kern/53714: Panic during recovery from IDE disk error

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         53714
>Category:       kern
>Synopsis:       Panic during recovery from IDE disk error
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Nov 10 12:10:00 +0000 2018
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2018.11.09.15.20.36
>Organization:
>Environment:
System: NetBSD
Architecture: i386
Machine: i386
>Description:

Running the ATF tests on a debug build of NetBSD-current/i386 under
qemu 3.0.0 on my own testbed, there were some disk errors followed by
an attempted downgrade to PIO mode 4 and then a panic.  This PR is
specifically about the panic, because that's clearly a NetBSD bug,
unlike the disk errors which may be a qemu issue.

The console showed:

bin/sh/t_patterns (17/768): 3 test cases
    case_matching: [43.106274s] Passed.
    filename_expansion: piixide0:0:0: lost interrupt
[ 1155.0753536]         type: ata tc_bcount: 16384 tc_skip: 0
piixide0:0:0: bus-master DMA error: missing interrupt, status=0x61
[ 1155.3570396] wd0a: DMA error writing fsbn 3779616 of 3779616-3779647 (wd0 bn 3779679; cn 3749 tn 10 sn 57), xfer 1f4, retry 0
piixide0:0:0: lost interrupt
[ 1177.2215340]         type: ata tc_bcount: 16384 tc_skip: 0
piixide0:0:0: bus-master DMA error: missing interrupt, status=0x61
[ 1178.1212942] wd0a: DMA error writing fsbn 3779584 of 3779584-3779615 (wd0 bn 3779647; cn 3749 tn 10 sn 25), xfer c8, retry 0
[ 1178.1271228] wd0: soft error (corrected) xfer 1f4
[ 1178.9967395] wd0: soft error (corrected) xfer c8
piixide0:0:0: lost interrupt
[ 1258.5017277]         type: ata tc_bcount: 16384 tc_skip: 0
piixide0:0:0: bus-master DMA error: missing interrupt, status=0x61
[ 1258.7546516] wd0a: DMA error writing fsbn 3779136 of 3779136-3779167 (wd0 bn 3779199; cn 3749 tn 3 sn 18), xfer 9c4, retry 0
[ 1259.6734782] wd0: soft error (corrected) xfer 9c4
piixide0:0:0: lost interrupt
[ 1279.6505127]         type: ata tc_bcount: 16384 tc_skip: 0
piixide0:0:0: bus-master DMA error: missing interrupt, status=0x61
[ 1280.7308735] wd0: transfer error, downgrading to PIO mode 4
[ 1283.7601240] panic: kernel diagnostic assertion "mutex_owned(&chp->ch_lock)" failed: file "/usr/src/sys/dev/ata/ata_subr.c", line 275 
[ 1283.8202761] cpu0: Begin traceback...
[ 1316.7572251] vpanic(c116553c,cdcb5e34,cdcb5e34,cdcb5e44,c01af986,c116553c,c11653dd,c116551f,c11653a0,113) at netbsd:vpanic+0x1b2
[ 1316.8132134] kern_assert(c116553c,c11653dd,c116551f,c11653a0,113,cdcb5e80,c01ad669,c2207108,2,c21fe064) at netbsd:kern_assert+0x27
[ 1316.8332269] ata_channel_lock_owned(c2207108,2,c21fe064,0,1,4,c21fe064,c2207000,c2207000,c2272428) at netbsd:ata_channel_lock_owned+0x4c
[ 1316.8732393] ata_thread_run(c2207108,0,200,ff,c2207108,c2207000,c2275d08,0,cdcb5eb8,c01ac108) at netbsd:ata_thread_run+0x1e
[ 1316.9132490] ata_downgrade_mode(c2272008,0,cdcb5f00,c01a9c72,c2272008,0,50,0,10,cdcb5edc) at netbsd:ata_downgrade_mode+0x16b
[ 1316.9332531] ata_dmaerr(c2272008,0,50,0,10,cdcb5edc,c18c2a60,50,2,c2207000) at netbsd:ata_dmaerr+0x40
[ 1316.9932775] wdc_ata_bio_intr(c2207108,c22739c4,1,c2207108,cdcb5f30,c2207108,c2207000,2,c22739c4,c1778d80) at netbsd:wdc_ata_bio_intr+0x3c1
[ 1317.0532938] wdctimeout(c2207108,c0100e1f,cdcb5f74,2,8,c20b3540,c18c2a60,c2207118,129df,8) at netbsd:wdctimeout+0x203
[ 1317.0732976] callout_softclock(0,0,0,0,0,0,0,0,b9d4c6,cdc2520c) at netbsd:callout_softclock+0x579
[ 1317.1132967] softint_execute(cdc25074,c20b3540,2,c20b3540,c20b3d20,c20b3540,cdc25074,0,cdc22000,c20a58c8) at netbsd:softint_execute+0x23e
[ 1317.1332991] softint_dispatch(c20b3d20,2,0,0,0,0,cdcb8ff0,cdcb8f98,c20b32a0,80050033) at netbsd:softint_dispatch+0xd7
[ 1317.1332991] Bad frame pointer: 0xcdc24ec4
[ 1317.1332991] cpu0: End traceback...

[ 1317.1332991] dumping to dev 0,1 offset 1574408
[ 1317.1332991] dump pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
[ 1317.1332991] pmap_kenter_pa: mapping already present
(etc)

>How-To-Repeat:

Don't know, only happened once so far.

>Fix: