kern/38758: LOCKDEBUG kernel hangs in esp(4) driver

[Hauke Fath <hauke%Espresso.Rhein-Neckar.DE@localhost>]

>Number:         38758
>Category:       kern
>Synopsis:       LOCKDEBUG kernel hangs in esp(4) driver
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 26 11:40:00 +0000 2008
>Originator:     Hauke Fath <hauke%Espresso.Rhein-Neckar.DE@localhost>
>Release:        NetBSD 4.99.63
>Organization:
-- 
     The ASCII Ribbon Campaign                    Hauke Fath
()     No HTML/RTF in email             Institut für Nachrichtentechnik
/\     No Word docs in email                     TU Darmstadt
     Respect for open standards              Ruf +49-6151-16-3281
>Environment:
        
        
System: NetBSD 4.99.63 (DEBUG) #0: Mon May 26 13:07:58 CEST 2008
        
hf@Hochstuhl:/var/obj/netbsd-builds/developer/mac68k/sys/arch/mac68k/compile/DEBUG

Architecture: m68k
Machine: mac68k

>Description:

        A GENERIC kernel built with DIAGNOSTIC, DEBUG and LOCKDEBUG
        options hangs when mounting root. Breaking into the debugger
        shows it is in esp scsi code. Attempting a 'reboot' from the
        debugger results in a LOCKDEBUG panic.

>How-To-Repeat:

        Build and boot the following kernel:

include         "arch/mac68k/conf/GENERIC"

options         DIAGNOSTIC
options         DEBUG
options         LOCKDEBUG



Bootstrapping NetBSD/mac68k.
Getting mapping from MMU.
Loaded at 0x0
System RAM: 142606336 bytes in 34816 pages.
     Low = 0x0, high = 0x8800000
On-board video at addr 0x0xf9000080 (phys 0x0xf9000080), len 0xfff80.
Done.
Bootstrapping the pmap system.
Pmap bootstrapped.
Moving ROMBase from 0x40800000 to 0x4eb000.
Video address 0x0xf9000080 -> 0x0x6eb080.
Loaded initial symtab at 0x354ec0, strtab at 0x3a9448, # entries 20752
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 4.99.63 (DEBUG) #0: Mon May 26 13:07:58 CEST 2008
        
hf@Hochstuhl:/var/obj/netbsd-builds/developer/mac68k/sys/arch/mac68k/compile/DEBUG
Apple Macintosh Quadra 650  (68040)
cpu: delay factor 1280
fpu: mc68040
total memory = 136 MB
avail memory = 127 MB
mrg: 'Quadra/Centris ROMs' ROM glue, tracing off, debug off, silent traps
mrg: I/O map kludge for ROMs that use hardware addresses directly.
mainbus0 (root)
obio0 at mainbus0
esp0 at obio0 addr 0 (quick): address 0x3fb000: NCR53C96, 16MHz, SCSI ID 7
scsibus0 at esp0: 8 targets, 8 luns per target
adb0 at obio0
asc0 at obio0: Apple Sound Chip
intvid0 at obio0 @ f9000080: DAFB video subsystem, monitor sense 7
intvid0: 1152 x 870, 256 color
macfb0 at intvid0
wsdisplay0 at macfb0 (kbdmux ignored)
sn0 at obio0: integrated SONIC Ethernet adapter
sn0: Ethernet address 08:00:07:ce:67:59
iwm0 at obio0: Apple GCR floppy disk controller
zsc0 at obio0 chip type 0 
zsc0 channel 0: d_speed   9600 DCD clk 0 CTS clk 0
zstty0 at zsc0 channel 0 (console i/o)
zsc0 channel 1: d_speed   9600 DCD clk 0 CTS clk 0
zstty1 at zsc0 channel 1
nubus0 at mainbus0
sm0 at nubus0 slot e: AsanteFAST 10/100 NB
sm0: SMC91C100, revision 0, buffer size: 128 KB
sm0: MAC address 00:00:94:75:93:d9, default media MII
nsphy0 at sm0 phy 5: DP83840 10/100 media interface, rev. 0
nsphy0: 10baseT, 100baseTX, auto
scsibus0: waiting 2 seconds for devices to settle...
adb0 (direct, II series): 2 targets
aed0 at adb0 addr 0: ADB Event device
akbd0 at adb0 addr 2: standard keyboard (ISO layout)
wskbd0 at akbd0 (mux ignored)
ams0 at adb0 addr 3: 1-button, 100 dpi mouse
wsmouse0 at ams0 (mux ignored)
sd0 at scsibus0 target 0 lun 0: <SEAGATE, ST336706LW, 010A> disk fixed
sd0: 35003 MB, 26302 cyl, 4 head, 681 sec, 512 bytes/sect x 71687370 sectors
sd0: async, 8-bit transfers, tagged queueing
boot device: sd0
root on sd0a dumps on sd0b              <<=== stalled here
Panic switch: PC is 0x79276.
Stopped in pid 0.2 (system) at  netbsd:cpu_Debugger+0x6:        unlk    a6
db> t
cpu_Debugger(2d9100,79276,0,a06fe64,358e) + 6
nmihand(80,80,0,4,91) + 2c
lev7intr(?)
ncr53c9x_intr(d00c00,9,193196,d00c00,cc2f88) + 12
esp_quick_dma_go(d00c00,d00c00,3,90) + 100
ncr53c9x_intr(d00c00) + 10b4
esp_intr(d00c00) + 1a
via2_intr(0,a06ffa8,356a,68,1) + 50
intr_dispatch(68) + 4e
intrhand(a087be0) + a
lwp_trampoline() + e
db> reboot
syncing disks... Mutex error: lockdebug_wantlock: acquiring sleep lock from 
interrupt context

lock address : 0x000000000a084fc0 type     :     sleep/adaptive
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
current cpu  :                  0 last held:                  0
current lwp  : 0x000000000a087be0 last held: 000000000000000000
last locked  : 0x000000000018e60e unlocked : 0x000000000018e7ba
initialized  : 0x000000000017e338
owner field  : 000000000000000000 wait/spin:                0/0

Turnstile chain at 0x348400.
=> No active turnstile for this lock.

panic: LOCKDEBUG
Stopped in pid 0.2 (system) at  netbsd:cpu_Debugger+0x6:        unlk    a6
db>

>Fix:
        None.

>Unformatted: