From owner-freebsd-current@FreeBSD.ORG  Wed May 23 16:06:46 2007
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: current@FreeBSD.org
Delivered-To: freebsd-current@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 2C19616A468
	for <current@FreeBSD.org>; Wed, 23 May 2007 16:06:46 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42])
	by mx1.freebsd.org (Postfix) with ESMTP id 06ABB13C48C
	for <current@FreeBSD.org>; Wed, 23 May 2007 16:06:45 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from fledge.watson.org (fledge.watson.org [209.31.154.41])
	by cyrus.watson.org (Postfix) with ESMTP id 6605347444
	for <current@FreeBSD.org>; Wed, 23 May 2007 12:06:45 -0400 (EDT)
Date: Wed, 23 May 2007 12:06:45 -0400 (EDT)
From: Robert Watson <rwatson@FreeBSD.org>
X-X-Sender: robert@fledge.watson.org
To: current@FreeBSD.org
Message-ID: <20070523120014.U28780@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: 
Subject: ata sema panic: mtx_lock() of destroyed mutex ... sema ...
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 23 May 2007 16:06:46 -0000


While attempting to debug the vga0 (actually, clocking locking) panic, I 
backed out to a 20070520 kernel, and saw the following:

acd0: WARNING - PREVENT_ALLOW read data overrun 18>0
panic: mtx_lock() of destroyed mutex @ /usr/src/sys/kern/kern_sema.c:79
KDB: enter: panic
[thread pid 17 tid 100012 ]
Stopped at	kdb_enter+0x32: leave
db> bt
Tracing pid 17 tid 100012 td 0xc2703000
kdb_enter(...) at kdb_enter+0x32
panic(...) at panic+0xc5
_mtx_lock_flags(...) at _mtx_lock_flags+0x59
_sema_post(...) at _sema_post+0x2a
ata_completed(...) at ata_completed+0x66d
taskqueue_run(...) at taskqueue_run+0x10b
taskqeueu_swi_run(...) at taskqueue_swi_run+0x13
ithread_loop(...) at ithread_loop+0x1b5

Hand-transcribed, full stack trace here:

   http://www.watson.org/~robert/freebsd/20070523-ata-sema-panic.png

No dump, but that's alright, it probably wouldn't have dumped anyway, given 
that ATA was keeling over :-).  ata_completed+0x66d maps to ata-queue.c:481 in 
ata_queue.c:1.69.

Robert N M Watson
Computer Laboratory
University of Cambridge