[Qemu-devel] Hot unplug of pci-serial-2x fails assertion

[Markus Armbruster]

Watch this:

    (qemu) chardev-add file,path=foo2,id=foo2
    (qemu) chardev-add file,path=foo3,id=foo3
    (qemu) device_add id=gg,driver=pci-serial-2x,chardev1=foo2,chardev2=foo3
    (qemu) device_del gg
    (qemu) upstream-qemu: /work/armbru/qemu/memory.c:1259: 
memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void 
*)0))' failed.

    Program received signal SIGABRT, Aborted.
    [Switching to Thread 0x7fffe2eb5700 (LWP 28433)]
    0x00007fffedef2c39 in raise () from /lib64/libc.so.6
    (gdb) bt
    #0  0x00007fffedef2c39 in raise () from /lib64/libc.so.6
    #1  0x00007fffedef4348 in abort () from /lib64/libc.so.6
    #2  0x00007fffedeebb96 in __assert_fail_base () from /lib64/libc.so.6
    #3  0x00007fffedeebc42 in __assert_fail () from /lib64/libc.so.6
    #4  0x00005555556443cd in memory_region_finalize (obj=<optimized out>)
        at /work/armbru/qemu/memory.c:1259
    #5  0x000055555583fdca in object_deinit (type=<optimized out>, 
        obj=0x5555563ee328) at /work/armbru/qemu/qom/object.c:408
    #6  object_finalize (data=0x5555563ee328) at 
/work/armbru/qemu/qom/object.c:421
    #7  object_unref (obj=0x5555563ee328) at /work/armbru/qemu/qom/object.c:729
    #8  0x000055555578f598 in multi_serial_pci_exit (dev=0x5555563edae0)
        at /work/armbru/qemu/hw/char/serial-pci.c:154
    #9  0x00005555557e4730 in pci_unregister_device (dev=<optimized out>)
        at /work/armbru/qemu/hw/pci/pci.c:909
    #10 0x00005555557913d4 in device_unrealize (dev=0x5555563edae0, 
        errp=0x7fffe2eb48c0) at /work/armbru/qemu/hw/core/qdev.c:196
    #11 0x000055555579288a in device_set_realized (obj=<optimized out>, 
        value=<optimized out>, errp=0x0) at /work/armbru/qemu/hw/core/qdev.c:885
    #12 0x000055555583eefe in property_set_bool (obj=0x5555563edae0, 
        v=<optimized out>, opaque=0x5555563c01f0, name=<optimized out>, 
errp=0x0)
        at /work/armbru/qemu/qom/object.c:1473
    #13 0x0000555555841837 in object_property_set_qobject (obj=0x5555563edae0, 
        value=<optimized out>, name=0x55555590e3d8 "realized", errp=0x0)
        at /work/armbru/qemu/qom/qom-qobject.c:24
    #14 0x0000555555840450 in object_property_set_bool (
        address@hidden, address@hidden, 
        address@hidden "realized", address@hidden)
        at /work/armbru/qemu/qom/object.c:888
    #15 0x00005555557910db in device_unparent (obj=0x5555563edae0)
        at /work/armbru/qemu/hw/core/qdev.c:1006
    #16 0x00005555558400c5 in object_unparent (obj=0x5555563edae0)
        at /work/armbru/qemu/qom/object.c:396
    #17 0x000055555576e3b6 in acpi_pcihp_eject_slot (s=<optimized out>, 
        bsel=<optimized out>, slots=<optimized out>)
        at /work/armbru/qemu/hw/acpi/pcihp.c:139
    #18 0x0000555555640bba in access_with_adjusted_size (address@hidden, 
        address@hidden, address@hidden, 
        access_size_min=<optimized out>, access_size_max=<optimized out>, 
access=
        0x555555640e60 <memory_region_write_accessor>, mr=0x5555563f5e78)
        at /work/armbru/qemu/memory.c:481
    #19 0x0000555555645897 in memory_region_dispatch_write (size=4, data=16, 
        addr=8, mr=0x5555563f5e78) at /work/armbru/qemu/memory.c:1143
    #20 io_mem_write (address@hidden, addr=8, val=<optimized out>, 
        size=4) at /work/armbru/qemu/memory.c:1976
    #21 0x000055555560fad3 in address_space_rw (
        as=0x555555d3ce80 <address_space_io>, address@hidden, 
        buf=0x7ffff7ff7000 "\020", address@hidden, address@hidden)
        at /work/armbru/qemu/exec.c:2054
    #22 0x000055555563ff18 in kvm_handle_io (count=1, size=4, 
        direction=<optimized out>, data=<optimized out>, port=44552)
        at /work/armbru/qemu/kvm-all.c:1597
    #23 kvm_cpu_exec (address@hidden)
        at /work/armbru/qemu/kvm-all.c:1734
    #24 0x000055555562e2e2 in qemu_kvm_cpu_thread_fn (arg=0x5555563aaee0)
        at /work/armbru/qemu/cpus.c:874
    #25 0x00007ffff6bc7f33 in start_thread () from /lib64/libpthread.so.0
    #26 0x00007fffedfb1ded in clone () from /lib64/libc.so.6