port-i386/47606: panic with ffs+wapbl on cgd on USB disk (ahci)

[apb%cequrux.com@localhost]

>Number:         47606
>Category:       port-i386
>Synopsis:       panic with ffs+wapbl on cgd on USB disk (ahci)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-i386-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 02 08:10:01 +0000 2013
>Originator:     Alan Barrett
>Release:        NetBSD 6.99.16
>Organization:
Not much
>Environment:
System: NetBSD 6.99.16 i386
>Description:
I encountered the following panic while using rsync to copy
files from an internal disk to an external USB disk.  All relevant
file systems are ffs+wapbl on cgd.

panic: kernel diagnostic assertion "!cpu_intr_p()" failed:
       file .../kern_timeout.c, line 471

db{0}> bt
breakpoint ...
vpanic ...
kern_assert ...
callout_halt ...
sleepq_block ...
ahci_channel_start ...
ahci_do_reset_drive ...
ahci_reset_drive ...
wddone ...
ahci_bio_complete ...
ahci_intr_port ...
ahci_intr ...
intr_biglock_wrapper ...
--- switch to interrupt stack ---
Xintr_ioapic_level7() ...
--- interrupt ---
x86_mwait ...
acpicpu_cstate_idle_enter ...
acpicpu_cstate_idle ...
idle_loop ...
db{0}>

I often encounter panics while using rsync to external USB disks.
Usually, I am unable to see the panic message or to get a stack trace,
because of inability to switch from graphicsto a text console after a
panic.  This time, the panic was while a text console was active, so
I can report this panic, but I can't tell whether the other frequent
panics are the same or different.

>How-To-Repeat:
Plug in external USB disk; it is attached as follows:

    umass1 at uhub3 port 3 configuration 1 interface 0
    umass1: Western Digital My Book, rev 2.00/1.65, addr 4
    umass1: using SCSI over Bulk-Only
    scsibus1 at umass1: 2 targets, 1 lun per target
    sd1 at scsibus1 target 0 lun 0: <WD, 10EACS External, 1.65> disk fixed 
version 4
    sd1: 931 GB, 16383 cyl, 16 head, 63 sec, 512 bytes/sect x 1953525168 sectors

The disk has an MBR and a disklabel,
in which the "e" partition is a cgd.

Inside the cgd is a disklabel,
in which the "a" partition is ffs+wabl.

# cgdconfig cgd2 /dev/sd1e ${configfile}

# mount -t ffs -o log /dev/cgd2a /mnt

Use rsync to copy lots of stuff to /mnt/somesubdir/

The system may panic after some time.  In this instance, the panic
was after about two hours.

Apart from a single rsync task, there was no other activity
on the disk at the time of the panic.

>Fix:
Unknown