From owner-freebsd-bugs Wed Jun 19 16:40:22 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id BFFF637B405 for ; Wed, 19 Jun 2002 16:40:01 -0700 (PDT) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g5JNe1x28281; Wed, 19 Jun 2002 16:40:01 -0700 (PDT) (envelope-from gnats) Received: from ns2.arlut.utexas.edu (ns2.arlut.utexas.edu [129.116.174.1]) by hub.freebsd.org (Postfix) with ESMTP id 5B8CF37B406 for ; Wed, 19 Jun 2002 16:30:08 -0700 (PDT) Received: from ns5.arlut.utexas.edu (ns5.arlut.utexas.edu [10.4.1.6]) by ns2.arlut.utexas.edu (8.11.4/8.11.3) with ESMTP id g5JNU2j62850 for ; Wed, 19 Jun 2002 18:30:02 -0500 (CDT) Received: from csdlap3.arlut.utexas.edu (csdlap3.arlut.utexas.edu [10.3.16.8]) by ns5.arlut.utexas.edu (8.11.6/8.11.6) with ESMTP id g5JNU0q92586; Wed, 19 Jun 2002 18:30:00 -0500 (CDT) Received: from csdlap3.arlut.utexas.edu (localhost [127.0.0.1]) by csdlap3.arlut.utexas.edu (8.12.3/8.12.3) with ESMTP id g5JNU0tM001461; Wed, 19 Jun 2002 18:30:00 -0500 (CDT) (envelope-from gil@csdlap3.arlut.utexas.edu) Received: (from gil@localhost) by csdlap3.arlut.utexas.edu (8.12.3/8.12.3/Submit) id g5JNTxpu001460; Wed, 19 Jun 2002 18:29:59 -0500 (CDT) Message-Id: <200206192329.g5JNTxpu001460@csdlap3.arlut.utexas.edu> Date: Wed, 19 Jun 2002 18:29:59 -0500 (CDT) From: Gil Kloepfer Reply-To: Gil Kloepfer To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: kern/39549: maestro3 driver causes page fault in kernel Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 39549 >Category: kern >Synopsis: maestro3 driver causes page fault in kernel >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jun 19 16:40:01 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Gil Kloepfer >Release: FreeBSD 4.6-RELEASE i386 >Organization: UT Applied Research Laboratories >Environment: System: FreeBSD csdlap3.arlut.utexas.edu 4.6-RELEASE FreeBSD 4.6-RELEASE #0: Mon Jun 17 09:07:04 CDT 2002 root@csdlap3.arlut.utexas.edu:/usr/src/sys/compile/ARLINSP8K i386 Dell Inspiron 8000 laptop >Description: When maestro3 driver is loaded (kldload snd_maestro3) the kernel panics with Page fault in kernel mode, Supervisor read, page not present. This is because (see patch below) the interrupts were enabled in m3_init which was called before the mixer code was initialized. The interrupt routine will call the mixer routines if a mixer interrupt comes in, which is what happened on the platform above. Since the chip interrupt came before the mixer init routines were called, the mixer routines attempted to access non-initialized pointers and caused a page fault in the kernel. This probably works OK provided the chip doesn't generate a mixer interrupt ... but there's no way to tell when that may happen, obviously. >How-To-Repeat: On above platform, simply load the snd_maestro3 driver: kldload snd_maestro3 >Fix: The function m3_enable_ints is moved out of m3_init and into m3_pci_attach following the mixer initialization. The following context diff shows the fix. The file's full location is /sys/drv/sound/pci/maestro3.c. -- Begin context diff -- *** maestro3.c.ORIG Mon Apr 22 10:49:32 2002 --- maestro3.c Wed Jun 19 17:54:07 2002 *************** *** 1044,1051 **** m3_wr_assp_data(sc, i, 0); /* zero entire dac/adc area */ } - m3_enable_ints(sc); - /* [m3_assp_continue] */ m3_wr_1(sc, DSP_PORT_CONTROL_REG_B, reset_state | REGB_ENABLE_RESET); --- 1044,1049 ---- *************** *** 1171,1176 **** --- 1169,1182 ---- device_printf(dev, "mixer_init error\n"); goto bad; } + + /* enable interrupts. This has to happen here because + * the interrupt routines call the mixer code, and if + * the chip interrupts are enabled before the mixer is + * initialized, all heck breaks loose. + */ + + m3_enable_ints(sc); if (pcm_register(dev, sc, M3_PCHANS, M3_RCHANS)) { device_printf(dev, "pcm_register error\n"); -- End context diff -- >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message