kern/46481: page fault in uvmspace_free -> uvm_unmap_remove -> pmap_remove -> pmap_pdes_invalid

[dieter.NetBSD%pandora.be@localhost]

>Number:         46481
>Category:       kern
>Synopsis:       page fault in uvmspace_free -> uvm_unmap_remove -> pmap_remove 
>-> pmap_pdes_invalid
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri May 25 13:25:00 +0000 2012
>Originator:     dieter roelants
>Release:        6.0_BETA2
>Organization:
>Environment:
NetBSD 6.0_BETA2 (SIMULT.domu) #22: Thu May 24 08:43:03 CEST 2012
        dieter@netbsd-u2...:/build/obj/sys/arch/amd64/compile/SIMULT.domu
>Description:

I got the following on a amd64/Xen DOM-U (PV) which was compiling:

uvm_fault(0xffffffff8060fba0, 0x7fbfdfe00000, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff8022306f cs e030 rflags 10246 cr2  7fbfdfe00000 
cpl 0 rsp ffffa00045a3c9e0
kernel: page fault trap, code=0
Stopped in pid 4011.1 (as) at   netbsd:pmap_pdes_invalid+0x32:  movq    0(%rcx,%
r9,8),%rcx
pmap_pdes_invalid() at netbsd:pmap_pdes_invalid+0x32
pmap_remove() at netbsd:pmap_remove+0x87
uvm_unmap_remove() at netbsd:uvm_unmap_remove+0x1dd
uvmspace_free() at netbsd:uvmspace_free+0xd7
exit1() at netbsd:exit1+0x175
sys_exit() at netbsd:sys_exit+0x3e
syscall() at netbsd:syscall+0xc4
ds          0
es          40
fs          0
gs          4336
rdi         400000
rsi         ffffa000033744e0
rbp         ffffa00045a3c9e0
rbx         ffffa000093a2790
rdx         ffffa00045a3ca30
rcx         7fbfdfe00000
rax         3
r8          fffffffffffffffc
r9          0
r10         7f8000000000
r11         206
r12         7f8000000000
r13         ffffa0000a417090
r14         400000
r15         ffffa00003503990
rip         ffffffff8022306f    pmap_pdes_invalid+0x32
cs          e030
rflags      10246
rsp         ffffa00045a3c9e0
ss          e02b
netbsd:pmap_pdes_invalid+0x32:  movq    0(%rcx,%r9,8),%rcx

I left the system in ddb for now and can easily provide more info.
>How-To-Repeat:

>Fix: