memory_region_update_container_subregions() used to call memory_region_ref(), which creates a reference to the owner of the subregion, on behalf of the owner of the container. This results in a circular reference if the subregion and container have the same owner.
memory_region_ref() creates a reference to the owner instead of the memory region to match the lifetime of the owner and memory region. We do not need such a hack if the subregion and container have the same owner because the owner will be alive as long as the container is. Therefore, create a reference to the subregion itself instead ot its owner in such a case; the reference to the subregion is still necessary to ensure that the subregion gets finalized after the container. Signed-off-by: Akihiko Odaki <[email protected]> --- system/memory.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/system/memory.c b/system/memory.c index 78e17e0efa83..972617b0192d 100644 --- a/system/memory.c +++ b/system/memory.c @@ -1855,6 +1855,24 @@ void memory_region_unref(MemoryRegion *mr) } } +static void memory_region_ref_subregion(MemoryRegion *subregion) +{ + if (subregion->container->owner == subregion->owner) { + object_ref(OBJECT(subregion)); + } else { + memory_region_ref(subregion); + } +} + +static void memory_region_unref_subregion(MemoryRegion *subregion) +{ + if (subregion->container->owner == subregion->owner) { + object_unref(OBJECT(subregion)); + } else { + memory_region_unref(subregion); + } +} + uint64_t memory_region_size(MemoryRegion *mr) { if (int128_eq(mr->size, int128_2_64())) { @@ -2644,7 +2662,8 @@ static void memory_region_update_container_subregions(MemoryRegion *subregion) memory_region_transaction_begin(); - memory_region_ref(subregion); + memory_region_ref_subregion(subregion); + QTAILQ_FOREACH(other, &mr->subregions, subregions_link) { if (subregion->priority >= other->priority) { QTAILQ_INSERT_BEFORE(other, subregion, subregions_link); @@ -2702,7 +2721,8 @@ void memory_region_del_subregion(MemoryRegion *mr, assert(alias->mapped_via_alias >= 0); } QTAILQ_REMOVE(&mr->subregions, subregion, subregions_link); - memory_region_unref(subregion); + memory_region_unref_subregion(subregion); + memory_region_update_pending |= mr->enabled && subregion->enabled; memory_region_transaction_commit(); } -- 2.47.1
