fdc_worker panic in mtx_lock()

[Robert Watson]

Got this this evening -- Warner, looks like it might be yours.

atkbd0: [GIANT-LOCKED]
fdc0: <floppy drive controller (FDE)> port 0x3f7,0x3f4-0x3f5,0x3f2-0x3f3 irq 6 drq 2 on acpi0
fdc0: [FAST]
fdc0: _FDE too small
device_attach: fdc0 attach returned 6
sio0 port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
sio1 port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
fdc0: <floppy drive controller (FDE)> port 0x3f7,0x3f4-0x3f5,0x3f2-0x3f3irq 6 drq 2 on acpi0
fdc0: [FAST]
fdc0: _FDE too small
device_attach: fdc0 attach returned 6
orm0: <ISA Option ROMs> at iomem 0xe4000-0xe7fff,0xd2800-0xd37ff,0xd1800-0xd27ff,0xc8000-0xd17ff,0xc0000-0xc7fff on isa0
pmtimer0 on isa0
ppc0: parallel port not found.
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x100>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounters tick every 10.000 msec
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x108
fault code         = supervisor read, page not present
instruction pointer     = 0x8:0xc060978d
stack pointer           = 0x10:0xe94c4cb0
frame pointer           = 0x10:0xe94c4cbc
code segment       = base 0x0, limit 0xfffff, type 0x1b
                   = DPL 0, pres 1, def32 1, gran 1
processor eflags   = resume, IOPL = 0
current process    = 99 (fdc0)
[thread 100110]
Stopped at      _mtx_lock_sleep+0xb9:   cmpl    $0x4,0x108(%ebx)
db> trace
_mtx_lock_sleep(c554ebb0,c549e000,0,0,0) at _mtx_lock_sleep+0xb9
fdc_worker(c554eb00,c5541000,c077faf8,e94c4d34,c05fcd1d) at  fdc_worker+0x1ab
fdc_thread(c554eb00,e94c4d48) at fdc_thread+0xe
fork_exit(c077faf8,c554eb00,e94c4d48) at fork_exit+0x75
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xe94c4d7c, ebp = 0 ---

(gdb) l *fdc_worker+0x1ab
0xc077eecf is in fdc_worker (../../../dev/fdc/fdc.c:758).
753                     need_recal = 0xf;
754             }
755
756             /* Pick up a request, if need be wait for it */
757             if (fdc->bp == NULL) {
758                     mtx_lock(&fdc->fdc_mtx);
759                     do {
760                             fdc->bp = bioq_takefirst(&fdc->head);
761                             if (fdc->bp == NULL)
762                                     msleep(&fdc->head, &fdc->fdc_mtx,

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org      Principal Research Scientist, McAfee Research