From patchwork Sun Jan 5 08:56:18 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Akihiko Odaki X-Patchwork-Id: 13926461 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C0553E77198 for ; Sun, 5 Jan 2025 08:57:42 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tUMRH-0001Qq-Bi; Sun, 05 Jan 2025 03:56:51 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tUMRF-0001QZ-Tu for qemu-devel@nongnu.org; Sun, 05 Jan 2025 03:56:50 -0500 Received: from mail-pl1-x62c.google.com ([2607:f8b0:4864:20::62c]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1tUMRD-000318-So for qemu-devel@nongnu.org; Sun, 05 Jan 2025 03:56:49 -0500 Received: by mail-pl1-x62c.google.com with SMTP id d9443c01a7336-216395e151bso138433665ad.0 for ; Sun, 05 Jan 2025 00:56:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=daynix-com.20230601.gappssmtp.com; s=20230601; t=1736067406; x=1736672206; darn=nongnu.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=yg6P8rzksaJBfm35L7tLpS6A+5UOh9uEhmOd6bgScw4=; b=DMYIhJO0E+Pn3XpSvMAIkwQjQkg/DTY+/V9YGXkrDSmf8XrXtew+D/5Sm6fjfbfuoM 85r35onu6B2WYAPHtT9iuLHwTdY8qoTAygJHONR+BTVqGMRQvnmVQDaliB/gL56xjiu0 9OqBhCxrywrlf29ZccM6itYRyIA9kjClEMlhUoAN/s8WlrDPEVyM4z0TotLfO9gTPq4s UDQpu0SuuHtxkGKGXq6pxjuZmfGfRZYjeMtP0RMdsczCUfZ7YouPhBnaPGmZrCRxvOGT NfD0J8gwnkXm2ZiPQaXK1t77ckAFmI/KyXAwDJ4L61dZaQBDVezA96yRPtjciftaLt4k wV+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736067406; x=1736672206; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=yg6P8rzksaJBfm35L7tLpS6A+5UOh9uEhmOd6bgScw4=; b=nyo2WR5cWvRyrFZbepn/nPfgtc6YUS4KiN5KwRrOgK8cIQFFi61aYRb3fKThzHIuXW fBvoLmbE5wVvaykNHHzZzcdVh20bbGX97EVu7pxYTiPTIdIKZ7XQm5LB9D3Nj0Tjflta YjqbPUSqhda+vdukcO6oRvvXfzECeiYsduY39iw5+1QU3hx1IZ9F3dnswEZUM+k/wSQh 1rwdocBVyo+pV7cbgK+mNqx7odrx2jeFBY0RZPM2HiLbBZ58yKBnmkjb/IZ78g6tutRv iIPXaetQ2wbfnuNF57eSxTx5lrWFRDJ93xWYnPLnINmC3l8Tm9RorY4FXCuyYKkICkmT gb5w== X-Gm-Message-State: AOJu0YwOczcL9snaEWVnoOCOBoP+QVrBxebmcfWZTF7UQnCtjzffcKWr iil2V2vfH/u7pwqAnQQfoHIVcBIGxE10jqS7v+aOX+118J6psbLxSuW0t55i4Oo= X-Gm-Gg: ASbGncuoI1TNeo1NSBB8udX6WrmYPGcxypB/p+VYgsrnc0oSTUEuCM5+yJFrR8rhz49 DNlfewYcgfHInQnillPgPWFRm1U77OJQMi//uyyYpglaO0iSurftr2JzGb0LWFIptGD0P9NgZ0T XsyTJwroDsF7ESpGSScHvJ628a/4PWk1+MX0PgbaFzj6kcH8Y2m4BBsKC4g+zX2Xz1DLsCBsnaM wyGzmhJ4PoN6/jo5scjTa8ml6lLf13vD9Um0DIhTjqRJp7zu9krHR2rohOg X-Google-Smtp-Source: AGHT+IGu+zFymaDrmx8YrIogKH5x1GKxgZSm1p+52T4n43idkT65wH8/C6H46ckfwsHyyX4eikRpGQ== X-Received: by 2002:a17:903:903:b0:216:6284:8a00 with SMTP id d9443c01a7336-219da5b9cb9mr852283595ad.2.1736067406392; Sun, 05 Jan 2025 00:56:46 -0800 (PST) Received: from localhost ([157.82.207.107]) by smtp.gmail.com with UTF8SMTPSA id d9443c01a7336-219dc9f72b8sm272100535ad.191.2025.01.05.00.56.40 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 05 Jan 2025 00:56:46 -0800 (PST) From: Akihiko Odaki Date: Sun, 05 Jan 2025 17:56:18 +0900 Subject: [PATCH v6 1/2] memory: Update inline documentation MIME-Version: 1.0 Message-Id: <20250105-san-v6-1-11fc859b99b7@daynix.com> References: <20250105-san-v6-0-11fc859b99b7@daynix.com> In-Reply-To: <20250105-san-v6-0-11fc859b99b7@daynix.com> To: Eduardo Habkost , Marcel Apfelbaum , =?utf-8?q?Philippe_Mathieu-?= =?utf-8?q?Daud=C3=A9?= , Yanan Wang , John Snow , BALATON Zoltan , Jiaxun Yang , Nicholas Piggin , Daniel Henrique Barboza , David Gibson , Harsh Prateek Bora , Alexey Kardashevskiy , "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Xu , Fabiano Rosas , Paolo Bonzini , David Hildenbrand , Thomas Huth , Laurent Vivier , Peter Maydell Cc: qemu-devel@nongnu.org, qemu-block@nongnu.org, qemu-ppc@nongnu.org, devel@daynix.com, Akihiko Odaki X-Mailer: b4 0.14-dev-fd6e3 Received-SPF: pass client-ip=2607:f8b0:4864:20::62c; envelope-from=akihiko.odaki@daynix.com; helo=mail-pl1-x62c.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Do not refer to "memory region's reference count" ------------------------------------------------- Now MemoryRegions do have their own reference counts, but they will not be used when their owners are not themselves. However, the documentation of memory_region_ref() says it adds "1 to a memory region's reference count", which is confusing. Avoid referring to "memory region's reference count" and just say: "Add a reference to a memory region". Make a similar change to memory_region_unref() too. Refer to docs/devel/memory.rst for "owner" ------------------------------------------ memory_region_ref() and memory_region_unref() used to have their own descriptions of "owner", but they are somewhat out-of-date and misleading. In particular, they say "whenever memory regions are accessed outside the BQL, they need to be preserved against hot-unplug", but protecting against hot-unplug is not mandatory if it is known that they will never be hot-unplugged. They also say "MemoryRegions actually do not have their own reference count", but they actually do. They just will not be used unless their owners are not themselves. Refer to docs/devel/memory.rst as the single source of truth instead of maintaining duplicate descriptions of "owner". Clarify that owner may be missing --------------------------------- A memory region may not have an owner, and memory_region_ref() and memory_region_unref() do nothing for such. memory: Clarify owner must not call memory_region_ref() -------------------------------------------------------- The owner must not call this function as it results in a circular reference. Signed-off-by: Akihiko Odaki --- include/exec/memory.h | 59 ++++++++++++++++++++++++--------------------------- 1 file changed, 28 insertions(+), 31 deletions(-) diff --git a/include/exec/memory.h b/include/exec/memory.h index 9458e2801d50..ca247343f433 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -1210,7 +1210,7 @@ void memory_region_section_free_copy(MemoryRegionSection *s); * memory_region_add_subregion() to add subregions. * * @mr: the #MemoryRegion to be initialized - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: used for debugging; not visible to the user or ABI * @size: size of the region; any subregions beyond this size will be clipped */ @@ -1220,29 +1220,26 @@ void memory_region_init(MemoryRegion *mr, uint64_t size); /** - * memory_region_ref: Add 1 to a memory region's reference count + * memory_region_ref: Add a reference to the owner of a memory region * - * Whenever memory regions are accessed outside the BQL, they need to be - * preserved against hot-unplug. MemoryRegions actually do not have their - * own reference count; they piggyback on a QOM object, their "owner". - * This function adds a reference to the owner. - * - * All MemoryRegions must have an owner if they can disappear, even if the - * device they belong to operates exclusively under the BQL. This is because - * the region could be returned at any time by memory_region_find, and this - * is usually under guest control. + * This function adds a reference to the owner of a memory region to keep the + * memory region alive. It does nothing if the owner is not present as a memory + * region without owner will never die. + * For references internal to the owner, use object_ref() instead to avoid a + * circular reference. + * See docs/devel/memory.rst to know about owner. * * @mr: the #MemoryRegion */ void memory_region_ref(MemoryRegion *mr); /** - * memory_region_unref: Remove 1 to a memory region's reference count + * memory_region_unref: Remove a reference to the memory region of the owner * - * Whenever memory regions are accessed outside the BQL, they need to be - * preserved against hot-unplug. MemoryRegions actually do not have their - * own reference count; they piggyback on a QOM object, their "owner". - * This function removes a reference to the owner and possibly destroys it. + * This function removes a reference to the owner of a memory region and + * possibly destroys the owner along with the memory region. It does nothing if + * the owner is not present. + * See docs/devel/memory.rst to know about owner. * * @mr: the #MemoryRegion */ @@ -1255,7 +1252,7 @@ void memory_region_unref(MemoryRegion *mr); * if @size is nonzero, subregions will be clipped to @size. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @ops: a structure containing read and write callbacks to be used when * I/O is performed on the region. * @opaque: passed to the read and write callbacks of the @ops structure. @@ -1275,7 +1272,7 @@ void memory_region_init_io(MemoryRegion *mr, * directly. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: size of the region. @@ -1298,7 +1295,7 @@ bool memory_region_init_ram_nomigrate(MemoryRegion *mr, * modify memory directly. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: size of the region. @@ -1328,7 +1325,7 @@ bool memory_region_init_ram_flags_nomigrate(MemoryRegion *mr, * canceled. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: used size of the region. @@ -1357,7 +1354,7 @@ bool memory_region_init_resizeable_ram(MemoryRegion *mr, * mmap-ed backend. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: size of the region. @@ -1390,7 +1387,7 @@ bool memory_region_init_ram_from_file(MemoryRegion *mr, * mmap-ed backend. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: the name of the region. * @size: size of the region. * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM, @@ -1421,7 +1418,7 @@ bool memory_region_init_ram_from_fd(MemoryRegion *mr, * region will modify memory directly. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: size of the region. @@ -1449,7 +1446,7 @@ void memory_region_init_ram_ptr(MemoryRegion *mr, * skip_dump flag. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: the name of the region. * @size: size of the region. * @ptr: memory to be mapped; must contain at least @size bytes. @@ -1469,7 +1466,7 @@ void memory_region_init_ram_device_ptr(MemoryRegion *mr, * part of another memory region. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: used for debugging; not visible to the user or ABI * @orig: the region to be referenced; @mr will be equivalent to * @orig between @offset and @offset + @size - 1. @@ -1495,7 +1492,7 @@ void memory_region_init_alias(MemoryRegion *mr, * of the caller. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: size of the region. @@ -1518,7 +1515,7 @@ bool memory_region_init_rom_nomigrate(MemoryRegion *mr, * of the caller. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @ops: callbacks for write access handling (must not be NULL). * @opaque: passed to the read and write callbacks of the @ops structure. * @name: Region name, becomes part of RAMBlock name used in migration stream @@ -1554,7 +1551,7 @@ bool memory_region_init_rom_device_nomigrate(MemoryRegion *mr, * @_iommu_mr: the #IOMMUMemoryRegion to be initialized * @instance_size: the IOMMUMemoryRegion subclass instance size * @mrtypename: the type name of the #IOMMUMemoryRegion - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: used for debugging; not visible to the user or ABI * @size: size of the region. */ @@ -1570,7 +1567,7 @@ void memory_region_init_iommu(void *_iommu_mr, * region will modify memory directly. * * @mr: the #MemoryRegion to be initialized - * @owner: the object that tracks the region's reference count (must be + * @owner: the object that keeps the region alive (must be * TYPE_DEVICE or a subclass of TYPE_DEVICE, or NULL) * @name: name of the memory region * @size: size of the region in bytes @@ -1616,7 +1613,7 @@ bool memory_region_init_ram_guest_memfd(MemoryRegion *mr, * If you pass a non-NULL non-device @owner then we will assert. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @name: Region name, becomes part of RAMBlock name used in migration stream * must be unique within any device * @size: size of the region. @@ -1647,7 +1644,7 @@ bool memory_region_init_rom(MemoryRegion *mr, * If you pass a non-NULL non-device @owner then we will assert. * * @mr: the #MemoryRegion to be initialized. - * @owner: the object that tracks the region's reference count + * @owner: the object that keeps the region alive * @ops: callbacks for write access handling (must not be NULL). * @opaque: passed to the read and write callbacks of the @ops structure. * @name: Region name, becomes part of RAMBlock name used in migration stream From patchwork Sun Jan 5 08:56:19 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Akihiko Odaki X-Patchwork-Id: 13926462 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 81C0FE77197 for ; Sun, 5 Jan 2025 08:58:02 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tUMRP-0001SS-2h; Sun, 05 Jan 2025 03:56:59 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tUMRN-0001SA-Li for qemu-devel@nongnu.org; Sun, 05 Jan 2025 03:56:57 -0500 Received: from mail-pj1-x1034.google.com ([2607:f8b0:4864:20::1034]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1tUMRM-000328-5q for qemu-devel@nongnu.org; Sun, 05 Jan 2025 03:56:57 -0500 Received: by mail-pj1-x1034.google.com with SMTP id 98e67ed59e1d1-2f4448bf96fso14724141a91.0 for ; Sun, 05 Jan 2025 00:56:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=daynix-com.20230601.gappssmtp.com; s=20230601; t=1736067415; x=1736672215; darn=nongnu.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=FmQmqRoZoVpBuUWMsWoA3ZXBC95hvdxu9mQlkpJR1U4=; b=uKpbojEg1Ur5qQJh4LcC8mk6ymO2EaN8DmY11KLgqXHVTay2G3y8Rk957Tng+ALiqK hSPPfE789BFHBKs8llHnPVRTlfUUrK5uvwrQuvkTQxWmma4ZVrQT7LnyEFUMivd7T2dm 8dPSdsRqGohSL+xblC2ruaqaS5T177RqkB02+TFPsB3fpUrb62FYksioTDJ5UwhykT1E QSpiQQ4QhZC7bu9K/TOWeba6yiBj0Wqcthr8LLqn1yv5g3CUmSER3GRC8Pab9xaaHMrU MhCzXTPFSUrcW7t2WunOhch/Df8ndo5umctlrwP9bl5MpOWSS28qBWdO2pd7iQKHycgu LAHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736067415; x=1736672215; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FmQmqRoZoVpBuUWMsWoA3ZXBC95hvdxu9mQlkpJR1U4=; b=PxYCBNaL1sng79NUslv4oMSdgZYPjqs2ifkADJ2vHt5u/swxSAorrO9IsS3JGxf9qH VXinrtxceuLpdphI+KxMMm1fvsUc3KwbGcyXUZFWi6koMLpJurhwDby1mUzkXtdexAia 0upe2sX118YT+WpXkZsSqN21eZwcLU9sT4wBLfvmViaaFi6venl/AhJ0Rx4YefwjhLyE iCju9HtShx6jAG7GXdjv/JCdaO42tEN9UMDNE/K7kN3maxpvIR7InNZYBpK8QqXevGQK PCQlAjmIFJUBIu0JoXi0s8CU9KfNhDdPGhrxdpVqX1TUEP2IIFhde1xiHen+7UgScTQr upbQ== X-Gm-Message-State: AOJu0Yz6ccumf/07XVBzSEGZ8UqiPMuO6oTHJCrsiWblDp+eC/Fp4e6p 1K0DqyD17ySyzdOUVqicmw8MYlcnefC8yi7BHlSOkub12gbPLkq8zQfTrTtLEMQ= X-Gm-Gg: ASbGncvgWu1Irh8Iqpoaew1mi4iuTwoPcKkYNKqEN+R2dHDD4CNt7kzb2ZYem4bxnTj Yzmnk+lKcy5z0k1k5GgpC8SwLpfafzs+Mf5zKV6JAdCRmJrpAkeb+HpnSLw8h4sOwnDqcNdsjRE hBdu7e1KeVFBljeEWb32Duw0SDLJLnA+Ez/27EjWmqyH+JHXYnRoZD41KaD59CimbKnmHH2NDtO GsRdJNsTk+ADYT+/OSRW26pIacf7aw5H7diBBLowrx6uFlrNfWpb3qw9N/L X-Google-Smtp-Source: AGHT+IFqEHZ/pf5jW+3+4HJoAdNdstOqzB+ea1JvMn5AIOlNTL6PtpsjOJsWh3kh45C92Nmj57zcaw== X-Received: by 2002:a17:90a:c2c8:b0:2ea:6f19:1815 with SMTP id 98e67ed59e1d1-2f452ee5eb9mr81365955a91.24.1736067414868; Sun, 05 Jan 2025 00:56:54 -0800 (PST) Received: from localhost ([157.82.207.107]) by smtp.gmail.com with UTF8SMTPSA id 98e67ed59e1d1-2f2ee26b131sm36844362a91.44.2025.01.05.00.56.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 05 Jan 2025 00:56:54 -0800 (PST) From: Akihiko Odaki Date: Sun, 05 Jan 2025 17:56:19 +0900 Subject: [PATCH v6 2/2] memory: Do not create circular reference with subregion MIME-Version: 1.0 Message-Id: <20250105-san-v6-2-11fc859b99b7@daynix.com> References: <20250105-san-v6-0-11fc859b99b7@daynix.com> In-Reply-To: <20250105-san-v6-0-11fc859b99b7@daynix.com> To: Eduardo Habkost , Marcel Apfelbaum , =?utf-8?q?Philippe_Mathieu-?= =?utf-8?q?Daud=C3=A9?= , Yanan Wang , John Snow , BALATON Zoltan , Jiaxun Yang , Nicholas Piggin , Daniel Henrique Barboza , David Gibson , Harsh Prateek Bora , Alexey Kardashevskiy , "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Xu , Fabiano Rosas , Paolo Bonzini , David Hildenbrand , Thomas Huth , Laurent Vivier , Peter Maydell Cc: qemu-devel@nongnu.org, qemu-block@nongnu.org, qemu-ppc@nongnu.org, devel@daynix.com, Akihiko Odaki X-Mailer: b4 0.14-dev-fd6e3 Received-SPF: pass client-ip=2607:f8b0:4864:20::1034; envelope-from=akihiko.odaki@daynix.com; helo=mail-pj1-x1034.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org memory_region_update_container_subregions() used to call memory_region_ref(), which creates a reference to the owner of the subregion, on behalf of the owner of the container. This results in a circular reference if the subregion and container have the same owner. memory_region_ref() creates a reference to the owner instead of the memory region to match the lifetime of the owner and memory region. We do not need such a hack if the subregion and container have the same owner because the owner will be alive as long as the container is. Therefore, create a reference to the subregion itself instead ot its owner in such a case; the reference to the subregion is still necessary to ensure that the subregion gets finalized after the container. Signed-off-by: Akihiko Odaki --- system/memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/system/memory.c b/system/memory.c index 78e17e0efa83..16b051249c5f 100644 --- a/system/memory.c +++ b/system/memory.c @@ -2644,7 +2644,9 @@ static void memory_region_update_container_subregions(MemoryRegion *subregion) memory_region_transaction_begin(); - memory_region_ref(subregion); + object_ref(mr->owner == subregion->owner ? + OBJECT(subregion) : subregion->owner); + QTAILQ_FOREACH(other, &mr->subregions, subregions_link) { if (subregion->priority >= other->priority) { QTAILQ_INSERT_BEFORE(other, subregion, subregions_link); @@ -2702,7 +2704,9 @@ void memory_region_del_subregion(MemoryRegion *mr, assert(alias->mapped_via_alias >= 0); } QTAILQ_REMOVE(&mr->subregions, subregion, subregions_link); - memory_region_unref(subregion); + object_unref(mr->owner == subregion->owner ? + OBJECT(subregion) : subregion->owner); + memory_region_update_pending |= mr->enabled && subregion->enabled; memory_region_transaction_commit(); }