panic: trap when running qemu

[Thomas Klausner <wiz%NetBSD.org@localhost>]

Hi!

In the past week, I had two occurrence where I started a qemu with the
nvmm module loaded on NetBSD 10.99.12/amd64 from 2025-01-18 and had an
immediate panic.

I've stopped running qemu for now, but would like to do that again...

The panic itself is not very helpful:
savecore: reboot after panic: [ 483171.8109391] panic: trap

The backtrace of the kernel crashdump doesn't tell me more:

First time:
(gdb) bt
#0  0xffffffff80239af5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:708
#1  0xffffffff80de0755 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:91
#2  0xffffffff80e26273 in vpanic (fmt=fmt@entry=0xffffffff813aa191 "trap", ap=ap@entry=0xffffc8a4db31b898) at /usr/src/sys/kern/subr_prf.c:288
#3  0xffffffff80e26348 in panic (fmt=fmt@entry=0xffffffff813aa191 "trap") at /usr/src/sys/kern/subr_prf.c:209
#4  0xffffffff8023c82d in trap (frame=0xffffc8a4db31b9e0) at /usr/src/sys/arch/amd64/amd64/trap.c:325
#5  0xffffffff80234ad4 in alltraps ()
#6  0xffffffff805af065 in pmap_unmap_ptes (pmap=<optimized out>, pmap2=0x0) at /usr/src/sys/arch/x86/x86/pmap.c:873
#7  0xffffffff805b03e7 in pmap_enter_ma (pmap=0xffff8b6987774200, va=<optimized out>, ma=<optimized out>, pa=102667816960, prot=prot@entry=5, flags=flags@entry=36, domid=domid@entry=0)
    at /usr/src/sys/arch/x86/x86/pmap.c:5188
#8  0xffffffff805b0f64 in pmap_enter_default (pmap=<optimized out>, va=<optimized out>, pa=<optimized out>, prot=prot@entry=5, flags=flags@entry=36) at /usr/src/sys/arch/x86/x86/pmap.c:4977
#9  0xffffffff80d77ced in uvm_fault_lower_enter (ufi=ufi@entry=0xffffc8a4db31bd60, flt=flt@entry=0xffffc8a4db31bd98, uobj=uobj@entry=0xffff8b7a938e0300, anon=0x0, pg=0xffffc88037830900)
    at /usr/src/sys/uvm/uvm_fault.c:2509
#10 0xffffffff80d795a5 in uvm_fault_lower_promote (uobjpage=<optimized out>, uobj=<optimized out>, flt=<optimized out>, ufi=<optimized out>) at /usr/src/sys/uvm/uvm_fault.c:2449
#11 uvm_fault_lower (pages=0xffffc8a4db31be50, flt=0xffffc8a4db31bd98, ufi=0xffffc8a4db31bd60) at /usr/src/sys/uvm/uvm_fault.c:1964
#12 uvm_fault_internal (orig_map=orig_map@entry=0xffff8b7b2bf43580, vaddr=vaddr@entry=129166812004352, access_type=access_type@entry=4, fault_flag=fault_flag@entry=0)
    at /usr/src/sys/uvm/uvm_fault.c:946
#13 0xffffffff8023c090 in trap (frame=0xffffc8a4db31c000) at /usr/src/sys/arch/amd64/amd64/trap.c:519
#14 0xffffffff80234ad4 in alltraps ()

Second time:
(gdb) bt
#0  0xffffffff80239af5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:708
#1  0xffffffff80de0755 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:91
#2  0xffffffff80e26273 in vpanic (fmt=fmt@entry=0xffffffff813aa191 "trap", ap=ap@entry=0xffffae2490b22898) at /usr/src/sys/kern/subr_prf.c:288
#3  0xffffffff80e26348 in panic (fmt=fmt@entry=0xffffffff813aa191 "trap") at /usr/src/sys/kern/subr_prf.c:209
#4  0xffffffff8023c82d in trap (frame=0xffffae2490b229e0) at /usr/src/sys/arch/amd64/amd64/trap.c:325
#5  0xffffffff80234ad4 in alltraps ()
#6  0xffffffff805af065 in pmap_unmap_ptes (pmap=<optimized out>, pmap2=0x0) at /usr/src/sys/arch/x86/x86/pmap.c:873
#7  0xffffffff805b03e7 in pmap_enter_ma (pmap=0xffff96607f65c400, va=<optimized out>, ma=<optimized out>, pa=110663139328, prot=prot@entry=5, flags=flags@entry=36, domid=domid@entry=0)
    at /usr/src/sys/arch/x86/x86/pmap.c:5188
#8  0xffffffff805b0f64 in pmap_enter_default (pmap=<optimized out>, va=<optimized out>, pa=<optimized out>, prot=prot@entry=5, flags=flags@entry=36) at /usr/src/sys/arch/x86/x86/pmap.c:4977
#9  0xffffffff80d77ced in uvm_fault_lower_enter (ufi=ufi@entry=0xffffae2490b22d60, flt=flt@entry=0xffffae2490b22d98, uobj=uobj@entry=0xffff966951141880, anon=0x0, pg=0xffffae0046678080)
    at /usr/src/sys/uvm/uvm_fault.c:2509
#10 0xffffffff80d795a5 in uvm_fault_lower_promote (uobjpage=<optimized out>, uobj=<optimized out>, flt=<optimized out>, ufi=<optimized out>) at /usr/src/sys/uvm/uvm_fault.c:2449
#11 uvm_fault_lower (pages=0xffffae2490b22e50, flt=0xffffae2490b22d98, ufi=0xffffae2490b22d60) at /usr/src/sys/uvm/uvm_fault.c:1964
#12 uvm_fault_internal (orig_map=orig_map@entry=0xffff96716ea37580, vaddr=vaddr@entry=14704640, access_type=access_type@entry=4, fault_flag=fault_flag@entry=0)
    at /usr/src/sys/uvm/uvm_fault.c:946
#13 0xffffffff8023c090 in trap (frame=0xffffae2490b23000) at /usr/src/sys/arch/amd64/amd64/trap.c:519
#14 0xffffffff80234ad4 in alltraps ()


The qemu command line:
#!/bin/sh
qemu-system-i386 \
        -accel nvmm \
        -m 4G \
        -name "NetBSD 9" \
        -object rng-random,filename=/dev/urandom,id=viornd0 \
        -device virtio-rng-pci,rng=viornd0 \
        -device virtio-net,netdev=n0 \
        -netdev tap,fd=3,id=n0 \
        -drive file=NetBSD-9.qcow2,if=none,id=hd0 \
        -device virtio-blk-pci,drive=hd0 \
        -display curses \
        3<>/dev/tap0

The nvmm module is from the same date as the kernel itself.

Any ideas? Time for a bug report?
 Thomas