kern/40362: KASSERT in pmap_enter

[spz%NetBSD.org@localhost]

>Number:         40362
>Category:       kern
>Synopsis:       KASSERT in pmap_enter
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jan 10 21:40:01 +0000 2009
>Originator:     S.P.Zeidler
>Release:        NetBSD 5.0_BETA
>Organization:
        TNF
>Environment:
System: NetBSD pkgbuild.netbsd.org 5.0_BETA NetBSD 5.0_BETA (PKGBUILD.SCHED_M2) 
#4: Wed Jan 7 22:24:22 UTC 2009 
spz@ADMIN:/chroots/netbsd-5/src/sys/arch/amd64/compile/obj/PKGBUILD.SCHED_M2 
amd64
Architecture: x86_64
Machine: amd64
>Description:

panic: kernel diagnostic assertion "(opte & (PG_V | PG_W)) != PG_W" failed: 
file "/chroots/netbsd-5/src/sys/arch/x86/x86/pmap.c", line 636
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80501105 cs 8 rflags 246 cr2  7f7ff4309000 cpl 0 
rsp ffff800072448780
Stopped in pid 22948.1 (cc1plus) at     netbsd:breakpoint+0x5:  leave
db{1}> bt
breakpoint() at netbsd:breakpoint+0x5
cpu_Debugger() at netbsd:cpu_Debugger+0x9
panic() at netbsd:panic+0x260
__kernassert() at netbsd:__kernassert+0x2d
pmap_enter() at netbsd:pmap_enter+0xcd3
uvm_fault_internal() at netbsd:uvm_fault_internal+0xad9
trap() at netbsd:trap+0x875
--- trap (number 0) ---
0:
db{1}> sh reg
ds          0x8750
es          0x7
fs          0x8
gs          0x58ae
rdi         0
rsi         0x3f8
rbp         0xffff800072448780
rbx         0xffff8000724487a0
rdx         0x8
rcx         0
rax         0x1
r8          0xffffffff809d2eea  copyright+0x887aa
r9          0x1
r10         0xffff800072448690
r11         0x8
r12         0x100
r13         0xffffffff809e0ca8  copyright+0x96568
r14         0x1
r15         0x20526
rip         0xffffffff80501105  breakpoint+0x5
cs          0x8
rflags      0x246
rsp         0xffff800072448780
ss          0
netbsd:breakpoint+0x5:  leave
db{1}> mach cpu 0
using CPU 0
db{1}> bt
_kernel_lock() at netbsd:_kernel_lock+0x135
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x16
Xintr_ioapic_level1() at netbsd:Xintr_ioapic_level1+0xf7
--- interrupt ---
_kernel_lock() at netbsd:_kernel_lock+0x13c
biodone2() at netbsd:biodone2+0x7b
biointr() at netbsd:biointr+0x3c
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x50, trying 0xffff80006c8cfd70
Xsoftintr() at netbsd:Xsoftintr+0x50
--- interrupt ---
0:
db{1}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0x6
rsi         0xffffffff804ecb66  intr_biglock_wrapper+0x16
rbp         0xffff80006c8cfb58
rbx         0xc17587
rdx         0x6
rcx         0
rax         0
r8          0
r9          0
r10         0xffff80006c8cfc80
r11         0x8
r12         0x1
r13         0xffffffff80bbfcc0  cpu_info_primary
r14         0x6
r15         0xffff80006c34a3e0
rip         0xffffffff80409ec5  _kernel_lock+0x135
cs          0x8
rflags      0x297
rsp         0xffff80006c8cfb18
ss          0
netbsd:_kernel_lock+0x135:      movzbl  0x8808f4(%rip),%eax
db{1}> mach cpu 2
using CPU 2
db{1}> bt
bufq_fcfs_get() at netbsd:bufq_fcfs_get+0x1
rf_buf_queue_check() at netbsd:rf_buf_queue_check+0x27
rf_RaidIOThread() at netbsd:rf_RaidIOThread+0x141
db{1}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0xffff800007cd5100
rsi         0
rbp         0xffff80006ec4ac10
rbx         0x2
rdx         0x190
rcx         0
rax         0xffff800007cd5100
r8          0
r9          0x1
r10         0
r11         0x8
r12         0xffff800007d29108
r13         0xffff800007d29000
r14         0
r15         0xffff800007d290f8
rip         0xffffffff803e9321  bufq_fcfs_get+0x1
cs          0x8
rflags      0x246
rsp         0xffff80006ec4ac00
ss          0
netbsd:bufq_fcfs_get+0x1:       movq    0x18(%rdi),%rdi
db{1}> mach cpu 3
using CPU 3
db{1}> bt
x86_stihlt() at netbsd:x86_stihlt+0x6
x86_cpu_idle_halt() at netbsd:x86_cpu_idle_halt+0x34
idle_loop() at netbsd:idle_loop+0x198
Bad frame pointer: 0xffff80006c35b420

>How-To-Repeat:
        we'll see if that repeats yet
>Fix: