kern/55906: Kernel panic while loading firmware when booting netbsd-9

[Pierre Pronchery <khorben%defora.org@localhost>]

>Number:         55906
>Category:       kern
>Synopsis:       Call to workqueue_enqueue() for aiodoned performed before initialisation
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 03 10:45:00 +0000 2021
>Originator:     Pierre Pronchery
>Release:        NetBSD 9.1_STABLE
>Organization:
The DeforaOS Project
The NetBSD Foundation
>Environment:
System: NetBSD localhost 9.1_STABLE NetBSD 9.1_STABLE (GENERIC_KASLR) #14: Mon Dec 28 05:45:36 CET 2020 khorben@localhost:/sys/arch/amd64/compile/GENERIC_KASLR amd64
Architecture: x86_64
Machine: amd64
>Description:
On a system booting GENERIC_KASLR together with root on cgd(4), and
loading firmware for the graphics card for the console, the kernel
panics with:

> kernel: page fault trap, code=0
> Stopped in pid 0.100 (system) at netbsd:workqueue_enqueue+0x16: testb $0x2,10(%rdi)
> workqueue_enqueue() at netbsd:workqueue_enqueue+0x16
> biodone2() at netbsd:biodone2+0xd8

The graphics card in this case is an ATI Radeon HD4870 (RV770) using
radeondrmkms(4).

After debugging I figured the culprit was not in the DRM2 code as
initially suspected, but with the workqueue for aiodoned, in the
kernel's main() routine.

>How-To-Repeat:
Boot NetBSD 9 on a system loading multiple or relatively big (?)
firmware files before running init(8).
>Fix:
The patch I sent on the tech-kern@ mailing-list does fix this issue and
seems to be correct, as confirmed by Chuck Silvers (chs@). I have
reproduced it here below.

I believe it is only relevant for the netbsd-9 branch, as it was fixed
differently in -current. It should therefore be applied there, but there
cannot be a corresponding commit in -current anymore to be pulled up.

I have not looked at the netbsd-8 branch.

The patch initialises the aiodoned queue before mounting the root file
system, as follows:

diff --git a/sys/kern/init_main.c b/sys/kern/init_main.c
index bbf418df55ce..0b07c9164ade 100644
--- a/sys/kern/init_main.c
+++ b/sys/kern/init_main.c
@@ -668,6 +668,11 @@ main(void)
 	cpu_rootconf();
 	cpu_dumpconf();
 
+	/* Create the aiodone daemon kernel thread. */
+	if (workqueue_create(&uvm.aiodone_queue, "aiodoned",
+	    uvm_aiodone_worker, NULL, PRI_VM, IPL_NONE, WQ_MPSAFE))
+		panic("fork aiodoned");
+
 	/* Mount the root file system. */
 	do {
 		domountroothook(root_device);
@@ -736,11 +741,6 @@ main(void)
 	    NULL, NULL, "ioflush"))
 		panic("fork syncer");
 
-	/* Create the aiodone daemon kernel thread. */
-	if (workqueue_create(&uvm.aiodone_queue, "aiodoned",
-	    uvm_aiodone_worker, NULL, PRI_VM, IPL_NONE, WQ_MPSAFE))
-		panic("fork aiodoned");
-
 	/* Wait for final configure threads to complete. */
 	config_finalize_mountroot();
 

>Unformatted:
 Up to and including "Ticket #1160".