Reproducible FreeBSD 6.0-BETA2 panic - probably ATA-ng related

[Gavin Atkinson]

On Sun, 21 Aug 2005, Fabian Keil wrote:
> I own a Plextor PlexWriter Premium, the drive has a buggy firmware
> which crashes if you try to burn multi session in SAO mode.
> On FreeBSD 6.0-BETA2 a panic is caused:

[snip the CD ROM drive detaching...]

> Fatal trap 12: page fault while in kernel mode
> cpuid = 0; apic id = 00
> fault virtual address   = 0x3b0
> fault code              = supervisor read, page not present
> instruction pointer     = 0x20:0xc046f132
> stack pointer           = 0x28:0xd44b0cc8
> frame pointer           = 0x28:0xd44b0cd8
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                        = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 2 (g_event)
> panic: from debugger
> cpuid = 0
>
> (kgdb) where
[...]
> #11 0xc063992a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
> ...
> #25 0xc046f132 in acd_geom_detach (arg=0xc1b89100, flag=0) at /usr/src/sys/dev/ata/atapi-cd.c:199
> #26 0xc04bf9ef in one_event () at /usr/src/sys/geom/geom_event.c:198
> #27 0xc04bfa79 in g_run_events () at /usr/src/sys/geom/geom_event.c:218
> #28 0xc04c10dd in g_event_procbody () at /usr/src/sys/geom/geom_kern.c:141
> #29 0xc04e1098 in fork_exit (callout=0xc04c1070 <g_event_procbody>, arg=0x0, frame=0xd44b0d38)
>    at /usr/src/sys/kern/kern_fork.c:789
> #30 0xc063998c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
>
> vmcore, dmesg output and kernel.debug can be downloaded at:
> <http://www.fabiankeil.de/tmp/kernel.debug+vmcore+dmesg.tar> (20MB)

It's a known issue.  I see exactly this same panic 80% of the time on my 
laptop on resume from ACPI suspend.  I believe it was introduced during 
the newbus-ification of ATA-mk3.  On the call to acd_geom_detach, 
acd_softc is already null.

(kgdb) f 23
#23 0xc04dd936 in acd_geom_detach (arg=0xc16dd680, flag=0)
     at /usr/src/sys/dev/ata/atapi-cd.c:199
199         g_wither_geom(cdp->gp, ENXIO);
(kgdb) list
194     acd_geom_detach(void *arg, int flag)
195     {
196         struct acd_softc *cdp = device_get_ivars(arg);
197
198         /* signal geom so we dont get any further requests */
199         g_wither_geom(cdp->gp, ENXIO);
200
201         /* fail requests on the queue and any thats "in flight" for this device */
202         ata_fail_requests(arg);
203
(kgdb) p cdp
$5 = (struct acd_softc *) 0x0

Gavin