port-arm/49061: armv4 crashes inside network interrupt

[martin%NetBSD.org@localhost]

>Number:         49061
>Category:       port-arm
>Synopsis:       armv4 crashes inside network interrupt
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    port-arm-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 01 18:40:00 +0000 2014
>Originator:     Martin Husemann
>Release:        NetBSD 6.99.49
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD night-rest.duskware.de 6.99.49 NetBSD 6.99.49 (EGENERIC) #21: 
Fri Aug 1 09:39:08 CEST 2014 
martin%seven-days-to-the-wolves.aprisoft.de@localhost:/usr/src/sys/arch/shark/compile/EGENERIC
 shark
Architecture: earmv4
Machine: shark
>Description:

Under load + using the network I can "often" (but not really reproducably)
crash my armv4 machine. Matt Thomas gave me a small patch as a workaround,
which is why the panic below is slightly odd - with that patch the problem
happens less often, but it is not solved.

Problem always shows a cs_interrupt causing some pmap action that hits
the KASSERT then.

Latest sample, from slightly patched kernel (see above):

data_abort_handler: data_aborts fsr=0x8621003 far=0x4030c071
panic: kernel diagnostic assertion "md == NULL || page_locked_p || !pmap_page_lo
cked_p(md)" failed: file "../../../../arch/arm/arm32/pmap.c", line 3786        
db> bt                                                                 
0xf607cb4c: netbsd:cpu_Debugger+0xc
0xf607cb64: netbsd:db_panic+0x24   
0xf607cb8c: netbsd:vpanic+0x20c 
0xf607cba4: netbsd:kern_assert+0x38
0xf607cc24: netbsd:pmap_kenter_pa+0x4b4
0xf607cc7c: netbsd:uvm_km_kmem_alloc+0x254
0xf607cca4: netbsd:pool_page_alloc+0x5c   
0xf607ccc4: netbsd:pool_allocator_alloc+0x3c
0xf607cce4: netbsd:pool_grow+0x3c           
0xf607cd04: netbsd:pool_catchup+0x2c
0xf607cd34: netbsd:pool_get+0x724   
0xf607cd84: netbsd:pool_cache_get_slow+0x328
0xf607cdc4: netbsd:pool_cache_get_paddr+0x31c
0xf607cdec: netbsd:m_get+0x80                
0xf607ce0c: netbsd:m_gethdr+0x24
0xf607ce54: netbsd:cs_process_rx_dma+0x1e8
0xf607ce6c: netbsd:cs_buffer_event+0x68   
0xf607ce94: netbsd:cs_intr+0x224       
0xf607cf14: netbsd:irq_entry+0x16c
0xf607cf34: netbsd:uvmpdpol_pagedeactivate+0x1a8
0xf607cf5c: netbsd:uvmpdpol_balancequeue+0xb8   
0xf607cf74: netbsd:uvmpd_scan+0xc4           
0xf607cfac: netbsd:uvm_pageout+0x1e8

>How-To-Repeat:
Stress your poor little armv4 while using the network.

>Fix:
n/a