>Number:         33340
>Category:       port-sparc
>Synopsis:       NetBSD panics while attaching QFE card
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-sparc-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Apr 22 22:55:00 +0000 2006
>Originator:     Matthias Scheler
>Release:        NetBSD 3.0_STABLE 2006-04-21 sources
>Organization:
Matthias Scheler                                  http://scheler.de/~matthias/
>Environment:
System: NetBSD 3.0_STABLE (IVANOVA) #0: Sat Apr 22 16:15:25 BST 2006
        tron@colwyn.zhadum.org.uk:/src/sys/compile/IVANOVA
Architecture: sparc
Machine: sparc
>Description:
I'm trying to setup a Dual HyperSPARC SPARCstation 20 to run as a firewall
under NetBSD 3.0_STABLE. The machine works fine with a Swift card (SCSI
and HME combined) plugged in but crashed reproducable with QFE card
plugged in like this:

SPARCstation 20 MP (2 X RT625), No Keyboard
ROM Rev. 2.25, 320 MB memory installed, Serial #7596660.
Ethernet address 8:0:20:73:ea:74, Host ID: 7273ea74.


Boot device: /iommu/sbus/espdma@f,400000/esp@f,800000/sd@3,0:a  File and args: 
>> NetBSD/sparc Secondary Boot, Revision 1.15
>> (tron@colwyn.zhadum.org.uk, Sat Apr 22 03:59:43 BST 2006)
Booting netbsd
2635848+76820+223816 [150688+136654]=0x323418
[...]
hme0: Ethernet address 08:00:20:xx:xx:xx
qsphy0 at hme0 phy 1: QS6612 10/100 media interface, rev. 1
qsphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
hme1 at sbus0 slot 2 offset 0x8c10000 level 4 (ipl 7): Sun Happy Meal Ethernet (SUNW,qfe)
hme1: Ethernet address 08:00:20:xx:xx:xx
qsphy1 at hme1 phy 1: QS6612 10/100 media interface, rev. 1
qsphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
hme2 at sbus0 slot 2 offset 0x8c20000 level 4 (ipl 7): Sun Happy Meal Ethernet (SUNW,qfe)
hme2: Ethernet address 08:00:20:xx:xx:xx
qsphy2 at hme2 phy 1: QS6612 10/100 media interface, rev. 1
qsphy2: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
hme3 at sbus0 slot 2 offset 0x8c30000 level 4 (ipl 7): Sun Happy Meal Ethernet (SUNW,qfe)
panic: kernel diagnostic assertion "me" failed: file "/usr/src/sys/uvm/uvm_map.c", line 481
Stopped in pid 0.1 (swapper) at netbsd:cpu_Debugger+0x4:        or    

Here's what the kernel knows about this:

db{0}> trace
cpu_Debugger(0xf02874a0, 0xf0254fa8, 0xf0268790, 0xf0277ef8, 0x100, 0xf02a4c00) at netbsd:__assert+0x18
__assert(0xf0254fa8, 0xf0277ef8, 0x1e1, 0xf0268790, 0x0, 0x0) at netbsd:uvm_map_clip_end+0x2a0
uvm_map_clip_end(0xf02c44d8, 0xf08f31f8, 0xf4300000, 0xf00, 0x40500, 0xf42e5000) at netbsd:uvm_unmap_remove+0x388
uvm_unmap_remove(0xf02c44d8, 0xf42e5000, 0xf4300000, 0xf029f04c, 0xf029f050, 0xffffffff) at netbsd:uvm_unmap1+0xcc
uvm_unmap1(0xf02c44d8, 0xf42e5000, 0xf4300000, 0xf02c4590, 0xffffffff, 0xc00000) at netbsd:_bus_dma_valloc_skewed+0xa4
_bus_dma_valloc_skewed(0xf4300000, 0xf42e5000, 0x40000, 0x0, 0x0, 0xf08fe880) at netbsd:iommu_dmamem_map+0x50
iommu_dmamem_map(0xf09fe900, 0xf029f1a8, 0x1, 0x65000, 0xf0a0f6c8, 0x5) at netbsd:hme_config+0x90
hme_config(0xf0a0f400, 0xf027b7d0, 0xffffffff, 0x0, 0x70, 0xfe05a000) at netbsd:hmeattach_sbus+0x2b4
hmeattach_sbus(0xf8003f, 0xf0a0f400, 0x5, 0x0, 0x378, 0x5) at netbsd:config_attach_loc+0x3c0
config_attach_loc(0xf0a0f400, 0xf02a0e94, 0x0, 0xf029f310, 0x3, 0xf02a4000) at netbsd:sbus_attach_common+0x184
sbus_attach_common(0xf0912a00, 0xf02c4ad8, 0x0, 0x0, 0x54, 0x5) at netbsd:config_attach_loc+0x3c0
config_attach_loc(0xf0912a00, 0xf02a0e94, 0x0, 0xf029f430, 0x0, 0xf02a4000) at netbsd:iommu_attach+0x428
iommu_attach(0xf027a000, 0xf09fe900, 0xf029f598, 0xf02a4000, 0xf01e6000, 0xf02a8400) at netbsd:config_attach_loc+0x3c0
config_attach_loc(0xf09fe900, 0xf02a0e94, 0x0, 0xf029f598, 0x0, 0xf02a4000) at netbsd:mainbus_attach+0x314
mainbus_attach(0xf027a000, 0xf0a08f80, 0xf027c000, 0xf0254c00, 0xf02a8400, 0xf029f578) at netbsd:config_attach_loc+0x3c0
config_attach_loc(0xf0a08f80, 0xf02a0e94, 0x0, 0x0, 0x0, 0xf02a4000) at netbsd:cpu_configure+0x40
cpu_configure(0xf0a08fc0, 0x14, 0xf02738b0, 0x0, 0x0, 0xf0271ca0) at netbsd:configure+0x58
configure(0x0, 0x20000000, 0xf02d7800, 0x2000000, 0x0, 0x133c2000) at netbsd:main+0x2f8
main(0x0, 0xfffffff8, 0x0, 0x0, 0x0, 0xf0002270) at netbsd:ft_want_ast+0xbd8

db{0}> show registers
psr         0x1e001fc4
pc          0xf02220c4  cpu_Debugger+0x4
npc         0xf02220c8  cpu_Debugger+0x8
y           0
wim         0
g0          0
g1          0xf02a2800  ufs_initcount
g2          0x1
g3          0xfe012000
g4          0xfe01c010
g5          0xf4240
g6          0xf0004000
g7          0xffd3d580
o0          0xf0261758  copyright+0xcfc0
o1          0xf029eef0  __link_set_evcnts_sym_lev14_evcnt+0x176ac
o2          0xffffffff
o3          0
o4          0x70
o5          0xfe05a000
o6          0xf029ee40  __link_set_evcnts_sym_lev14_evcnt+0x175fc
o7          0xf015b774  panic+0x16c
l0          0xf08f3558
l1          0xf08f3258
l2          0xf08f31f8
l3          0xf08f3258
l4          0xf0006e18  ft_want_ast+0x1f8
l5          0xf4240
l6          0xf0004000
l7          0xffd3d580
i0          0xf02874a0  copyright+0x32d08
i1          0xf0254fa8  copyright+0x810
i2          0xf0268790  copyright+0x13ff8
i3          0xf0277ef8  copyright+0x23760
i4          0x100
i5          0xf02a4c00  defcorename+0x328
i6          0xf029eea8  __link_set_evcnts_sym_lev14_evcnt+0x17664
i7          0xf02297c8  __assert+0x18

This is the function in the kernel sources where it dies:

static __inline struct vm_map_entry *
uvm_mapent_alloc_split(struct vm_map *map,
    const struct vm_map_entry *old_entry, int flags,
    struct uvm_mapent_reservation *umr)
{
	struct vm_map_entry *me;

	KASSERT(!VM_MAP_USE_KMAPENT(map) ||
	    (old_entry->flags & UVM_MAP_QUANTUM) || !UMR_EMPTY(umr));

	if (old_entry->flags & UVM_MAP_QUANTUM) {
		int s;
		struct vm_map_kernel *vmk = vm_map_to_kernel(map);

		s = splvm();
		simple_lock(&uvm.kentry_lock);
		me = vmk->vmk_merged_entries;
---->		KASSERT(me);
		vmk->vmk_merged_entries = me->next;
		simple_unlock(&uvm.kentry_lock);
		splx(s);
		KASSERT(me->flags & UVM_MAP_QUANTUM);
	} else {
		me = uvm_mapent_alloc(map, flags);
	}

	return me;
}

I do *not* think this is a hardware problem because:
1.) It happens with two different QFE cards. One of them was in service
    in my SPARCstation LX for years.
2.) The machine booted Solaris 9 fine using one of the two QFE cards
    as it network interface. Solaris recognized all for ports of
    the card without problems.

Here is a "dmesg" of the machine with the Swift card plugged in:

NetBSD 3.0_STABLE (GENERIC.MP) #0: Sat Apr 22 04:49:03 BST 2006
	tron@colwyn.zhadum.org.uk:/export/scratch/tron/build.15922a/obj/sys/arch/sparc/compile/GENERIC.MP
total memory = 447 MB
avail memory = 433 MB
bootpath: /iommu@f,e0000000/sbus@f,e0001000/SUNW,hme@2,8c00000
mainbus0 (root): SUNW,SPARCstation-20: hostid 7273ea74
cpu0 at mainbus0: mid 8: RT620/625 @ 100 MHz, on-chip FPU
cpu0: 256K byte write-back, 64 bytes/line, sw flush: cache enabled
cpu1 at mainbus0: mid 10: RT620/625 @ 100 MHz, on-chip FPU
cpu1: 256K byte write-back, 64 bytes/line, sw flush: cache enabled
obio0 at mainbus0
clock0 at obio0 slot 0 offset 0x200000: mk48t08
timer0 at obio0 slot 0 offset 0x300000: delay constant 48
zs0 at obio0 slot 0 offset 0x100000 level 12 softpri 6
zstty0 at zs0 channel 0 (console i/o)
zstty1 at zs0 channel 1
zs1 at obio0 slot 0 offset 0x0 level 12 softpri 6
kbd0 at zs1 channel 0: baud rate 1200
ms0 at zs1 channel 1: baud rate 1200
fdc0 at obio0 slot 0 offset 0x700000 level 11 softpri 4: chip 82077
fd0 at fdc0 drive 0: 1.44MB 80 cyl, 2 head, 18 sec
auxreg0 at obio0 slot 0 offset 0x800000
power0 at obio0 slot 0 offset 0xa01000 level 2
cgfourteen0 at obio0 slot 2 offset 0x0 level 8: cgthree emulated at 1152x900x8bpp
cgfourteen0: attached to /dev/fb
iommu0 at mainbus0 ioaddr 0xe0000000: version 0x1/0x1, page-size 4096, range 64MB
sbus0 at iommu0: clock = 25 MHz
dma0 at sbus0 slot 15 offset 0x400000: DMA rev 2
esp0 at dma0 slot 15 offset 0x800000 level 4: ESP200, 40MHz, SCSI ID 7
scsibus0 at esp0: 8 targets, 8 luns per target
ledma0 at sbus0 slot 15 offset 0x400010: DMA rev 2
le0 at ledma0 slot 15 offset 0xc00000 level 6: address 08:00:20:xx:xx:xx
le0: 8 receive buffers, 2 transmit buffers
bpp0 at sbus0 slot 15 offset 0x4800000 level 2 (ipl 3): DMA rev 2
SUNW,DBRIe at sbus0 slot 14 offset 0x10000 level 9 not configured
hme0 at sbus0 slot 2 offset 0x8c00000 level 4 (ipl 7): Sun Happy Meal Ethernet (SUNW,hme)
hme0: Ethernet address 08:00:20:xx:xx:xx
nsphy0 at hme0 phy 1: DP83840 10/100 media interface, rev. 0
nsphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
esp1 at sbus0 slot 2 offset 0x8800000 level 3 (ipl 5): FAS366/HME, 40MHz, SCSI ID 7
scsibus1 at esp1: 16 targets, 8 luns per target
eccmemctl0 at mainbus0 ioaddr 0x0: version 0x0/0x2
Kernelized RAIDframe activated
scsibus0: waiting 2 seconds for devices to settle...
scsibus1: waiting 2 seconds for devices to settle...
sd0 at scsibus0 target 3 lun 0: <HP, 9.10GB A 80-S94C, S94C> disk fixed
sd0: 8678 MB, 8387 cyl, 10 head, 211 sec, 512 bytes/sect x 17773524 sectors
sd0: sync (100.00ns offset 15), 8-bit (10.000MB/s) transfers, tagged queueing
cd0 at scsibus0 target 6 lun 0: <TOSHIBA, XM-4101TASUNSLCD, 1084> cdrom removable
cd0: async, 8-bit transfers
sd0: no disk label
root on hme0
nfs_boot: trying DHCP/BOOTP
nfs_boot: DHCP next-server: 81.187.181.119
nfs_boot: my_name=karloff
nfs_boot: my_domain=zhadum.org.uk
nfs_boot: my_addr=192.168.25.7
nfs_boot: my_mask=255.255.255.0
nfs_boot: gateway=192.168.25.1
root on colwyn:/export/install/netbsd/sparc
root file system type: nfs
cpu0: booting secondary processors: cpu1
sd0: no disk label

>How-To-Repeat:
Boot NetBSD 3.0_STABLE, wait until QFE card is probed by the kernel.

>Fix:
None provided.