Re: Reproducable kernel crash

[Martin Husemann <martin%duskware.de@localhost>]

On Fri, Mar 01, 2024 at 05:43:49AM +1100, matthew green wrote:
> sounds about right to me.  this should genreally only be
> called by MI code doing context switch.  besides this one
> vax call, there are two in arm that may be an issue, though
> i can perhaps see why at least the efirt one is needed:
> 
> arch/arm/arm/ast.c:             pmap_activate(l);
> arch/arm/arm/efi_machdep.c:             pmap_activate(l);
> 
> does it happen without this bonus activate call?

Unfortunately cpu_lwp_bootstrap() is not able to start kernel threads
without it - must have something to do with faking the CALLS for it:

	/*
	 * Set up the calls frame above (below) the trapframe and populate
	 * it with something good.  This is so that we can simulate that we
	 * called cpu_lwp_bootstrap with a CALLS insn and it can return to
	 * sret.
	 */
	cf = (struct callsframe *)tf - 1;
	cf->ca_cond = 0;
	cf->ca_maskpsw = 0x20000000;	/* CALLS stack frame, no registers */
	cf->ca_pc = (uintptr_t)&sret;	/* return PC; userspace trampoline */
	cf->ca_argno = 1;
	cf->ca_arg1 = 0;		/* unused */
	   
	/*
	 * Set up internal defs in PCB. This matches the "fake" CALLS frame
	 * that were constructed earlier.
	 */
	pcb2->pcb_onfault = NULL;
	pcb2->AP = (uintptr_t)&cf->ca_argno;
	pcb2->KSP = (uintptr_t)cf;
	pcb2->FP = (uintptr_t)cf;
	pcb2->PC = (uintptr_t)cpu_lwp_bootstrap + 2;
	pcb2->PSL = PSL_HIGHIPL;
	pcb2->ESP = (uintptr_t)&pcb2->pcb_onfault;
	pcb2->SSP = (uintptr_t)l2;


Without the pmap_activate() I get:

[   1.0153750] panic: trap: type 7, code 0, pc 8010bdf5, psl 4
Stopped in pid 0.11 (system) at netbsd:vpanic+0x179:    pushl   $0
db> bt
panic: trap: type 7, code 0, pc 8010bdf5, psl 4
Stack traceback :
0x8afcfdb0: vpanic+0x179(0x802136cb,0x8afcfe48)
0x8afcfdd0: printf_nostamp+0x0(0x802136cb,0x7,0,0x8010bdf5,0x4)
0x8afcfdfc: trap+0xae(0x8afcff10)
0x8afcff10: trap type=0x7 code=0x0 pc=0x8010bdf5 psl=0x4
0x8afcfedc: lwp_startup+0x93(0x8029a080,0x87f0f800)
0x8afcff60: cpu_lwp_bootstrap+0xf(0)


and that is:

(gdb) list *(lwp_startup+0x93)
0x8010bdf5 is in lwp_startup (../../../../kern/kern_lwp.c:1070).
1065            LOCKDEBUG_BARRIER(NULL, 0);
1066            SDT_PROBE(proc, kernel, , lwp__start, new_lwp, 0, 0, 0, 0);
1067    
1068            /* For kthreads, acquire kernel lock if not MPSAFE. */
1069            if (__predict_false((new_lwp->l_pflag & LP_MPSAFE) == 0)) {
1070                    KERNEL_LOCK(1, new_lwp);
1071            }
1072    }


the KERNEL_LOCK()

Martin