kern/102211: [ata] detach raid member and reboot will cause panic (ICH7)

[Yoichi NAKAYAMA]

>Number:         102211
>Category:       kern
>Synopsis:       [ata] detach raid member and reboot will cause panic (ICH7)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 18 03:00:30 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Yoichi NAKAYAMA
>Release:        7-current
>Organization:
FreeBSD.org
>Environment:
FreeBSD suigei.local-net 7.0-CURRENT FreeBSD 7.0-CURRENT #11: Thu Aug 17 23:51:38 JST 2006     yoichi at suigei.local-net:/usr/obj/usr/src/sys/GENERIC_DEBUG  i386
>Description:
I have raid array with ICH7.
Reboot system after detaching member disk will cause panic
(as noted in kern/97624).
The metadata on the left disk is:

********* ATA Intel MatrixRAID Metadata *********
intel_id            <Intel Raid ISM Cfg Sig. >
version             <1.1.00>
checksum            0x5f8caa2c
config_size         0x000001e0
config_id           0x44e526fa
generation          0x0000007e
total_disks         2
total_volumes       1
DISK#   serial disk_sectors disk_id flags
    0   <V591P8FG> 490234752 0x00000000 0x0000013a
    1   <:0> 490229760 0xffffffff 0x00000006
name                Volume0
total_sectors       490229760
state               12
reserved            0
offset              0
disk_sectors        490229760
stripe_count        1914960
stripe_sectors      128
status              2
type                RAID1
total_disks         2
magic[0]            0x02
magic[1]            0x01
magic[2]            0x01
    disk 0 at disk_idx 0x00000000
    disk 1 at disk_idx 0x01000001
=================================================
where higher bits of disk_idx for detached one causes access vaiolation. 

related part of dmesg:
 atapci2: <Intel ICH7M SATA300 controller> port 0xe080-0xe087,0xe000-0xe003,0xdc00-0xdc07,0xd880-0xd883,0xd800-0xd80f mem 0xffa37800-0xffa37bff irq 19 at device 31.2 on pci0
 ad10: 239372MB <Maxtor 7V250F0 VA111630> at ata5-master SATA150
 ad14: 239372MB <Maxtor 7V250F0 VA111630> at ata7-master SATA150
 ar0: disk0 READY (master) using ad10 at ata5-master
 ar0: disk1 READY (mirror) using ad14 at ata7-master

attached change avoids panic, but detached disk forms separate volume as
 ar0: WARNING - mirror protection lost. RAID1 array in DEGRADED mode
 ar0: 239370MB <Intel MatrixRAID RAID1> status: DEGRADED
 ar0: disk0 READY (master) using ad10 at ata5-master
 ar0: disk1 DOWN no device found for this subdisk
 ar1: WARNING - mirror protection lost. RAID1 array in DEGRADED mode
 ar1: 239370MB <Intel MatrixRAID RAID1> status: DEGRADED
 ar1: disk0 DOWN no device found for this subdisk
 ar1: disk1 READY (mirror) using ad14 at ata7-master
so we have to call "atacontrol delete ar1" before addspare and rebuild,
while "Intel(R) Matrix Storage Manager option ROM v5.7.0.1005 ICH7MR" shows
single volume as:
 RAID Volumes:
 ID    Name     Level           Strip  Size     Status    Bootable
 0     Volume0  RAID1(Mirror)   N/A    233.8GB  Degraded  Yes

 Physical Disks:
 Port  Drive Model     Serial #  Size      Type/Status(Vol ID)
 0     Maxtor 7V250F0  V591P8FG  233.8GB   Member Disk(0)
 2     Maxtor 7V250F0  V591PNAG  233.8GB   Offline Member

On Windows XP, Intel Matrix Storage Console shows single RAID volume with one disk  (port 0) and separate non-RAID disk (port 2).
>How-To-Repeat:
# atacontrol status ar0
ar0: ATA RAID1 subdisks: ad10 ad14 status: READY
# atacontrol detach ata7
# atacontrol status ar0
ar0: ATA RAID1 subdisks: ad10 DOWN status: DEGRADED
# reboot

>Fix:
Masking disk_idx avoids panic

*** /usr/src/sys/dev/ata/ata-raid.c.orig	Sat Apr 15 19:27:41 2006
--- /usr/src/sys/dev/ata/ata-raid.c	Thu Aug 10 07:37:28 2006
***************
*** 2122,2143 ****
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
  		raid->disks[disk].dev = NULL;
! 		bcopy(meta->disk[map->disk_idx[disk]].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
! 		    meta->disk[map->disk_idx[disk]].sectors;
  		raid->disks[disk].flags = 0;
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}
--- 2122,2144 ----
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
+ 		u_int32_t disk_idx = map->disk_idx[disk] & 0xffff;
  		raid->disks[disk].dev = NULL;
! 		bcopy(meta->disk[disk_idx].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
! 		    meta->disk[disk_idx].sectors;
  		raid->disks[disk].flags = 0;
! 		if (meta->disk[disk_idx].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
! 		if (meta->disk[disk_idx].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
! 		if (meta->disk[disk_idx].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
! 		if (meta->disk[disk_idx].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}

>Release-Note:
>Audit-Trail:
>Unformatted: