From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:41270) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T4qY9-0004ty-7A for qemu-devel@nongnu.org; Fri, 24 Aug 2012 05:51:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T4qY8-0003Ns-9x for qemu-devel@nongnu.org; Fri, 24 Aug 2012 05:51:33 -0400 Received: from mail-iy0-f173.google.com ([209.85.210.173]:48959) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T4qY8-0003J8-4q for qemu-devel@nongnu.org; Fri, 24 Aug 2012 05:51:32 -0400 Received: by mail-iy0-f173.google.com with SMTP id x26so2920370iak.4 for ; Fri, 24 Aug 2012 02:51:31 -0700 (PDT) From: Liu Ping Fan Date: Fri, 24 Aug 2012 17:49:23 +0800 Message-Id: <1345801763-24227-11-git-send-email-qemulist@gmail.com> In-Reply-To: <1345801763-24227-1-git-send-email-qemulist@gmail.com> References: <1345801763-24227-1-git-send-email-qemulist@gmail.com> Subject: [Qemu-devel] [PATCH 10/10] qdev: fix create in place obj's life cycle problem List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Liu Ping Fan , Avi Kivity , Anthony Liguori From: Liu Ping Fan Scene: obja lies in objA, when objA's ref->0, it will be freed, but at that time obja can still be in use. The real example is: typedef struct PCIIDEState { PCIDevice dev; IDEBus bus[2]; --> create in place ..... } When without big lock protection for mmio-dispatch, we will hold obj's refcnt. So memory_region_init_io() will replace the third para "void *opaque" with "Object *obj". With this patch, we can protect PCIIDEState from disappearing during mmio-dispatch hold the IDEBus->ref. And the ref circle has been broken when calling qdev_delete_subtree(). Signed-off-by: Liu Ping Fan --- hw/qdev.c | 2 ++ hw/qdev.h | 1 + 2 files changed, 3 insertions(+), 0 deletions(-) diff --git a/hw/qdev.c b/hw/qdev.c index e2339a1..b09ebbf 100644 --- a/hw/qdev.c +++ b/hw/qdev.c @@ -510,6 +510,8 @@ void qbus_create_inplace(BusState *bus, const char *typename, { object_initialize(bus, typename); + bus->overlap = parent; + object_ref(OBJECT(bus->overlap)); bus->parent = parent; bus->name = name ? g_strdup(name) : NULL; qbus_realize(bus); diff --git a/hw/qdev.h b/hw/qdev.h index 182cfa5..9bc5783 100644 --- a/hw/qdev.h +++ b/hw/qdev.h @@ -117,6 +117,7 @@ struct BusState { int allow_hotplug; bool qom_allocated; bool glib_allocated; + DeviceState *overlap; int max_index; QTAILQ_HEAD(ChildrenHead, BusChild) children; QLIST_ENTRY(BusState) sibling; -- 1.7.4.4