kern/184098: [cam] Qlogic fibre channel target causes kernel panic/reboot

[Jayson]

>Number:         184098
>Category:       kern
>Synopsis:       [cam] Qlogic fibre channel target causes kernel panic/reboot
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Nov 20 03:50:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Jayson
>Release:        9.2-RELEASE
>Organization:
Self
>Environment:
FreeBSD enlil 9.2-RELEASE FreeBSD 9.2-RELEASE #1 r257260M: Sun Nov 17 18:08:54 CST 2013     root at enlil:/usr/obj/usr/src/sys/SPIKEKERNEL  amd64
>Description:
Setup:
The server is using a Qlogic 2432 fibre channel HBA in target mode through the isp module. Card firmware is bring loaded with the ispfw module. WWPNs show up and are setup for host in the SAN fabric. The LUNs are setup through ctladm.
Backing files are on ZFS.

The issue:
When a client contacts the target, the server shortly panics and reboots.

Kernel dump:
Unread portion of the kernel message buffer:
(1:3:0:0): MAINTENANCE (IN). CDB: a3 0c 01 12 00 00 00 00 02 00 00 00  
(1:3:0:0): Tag: 0x116a38, Type: 1
(1:3:0:0): CTL Status: SCSI Error
(1:3:0:0): SCSI Status: Check Condition
(1:3:0:0): SCSI sense: ILLEGAL REQUEST asc:24,0 (Invalid field in CDB)
(1:3:0:0): Command byte 1 bit 4 is invalid
Sleeping thread (tid 100053, pid 2) owns a non-sleepable lock
KDB: stack backtrace of thread 100053:
#0 0xffffffff805144c4 at mi_switch+0x194
#1 0xffffffff8054ffb2 at sleepq_wait+0x42
#2 0xffffffff80514d5f at _sleep+0x3af
#3 0xffffffff802ccaaa at ctl_work_thread+0x2fca
#4 0xffffffff804d8e3f at fork_exit+0x11f
#5 0xffffffff8075a0fe at fork_trampoline+0xe
panic: sleeping thread
cpuid = 13
KDB: stack backtrace:
#0 0xffffffff80545056 at kdb_backtrace+0x66
#1 0xffffffff8050b1cd at panic+0x1cd
#2 0xffffffff80553bfd at propagate_priority+0x23d
#3 0xffffffff80554d5a at turnstile_wait+0x1ba
#4 0xffffffff804f6a7e at _mtx_lock_sleep+0xfe
#5 0xffffffff802bde53 at ctl_free_io_internal+0x113
#6 0xffffffff802db3a7 at ctlfedone+0x667
#7 0xffffffff802a16c3 at camisr_runqueue+0x53
#8 0xffffffff802a1b0f at camisr+0xff
#9 0xffffffff804dc3fd at intr_event_execute_handlers+0xfd
#10 0xffffffff804ddbed at ithread_loop+0x9d
#11 0xffffffff804d8e3f at fork_exit+0x11f
#12 0xffffffff8075a0fe at fork_trampoline+0xe
>How-To-Repeat:
Follow instructions in /usr/src/sys/cam/ctl/README.ctl.txt

ctladm create -b ramdisk -s 10485760000000000000
ctladm port -o on

hook up client.

OR:

ctladm port -o on
ctladm create -b block -o file=/tank/block/file -S ZFSTANK01 -d BOOTLUN

hook up client.
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: