Start QEMU with a pci-serial-2x device: -chardev file,path=/dev/null,id=foo2 -chardev file,path=/dev/null,id=foo3 -device id=gg,driver=pci-serial-2x,chardev1=foo2,chardev2=foo3
Wait until the guest finishes booting (F-19 in my case), then hot unplug the device: (qemu) device_del gg (qemu) qemu-system-x86_64: /work/armbru/tmp/qemu/memory.c:1021: memory_region_destroy: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed. Aborted (core dumped) Backtrace: #0 0x00007fffedecec39 in raise () from /lib64/libc.so.6 #1 0x00007fffeded0348 in abort () from /lib64/libc.so.6 #2 0x00007fffedec7b96 in __assert_fail_base () from /lib64/libc.so.6 #3 0x00007fffedec7c42 in __assert_fail () from /lib64/libc.so.6 #4 0x0000555555644908 in memory_region_destroy (mr=0x555556467ae0) at /work/armbru/qemu/memory.c:1118 #5 0x000055555578e4a8 in multi_serial_pci_exit (dev=0x555556467360) at /work/armbru/qemu/hw/char/serial-pci.c:154 #6 0x00005555557e3320 in pci_unregister_device (dev=<optimized out>) at /work/armbru/qemu/hw/pci/pci.c:909 #7 0x0000555555790234 in device_unrealize (dev=0x555556467360, errp=0x7fffe2e8d8c0) at /work/armbru/qemu/hw/core/qdev.c:196 #8 0x0000555555791648 in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=0x0) at /work/armbru/qemu/hw/core/qdev.c:863 #9 0x000055555583c9ae in property_set_bool (obj=0x555556467360, v=<optimized out>, opaque=0x555556421180, name=<optimized out>, errp=0x0) at /work/armbru/qemu/qom/object.c:1456 #10 0x000055555583f1c7 in object_property_set_qobject (obj=0x555556467360, value=<optimized out>, name=0x555555909cd8 "realized", errp=0x0) at /work/armbru/qemu/qom/qom-qobject.c:24 #11 0x000055555583dee0 in object_property_set_bool ( obj=obj@entry=0x555556467360, value=value@entry=false, name=name@entry=0x555555909cd8 "realized", errp=errp@entry=0x0) at /work/armbru/qemu/qom/object.c:884 #12 0x000055555578ff9c in device_unparent (obj=0x555556467360) at /work/armbru/qemu/hw/core/qdev.c:978 #13 0x000055555583db91 in object_unparent (obj=0x555556467360) at /work/armbru/qemu/qom/object.c:401 #14 0x000055555576d336 in acpi_pcihp_eject_slot (s=<optimized out>, bsel=<optimized out>, slots=<optimized out>) at /work/armbru/qemu/hw/acpi/pcihp.c:139 #15 0x00005555556416b2 in access_with_adjusted_size (addr=addr@entry=8, value=value@entry=0x7fffe2e8dab0, size=size@entry=4, access_size_min=<optimized out>, access_size_max=<optimized out>, access= 0x555555641b00 <memory_region_write_accessor>, mr=0x5555563c5c18) at /work/armbru/qemu/memory.c:480 #16 0x0000555555645dc6 in memory_region_dispatch_write (size=4, data=16, addr=8, mr=0x5555563c5c18) at /work/armbru/qemu/memory.c:1004 #17 io_mem_write (mr=mr@entry=0x5555563c5c18, addr=8, val=<optimized out>, size=4) at /work/armbru/qemu/memory.c:1812 #18 0x0000555555610713 in address_space_rw ( as=0x555555d373c0 <address_space_io>, addr=addr@entry=44552, buf=0x7ffff7ff7000 "\020", len=len@entry=4, is_write=is_write@entry=true) at /work/armbru/qemu/exec.c:2047 #19 0x0000555555640a18 in kvm_handle_io (count=1, size=4, direction=<optimized out>, data=<optimized out>, port=44552) at /work/armbru/qemu/kvm-all.c:1597 #20 kvm_cpu_exec (cpu=cpu@entry=0x5555563a3470) at /work/armbru/qemu/kvm-all.c:1734 #21 0x000055555562ef92 in qemu_kvm_cpu_thread_fn (arg=0x5555563a3470) at /work/armbru/qemu/cpus.c:874 #22 0x00007ffff6ba0f33 in start_thread () from /lib64/libpthread.so.0 #23 0x00007fffedf8dded in clone () from /lib64/libc.so.6