Re: kern/60522: evbppc/RB800 hits MI pmap KASSERT failure

[Nick Hudson <nick.hudson%gmx.co.uk@localhost>]

On 01/08/2026 04:55, rokuyama.rk%gmail.com@localhost via gnats wrote:
>> Number:         60522
>> Category:       kern
>> Synopsis:       evbppc/RB800 hits MI pmap KASSERT failure
>> Confidential:   no
>> Severity:       serious
>> Priority:       medium
>> Responsible:    kern-bug-people
>> State:          open
>> Class:          sw-bug
>> Submitter-Id:   net
>> Arrival-Date:   Sat Aug 01 03:55:00 +0000 2026
>> Originator:     Rin Okuyama
>> Release:        11.9.7
>> Organization:
> Internet Initiative Japan Inc.
>> Environment:
> NetBSD rb800.local 11.99.7 NetBSD 11.99.7 (RB800-$Revision: 1.41 $) #9: Sat Aug  1 11:40:53 JST 2026  rin@sakaizumii.local:/home/rin/src/sys/arch/evbppc/compile/RB800 evbppc
>> Description:
> On RB800 with option INSECURE enabled, a KASSERT in MI pmap fires:
> ```
> # cd /usr/tests/dev/fss && atf-run
> (snip)
> tp-start: 1785555213.589886, t_fss, 1
> tc-start: 1785555213.589970, basic
> [ 136.6130204] panic: kernel diagnostic assertion "!VM_PAGEMD_PVLIST_EMPTY_P(mdpg)" failed: file "../../../../uvm/pmap/pmap.c", line 1330
> [ 136.6348717] cpu0: Begin traceback...
> [ 136.6348717] 0x00d3e9d0: at vpanic+0x154
> [ 136.6432136] 0x00d3ea00: at kern_assert+0x60
> [ 136.6432136] 0x00d3ea40: at pmap_pte_protect+0x210
> [ 136.6538985] 0x00d3ea70: at pmap_pte_process+0x68
> [ 136.6538985] 0x00d3eaa0: at pmap_protect+0x70
> [ 136.6638310] 0x00d3eac0: at uvm_map_protect+0x268
> [ 136.6638310] 0x00d3eb10: at kobj_affix+0x1f4
> [ 136.6737622] 0x00d3eb30: at module_do_load+0x4ec
> [ 136.6737622] 0x00d3ebf0: at module_autoload+0x108
> [ 136.6846379] 0x00d3ec10: at spec_open+0x354
> [ 136.6846379] 0x00d3ec90: at VOP_OPEN+0x4c
> [ 136.6938266] 0x00d3ecc0: at vn_open+0x188
> [ 136.6938266] 0x00d3ede0: at do_open+0xac
> [ 136.6938266] 0x00d3ee40: at do_sys_openat+0x9c
> [ 136.7052636] 0x00d3ee80: at sys_open+0x2c
> [ 136.7052636] 0x00d3eeb0: at syscall+0x110
> [ 136.7151053] 0x00d3ef20: user SC trap #5 by 0xfdbf84ac: srr1=0x2d030
> [ 136.7242392]             r1=0xffff76d0 cr=0x20042242 xer=0 ctr=0xfdbf84a4
> [ 136.7242392] cpu0: End traceback...

Is this a regression? If so can you bisect please

Otherwise, please enable UVMHIST and dump pmaphist and pmapexechist after the panic.