From owner-freebsd-current@FreeBSD.ORG Sun Mar 29 12:40:31 2009 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6DB2010656CA for ; Sun, 29 Mar 2009 12:40:31 +0000 (UTC) (envelope-from lstewart@room52.net) Received: from outbound.icp-qv1-irony-out2.iinet.net.au (outbound.icp-qv1-irony-out2.iinet.net.au [203.59.1.107]) by mx1.freebsd.org (Postfix) with ESMTP id E13928FC23 for ; Sun, 29 Mar 2009 12:40:30 +0000 (UTC) (envelope-from lstewart@room52.net) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEADMCz0l8qF1T/2dsb2JhbADIf4N6Bg X-IronPort-AV: E=Sophos;i="4.38,441,1233500400"; d="scan'208";a="457664170" Received: from unknown (HELO lawrence1.loshell.room52.net) ([124.168.93.83]) by outbound.icp-qv1-irony-out2.iinet.net.au with ESMTP; 29 Mar 2009 20:10:58 +0800 Message-ID: <49CF6551.4080301@room52.net> Date: Sun, 29 Mar 2009 23:10:57 +1100 From: Lawrence Stewart User-Agent: Thunderbird 2.0.0.21 (X11/20090326) MIME-Version: 1.0 To: Alexander Motin References: <49CF0754.9070907@room52.net> <49CF2B0C.7050301@FreeBSD.org> In-Reply-To: <49CF2B0C.7050301@FreeBSD.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-current@freebsd.org Subject: Re: kernel panic with snd_hda "panic: Duplicate free of item 0xffffff00025f8c00 from zone 0xffffff00b697d400(1024)" X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Mar 2009 12:40:32 -0000 Alexander Motin wrote: > Lawrence Stewart wrote: >> I'm getting a kernel panic with the snd_hda driver on fresh 8-CURRENT >> amd64 (r190518). I received this panic the other day when loading the >> module from the command line on a slightly older kernel revision (I >> think it was r190437). After putting the module load into >> /boot/loader.conf, the problem didn't occur again and sound worked >> just fine on subsequent reboots. >> >> A few minutes ago I installed the new r190518 kernel and now it panics >> consistently with the same message every time. It also panics if I >> unload the module at the loader prompt, boot the kernel and then >> kldload on the command line. >> >> Hardware is a Toshiba Portege R600 laptop. Details below are hand >> transcribed as the machine doesn't have a serial port. >> >> Relevant bit of verbose boot message when it panics: >> >> hdac0: at device 27.0 on >> pci0 >> hdac0: HDA driver revision: 20090316_0130 >> hdac0: Lazy allocation of 0x4000 bytes rid 0x10 type 3 at 0xb69a4000 >> hdac0: Reserved 0x4000 bytes for rid 0x10 type 3 at 0xb69a4000 >> hdac0: attempting to allocate 1 MSI vectors (1 supported) >> hdac0: using IRQ 257 for MSI >> msi: Assinging MSI IRQ 257 to local APIC 0 vector 53 >> hdac0: [MPSAFE] >> hdac0: [ITHREAD] >> hdac0: hdac_get_capabilities: Invalid corb size (0) >> device_attach: hdac0 attach returned 6 >> Slab at 0xffffff00025d5b18, freei 3 = 0. >> panic: Duplicate free of item 0xffffff00025f8c00 from zone >> 0xffffff00b697d400(1024) >> >> Any idea what the issue(s) might be? > > I can't reproduce neither "Invalid corb size (0)" error, nor the crash > in case of it. I have tried to simulate that error, but system handled > it correctly. But I have INVARIANTS disabled on my system. > > Can you try to disable MSI? Setting hw.pci.enable_msix=0 and hw.pci.enable_msi=0 at the loader prompt made no difference. > > Can you try to move hdac_irq_alloc() call after hdac_rirb_init() in > hdac_attach()? May be interrupt shots while something is not yet > initialized? > Running with the following patch made no difference either. lstewart-laptop# svn diff dev/sound/pci/hda/hdac.c Index: dev/sound/pci/hda/hdac.c =================================================================== --- dev/sound/pci/hda/hdac.c (revision 190518) +++ dev/sound/pci/hda/hdac.c (working copy) @@ -4145,9 +4145,6 @@ result = hdac_mem_alloc(sc); if (result != 0) goto hdac_attach_fail; - result = hdac_irq_alloc(sc); - if (result != 0) - goto hdac_attach_fail; /* Get Capabilities */ result = hdac_get_capabilities(sc); @@ -4174,6 +4171,10 @@ hdac_corb_init(sc); hdac_rirb_init(sc); + result = hdac_irq_alloc(sc); + if (result != 0) + goto hdac_attach_fail; + /* Defer remaining of initialization until interrupts are enabled */ sc->intrhook.ich_func = hdac_attach2; sc->intrhook.ich_arg = (void *)sc; Any other ideas I could try? Cheers, Lawrence