panic: pmap_enter: attempted pmap_enter on 4MB page

Hello,

Yesterday our 5-CURRENT box panicked with panic: pmap_enter: attempted
pmap_enter on 4MB page.

uname -a:

FreeBSD turtle.stack.nl 5.1-CURRENT FreeBSD 5.1-CURRENT #15: Thu Oct  9 11:43:55 CEST 2003     jilles_at_turtle.stack.nl:/usr/obj/usr/src/sys/TURTLE  i386

This kernel includes a patch from Sam Leffler to
/usr/src/sys/netinet6/nd6.c to prevent panics which has been committed
now.

Beginning of dmesg:

Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 5.1-CURRENT #15: Thu Oct  9 11:43:55 CEST 2003
    jilles_at_turtle.stack.nl:/usr/obj/usr/src/sys/TURTLE
Preloaded elf kernel "/boot/kernel/kernel" at 0xc07e6000.
Preloaded elf module "/boot/kernel/acpi.ko" at 0xc07e6294.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD Athlon(tm) MP 2000+ (1666.74-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x662  Stepping = 2
  Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
  AMD Features=0xc0480000<MP,AMIE,DSP,3DNow!>
real memory  = 1073217536 (1023 MB)
avail memory = 1037123584 (989 MB)
Programming 24 pins in IOAPIC #0
IOAPIC #0 intpin 2 -> irq 0
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
 cpu0 (BSP): apic id:  1, version: 0x00040010, at 0xfee00000
 cpu1 (AP):  apic id:  0, version: 0x00040010, at 0xfee00000
 io0 (APIC): apic id:  2, version: 0x00170011, at 0xfec00000
Pentium Pro MTRR support enabled
...

gdb output:
Script started on Fri Oct 17 11:56:23 2003
# gdb -k kernel.debug.13 vmcore.13
GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...
panic: pmap_enter: attempted pmap_enter on 4MB page
panic messages:
---
panic: pmap_enter: attempted pmap_enter on 4MB page
cpuid = 1; lapic.id = 00000000
boot() called on cpu#1

syncing disks, buffers remaining... 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 6552 
giving up on 374 buffers
Uptime: 3d12h22m57s
Dumping 1023 MB
 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304 320 336 352 368 384 400 416 432 448 464 480 496 512 528 544 560 576 592 608 624 640 656 672 688 704 720 736 752 768 784 800 816 832 848 864 880 896 912 928 944 960 976 992 1008
---
Reading symbols from /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/acpi/acpi.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/acpi/acpi.ko.debug
Reading symbols from /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/fdescfs/fdescfs.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/fdescfs/fdescfs.ko.debug
Reading symbols from /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/linux/linux.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/TURTLE/modules/usr/src/sys/modules/linux/linux.ko.debug
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
240		dumping++;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc04d7041 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:372
#2  0xc04d7498 in panic () at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc0652014 in pmap_enter (pmap=0xc6d6e98c, va=689672192, m=0xc1a33ba0, 
    prot=5 '\005', wired=0) at /usr/src/sys/i386/i386/pmap.c:1897
#4  0xc0601482 in vm_fault (map=0xc6d6e8dc, vaddr=689672192, 
    fault_type=1 '\001', fault_flags=0) at /usr/src/sys/vm/vm_fault.c:903
#5  0xc0655af5 in trap_pfault (frame=0xe6215d48, usermode=1, eva=689675199)
    at /usr/src/sys/i386/i386/trap.c:709
#6  0xc0655694 in trap (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 134522240, tf_esi = 690202368, tf_ebp = -1077942584, tf_isp = -434021004, tf_ebx = 689329844, tf_edx = 1, tf_ecx = 0, tf_eax = 0, tf_trapno = 12, tf_err = 4, tf_eip = 689675199, tf_cs = 31, tf_eflags = 66050, tf_esp = -1077942628, tf_ss = 47})
    at /usr/src/sys/i386/i386/trap.c:317
#7  0xc063d938 in calltrap () at {standard input}:103
---Can't read userspace from dump, or kernel process---

(kgdb) frame 3
#3  0xc0652014 in pmap_enter (pmap=0xc6d6e98c, va=689672192, m=0xc1a33ba0, 
    prot=5 '\005', wired=0) at /usr/src/sys/i386/i386/pmap.c:1897
1897			panic("pmap_enter: invalid page directory pdir=%#jx, va=%#x\n",
(kgdb) l
1892	
1893		/*
1894		 * Page Directory table entry not valid, we need a new PT page
1895		 */
1896		if (pte == NULL) {
1897			panic("pmap_enter: invalid page directory pdir=%#jx, va=%#x\n",
1898				(uintmax_t)pmap->pm_pdir[PTDPTDI], va);
1899		}
1900	
1901		pa = VM_PAGE_TO_PHYS(m) & PG_FRAME;
(kgdb) l
1902		origpte = *pte;
1903		opa = origpte & PG_FRAME;
1904	
1905		if (origpte & PG_PS) {
1906			/*
1907			 * Yes, I know this will truncate upper address bits for PAE,
1908			 * but I'm actually more interested in the lower bits
1909			 */
1910			printf("pmap_enter: va %p, pte %p, origpte %p\n",
1911			    (void *)va, (void *)pte, (void *)(uintptr_t)origpte);
(kgdb) l
1912			panic("pmap_enter: attempted pmap_enter on 4MB page");
1913		}
1914	
1915		/*
1916		 * Mapping has not changed, must be protection or wiring change.
1917		 */
1918		if (origpte && (opa == pa)) {
1919			/*
1920			 * Wiring change, just update stats. We don't worry about
1921			 * wiring PT pages as they remain resident as long as there
(kgdb) p va
$1 = 689672192
(kgdb) p pte
$2 = (pt_entry_t *) 0xbfca46e4
(kgdb) p origpte
$3 = 3503345872
(kgdb) p (void *)va
$4 = (void *) 0x291b9000
(kgdb) p (void *)origpte
$5 = (void *) 0xd0d0d0d0
(kgdb) # 
# ^D
Script done on Fri Oct 17 12:03:23 2003