On Tue, Apr 21, 2026 at 02:05:47PM +0200, Jeremie Courreges-Anglas wrote: > On Sat, Apr 18, 2026 at 03:00:57PM +0200, Mark Kettenis wrote: > > > Date: Sat, 18 Apr 2026 14:35:49 +0200 > > > From: Jeremie Courreges-Anglas <[email protected]> > > > > > > Hey hey, > > > > > > First report below was obtained while running cvs co/up over NFS over > > > smte0, disk is nvme. This is after the pmap_growkernel() fix. > > > > The first report is *exactly* what the pmap_growkernel() fix fixes. > > So I suspect your kernel didn't have the fix yet. > > That doesn't match my memories but let's hope you're right. ;) > > > The second one doesn't look familliar, but the "locking against > > myself" panic is the result of an unexpected kernel page fault that > > occurs shortly after allocating some new KVA. > > Here's a series of lockups running one or two cvs up processes over > NFS/udp. Usually the machine is hanging, but in the first case it > hits faults in a loop. > > The two only other diffs applied are your com diff, your dwpcie diff > and the diff below which pretty-prints code page faults. (ok?)
Using the riscv64 bounce buffer + buffer flipper removal, I get crashes that seem to involve smte(4). login: t[0] == 0x8000000000000009 t[1] == 0xffffffc000730132 t[2] == 0x000000000000002b t[3] == 0x0000000f4b5d4768 t[4] == 0x0000000f22674000 t[5] == 0x00000000051eb850 t[6] == 0x00000000028f5c28 s[0] == 0xffffffc1262fbb70 s[1] == 0x3d0a6e6f69746174 s[2] == 0xffffffc023483c00 s[3] == 0xffffffc1262fbc00 s[4] == 0x0000000000000001 s[5] == 0x0000000000000000 s[6] == 0x0000000000000042 s[7] == 0xffffffc0233b6880 s[8] == 0x0000000000000084 s[9] == 0x0000000000000002 s[10] == 0x0000000000000000 s[11] == 0xffffffc0009d9b14 a[0] == 0x0000000000000001 a[1] == 0x0000000000000042 a[2] == 0xffffffc023483c00 a[3] == 0x0000000000000001 a[4] == 0xf548629906554a1b a[5] == 0xffffffc000254ca8 a[6] == 0xffffffffffffffff a[7] == 0x0000000000000001 sepc == 0xffffffc00072fb4a sstatus == 0x0000000200000120 stval == 0x0000006f69746184 scause == 0x000000000000000d panic: Fatal page fault at 0xffffffc00072fb4a: 0x6f69746184 Stopped at panic+0xfc: addi a0,zero,256 TID PID UID PR FLAGS PFLAGS CPU COMMAND 85875 99057 1000 0x100003 0 4 cvs 466143 32996 1000 0x100003 0 5 cvs panic() at panic+0xfc do_trap_supervisor() at do_trap_supervisor+0x1f4 cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a _bpf_mtap() at _bpf_mtap+0x54 smte_rx_proc() at smte_rx_proc+0x104 smte_intr() at smte_intr+0x2a plic_irq_dispatch() at plic_irq_dispatch+0xea plic_irq_handler() at plic_irq_handler+0x4e riscv_cpu_intr() at riscv_cpu_intr+0x2a cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a sched_idle() at sched_idle+0x18c proc_trampoline() at proc_trampoline+0xc end trace frame: 0x0, count: 3 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> show pool POOLt[0] == 0xffffffc1262fb4b0 t[1] == 0xffffffc0002460d0 t[2] == 0xffffffc000a9fdf1 t[3] == 0xffffffc000a34f0e t[4] == 0x0000000f22674000 t[5] == 0x00000000051eb850 t[6] == 0x00000000028f5c28 s[0] == 0xffffffc1262fb350 s[1] == 0x0000000000000073 s[2] == 0xffffffffffffffff s[3] == 0x0000000000000000 s[4] == 0x0000000000000000 s[5] == 0x0000000000000000 s[6] == 0x80e7000010974601 s[7] == 0x0000000000000000 s[8] == 0x000000000000000a s[9] == 0xffffffc000873ba3 s[10] == 0x0000000000000000 s[11] == 0x0000000000000005 a[0] == 0x80e7000010974601 a[1] == 0x0000000000000000 a[2] == 0x80e7000010974601 a[3] == 0x0000000000000000 a[4] == 0x0000000000000009 a[5] == 0x0000000000000001 a[6] == 0x0000000000000000 a[7] == 0x0000000000000000 sepc == 0xffffffc00042028c sstatus == 0x0000000200000120 stval == 0x0000000010974601 scause == 0x000000000000000d panic: Fatal page fault at 0xffffffc00042028c: 0x10974601 Stopped at panic+0xfc: addi a0,zero,256panic() at panic+0xfc do_trap_supervisor() at do_trap_supervisor+0x1f4 cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a kprintf() at kprintf+0x73a db_printf() at db_printf+0x4e pool_print1() at pool_print1+0x48 db_command() at db_command+0x298 db_command_loop() at db_command_loop+0xda db_trap() at db_trap+0x122 kdb_trap() at kdb_trap+0xc6 db_trapper() at db_trapper+0x1e cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a panic() at panic+0xfc do_trap_supervisor() at do_trap_supervisor+0x1f4 end trace frame: 0xffffffc1262fb9a0, count: 0 ddb{0}> bo re rebooting... OpenBSD/riscv64 (jupiter.leard.wxcvbn.org) (console) login: 35/0007.: trying to send packet on wrong domain. if 775434288 vs. mbuf 0 panic: kernel diagnostic assertion "idx < SMTE_NRXDESC" failed: file "/usr/src/ sys/arch/riscv64/dev/if_smte.c", line 831 Stopped at panic+0xfc: addi a0,zero,256 TID PID UID PR FLAGS PFLAGS CPU COMMAND panic() at panic+0xfc panic() at panic smte_rx_proc() at smte_rx_proc+0x17a smte_intr() at smte_intr+0x2a plic_irq_dispatch() at plic_irq_dispatch+0xea plic_irq_handler() at plic_irq_handler+0x4e riscv_cpu_intr() at riscv_cpu_intr+0x2a cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a sched_idle() at sched_idle+0x18c proc_trampoline() at proc_trampoline+0xc end trace frame: 0x0, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> show pool POOLt[0] == 0xffffffc1262fb750 t[1] == 0xffffffc0002460d0 t[2] == 0xffffffc000a9fdf1 t[3] == 0xffffffc000a34f0e t[4] == 0x0000000007920000 t[5] == 0x000000000000000c t[6] == 0x000000000791f000 s[0] == 0xffffffc1262fb5f0 s[1] == 0x0000000000000073 s[2] == 0xffffffffffffffff s[3] == 0x0000000000000000 s[4] == 0x0000000000000000 s[5] == 0x0000000000000000 s[6] == 0x80e7000010974601 s[7] == 0x0000000000000000 s[8] == 0x000000000000000a s[9] == 0xffffffc000873ba3 s[10] == 0x0000000000000000 s[11] == 0x0000000000000005 a[0] == 0x80e7000010974601 a[1] == 0x0000000000000000 a[2] == 0x80e7000010974601 a[3] == 0x0000000000000000 a[4] == 0x0000000000000009 a[5] == 0x0000000000000001 a[6] == 0x0000000000000000 a[7] == 0x0000000000000000 sepc == 0xffffffc00042028c sstatus == 0x0000000200000120 stval == 0x0000000010974601 scause == 0x000000000000000d panic: Fatal page fault at 0xffffffc00042028c: 0x10974601 Stopped at panic+0xfc: addi a0,zero,256panic() at panic+0xfc do_trap_supervisor() at do_trap_supervisor+0x1f4 cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a kprintf() at kprintf+0x73a db_printf() at db_printf+0x4e pool_print1() at pool_print1+0x48 db_command() at db_command+0x298 db_command_loop() at db_command_loop+0xda db_trap() at db_trap+0x122 kdb_trap() at kdb_trap+0xc6 db_trapper() at db_trapper+0x1e cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x7a panic() at panic+0xfc panic() at panic end trace frame: 0xffffffc1262fbc00, count: 0 ddb{0}> bo re rebooting... -- jca
