier in series, drop wasted generated functions and
> replace it with QAPI_CLONE() macro, drop 'any' support, tweak
> core assertion checking, internal improve commit message
> v3: new patch
> ---
>  include/qapi/visitor.h       |  33 ++++---
>  include/qapi/visitor-impl.h  |  12 +--
>  include/qapi/clone-visitor.h |  37 ++++++++
>  qapi/qapi-visit-core.c       |  18 ++--
>  qapi/qapi-clone-visitor.c    | 178 +++++++++++++++++++++++++++++++++++++
>  tests/test-clone-visitor.c   | 207 
> +++++++++++++++++++++++++++++++++++++++++++
>  qapi/Makefile.objs           |   2 +-
>  tests/.gitignore             |   1 +
>  tests/Makefile               |   4 +
>  9 files changed, 466 insertions(+), 26 deletions(-)
>  create mode 100644 include/qapi/clone-visitor.h
>  create mode 100644 qapi/qapi-clone-visitor.c
>  create mode 100644 tests/test-clone-visitor.c
>
> diff --git a/include/qapi/visitor.h b/include/qapi/visitor.h
> index b3bd97c..3f46921 100644
> --- a/include/qapi/visitor.h
> +++ b/include/qapi/visitor.h
> @@ -24,15 +24,16 @@
>   * for doing work at each node of a QAPI graph; it can also be used
>   * for a virtual walk, where there is no actual QAPI C struct.
>   *
> - * There are three kinds of visitor classes: input visitors (QMP,
> + * There are four kinds of visitor classes: input visitors (QMP,
>   * string, and QemuOpts) parse an external representation and build
>   * the corresponding QAPI graph, output visitors (QMP and string) take
> - * a completed QAPI graph and generate an external representation, and
> - * the dealloc visitor can take a QAPI graph (possibly partially
> - * constructed) and recursively free its resources.  While the dealloc
> - * and QMP input/output visitors are general, the string and QemuOpts
> - * visitors have some implementation limitations; see the
> - * documentation for each visitor for more details on what it
> + * a completed QAPI graph and generate an external representation, the
> + * dealloc visitor can take a QAPI graph (possibly partially
> + * constructed) and recursively free its resources, and the clone
> + * visitor performs a deep clone of one QAPI object to another.  While
> + * the dealloc and QMP input/output visitors are general, the string,
> + * QemuOpts, and clone visitors have some implementation limitations;
> + * see the documentation for each visitor for more details on what it
>   * supports.  Also, see visitor-impl.h for the callback contracts
>   * implemented by each visitor, and docs/qapi-code-gen.txt for more
>   * about the QAPI code generator.
[...]
    * If an error is detected during visit_type_FOO() with an input
    * visitor, then address@hidden will be NULL for pointer types, and left
    * unchanged for scalar types.  Using an output visitor with an
    * incomplete object has undefined behavior (other than a special case
    * for visit_type_str() treating NULL like ""), while the dealloc
    * visitor safely handles incomplete objects.  Since input visitors
    * never produce an incomplete object, such an object is possible only
    * by manual construction.

What about the clone visitor?

> @@ -102,11 +103,19 @@
>   *
>   * void qapi_free_FOO(FOO *obj);
>   *
> - * which behaves like free() in that @obj may be NULL.  Because of
> - * these functions, the dealloc visitor is seldom used directly
> - * outside of generated code.  QAPI types can also inherit from a base
> - * class; when this happens, a function is generated for easily going
> - * from the derived type to the base type:
> + * where behaves like free() in that @obj may be NULL.  Such objects
> + * may also be used with the following macro, provided alongside the
> + * clone visitor:
> + *
> + * Type *QAPI_CLONE(Type, src);
> + *
> + * in order to perform a deep clone of @src.  Because of the generated
> + * qapi_free functions and the QAPI_CLONE() macro, the clone and
> + * dealloc visitor should not be used directly outside of QAPI code.
> + *
> + * QAPI types can also inherit from a base class; when this happens, a
> + * function is generated for easily going from the derived type to the
> + * base type:
>   *
>   * BASE *qapi_CHILD_base(CHILD *obj);
>   *



> diff --git a/include/qapi/visitor-impl.h b/include/qapi/visitor-impl.h
> index 16e0b86..29fac2b 100644
> --- a/include/qapi/visitor-impl.h
> +++ b/include/qapi/visitor-impl.h
> @@ -27,14 +27,16 @@
>   */
>
>  /*
> - * There are three classes of visitors; setting the class determines
> + * There are four classes of visitors; setting the class determines
>   * how QAPI enums are visited, as well as what additional restrictions
> - * can be asserted.
> + * can be asserted.  The values are intentionally chosen so as to
> + * permit some assertions based on whether a given bit is set.

We'll see below that the code now wants to accept a VISITOR_CLONE in
addition to VISITOR_INPUT in most places, and similarly in addition to
VISITOR_OUTPUT.  Subtle.

>   */
>  typedef enum VisitorType {
> -    VISITOR_INPUT,
> -    VISITOR_OUTPUT,
> -    VISITOR_DEALLOC,
> +    VISITOR_INPUT = 1,
> +    VISITOR_OUTPUT = 2,
> +    VISITOR_CLONE = 3,
> +    VISITOR_DEALLOC = 4,
>  } VisitorType;
>
>  struct Visitor
[...]
   /*** Visiting structures ***/

   /*
    * Start visiting an object @obj (struct or union).
    *
    * @name expresses the relationship of this object to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL for a real walk, in which case @size
    * determines how much memory an input visitor will allocate into
    * address@hidden  @obj may also be NULL for a virtual walk, in which case
    * @size is ignored.

What about the clone visitor?

    *
    * @errp obeys typical error usage, and reports failures such as a
    * member @name is not present, or present but not an object.  On
    * error, input visitors set address@hidden to NULL.

What about the clone visitor?

    *
    * After visit_start_struct() succeeds, the caller may visit its
    * members one after the other, passing the member's name and address
    * within the struct.  Finally, visit_end_struct() needs to be called
    * with the same @obj to clean up, even if intermediate visits fail.
    * See the examples above.
    *
    * FIXME Should this be named visit_start_object, since it is also
    * used for QAPI unions, and maps to JSON objects?
    */
   void visit_start_struct(Visitor *v, const char *name, void **obj,
                           size_t size, Error **errp);
[...]
   /*** Visiting lists ***/

   /*
    * Start visiting a list.
    *
    * @name expresses the relationship of this list to its parent
    * container; see the general description of @name above.
    *
    * @list must be non-NULL for a real walk, in which case @size
    * determines how much memory an input visitor will allocate into
    * address@hidden (at least sizeof(GenericList)).  Some visitors also allow
    * @list to be NULL for a virtual walk, in which case @size is
    * ignored.

What about the clone visitor?

    *
    * @errp obeys typical error usage, and reports failures such as a
    * member @name is not present, or present but not a list.  On error,
    * input visitors set address@hidden to NULL.

What about the clone visitor?

    *
    * After visit_start_list() succeeds, the caller may visit its members
    * one after the other.  A real visit (where @obj is non-NULL) uses
    * visit_next_list() for traversing the linked list, while a virtual
    * visit (where @obj is NULL) uses other means.  For each list
    * element, call the appropriate visit_type_FOO() with name set to
    * NULL and obj set to the address of the value member of the list
    * element.  Finally, visit_end_list() needs to be called with the
    * same @list to clean up, even if intermediate visits fail.  See the
    * examples above.
    */
   void visit_start_list(Visitor *v, const char *name, GenericList **list,
                         size_t size, Error **errp);
[...]
   /*** Visiting alternates ***/

   /*
    * Start the visit of an alternate @obj.
    *
    * @name expresses the relationship of this alternate to its parent
    * container; see the general description of @name above.
    *
    * @obj must not be NULL. Input visitors use @size to determine how
    * much memory to allocate into address@hidden, then determine the qtype of 
the
    * next thing to be visited, stored in (address@hidden)->type.  Other 
visitors
    * will leave @obj unchanged.

What about the clone visitor?

    *
    * If @promote_int, treat integers as QTYPE_FLOAT.
    *
    * If successful, this must be paired with visit_end_alternate() with
    * the same @obj to clean up, even if visiting the contents of the
    * alternate fails.
    */
[...]
   /*** Other helpers ***/

   /*
    * Does optional struct member @name need visiting?
    *
    * @name must not be NULL.  This function is only useful between
    * visit_start_struct() and visit_end_struct(), since only objects
    * have optional keys.
    *
    * @present points to the address of the optional member's has_ flag.
    *
    * Input visitors set address@hidden according to input; other visitors
    * leave it unchanged.  In either case, return address@hidden for
    * convenience.

I guess this is correct for the clone visitor.

    */
   bool visit_optional(Visitor *v, const char *name, bool *present);

   /*
    * Visit an enum value.
    *
    * @name expresses the relationship of this enum to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL.  Input visitors parse input and set address@hidden 
to
    * the enumeration value, leaving @obj unchanged on error; other
    * visitors use address@hidden but leave it unchanged.

I guess this is correct for the clone visitor.

    *
    * Currently, all input visitors parse text input, and all output
    * visitors produce text output.  The mapping between enumeration
    * values and strings is done by the visitor core, using @strings; it
    * should be the ENUM_lookup array from visit-types.h.
    *
    * May call visit_type_str() under the hood, and the enum visit may
    * fail even if the corresponding string visit succeeded; this implies
    * that visit_type_str() must have no unwelcome side effects.
    */
   void visit_type_enum(Visitor *v, const char *name, int *obj,
                        const char *const strings[], Error **errp);

   /*
    * Check if visitor is an input visitor.

Does the clone visitor count as input visitor here?  Should it?

    */
   bool visit_is_input(Visitor *v);

   /*** Visiting built-in types ***/

   /*
    * Visit an integer value.
    *
    * @name expresses the relationship of this integer to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL.  Input visitors set address@hidden to the value;
    * other visitors will leave address@hidden unchanged.

I guess this is correct for the clone visitor.

    */
   void visit_type_int(Visitor *v, const char *name, int64_t *obj, Error 
**errp);
[...]
   /*
    * Visit a boolean value.
    *
    * @name expresses the relationship of this boolean to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL.  Input visitors set address@hidden to the value;
    * other visitors will leave address@hidden unchanged.

I guess this is correct for the clone visitor.

    */
   void visit_type_bool(Visitor *v, const char *name, bool *obj, Error **errp);

   /*
    * Visit a string value.
    *
    * @name expresses the relationship of this string to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL.  Input visitors set address@hidden to the value
    * (never NULL).  Other visitors leave address@hidden unchanged, and commonly
    * treat NULL like "".

I guess this is correct for the clone visitor.

    *
    * It is safe to cast away const when preparing a (const char *) value
    * into @obj for use by an output visitor.
    *
    * FIXME: Callers that try to output NULL *obj should not be allowed.
    */
   void visit_type_str(Visitor *v, const char *name, char **obj, Error **errp);

   /*
    * Visit a number (i.e. double) value.
    *
    * @name expresses the relationship of this number to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL.  Input visitors set address@hidden to the value;
    * other visitors will leave address@hidden unchanged.  Visitors should
    * document if infinity or NaN are not permitted.

I guess this is correct for the clone visitor.

    */
   void visit_type_number(Visitor *v, const char *name, double *obj,
                          Error **errp);

   /*
    * Visit an arbitrary value.
    *
    * @name expresses the relationship of this value to its parent
    * container; see the general description of @name above.
    *
    * @obj must be non-NULL.  Input visitors set address@hidden to the value;
    * other visitors will leave address@hidden unchanged.  address@hidden must 
be non-NULL
    * for output visitors.

Fine, as the clone visitor doesn't support any.

    */
   void visit_type_any(Visitor *v, const char *name, QObject **obj, Error 
**errp);

> diff --git a/include/qapi/clone-visitor.h b/include/qapi/clone-visitor.h
> new file mode 100644
> index 0000000..16ceff5
> --- /dev/null
> +++ b/include/qapi/clone-visitor.h
> @@ -0,0 +1,37 @@
> +/*
> + * Clone Visitor
> + *
> + * Copyright (C) 2016 Red Hat, Inc.
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> + * See the COPYING file in the top-level directory.
> + *
> + */
> +
> +#ifndef QAPI_CLONE_VISITOR_H
> +#define QAPI_CLONE_VISITOR_H
> +
> +#include "qapi/visitor.h"
> +
> +/*
> + * The clone visitor is for direct use only by the QAPI_CLONE() macro;
> + * it requires that the root visit occur on an object, list, or
> + * alternate, and is not usable directly on built-in QAPI types.
> + */
> +typedef struct QapiCloneVisitor QapiCloneVisitor;
> +
> +void *qapi_clone(const void *src, void (*visit_type)(Visitor *, const char *,
> +                                                     void **, Error **));
> +
> +/*
> + * Deep-clone QAPI object @src of the given @type, and return the result.
> + *
> + * Not usable on QAPI scalars (integers, strings, enums), nor on a
> + * QAPI object that references the 'any' type.  Safe when @src is NULL.
> + */
> +#define QAPI_CLONE(type, src)                                           \
> +    ((type *)qapi_clone(src,                                            \
> +                        (void (*)(Visitor *, const char *, void**,      \
> +                                  Error **))visit_type_ ## type))

This casts visit_type_FOO(), where FOO is a QAPI-generated complex or
alternate type, from

    void (*)(Visitor *, const char *, FOO **, Error **)

to

    void (*)(Visitor *, const char *, void **, Error **)

Okay.  Can't see how to avoid the type-punning without generating lots
of wrapper functions.

Note that scalar QAPI types have one * less: FOO * instead of FOO **.
But they're explicitly not permitted here.

> +
> +#endif
> diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c
> index 279ea8e..c5bdca2 100644
> --- a/qapi/qapi-visit-core.c
> +++ b/qapi/qapi-visit-core.c

As we'll see further down, @obj points into the clone, except at the
root, where it points to qapi_clone()'s local variable @dst.  A
pointer-valued address@hidden still points into the source.

Now let's go through the v->type checks real slow.

First one:

   void visit_complete(Visitor *v, void *opaque)
   {
       if (v->type == VISITOR_OUTPUT) {
           assert(v->complete);
       }

An output visitor needs a complete(), because without it, there's no way
to get the output (unless you resort to side effects).
qapi-visit-core.c chooses to enforce this.  Not really necessary,
because qapi-visit-core.c works just fine without it.

The clone visitor has no use for complete, because it returns its output
differently: qapi_clone() returns it.  Therefore, we don't want to treat
clone as output here.  Okay.

> @@ -44,10 +44,10 @@ void visit_start_struct(Visitor *v, const char *name, 
> void **obj,
>
>      if (obj) {
>          assert(size);
> -        assert(v->type != VISITOR_OUTPUT || *obj);
> +        assert(!(v->type & VISITOR_OUTPUT) || *obj);
>      }

For real walks (obj != NULL):

* Input visitors write *obj, and don't care for the old value.

* Output visitors read *obj, and a struct can't be null.

* The dealloc visitor reads *obj, but null is fine (partially
  constructed object).

* The clone visitor reads like an output visitor (except at the root)
  and writes like an input visitor.

Before the patch, we assert "if output visitor, then *obj isn't null".

After the patch, we do the same for the clone visitor.  Correct, except
at the root.  There, @obj points to qapi_clone()'s @dst, which is
uninitialized.  I'm afraid this assertion fails if @dst happens to be
null.

Can we fix this by removing the "except at the root" special case?
Change qapi_clone to initialize dst = src, drop QapiCloneVisitor member
@root and qapi_clone_visitor_new() parameter @src.

>      v->start_struct(v, name, obj, size, &err);
> -    if (obj && v->type == VISITOR_INPUT) {
> +    if (obj && (v->type & VISITOR_INPUT)) {
>          assert(!err != !*obj);
>      }

Before the patch, we assert "input visitor must either fail or create
*obj for a real walk."

After the patch, we do the same for the clone visitor.  Okay.

>      error_propagate(errp, err);
> @@ -72,7 +72,7 @@ void visit_start_list(Visitor *v, const char *name, 
> GenericList **list,
>
>      assert(!list || size >= sizeof(GenericList));
>      v->start_list(v, name, list, size, &err);
> -    if (list && v->type == VISITOR_INPUT) {
> +    if (list && (v->type & VISITOR_INPUT)) {
>          assert(!(err && *list));
>      }

Likewise.

>      error_propagate(errp, err);
> @@ -96,11 +96,11 @@ void visit_start_alternate(Visitor *v, const char *name,
>      Error *err = NULL;
>
>      assert(obj && size >= sizeof(GenericAlternate));
> -    assert(v->type != VISITOR_OUTPUT || *obj);
> +    assert(!(v->type & VISITOR_OUTPUT) || *obj);
>      if (v->start_alternate) {
>          v->start_alternate(v, name, obj, size, promote_int, &err);
>      }
> -    if (v->type == VISITOR_INPUT) {
> +    if (v->type & VISITOR_INPUT) {
>          assert(v->start_alternate && !err != !*obj);
>      }
>      error_propagate(errp, err);

Same analysis as for visit_start_struct().

[...]
   bool visit_is_input(Visitor *v)
   {
       return v->type == VISITOR_INPUT;
   }

This answers my question "Does the clone visitor count as input visitor
here?"  Remaining question: "Should it?"

> @@ -252,9 +252,10 @@ void visit_type_str(Visitor *v, const char *name, char 
> **obj, Error **errp)
>      assert(obj);
>      /* TODO: Fix callers to not pass NULL when they mean "", so that we
>       * can enable:
> -    assert(v->type != VISITOR_OUTPUT || *obj);
> +    assert(!(v->type & VISITOR_OUTPUT) || *obj);
>       */
>      v->type_str(v, name, obj, &err);
> +    /* Likewise, use of NULL means we can't do (v->type & VISITOR_INPUT) */
>      if (v->type == VISITOR_INPUT) {
>          assert(!err != !*obj);
>      }

If your head doesn't hurt by know, you either wrote this, or you're not
reading closely :)

If the TODOs were already addressed, we'd again get the same analysis as
for visit_start_struct(), except for the arguments about the root, which
don't apply here, because the clone visitor doesn't accept scalar roots.

In the current state, the analysis needs to be modified as follows.

First assertion:

Before the patch, we'd like to assert "if output or clone visitor, then
*obj isn't null".  We can't as long as we need to treat null as the
empty string.

After the patch, the situation is the same for the clone visitor.  Okay.

Second assertion:

Before the patch, we assert "input visitor must either fail or create
*obj for a real walk."  The TODO doesn't apply; we create "", not null.

After the patch, we'd like to assert the same for the clone visitor, but
we can't: the clone of null is null.  Okay.

> @@ -273,9 +274,9 @@ void visit_type_any(Visitor *v, const char *name, QObject 
> **obj, Error **errp)
>      Error *err = NULL;
>
>      assert(obj);
> -    assert(v->type != VISITOR_OUTPUT || *obj);
> +    assert(!(v->type & VISITOR_OUTPUT) || *obj);
>      v->type_any(v, name, obj, &err);
> -    if (v->type == VISITOR_INPUT) {
> +    if (v->type & VISITOR_INPUT) {
>          assert(!err != !*obj);
>      }
>      error_propagate(errp, err);

v->type_any() will crash for the clone visitor, so these changes aren't.
necessary.  If you want them to future-proof the code, I need to
convince myself the changes make sense, similar to what I did for the
other ones in this file.

> @@ -342,4 +343,5 @@ void visit_type_enum(Visitor *v, const char *name, int 
> *obj,
>      } else if (v->type == VISITOR_OUTPUT) {
>          output_type_enum(v, name, obj, strings, errp);
>      }
> +    /* dealloc and clone visitors have nothing to do */
>  }

I'm upgrade my verdict from "subtle" to "scarily subtle" %-}

> diff --git a/qapi/qapi-clone-visitor.c b/qapi/qapi-clone-visitor.c
> new file mode 100644
> index 0000000..a24a258
> --- /dev/null
> +++ b/qapi/qapi-clone-visitor.c
> @@ -0,0 +1,178 @@
> +/*
> + * Copy one QAPI object to another
> + *
> + * Copyright (C) 2016 Red Hat, Inc.
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> + * See the COPYING file in the top-level directory.
> + *
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/clone-visitor.h"
> +#include "qapi/visitor-impl.h"
> +#include "qapi/error.h"
> +
> +struct QapiCloneVisitor {
> +    Visitor visitor;
> +    const void *root; /* Must be object, alternate, or list */
> +    size_t depth;
> +};
> +
> +static QapiCloneVisitor *to_qcv(Visitor *v)
> +{
> +    return container_of(v, QapiCloneVisitor, visitor);
> +}
> +
> +static void qapi_clone_start_struct(Visitor *v, const char *name, void **obj,
> +                                    size_t size, Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    if (!obj) {
> +        /* Only possible when visiting an alternate's object
> +         * branch. Nothing to do here, since the earlier
> +         * visit_start_alternate() already copied memory. */

Should visitor-impl.h explain how method start_struct() is used with
alternates?  I once again forgot how this works...  Hmm, you explained
it to me during review of v3.

Despite there's "nothing to do here", you found something to do:

> +        assert(qcv->depth);
> +        return;
> +    }
> +
> +    *obj = g_memdup(qcv->depth ? *obj : qcv->root, size);
> +    qcv->depth++;
> +}
> +
> +static void qapi_clone_end(Visitor *v, void **obj)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    if (obj) {
> +        qcv->depth--;
> +    }
> +}
> +
> +static void qapi_clone_start_list(Visitor *v, const char *name,
> +                                  GenericList **listp, size_t size,
> +                                  Error **errp)
> +{
> +    qapi_clone_start_struct(v, name, (void **)listp, size, errp);
> +}
> +
> +static GenericList *qapi_clone_next_list(Visitor *v, GenericList *tail,
> +                                         size_t size)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Unshare the tail of the list cloned by g_memdup */

Humor me: g_memdup()

> +    tail->next = g_memdup(tail->next, size);
> +    return tail->next;
> +}
> +
> +static void qapi_clone_start_alternate(Visitor *v, const char *name,
> +                                       GenericAlternate **obj, size_t size,
> +                                       bool promote_int, Error **errp)
> +{
> +    qapi_clone_start_struct(v, name, (void **)obj, size, errp);
> +}
> +
> +static void qapi_clone_type_int64(Visitor *v, const char *name, int64_t *obj,
> +                                   Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Value was already cloned by g_memdup */
> +}
> +
> +static void qapi_clone_type_uint64(Visitor *v, const char *name,
> +                                    uint64_t *obj, Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Value was already cloned by g_memdup */
> +}
> +
> +static void qapi_clone_type_bool(Visitor *v, const char *name, bool *obj,
> +                                  Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Value was already cloned by g_memdup */
> +}
> +
> +static void qapi_clone_type_str(Visitor *v, const char *name, char **obj,
> +                                 Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Pointer was already cloned by g_memdup; create fresh copy */
> +    *obj = g_strdup(*obj);
> +}
> +
> +static void qapi_clone_type_number(Visitor *v, const char *name, double *obj,
> +                                    Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Value was already cloned by g_memdup */
> +}
> +
> +static void qapi_clone_type_null(Visitor *v, const char *name, Error **errp)
> +{
> +    QapiCloneVisitor *qcv = to_qcv(v);
> +
> +    assert(qcv->depth);
> +    /* Nothing to do */
> +}
> +
> +static void qapi_clone_free(Visitor *v)
> +{
> +    g_free(v);
> +}
> +
> +static Visitor *qapi_clone_visitor_new(const void *src)
> +{
> +    QapiCloneVisitor *v;
> +
> +    v = g_malloc0(sizeof(*v));
> +    v->root = src;
> +
> +    v->visitor.type = VISITOR_CLONE;
> +    v->visitor.start_struct = qapi_clone_start_struct;
> +    v->visitor.end_struct = qapi_clone_end;
> +    v->visitor.start_list = qapi_clone_start_list;
> +    v->visitor.next_list = qapi_clone_next_list;
> +    v->visitor.end_list = qapi_clone_end;
> +    v->visitor.start_alternate = qapi_clone_start_alternate;
> +    v->visitor.end_alternate = qapi_clone_end;
> +    v->visitor.type_int64 = qapi_clone_type_int64;
> +    v->visitor.type_uint64 = qapi_clone_type_uint64;
> +    v->visitor.type_bool = qapi_clone_type_bool;
> +    v->visitor.type_str = qapi_clone_type_str;
> +    v->visitor.type_number = qapi_clone_type_number;
> +    v->visitor.type_null = qapi_clone_type_null;
> +    v->visitor.free = qapi_clone_free;
> +
> +    return &v->visitor;
> +}
> +
> +void *qapi_clone(const void *src, void (*visit_type)(Visitor *, const char *,
> +                                                     void **, Error **))
> +{
> +    Visitor *v;
> +    void *dst;
> +
> +    if (!src) {
> +        return NULL;
> +    }
> +
> +    v = qapi_clone_visitor_new(src);
> +    visit_type(v, NULL, &dst, &error_abort);
> +    visit_free(v);
> +    return dst;
> +}
[Skipping the tests for now to get this review out today...]