From patchwork Fri Aug 24 09:49:23 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: pingfan liu X-Patchwork-Id: 179810 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 17DC62C00D2 for ; Fri, 24 Aug 2012 20:14:35 +1000 (EST) Received: from localhost ([::1]:41006 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T4qYN-0005D5-KO for incoming@patchwork.ozlabs.org; Fri, 24 Aug 2012 05:51:47 -0400 Received: from eggs.gnu.org ([208.118.235.92]:41270) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T4qY9-0004ty-7A for qemu-devel@nongnu.org; Fri, 24 Aug 2012 05:51:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T4qY8-0003Ns-9x for qemu-devel@nongnu.org; Fri, 24 Aug 2012 05:51:33 -0400 Received: from mail-iy0-f173.google.com ([209.85.210.173]:48959) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T4qY8-0003J8-4q for qemu-devel@nongnu.org; Fri, 24 Aug 2012 05:51:32 -0400 Received: by mail-iy0-f173.google.com with SMTP id x26so2920370iak.4 for ; Fri, 24 Aug 2012 02:51:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=tr5TFqhJOjIE1waBanFmwaw4Omru/iimcXd5TYeAT18=; b=VEvb6SbWqZ7ChXJhxpx6itWPJr/o10m0aTohdVLBYygyPXX1FdvUp25zYbysHbguub MdWsRkET5jbpRpz5H71L7oKd5lloq65xqAN97osY65o0sDoluYzUg1Xg5tL7MhooYhNG G4Wzc8QxwzVehVyTTFeUBBeSZqyxQRD7wAgPadc8q72vAfpCSmV1j9QenM3gdK9L+8Bo 2+ctlQvHCWLeqhDs6Vyv4v6FTzkRl7OuLVMMFCrUqor+LZq6+sJAWKDlAdpKbROaQJV/ 9Fs/OqPMo7/cUF4v8Xs0bSeyHWr/amtGFbxLwTKfgSR6M75sTq472wQdEfIlGWqo90Y4 yrmA== Received: by 10.50.41.201 with SMTP id h9mr1491494igl.37.1345801891749; Fri, 24 Aug 2012 02:51:31 -0700 (PDT) Received: from localhost ([202.108.130.138]) by mx.google.com with ESMTPS id ut5sm5472405igc.13.2012.08.24.02.51.29 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 24 Aug 2012 02:51:30 -0700 (PDT) From: Liu Ping Fan To: qemu-devel@nongnu.org Date: Fri, 24 Aug 2012 17:49:23 +0800 Message-Id: <1345801763-24227-11-git-send-email-qemulist@gmail.com> X-Mailer: git-send-email 1.7.4.4 In-Reply-To: <1345801763-24227-1-git-send-email-qemulist@gmail.com> References: <1345801763-24227-1-git-send-email-qemulist@gmail.com> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 209.85.210.173 Cc: Paolo Bonzini , Liu Ping Fan , Avi Kivity , Anthony Liguori Subject: [Qemu-devel] [PATCH 10/10] qdev: fix create in place obj's life cycle problem X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Liu Ping Fan Scene: obja lies in objA, when objA's ref->0, it will be freed, but at that time obja can still be in use. The real example is: typedef struct PCIIDEState { PCIDevice dev; IDEBus bus[2]; --> create in place ..... } When without big lock protection for mmio-dispatch, we will hold obj's refcnt. So memory_region_init_io() will replace the third para "void *opaque" with "Object *obj". With this patch, we can protect PCIIDEState from disappearing during mmio-dispatch hold the IDEBus->ref. And the ref circle has been broken when calling qdev_delete_subtree(). Signed-off-by: Liu Ping Fan --- hw/qdev.c | 2 ++ hw/qdev.h | 1 + 2 files changed, 3 insertions(+), 0 deletions(-) diff --git a/hw/qdev.c b/hw/qdev.c index e2339a1..b09ebbf 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -510,6 +510,8 @@ void qbus_create_inplace(BusState *bus, const char *typename, { object_initialize(bus, typename); + bus->overlap = parent; + object_ref(OBJECT(bus->overlap)); bus->parent = parent; bus->name = name ? g_strdup(name) : NULL; qbus_realize(bus); diff --git a/hw/qdev.h b/hw/qdev.h index 182cfa5..9bc5783 100644 --- a/hw/qdev.h +++ b/hw/qdev.h @@ -117,6 +117,7 @@ struct BusState { int allow_hotplug; bool qom_allocated; bool glib_allocated; + DeviceState *overlap; int max_index; QTAILQ_HEAD(ChildrenHead, BusChild) children; QLIST_ENTRY(BusState) sibling;