[Bug 298121] SR-IOV: Kernel thread hangs while adding a VF interface

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298121

            Bug ID: 298121
           Summary: SR-IOV: Kernel thread hangs while adding a VF
                    interface
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: naito.yuichiro@gmail.com

After updating my FreeBSD 16-CURRENT to the following commit, iovctl(8) hangs
in the kernel.

```
FreeBSD 16.0-CURRENT #0 main-n288781-551b7c5e12bf: Wed Sep  2 09:20:29 JST 2026
    root@juno.yuisoft.com:/usr/obj/usr/src/amd64.amd64/sys/GENERIC-NODEBUG
```

I created the iovctl.conf like this. It creates one VF interface without
passthrough. An iavf(4) interface will be available on the host machine. If I
create a passthrough device, this issue won't happen.

```iovctl.conf
PF {
        device : "ixl0";
        num_vfs : 1;
}

DEFAULT {
        passthrough : false;
}
```

The `iovctl -C -f iovctl.conf` always hangs up and ps(1) shows that iovctl is
running at 100% CPU usage. I see the console messages seem to indicate that
creating an iavf(1) succeeded.

```
login: Sep  2 14:53:40 juno su[3698]: yuichiro to root on /dev/pts/0
iavf0: <Intel(R) Ethernet Virtual Function 700 Series - 3.0.26-k> at device
0.16 on pci1
iavf0: PF API 1.1 / VF API 1.1
iavf0: VSIs 1, QPs 4, MSI-X 5, RSS sizes: key 52 lut 64
iavf0: Generated random MAC address
iavf0: Using 1024 TX descriptors and 1024 RX descriptors
iavf0: Using 4 RX queues 4 TX queues
iavf0: Using MSI-X interrupts with 5 vectors
```

While iovctl(8) hangs, the other processes keep working. I can trigger a kernel
core dump. I found the iovctl kernel thread backtrace from kgdb(1).

```
Tracing command "iovctl", '\000' <repeats 13 times> pid 3702 tid 101156 (CPU
11)
#0  cpustop_handler () at /usr/src/sys/x86/x86/mp_x86.c:1537
#1  0xffffffff8113a9a8 in ipi_nmi_handler ()
    at /usr/src/sys/x86/x86/mp_x86.c:1494
#2  0xffffffff8112f25f in nmi_handle_intr (frame=<unavailable>)
    at /usr/src/sys/x86/x86/cpu_machdep.c:1086
#3  <signal handler called>
#4  lock_delay (la=la@entry=0xfffffe0187fe9700)
    at /usr/src/sys/kern/subr_lock.c:124
#5  0xffffffff80c2ba98 in _sx_slock_hard (
    sx=0xffffffff81e31548 <ifnet_sxlock>, opts=<optimized out>, 
    x=<optimized out>) at /usr/src/sys/kern/kern_sx.c:1108
#6  0xffffffff80c2b956 in _sx_slock_int (sx=0xfffffe0187fe9700, 
    opts=opts@entry=0) at /usr/src/sys/kern/kern_sx.c:1279
#7  0xffffffff80d62174 in if_foreach_group (ifp=ifp@entry=0xfffff8002cb98c00, 
    cb=0xffffffff80e9b860 <dump_group_cb>, cb_arg=0xfffff8000c6bb000, 
    cb_arg@entry=0xfffffe0187fe9830) at /usr/src/sys/net/if.c:1484
#8  0xffffffff80e9b595 in dump_group (nw=0xfffffe0187fe9830, 
    ifp=0xfffff8002cb98c00) at /usr/src/sys/netlink/route/iface.c:233
#9  dump_iface (nw=nw@entry=0xfffffe0187fe9830, 
    ifp=ifp@entry=0xfffff8002cb98c00, hdr=hdr@entry=0xfffffe0187fe9868, 
    if_flags_mask=if_flags_mask@entry=0, ifname=ifname@entry=0x0)
    at /usr/src/sys/netlink/route/iface.c:389
#10 0xffffffff80e9ac0f in rtnl_handle_ifevent (ifp=0xfffff8002cb98c00, 
    nlmsg_type=16, if_flags_mask=0, ifname=0x0)
    at /usr/src/sys/netlink/route/iface.c:1454
#11 rtnl_handle_ifattach (arg=<optimized out>, ifp=0xfffff8002cb98c00)
    at /usr/src/sys/netlink/route/iface.c:1462
#12 0xffffffff80d60a42 in if_attach_internal (ifp=0xfffff8002cb98c00, 
    vmove=<optimized out>) at /usr/src/sys/net/if.c:931
#13 0xffffffff80d605b9 in if_attach (ifp=0xfffffe0187fe9700)
    at /usr/src/sys/net/if.c:763
#14 0xffffffff80d6c0ee in ether_ifattach (ifp=0xfffffe0187fe9700, lla=0x0)
    at /usr/src/sys/net/if_ethersubr.c:945
#15 0xffffffff80d7c05b in iflib_device_register (
    dev=dev@entry=0xfffff8002ce0c200, sc=<optimized out>, sc@entry=0x0, 
    sctx=sctx@entry=0xffffffff81b5eb00 <iavf_sctx>, 
    ctxp=ctxp@entry=0xfffffe0187fe99e8) at /usr/src/sys/net/iflib.c:5509
#16 0xffffffff80d80938 in iflib_device_attach (dev=0xfffff8002ce0c200)
    at /usr/src/sys/net/iflib.c:5656
#17 0xffffffff80c61ae8 in DEVICE_ATTACH (dev=0xfffff8002ce0c200)
    at ./device_if.h:198
#18 device_attach (dev=dev@entry=0xfffff8002ce0c200)
    at /usr/src/sys/kern/subr_bus.c:2630
#19 0xffffffff80c62dfd in device_probe_and_attach (dev=0xfffff8002ce0c200)
    at /usr/src/sys/kern/subr_bus.c:2579
#20 bus_attach_children (dev=dev@entry=0xfffff80001b87100)
    at /usr/src/sys/kern/subr_bus.c:3490
#21 0xffffffff808ae2d2 in pci_iov_enumerate_vfs (
    dinfo=dinfo@entry=0xfffff80001b83c00, 
    config=config@entry=0xfffff80127eb35c0, first_rid=first_rid@entry=272, 
    rid_stride=rid_stride@entry=1) at /usr/src/sys/dev/pci/pci_iov.c:678
#22 0xffffffff808ad400 in pci_iov_config (cdev=<optimized out>, 
    arg=<optimized out>) at /usr/src/sys/dev/pci/pci_iov.c:815
#23 pci_iov_ioctl (dev=<optimized out>, cmd=<optimized out>, 
    data=<optimized out>, fflag=<optimized out>, td=<optimized out>)
    at /usr/src/sys/dev/pci/pci_iov.c:1218
#24 0xffffffff80a85f86 in devfs_ioctl (ap=0xfffffe0187fe9c40)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:964
#25 0xffffffff80d3d6b3 in VOP_IOCTL (vp=0xfffff80003d20528, 
    command=<optimized out>, data=<optimized out>, fflag=<optimized out>, 
    cred=<optimized out>, td=<optimized out>) at ./vnode_if.h:747
#26 vn_ioctl (fp=<optimized out>, com=<optimized out>, data=<optimized out>, 
    active_cred=<optimized out>, td=<optimized out>)
    at /usr/src/sys/kern/vfs_vnops.c:1889
#27 0xffffffff80a8664e in devfs_ioctl_f (fp=0xfffffe0187fe9700, com=0, 
    data=0xfffff8000c6bb000, cred=0x321, td=0x0)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:895
#28 0xffffffff80c99d32 in fo_ioctl (fp=0xfffff80064440cd0, com=0, 
    data=0xfffffe0187fe9d50, active_cred=0x321, td=0xfffff8000c6bb000)
    at /usr/src/sys/sys/file.h:391
#29 kern_ioctl (td=td@entry=0xfffff8000c6bb000, fd=<optimized out>, com=0, 
    com@entry=2148560906, data=data@entry=0xfffffe0187fe9d50 "")
    at /usr/src/sys/kern/sys_generic.c:834
#30 0xffffffff80c99a31 in sys_ioctl (td=<optimized out>, 
    uap=0xfffff8000c6bb428) at /usr/src/sys/kern/sys_generic.c:739
#31 0xffffffff81175da6 in syscallenter (td=0xfffff8000c6bb000)
    at /usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:193
#32 amd64_syscall (td=0xfffff8000c6bb000, traced=0)
    at /usr/src/sys/amd64/amd64/trap.c:1278
#33 <signal handler called>
#34 0x0000128b8de5754a in ?? ()
Backtrace stopped: Cannot access memory at address 0x128b8a38cc38

```

It seems like an IFNET_{RW}LOCK deadlock.
If I revert the following commit, this issue won't happen.

```
commit 2f8f892ca344d884abbed0305886bb532f16368f (HEAD)
Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
Date:   Thu Aug 27 16:13:28 2026 +0330

    rtnetlink: Add FreeBSD-specific IFLAF_GROUP support

    Netlink IFLA_GROUP works with a single group id, in our
    implementation an interface can be joined to multiple groups
    and it works with group name.
    Store interface groups in IFLAF_GROUP attribute.

    Reviewed by:    glebius, melifaro
    Discussed with: markj
    Differential Revision: https://reviews.freebsd.org/D58643
```

-- 
You are receiving this mail because:
You are the assignee for the bug.