From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53174) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V4pKx-0006N0-94 for qemu-devel@nongnu.org; Thu, 01 Aug 2013 05:38:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V4pDL-00066r-BY for qemu-devel@nongnu.org; Thu, 01 Aug 2013 05:30:40 -0400 Received: from mail-we0-x22d.google.com ([2a00:1450:400c:c03::22d]:53519) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V4pDL-00066T-02 for qemu-devel@nongnu.org; Thu, 01 Aug 2013 05:30:31 -0400 Received: by mail-we0-f173.google.com with SMTP id x55so1509008wes.32 for ; Thu, 01 Aug 2013 02:30:29 -0700 (PDT) Date: Thu, 1 Aug 2013 11:30:26 +0200 From: Stefan Hajnoczi Message-ID: <20130801093026.GB29838@stefanha-thinkpad.redhat.com> References: <1375170777-31457-1-git-send-email-famz@redhat.com> <1375170777-31457-4-git-send-email-famz@redhat.com> <20130730145848.GE9018@stefanha-thinkpad.redhat.com> <20130731095117.GA1145@T430s.nay.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20130731095117.GA1145@T430s.nay.redhat.com> Subject: Re: [Qemu-devel] [PATCH v2 3/7] block: implement reference count for BlockDriverState List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fam Zheng Cc: kwolf@redhat.com, jcody@redhat.com, qemu-devel@nongnu.org, Stefan Hajnoczi On Wed, Jul 31, 2013 at 05:51:17PM +0800, Fam Zheng wrote: > On Tue, 07/30 16:58, Stefan Hajnoczi wrote: > > On Tue, Jul 30, 2013 at 03:52:53PM +0800, Fam Zheng wrote: > > > @@ -1518,6 +1519,9 @@ static void bdrv_move_feature_fields(BlockDriverState *bs_dest, > > > /* dirty bitmap */ > > > bs_dest->dirty_bitmap = bs_src->dirty_bitmap; > > > > > > + /* reference count */ > > > + bs_dest->refcnt = bs_src->refcnt; > > > + > > > /* job */ > > > bs_dest->in_use = bs_src->in_use; > > > bs_dest->job = bs_src->job; > > > > Not sure this is correct, but then bdrv_swap() is hard to reason > > about... :) > > > > Imagine an emulated storage controller holds a reference to the > > BlockDriverState. When we create an external snapshot we'll > > bdrv_swap(old_top, new_top). > > > > We must not move new_top's refcount into old_top since the old_top > > object is still being referenced by the emulated storage controller. > > When the emulated storage controller does bdrv_unref() we'll hit the > > recount < 0 assertion and be accessing freed memory. > > > When we swap old_top and new_top, we want to swap all fields except for > these, so we use bdrv_move_feature_fields() to move them back > (bdrv_swap): > > tmp = *bs_new; > *bs_new = *bs_old; > *bs_old = tmp; > > /* there are some fields that should not be swapped, move them back */ > bdrv_move_feature_fields(&tmp, bs_old); > bdrv_move_feature_fields(bs_old, bs_new); > bdrv_move_feature_fields(bs_new, &tmp); > > And I agree that refcnt is one of the fields that shouldn't be moved, so > it's in bdrv_move_feature_fields(). So isn't above right? Without these > lines, it *is* swapped. Yes, you are right. I should have looked at the calling function. We want to swap the refcount field back into the original struct where is belongs. Stefan