kern/52924: sparc kernel dies with strange fault in pool_cache_get_slow

[martin%NetBSD.org@localhost]

>Number:         52924
>Category:       kern
>Synopsis:       sparc kernel dies with strange fault in pool_cache_get_slow
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jan 13 19:00:00 +0000 2018
>Originator:     Martin Husemann
>Release:        NetBSD 8.99.12
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD 8.99.12 (MP3) #55: Sat Jan 13 18:29:09 CET 2018  martin%night-owl.duskware.de@localhost:/usr/src/sys/arch/sparc/compile/MP3 sparc
Architecture: sparc
Machine: sparc
>Description:

My krups dies when trying to boot -current:

audiocs0 at ebus0 bar 14 offset 0x200000 line 3: CS4231A
audio0 at audiocs0: full duplex, playback, capture, mmap
audiocs0: Virtual format configured - Format SLINEAR, precision 16, channels 2, frequency 48000
audiocs0: Latency: 256 milliseconds
trap type 0x7: pc=0xe8306b14 npc=0xe8306b18 psr=0x4401fc6<EF,S,PS>
kernel: alignment fault trap
Stopped in pid 0.1 (system) at  netbsd:pool_cache_get_slow+0x1a4:       ld              [
%g1 + 0x100], %g1

Backtrace is:

pool_cache_get_slow(0xf0919840, 0xf00, 0xe8505d40, 0x0, 0x0, 0x44) at netbsd:cpu
_intr_p
cpu_intr_p(0xf09196c0, 0x1, 0x0, 0xa, 0x0, 0xe85063e7) at netbsd:vmem_alloc+0x20
c
vmem_alloc(0xe852ee50, 0x1000, 0x1001, 0xe8505e54, 0xfffffff8, 0xf09196c0) at ne
tbsd:uvm_km_kmem_alloc+0x38
uvm_km_kmem_alloc(0xe852ee50, 0x1000, 0x1001, 0xe8505ecc, 0x4401fe3, 0x4401fe3) a
t netbsd:pool_page_alloc+0x6c
pool_page_alloc(0xf091c018, 0x1, 0xe8506500, 0x60, 0xe8506380, 0x4401fe4) at net
bsd:pool_allocator_alloc+0x28
pool_allocator_alloc(0xf091c018, 0x1, 0xe85064a0, 0xe850649c, 0xe8506500, 0xe850
5f8f) at netbsd:pool_grow+0x148
pool_grow(0xf091c018, 0x1, 0x0, 0xe850697c, 0x1, 0xe8506007) at netbsd:pool_get+
0x4ec
pool_get(0xf091c018, 0x1, 0xe8506b74, 0x0, 0x0, 0xe85060a7) at netbsd:pool_cache
_get_slow+0x3a4
pool_cache_get_slow(0xf091c198, 0xf00, 0xe8506118, 0x0, 0x0, 0x4) at netbsd:pool
_cache_get_paddr+0x40c
pool_cache_get_paddr(0xf091c018, 0x1, 0x0, 0xa, 0x0, 0xe85063e7) at netbsd:kmem_
intr_alloc+0x2dc
kmem_intr_alloc(0xc08, 0x1, 0xfffffff8, 0x4, 0xfffffff8, 0xe8505cc0) at netbsd:k
ern_malloc+0xa4
kern_malloc(0xc00, 0x4, 0xe8506380, 0x60, 0x4401fe3, 0x4401fe3) at netbsd:sysctl
_realloc+0x88
sysctl_realloc(0xf092b1f0, 0xf092e5b8, 0xe8506500, 0x60, 0xe8506380, 0x4401fe4) a
t netbsd:sysctl_create+0x1038
sysctl_create(0xe8506568, 0x1, 0xe85064a0, 0xe850649c, 0xe8506500, 0x60) at netb
sd:sysctl_createv+0x474
sysctl_createv(0xf09a767c, 0x0, 0x0, 0xe850697c, 0x1, 0xe8506500) at netbsd:audi
oattach+0xf28
audioattach(0xf09a8ac8, 0xf09a8908, 0xe8506b74, 0x0, 0x0, 0xf09a767c) at netbsd:
config_attach_loc+0x374
config_attach_loc(0xf09a8ac8, 0xe85180a0, 0x0, 0xe8506b74, 0xe814e47c, 0xf09a892
4) at netbsd:config_found_sm_loc+0x60
config_found_sm_loc(0xf09a8ac8, 0x0, 0x0, 0xe8506b74, 0xe814e47c, 0x0) at netbsd
:config_found+0x28
config_found(0xf09a8ac8, 0xe8506b74, 0xe814e47c, 0x0, 0xe8506bc8, 0x0) at netbsd
:audio_attach_mi+0x64
audio_attach_mi(0xe8450bf0, 0xf0996a88, 0xf09a8ac8, 0xe8012900, 0xf0996af0, 0xf0
996bb0) at netbsd:cs4231_ebus_attach+0x2b8
cs4231_ebus_attach(0xf09621c8, 0xf09a8ac8, 0xe8506e98, 0x6, 0x14, 0x0) at netbsd
:config_attach_loc+0x374

which is:

(gdb) list *pool_cache_get_slow+0x1a4
0xe8306b14 is in pool_cache_get_slow (../../../../kern/subr_pool.c:2194).
2189                            mutex_exit(&pc->pc_lock);
2190                            return true;
2191                    }
2192            }
2193    
2194            if (__predict_true((pcg = pc->pc_fullgroups) != NULL)) {
2195                    /*
2196                     * If there's a full group, release our empty
2197                     * group back to the cache.  Install the full
2198                     * group as cc_current and return.

and the value of pc is 3.


>How-To-Repeat:
Try to boot -current on sparc/Krups

>Fix:
n/a