Bug 237435 - panic: pmap_demote_l2: Invalid virtual address - in sys_mprotect while building lang/sbcl with lang/clisp
Summary: panic: pmap_demote_l2: Invalid virtual address - in sys_mprotect while buildi...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: arm (show other bugs)
Version: CURRENT
Hardware: arm64 Any
: --- Affects Only Me
Assignee: freebsd-arm mailing list
URL:
Keywords: crash, needs-qa
Depends on:
Blocks:
 
Reported: 2019-04-21 12:19 UTC by Greg V
Modified: 2019-06-28 22:14 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Greg V 2019-04-21 12:19:11 UTC
Added clisp as an option for building sbcl on non-x86 platforms (clisp itself requires removing BROKEN in a dependency - bug 237432). When building, an mprotect call fails an assertion:

panic: pmap_demote_l2: Invalid virtual address 0x2e0004a7b000
cpuid = 20
time = 1555847196
KDB: stack backtrace:
db_trace_self() at db_trace_self_wrapper+0x28
         pc = 0xffff0000006fcb70  lr = 0xffff000000123b94
         sp = 0xffff000103ea44c0  fp = 0xffff000103ea46d0

db_trace_self_wrapper() at vpanic+0x18c
         pc = 0xffff000000123b94  lr = 0xffff0000003e8e2c
         sp = 0xffff000103ea46e0  fp = 0xffff000103ea4790

vpanic() at panic+0x44
         pc = 0xffff0000003e8e2c  lr = 0xffff0000003e8bf4
         sp = 0xffff000103ea47a0  fp = 0xffff000103ea4820

panic() at pmap_demote_l2_locked+0xadc
         pc = 0xffff0000003e8bf4  lr = 0xffff00000070e674
         sp = 0xffff000103ea4830  fp = 0xffff000103ea48d0

pmap_demote_l2_locked() at pmap_protect+0x1dc
         pc = 0xffff00000070e674  lr = 0xffff00000070f4d0
         sp = 0xffff000103ea48e0  fp = 0xffff000103ea4940

pmap_protect() at vm_map_protect+0x2ec
         pc = 0xffff00000070f4d0  lr = 0xffff0000006ae188
         sp = 0xffff000103ea4950  fp = 0xffff000103ea49b0

vm_map_protect() at sys_mprotect+0x58
         pc = 0xffff000  sp = 0xffff000103ea49c0  fp = 0xffff000103ea49c0

sys_mprotect() at do_el0_sync+0x4fc
         pc = 0xffff0000006b3758  lr = 0xffff000000717c58
         sp = 0xffff000103ea49d0  fp = 0xffff000103ea4a70

do_el0_sync() at handle_el0_sync+0x84
         pc = 0xffff000000717c58  lr = 0xffff0000006fea00
         sp = 0xffff000103ea4a80  fp = 0xffff000103ea4b90

handle_el0_sync() at 0x43a83c
         pc = 0xffff0000006fea00  lr = 0x000000000043a83c
         sp = 0xffff000103ea4ba0  fp = 0x0000fffffffee930

The panic does not happen on a NODEBUG kernel and nothing bad seems to happen after that :)
Comment 1 Greg V 2019-06-28 22:14:05 UTC
Now on a Marvell MACCHIATObin (upstream EDK2, ACPI mode), while doing a lot more things (e.g. tig, meson build..)

Also in demote_l2 but from pmap_enter.

panic: Invalid l3 page (16000006da0074b != 16000006da007cb)
cpuid = 2
time = 1561759063
KDB: stack backtrace:
db_trace_self() at db_trace_self_wrapper+0x28
	 pc = 0xffff000000705f30  lr = 0xffff000000102644
	 sp = 0xffff00006979d280  fp = 0xffff00006979d490

db_trace_self_wrapper() at vpanic+0x18c
	 pc = 0xffff000000102644  lr = 0xffff0000003f70b4
	 sp = 0xffff00006979d4a0  fp = 0xffff00006979d550

vpanic() at panic+0x44
	 pc = 0xffff0000003f70b4  lr = 0xffff0000003f6e64
	 sp = 0xffff00006979d560  fp = 0xffff00006979d5e0

panic() at pmap_demote_l2_locked+0xb48
	 pc = 0xffff0000003f6e64  lr = 0xffff0000007187d0
	 sp = 0xffff00006979d5f0  fp = 0xffff00006979d690

pmap_demote_l2_locked() at pmap_enter+0x5a8
	 pc = 0xffff0000007187d0  lr = 0xffff00000071a078
	 sp = 0xffff00006979d6a0  fp = 0xffff00006979d740

pmap_enter() at vm_fault_hold+0x1714
	 pc = 0xffff00000071a078  lr = 0xffff0000006aac2c
	 sp = 0xffff00006979d750  fp = 0xffff00006979d8c0

vm_fault_hold() at vm_fault+0x60
	 pc = 0xffff0000006aac2c  lr = 0xffff0000006a94c0
	 sp = 0xffff00006979d8d0  fp = 0xffff00006979d900

vm_fault() at data_abort+0xd0
	 pc = 0xffff0000006a94c0  lr = 0xffff000000721d68
	 sp = 0xffff00006979d910  fp = 0xffff00006979d9c0

data_abort() at do_el0_sync+0xc0
	 pc = 0xffff000000721d68  lr = 0xffff000000721fec
	 sp = 0xffff00006979d9d0  fp = 0xffff00006979da70

do_el0_sync() at handle_el0_sync+0x84
	 pc = 0xffff000000721fec  lr = 0xffff000000708a00
	 sp = 0xffff00006979da80  fp = 0xffff00006979db90

handle_el0_sync() at 0x40413b90
	 pc = 0xffff000000708a00  lr = 0x0000000040413b90
	 sp = 0xffff00006979dba0  fp = 0x0000ffffffff8540

KDB: enter: panic
[ thread pid 38171 tid 100434 ]
Stopped at      0x40413bd8:     undefined       f9000008