kern/42849: 32 ppbs causes a lockdebug panic during vmware boot of current

[darran%NetBSD.org@localhost]

>Number:         42849
>Category:       kern
>Synopsis:       32 ppbs causes a lockdebug panic during vmware boot of current
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Feb 19 22:50:01 +0000 2010
>Originator:     Darran Hunt
>Release:        current
>Organization:
CoyotePoint Systems
>Environment:
NetBSD  5.99.24 NetBSD 5.99.24 (GENERIC_LOCKDEBUG) #1: Sat Feb 20 11:35:06 NZDT 
2010  
darran@bsd:/home/darran/build/current.dtrace/nbobj/sys/arch/i386/compile/GENERIC_LOCKDEBUG
 i386
>Description:
The boot panics after enumerating the 32nd ppb:

ppb31 at pci0 dev 24 function 5: vendor 0x15ad product 0x07a0 (rev. 0x01)
ppb31: unsupported PCI Express version
Mutex error: lockdebug_barrier: spin lock held
 
lock address : 0x00000000c0b2a08c type     :               spin
initialized  : 0x00000000c062eb2b
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
current cpu  :                  0 last held:                  0
current lwp  : 0x00000000c0adf2e0 last held: 0x00000000c0adf2e0
last locked  : 0x00000000c062df83 unlocked : 0x00000000c062df59
owner field  : 0x0000000000010600 wait/spin:                0/1
 
panic: LOCKDEBUG
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c0246cb4 cs 8 eflags 246 cr2 0 ilevel 8
Stopped in pid 0.1 (system) at  netbsd:breakpoint+0x4:  popl    %ebp

kgdb backtrace:
#0  0xc0246cb4 in breakpoint ()
#1  0xc064142e in panic (fmt=0xc0a51412 "LOCKDEBUG")
    at /home/darran/dev/current.dtrace/src/sys/kern/subr_prf.c:299
#2  0xc063921b in lockdebug_abort1 (ld=0xca997044, s=8, func=0xc09c2ca8 
"lockdebug_barrier", 
    msg=0xc0a5142b "spin lock held", dopanic=true)
    at /home/darran/dev/current.dtrace/src/sys/kern/subr_lockdebug.c:777
#3  0xc04c9533 in mutex_vector_enter (mtx=0xc16c0800)
    at /home/darran/dev/current.dtrace/src/sys/kern/kern_mutex.c:506
#4  0xc06441a0 in vmem_xfree (vm=0xc16c0800, addr=3404795448, size=133)
    at /home/darran/dev/current.dtrace/src/sys/kern/subr_vmem.c:1062
#5  0xc06371c9 in kmem_free (p=0xcaf10e38, size=132)
    at /home/darran/dev/current.dtrace/src/sys/kern/subr_kmem.c:279
#6  0xc062e094 in config_devalloc (parent=0xcaf59204, cf=0xc0a79950, locs=0x0)
    at /home/darran/dev/current.dtrace/src/sys/kern/subr_autoconf.c:1001
#7  0xc062e49c in config_attach_loc (parent=0xcaf59204, cf=0xc0a79950, 
locs=0x0, aux=0xc0c8f85c, 
    print=0xc0569e40 <pcibusprint>) at 
/home/darran/dev/current.dtrace/src/sys/kern/subr_autoconf.c:1256
#8  0xc062e852 in config_found_ia (parent=0xcaf59204, ifattr=0xc09dbc46 
"pcibus", aux=0xc0c8f85c, 
    print=0xc0569e40 <pcibusprint>) at 
/home/darran/dev/current.dtrace/src/sys/kern/subr_autoconf.c:913
#9  0xc05854f9 in ppbattach (parent=0xcac77c3c, self=0xcaf59204, aux=0xc0c8f9fc)
    at /home/darran/dev/current.dtrace/src/sys/dev/pci/ppb.c:157
#10 0xc062e616 in config_attach_loc (parent=0xcac77c3c, cf=<value optimized 
out>, locs=0xc0c8fa38, 
    aux=0xc0c8f9fc, print=0xc0565270 <pciprint>)
    at /home/darran/dev/current.dtrace/src/sys/kern/subr_autoconf.c:1312
#11 0xc0565022 in pci_probe_device (sc=0xcac73004, tag=
        {mode1 = 2147534080, mode2 = {port = 50432, enable = 0 '\0', forward = 
128 '\200'}}, match=0, pap=0x0)
    at /home/darran/dev/current.dtrace/src/sys/dev/pci/pci.c:372







>How-To-Repeat:
Build a GENERIC kernel with LOCKDEBUG enabled.  Boot it in vmware (vmware 
fusion 2.0 machine running on OS X 10.5).
>Fix:
As a work-around, modifying the kernel config to reduce the number of ppbs by 
one stops the problem occuring.

That is, add the following to the config file:
no ppb
ppb0 at pci? dev ? function ?
ppb1 at pci? dev ? function ?
ppb2 at pci? dev ? function ?
ppb3 at pci? dev ? function ?
ppb4 at pci? dev ? function ?
...
ppb29 at pci? dev ? function ?
ppb30 at pci? dev ? function ?
#ppb31 at pci? dev ? function ?