Nick,
New kernhist output, with the new trace calls you added to pmap_update, is at
https://gist.github.com/mfplass/4a96808d35e001ab49c4d0f44441632e
Have you been able to reproduce this panic?
I've been trying to figure out what might be causing these panics.
It would appear that the pm_remove_all flag is getting set in (arm32) pmap_remove rather than in
pmap_remove_all, and that in this case the assumption that there is only one onproc
cpu isn't true. The old version of pmap_tlb_asid_release_all() looks like it was prepared
to handle multiple onproc cpus, but sys/uvm/pmap/pmap_tlb.c:1.13 changed that.
I also notice that sys/uvm/pmap/pmap_tlb.c:1.13 changed several atomic
manipulations of kcpuset into non-atomic versions. Doesn't mean that
you can no longer rely on the atomic kcpuset calls in sys/arch/arm/arm32/pmap.c?