PANIC: vinum / atacontrol (5.0-STABLE)

[james]

Hi

I am trying to configure hotswap-raid and vinum on my machine, and have found I
can cause the kernel to panic at will.

Ideally I would like to be able to stop a plex, use atacontrol attach/detach to
replace the disk, and rebuild the plex. Would this work in theory?

I am using atacontrol to allow me to hot-swap drives. On a freshly rebooted
system, where I haven't yet loaded vinum, this works:

eddie# mount /dev/ad6s1a /mnt
eddie# touch /mnt/SOME_DATA
eddie# umount /mnt
eddie# atacontrol detach 3
ad6: removed from configuration
eddie# atacontrol attach 3
Master:  ad6 <IC35L120AVV207-0/V24OA63A> ATA/ATAPI rev 6
Slave:       no device present
eddie# mount /dev/ad6s1a /mnt
eddie# cd /mnt
eddie# ls
SOME_DATA
eddie# 

And now, I create a vinum volume that's mirrored across 2 drives, the second of
which is ad6:

eddie# cat config1
drive a device /dev/ad4s1a
drive b device /dev/ad6s1a
volume mirror setupstate
  plex org concat
    sd length 1000m drive a
  plex org concat
    sd length 1000m drive b
eddie# vinum create config1 
2 drives:
D a                     State: up       /dev/ad4s1a     A: 116796/117796 MB 
D b                     State: up       /dev/ad6s1a     A: 116796/117796 MB 

1 volumes:
V mirror                State: up       Plexes:       2 Size:       1000 MB

2 plexes:
P mirror.p0           C State: up       Subdisks:     1 Size:       1000 MB
P mirror.p1           C State: up       Subdisks:     1 Size:       1000 MB

2 subdisks:
S mirror.p0.s0          State: up       D: a            Size:       1000 MB
S mirror.p1.s0          State: up       D: b            Size:       1000 MB

Now I stop and unload vinum, and try to run atacontrol:

eddie# vinum stop
vinum unloaded
eddie# kldstat | grep vinum
eddie# 
eddie# atacontrol detach 3
<PANIC>

I have built a debug kernel, and have a core. The backtrace is below.

If you need any more info please let me know!

James

Now follows the gdb-output:

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x24
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc01c6de6
stack pointer           = 0x10:0xc873fab4
frame pointer           = 0x10:0xc873fab4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 2 (g_event)
trap number             = 12
panic: page fault

syncing disks, buffers remaining... panic: bdwrite: buffer is not busy
Uptime: 22m39s
Dumping 126 MB
ata0: resetting devices ..
done
 16 32 48 64 80 96 112
---
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:232
232             dumping++;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:232
#1  0xc01a9011 in boot (howto=0x104) at /usr/src/sys/kern/kern_shutdown.c:364
#2  0xc01a9223 in panic () at /usr/src/sys/kern/kern_shutdown.c:517
#3  0xc01e78ed in bdwrite (bp=0xc0b94e00) at /usr/src/sys/kern/vfs_bio.c:950
#4  0xc027e46b in ffs_update (vp=0xc1ae68e0, waitfor=0x0) at 
/usr/src/sys/ufs/ffs/ffs_inode.c:125
#5  0xc02924df in ffs_fsync (ap=0xc873f8ec) at 
/usr/src/sys/ufs/ffs/ffs_vnops.c:315
#6  0xc02915ee in ffs_sync (mp=0xc1906a00, waitfor=0x2, cred=0xc0b86e00, 
td=0xc0325e40) at vnode_if.h:612
#7  0xc01fa24b in sync (td=0xc0325e40, uap=0x0) at 
/usr/src/sys/kern/vfs_syscalls.c:138
#8  0xc01a8c82 in boot (howto=0x100) at /usr/src/sys/kern/kern_shutdown.c:273
#9  0xc01a9223 in panic () at /usr/src/sys/kern/kern_shutdown.c:517
#10 0xc02e311e in trap_fatal (frame=0xc0b94e00, eva=0x0) at 
/usr/src/sys/i386/i386/trap.c:844
#11 0xc02e2e32 in trap_pfault (frame=0xc873fa74, usermode=0x0, eva=0x24) at 
/usr/src/sys/i386/i386/trap.c:758
#12 0xc02e2a1d in trap (frame=
      {tf_fs = 0xc0380018, tf_es = 0xc0b90010, tf_ds = 0x10, tf_edi = 0x0, 
tf_esi = 0xc1857530, tf_ebp = 0xc873fab4, tf_isp = 0xc873faa0, tf_
ebx = 0xc19a6c00, tf_edx = 0xe7, tf_ecx = 0xc032a340, tf_eax = 0x0, tf_trapno = 
0xc, tf_err = 0x0, tf_eip = 0xc01c6de6, tf_cs = 0x8, tf_eflag
s = 0x10292, tf_esp = 0xc873faf0, tf_ss = 0xc01296ae})
    at /usr/src/sys/i386/i386/trap.c:445
#13 0xc02d44f8 in calltrap () at {standard input}:98
#14 0xc01296ae in ata_command (atadev=0xc1857530, command=0xe7, lba=0x0, 
count=0x0, feature=0x0, flags=0x4)
    at bus_at386.h:526
#15 0xc01396df in adclose (dev=0x0, flags=0x3, fmt=0x0, td=0x0) at 
/usr/src/sys/dev/ata/ata-disk.c:292
#16 0xc0177593 in g_disk_access (pp=0xc1919380, r=0x0, w=0x0, e=0x0) at 
/usr/src/sys/geom/geom_disk.c:96
#17 0xc017b634 in g_access_rel (cp=0xc1913800, dcr=0xffffffff, dcw=0xffffffff, 
dce=0xfffffffe)
    at /usr/src/sys/geom/geom_subr.c:437
#18 0xc017a0b0 in g_slice_access (pp=0xc1911680, dr=0xffffffff, dw=0xffffffff, 
de=0xfffffffe)
    at /usr/src/sys/geom/geom_slice.c:121
#19 0xc017b634 in g_access_rel (cp=0xc213a000, dcr=0xffffffff, dcw=0xffffffff, 
dce=0xffffffff)
    at /usr/src/sys/geom/geom_subr.c:437
#20 0xc017a0b0 in g_slice_access (pp=0xc1d4cd80, dr=0xffffffff, dw=0xffffffff, 
de=0xffffffff)
    at /usr/src/sys/geom/geom_slice.c:121
#21 0xc017b634 in g_access_rel (cp=0xc1888500, dcr=0xffffffff, dcw=0xffffffff, 
dce=0x0)
    at /usr/src/sys/geom/geom_subr.c:437
#22 0xc01772f3 in g_dev_orphan (cp=0xc1888500) at 
/usr/src/sys/geom/geom_dev.c:436
#23 0xc0178a3c in g_orphan_register (pp=0xc1888500) at 
/usr/src/sys/geom/geom_event.c:129
#24 0xc0178dd0 in one_event () at /usr/src/sys/geom/geom_event.c:236
#25 0xc0178f55 in g_run_events () at /usr/src/sys/geom/geom_event.c:268
#26 0xc0179bc5 in g_event_procbody () at /usr/src/sys/geom/geom_kern.c:140
#27 0xc0196f22 in fork_exit (callout=0xc0179ba0 <g_event_procbody>, arg=0x0, 
frame=0x0)
    at /usr/src/sys/kern/kern_fork.c:872