"panic: Duplicate alloc" in dwmmc_attach on Rock64

[Peter Jeremy]

Since r349169, my Rock64 has consistently panic'd whilst attaching
rockchip_dwmmc1.  A kernel built at r349135 works OK.  The relevant
output looks like:
rockchip_dwmmc0: <Synopsys DesignWare Mobile Storage Host Controller (RockChip)> mem 0xff500000-0xff503fff irq 40 on ofwbus0
rockchip_dwmmc0: Hardware version ID is 270a
mmc0: <MMC/SD bus> on rockchip_dwmmc0
rockchip_dwmmc1: <Synopsys DesignWare Mobile Storage Host Controller (RockChip)> mem 0xff520000-0xff523fff irq 42 on ofwbus0
rockchip_dwmmc1: Hardware version ID is 270a
panic: Duplicate alloc of 0xfffffd000089cf50 from zone 0xfffffd0000817540(16) slab 0xfffffd000089cf90(0)

cpuid = 0
time = 1
KDB: stack backtrace:
db_trace_self() at db_trace_self_wrapper+0x28
         pc = 0xffff000000535d54  lr = 0xffff0000000df10c
         sp = 0xffff0000000104d0  fp = 0xffff0000000106e0

db_trace_self_wrapper() at vpanic+0x18c
         pc = 0xffff0000000df10c  lr = 0xffff000000278218
         sp = 0xffff0000000106f0  fp = 0xffff000000010790

vpanic() at panic+0x44
         pc = 0xffff000000278218  lr = 0xffff000000277fc8
         sp = 0xffff0000000107a0  fp = 0xffff000000010820

panic() at uma_dbg_alloc+0x144
         pc = 0xffff000000277fc8  lr = 0xffff0000004fa4b0
         sp = 0xffff000000010830  fp = 0xffff000000010850

uma_dbg_alloc() at uma_zalloc_arg+0x9b0
         pc = 0xffff0000004fa4b0  lr = 0xffff0000004f9960
         sp = 0xffff000000010860  fp = 0xffff0000000108e0

uma_zalloc_arg() at malloc+0x9c
         pc = 0xffff0000004f9960  lr = 0xffff000000252a8c
         sp = 0xffff0000000108f0  fp = 0xffff000000010920

malloc() at bounce_bus_dmamem_alloc+0x4c
         pc = 0xffff000000252a8c  lr = 0xffff000000533b64
         sp = 0xffff000000010930  fp = 0xffff000000010960

bounce_bus_dmamem_alloc() at dwmmc_attach+0x5fc
         pc = 0xffff000000533b64  lr = 0xffff000000556f14
         sp = 0xffff000000010970  fp = 0xffff0000000109e0

dwmmc_attach() at device_attach+0x3f4
         pc = 0xffff000000556f14  lr = 0xffff0000002abd8c
         sp = 0xffff0000000109f0  fp = 0xffff000000010a40

device_attach() at bus_generic_new_pass+0x12c
         pc = 0xffff0000002abd8c  lr = 0xffff0000002adb40
         sp = 0xffff000000010a50  fp = 0xffff000000010a80
...

I've looked through all the intervening commits and don't see any
smoking gun.  Does anyone have any suggestions?

-- 
Peter Jeremy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-arm/attachments/20190621/563d09c2/attachment.sig>