Bug 121962 - [sound] [snd_emu10k1] [panic] Kernel panics with device polling and snd_emu10k1.ko enabled and network load
Summary: [sound] [snd_emu10k1] [panic] Kernel panics with device polling and snd_emu10...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 7.0-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-03-22 12:20 UTC by dima_bsd
Modified: 2018-01-03 05:11 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description dima_bsd 2008-03-22 12:20:00 UTC
I met 100% reproducible kernel panic when DEVICE_POLLING is enabled and sound sustem is active.

If I enable polling for my em0 using ifconfig/rc.conf, start playing audio, and in parallel, start to download some stuff with full speed of my internet connection - there is always the same result - kernel panics. All this conditions (polling+audio+download) should be achieved in one time to generate panic.

My sound card is SB Live and I use snd_emu10k1 driver (compiled in or loaded as module). To test this problem, I have builded GENERIC kernel with this set of options:
options         DEVICE_POLLING
options         HZ="1000"

kldstat:
Id Refs Address    Size     Name
 1   10 0xc0400000 b51968   kernel
 2    1 0xc0f52000 85a4     snd_emu10k1.ko
 3    3 0xc0f5b000 4836c    sound.ko
 4    1 0xc0fa4000 6722c    acpi.ko
 5    1 0xc4b31000 2000     rtc.ko
 6    1 0xc4b33000 21000    linux.ko


my make.conf is:
PERL_VER=5.8.8
PERL_VERSION=5.8.8
CPUTYPE=pentium4
CFLAGS+= -pipe
COPTFLAGS+= -pipe

mp3 audio playing has been done using XMMS from KDE, and mocp/mpg321 from console. Audio has been played from regular user account.
xmms-1.2.11_2
moc-2.4.1_3
mpg321-0.2.10_7

My Internet connection is DSL line with 230KB/64KB speed. Panics occur then I fill up this channel with http download trafic. There is no firewall in kernel/modules loaded during tests.


/var/crash:

cat ./info.7
Dump header from device /dev/ad0s2b
  Architecture: i386
  Architecture Version: 2
  Dump Length: 65011712B (62 MB)
  Blocksize: 512
  Dumptime: Sat Mar 22 11:53:24 2008
  Hostname: hius.local.home
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 7.0-RELEASE #0: Sat Mar 22 11:12:14 EET 2008
    root@hius.local.home:/usr/obj/usr/src/sys/GENERIC_COPY
  Panic String: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
  Dump Parity: 2072778861
  Bounds: 7
  Dump Status: good

cat ./info.6
Dump header from device /dev/ad0s2b
  Architecture: i386
  Architecture Version: 2
  Dump Length: 121036800B (115 MB)
  Blocksize: 512
  Dumptime: Sat Mar 22 10:56:41 2008
  Hostname: hius.local.home
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 7.0-RELEASE #0: Fri Mar 21 22:20:44 EET 2008
    root@hius.local.home:/usr/obj/usr/src/sys/GENERIC_COPY
  Panic String: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
  Dump Parity: 2808929151
  Bounds: 6
  Dump Status: good

cat ./info.5
Dump header from device /dev/ad0s2b
  Architecture: i386
  Architecture Version: 2
  Dump Length: 65126400B (62 MB)
  Blocksize: 512
  Dumptime: Sat Mar 22 10:48:35 2008
  Hostname: hius.local.home
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 7.0-RELEASE #0: Fri Mar 21 22:20:44 EET 2008
    root@hius.local.home:/usr/obj/usr/src/sys/GENERIC_COPY
  Panic String: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
  Dump Parity: 2369916027
  Bounds: 5
  Dump Status: good

How-To-Repeat: 1) Build/install GENERIC kernel with options:
options         DEVICE_POLLING
options         HZ="1000"

2) /boot/loader.conf
snd_emu10k1_load="YES"

3) ifconfig em0 polling

4) mpg321 ./some_nice_audio.mp3

5) fetch http://some.site.com/some_big_file
5) links net.apollo.lv/download_meter
Comment 1 Remko Lodder 2008-03-22 13:54:22 UTC
On Sat, March 22, 2008 1:14 pm, Dmitry Demidov wrote:
>

Hello,

Thanks for submitting this; can you please review
http://www.freebsd.org/doc/en/books/developers-handbook/kerneldebug.html
and return is the information? Make sure you reply-all to this message to
get it properly recorded for others.

Without that it's rather difficult to see why something crashed and what
caused it (as you mention three or four different things occur at the same
time, only one of them probably triggers a panic).

Thanks,
remko

-- 
/"\   Best regards,                      | remko@FreeBSD.org
\ /   Remko Lodder                       | remko@EFnet
 X    http://www.evilcoder.org/          |
/ \   ASCII Ribbon Campaign              | Against HTML Mail and News
Comment 2 Remko Lodder freebsd_committer 2008-03-22 14:06:07 UTC
State Changed
From-To: open->feedback

I asked for additional information about the coredumps. Set status to 
feedback
Comment 3 dima_bsd 2008-03-22 16:20:08 UTC
On Saturday 22 March 2008, Remko Lodder wrote:
> On Sat, March 22, 2008 1:14 pm, Dmitry Demidov wrote:
>
>
> Hello,
>
> Thanks for submitting this; can you please review
> http://www.freebsd.org/doc/en/books/developers-handbook/kerneldebug.html
> and return is the information? Make sure you reply-all to this message to
> get it properly recorded for others.
>
> Without that it's rather difficult to see why something crashed and what
> caused it (as you mention three or four different things occur at the same
> time, only one of them probably triggers a panic).
>
> Thanks,
> remko


Thanks for support. 
Here are the output of kgdb and some more info.
Can I do more to help you trace this?


---

kgdb kernel.debug /var/crash/vmcore.8

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
cpuid = 0
Uptime: 2m40s
Physical memory: 1007 MB
Dumping 62 MB: 47 31 15

#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
241             dumptid = curthread->td_tid;

---

cat /var/crash/info.8

Dump header from device /dev/ad0s2b
  Architecture: i386
  Architecture Version: 2
  Dump Length: 65060864B (62 MB)
  Blocksize: 512
  Dumptime: Sat Mar 22 17:15:49 2008
  Hostname: hius.local.home
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 7.0-RELEASE #0: Sat Mar 22 16:44:18 EET 2008
    root@hius.local.home:/usr/obj/usr/src/sys/GENERIC_COPY
  Panic String: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
  Dump Parity: 3434092906
  Bounds: 8
  Dump Status: good

---

kldstat

Id Refs Address    Size     Name
 1   10 0xc0400000 b51968   kernel
 2    1 0xc0f52000 85a4     snd_emu10k1.ko
 3    3 0xc0f5b000 4836c    sound.ko
 4    1 0xc0fa4000 6722c    acpi.ko
 5    1 0xc4b2f000 2000     rtc.ko
 6    1 0xc4b31000 21000    linux.ko

---

ps auxw

USER    PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
root     11 97.8  0.0     0     8  ??  RL    5:13PM   0:42.42 [idle: cpu0]
root      0  0.0  0.0     0     0  ??  WLs   5:13PM   0:00.00 [swapper]
root      1  0.0  0.0  1888   456  ??  ILs   5:13PM   0:00.01 /sbin/init --
root      2  0.0  0.0     0     8  ??  DL    5:13PM   0:00.01 [g_event]
root      3  0.0  0.0     0     8  ??  DL    5:13PM   0:00.02 [g_up]
root      4  0.0  0.0     0     8  ??  DL    5:13PM   0:00.03 [g_down]
root      5  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [kqueue taskq]
root      6  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [acpi_task_0]
root      7  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [acpi_task_1]
root      8  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [acpi_task_2]
root      9  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [thread taskq]
root     10  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [audit]
root     12  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [swi1: net]
root     13  0.0  0.0     0     8  ??  WL    5:13PM   0:00.16 [swi4: clock 
sio]
root     14  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [swi3: vm]
root     15  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [yarrow]
root     16  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [swi6: task 
queue]
root     17  0.0  0.0     0     8  ??  WL    5:13PM   0:00.01 [swi6: Giant 
taskq]
root     18  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [swi5: +]
root     19  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [xpt_thrd]
root     20  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [swi2: cambio]
root     21  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq9: acpi0]
root     22  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq16: 
fwohci0+]
root     23  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [usb0]
root     24  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [usbtask-hc]
root     25  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [usbtask-dr]
root     26  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq19: uhci1]
root     27  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [usb1]
root     28  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq18: uhci2]
root     29  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [usb2]
root     30  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq23: ehci0]
root     31  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [usb3]
root     32  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq21: pcm0 
em0]
root     33  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq22: fxp0]
root     34  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [fw0_taskq]
root     35  0.0  0.0     0     8  ??  IL    5:13PM   0:00.00 [fw0_probe]
root     36  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [em0 taskq]
root     37  0.0  0.0     0     8  ??  WL    5:13PM   0:00.01 [irq14: ata0]
root     38  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq15: ata1]
root     39  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [fdc0]
root     40  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [swi0: sio]
root     41  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq1: atkbd0]
root     42  0.0  0.0     0     8  ??  WL    5:13PM   0:00.00 [irq7: ppbus0 
ppc0]
root     43  0.0  0.0     0    16  ??  DL    5:13PM   0:00.00 [sctp_iterator]
root     44  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [pagedaemon]
root     45  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [vmdaemon]
root     46  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [idlepoll]
root     47  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [pagezero]
root     48  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [bufdaemon]
root     49  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [syncer]
root     50  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [vnlru]
root     51  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [softdepflush]
root     52  0.0  0.0     0     8  ??  DL    5:13PM   0:00.00 [schedcpu]
root    170  0.0  0.1  1324   752  ??  Is    5:13PM   0:00.00 adjkerntz -i
_dhcp   449  0.0  0.1  3072  1256  ??  Is    5:13PM   0:00.00 dhclient: em0 
(dhclient)
root    744  0.0  0.1  3208   996  ??  Is    5:13PM   
0:00.00 /usr/sbin/moused -p /dev/ums0 -t auto -I /var/run/moused.ums0.pid
root    802  0.0  0.1  1888   528  ??  Is    5:13PM   0:00.00 /sbin/devd
root    873  0.0  0.1  3124  1156  ??  Ss    5:13PM   
0:00.01 /usr/sbin/syslogd -s
root   1015  0.0  0.1  3152  1180  ??  Is    5:13PM   
0:00.00 /usr/sbin/cron -s
root   1078  0.0  0.1  3124  1036  v0  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv0
root   1079  0.0  0.1  3556  1528  v1  Is    5:13PM   0:00.02 login [pam] 
(login)
root   1086  0.0  0.2  4352  2092  v1  S     5:13PM   0:00.02 -bash (bash)
root   1092  0.0  0.1  3224  1020  v1  R+    5:13PM   0:00.00 ps auxw
root   1080  0.0  0.1  3124  1040  v2  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv2
root   1081  0.0  0.1  3124  1040  v3  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv3
root   1082  0.0  0.1  3124  1040  v4  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv4
root   1083  0.0  0.1  3124  1040  v5  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv5
root   1084  0.0  0.1  3124  1040  v6  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv6
root   1085  0.0  0.1  3124  1040  v7  Is+   5:13PM   
0:00.00 /usr/libexec/getty Pc ttyv7
root    429  0.0  0.1  3072  1152 con- I+    5:13PM   0:00.00 dhclient: em0 
[priv] (dhclient)
Comment 4 Volker 2008-05-23 23:16:50 UTC
Dmitry,

can you please send us a backtrace? Using the kgdb, fire a 'bt' command
and send us the output.

Thanks!
Comment 5 dima_bsd 2008-05-24 20:42:40 UTC
>Dmitry,
>
>can you please send us a backtrace? Using the kgdb, fire a 'bt' command
>and send us the output.
>
>Thanks!

Here it is.


===

Script started on Sat May 24 22:17:34 2008

[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# uname -a
FreeBSD hius.local.home 7.0-RELEASE-p1 FreeBSD 7.0-RELEASE-p1 #0: Sat May 24 
21:41:59 EEST 2008 root@hius.local.home:/usr/obj/usr/src/sys/GENERIC_COPY  
i386
[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# kgdb 
kernel.debug /var/crash/vmcore.9

[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: 
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
cpuid = 0
Uptime: 3m30s
Physical memory: 1007 MB
Dumping 62 MB: 47 31 15

#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
241		dumptid = curthread->td_tid;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
#1  0xc0852d7f in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc08531ad in panic (fmt=Could not find the frame base for "panic".
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc08bce07 in sbflush_internal (sb=0xc48c8cb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:815
#4  0xc08bce1a in sbflush_locked (sb=0xc48c8cb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:824
#5  0xc08bcebb in sbflush (sb=0xc48c8cb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:832
#6  0xc0a1d011 in tcp_disconnect (tp=0xc4bddcb0)
    at /usr/src/sys/netinet/tcp_usrreq.c:1491
#7  0xc0a1a902 in tcp_usr_disconnect (so=0xc48c8c60)
    at /usr/src/sys/netinet/tcp_usrreq.c:578
#8  0xc08bf5d1 in sodisconnect (so=0xc48c8c60)
    at /usr/src/sys/kern/uipc_socket.c:787
#9  0xc08bec08 in soclose (so=0xc48c8c60)
    at /usr/src/sys/kern/uipc_socket.c:642
#10 0xc08a083b in soo_close (fp=0xc481e360, td=0xc4977210)
    at /usr/src/sys/kern/sys_socket.c:274
#11 0xc0816377 in fo_close (fp=0xc481e360, td=0xc4977210) at file.h:297
#12 0xc081629c in fdrop_locked (fp=0xc481e360, td=0xc4977210)
    at /usr/src/sys/kern/kern_descrip.c:2175
#13 0xc0816153 in fdrop (fp=0xc481e360, td=0xc4977210)
    at /usr/src/sys/kern/kern_descrip.c:2140
#14 0xc08158e2 in closef (fp=0xc481e360, td=0xc4977210)
    at /usr/src/sys/kern/kern_descrip.c:1958
#15 0xc0812d15 in kern_close (td=0xc4977210, fd=8)
    at /usr/src/sys/kern/kern_descrip.c:1054
#16 0xc0812b82 in close (td=0xc4977210, uap=0xe6cb1ccc)
    at /usr/src/sys/kern/kern_descrip.c:1006
#17 0xc0c4b3d4 in syscall (frame=0xe6cb1d38)
    at /usr/src/sys/i386/i386/trap.c:1035
#18 0xc0c29340 in Xint0x80_syscall ()
    at /usr/src/sys/i386/i386/exception.s:196
#19 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) 
(kgdb) quit
[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# exit
exit

Script done on Sat May 24 22:19:18 2008

===

#cat /var/crash/info.9
Dump header from device /dev/ad0s2b
  Architecture: i386
  Architecture Version: 2
  Dump Length: 65564672B (62 MB)
  Blocksize: 512
  Dumptime: Sat May 24 22:12:53 2008
  Hostname: hius.local.home
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 7.0-RELEASE-p1 #0: Sat May 24 21:41:59 EEST 2008
    terminus@hius.local.home:/usr/obj/usr/src/sys/GENERIC_COPY
  Panic String: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
  Dump Parity: 4246574967
  Bounds: 9
  Dump Status: good

===
Comment 6 Volker 2008-05-24 23:35:02 UTC
Dmitry,

I've just seen, you've enabled DEVICE_POLLING in kernel config. Can you
please try to remove that option and instead use `ifconfig em0 polling'?

The use of 'option DEVICE_POLLING' is deprecated.

Does that make your box not panicing?

Thanks!

Volker
Comment 7 dima_bsd 2008-05-25 08:58:34 UTC
>Dmitry,
>
>I've just seen, you've enabled DEVICE_POLLING in kernel config. Can you
>please try to remove that option and instead use `ifconfig em0 polling'?
>
>The use of 'option DEVICE_POLLING' is deprecated.
>
>Does that make your box not panicing?
>
>Thanks!
>
>Volker

Sorry, it did not works at all. Then option DEVICE_POLLING is removed from the 
kernel, I'm unabled to start polling mode. 

# ifconfig em0
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
	ether 00:20:ed:11:11:11
	inet 7.8.2.5 netmask 0xffffe000 broadcast 255.255.255.255
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active

# ifconfig em0 polling

# ifconfig em0
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
	ether 00:20:ed:11:11:11
	inet 7.8.2.5 netmask 0xffffe000 broadcast 255.255.255.255
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active

# sysctl -a | grep pol
kern.dcons.poll_hz: 100
kern.sched.topology: 0
debug.acpi.ec.polled: 0
Comment 8 Volker 2008-05-25 21:12:38 UTC
Dmitry,

On 05/25/08 09:58, Dmitry Demidov wrote:
>> Dmitry,
>>
>> I've just seen, you've enabled DEVICE_POLLING in kernel config. Can you
>> please try to remove that option and instead use `ifconfig em0 polling'?
>>
>> The use of 'option DEVICE_POLLING' is deprecated.

ouch... did I really write something that stupid? I took notice while
reading your reply.

Of course, you need to have DEVICE_POLLING in kernel, but the use of
sysctl kern.polling.enable is deprecated.

> 
> Sorry, it did not works at all. Then option DEVICE_POLLING is removed from the 
> kernel, I'm unabled to start polling mode. 
> 
> # ifconfig em0
> em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
> 	options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
> 	ether 00:20:ed:11:11:11
> 	inet 7.8.2.5 netmask 0xffffe000 broadcast 255.255.255.255
> 	media: Ethernet autoselect (100baseTX <full-duplex>)
> 	status: active
> 
> # ifconfig em0 polling
> 
> # ifconfig em0
> em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
> 	options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
> 	ether 00:20:ed:11:11:11
> 	inet 7.8.2.5 netmask 0xffffe000 broadcast 255.255.255.255
> 	media: Ethernet autoselect (100baseTX <full-duplex>)
> 	status: active
> 
> # sysctl -a | grep pol
> kern.dcons.poll_hz: 100
> kern.sched.topology: 0
> debug.acpi.ec.polled: 0
> 

Clearly because of my wrong hint. Please try the following:

include DEVICE_POLLING in your kernel config
make sure, you don't use kern.polling.enable
enable polling for your em0 device by using `ifconfig em0 polling'.

Can you please try that?

Sorry for my misinformation. Working on too much things in parallel.

Volker
Comment 9 dima_bsd 2008-05-26 20:37:46 UTC
>Please try the following:
>
>include DEVICE_POLLING in your kernel config
>make sure, you don't use kern.polling.enable
>enable polling for your em0 device by using `ifconfig em0 polling'.
>
>Can you please try that?
>
>Sorry for my misinformation. Working on too much things in parallel.

It's ok ;) 

>
>Volker

I have recompilled the kernel with POLLING and HZ options, and done the tests 
again. So, the results is:

1) if polling mode are enabled using 'ifconfig em0 polling'

Script started on Mon May 26 20:59:50 2008

[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# kgdb kernel.debug /us      
var/crash/vmcore.10
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: 
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
cpuid = 0
Uptime: 4m32s
Physical memory: 1007 MB
Dumping 62 MB: 47 31 15

#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
241		dumptid = curthread->td_tid;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
#1  0xc0852d7f in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc08531ad in panic (fmt=Could not find the frame base for "panic".
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc08bce07 in sbflush_internal (sb=0xc48cbcb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:815
#4  0xc08bce1a in sbflush_locked (sb=0xc48cbcb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:824
#5  0xc08bcebb in sbflush (sb=0xc48cbcb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:832
#6  0xc0a1d011 in tcp_disconnect (tp=0xc4be1000)
    at /usr/src/sys/netinet/tcp_usrreq.c:1491
#7  0xc0a1a902 in tcp_usr_disconnect (so=0xc48cbc60)
    at /usr/src/sys/netinet/tcp_usrreq.c:578
#8  0xc08bf5d1 in sodisconnect (so=0xc48cbc60)
    at /usr/src/sys/kern/uipc_socket.c:787
#9  0xc08bec08 in soclose (so=0xc48cbc60)
    at /usr/src/sys/kern/uipc_socket.c:642
#10 0xc08a083b in soo_close (fp=0xc481fe10, td=0xc4977630)
    at /usr/src/sys/kern/sys_socket.c:274
#11 0xc0816377 in fo_close (fp=0xc481fe10, td=0xc4977630) at file.h:297
#12 0xc081629c in fdrop_locked (fp=0xc481fe10, td=0xc4977630)
    at /usr/src/sys/kern/kern_descrip.c:2175
#13 0xc0816153 in fdrop (fp=0xc481fe10, td=0xc4977630)
    at /usr/src/sys/kern/kern_descrip.c:2140
#14 0xc08158e2 in closef (fp=0xc481fe10, td=0xc4977630)
    at /usr/src/sys/kern/kern_descrip.c:1958
#15 0xc0812d15 in kern_close (td=0xc4977630, fd=8)
    at /usr/src/sys/kern/kern_descrip.c:1054
#16 0xc0812b82 in close (td=0xc4977630, uap=0xe6cabccc)
    at /usr/src/sys/kern/kern_descrip.c:1006
#17 0xc0c4b3d4 in syscall (frame=0xe6cabd38)
    at /usr/src/sys/i386/i386/trap.c:1035
#18 0xc0c29340 in Xint0x80_syscall ()
    at /usr/src/sys/i386/i386/exception.s:196
#19 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) quit
[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# exit
exit

Script done on Mon May 26 21:00:46 2008

=============

2) if polling mode are enabled using '/etc/sysctl.conf kern.polling.enable=1'

Script started on Mon May 26 21:10:15 2008
[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# kgdb 
kernel.debug /var/crash/vmcore.11
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: 
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: sbflush_internal: cc 4294967230 || mb 0 || mbcnt 0
cpuid = 0
Uptime: 3m17s
Physical memory: 1007 MB
Dumping 62 MB: 47 31 15

#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
241		dumptid = curthread->td_tid;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:241
#1  0xc0852d7f in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc08531ad in panic (fmt=Could not find the frame base for "panic".
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc08bce07 in sbflush_internal (sb=0xc48c8cb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:815
#4  0xc08bce1a in sbflush_locked (sb=0xc48c8cb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:824
#5  0xc08bcebb in sbflush (sb=0xc48c8cb0)
    at /usr/src/sys/kern/uipc_sockbuf.c:832
#6  0xc0a1d011 in tcp_disconnect (tp=0xc4c11000)
    at /usr/src/sys/netinet/tcp_usrreq.c:1491
#7  0xc0a1a902 in tcp_usr_disconnect (so=0xc48c8c60)
    at /usr/src/sys/netinet/tcp_usrreq.c:578
#8  0xc08bf5d1 in sodisconnect (so=0xc48c8c60)
    at /usr/src/sys/kern/uipc_socket.c:787
#9  0xc08bec08 in soclose (so=0xc48c8c60)
    at /usr/src/sys/kern/uipc_socket.c:642
#10 0xc08a083b in soo_close (fp=0xc481fe10, td=0xc4977000)
    at /usr/src/sys/kern/sys_socket.c:274
#11 0xc0816377 in fo_close (fp=0xc481fe10, td=0xc4977000) at file.h:297
#12 0xc081629c in fdrop_locked (fp=0xc481fe10, td=0xc4977000)
    at /usr/src/sys/kern/kern_descrip.c:2175
#13 0xc0816153 in fdrop (fp=0xc481fe10, td=0xc4977000)
    at /usr/src/sys/kern/kern_descrip.c:2140
#14 0xc08158e2 in closef (fp=0xc481fe10, td=0xc4977000)
    at /usr/src/sys/kern/kern_descrip.c:1958
#15 0xc0812d15 in kern_close (td=0xc4977000, fd=8)
    at /usr/src/sys/kern/kern_descrip.c:1054
#16 0xc0812b82 in close (td=0xc4977000, uap=0xe6c9fccc)
    at /usr/src/sys/kern/kern_descrip.c:1006
#17 0xc0c4b3d4 in syscall (frame=0xe6c9fd38)
    at /usr/src/sys/i386/i386/trap.c:1035
#18 0xc0c29340 in Xint0x80_syscall ()
    at /usr/src/sys/i386/i386/exception.s:196
#19 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) qy   uit
[root@hius /usr/obj/usr/src/sys/GENERIC_COPY]# exit
exit

Script done on Mon May 26 21:11:04 2008

============

So, there is no difference in the way how polling are enabled - result is 
always the same...

I just note, that em0 and pcm0 shares the same virtual IRQ in my system.
pcm0: <Creative EMU10K1> port 0x9000-0x901f irq 21 at device 1.0 on pci2
em0: <Intel(R) PRO/1000 Network Connection Version - 6.7.3> port 0xa000-0xa03f 
mem 0xdb100000-0xdb11ffff irq 21 at device 9.0 on pci2

So I repluged soundcard into another PCI slot on motherboard. The result is:

# dmesg | grep em0
em0: <Intel(R) PRO/1000 Network Connection Version - 6.7.3> port 0xa000-0xa03f 
mem 0xdb100000-0xdb11ffff irq 21 at device 9.0 on pci2
em0: Ethernet address: 00:20:ed:11:11:11
em0: [FILTER]
# dmesg | grep pcm0
pcm0: <Creative EMU10K1> port 0x9400-0x941f irq 16 at device 3.0 on pci2
pcm0: <TriTech TR28602 AC97 Codec>
pcm0: [ITHREAD]

And no panics any more!


Anyway, if FreeBSD team is interested to solve this bug, I will be happy to 
take part. It is not critical for me - this box is my home system used just 
as KDE desktop/test system.
Before I installed 7.0 RELEASE (it was a clean install - not upgrade), I been 
using 6.2 RELEASE of Beastie, that did not have that panics (same hardware 
config + polling mode + audio + internet).

Thanks Volker!
Comment 10 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 08:01:11 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped