Comment 1 for bug 1087114

On Thu, Dec 06, 2012 at 04:02:57AM -0000, Brad Smith wrote:
> QEMU 1.3.0 on OpenBSD now crashes with an error as shown below and the
> command line params do not seem to matter.

Please use git-bisect(1) to identify the commit that caused the
regression.

I was unable to hit this code path with qemu-system-i386 with an IDE
disk. Please do share your command-line.

> assertion "QLIST_EMPTY(&bs->tracked_requests)" failed: file "block.c",
> line 1220, function "bdrv_drain_all"

bdrv_drain_all() waits until in-flight requests have completed. The
assertion verifies that all I/O requests are really done. Something is
wrong here.

> #1 0x0000030d1bce24aa in abort () at /usr/src/lib/libc/stdlib/abort.c:70
> p = (struct atexit *) 0x30d11897000
> mask = 4294967263
> cleanup_called = 1
> #2 0x0000030d1bc5ff44 in __assert2 (file=Variable "file" is not available.
> ) at /usr/src/lib/libc/gen/assert.c:52
> No locals.
> #3 0x0000030b0d383a03 in bdrv_drain_all () at block.c:1220
> bs = (BlockDriverState *) 0x30d13f3b630
> busy = false
> __func__ = "bdrv_drain_all"
> #4 0x0000030b0d43acfc in bmdma_cmd_writeb (bm=0x30d0f5f56a8, val=8) at hw/ide/pci.c:312
> __func__ = "bmdma_cmd_writeb"
> #5 0x0000030b0d43b450 in bmdma_write (opaque=0x30d0f5f56a8, addr=0, val=8, size=1) at hw/ide/piix.c:76
> bm = (BMDMAState *) 0x30d0f5f56a8

The device is an IDE disk.

> #6 0x0000030b0d5c2ce6 in memory_region_write_accessor (opaque=0x30d0f5f57d0, addr=0, value=0x30d18c288f0, size=1, shift=0, mask=255)
> at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:334
> mr = (MemoryRegion *) 0x30d0f5f57d0
> tmp = 8
> #7 0x0000030b0d5c2dc5 in access_with_adjusted_size (addr=0, value=0x30d18c288f0, size=1, access_size_min=1, access_size_max=4,
> access=0x30b0d5c2c6b <memory_region_write_accessor>, opaque=0x30d0f5f57d0) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:364
> access_mask = 255
> access_size = 1
> i = 0
> #8 0x0000030b0d5c3222 in memory_region_iorange_write (iorange=0x30d1d5e7400, offset=0, width=1, data=8)
> at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:439
> mrio = (MemoryRegionIORange *) 0x30d1d5e7400
> mr = (MemoryRegion *) 0x30d0f5f57d0
> __func__ = "memory_region_iorange_write"
> #9 0x0000030b0d5c019a in ioport_writeb_thunk (opaque=0x30d1d5e7400, addr=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:212
> ioport = (IORange *) 0x30d1d5e7400
> #10 0x0000030b0d5bfb65 in ioport_write (index=0, address=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:83
> func = (IOPortWriteFunc *) 0x30b0d5c0148 <ioport_writeb_thunk>
> default_func = {0x30b0d5bfbbc <default_ioport_writeb>, 0x30b0d5bfc61 <default_ioport_writew>, 0x30b0d5bfd0c <default_ioport_writel>}
> #11 0x0000030b0d5c0704 in cpu_outb (addr=49216, val=8 '\b') at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:289
> No locals.
> #12 0x0000030b0d6067dd in helper_outb (port=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/target-i386/misc_helper.c:72
> No locals.