kern/38131: lockdebug panic when ejecting compactflash card

[plunky%rya-online.net@localhost]

>Number:         38131
>Category:       kern
>Synopsis:       ejecting a compact flash card results in LOCKDEBUG panic
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 01 18:00:00 +0000 2008
>Originator:     Iain Hibbert
>Release:        NetBSD 4.99.54
>Organization:
>Environment:
        
        
System: NetBSD galant 4.99.54 NetBSD 4.99.54 (GALANT) #2: Sat Mar 1 17:15:22 
GMT 2008 plunky@galant:/var/obj/sys/arch/i386/compile/GALANT i386
Architecture: i386
Machine: i386
>Description:

        insert a compactflash card to PCMCIA slot:

wdc2 at pcmcia1 function 0: <SanDisk, SDP, 5/3 0.6>
wdc2: i/o mapped mode
atabus2 at wdc2 channel 0
wd1 at atabus2 drive 0: <SanDisk SDCFB-16>
wd1: drive supports 1-sector PIO transfers, LBA addressing
wd1: 15680 KB, 490 cyl, 2 head, 32 sec, 512 bytes/sect x 31360 sectors
wd1: drive supports PIO mode 4

        remove compactflash card from PCMCIA slot:

wd1 detached

panic: LOCKDEBUG
Stopped in pid 0.20 (system) at netbsd:breakpoint+0x4:  popl    %ebp
db{0}>  ps
PID           PPID     PGRP        UID S   FLAGS LWPS          COMMAND    WAIT
 2                1        2          0 2  0x4000    1               sh     tty
 1                0        1          0 2  0x4000    1             init    wait
>0               -1        0          0 2 0x20002   30           system       *
db{0}> bt
breakpoint(c0a579e9,cae61b48,c0a84c00,c049576f,0) at netbsd:breakpoint+0x4
panic(c09faa73,c09f6f4d,c080f4a4,c09fac9c,0) at netbsd:panic+0x1c0
lockdebug_abort1(c09fac9c,1,800,c0495df6,0) at netbsd:lockdebug_abort1+0xa1
free(c146b000,c0a81800,0,0,c0a1194d) at netbsd:free+0x114
config_detach(c146b000,1,c0a1194d,0,0) at netbsd:config_detach+0x244
atabus_detach(c137f500,1,ca5729a0,23,23) at netbsd:atabus_detach+0xef
config_detach(c137f500,1,1,ca5729a0,0) at netbsd:config_detach+0x8b
wdcdetach(c145a400,1,23,c0476890,c0aa7b40) at netbsd:wdcdetach+0x42
wdc_pcmcia_detach(c145a400,1,b377c4,c1311540,12c) at 
netbsd:wdc_pcmcia_detach+0x35
config_detach(c145a400,1,cae61cec,c06326c4,c1311540) at 
netbsd:config_detach+0x8b
pcmcia_card_detach(c1310000,1,c0a4b778,0,0) at netbsd:pcmcia_card_detach+0x46
cardslot_event_thread(c1314100,0,c01002bd,0,c01002bd) at 
netbsd:cardslot_event_thread+0x30d
db{0}>

        it doesn't matter if you mount or don't mount it, this seems
        nothing to do with the filesystem but rather related to the
        disk controller autoconfig. It happens every time.

        Actually, it could be a cardbus slot, the autoconfig messages relating
        to the slots:

cbb0 at pci0 dev 11 function 0: Toshiba ToPIC100 PCI-CardBus Bridge (rev. 0x20)
cbb0: cacheline 0x0 lattimer 0x40
cbb0: bhlc 0x824000
cbb0: interrupting at irq 11
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 20
pcmcia0 at cardslot0

cbb1 at pci0 dev 11 function 1: Toshiba ToPIC100 PCI-CardBus Bridge (rev. 0x20)
cbb1: cacheline 0x0 lattimer 0x40
cbb1: bhlc 0x824000
cbb1: interrupting at irq 11
cardslot1 at cbb1 slot 1 flags 0
cardbus1 at cardslot1: bus 21
pcmcia1 at cardslot1

        and I should note that a Cardbus card containing a USB host controller
        and bluetooth dongle does not seem to do this (same slot), insert:

uhci1 at cardbus1 function 0: VIA Technologies VT83C572 USB Controller (rev. 
0x62)
uhci1: interrupting at 255
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2 at cardbus1 function 1: VIA Technologies VT83C572 USB Controller (rev. 
0x62)
uhci2: interrupting at 255
usb2 at uhci2: USB revision 1.0
uhub2 at usb2
uhub2: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ubt0 at uhub1 port 1
ubt0: Cambridge Silicon Radio Bluetooth USB Adapter, rev 2.00/19.58, addr 2

        and remove:

uhub1: at usb1 (addr 1) disconnected
ubt0: at uhub1 port 1 (addr 2) disconnected
ubt0 detached
uhub1 detached
usb1 detached
uhci1 detached
uhub2: at usb2 (addr 1) disconnected
uhub2 detached
usb2 detached
uhci2 detached

        any other information please ask

>How-To-Repeat:
        
        reboot (single user), insert, remove.
>Fix:

        ah, that I don't know..

>Unformatted: