NetBSD Problem Report #41957

From www@NetBSD.org  Sat Aug 29 15:44:35 2009
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 4FF1F63B121
	for <gnats-bugs@gnats.netbsd.org>; Sat, 29 Aug 2009 15:44:35 +0000 (UTC)
Message-Id: <20090829154402.D843A63B121@www.NetBSD.org>
Date: Sat, 29 Aug 2009 15:44:02 +0000 (UTC)
From: xbarken@googlemail.com
Reply-To: xbarken@googlemail.com
To: gnats-bugs@NetBSD.org
Subject: hdaudio failure: (was: azalia crashes during boot)
X-Send-Pr-Version: www-1.0

>Number:         41957
>Category:       kern
>Synopsis:       hdaudio failure (was: azalia crashes during boot)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 29 15:45:00 +0000 2009
>Closed-Date:    
>Last-Modified:  Sun Nov 13 18:02:21 +0000 2011
>Originator:     Björn Barkenfelt
>Release:        5.0.1
>Organization:
>Environment:
NetBSD titan 5.0.1 NetBSD 5.0.1 (TITAN) #1: Sat Aug 22 01:03:01 CEST 2009  barken@titan:/home/barken/code/netbsd/src/sys/arch/amd64/compile/obj/TITAN amd64
>Description:
The generic kernel crashed upon boot on my system. The azalia driver generates a uvm_fault during boot.
The problem lies in azalia_codec.c where an initialization of a pointer is made before a realloc(). A fix for 5.0.1 release is included, which solves the problem for me. 

/ Björn


>How-To-Repeat:
Difficult to say, I guess a realloc() in the mixer init code is necessary only on some systems/combinations of hardware. On a lot of other systems, the code might work, possible because realloc() not always moves the memory block.
On my system, I can repeat the problem just by booting with the GENERIC kernel.
>Fix:
Apply the following patch to /usr/src/sys/dec/pci/azalia_codec.c

3166c3166
<       mixer_item_t *m = NULL;
---
>       mixer_item_t *m, *mdac = NULL;
3168c3168
<       int err, i, imdac;
---
>       int err, i;
3181c3181
<       for (i = 0, imdac = -1; i < this->nmixers; i++)
---
>       for (i = 0; i < this->nmixers; i++)
3183,3189c3183
<                       /*  
<                       *  Rememer at which index we found the mdac. 
<                       *  Setting a pointer is dangerous at this point
<                       *  due to a possile realloc() further below
<                       *  in generic_mixer_ensure_capacity().
<                       */
<                       imdac = i;
---
>                       mdac = &this->mixers[i];
3192,3193c3186
< 
<       if (imdac >= 0 ) {
---
>       if (mdac) {
3204,3205c3197
< 
<               memcpy(m, &this->mixers[imdac], sizeof(*m));
---
>  

>Release-Note:

>Audit-Trail:
From: David Holland <dholland-bugs@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/41957: azalia crashes during boot - uvm_fault
Date: Mon, 7 Sep 2009 06:46:41 +0000

 On Sat, Aug 29, 2009 at 03:45:00PM +0000, xbarken@googlemail.com wrote:
  > The generic kernel crashed upon boot on my system. The azalia
  > driver generates a uvm_fault during boot.
  >
  > The problem lies in azalia_codec.c where an initialization of a
  > pointer is made before a realloc(). A fix for 5.0.1 release is
  > included, which solves the problem for me.
  > 3166c3166
  >
  > <       mixer_item_t *m = NULL;
  > ---
  > >       mixer_item_t *m, *mdac = NULL;

 Could you regenerate this patch using diff -up? (And make sure you do
 "diff old new"; I think this patch is reversed.)

 -- 
 David A. Holland
 dholland@netbsd.org

From: "=?ISO-8859-1?Q?Bj=F6rn?= Barkenfelt" <xbarken@googlemail.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/41957: azalia crashes during boot - uvm_fault
Date: Tue, 08 Sep 2009 21:43:31 +0200

 --=-xKVBYYeeMbB0qjLojA9m
 Content-Type: text/plain; charset="ISO-8859-1"
 Content-Transfer-Encoding: 8bit

 On Mon, 2009-09-07 at 06:50 +0000, David Holland wrote:
 > The following reply was made to PR kern/41957; it has been noted by GNATS.
 > 
 > From: David Holland <dholland-bugs@netbsd.org>
 > To: gnats-bugs@NetBSD.org
 > Cc: 
 > Subject: Re: kern/41957: azalia crashes during boot - uvm_fault
 > Date: Mon, 7 Sep 2009 06:46:41 +0000
 > 
 >  On Sat, Aug 29, 2009 at 03:45:00PM +0000, xbarken@googlemail.com wrote:
 >   > The generic kernel crashed upon boot on my system. The azalia
 >   > driver generates a uvm_fault during boot.
 >   >
 >   > The problem lies in azalia_codec.c where an initialization of a
 >   > pointer is made before a realloc(). A fix for 5.0.1 release is
 >   > included, which solves the problem for me.
 >   > 3166c3166
 >   >
 >   > <       mixer_item_t *m = NULL;
 >   > ---
 >   > >       mixer_item_t *m, *mdac = NULL;
 >  
 >  Could you regenerate this patch using diff -up? (And make sure you do
 >  "diff old new"; I think this patch is reversed.)

 Ok, a new diff is attached.

 / Björn

 --=-xKVBYYeeMbB0qjLojA9m
 Content-Disposition: attachment; filename="azalia_codec.c.diff"
 Content-Type: text/x-patch; name="azalia_codec.c.diff"; charset="us-ascii"
 Content-Transfer-Encoding: 7bit

 --- /usr/src/sys/dev/pci/azalia_codec.c	2009-08-09 20:27:57.000000000 +0200
 +++ azalia_codec.c	2009-08-29 17:35:13.000000000 +0200
 @@ -3163,9 +3163,9 @@ alc888_init_widget(const codec_t *this, 
  static int
  alc888_mixer_init(codec_t *this)
  {
 -	mixer_item_t *m, *mdac = NULL;
 +	mixer_item_t *m = NULL;
  	mixer_devinfo_t *d;
 -	int err, i;
 +	int err, i, imdac;

  	err = generic_mixer_init(this);
  	if (err)
 @@ -3178,12 +3178,19 @@ alc888_mixer_init(codec_t *this)
  	}

  	/* We're looking for front l/r mixer, which we know is nid 0x0c */
 -	for (i = 0; i < this->nmixers; i++)
 +	for (i = 0, imdac = -1; i < this->nmixers; i++)
  		if (this->mixers[i].nid == 0x0c) {
 -			mdac = &this->mixers[i];
 +			/*  
 +			*  Rememer at which index we found the mdac. 
 +			*  Setting a pointer is dangerous at this point
 +			*  due to a possile realloc() further below
 +			*  in generic_mixer_ensure_capacity().
 +			*/
 +			imdac = i;
  			break;
  		}
 -	if (mdac) {
 +
 +	if (imdac >= 0 ) {
  		/*
  		 * ALC888 doesn't have a master mixer, so create a fake
  		 * inputs.dac that mirrors outputs.master
 @@ -3194,7 +3201,8 @@ alc888_mixer_init(codec_t *this)

  		m = &this->mixers[this->nmixers];
  		d = &m->devinfo;
 -		memcpy(m, mdac, sizeof(*m));
 +		
 +		memcpy(m, &this->mixers[imdac], sizeof(*m));
  		d->mixer_class = AZ_CLASS_INPUT;
  		snprintf(d->label.name, sizeof(d->label.name), AudioNdac);
  		this->nmixers++;

 --=-xKVBYYeeMbB0qjLojA9m--

State-Changed-From-To: open->feedback
State-Changed-By: jmcneill@NetBSD.org
State-Changed-When: Thu, 08 Oct 2009 10:39:19 +0000
State-Changed-Why:
Does the new hdaudio(4) driver in NetBSD 5.0_STABLE work better for you?


From: "=?ISO-8859-1?Q?Bj=F6rn?= Barkenfelt" <xbarken@googlemail.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/41957 (azalia crashes during boot - uvm_fault)
Date: Mon, 19 Oct 2009 12:43:42 +0200

 Finally got time to test the hdaudio driver:

 First impressions:
 After boot, basic audio output works.
 Audio recording is functional as well (I didn't get recording to work
 with the azalia driver), but the recorded audio has a reduced
 sound-pitch which makes it unusable. 

 Upon boot the driver floods the dmesg buffer with the following message:

 hdaudio1: RIRB timeout
 unknown at hdaudio1 vendor 0xFFFF product 0xFFFF nid 0x7B not configured
 ......
 (repeats numerous times, until nid == 0xFF I guess)
 hdaudio1: RIRB timeout
 unknown at hdaudio1 vendor 0xFFFF product 0xFFFF nid 0xFD not configured


 / Björn


 On Thu, 2009-10-08 at 10:39 +0000, jmcneill@NetBSD.org wrote:
 > Synopsis: azalia crashes during boot - uvm_fault
 > 
 > State-Changed-From-To: open->feedback
 > State-Changed-By: jmcneill@NetBSD.org
 > State-Changed-When: Thu, 08 Oct 2009 10:39:19 +0000
 > State-Changed-Why:
 > Does the new hdaudio(4) driver in NetBSD 5.0_STABLE work better for you?
 > 
 > 
 > 

State-Changed-From-To: feedback->open
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 03 May 2010 04:14:57 +0000
State-Changed-Why:
Feedback was received, hdaudio has a problem.


State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 03 May 2010 04:37:49 +0000
State-Changed-Why:
Different feedback question: can you check that I didn't break your patch
when I committed it?


From: "David A. Holland" <dholland@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/41957 CVS commit: src/sys/dev/pci
Date: Mon, 3 May 2010 04:36:43 +0000

 Module Name:	src
 Committed By:	dholland
 Date:		Mon May  3 04:36:43 UTC 2010

 Modified Files:
 	src/sys/dev/pci: azalia_codec.c

 Log Message:
 Fix a crash during alc888 initialization caused by holding a pointer
 across realloc. Patch from Bj?rn Barkenfelt in PR kern/41957, rearranged
 somewhat by myself.


 To generate a diff of this commit:
 cvs rdiff -u -r1.77 -r1.78 src/sys/dev/pci/azalia_codec.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "=?ISO-8859-1?Q?Bj=F6rn?= Barkenfelt" <xbarken@googlemail.com>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org, gnats-admin@netbsd.org,  dholland@NetBSD.org
Subject: Re: kern/41957 (azalia crashes during boot - uvm_fault)
Date: Sun, 23 May 2010 14:26:31 +0200

 Should be ok like that, I'll test the fix on my system later, and let
 you know if there're any problems.

 / Björn

 On Mon, 2010-05-03 at 04:37 +0000, dholland@NetBSD.org wrote:
 > Synopsis: azalia crashes during boot - uvm_fault
 > 
 > State-Changed-From-To: open->feedback
 > State-Changed-By: dholland@NetBSD.org
 > State-Changed-When: Mon, 03 May 2010 04:37:49 +0000
 > State-Changed-Why:
 > Different feedback question: can you check that I didn't break your patch
 > when I committed it?
 > 
 > 
 > 

From: "=?ISO-8859-1?Q?Bj=F6rn?= Barkenfelt" <xbarken@googlemail.com>
To: gnats-bugs@NetBSD.org
Cc: dholland@NetBSD.org
Subject: Re: kern/41957 (azalia crashes during boot - uvm_fault)
Date: Mon, 07 Nov 2011 19:24:10 +0100

 Don't have the possibilities any more to do more tests.
 The patch should work though.
 Could someone please close the pr, or at least remove the feed-back
 state? Thanks

 / Björn

 On Sun, 2010-05-23 at 12:30 +0000, Björn Barkenfelt wrote:
 > The following reply was made to PR kern/41957; it has been noted by GNATS.
 > 
 > From: "=?ISO-8859-1?Q?Bj=F6rn?= Barkenfelt" <xbarken@googlemail.com>
 > To: gnats-bugs@NetBSD.org
 > Cc: kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org, gnats-admin@netbsd.org,  dholland@NetBSD.org
 > Subject: Re: kern/41957 (azalia crashes during boot - uvm_fault)
 > Date: Sun, 23 May 2010 14:26:31 +0200
 > 
 >  Should be ok like that, I'll test the fix on my system later, and let
 >  you know if there're any problems.
 >  
 >  / Björn
 >  
 >  On Mon, 2010-05-03 at 04:37 +0000, dholland@NetBSD.org wrote:
 >  > Synopsis: azalia crashes during boot - uvm_fault
 >  > 
 >  > State-Changed-From-To: open->feedback
 >  > State-Changed-By: dholland@NetBSD.org
 >  > State-Changed-When: Mon, 03 May 2010 04:37:49 +0000
 >  > State-Changed-Why:
 >  > Different feedback question: can you check that I didn't break your patch
 >  > when I committed it?
 >  > 
 >  > 
 >  > 
 >  

State-Changed-From-To: feedback->analyzed
State-Changed-By: wiz@NetBSD.org
State-Changed-When: Mon, 07 Nov 2011 22:56:50 +0000
State-Changed-Why:
Feedback supplied.


State-Changed-From-To: analyzed->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Tue, 08 Nov 2011 13:43:27 +0000
State-Changed-Why:
Submitter can't test, let's assume it works. azalia is not exactly the
future anyway.


State-Changed-From-To: closed->open
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sun, 13 Nov 2011 18:02:21 +0000
State-Changed-Why:
Oops, there's an hdaudio issue in here too.


>Unformatted:

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.