kern/58763: vge(4): reproducible panic: kernel diagnostic assertion "!cpu_intr_p()" failed

[vezhlys%gmail.com@localhost]

>Number:         58763
>Category:       kern
>Synopsis:       vge(4): reproducible panic: kernel diagnostic assertion "!cpu_intr_p()" failed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 20 11:25:00 +0000 2024
>Originator:     Andrius V
>Release:        NetBSD 10.99.12
>Organization:
>Environment:
NetBSD 10.99.12 (VT-310DP) #2: Sat Oct 19 23:17:54 EEST 2024 i386
>Description:
I stumbled on a reproducible vge(4) panic, caused by failed cpu_intr_p() assertion on sys/net/bpf.c line 1719. As of now I can only reproduce it on my i386 VIA VT310-DP board (VIA VT6122 network controller). It happens shortly after calling "ifconfig vge0 down" command. dhcpcd should be enabled and vge(4) configured for it to trigger as well. In between dhcpcd starts to do its magic, prints some messages, eventually system panics. I tried few other interfaces on same and other systems, including different vge(4) controllers, also install image with nearly same version of the kernel, seems to be my installation specific on this specific system and only for vge interface (system has fxp and vr as well). Tested on netbsd current with the latest code at the time of writing. Interrupt part can be different in the trace.

panic: kernel diagnostic assertion "!cpu_intr_p()" failed: file "/home/andriusv/netbsd-src-git/sys/net/bpf.c", line 1719 
cpu0: Begin traceback...
vpanic(c0efe278,db086dd0,db086e70,c0b46862,c0efe278,c0efe1c7,c0f4f17e,c0ff8330,6b7,db086e0c) at netbsd:vpanic+0x176
kern_assert(c0efe278,c0efe1c7,c0f4f17e,c0ff8330,6b7,db086e0c,c0c45290,c3a2af02,c02a96a1,c3a1f70e) at netbsd:kern_assert+0x23
bpf_deliver(2a,2a,2,8,5,3,3c0000,8,ff,100) at netbsd:bpf_deliver+0x489
vge_start(c395a010,64,1,8000,db086f0c,c02ac363,c395a000,db95e000,24,20008000) at netbsd:vge_start+0x3c3
vge_tick(c395a000,db95e000,24,20008000,c395a010,c3cba4c0,c3a1b300,2,db086f58,c0400cef) at netbsd:vge_tick+0xac
vge_intr(c395a000,6,5dc,5dc,f,b7e,47b79,c11a7f40,c3a1b040,db20eedc) at netbsd:vge_intr+0xdd
intr_wrapper(c3cba4c0,0,0,c3ca2940,c0109963,c3cba4c0,db20eedc,0,0,0) at netbsd:intr_wrapper+0x3f
intr_biglock_wrapper(c3cba4c0,db20eedc,0,0,0,0,0,0,0,0) at netbsd:intr_biglock_wrapper+0x1e
--- switch to interrupt stack ---
Xintr_ioapic_level2() at netbsd:Xintr_ioapic_level2+0xc3
--- interrupt ---
bus_space_read_4(c3e30000,0,0,0,0,0,0,0,10,10) at netbsd:bus_space_read_4+0x13
softint_dispatch(c3a1b040,4,0,0,0,0,[ 2942.4534259] 5,[ 2942.4534259] 5,[ 2942.4534259] 5,[ 2942.4534259] 5) at netbsd:softint_dispatch+0x3c0
Bad frame pointer: 0xc3d76700
cpu0: End traceback...

or

--- interrupt ---
x86_stihlt(1,1,c11d22c0,0,c3a1b000,c3a1b040,c11a7f40,c3a1b040,db203f9c,c0a2ebc5) at netbsd:x86_stihlt+0x5
acpicpu_cstate_idle_enter(c3a1b040,1,c11bd940,c3a1b040,c01006a3,c3a1b040,c0a2eab0,c3a1b040,c0a2eab0,0) at netbsd:acpicpu_cstate_idle_enter+0x7f
idle_loop(c3a1b040,143f000,144a000,0,c01005a3,0,0,0,0,0) at netbsd:idle_loop+0x115
cpu0: End traceback...

vge dmesg messages:
vge0 at pci0 dev 10 function 0: VIA VT612X Gigabit Ethernet (rev. 0x11)
vge0: interrupting at ioapic0 pin 18
vge0: Ethernet address xx:xx:xx:xx:xx:xx
ciphy0 at vge0 phy 1: Cicada CIS8201 10/100/1000TX PHY, rev. 2
vge0: link state DOWN (was UNKNOWN)
vge0: link state UP (was DOWN)

>How-To-Repeat:
# dhcpcd enabled and vge0 is up
ifconfig vge0 down
# observe crash shortly after
>Fix: