Kernel panic on armv7 when PF is enabled

After git bisecting the panic started since this commit.

commit 78bc3d5e1712bc1649aa5574d2b8d153f9665113

Author: Kristof Provost <
[email protected]
>

Date:   Mon Feb 14 20:09:54 2022 +0100

vlan: allow net.link.vlan.mtag_pcp to be set per vnet

The primary reason for this change is to facilitate testing.

MFC after:      1 week

sys/net/if_ethersubr.c | 9 +++++----

sys/net/if_vlan.c      | 5 +++--

2 files changed, 8 insertions(+), 6 deletions(-)

The armv7 board boots from a NFS root,

it can boot without any problem if PF is disabled.

Any helps?

add host ::1: gateway lo0 fib 0: route already in table
add net fe80::: gateway ::1
add net ff02::: gateway ::1
add net ::ffff:0.0.0.0: gateway ::1
add net ::0.0.0.0: gateway ::1
Enabling pf.
Kernel page fault with the following non-sleepable locks held:
shared rm pf rulesets (pf rulesets) r = 0 (0xe3099430) locked @ /usr/src/sys/netpfil/pf/pf.c:6493
exclusive rw tcpinp (tcpinp) r = 0 (0xdb748d88) locked @ /usr/src/sys/netinet/tcp_usrreq.c:1008
stack backtrace:
#0 0xc0355cac at witness_debugger+0x7c
#1 0xc0356ef0 at witness_warn+0x3fc
#2 0xc05ec048 at abort_handler+0x1d8
#3 0xc05cb5ac at exception_exit+0
#4 0xe3083c10 at pf_syncookie_validate+0x60
#5 0xe30496a8 at pf_test+0x518
#6 0xe306d768 at pf_check_out+0x30
#7 0xc0415b44 at pfil_run_hooks+0xbc
#8 0xc0445cfc at ip_output+0xce8
#9 0xc045bc9c at tcp_default_output+0x20ac
#10 0xc0471eb4 at tcp_usr_send+0x1ac
#11 0xc0389464 at sosend_generic+0x490
#12 0xc0389790 at sosend+0x64
#13 0xc0502888 at clnt_vc_call+0x560
#14 0xc05009d8 at clnt_reconnect_call+0x170
#15 0xc01e7b14 at newnfs_request+0xb20
#16 0xc0230218 at nfscl_request+0x60
#17 0xc020d9bc at nfsrpc_getattr+0xb0
Fatal kernel mode data abort: 'Alignment Fault' on read
trapframe: 0xdf1f1c90
FSR=00000001, FAR=d7840264, spsr=40000013
r0 =6a228eda, r1 =dac0d785, r2 =d7840264, r3 =db5527c0
r4 =df1f1e00, r5 =dac0d75f, r6 =00000018, r7 =d9422c00
r8 =c093e5e4, r9 =00000001, r10=df1f1f5c, r11=df1f1d38
r12=e3098dd0, ssp=df1f1d20, slr=e3083bdc, pc =e3083c10

panic: Fatal abort
cpuid = 1
time = 1651366089
KDB: stack backtrace:
db_trace_self() at db_trace_self
         pc = 0xc05c8c00  lr = 0xc007ac8c (db_trace_self_wrapper+0x30)
         sp = 0xdf1f1a68  fp = 0xdf1f1b80
db_trace_self_wrapper() at db_trace_self_wrapper+0x30
         pc = 0xc007ac8c  lr = 0xc02e289c (vpanic+0x170)
         sp = 0xdf1f1b88  fp = 0xdf1f1ba8
         r4 = 0x00000100  r5 = 0x00000000
         r6 = 0xc0780529  r7 = 0xc090ea10
vpanic() at vpanic+0x170
         pc = 0xc02e289c  lr = 0xc02e264c (doadump)
         sp = 0xdf1f1bb0  fp = 0xdf1f1bb4
         r4 = 0xdf1f1c90  r5 = 0x00000013
         r6 = 0xd7840264  r7 = 0x00000001
         r8 = 0x00000001  r9 = 0xdb5527c0
        r10 = 0xd7840264
doadump() at doadump
         pc = 0xc02e264c  lr = 0xc05ec698 (abort_align)
         sp = 0xdf1f1bbc  fp = 0xdf1f1be8
         r4 = 0xd7840264  r5 = 0xdf1f1bb4
         r6 = 0xc02e264c r10 = 0xdf1f1bbc
abort_align() at abort_align
         pc = 0xc05ec698  lr = 0xc05ec198 (abort_handler+0x328)
         sp = 0xdf1f1bf0  fp = 0xdf1f1c88
         r4 = 0x00000013  r5 = 0xd7840264
abort_handler() at abort_handler+0x328
         pc = 0xc05ec198  lr = 0xc05cb5ac (exception_exit)
         sp = 0xdf1f1c90  fp = 0xdf1f1d38
         r4 = 0xdf1f1e00  r5 = 0xdac0d75f
         r6 = 0x00000018  r7 = 0xd9422c00
         r8 = 0xc093e5e4  r9 = 0x00000001
        r10 = 0xdf1f1f5c
exception_exit() at exception_exit
         pc = 0xc05cb5ac  lr = 0xe3083bdc (pf_syncookie_validate+0x2c)
         sp = 0xdf1f1d20  fp = 0xdf1f1d38
         r0 = 0x6a228eda  r1 = 0xdac0d785
         r2 = 0xd7840264  r3 = 0xdb5527c0
         r4 = 0xdf1f1e00  r5 = 0xdac0d75f
         r6 = 0x00000018  r7 = 0xd9422c00
         r8 = 0xc093e5e4  r9 = 0x00000001
        r10 = 0xdf1f1f5c r12 = 0xe3098dd0
pf_syncookie_validate() at pf_syncookie_validate+0x60
         pc = 0xe3083c10  lr = 0xe30496a8 (pf_test+0x518)
         sp = 0xdf1f1d40  fp = 0xdf1f1ea8
         r4 = 0x00020000  r5 = 0xdb4a6100
         r6 = 0x00000018  r7 = 0xd9422c00
         r8 = 0x00000002  r9 = 0x00000001
pf_test() at pf_test+0x518
         pc = 0xe30496a8  lr = 0xe306d768 (pf_check_out+0x30)
         sp = 0xdf1f1eb0  fp = 0xdf1f1ec0
         r4 = 0xdf1f1f5c  r5 = 0xe306d738
         r6 = 0xdb6ba660  r7 = 0x00000000
         r8 = 0xd9422c00  r9 = 0xdb748d80
        r10 = 0xfff70000
pf_check_out() at pf_check_out+0x30
         pc = 0xe306d768  lr = 0xc0415b44 (pfil_run_hooks+0xbc)
         sp = 0xdf1f1ec8  fp = 0xdf1f1ef0
         r4 = 0x00020000  r5 = 0xe306d738
pfil_run_hooks() at pfil_run_hooks+0xbc
         pc = 0xc0415b44  lr = 0xc0445cfc (ip_output+0xce8)
         sp = 0xdf1f1ef8  fp = 0xdf1f1fa8
         r4 = 0x0000010a  r5 = 0x00000a0a
         r6 = 0xdb4a6158  r7 = 0xc0946908
         r8 = 0xdb5bec00  r9 = 0xd9422c00
        r10 = 0x000005dc
ip_output() at ip_output+0xce8
         pc = 0xc0445cfc  lr = 0xc045bc9c (tcp_default_output+0x20ac)
         sp = 0xdf1f1fb0  fp = 0xdf1f20e0
         r4 = 0x00000001  r5 = 0x00000000
         r6 = 0x00000034  r7 = 0xdb746000
         r8 = 0xdb4a616c  r9 = 0xdb4a6100
        r10 = 0xdb782000
tcp_default_output() at tcp_default_output+0x20ac
         pc = 0xc045bc9c  lr = 0xc0471eb4 (tcp_usr_send+0x1ac)
         sp = 0xdf1f20e8  fp = 0xdf1f2160
         r4 = 0xc0af955c  r5 = 0xdb782000
         r6 = 0x00000000  r7 = 0xdb746000
         r8 = 0x00000000  r9 = 0xdb748d80
        r10 = 0x00000000
tcp_usr_send() at tcp_usr_send+0x1ac
         pc = 0xc0471eb4  lr = 0xc0389464 (sosend_generic+0x490)
         sp = 0xdf1f2168  fp = 0xdf1f21d0
         r4 = 0xc0471d08  r5 = 0x00044000
         r6 = 0xdb746000  r7 = 0xdb5527c0
         r8 = 0x00000000  r9 = 0xdb7461b8
        r10 = 0xdb4b2900
sosend_generic() at sosend_generic+0x490
         pc = 0xc0389464  lr = 0xc0389790 (sosend+0x64)
         sp = 0xdf1f21d8  fp = 0xdf1f2200
         r4 = 0x00000000  r5 = 0xc0388fd4
         r6 = 0xdb5527c0  r7 = 0x00000000
         r8 = 0x5e4a6f28  r9 = 0x00000100
        r10 = 0xc72fc490
sosend() at sosend+0x64
         pc = 0xc0389790  lr = 0xc0502888 (clnt_vc_call+0x560)
         sp = 0xdf1f2208  fp = 0xdf1f22e8
         r4 = 0xc076e132  r5 = 0xdf1f22ac
         r6 = 0xc72fc5a0  r7 = 0xc04fd348
         r8 = 0xc72fc480 r10 = 0xc72fc490
clnt_vc_call() at clnt_vc_call+0x560
         pc = 0xc0502888  lr = 0xc05009d8 (clnt_reconnect_call+0x170)
         sp = 0xdf1f22f0  fp = 0xdf1f2378
         r4 = 0xc0502328  r5 = 0xc0768137
         r6 = 0xdb65bc40  r7 = 0xc72fc610
         r8 = 0xc72fc600  r9 = 0x00000000
        r10 = 0xdf1f2438
clnt_reconnect_call() at clnt_reconnect_call+0x170
         pc = 0xc05009d8  lr = 0xc01e7b14 (newnfs_request+0xb20)
         sp = 0xdf1f2380  fp = 0xdf1f24a8
         r4 = 0x0000012c  r5 = 0xc0500868
         r6 = 0x00000000  r7 = 0x00000000
         r8 = 0xdf1f2510  r9 = 0xc0726761
        r10 = 0x00000000
newnfs_request() at newnfs_request+0xb20
         pc = 0xc01e7b14  lr = 0xc0230218 (nfscl_request+0x60)
         sp = 0xdf1f24b0  fp = 0xdf1f24e8
         r4 = 0x00000000  r5 = 0x000186a3
         r6 = 0x00000003  r7 = 0x00000001
         r8 = 0xdf1f26c8  r9 = 0xc0af955c
        r10 = 0x00000000
nfscl_request() at nfscl_request+0x60
         pc = 0xc0230218  lr = 0xc020d9bc (nfsrpc_getattr+0xb0)
         sp = 0xdf1f24f0  fp = 0xdf1f2618
         r4 = 0x00000000  r5 = 0xdb5afd00
         r6 = 0xdb5527c0  r7 = 0xe29d453c
nfsrpc_getattr() at nfsrpc_getattr+0xb0
         pc = 0xc020d9bc  lr = 0xc0223b88 (nfs_getattr+0xc8)
         sp = 0xdf1f2620  fp = 0xdf1f27b0
         r4 = 0x00000000  r5 = 0xe29d453c
         r6 = 0xe29d6670  r7 = 0x00000000
         r8 = 0xdb5527c0  r9 = 0xdf1f2830
        r10 = 0xdb5527c0
nfs_getattr() at nfs_getattr+0xc8
         pc = 0xc0223b88  lr = 0xc03b9b80 (vop_sigdefer+0x34)
         sp = 0xdf1f27b8  fp = 0xdf1f27c8
         r4 = 0xdf1f2998  r5 = 0xffffffff
         r6 = 0xc0223ac0  r7 = 0x00000000
         r8 = 0xdf1f2d60  r9 = 0xdb795800
vop_sigdefer() at vop_sigdefer+0x34
         pc = 0xc03b9b80  lr = 0xc0221a00 (nfs_lookup+0x344)
         sp = 0xdf1f27d0  fp = 0xdf1f2aa8
         r4 = 0xe29d6670  r5 = 0xdf1f2830
         r6 = 0xe29d6660 r10 = 0xdb5527c0
nfs_lookup() at nfs_lookup+0x344
         pc = 0xc0221a00  lr = 0xc03b9b80 (vop_sigdefer+0x34)
         sp = 0xdf1f2ab0  fp = 0xdf1f2ac0
         r4 = 0xdf1f2ae4  r5 = 0x00000000
         r6 = 0xc02216bc  r7 = 0x00080000
         r8 = 0xdf1f2d60  r9 = 0x00000002
        r10 = 0x00000000
vop_sigdefer() at vop_sigdefer+0x34
         pc = 0xc03b9b80  lr = 0xc03be55c (lookup+0x46c)
         sp = 0xdf1f2ac8  fp = 0xdf1f2b10
         r4 = 0xdf1f2d00  r5 = 0xdb9e4ea8
         r6 = 0xdf1f2d58 r10 = 0x00000000
lookup() at lookup+0x46c
         pc = 0xc03be55c  lr = 0xc03bd450 (namei+0x3cc)
         sp = 0xdf1f2b18  fp = 0xdf1f2bb8
         r4 = 0xdf1f2d00  r5 = 0xfffff81c
         r6 = 0x00000000  r7 = 0xdb3bcc90
         r8 = 0xc0b5a48c  r9 = 0xdb5527c0
        r10 = 0xdf1f2d60
namei() at namei+0x3cc
         pc = 0xc03bd450  lr = 0xc03e4e98 (vn_open_cred+0x45c)
         sp = 0xdf1f2bc0  fp = 0xdf1f2cc8
         r4 = 0x00000001  r5 = 0x00000000
         r6 = 0x00100001  r7 = 0xdf1f2d60
         r8 = 0xffffff9c  r9 = 0xdf1f2d00
        r10 = 0xdf1f2d58
vn_open_cred() at vn_open_cred+0x45c
         pc = 0xc03e4e98  lr = 0xc03e4a34 (vn_open+0x24)
         sp = 0xdf1f2cd0  fp = 0xdf1f2cd8
         r4 = 0xdb5527c0  r5 = 0xdf1f2d00
         r6 = 0x00000000  r7 = 0xdf1f2d00
         r8 = 0xffffff9c  r9 = 0x00000012
        r10 = 0x20076b04
vn_open() at vn_open+0x24
         pc = 0xc03e4a34  lr = 0xc03db428 (kern_openat+0x254)
         sp = 0xdf1f2ce0  fp = 0xdf1f2db8
kern_openat() at kern_openat+0x254
         pc = 0xc03db428  lr = 0xc03db6b0 (sys_openat+0x2c)
         sp = 0xdf1f2dc0  fp = 0xdf1f2dc8
         r4 = 0xdb5527c0  r5 = 0x00000001
         r6 = 0xc08d99cc  r7 = 0x00000000
         r8 = 0x00000000  r9 = 0xdb552a68
        r10 = 0xdba29c80
sys_openat() at sys_openat+0x2c
         pc = 0xc03db6b0  lr = 0xc05eb9b4 (swi_handler+0x15c)
         sp = 0xdf1f2dd0  fp = 0xdf1f2e40
swi_handler() at swi_handler+0x15c
         pc = 0xc05eb9b4  lr = 0xc05cb53c (swi_exit)
         sp = 0xdf1f2e48  fp = 0xbfbfe720
         r4 = 0x2027d2f4  r5 = 0x00065c40
         r6 = 0x20076ac8  r7 = 0x000001f3
         r8 = 0x00000001  r9 = 0x00065c40
        r10 = 0x00064d88
swi_exit() at swi_exit
         pc = 0xc05cb53c  lr = 0xc05cb53c (swi_exit)
         sp = 0xdf1f2e48  fp = 0xbfbfe720
KDB: enter: panic
[ thread pid 579 tid 100122 ]
Stopped at      kdb_enter+0x58: ldrb    r15, [r15, r15, ror r15]!