kern/39875: panic when booting off ffs+log

[lists%nerdbynature.de@localhost]

>Number:         39875
>Category:       kern
>Synopsis:       panic when booting off ffs+log
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 07 10:35:00 +0000 2008
>Originator:     Christian Kujau
>Release:        NetBSD 5.0_BETA
>Organization:
>Environment:
        
        
System: NetBSD netbsd.housecafe.de 5.0_BETA NetBSD 5.0_BETA (XEN3_DOMU) #0: Mon 
Nov 3 22:50:22 PST 2008 
builds@wb28:/home/builds/ab/netbsd-5/amd64/200811030002Z-obj/home/builds/ab/netbsd-5/src/sys/arch/amd64/compile/XEN3_DOMU
 amd64
Architecture: x86_64
Machine: amd64
>Description:
        After installing from netbsd-INSTALL_XEN3_DOMU.gz in an Dom0 
        (Ubuntu Linux, amd64, Intel based MacMini) rebooting from
        netbsd-XEN3_DOMU.gz, the kernel panics:

# xm create -c netbsd.cfg
Using config file "/etc/xen/netbsd.cfg".
Started domain netbsd
Loaded initial symtab at 0xffffffff80658464, strtab at 0xffffffff806a4a70, # 
entries 12943
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 5.0_BETA (XEN3_DOMU) #0: Mon Nov  3 22:50:22 PST 2008
        
builds@wb28:/home/builds/ab/netbsd-5/amd64/200811030002Z-obj/home/builds/ab/netbsd-5/src/sys/arch/amd64/compile/XEN3_DOMU
total memory = 65536 KB
avail memory = 55692 KB
mainbus0 (root)
hypervisor0 at mainbus0: Xen version 3.2
vcpu0 at hypervisor0: Intel 686-class, 1999MHz, id 0x6f6
xenbus0 at hypervisor0: Xen Virtual Bus Interface
xencons0 at hypervisor0: Xen Virtual Console Driver
xencons0: using event channel 2
xbd0 at xenbus0 id 3: Xen Virtual Block Device Interface
xennet0 at xenbus0 id 0: Xen Virtual Network Interface
xennet0: MAC address 00:16:3e:38:d3:03
unknown type console at xenbus0 id 0 not configured
raidattach: Asked for 8 units
Kernelized RAIDframe activated
Searching for RAID components...
boot device: <unknown>
root device: 
use one of: xbd0[a-p] xennet0 md0[a-p] ddb halt reboot
root device: xbd0a
dump device (default xbd0b): 
file system (default generic): ffs
root on xbd0a dumps on xbd0b
unknown type console at xenbus0 id 0 not configured
unknown type console at xenbus0 id 0 not configured
/: replaying log to memory
init path (default /sbin/init): 
init: copying out path `/sbin/init' 11
Fri Nov  7 10:18:52 CET 2008
swapctl: adding /dev/xbd0b as swap device at priority 0
Starting file system checks:
/dev/rxbd0a: file system is journaled; not checking
/dev/rxbd0e: 1 files, 1 used, 4032278 free (14 frags, 504033 blocks, 0.0% 
fragmentation)
/dev/rxbd0e: MARKING FILE SYSTEM CLEAN
/ fs is journalled, ignoring soft update mode
/: replaying log to disk
Setting tty flags.
Setting sysctl variables:
Starting network.
Hostname: netbsd.housecafe.de
IPv6 mode: host
Configuring network interfaces: xennet0.
Adding interface aliases:.
Starting dhclient.
Internet Systems Consortium DHCP Client V3.0.3
Copyright 2004-2005 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/products/DHCP

Listening on BPF/xennet0/00:16:3e:38:d3:03
Sending on   BPF/xennet0/00:16:3e:38:d3:03
Sending on   Socket/fallback
DHCPDISCOVER on xennet0 to 255.255.255.255 port 67 interval 7
DHCPOFFER from 192.168.10.50
DHCPREQUEST on xennet0 to 255.255.255.255 port 67
DHCPACK from 192.168.10.50
bound to 192.168.10.102 -- renewal in 33844 seconds.
Building databases: dev, utmp, utmpx, services done
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
wsconscfg: Cannot open `/dev/ttyEcfg': Device not configured
Starting syslogd.
Checking for core dump...
Mounting all filesystems...
/ fs is journalled, ignoring soft update mode
Clearing temporary files.
Checking quotas: done.
Starting virecover.
Starting local daemons:.
Updating motd.
panic: kernel diagnostic assertion "!rw_write_held(&wl->wl_rwlock)" failed: 
file "/home/builds/ab/netbsd-5/src/sys/kern/vfs_wapbl.c", line 1570
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80375c95 cs e030 rflags 246 cr2  7f7ffdba1800 
cpl 0 rsp ffffa00006772830
Stopped in pid 233.1 (rm) at    netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x255
__kernassert() at netbsd:__kernassert+0x2d
vn_lock() at netbsd:vn_lock+0x6e
vget() at netbsd:vget+0x132
ufs_ihashget() at netbsd:ufs_ihashget+0x91
ffs_vget() at netbsd:ffs_vget+0xc1
handle_workitem_remove() at netbsd:handle_workitem_remove+0x36
softdep_setup_remove() at netbsd:softdep_setup_remove+0x103
ufs_dirremove() at netbsd:ufs_dirremove+0x9f
ufs_remove() at netbsd:ufs_remove+0x16c
VOP_REMOVE() at netbsd:VOP_REMOVE+0x2d
do_sys_unlink() at netbsd:do_sys_unlink+0xa7
syscall() at netbsd:syscall+0xb4
ds          0x2840
es          0x6ddc
fs          0x2840
gs          0x6eb7
rdi         0
rsi         0xd
rbp         0xffffa00006772830
rbx         0xffffa00006772840
rdx         0
rcx         0
rax         0x1
r8          0xffffffff80591640  cpu_info_primary
r9          0x1
r10         0xffffa00006772750
r11         0xffffffff8038da70  xenconscn_putc
r12         0x100
r13         0xffffffff804820f8  copyright+0x8e5b8
r14         0xe5e1
r15         0x2
rip         0xffffffff80375c95  breakpoint+0x5
cs          0xe030
rflags      0x246
rsp         0xffffa00006772830
ss          0xe02b
netbsd:breakpoint+0x5:  leave


The underlying device is provided by the Xen-3.2 Dom0, which in turn built 
this device from an LVM2 volume.

>How-To-Repeat:
        This happens every time I try to boot netbsd-XEN3_DOMU.gz from
        NetBSD-daily/netbsd-5/200811030002Z/amd64. More details from
        ddb is available.
        
>Fix:
        The root filesystem was mounted with the "log" option. Removing
        this option fixes this issue and booting continues.
        FWIW, this looked like PR 39295 to me, but the filesystem was not
        corrupted afterwards and it panicked always in line 1570 vfs_wapbl.c

>Unformatted: