port-amd64/41582: ioapic mapping failed on amd64/i386 in NetBSD 4.x -> double bus error in interrupt code

[Wolfgang.Stukenbrock%nagler-company.com@localhost]

>Number:         41582
>Category:       port-amd64
>Synopsis:       ioapic mapping failed on amd64/i386 in NetBSD 4.x -> double 
>bus error in interrupt code
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    port-amd64-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 12 14:10:00 +0000 2009
>Originator:     Wolfgang Stukenbrock
>Release:        NetBSD 4.0
>Organization:
Dr. Nagler & Company GmbH
        
>Environment:
        
        
System: NetBSD s012 4.0 NetBSD 4.0 (NSW-S012) #9: Fri Mar 13 12:31:52 CET 2009 
wgstuken@s012:/usr/src/sys/arch/amd64/compile/NSW-S012 amd64
Architecture: x86_64
Machine: amd64
>Description:
        Our Supermicro Board X7SBE will run fine as long as only one of the 
IO-cards installed is used.
        If both cards are busy at the same time, the system will crash after a 
short time inside of
        the interrupt code with double bus error.
        I've located the source of the problem in the fact that two differen 
ioapics that are interrupted
        on the same pin at the same level for the same legay-irq uses the same 
interrupt vector.
        If both interruptsources get busy at the same time, the system crashes.
        The reason for the same vector is a bug in 
/usr/src/sys/arch/x86/x86/intr.c.
        The first check for duplicates in intr_allocate_slot() checks for the 
same "pic", but the code
        some lines later compares only the pin and not the pic itself.
        If now two different apics uses the same pin for the same interrupt 
level, the already assigned
        vector for the first source is reused for the second source again. That 
may not happen.
        remark: The problem seems to be fixed in 5.0 by a complete rewrite of 
the affected routines, so
        only 4.0 and 4.0.1 are affected.

        With the following patch the system no longer crashes - or let's say: 
there was no crash anymore
        since I've patched the kernel.
>How-To-Repeat:
        Get a board with multiple ioapic's an populate card into the system, so 
that
        they will use the same pin on different ioapic's for the same 
interrupt-level.
        The system will use the same vector and will crash if both interrupts 
happen at the same time.
>Fix:
        The following patch will solve the problem in 4.0 (and 4.0.1)

*** intr.c      2009/06/12 12:22:13     1.1
--- intr.c      2009/06/12 12:23:19
***************
*** 466,472 ****
                        ci->ci_isources[slot] = isp;
                        simple_unlock(&ci->ci_slock);
                } else {
!                       if (isp->is_pin != pin) {
                                if (pic == &i8259_pic)
                                        return EINVAL;
                                goto other;
--- 466,472 ----
                        ci->ci_isources[slot] = isp;
                        simple_unlock(&ci->ci_slock);
                } else {
!                       if (isp->is_pin != pin || isp->pic != pic) {
                                if (pic == &i8259_pic)
                                        return EINVAL;
                                goto other;

>Unformatted: