kern/52569: Entering ddb using USB keyboard panics with "locking against myself"

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         52569
>Category:       kern
>Synopsis:       Entering ddb using USB keyboard panics with "locking against myself"
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 22 19:10:00 +0000 2017
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2017.09.06.18.21.17 + patch from PR 52553
>Organization:

>Environment:
System: NetBSD
Architecture: i386
Machine: i386
>Description:

After testing Nick's patch for PR 52553, I figured I'd try to
reproduce PR 52525 on the same machine by hitting control-alt-esc on
its USB keyboard.  This resulted in a panic and crash dump.  Examining
the crash dump shows:

  test# gdb /netbsd
  [...]
  (gdb) target kvm netbsd.3.core
  maybe_dump (howto=260) at /usr/src/sys/arch/i386/i386/machdep.c:757
  757             splx(s);
  (gdb) bt
  #0  maybe_dump (howto=260) at /usr/src/sys/arch/i386/i386/machdep.c:757
  #1  0xc011edb5 in cpu_reboot (howto=260, bootstr=0x0) at /usr/src/sys/arch/i386/i386/machdep.c:776
  #2  0xc0bf7c54 in vpanic (fmt=0xc13ab588 "lock error: %s: %s,%zu: %s: lock %p cpu %d lwp %p", ap=0xd8a5b700 "?/:\301(1:\301 \002") at /usr/src/sys/kern/subr_prf.c:342
  #3  0xc0bf7a86 in panic (fmt=0xc13ab588 "lock error: %s: %s,%zu: %s: lock %p cpu %d lwp %p") at /usr/src/sys/kern/subr_prf.c:258
  #4  0xc0bf00c6 in lockdebug_abort (func=0xc13a3128 <__func__.6155> "mutex_vector_enter", line=544, lock=0xc25e626c, ops=0xc16ace78 <mutex_adaptive_lockops>, 
      msg=0xc13a3081 "locking against myself") at /usr/src/sys/kern/subr_lockdebug.c:877
  #5  0xc0ba7dde in mutex_abort (func=0xc13a3128 <__func__.6155> "mutex_vector_enter", line=544, mtx=0xc25e626c, msg=0xc13a3081 "locking against myself") at /usr/src/sys/kern/kern_mutex.c:316
  #6  0xc0ba82dc in mutex_vector_enter (mtx=0xc25e626c) at /usr/src/sys/kern/kern_mutex.c:544
  #7  0xc06f2a90 in uhci_device_intr_start (xfer=0xc25fdd20) at /usr/src/sys/dev/usb/uhci.c:2752
  #8  0xc0457e58 in usbd_start_next (pipe=0xc261f248) at /usr/src/sys/dev/usb/usbdi.c:1043
  #9  0xc0457bac in usb_transfer_complete (xfer=0xc25fdd20) at /usr/src/sys/dev/usb/usbdi.c:986
  #10 0xc06f0037 in uhci_softintr (v=0xc25e600c) at /usr/src/sys/dev/usb/uhci.c:1423
  #11 0xc04580fc in usbd_set_polling (dev=0xc260b218, on=1) at /usr/src/sys/dev/usb/usbdi.c:1143
  #12 0xc0473cc8 in ukbd_cnpollc (v=0xc256a000, on=1) at /usr/src/sys/dev/usb/ukbd.c:997
  #13 0xc09f74aa in wskbd_cnpollc (dev=18446744073709551615, poll=1) at /usr/src/sys/dev/wscons/wskbd.c:1431
  #14 0xc09ef67c in wsdisplay_pollc (dev=12032, on=1) at /usr/src/sys/dev/wscons/wsdisplay.c:2257
  #15 0xc0123655 in cnpollc (on=1) at /usr/src/sys/dev/cons.c:359
  #16 0xc011abfd in kdb_trap (type=1, code=0, regs=0xd8a5ba04) at /usr/src/sys/arch/i386/i386/db_interface.c:248
  #17 0xc0122593 in trap (frame=0xd8a5ba04) at /usr/src/sys/arch/i386/i386/trap.c:313
  #18 0xc0116e8f in alltraps ()
  #19 0xd8a5ba04 in ?? ()
  #20 0xc011ad4e in cpu_Debugger () at /usr/src/sys/arch/i386/i386/db_interface.c:289
  #21 0xc09f7a62 in internal_command (sc=0xc261f748, type=0xd8a5babc, ksym=62496, ksym2=27) at /usr/src/sys/dev/wscons/wskbd.c:1591
  #22 0xc09f7e32 in wskbd_translate (id=0xc17404c0 <wskbd_console_data>, type=2, value=41) at /usr/src/sys/dev/wscons/wskbd.c:1719
  #23 0xc09f5fb5 in wskbd_input (dev=0xc25fe288, type=2, value=41) at /usr/src/sys/dev/wscons/wskbd.c:684
  #24 0xc04738af in ukbd_decode (sc=0xc256a000, ud=0xc256ae28) at /usr/src/sys/dev/usb/ukbd.c:849
  #25 0xc047337b in ukbd_delayed_decode (addr=0xc256a000) at /usr/src/sys/dev/usb/ukbd.c:714
  #26 0xc0bd7b68 in callout_softclock (v=0x0) at /usr/src/sys/kern/kern_timeout.c:738
  #27 0xc0bc6927 in softint_execute (si=0xd89ce074, l=0xc23a7540, s=2) at /usr/src/sys/kern/kern_softint.c:589
  #28 0xc0bc6c93 in softint_dispatch (pinned=0xc23a7d20, s=2) at /usr/src/sys/kern/kern_softint.c:871
  #29 0xc0100f3b in Xsoftintr ()
  #30 0xc23a7d20 in ?? ()

For a dmesg, see PR 53553.

>How-To-Repeat:

Hit control-alt-esc on a USB keyboard attached to a uhci controller
when running an i386 debug build.  You may also need to have some
other USB activity going on; running the test of PR 53553 seems to do
it.

>Fix:

>Unformatted: