Re: [Qemu-devel] [PATCH v2 3/7] block: implement reference count for BlockDriverState

[Stefan Hajnoczi <stefanha@gmail.com>]

On Wed, Jul 31, 2013 at 05:51:17PM +0800, Fam Zheng wrote:
> On Tue, 07/30 16:58, Stefan Hajnoczi wrote:
> > On Tue, Jul 30, 2013 at 03:52:53PM +0800, Fam Zheng wrote:
> > > @@ -1518,6 +1519,9 @@ static void bdrv_move_feature_fields(BlockDriverState *bs_dest,
> > >      /* dirty bitmap */
> > >      bs_dest->dirty_bitmap       = bs_src->dirty_bitmap;
> > >  
> > > +    /* reference count */
> > > +    bs_dest->refcnt             = bs_src->refcnt;
> > > +
> > >      /* job */
> > >      bs_dest->in_use             = bs_src->in_use;
> > >      bs_dest->job                = bs_src->job;
> > 
> > Not sure this is correct, but then bdrv_swap() is hard to reason
> > about... :)
> > 
> > Imagine an emulated storage controller holds a reference to the
> > BlockDriverState.  When we create an external snapshot we'll
> > bdrv_swap(old_top, new_top).
> > 
> > We must not move new_top's refcount into old_top since the old_top
> > object is still being referenced by the emulated storage controller.
> > When the emulated storage controller does bdrv_unref() we'll hit the
> > recount < 0 assertion and be accessing freed memory.
> > 
> When we swap old_top and new_top, we want to swap all fields except for
> these, so we use bdrv_move_feature_fields() to move them back
> (bdrv_swap):
> 
>     tmp = *bs_new;
>     *bs_new = *bs_old;
>     *bs_old = tmp;
> 
>     /* there are some fields that should not be swapped, move them back */
>     bdrv_move_feature_fields(&tmp, bs_old);
>     bdrv_move_feature_fields(bs_old, bs_new);
>     bdrv_move_feature_fields(bs_new, &tmp);
> 
> And I agree that refcnt is one of the fields that shouldn't be moved, so
> it's in bdrv_move_feature_fields(). So isn't above right? Without these
> lines, it *is* swapped.

Yes, you are right.  I should have looked at the calling function.  We
want to swap the refcount field back into the original struct where is
belongs.

Stefan