kern/40726: uvm panic when xen guest re-mounts block device as rw

[Christoph_Egger%gmx.de@localhost]

>Number:         40726
>Category:       kern
>Synopsis:       uvm panic when xen guest re-mounts block device as rw
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 23 11:05:00 +0000 2009
>Originator:     Christoph Egger
>Release:        5.99.7 amd64 Xen
>Organization:
>Environment:
amd64 Xen Dom0
>Description:

Xen Dom0 booted with root-on-nfs.
guest image is on nfs.

Launch NetBSD/Xen amd64 PV DomU.

As soon as DomU wants to mount its / block device
rw, Dom0 crashes:

panic: kernel diagnostic assertion "pg != NULL" failed: file 
"sys/uvm/uvm_pager.c", line 522
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff802079fd cs e030 rflags 246 cr2  
ffffa000263aab5c cpl 0 rsp ffffa00026a36a00
Stopped in pid 0.46 (system) at netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x242
__kernassert() at netbsd:__kernassert+0x2d
uvm_pageratop() at netbsd:uvm_pageratop+0x61
nfs_doio() at netbsd:nfs_doio+0x1e6
nfssvc_iod() at netbsd:nfssvc_iod+0x181
ds          0x69d0
es          0x203
fs          0xe030
gs          0x272e
rdi         0
rsi         0xffffffff805a5cfc  printf+0xbc
rbp         0xffffa00026a36a00
rbx         0xffffa00026a36a10
rdx         0
rcx         0
rax         0x1
r8          0xffffa00026a36920
r9          0x1
r10         0xffffa00026a36920
r11         0xffffffff806b78c0  xenconscn_putc
r12         0x104
r13         0xffffffff80a403c8  __link_set_malloc_types_sym_M_PROP_ARRAY+0x58978

r14         0x1
r15         0xffffa0002756c5f8
rip         0xffffffff802079fd  breakpoint+0x5
cs          0xe030
rflags      0x246
rsp         0xffffa00026a36a00
ss          0xe02b
netbsd:breakpoint+0x5:  leave
db> 

>How-To-Repeat:
Boot NetBSD/Xen Dom0 with root-on-nfs.
Boot NetBSD/Xen amd64 PV DomU.

Boom.

>Fix: