Re: CD access panic on 5.2RC2 (similar to panic before for audio/data CD access)

>>> "LE" == Lukas Ertl <le_at_FreeBSD.org> writes:
LE> What's the panic message? Would it be possible for you to get a
LE> coredump and a gdb backtrace out of that?

Ok, here is a gdb backtrace. I have also put in some info about the
last frame that called calltrap(). That doesnt seem to be same
function that panic tells me about. The panic says that it stopped at
devstat_remove_entry but the last frame before calltrap is
g_destroy_provider. I guess I dont understand the kernel code well
enough to know what is happening.

I also noticed that when I accessed the CD using cd0 (using atapicam)
then the panic doesnt happen. This only happens when I access it using
acd0. atapicam is always compiled in the kernel.

(Sorry about the long lines)

(kgdb) bt
#0  doadump () at ../../../kern/kern_shutdown.c:240
#1  0xc04e93c2 in boot (howto=260) at ../../../kern/kern_shutdown.c:372
#2  0xc04e96f7 in panic () at ../../../kern/kern_shutdown.c:550
#3  0xc043d832 in db_panic () at ../../../ddb/db_command.c:450
#4  0xc043d792 in db_command (last_cmdp=0xc069c340, cmd_table=0x0, aux_cmd_tablep=0xc066efb0, aux_cmd_tablep_end=0xc066efb4) at ../../../ddb/db_command.c:346
#5  0xc043d8d5 in db_command_loop () at ../../../ddb/db_command.c:472
#6  0xc04408d5 in db_trap (type=12, code=0) at ../../../ddb/db_trap.c:73
#7  0xc060b0ac in kdb_trap (type=12, code=0, regs=0xd89a1c44) at ../../../i386/i386/db_interface.c:171
#8  0xc061e0c6 in trap_fatal (frame=0xd89a1c44, eva=0) at ../../../i386/i386/trap.c:816
#9  0xc061dd92 in trap_pfault (frame=0xd89a1c44, usermode=0, eva=28) at ../../../i386/i386/trap.c:735
#10 0xc061d97d in trap (frame={tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 0, tf_esi = -1027875712, tf_ebp = -660988776, tf_isp = -660988816, tf_ebx = -1019462608, tf_edx = 0, tf_ecx = -1066768828, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1068488413, tf_cs = 8, tf_eflags = 66051, tf_esp = -1066768864, tf_ss = 0}) at ../../../i386/i386/trap.c:420
#11 0xc060caa8 in calltrap () at {standard input}:94
#12 0xc04b8558 in g_destroy_provider (pp=0xc33c3c30) at ../../../geom/geom_subr.c:426
#13 0xc04b5775 in g_orphan_register (pp=0xc2bbdc80) at ../../../geom/geom_event.c:143
#14 0xc04b5850 in one_event () at ../../../geom/geom_event.c:169
#15 0xc04b5a15 in g_run_events () at ../../../geom/geom_event.c:202
#16 0xc04b68c5 in g_event_procbody () at ../../../geom/geom_kern.c:134
#17 0xc04d5dae in fork_exit (callout=0xc04b68a0 <g_event_procbody>, arg=0x0, frame=0x0) at ../../../kern/kern_fork.c:793
(kgdb) fr 12
#12 0xc04b8558 in g_destroy_provider (pp=0xc33c3c30) at ../../../geom/geom_subr.c:426
426             devstat_remove_entry(pp->stat);
(kgdb) l
421             KASSERT (pp->acw == 0, ("g_destroy_provider with acw"));
422             KASSERT (pp->acw == 0, ("g_destroy_provider with ace"));
423             g_cancel_event(pp);
424             LIST_REMOVE(pp, provider);
425             gp = pp->geom;
426             devstat_remove_entry(pp->stat);
427             g_free(pp);
428             if ((gp->flags & G_GEOM_WITHER))
429                     g_wither_geom(gp, 0);
430     }
(kgdb) p *pp
$1 = {name = 0x0, provider = {le_next = 0x0, le_prev = 0x0}, geom = 0x0, consumers = {lh_first = 0x0}, acr = 0, acw = 0, ace = 0, error = 0, orphan = {tqe_next = 0x0, tqe_prev = 0x0}, index = 0, mediasize = 0, sectorsize = 0, stripesize = 0, stripeoffset = 0, stat = 0x0, nstart = 0, nend = 0, flags = 0}
(kgdb) p gp
$2 = (struct g_geom *) 0xc2bbdc80
(kgdb) p *gp
$5 = {name = 0xc1f4d5e0 "acd0", class = 0xc0675c00, geom = {le_next = 0x0, le_prev = 0xc0675c24}, consumer = {lh_first = 0x0}, provider = {lh_first = 0xc32a5380}, geoms = {tqe_next = 0xc2ab6b80, tqe_prev = 0xc2ab6a18}, rank = 1, start = 0xc0457ce0 <acd_geom_start>, spoiled = 0, dumpconf = 0, access = 0xc0456cf0 <acd_geom_access>, orphan = 0, ioctl = 0xc0456f60 <acd_geom_ioctl>, softc = 0xc2abb000, flags = 0}
(kgdb)


Thanks.

kaarthik