Merge remote-tracking branch 'bonzini/iommu-for-anthony' into staging

# By Paolo Bonzini (50) and others
# Via Paolo Bonzini
* bonzini/iommu-for-anthony: (66 commits)
  exec: change some APIs to take AddressSpaceDispatch
  exec: remove cur_map
  exec: put memory map in AddressSpaceDispatch
  exec: separate current radix tree from the one being built
  exec: move listener from AddressSpaceDispatch to AddressSpace
  memory: move MemoryListener declaration earlier
  exec: separate current memory map from the one being built
  exec: change well-known physical sections to macros
  qom: Use atomics for object refcounting
  memory: add reference counting to FlatView
  memory: use a new FlatView pointer on every topology update
  memory: access FlatView from a local variable
  add a header file for atomic operations
  hw/[u-x]*: pass owner to memory_region_init* functions
  hw/t*: pass owner to memory_region_init* functions
  hw/s*: pass owner to memory_region_init* functions
  hw/p*: pass owner to memory_region_init* functions
  hw/n*: pass owner to memory_region_init* functions
  hw/m*: pass owner to memory_region_init* functions
  hw/i*: pass owner to memory_region_init* functions
  ...

Message-id: 1372950842-32422-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

1 files changed, 10 insertions, 2 deletions

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 53ea906433..a92b7c1de4 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -505,10 +505,12 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
                             uint32_t tag, uint32_t lun, void *hba_private)
 {
     SCSIRequest *req;
+    SCSIBus *bus = scsi_bus_from_device(d);
+    BusState *qbus = BUS(bus);
 
     req = g_malloc0(reqops->size);
     req->refcount = 1;
-    req->bus = scsi_bus_from_device(d);
+    req->bus = bus;
     req->dev = d;
     req->tag = tag;
     req->lun = lun;
@@ -516,6 +518,8 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
     req->status = -1;
     req->sense_len = 0;
     req->ops = reqops;
+    object_ref(OBJECT(d));
+    object_ref(OBJECT(qbus->parent));
     trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
     return req;
 }
@@ -1498,13 +1502,17 @@ void scsi_req_unref(SCSIRequest *req)
 {
     assert(req->refcount > 0);
     if (--req->refcount == 0) {
-        SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, req->dev->qdev.parent_bus);
+        BusState *qbus = req->dev->qdev.parent_bus;
+        SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus);
+
         if (bus->info->free_request && req->hba_private) {
             bus->info->free_request(bus, req->hba_private);
         }
         if (req->ops->free_req) {
             req->ops->free_req(req);
         }
+        object_unref(OBJECT(req->dev));
+        object_unref(OBJECT(qbus->parent));
         g_free(req);
     }
 }