kern/57258: kthread_fpu_enter/exit problem

[prlw1%cam.ac.uk@localhost]

>Number:         57258
>Category:       kern
>Synopsis:       kthread_fpu_enter/exit problem
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 04 07:45:00 +0000 2023
>Originator:     Patrick Welche
>Release:        NetBSD-10.99.2/amd64
>Organization:
>Environment:
>Description:
A kernel built with amd64/locore.S 1.216 having AMD Ryzen 7 5700X cpu panics on boot with:

Configuring CGD
[   4.4533308] fatal protection fault in supervisor mode
[   4.4633307] trap type 4 code 0 rip 0xffffffff802363c4 cs 0x8 rflags 0x10256 cr2 0 ilevel 0x8 rsp 0xffffc510aada2d58
[   4.4733305] curlwp 0xffffe98c5ae24340 pid 0.877 lowest kstack 0xffffc510aad9e2c0

kernel: protection fault trap, code=0                                           
Stopped in pid 0.1371 (system) at       netbsd:xrstor64+0xa:    fxsaveq         
xrstor64() at netbsd:xrstor64+0xa                                               
sleepq_block() at netbsd:sleepq_block+0x13a                                     
cv_wait() at netbsd:cv_wait+0xb7                                                
workqueue_worker() at netbsd:workqueue_worker+0x125                             

crash> show proc/a 0xffffe98c5ae24340
lwp_t ffffe98c5ae24340
system: pid 0 proc ffffffff81069140 vmspace/map ffffffff81122420 flags 20002
> lwp 877 [cgd/5] ffffe98c5ae24340 pcb ffffc510aad9e000
    stat 7 flags 600 cpu 5 pri 123 ref 0

(gdb) print *(struct pcb *)0xffffc510aad9e000
$1 = {pcb_flags = 0, pcb_cr0 = 2147811379, pcb_rsp0 = 18446679274109415408, pcb_cr2 = 0, 
  pcb_cr3 = 21565440, pcb_rsp = 18446679274109414752, pcb_rbp = 18446679274109414896, 
  pcb_onfault = 0x0, pcb_fs = 0, pcb_gs = 0, pcb_dbregs = 0x0, pcb_fpu_dflt_cw = 0, pcb_iopl = 0, 
  pcb_unused = {0, 0, 0, 0, 0, 0, 0, 0}, pcb_savefpu = {sv_87 = {s87_cw = 59904, s87_sw = 32639, 
      s87_tw = 37712, s87_ip = {fa_64 = 32639, fa_32 = {fa_off = 32639, fa_seg = 0, fa_opcode = 0}}, 
      s87_dp = {fa_64 = 17865305007633465344, fa_32 = {fa_off = 0, fa_seg = 20544, fa_opcode = 63470}}, 
      s87_ac = {{f87_mantissa = 17865304732755591039, f87_exp_sign = 32639}, {f87_mantissa = 268435456, 
          f87_exp_sign = 0}, {f87_mantissa = 51539607554, f87_exp_sign = 12}, {f87_mantissa = 0, 
          f87_exp_sign = 0}, {f87_mantissa = 17865307069217767424, f87_exp_sign = 32639}, {
          f87_mantissa = 0, f87_exp_sign = 0}, {f87_mantissa = 140187597193216, f87_exp_sign = 0}, {
          f87_mantissa = 0, f87_exp_sign = 0}}}, sv_xmm = {fx_cw = 59904, fx_sw = 65535, 
      fx_tw = 127 '\177', fx_zero = 127 '\177', fx_opcode = 0, fx_ip = {fa_64 = 140187597247312, 
        fa_32 = {fa_off = 4159673168, fa_seg = 32639, fa_opcode = 0}}, fx_dp = {fa_64 = 0, fa_32 = {
          fa_off = 0, fa_seg = 0, fa_opcode = 0}}, fx_mxcsr = 4159590464, fx_mxcsr_mask = 32639, 
      fx_87_ac = {{r = {f87_mantissa = 140187597164544, f87_exp_sign = 4096}}, {r = {
            f87_mantissa = 51539607554, f87_exp_sign = 12}}, {r = {f87_mantissa = 0, 
            f87_exp_sign = 21024}}, {r = {f87_mantissa = 0, f87_exp_sign = 49152}}, {r = {
            f87_mantissa = 0, f87_exp_sign = 0}}, {r = {f87_mantissa = 0, f87_exp_sign = 49152}}, {r = {
            f87_mantissa = 140187597266656, f87_exp_sign = 0}}, {r = {f87_mantissa = 140187597193280, 
            f87_exp_sign = 504}}}, fx_xmm = {{xmm_bytes = '\000' <repeats 15 times>}, {
          xmm_bytes = "\000\000\000\000\000\000\000\000\240\305\356\367\177\177\000"}, {
          xmm_bytes = "@\310\356\367\177\177\000\000\000\000\000\000\000\000\000"}, {
          xmm_bytes = '\000' <repeats 15 times>}, {
          xmm_bytes = "\000\000\000\000\000\000\000\000\340\302\356\367\177\177\000"}, {
          xmm_bytes = "\360\304\356\367\177\177\000\000\255\000\000\000\000\000\000"}, {
          xmm_bytes = "@\302\356\367\177\177\000\000\000\000\000\000\000\000\000"}, {
          xmm_bytes = "\204\302\356\367\177\177\000\000\026\000\000\000\000\000\000"}, {
          xmm_bytes = '\000' <repeats 15 times>}, {xmm_bytes = '\000' <repeats 15 times>}, {
          xmm_bytes = "\n\000\004\000\000\000\000\000\000\300\356\367\177\177\000"}, {
          xmm_bytes = " R\356\367\177\177\000\000\340\336\357\367\177\177\000"}, {
          xmm_bytes = "\000\000\000\000\000\000\000\000\b\275\356\367\177\177\000"}, {
          xmm_bytes = '\000' <repeats 15 times>}, {xmm_bytes = '\000' <repeats 15 times>}, {
          xmm_bytes = '\000' <repeats 15 times>}}, 
      fx_rsvd = '\000' <repeats 16 times>, "\021\000\000\000\342\341\341\341\001\004", '\000' <repeats 62 times>, "\022\000\000\000\000\000\000"}, sv_xsave_hdr = {
      xsh_fxsave = "\000\352\377\377\177\177\000\000P\223\357\367\177\177\000\000\000\000\000\000\000\000\000\000@P\356\367\177\177\000\000\000P\356\367\177\177\000\000\000\020\000\000\000\000\000\000\002\000\000\000\f\000\000\000\f", '\000' <repeats 15 times>, " R\356\367\177\177", '\000' <repeats 11 times>, "\300\356\367\177\177", '\000' <repeats 27 times>, "\300\356\367\177\177\000\000\340\336\357\367\177\177\000\000\000\000\000\000\000\000\000\000@\300\356\367\177\177\000\000\370\001", '\000' <repeats 30 times>, "\240\305\356\367\177\177\000\000@\310\356\367\177\177", '\000' <repeats 34 times>..., xsh_xstate_bv = 0, 
      xsh_xcomp_bv = 0, xsh_rsrvd = "\000\000\000\000\000\000\000", 
      xsh_reserved = '\000' <repeats 39 times>}}}

>How-To-Repeat:

>Fix:
riastradh@ has already reverted this.