so an additional info this subject about that intr_handler.

spc (0x88005c60) is 
88005C5A        909F    MOV.W           @(H'9F,PC),R0
88005C5C        6283    MOV             R8,R2
88005C5E        320C    ADD             R0,R2
88005C60        018E    MOV.L           @(R0,R8),R1
88005C62        2118    TST             R1,R1
88005C64        8B02    BF              H'02
88005C66        5121    MOV.L           @(H'1,R2),R1

maybe is is kern/kern_clock.c line 533:
         if (CLKF_USERMODE(frame) && 
            timerisset(&pstats->p_timer[ITIMER_VIRTUAL].it_value) && 
            itimerdecr(&pstats->p_timer[ITIMER_VIRTUAL], tick) == 0) 

... must have I doubt about ipendings in locore.s ?

------------------------+
minematu@aimcom.co.jp   |

From: minematu@aimcom.co.jp (Hiroki Minematu)
Subject: NetBSD/evbsh3 intr_handler panic.
Date: Fri, 16 Nov 2001 02:13:21 +0900

> Hello!
> 
>  I got panic with NetBSD evbsh3 porting my evaluation board that
> mount SH4(7750S) and simple serial port and some LAN controllers.
>  illustrate the following boot log. it is just nfs_boot failure 
> and read /sbin/init from md_root fs.
> 
> unfortunately, as soon as getting any soft trap, and come out 
> endless intr_handler loop :-(
> 
> but, I say it is not reentrant, so I lay a snare that in(+)/out(-) 
> counter on entrance to and way out for `hardclock' function. 
> counter value show me a process stay the inside at 
> (maybe 0x88005c60).
> 
> and I thin down indication from intr_handler by 1, 16 and 256,
> or changed timer interval into 64hz, 32hz, but display timing
> don't change. so this crash is not the origin in timer intr.
> when make another attenpt, stimulating this board with NMI
> displaied int_no change 420 to 1c0 (NMI), but spc in not change.
> I wonder why replace only int_no.
> 
> the register r15 (is use for stacks) is droped 24 at a time,
> and kernel crash when it should fully close a code precipice.
> 
>  where should I explore NetBSD source tree?
> 
> # of cource, some private patch applied for LAN controller, but
> # it works fine. the truth, get successfully reading /sbin/init
> # from NFS server. the question is on next phasese.
> ------------------------+
> Hiroki MINEMATSU/Aimcom |
> minematu@aimcom.co.jp   |
> +=+=+=+=+=+=+=+=+=+=+=+  boot log +=+=+=+=+=+=+=+=+=+=+=+ 
> nfs_boot: timeout...
> cannot mount root, error = 60
> root device (default md0a):
> dump device (default md0b): none
> file system (default nfs): ffs
> root on md0a
> readclock: -1900/1/1/0/0/0(6)
> WARNING: clock time much less than file system time
> WARNING: using file system time
> WARNING: CHECK AND RESET THE DATE!
> init: copying out flags `-s' 3
> init: copying out path `/sbin/init' 11
> trap f00 spc 113c ssr 0
> curproc 0x88757000
> trap f00 spc 113c ssr 0
> curproc 0x88757000
> trap f00 spc 113c ssr 0
> curproc 0x88757000
> trap f00 spc 113c ssr 0
> curproc 0x88757000
> trap f00 spc 113c ssr 0
> curproc 0x88757000
> trap f00 spc 113c ssr 0
> curproc 0x88757000
> intr_handler:int_no 420 spc 880be192 ssr 40000000 r15 88753f0c curproc 88757000
> intr_handler:int_no 420 spc 88005c60 ssr 40000000 r15 88753e58 curproc 88757000
> intr_handler:int_no 420 spc 88005c60 ssr 40000000 r15 88753e34 curproc 88757000
> ... 
> intr_handler:int_no 420 spc 88005c60 ssr 40000000 r15 88753e34 curproc 88757000