kern/39908: pmap_remove_ptes panic

[Patrick Welche <prlw1%inf.phy.cam.ac.uk@localhost>]

>Number:         39908
>Category:       kern
>Synopsis:       pmap_remove_ptes panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 12 21:10:00 +0000 2008
>Originator:     Patrick Welche
>Release:        NetBSD-current/amd64
>Organization:
        
>Environment:
NetBSD-current/amd64 of Nov 12 2008 14:11 GMT (5.99.01)
so after
PR port-amd64/38293 panic: fp_save ipi didn't
Fix race conditions in FPU IPI handling.
(so different race condition in this panic)
with DEBUG and DIAGNOSTIC, building on raidframe mirrors, ffs + softdep.
>Description:
(copied by hand)
panic: pmap_remove_ptes: unmanaged page marked PG_PVLIST, va = 0x7f7ffd600000, 
pa = 0xfffffffff000
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff804bc5e5 cs 8 rflags 246 cr2  7f7ffd6fe330 cpl 0 
rsp ffff80004f93d8e0
Stopped in ..nbgroff..

breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x260
pmap_do_remove() at netbsd:pmap_do_remove+0x561
uvm_unmap_remove() at netbsd:uvm_unmap_remove+0x2d9
uvmspace_free() at netbsd:uvmspace_free+0x109
exit1()
sys_exit()
syscall()

ds  0x5080
es  0
fs  0xd8f0
gs  0xb930
rdi 0
rsi 0xffffffff80bdb000
rbp 0xffff80004f93d8e0
rbx 0xffff80004f93d8f0
rdx 0x8
ss  0x10 (rest as in message above, r# has copyright and pcdisplay_cursor)

the other cpu says:
uvm_fault(0xffffffff90a90090, 0x402000, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff804bdebc cs 8 rflags 10246 cr2  402180 cpl 8 rsp 
ffff80004f93d2f0
kernel: page fault trap, code=0
Faulted in DDB; continuing...

bother: didn't get a core dump so can't look at pmap anymore

>How-To-Repeat:
build -j5 on a AMD Athlon(tm) 64 X2. -j2 is unlikely to trigger it.
>Fix:
        

>Unformatted: