kern/52252: uvm_km_check_empty panic when loading any module

[tho%netbsd.org@localhost]

>Number:         52252
>Category:       kern
>Synopsis:       uvm_km_check_empty panic when loading any module
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 22 22:00:00 +0000 2017
>Originator:     Anthony Mallet
>Release:        NetBSD 7.99.72 May 22 01:05:18 CEST 2017
>Organization:
>Environment:
System: NetBSD papyrus 7.99.72 NetBSD 7.99.72 (PAPYRUS) #12: Mon May 22
01:05:18 CEST 2017  troot@papyrus:/usr/obj/sys/arch/amd64/compile/PAPYRUS amd64
Architecture: x86_64
Machine: amd64
>Description:
Loading any module triggers a panic in uvm_km_check_empty(). This actually
happens as soon as uvm_km_alloc() allocates memory from module_map. The system
works otherwise fine, e.g. it boots, I can run gdb on the previous crash dump
etc.

Here is a backtrace excerpt:

#11 0xffffffff8046e3f5 in uvm_km_check_empty (
    map=map@entry=0xffffffff80a21780 <module_map_store>,
    start=<optimized out>, end=18446744071574720512)
    at /usr/src/sys/uvm/uvm_km.c:563
563                             panic("uvm_km_check_empty: va %p has pa 0x%llx",
(gdb) p/x va
$1 = 0xffffffff80c10000
(gdb) p/x pa
$2 = 0xc10000
(gdb) up
#12 0xffffffff80473ba9 in uvm_map (
    map=map@entry=0xffffffff80a21780 <module_map_store>,
    startp=startp@entry=0xfffffe810f4bca58, size=size@entry=4096,
    uobj=<optimized out>, uoffset=uoffset@entry=-1, align=<optimized out>,
    flags=<optimized out>, flags@entry=5923) at /usr/src/sys/uvm/uvm_map.c:1101
1101                    uvm_km_check_empty(map, *startp, *startp + size);
(gdb) up
#13 0xffffffff8046e53f in uvm_km_alloc (
    map=0xffffffff80a21780 <module_map_store>, size=size@entry=4096,
    align=align@entry=0, flags=flags@entry=1) at /usr/src/sys/uvm/uvm_km.c:621
621             if (__predict_false(uvm_map(map, &kva, size, obj, UVM_UNKNOWN_OFFSET,
#14 0xffffffff804cea8a in kobj_load (ko=ko@entry=0xfffffe822c176b08)
    at /usr/src/sys/kern/subr_kobj.c:429
429                     map_data_base = uvm_km_alloc(module_map, round_page(map_data_size),
(gdb) p map_data_size
$3 = 344
(gdb)

The module_map looks otherwise fine, e.g.
(gdb) p/x module_map.header.start
$6 = 0xffffffff84000000
(gdb) p/x module_map.header.end
$7 = 0xffffffff80c10000

The relevant parts of my config are:

options         MODULAR
makeoptions     COPTS="-O2 -fno-omit-frame-pointer"
#options        DIAGNOSTIC
options         DEBUG
options         LOCKDEBUG
makeoptions     DEBUG="-g"      # compile full symbol table

This has been happening for me for all -current kernels since January or so, on
two different machines with different hardware (although similar,
e.g. i915drkms). So I wonder if I have missed something new in my config, or
anything like this, that could explain that I am the only with this issue
... :)

>How-To-Repeat:
Load any module, e.g.
# modload /usr/obj/destdir.amd64/stand/amd64/7.99.72/modules/zlib/zlib.kmod

>Fix:
I have no clue, but any help about where/what to look for is appreciated :)