On Fri, May 11, 2012 at 10:57:25PM +0800, Amos Kong wrote: > The whole PCI slot should be removed once. Currently only one func > is cleaned in pci_unplug_device(), if you try to remove a single > func by monitor cmd. > > Start VM with 8 multiple-function block devs, hot-removing > those block devs by 'device_del ...' would cause qemu abort. > > | (qemu) device_del virti0-0-0 > | (qemu) ** > |ERROR:qom/object.c:389:object_delete: assertion failed: (obj->ref == 0) > > Execute 'device_del $blkid' in monitor > \_handle_user_command() > \_qmp_device_del() > \_qdev_unplug() > \_pci_unplug_device() > | //only one obj(func) is unpluged > v //need process funcs here > object_unparent() > \_object_finalize_child_property()
This is the bug IMO. PCI device delete request through monitor simply notifies guest. It should not unparent the object or do anything else. > Guest sets pci dev by ioport write (eject from acpi) > \_kvm_handle_io() > \_pciej_write() > \_acpi_piix_eject_slot() > | > v //all qdevs(funcs) will be free > QTAILQ_FOREACH_SAFE(qdev, &bus->children, sibling, next) { > PCIDevice *dev = PCI_DEVICE(qdev); > if (PCI_SLOT(dev->devfn) == slot) { > qdev_free() > > Signed-off-by: Amos Kong <ak...@redhat.com> > --- This was done as part of 57c9fafe0f759c9f1efa5451662b3627f9bb95e0. Should we just call object_unparent before qdev_free? Anthony? -- MST