>>  If this is where I think it is, it looks like the kernel is processing a
>>user TLB modify exception [pmap has set the page to read-only, and uses
>>the TLBmod exception to emulate page-modification status].  The kernel
>>TLB miss appears to be occuring when the TLBmod exception handler is
>>trying to load the first-level page table entry.
>>
>>                pmap  = p->p_vmspace->vm_map.pmap;
>>                if (!(pte = pmap_segmap(pmap, vaddr)))
>
> I threw in the printfs, they showed (1 out of 1 try) that pmap was not NULL, 
> but pmap->pm_segtab was.

It's weird.  'pm_segtab' entry should never be NULL except for kernel map.

Does your kernel have 'MIPS1' only configuration?  Do you have any
differnces with kernel w/ 'MIPS1' and 'MIPS3' for your DS3100?

Tohru Nishimura