NetBSD Problem Report #54059

From martin@aprisoft.de  Thu Mar 14 14:27:55 2019
Return-Path: <martin@aprisoft.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 1E7447A166
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 14 Mar 2019 14:27:55 +0000 (UTC)
Message-Id: <20190314142743.023BF5CC8E5@emmas.aprisoft.de>
Date: Thu, 14 Mar 2019 15:27:43 +0100 (CET)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: panic when detecting SATA devices on virtual box
X-Send-Pr-Version: 3.95

>Number:         54059
>Category:       kern
>Synopsis:       panic when detecting SATA devices on virtual box
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Mar 14 14:30:00 +0000 2019
>Originator:     Martin Husemann
>Release:        NetBSD 8.99.35
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD night-porter.duskware.de 8.99.35 NetBSD 8.99.35 (PORTER) #13: Sat Mar 9 16:26:42 CET 2019 martin@seven-days-to-the-wolves.aprisoft.de:/work/src/sys/arch/i386/compile/PORTER i386
Architecture: i386
Machine: i386
>Description:

Trying to boot a -current i386 install ISO on VirtualBox 5.2.26
set to use SATA (instead of IDE) panics in the atabus thread:

atabus_thread->atabusconfig->wdc_drvprobe->wdcprobe1 + 0x2df

0xc0573054 is in wdcprobe1 (/work/src/sys/dev/ic/wdc.c:672).
667                             }
668                     }
669     
670                     if (ret_value == 0) {
671                             ata_channel_unlock(chp);
672                             return 0;

doing an Xspllower and crashing at Xspllower + 0x10 - which should not
exist:

(gdb) x/16i Xspllower      
   0xc0100e10 <Xspllower>:      push   %ebp
   0xc0100e11 <Xspllower+1>:    mov    %esp,%ebp
   0xc0100e13 <Xspllower+3>:    push   %ebx
   0xc0100e14 <Xspllower+4>:    push   %esi
   0xc0100e15 <Xspllower+5>:    push   %edi
   0xc0100e16 <Xspllower+6>:    mov    0x8(%ebp),%ebx
   0xc0100e19 <Xspllower+9>:    mov    $0xc0100e1f,%esi
   0xc0100e1e <Xspllower+14>:   cli    
   0xc0100e1f <Xspllower+15>:   mov    %ebx,%eax
   0xc0100e21 <Xspllower+17>:   mov    %fs:0x2ac(,%eax,4),%eax
   0xc0100e29 <Xspllower+25>:   and    %fs:0x278,%eax
   0xc0100e30 <Xspllower+32>:   je     0xc0100e48 <Xspllower+56>
   0xc0100e32 <Xspllower+34>:   bsr    %eax,%eax
   0xc0100e35 <Xspllower+37>:   btr    %eax,%fs:0x278
   0xc0100e3d <Xspllower+45>:   mov    %fs:0x1ec(,%eax,4),%eax
   0xc0100e45 <Xspllower+53>:   jmp    *0x10(%eax)

Makes no sense to me - just to make sure I did not mistranscribe it,
here are two screenshots:

	https://NetBSD.org/~martin/panic1.png
	https://NetBSD.org/~martin/panic2.png

>How-To-Repeat:

Configure a i386 virtual box machine with controller = AHCI/SATA and
try to boot a current ISO.

>Fix:
n/a

Home	PR Database Search