RELENG_7: SATA hotplug does not work

Dear colleagues,

with -CURRENT and RELENG_7 I am never able to hot plug SATA disk: it is always 
entering endless loop like

ad10: 381554MB <Seagate ST3400620AS 3.AAK> at ata5-master SATA150
ad10: detached
ad10: 381554MB <Seagate ST3400620AS 3.AAK> at ata5-master SATA150
ad10: detached
ad10: 381554MB <Seagate ST3400620AS 3.AAK> at ata5-master SATA150
ad10: detached
ad10: 381554MB <Seagate ST3400620AS 3.AAK> at ata5-master SATA150
ad10: detached
ad10: 381554MB <Seagate ST3400620AS 3.AAK> at ata5-master SATA150
ad10: detached
ad10: 381554MB <Seagate ST3400620AS 3.AAK> at ata5-master SATA150
ad10: detached

on every controllers I have (though it's mostly cheap side: onboard NVivia, 
JMicron, Intel ICH7/ICH8, etc; Promise FastTrak SATA -- all they behave the 
same)

RELENG_6 on those controllers usually survive hotplug.


If I  atacontrol detach before plugging, plug, atacontrol 
attach - sometimes machine detects new disk OK, sometime panics:


Unread portion of the kernel message buffer:
ata4: [ITHREAD]


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x50
fault code              = supervisor read data, page not present
instruction pointer     = 0x8:0xffffffff8023a6a3
stack pointer           = 0x10:0xffffffffa2c82900
frame pointer           = 0x10:0xffffff00018f1d00
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 990 (atacontrol)
trap number             = 12
panic: page fault
Uptime: 1h37m58s
Physical memory: 1016 MB
Dumping 65 MB: 50 34 18 2

#0  doadump () at pcpu.h:194
194     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:194
#1  0x0000000000000000 in ?? ()
#2  0xffffffff80218f14 in boot (howto=260) at 
/usr/src/sys/kern/kern_shutdown.c:409
#3  0xffffffff802192c0 in panic (fmt=0xffffffff80389477 "%s") at 
/usr/src/sys/kern/kern_shutdown.c:563
#4  0xffffffff8034dc10 in trap_fatal (frame=0xffffff0001a35350, 
eva=18446742974226405568) at /usr/src/sys/amd64/amd64/trap.c:697
#5  0xffffffff8034dfe5 in trap_pfault (frame=0xffffffffa2c82850, usermode=0) at 
/usr/src/sys/amd64/amd64/trap.c:614
#6  0xffffffff8034e953 in trap (frame=0xffffffffa2c82850) at 
/usr/src/sys/amd64/amd64/trap.c:383
#7  0xffffffff8033789e in calltrap () at 
/usr/src/sys/amd64/amd64/exception.S:169
#8  0xffffffff8023a6a3 in device_attach (dev=0xffffff00018f1d00) at bus_if.h:46
#9  0xffffffff8023b9c8 in bus_generic_attach (dev=Variable "dev" is not 
available.
) at /usr/src/sys/kern/subr_bus.c:2884
#10 0xffffffff8017442c in ata_identify (dev=0xffffff00010a5800) at 
/usr/src/sys/dev/ata/ata-all.c:713
#11 0xffffffff80174d2a in ata_attach (dev=0xffffff00010a5800) at 
/usr/src/sys/dev/ata/ata-all.c:145
#12 0xffffffff801757a3 in ata_ioctl (dev=Variable "dev" is not available.
) at /usr/src/sys/dev/ata/ata-all.c:383
#13 0xffffffff801e93d2 in giant_ioctl (dev=0xffffff00010a2c00, cmd=2147770627, 
data=0xffffff0001398a30 "\004", fflag=3, td=0xffffff0001a35350)
    at /usr/src/sys/kern/kern_conf.c:349
#14 0xffffffff801ce7fe in devfs_ioctl_f (fp=0xffffff00019b23c0, com=2147770627, 
data=Variable "data" is not available.
) at /usr/src/sys/fs/devfs/devfs_vnops.c:494
#15 0xffffffff8024ac44 in kern_ioctl (td=0xffffff0001a35350, fd=3, 
com=2147770627, data=0xffffff0001398a30 "\004") at file.h:266
#16 0xffffffff8024af3e in ioctl (td=0xffffff0001a35350, uap=0xffffffffa2c82be0) 
at /usr/src/sys/kern/sys_generic.c:570
#17 0xffffffff8034e263 in syscall (frame=0xffffffffa2c82c70) at 
/usr/src/sys/amd64/amd64/trap.c:822
#18 0xffffffff80337a4b in Xfast_syscall () at 
/usr/src/sys/amd64/amd64/exception.S:272
#19 0x00000008007106bc in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) 

# uname -a
FreeBSD n5600.rinet.ru 7.0-BETA1 FreeBSD 7.0-BETA1 #3: Wed Oct 24 00:40:47 MSD 
2007     root_at_n5600.rinet.ru:/usr/obj/usr/src/sys/MINI  amd64


Any hints?  Thanks in advance.

I'm now rebuilding kernel with WITNESS/INVARIANTS to recheck, will followup 
ASAP.


Sincerely,
D.Marck                                     [DM5020, MCK-RIPE, DM3-RIPN]
[ FreeBSD committer:				     marck_at_FreeBSD.org ]
------------------------------------------------------------------------
*** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck_at_rinet.ru ***
------------------------------------------------------------------------