From nobody@FreeBSD.org  Fri Aug 18 02:58:59 2006
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D6B6F16A4DA
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 18 Aug 2006 02:58:59 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7DE9043D53
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 18 Aug 2006 02:58:59 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k7I2wxnG048617
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 18 Aug 2006 02:58:59 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id k7I2wxGb048616;
	Fri, 18 Aug 2006 02:58:59 GMT
	(envelope-from nobody)
Message-Id: <200608180258.k7I2wxGb048616@www.freebsd.org>
Date: Fri, 18 Aug 2006 02:58:59 GMT
From: Yoichi NAKAYAMA <yoichi@FreeBSD.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [ata] detach raid member and reboot will cause panic (ICH7)
X-Send-Pr-Version: www-2.3

>Number:         102211
>Category:       kern
>Synopsis:       [ar] [patch] detach raid member and reboot will cause panic (ICH7)
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    mav
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 18 03:00:30 GMT 2006
>Closed-Date:    Wed Mar 31 07:53:54 UTC 2010
>Last-Modified:  Wed Mar 31 08:00:19 UTC 2010
>Originator:     Yoichi NAKAYAMA
>Release:        7-current
>Organization:
FreeBSD.org
>Environment:
FreeBSD suigei.local-net 7.0-CURRENT FreeBSD 7.0-CURRENT #11: Thu Aug 17 23:51:38 JST 2006     yoichi@suigei.local-net:/usr/obj/usr/src/sys/GENERIC_DEBUG  i386
>Description:
I have raid array with ICH7.
Reboot system after detaching member disk will cause panic
(as noted in kern/97624).
The metadata on the left disk is:

********* ATA Intel MatrixRAID Metadata *********
intel_id            <Intel Raid ISM Cfg Sig. >
version             <1.1.00>
checksum            0x5f8caa2c
config_size         0x000001e0
config_id           0x44e526fa
generation          0x0000007e
total_disks         2
total_volumes       1
DISK#   serial disk_sectors disk_id flags
    0   <V591P8FG> 490234752 0x00000000 0x0000013a
    1   <:0> 490229760 0xffffffff 0x00000006
name                Volume0
total_sectors       490229760
state               12
reserved            0
offset              0
disk_sectors        490229760
stripe_count        1914960
stripe_sectors      128
status              2
type                RAID1
total_disks         2
magic[0]            0x02
magic[1]            0x01
magic[2]            0x01
    disk 0 at disk_idx 0x00000000
    disk 1 at disk_idx 0x01000001
=================================================
where higher bits of disk_idx for detached one causes access vaiolation. 

related part of dmesg:
 atapci2: <Intel ICH7M SATA300 controller> port 0xe080-0xe087,0xe000-0xe003,0xdc00-0xdc07,0xd880-0xd883,0xd800-0xd80f mem 0xffa37800-0xffa37bff irq 19 at device 31.2 on pci0
 ad10: 239372MB <Maxtor 7V250F0 VA111630> at ata5-master SATA150
 ad14: 239372MB <Maxtor 7V250F0 VA111630> at ata7-master SATA150
 ar0: disk0 READY (master) using ad10 at ata5-master
 ar0: disk1 READY (mirror) using ad14 at ata7-master

attached change avoids panic, but detached disk forms separate volume as
 ar0: WARNING - mirror protection lost. RAID1 array in DEGRADED mode
 ar0: 239370MB <Intel MatrixRAID RAID1> status: DEGRADED
 ar0: disk0 READY (master) using ad10 at ata5-master
 ar0: disk1 DOWN no device found for this subdisk
 ar1: WARNING - mirror protection lost. RAID1 array in DEGRADED mode
 ar1: 239370MB <Intel MatrixRAID RAID1> status: DEGRADED
 ar1: disk0 DOWN no device found for this subdisk
 ar1: disk1 READY (mirror) using ad14 at ata7-master
so we have to call "atacontrol delete ar1" before addspare and rebuild,
while "Intel(R) Matrix Storage Manager option ROM v5.7.0.1005 ICH7MR" shows
single volume as:
 RAID Volumes:
 ID    Name     Level           Strip  Size     Status    Bootable
 0     Volume0  RAID1(Mirror)   N/A    233.8GB  Degraded  Yes

 Physical Disks:
 Port  Drive Model     Serial #  Size      Type/Status(Vol ID)
 0     Maxtor 7V250F0  V591P8FG  233.8GB   Member Disk(0)
 2     Maxtor 7V250F0  V591PNAG  233.8GB   Offline Member

On Windows XP, Intel Matrix Storage Console shows single RAID volume with one disk  (port 0) and separate non-RAID disk (port 2).
>How-To-Repeat:
# atacontrol status ar0
ar0: ATA RAID1 subdisks: ad10 ad14 status: READY
# atacontrol detach ata7
# atacontrol status ar0
ar0: ATA RAID1 subdisks: ad10 DOWN status: DEGRADED
# reboot

>Fix:
Masking disk_idx avoids panic

*** /usr/src/sys/dev/ata/ata-raid.c.orig	Sat Apr 15 19:27:41 2006
--- /usr/src/sys/dev/ata/ata-raid.c	Thu Aug 10 07:37:28 2006
***************
*** 2122,2143 ****
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
  		raid->disks[disk].dev = NULL;
! 		bcopy(meta->disk[map->disk_idx[disk]].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
! 		    meta->disk[map->disk_idx[disk]].sectors;
  		raid->disks[disk].flags = 0;
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
! 		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}
--- 2122,2144 ----
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
+ 		u_int32_t disk_idx = map->disk_idx[disk] & 0xffff;
  		raid->disks[disk].dev = NULL;
! 		bcopy(meta->disk[disk_idx].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
! 		    meta->disk[disk_idx].sectors;
  		raid->disks[disk].flags = 0;
! 		if (meta->disk[disk_idx].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
! 		if (meta->disk[disk_idx].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
! 		if (meta->disk[disk_idx].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
! 		if (meta->disk[disk_idx].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->sos 
Responsible-Changed-By: jkim 
Responsible-Changed-When: Tue May 1 15:58:49 UTC 2007 
Responsible-Changed-Why:  
Over to the maintainer. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=102211 

From: Stef Walter <stef@memberwebs.com>
To: bug-followup@FreeBSD.org, yoichi@FreeBSD.org
Cc:  
Subject: Re: kern/102211: [ar] [patch] detach raid member and reboot will
 cause panic (ICH7)
Date: Thu, 20 Mar 2008 06:35:12 +0000 (UTC)

 The secondary condition of the separate volume formed is fixed by the
 patch attached to kern/121899:
 
 http://www.freebsd.org/cgi/query-pr.cgi?pr=121899
 

From: Rolf Grossmann <rg@progtech.net>
To: bug-followup@FreeBSD.org, yoichi@FreeBSD.org
Cc:  
Subject: Re: kern/102211: [ar] [patch] detach raid member and reboot will
 cause panic (ICH7)
Date: Fri, 26 Sep 2008 21:08:03 +0200

 Hi,
 
 i've just run into the same problem. A disk that was previously used in 
 an Intel MatrixRAID board was put on its own into a replacement machine 
 (with no RAID support) because of hardware problems. However, upon boot 
 the kernel just paniced (without the second disk). A verbose boot showed 
 that both disk_idx had indeed the extra bit set, as described in this 
 PR. The given patch solves the problem and worked well for me. However, 
 it took me a couple of hours to actually figure out what was going on 
 and come across this patch.
 
 So can we please get this committed, so in the future nobody needs to 
 waste their time? As a programmer, I can easily tell that the change is 
 very localized and low risk and can therefor be applied even this far 
 into the release cycle.
 
 The other patch in kern/121899 
 <http://www.freebsd.org/cgi/query-pr.cgi?pr=121899&cat=kern> also looks 
 useful (and simple enough) to me (and I have applied it to my sources 
 without problems), although that didn't hit me (yet?) since I haven't 
 tried to restore the machine with both RAID disks.
 
 Thanks, Rolf.
 
Responsible-Changed-From-To: sos->freebsd-bugs 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Tue May 12 04:40:01 UTC 2009 
Responsible-Changed-Why:  
sos@ is not actively working on ATA-related PRs. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=102211 
State-Changed-From-To: open->patched 
State-Changed-By: mav 
State-Changed-When: Fri Mar 12 07:49:22 UTC 2010 
State-Changed-Why:  
Patch committed to HEAD. 


Responsible-Changed-From-To: freebsd-bugs->mav  
Responsible-Changed-By: mav 
Responsible-Changed-When: Fri Mar 12 07:49:22 UTC 2010 
Responsible-Changed-Why:  
I'll track merging it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=102211 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/102211: commit references a PR
Date: Fri, 12 Mar 2010 07:49:19 +0000 (UTC)

 Author: mav
 Date: Fri Mar 12 07:49:10 2010
 New Revision: 205074
 URL: http://svn.freebsd.org/changeset/base/205074
 
 Log:
   Mask disk_idx to avoid panic because of extra bits set.
   
   PR:		kern/102211
   Submitted by:	yoichi
 
 Modified:
   head/sys/dev/ata/ata-raid.c
 
 Modified: head/sys/dev/ata/ata-raid.c
 ==============================================================================
 --- head/sys/dev/ata/ata-raid.c	Fri Mar 12 07:26:37 2010	(r205073)
 +++ head/sys/dev/ata/ata-raid.c	Fri Mar 12 07:49:10 2010	(r205074)
 @@ -2544,22 +2544,24 @@ ata_raid_intel_read_meta(device_t dev, s
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
 +		u_int disk_idx = map->disk_idx[disk] & 0xffff;
 +
  		raid->disks[disk].dev = NULL;
 -		bcopy(meta->disk[map->disk_idx[disk]].serial,
 +		bcopy(meta->disk[disk_idx].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
 -		    meta->disk[map->disk_idx[disk]].sectors;
 +		    meta->disk[disk_idx].sectors;
  		raid->disks[disk].flags = 0;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ONLINE)
 +		if (meta->disk[disk_idx].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ASSIGNED)
 +		if (meta->disk[disk_idx].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_SPARE) {
 +		if (meta->disk[disk_idx].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_DOWN)
 +		if (meta->disk[disk_idx].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: mav 
State-Changed-When: Wed Mar 31 07:53:24 UTC 2010 
State-Changed-Why:  
Patch merged to 7/8-STABLE. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=102211 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/102211: commit references a PR
Date: Wed, 31 Mar 2010 07:50:16 +0000 (UTC)

 Author: mav
 Date: Wed Mar 31 07:49:59 2010
 New Revision: 205968
 URL: http://svn.freebsd.org/changeset/base/205968
 
 Log:
   MFC r205074:
   Mask disk_idx to avoid panic because of extra bits set.
   
   PR:             kern/102211
   Submitted by:   yoichi
 
 Modified:
   stable/8/sys/dev/ata/ata-raid.c
 Directory Properties:
   stable/8/sys/   (props changed)
   stable/8/sys/amd64/include/xen/   (props changed)
   stable/8/sys/cddl/contrib/opensolaris/   (props changed)
   stable/8/sys/contrib/dev/acpica/   (props changed)
   stable/8/sys/contrib/pf/   (props changed)
   stable/8/sys/dev/xen/xenpci/   (props changed)
 
 Modified: stable/8/sys/dev/ata/ata-raid.c
 ==============================================================================
 --- stable/8/sys/dev/ata/ata-raid.c	Wed Mar 31 07:20:10 2010	(r205967)
 +++ stable/8/sys/dev/ata/ata-raid.c	Wed Mar 31 07:49:59 2010	(r205968)
 @@ -2544,22 +2544,24 @@ ata_raid_intel_read_meta(device_t dev, s
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
 +		u_int disk_idx = map->disk_idx[disk] & 0xffff;
 +
  		raid->disks[disk].dev = NULL;
 -		bcopy(meta->disk[map->disk_idx[disk]].serial,
 +		bcopy(meta->disk[disk_idx].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
 -		    meta->disk[map->disk_idx[disk]].sectors;
 +		    meta->disk[disk_idx].sectors;
  		raid->disks[disk].flags = 0;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ONLINE)
 +		if (meta->disk[disk_idx].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ASSIGNED)
 +		if (meta->disk[disk_idx].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_SPARE) {
 +		if (meta->disk[disk_idx].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_DOWN)
 +		if (meta->disk[disk_idx].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/102211: commit references a PR
Date: Wed, 31 Mar 2010 07:53:02 +0000 (UTC)

 Author: mav
 Date: Wed Mar 31 07:52:48 2010
 New Revision: 205969
 URL: http://svn.freebsd.org/changeset/base/205969
 
 Log:
   MFC r205074:
   Mask disk_idx to avoid panic because of extra bits set.
   
   PR:             kern/102211
   Submitted by:   yoichi
 
 Modified:
   stable/7/sys/dev/ata/ata-raid.c
 Directory Properties:
   stable/7/sys/   (props changed)
   stable/7/sys/cddl/contrib/opensolaris/   (props changed)
   stable/7/sys/contrib/dev/acpica/   (props changed)
   stable/7/sys/contrib/pf/   (props changed)
 
 Modified: stable/7/sys/dev/ata/ata-raid.c
 ==============================================================================
 --- stable/7/sys/dev/ata/ata-raid.c	Wed Mar 31 07:49:59 2010	(r205968)
 +++ stable/7/sys/dev/ata/ata-raid.c	Wed Mar 31 07:52:48 2010	(r205969)
 @@ -2535,22 +2535,24 @@ ata_raid_intel_read_meta(device_t dev, s
  
  	    /* clear out any old info */
  	    for (disk = 0; disk < raid->total_disks; disk++) {
 +		u_int disk_idx = map->disk_idx[disk] & 0xffff;
 +
  		raid->disks[disk].dev = NULL;
 -		bcopy(meta->disk[map->disk_idx[disk]].serial,
 +		bcopy(meta->disk[disk_idx].serial,
  		      raid->disks[disk].serial,
  		      sizeof(raid->disks[disk].serial));
  		raid->disks[disk].sectors =
 -		    meta->disk[map->disk_idx[disk]].sectors;
 +		    meta->disk[disk_idx].sectors;
  		raid->disks[disk].flags = 0;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ONLINE)
 +		if (meta->disk[disk_idx].flags & INTEL_F_ONLINE)
  		    raid->disks[disk].flags |= AR_DF_ONLINE;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_ASSIGNED)
 +		if (meta->disk[disk_idx].flags & INTEL_F_ASSIGNED)
  		    raid->disks[disk].flags |= AR_DF_ASSIGNED;
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_SPARE) {
 +		if (meta->disk[disk_idx].flags & INTEL_F_SPARE) {
  		    raid->disks[disk].flags &= ~(AR_DF_ONLINE | AR_DF_ASSIGNED);
  		    raid->disks[disk].flags |= AR_DF_SPARE;
  		}
 -		if (meta->disk[map->disk_idx[disk]].flags & INTEL_F_DOWN)
 +		if (meta->disk[disk_idx].flags & INTEL_F_DOWN)
  		    raid->disks[disk].flags &= ~AR_DF_ONLINE;
  	    }
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
