[Qemu-devel] Q35 virtio disk unplug 'memory.c:1403: memory_region_del_eventfd: Assertion `i != mr->ioeventfd_nb' failed.'

[Etienne Martineau]

Hi,

When using virtio disk plug/unplug with Q35 machine I see two problems. 
Note that when using the same sequence with default 440FX I see no issues.

A) 'pcie.0' does not support hotplugging'

I can workaround this problem if I manually specify "-readconfig 
/usr/share/qemu-153/Q35-chipset.cfg" on the QEMU command line and use 
the following monitor command to plug the disk:

(qemu) device_add 
virtio-blk-pci,id=device1,drive=drive1,scsi=on,bus=ich9-pcie-port-1

The content of Q35-chipset.cfg is:

[device "ich9-pcie-port-1"]
  driver = "ioh3420"
  multifunction = "on"
  bus = "pcie.0"

B) Upon disk unplug QEMU is crashing. This is with recent qemu.git

qemu-system-x86_64: memory.c:1403: memory_region_del_eventfd: Assertion 
`i != mr->ioeventfd_nb' failed.

#0  0x00007f9cb9521445 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007f9cb9524bab in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007f9cb951a10e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007f9cb951a1b2 in __assert_fail () from 
/lib/x86_64-linux-gnu/libc.so.6
#4  0x00007f9cbb534b1a in memory_region_del_eventfd (mr=0x7f9cbd8eec98, 
addr=16, size=2, match_data=true, data=0, e=0x7f9cbd9675b0)
    at /usr/src/qemu/memory.c:1403
#5  0x00007f9cbb411fa9 in virtio_pci_set_host_notifier_internal 
(proxy=0x7f9cbd8ee500, n=0, assign=false, set_handler=false)
    at hw/virtio/virtio-pci.c:205
#6  0x00007f9cbb4121c7 in virtio_pci_stop_ioeventfd 
(proxy=0x7f9cbd8ee500) at hw/virtio/virtio-pci.c:265
#7  0x00007f9cbb413f4a in virtio_pci_device_unplugged (d=0x7f9cbd8ee500) 
at hw/virtio/virtio-pci.c:1010
#8  0x00007f9cbb410158 in virtio_bus_device_unplugged 
(vdev=0x7f9cbd8eee00) at hw/virtio/virtio-bus.c:78
#9  0x00007f9cbb5282e7 in virtio_device_unrealize (dev=0x7f9cbd8eee00, 
errp=0x7fffba3682d0) at /usr/src/qemu/hw/virtio/virtio.c:1199
#10 0x00007f9cbb32b31d in device_set_realized (obj=0x7f9cbd8eee00, 
value=false, errp=0x0) at hw/core/qdev.c:795
#11 0x00007f9cbb478088 in property_set_bool (obj=0x7f9cbd8eee00, 
v=0x7f9cbd897700, opaque=0x7f9cbd8ef4a0, name=0x7f9cbb60c96e "realized",
    errp=0x0) at qom/object.c:1421
#12 0x00007f9cbb4768bc in object_property_set (obj=0x7f9cbd8eee00, 
v=0x7f9cbd897700, name=0x7f9cbb60c96e "realized", errp=0x0)
    at qom/object.c:819
#13 0x00007f9cbb4787f2 in object_property_set_qobject 
(obj=0x7f9cbd8eee00, value=0x7f9cbd870cc0, name=0x7f9cbb60c96e 
"realized", errp=0x0)
    at qom/qom-qobject.c:24
#14 0x00007f9cbb476bb9 in object_property_set_bool (obj=0x7f9cbd8eee00, 
value=false, name=0x7f9cbb60c96e "realized", errp=0x0)
    at qom/object.c:883
#15 0x00007f9cbb32b7b4 in device_unparent (obj=0x7f9cbd8eee00) at 
hw/core/qdev.c:881
#16 0x00007f9cbb4757e5 in object_unparent (obj=0x7f9cbd8eee00) at 
qom/object.c:400
#17 0x00007f9cbb32a4b5 in bus_unparent (obj=0x7f9cbd8eed88) at 
hw/core/qdev.c:495
#18 0x00007f9cbb4757e5 in object_unparent (obj=0x7f9cbd8eed88) at 
qom/object.c:400
#19 0x00007f9cbb32b7ce in device_unparent (obj=0x7f9cbd8ee500) at 
hw/core/qdev.c:885
#20 0x00007f9cbb4757e5 in object_unparent (obj=0x7f9cbd8ee500) at 
qom/object.c:400
#21 0x00007f9cbb3af33a in pcie_cap_slot_hot_unplug_cb 
(hotplug_dev=0x7f9cbd834a50, dev=0x7f9cbd8ee500, errp=0x7fffba3686a8) at 
hw/pci/pcie.c:271
#22 0x00007f9cbb32035c in hotplug_handler_unplug 
(plug_handler=0x7f9cbd834a50, plugged_dev=0x7f9cbd8ee500, 
errp=0x7fffba3686a8)
    at hw/core/hotplug.c:33
#23 0x00007f9cbb329855 in qdev_unplug (dev=0x7f9cbd8ee500, 
errp=0x7fffba3686a8) at hw/core/qdev.c:229
#24 0x00007f9cbb45357d in qmp_device_del (id=0x7f9cbd8fd6b0 "device1", 
errp=0x7fffba3686a8) at qdev-monitor.c:696
#25 0x00007f9cbb2e54e9 in hmp_device_del (mon=0x7f9cbd7ef270, 
qdict=0x7f9cbd86f400) at hmp.c:1308
#26 0x00007f9cbb540d3d in handle_user_command (mon=0x7f9cbd7ef270, 
cmdline=0x7f9cbd7f4e20 "device_del device1") at /usr/src/qemu/monitor.c:4159
#27 0x00007f9cbb542b6c in monitor_command_cb (opaque=0x7f9cbd7ef270, 
cmdline=0x7f9cbd7f4e20 "device_del device1", readline_opaque=0x0)
    at /usr/src/qemu/monitor.c:4886
#28 0x00007f9cbb5f6185 in readline_handle_byte (rs=0x7f9cbd7f4e20, 
ch=13) at util/readline.c:376
#29 0x00007f9cbb542aa6 in monitor_read (opaque=0x7f9cbd7ef270, 
buf=0x7fffba368850 "\r\220\066\272\377\177", size=1)
    at /usr/src/qemu/monitor.c:4869
#30 0x00007f9cbb453a5f in qemu_chr_be_write (s=0x7f9cbd7e0450, 
buf=0x7fffba368850 "\r\220\066\272\377\177", len=1) at qemu-char.c:165
#31 0x00007f9cbb457e75 in tcp_chr_read (chan=0x7f9cbd8feb80, 
cond=G_IO_IN, opaque=0x7f9cbd7e0450) at qemu-char.c:2487
#32 0x00007f9cba8eec9a in g_main_context_dispatch () from 
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#33 0x00007f9cbb4195ec in glib_pollfds_poll () at main-loop.c:190
#34 0x00007f9cbb4196ec in os_host_main_loop_wait (timeout=1000000000) at 
main-loop.c:235
#35 0x00007f9cbb4197bf in main_loop_wait (nonblocking=0) at main-loop.c:484
#36 0x00007f9cbb4994f2 in main_loop () at vl.c:2075
#37 0x00007f9cbb4a0cb3 in main (argc=21, argv=0x7fffba369db8, 
envp=0x7fffba369e68) at vl.c:4557

-Etienne