Re: kern/60318: reproducable bpfjit crash

["Martin Husemann via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60318; it has been noted by GNATS.

From: Martin Husemann <martin%duskware.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/60318: reproducable bpfjit crash
Date: Sat, 13 Jun 2026 11:35:35 +0200

 The problem is my kernel uses "options PMAP_MI" and the modules don't.
 
 I instrumented sljit_generate_code() like this:
 
 Index: sys/external/bsd/sljit/dist/sljit_src/sljitNativeARM_64.c
 ===================================================================
 RCS file: /cvsroot/src/sys/external/bsd/sljit/dist/sljit_src/sljitNativeARM_64.c,v
 retrieving revision 1.5
 diff -u -p -r1.5 sljitNativeARM_64.c
 --- sys/external/bsd/sljit/dist/sljit_src/sljitNativeARM_64.c	2 Apr 2024 22:29:57 -0000	1.5
 +++ sys/external/bsd/sljit/dist/sljit_src/sljitNativeARM_64.c	13 Jun 2026 09:30:36 -0000
 @@ -321,6 +321,11 @@ SLJIT_API_FUNC_ATTRIBUTE void* sljit_gen
  	code = (sljit_ins *)SLJIT_ADD_EXEC_OFFSET(code, executable_offset);
  	code_ptr = (sljit_ins *)SLJIT_ADD_EXEC_OFFSET(code_ptr, executable_offset);
  
 +#ifdef _HARDKERNEL
 +printf("sljit_generate_code: calling SLJIT_CACHE_FLUSH -> curcpu()->ci_cpufuncs.cf_icache_sync_range which is %p (with curcpu = %p)\n",
 +    curcpu()->ci_cpufuncs.cf_icache_sync_range, curcpu());
 +#endif
 +
  	SLJIT_CACHE_FLUSH(code, code_ptr);
  	return code;
  }
 
 
 and got:
 
 Starting dhcpcd.
 Enabling NPF /etc/npf.conf
 [  14.4965914] sljit_generate_code: calling SLJIT_CACHE_FLUSH -> curcpu()->ci_cpufuncs.cf_icache_sync_range which is 0x0 (with curcpu = 0xffffc00000c70380)
 [  14.5186367] panic: Trap: Instruction Abort (EL1): Translation Fault L2 for 0000000000000000, PAN Set: pc 0000000000000000: opcode unknown
 
 
 Martin