guest aborts when detaching a SR-IOV VF

[Yongjie Ren]

Environment:
------------
Host OS (ia32/ia32e/IA64):All
Guest OS (ia32/ia32e/IA64):ia32e
Guest OS Type (Linux/Windows):Linux
kvm.git Commit:211978fb6c666f824ae8221baeaeeee7ee28efc1
qemu.git Commit:edbb7c0de56692868e6126c7ff7e8bf917f8d0e7
Host Kernel Version:3.1.0-rc9+
Hardware: Westmere-EP && SandyBridge platform

Bug detailed description:
--------------------------
Guest will abort when detaching a SR-IOV VF.
I'm using rhel6 and rhel6u1 as my guest. Firstly, I hot-plug a sr-iov VF to a guest. Then I detach the VF from the guest. At that time, guest aborts and qemu-kvm process aborts with the following message.
"qemu-system-x86_64: /workspace/qemu-kvm/memory.c:998: memory_region_destroy: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.
Aborted (core dumped) "

Reproduce steps:
----------------
1.start a rhel6 guest
2.attach a SR-IOV VF to the guest: device_add pci-assign,host=01:10.0,id=myNIC
(I'm using 82576 Virtual Function.)
3.detach the VF from the guest: device_del myNIC
(you'll find guest aborts)

Current result:
----------------
guest aborts and qemu process aborts

Expected result:
----------------
guest still alive

[Yongjie Ren (yongjie-ren)]

I also tried this issue with Intel 82576EI NIC, and this normal VT-D NIC doesn't have this detachment issue.

[Yongjie Ren (yongjie-ren)]

This bug is got fixed in qemu-kvm upstream. I verified it. The following is the commit info for the fix in qemu-kvm.

commit c4cd183600aa6319b4a4a0b48cb41d63198e08c3
Author: Alex Williamson <email address hidden>
Date: Wed Nov 16 13:45:32 2011 -0700

    pci-assign: Fix device removal

    We're destroying the memory container before we remove the
    subregions it holds. This fixes:

    https://bugs.launchpad.net/qemu/+bug/875723

    Signed-off-by: Alex Williamson <email address hidden>
    Signed-off-by: Avi Kivity <email address hidden>