Re: [Qemu-devel] [PATCH 10/10] qdev: fix create in place obj's life cycle problem

[liu ping fan]

On Fri, Aug 24, 2012 at 10:42 PM, Paolo Bonzini <address@hidden> wrote:
> Il 24/08/2012 11:49, Liu Ping Fan ha scritto:
>> With this patch, we can protect PCIIDEState from disappearing during
>> mmio-dispatch hold the IDEBus->ref.
>
> I don't see why MMIO dispatch should hold the IDEBus ref rather than the
> PCIIDEState.
>
When transfer memory_region_init_io()  3rd para from void* opaque to
Object* obj,  the obj : opaque is not neccessary 1:1 map. For such
situation, in order to let MemoryRegionOps tell between them, we
should pass PCIIDEState->bus[0], bus[1] separately.

> In the case of the PIIX, the BARs are set up by the PCIIDEState in
> bmdma_setup_bar (called by bmdma_setup_bar).
>
Supposing we have convert  PCIIDEState->bmdma[0]/[1] to Object. And in
mmio-dispatch, object_ref will impose on bmdma[0/[1], but this can not
prevent  PCIIDEState->refcnt=0, and then the whole object disappear!

Thanks and regards,
pingfan


> Also, containment may happen just as well for devices, not buses.  Why
> isn't it a problem in that case?  It looks like you're papering over a
> different bug.
>
> Paolo
>
>> And the ref circle has been broken when calling qdev_delete_subtree().
>>
>> Signed-off-by: Liu Ping Fan <address@hidden>
>> ---
>>  hw/qdev.c |    2 ++
>>  hw/qdev.h |    1 +
>>  2 files changed, 3 insertions(+), 0 deletions(-)
>>
>> diff --git a/hw/qdev.c b/hw/qdev.c
>> index e2339a1..b09ebbf 100644
>> --- a/hw/qdev.c
>> +++ b/hw/qdev.c
>> @@ -510,6 +510,8 @@ void qbus_create_inplace(BusState *bus, const char 
>> *typename,
>>  {
>>      object_initialize(bus, typename);
>>
>> +    bus->overlap = parent;
>> +    object_ref(OBJECT(bus->overlap));
>>      bus->parent = parent;
>>      bus->name = name ? g_strdup(name) : NULL;
>>      qbus_realize(bus);
>> diff --git a/hw/qdev.h b/hw/qdev.h
>> index 182cfa5..9bc5783 100644
>> --- a/hw/qdev.h
>> +++ b/hw/qdev.h
>> @@ -117,6 +117,7 @@ struct BusState {
>>      int allow_hotplug;
>>      bool qom_allocated;
>>      bool glib_allocated;
>> +    DeviceState *overlap;
>>      int max_index;
>>      QTAILQ_HEAD(ChildrenHead, BusChild) children;
>>      QLIST_ENTRY(BusState) sibling;
>> -- 1.7.4.4
>