kern/42113: boot time panic in audio_calcwater with hdaudio

[List Mail User <track%Plectere.com@localhost>]

>Number:         42113
>Category:       kern
>Synopsis:       null pointer dereference in audio_calcwater if using hdaudio
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 23 04:25:00 +0000 2009
>Originator:     Paul Shupak
>Release:        NetBSD 5.99.18
>Organization:
        
>Environment:
        
        
System: NetBSD 5.99.18 (GENERIC) #2: Sun Sep 20 09:46:18 PDT 2009
Architecture: amd64
Machine: amd64
>Description:
        
        Machines which happily ran using the azalia driver now panic
when audio0 is attached - the "play" stream is NULL (%rax at the panic)

        ten finger copy from DDB (sorry, no coredump):
        audio_calcwater() + 0xb
        audiosetinfo() + 0x4d1
        audio_set_defaults() + 0xdd
        audioattach() + 0x226
        config_attach_loc() + 0x16b
        audio_attach_mi() + 0x32
        hdaudio_afg_attach() + 0x10db
        config_attach_loc() + 0x16b
        hdaudio_attach_fg() + 0xce
        hdaudio_attach() + 0x61d
        hdaudio_pci_attach() + 0x61d
        config_attach_loc() + 0x16b
        ...

        NOTE: obviously _not_ an actual "GENERIC" kernel

        dmesg fragment from 5.99.15:
        ...
azalia0: codec[0]: 0x1106/0x4397 (rev. 0.0), HDA rev. 1.0
audio0 at azalia0: full duplex, independent
        ...

        panic fragment (same kernal as below):
        ...
hdafg0: ADC1:13, Analog Line In: Jack (Blue, 1B)
hdafg0: configuring encodings
hdafg0: 2ch/2ch 48000Hz
hdafg0: reserving streams
hdafg0: connecting streams
hdafg0: attaching audio device
audio0 at hdafg0: full duplex, independent
uvm_fault(0xffffffff80b57760, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff80185449 cs 8 rflags 10287 cr2  10 cpl 8 rsp 
ffffffff80d0be80
uvm_fault(0xffffffff80b57760, 0x0, 1) -> e
fatal page fault in supervisor mode
        ...

        full dmesg with "boot -c" & "disable audio*" from -current/5.99.18:

NetBSD 5.99.18 (GENERIC) #2: Sun Sep 20 09:46:18 PDT 2009
        root@nepal:/space/obj-dirs/sys/arch/amd64/compile/GENERIC
total memory = 2039 MB
avail memory = 1961 MB
timecounter: Timecounters tick every 10.000 msec
userconf: configure system autoconfiguration:
uc> disable audio*
[  0] audio* disabled
uc> quit
Continuing...
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
System manufacturer System Product Name (Rev 1.xx)
mainbus0 (root)
pci_addr_fixup: 000:31:1 0x8086 0x27df new address 0x00005800
pci_addr_fixup: 000:31:1 0x8086 0x27df new address 0x00005808
pci_addr_fixup: 000:31:1 0x8086 0x27df new address 0x00005810
pci_addr_fixup: 000:31:1 0x8086 0x27df new address 0x0000580c
cpu0 at mainbus0 apid 0: Intel 686-class, 1600MHz, id 0x106c2
cpu1 at mainbus0 apid 2: Intel 686-class, 1600MHz, id 0x106c2
cpu2 at mainbus0 apid 1: Intel 686-class, 1600MHz, id 0x106c2
cpu3 at mainbus0 apid 3: Intel 686-class, 1600MHz, id 0x106c2
ioapic0 at mainbus0 apid 4: pa 0xfec00000, version 20, 24 pins
acpi0 at mainbus0: Intel ACPICA 20090730
acpi0: X/RSDT: OemId <A_M_I_,OEMXSDT ,07000906>, AslId <MSFT,00000097>
acpi0: SCI interrupting at int 9
acpi0: fixed-feature power button present
timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000
ACPI-Fast 24-bit timer
attimer0 at acpi0 (TMR, PNP0100): io 0x40-0x43 irq 0
pcppi0 at acpi0 (SPKR, PNP0800): io 0x61
midi0 at pcppi0: PC speaker
sysbeep0 at pcppi0
aiboost0 at acpi0 (ASOC, ATK0110-16843024)
aiboost0: ASUS AI Boost Hardware monitor
hpet0 at acpi0 (HPET, PNP0103): mem 0xfed00000-0xfed003ff
timecounter: Timecounter "hpet0" frequency 14318179 Hz quality 2000
pckbc1 at acpi0 (PS2K, PNP0303) (kbd port): io 0x60,0x64 irq 1
pckbc2 at acpi0 (PS2M, PNP0F03) (aux port): irq 12
com0 at acpi0 (UAR1, PNP0501-1): io 0x3f8-0x3ff irq 4
com0: ns16550a, working fifo
lpt1 at acpi0 (LPTE, PNP0401): io 0x378-0x37f,0x778-0x77f irq 7 drq 3
FWH (INT0800) [Intel FWH Random Number Generator] at acpi0 not configured
acpibut0 at acpi0 (PWRB, PNP0C0C-170): ACPI Power Button
attimer0: attached to pcppi0
pckbd0 at pckbc1 (kbd slot)
pckbc1: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc1 (aux slot)
pckbc1: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0: Intel 82945G/P Memory Controller Hub (rev. 0x02)
agp0 at pchb0: detected 7932k stolen memory
agp0: aperture at 0xd0000000, size 0x10000000
vga0 at pci0 dev 2 function 0: Intel 82945G/P Integrated Graphics Device (rev. 
0x02)
wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
i915drm0 at vga0: Intel i945G
i915drm0: AGP at 0xd0000000 256MB
i915drm0: Initialized i915 1.6.0 20080730
hdaudio0 at pci0 dev 27 function 0: HD Audio Controller
hdaudio0: interrupting at ioapic0 pin 19
hdaudio0: High Definition Audio version 1.0
hdaudio0: OSS 4 ISS 4 BSS 0 SDO 0 64-bit
hdaudio0: using 1024 byte CORB (cap 4)
hdaudio0: using 2048 byte RIRB (cap 4)
hdaudio0: Codec00: 1106:4397 HDA 1.0 rev 0 stepping 0
hdafg0 at hdaudio0 vendor 0x1106 product 0x4397 nid 0x01 (firmware 
configuration)
hdafg0: parsing widgets
hdafg0: afg start 10 end 28 nwidgets 24
hdafg0: powering up widgets
hdafg0: afg widgets 0xffff800048573008-0xffff800048574a48
hdafg0: parsing controls
hdafg0: disabling non-audio devices
hdafg0: disabling useless devices
hdafg0: parsing associations
hdafg0:   count present associations
hdafg0:   maxassocs 2
hdafg0:   allocating memory
hdafg0:   scan associations, skipping as=0
hdafg0:   all done
hdafg0: building tree
hdafg0: disabling unassociated pins
hdafg0: disabling unselected pins
hdafg0: disabling useless devices
hdafg0: disabling cross-associated pins
hdafg0: disabling useless devices
hdafg0: assigning mixer names to sound sources
hdafg0: assigning mixers to device tree
hdafg0: preparing pin controls
hdafg0: commiting settings
hdafg0: setup jack sensing
hdafg0: building mixer controls
hdafg0: DAC0:10, Analog Speaker: Jack (Green, 1C)
hdafg0: DAC0:10, Analog HP Out: Jack (Green, 1D)
hdafg0: ADC1:13, Analog Mic In: Jack (Pink, 1A)
hdafg0: ADC1:13, Analog CD: Fixed Function (Unknown, 1F)
hdafg0: ADC1:13, Analog Mic In: Jack (Pink, 1E)
hdafg0: ADC1:13, Analog Line In: Jack (Blue, 1B)
hdafg0: configuring encodings
hdafg0: 2ch/2ch 48000Hz
hdafg0: reserving streams
hdafg0: connecting streams
hdafg0: attaching audio device
audio at hdafg0 not configured
ppb0 at pci0 dev 28 function 0: Intel 82801GB/GR PCI Express Port #1 (rev. 0x01)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled, rd/line, wr/inv ok
ppb1 at pci0 dev 28 function 1: Intel 82801GB/GR PCI Express Port #2 (rev. 0x01)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled, rd/line, wr/inv ok
re0 at pci2 dev 0 function 0: RealTek 8168/8111 PCIe Gigabit Ethernet (rev. 
0x01)
re0: interrupting at ioapic0 pin 17
re0: Ethernet address 00:26:18:xx:xx:xx
re0: using 256 tx descriptors
rgephy0 at re0 phy 7: RTL8169S/8110S/8211 1000BASE-T media interface, rev. 2
rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 
1000baseT-FDX, auto
uhci0 at pci0 dev 29 function 0: Intel 82801GB/GR USB UHCI Controller (rev. 
0x01)
uhci0: interrupting at ioapic0 pin 20
usb0 at uhci0: USB revision 1.0
uhci1 at pci0 dev 29 function 1: Intel 82801GB/GR USB UHCI Controller (rev. 
0x01)
uhci1: interrupting at ioapic0 pin 17
usb1 at uhci1: USB revision 1.0
uhci2 at pci0 dev 29 function 2: Intel 82801GB/GR USB UHCI Controller (rev. 
0x01)
uhci2: interrupting at ioapic0 pin 18
usb2 at uhci2: USB revision 1.0
uhci3 at pci0 dev 29 function 3: Intel 82801GB/GR USB UHCI Controller (rev. 
0x01)
uhci3: interrupting at ioapic0 pin 19
usb3 at uhci3: USB revision 1.0
ehci0 at pci0 dev 29 function 7: Intel 82801GB/GR USB EHCI Controller (rev. 
0x01)
ehci0: interrupting at ioapic0 pin 20
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: uhci0 uhci1 uhci2 uhci3
usb4 at ehci0: USB revision 2.0
ppb2 at pci0 dev 30 function 0: Intel 82801BA Hub-PCI Bridge (rev. 0xe1)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled
ichlpcib0 at pci0 dev 31 function 0: Intel 82801GB/GR LPC Interface Bridge 
(rev. 0x01)
timecounter: Timecounter "ichlpcib0" frequency 3579545 Hz quality 1000
ichlpcib0: 24-bit timer
ichlpcib0: TCO (watchdog) timer configured.
ichlpcib0: HPET window not mapped, skipping
piixide0 at pci0 dev 31 function 1: Intel 82801GB/GR IDE Controller (ICH7) 
(rev. 0x01)
piixide0: bus-master DMA support present
piixide0: primary channel configured to compatibility mode
piixide0: primary channel interrupting at ioapic0 pin 14
atabus0 at piixide0 channel 0
piixide0: secondary channel configured to compatibility mode
piixide0: secondary channel interrupting at ioapic0 pin 15
atabus1 at piixide0 channel 1
piixide1 at pci0 dev 31 function 2: Intel 82801GB/GR Serial ATA/Raid Controller 
(ICH7) (rev. 0x01)
piixide1: bus-master DMA support present
piixide1: primary channel configured to native-PCI mode
piixide1: using ioapic0 pin 23 for native-PCI interrupt
atabus2 at piixide1 channel 0
piixide1: secondary channel configured to native-PCI mode
atabus3 at piixide1 channel 1
ichsmb0 at pci0 dev 31 function 3: Intel 82801GB/GR SMBus Controller (rev. 0x01)
ichsmb0: interrupting at ioapic0 pin 23
iic0 at ichsmb0: I2C bus
spdmem0 at iic0 addr 0x50
spdmem0: DDR2 SDRAM, no parity or ECC, 2GB, 800MHz (PC2-6400)
spdmem0: 14 rows, 10 cols, 2 ranks, 8 banks/chip, 2.50ns cycle time
spdmem0: tAA-tRCD-tRP-tRAS: 5-5-5-18
spdmem0: voltage SSTL 1.8V, refresh time 7.8us (self-refreshing)
isa0 at ichlpcib0
itesio0 at isa0 port 0x2e-0x2f: iTE IT8718F Super I/O (rev 4)
itesio0: Hardware Monitor registers at 0x290
itesio0: Watchdog Timer present
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
uhub0 at usb0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub1 at usb1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub2 at usb2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhub3 at usb3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
uhub4 at usb4: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub4: 8 ports with 8 removable, self powered
IPsec: Initialized Security Association Processing.
umass0 at uhub4 port 3 configuration 1 interface 0: ADS Technologies USB2.0 
Drive Kit, rev 2.00/0.01, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
cd0 at scsibus0 target 0 lun 0: <LITE-ON, DVDRW SOHW-1633S, BS0A> cdrom 
removable
wd0 at atabus2 drive 0: <ST3500630AS>
wd0: quirks 0x2<FORCE_LBA48>
wd0: drive supports 16-sector PIO transfers, LBA48 addressing
wd0: 465 GB, 969021 cyl, 16 head, 63 sec, 512 bytes/sect x 976773168 sectors
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 6 (Ultra/133)
wd0(piixide1:0:0): using PIO mode 4, Ultra-DMA mode 6 (Ultra/133) (using DMA)
Kernelized RAIDframe activated
pad0: outputs: 44100Hz, 16-bit, stereo
audio at pad0 not configured
boot device: wd0
root on wd0a dumps on wd0b
mountroot: trying smbfs...
mountroot: trying ntfs...
mountroot: trying nfs...
mountroot: trying msdos...
mountroot: trying lfs...
mountroot: trying ext2fs...
mountroot: trying ffs...
root file system type: ffs
init: copying out path `/sbin/init' 11
wsdisplay0: screen 1 added (80x25, vt100 emulation)
wsdisplay0: screen 2 added (80x25, vt100 emulation)
wsdisplay0: screen 3 added (80x25, vt100 emulation)
wsdisplay0: screen 4 added (80x25, vt100 emulation)

>How-To-Repeat:
        Boot an Asus AT3GC-I with the hdaudio driver.  NOTE:  These
machines are all configured (i.e. BIOS) and wired for HDA mode, not AC '97.
>Fix:
        Workaround: disable audio in the BIOS, disable w/ "boot -c" or
build custom kernels without hdaudio and use the older azalia driver.