kern/46096: uvmwait test case sometimes panics kernel

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         46096
>Category:       kern
>Synopsis:       uvmwait test case sometimes panics kernel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Feb 25 16:10:01 +0000 2012
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2012.02.24.19.40.49
>Organization:
>Environment:
System: NetBSD
Architecture: i386
Machine: i386
>Description:

There have now been multiple incidents where a kernel panic has
occurred while running the uvmwait test case of the rump/rumpkern/t_vm
test, for example:

  http://releng.netbsd.org/b5reports/i386/build/2012.01.30.12.19.45/test.log
  http://www.gson.org/netbsd/bugs/build/build/2012.02.06.17.51.47/test.log
  
http://www.gson.org/netbsd/bugs/build.i386-debug/build/2012.02.24.19.40.49/test.log

The uvmwait test case has been consistently failing since the vmem
commits of January 29, which would be worthy of a PR in itself, but
this PR is specifically about the kernel panics, not the test failures.

Tracking down the problem should be easier than usual, because the
latest failure occurred on a test system that was built with full
debug symbols (using "build.sh -V MKDEBUG=yes -V DBG=-g"), installed
with full source, and run under a new test fixture that automatically
archived a full disk image of the failed system, including the kernel
crash dump.

This disk image is available for downloading at:

   http://www.gson.org/netbsd/bugs/i386-debug-2012.02.24.19.40.49.img.gz

The compressed image is 832 MB in size and decompresses to 4 GB.

To debug the problem while enjoying the comforts of source-level
debugging, download and gunzip the disk image, and then boot it with

  qemu -snapshot -nographic -hda i386-debug-2012.02.24.19.40.49.img

Note that you don't need to be running to i386 port, or even NetBSD,
to do this.

Log in as root (there is no password).  To help gdb find the kernel
sources, type:

  mkdir -p /tmp/bracket/build/2012.02.24.19.40.49-i386-debug
  ln -s /usr/src /tmp/bracket/build/2012.02.24.19.40.49-i386-debug/src

Then type:

  cd /var/crash
  gunzip netbsd*
  gdb /netbsd
  target kvm netbsd.0.core
  where

>How-To-Repeat:

Run the ATF tests enough times.  But there should be no need to
reproduce the problem since an exceptionally complete set of evidence
was collected from the latest crime scene.

>Fix: