kern/131785: sysctl hw.snd.maxautovchans panics with snd_hda

[Dirk Meyer]

>Number:         131785
>Category:       kern
>Synopsis:       sysctl hw.snd.maxautovchans panics with snd_hda
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Feb 17 19:50:02 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Dirk Meyer
>Release:        FreeBSD 8.0-STABLE i386
>Organization:
>Environment:
System: FreeBSD book64.dinoex.sub.de 8.0-CURRENT FreeBSD 8.0-CURRENT #5: Tue Feb 17 06:39:57 CET 2009     root at book64.dinoex.sub.de:/usr/obj/usr/src/sys/GENERIC  amd64

$ pciconf -lv
none0 at pci0:0:27:0:      class=0x040300 card=0x3a0d17aa chip=0x293e8086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801IB/IR/IH (ICH9 Family) HD Audio Controller'
    class      = multimedia
    subclass   = HDA

FreeBSD 7.1 STABLE from 2009 Feb 11:
hdac0: HDA Driver Revision: 20090131_0127
hdac0: [ITHREAD]
hdac0: HDA Codec #0: Intel G45 HDMI
hdac0: HDA Codec #2: Conexant CX20561 (Hermosa)
pcm0: <HDA Intel G45 HDMI PCM #0 Digital> at cad 0 nid 1 on hdac0
pcm1: <HDA Conexant CX20561 (Hermosa) PCM #0 Analog> at cad 2 nid 1 on hdac0
pcm2: <HDA Conexant CX20561 (Hermosa) PCM #1 Analog> at cad 2 nid 1 on hdac0


>Description:

	FreeBSD 7.1 STABLE from 2009 Feb 11 does work and play sound
	FreeBSD 8.0-CURRENT crashes after loading snd_hda
	and run
	$ sysctl -w hw.snd.maxautovchans=16

hdac0: <Intel 82801I High Definition Audio Controller> mem 0xf4a00000-0xf4a03fff irq 22 at device 27.0 on pci0
hdac0: HDA Driver Revision: 20090215_0128
hdac0: [ITHREAD]
hdac0: HDA Codec #0: Intel G45 HDMI
hdac0: HDA Codec #2: Conexant CX20561 (Hermosa)
pcm0: <HDA Intel G45 HDMI PCM #0 Digital> at cad 0 nid 1 on hdac0
feeder_init(0xffffff00039d8500) on feeder_vchan returned -1
pcm1: <HDA Conexant CX20561 (Hermosa) PCM #0 Analog> at cad 2 nid 1 on hdac0
pcm2: <HDA Conexant CX20561 (Hermosa) PCM #1 Analog> at cad 2 nid 1 on hdac0
panic: to[0] == 0

	backtrace shows "chn_fmtchain" as the caller.
	where a "KASSERT" can be found.

	a crashdump does not get written.

	I have only a photo, backtrace:
		chn_fmtchain()
		chn_buildcoder()
		chn_tryformat()
		chn_setformat()
		chn_reset()
		vchn_create()
		pcm_setvchans()
		pcm_setmaxautovchans()
		sysctl_hw_snd_maxautovchans()
		sysclt_root()
		userland_sysctl()

>How-To-Repeat:

	run this script on an Lenvovo n500 under FreeBSD 8.0-CURRENT

	kldload snd_hda
        sysctl -w hw.snd.maxautovchans=16
        mixer -f /dev/dsp1 100
        mixer -f /dev/dsp1 pcm 100
        sysctl hw.snd.default_unit=1

>Fix:

	unknown

>Release-Note:
>Audit-Trail:
>Unformatted: