From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:57238)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@pond.sub.org>) id 1Wzr2P-0007a8-Qj
	for qemu-devel@nongnu.org; Wed, 25 Jun 2014 13:31:22 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <armbru@pond.sub.org>) id 1Wzr2G-00069J-DF
	for qemu-devel@nongnu.org; Wed, 25 Jun 2014 13:31:13 -0400
Received: from oxygen.pond.sub.org ([2a01:4f8:201:233:1::3]:59967)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@pond.sub.org>) id 1Wzr2E-00068S-70
	for qemu-devel@nongnu.org; Wed, 25 Jun 2014 13:31:04 -0400
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 25 Jun 2014 19:30:59 +0200
Message-ID: <87bntg6gmk.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain
Subject: [Qemu-devel] Hot unplug of pci-serial-2x crashes
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Paolo Bonzini <pbonzini@redhat.com>, Gerd Hoffmann <kraxel@redhat.com>, Andreas =?utf-8?Q?F=C3=A4rber?= <afaerber@suse.de>

Start QEMU with a pci-serial-2x device:

    -chardev file,path=/dev/null,id=foo2
    -chardev file,path=/dev/null,id=foo3
    -device id=gg,driver=pci-serial-2x,chardev1=foo2,chardev2=foo3

Wait until the guest finishes booting (F-19 in my case), then hot unplug
the device:

    (qemu) device_del gg
    (qemu) qemu-system-x86_64: /work/armbru/tmp/qemu/memory.c:1021: memory_region_destroy: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.
    Aborted (core dumped)

Backtrace:

#0  0x00007fffedecec39 in raise () from /lib64/libc.so.6
#1  0x00007fffeded0348 in abort () from /lib64/libc.so.6
#2  0x00007fffedec7b96 in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007fffedec7c42 in __assert_fail () from /lib64/libc.so.6
#4  0x0000555555644908 in memory_region_destroy (mr=0x555556467ae0)
    at /work/armbru/qemu/memory.c:1118
#5  0x000055555578e4a8 in multi_serial_pci_exit (dev=0x555556467360)
    at /work/armbru/qemu/hw/char/serial-pci.c:154
#6  0x00005555557e3320 in pci_unregister_device (dev=<optimized out>)
    at /work/armbru/qemu/hw/pci/pci.c:909
#7  0x0000555555790234 in device_unrealize (dev=0x555556467360, 
    errp=0x7fffe2e8d8c0) at /work/armbru/qemu/hw/core/qdev.c:196
#8  0x0000555555791648 in device_set_realized (obj=<optimized out>, 
    value=<optimized out>, errp=0x0) at /work/armbru/qemu/hw/core/qdev.c:863
#9  0x000055555583c9ae in property_set_bool (obj=0x555556467360, 
    v=<optimized out>, opaque=0x555556421180, name=<optimized out>, errp=0x0)
    at /work/armbru/qemu/qom/object.c:1456
#10 0x000055555583f1c7 in object_property_set_qobject (obj=0x555556467360, 
    value=<optimized out>, name=0x555555909cd8 "realized", errp=0x0)
    at /work/armbru/qemu/qom/qom-qobject.c:24
#11 0x000055555583dee0 in object_property_set_bool (
    obj=obj@entry=0x555556467360, value=value@entry=false, 
    name=name@entry=0x555555909cd8 "realized", errp=errp@entry=0x0)
    at /work/armbru/qemu/qom/object.c:884
#12 0x000055555578ff9c in device_unparent (obj=0x555556467360)
    at /work/armbru/qemu/hw/core/qdev.c:978
#13 0x000055555583db91 in object_unparent (obj=0x555556467360)
    at /work/armbru/qemu/qom/object.c:401
#14 0x000055555576d336 in acpi_pcihp_eject_slot (s=<optimized out>, 
    bsel=<optimized out>, slots=<optimized out>)
    at /work/armbru/qemu/hw/acpi/pcihp.c:139
#15 0x00005555556416b2 in access_with_adjusted_size (addr=addr@entry=8, 
    value=value@entry=0x7fffe2e8dab0, size=size@entry=4, 
    access_size_min=<optimized out>, access_size_max=<optimized out>, access=
    0x555555641b00 <memory_region_write_accessor>, mr=0x5555563c5c18)
    at /work/armbru/qemu/memory.c:480
#16 0x0000555555645dc6 in memory_region_dispatch_write (size=4, data=16, 
    addr=8, mr=0x5555563c5c18) at /work/armbru/qemu/memory.c:1004
#17 io_mem_write (mr=mr@entry=0x5555563c5c18, addr=8, val=<optimized out>, 
    size=4) at /work/armbru/qemu/memory.c:1812
#18 0x0000555555610713 in address_space_rw (
    as=0x555555d373c0 <address_space_io>, addr=addr@entry=44552, 
    buf=0x7ffff7ff7000 "\020", len=len@entry=4, is_write=is_write@entry=true)
    at /work/armbru/qemu/exec.c:2047
#19 0x0000555555640a18 in kvm_handle_io (count=1, size=4, 
    direction=<optimized out>, data=<optimized out>, port=44552)
    at /work/armbru/qemu/kvm-all.c:1597
#20 kvm_cpu_exec (cpu=cpu@entry=0x5555563a3470)
    at /work/armbru/qemu/kvm-all.c:1734
#21 0x000055555562ef92 in qemu_kvm_cpu_thread_fn (arg=0x5555563a3470)
    at /work/armbru/qemu/cpus.c:874
#22 0x00007ffff6ba0f33 in start_thread () from /lib64/libpthread.so.0
#23 0x00007fffedf8dded in clone () from /lib64/libc.so.6