kernel trap 19 with interrupts disabled

Hello,

An SMP box just crashed here, while building -j2 world. The source files were 
cvsup-synced yesterday around 20h00 GMT (13 august). The crashed happened 
around the end of the make buildworld phase (while building usr.sbin 
binaries).

As there was no recent significant commit, this must be a heisenbug >-(

	Cheers,

	TfH

PS : I enclose here a (hopefully meaningful) trace

FreeBSD 7.0-CURRENT #769: Sat Aug 13 21:17:55 CEST 2005
    XX_at_YYY:/usr/obj/usr/src/sys/GENERIC

Starting background file system checks in 60 seconds.

Sat Aug 13 22:16:00 CEST 2005

FreeBSD/i386 (XX) (ttyd0)

--- trap 0x1, eip = 0, esp = 0xc721cd6c, ebp = 0 ---
kernel trap 19 with interrupts disabled
NMI ... going to debugger
[thread pid 35245 tid 100178 ]
Stopped at      smp_tlb_shootdown+0x61: jb      smp_tlb_shootdown+0x58
db> where
Tracing pid 35245 tid 100178 td 0xc185dd80
smp_tlb_shootdown(f5,c3175000,c3179000) at smp_tlb_shootdown+0x61
smp_invlpg_range(c3175000,c3179000) at smp_invlpg_range+0x1c
pmap_invalidate_range(c09a40a0,c3175000,c3179000,c1118dc0,cb77fa6c) at 
pmap_invalidate_range+0x83
pmap_qremove(c3175000,4) at pmap_qremove+0x3d
vfs_vmio_release(c2ed9bd8) at vfs_vmio_release+0x120
getnewbuf(0,0,800,4000,0) at getnewbuf+0x276
getblk(c14c2dd0,0,0,800,0) at getblk+0x3a3
breadn(c14c2dd0,0,0,800,0) at breadn+0x31
bread(c14c2dd0,0,0,800,0) at bread+0x20
ffs_read(cb77fc08) at ffs_read+0x23f
VOP_READ_APV(c08f9a80,cb77fc08) at VOP_READ_APV+0x7e
ufs_readdir(cb77fc90) at ufs_readdir+0xd1
VOP_READDIR_APV(c08f9a80,cb77fc90) at VOP_READDIR_APV+0x7e
getdirentries(c185dd80,cb77fd04,4,25e5,246) at getdirentries+0x13f
syscall(805003b,805003b,bfbf003b,80533c0,80533c0) at syscall+0x22f
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (196, FreeBSD ELF32, getdirentries), eip = 0x2811afff, esp = 
0xbfbfebec, ebp = 0xbfbfec08 ---

# kgdb kernel.debug /files3/tmp/vmcore.162
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: 
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
kernel trap 19 with interrupts disabled
<2>NMI ISA 3c, EISA ff
NMI ... going to debugger
Dumping 95 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 95MB (24320 pages) 80 64 48 32 16

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
...
#21 0xc07ea6e1 in smp_tlb_shootdown (vector=245, addr1=0, addr2=0) at 
cpufunc.h:317
#22 0xc07ea868 in smp_invlpg_range (addr1=3273084928, addr2=3273101312)
    at /usr/src/sys/i386/i386/mp_machdep.c:1129
#23 0xc07ecbeb in pmap_invalidate_range (pmap=0xc09a40a0, sva=3273084928, 
eva=3273101312)
    at /usr/src/sys/i386/i386/pmap.c:606
#24 0xc07ed26d in pmap_qremove (sva=3273084928, count=0) 
at /usr/src/sys/i386/i386/pmap.c:966
#25 0xc06782e4 in vfs_vmio_release (bp=0xc2ed9bd8) 
at /usr/src/sys/kern/vfs_bio.c:1494
#26 0xc0678926 in getnewbuf (slpflag=0, slptimeo=0, size=2048, maxsize=16384)
    at /usr/src/sys/kern/vfs_bio.c:1775
#27 0xc0679c2b in getblk (vp=0xc14c2dd0, blkno=0, size=2048, slpflag=0, 
slptimeo=0, flags=0)
    at /usr/src/sys/kern/vfs_bio.c:2480
#28 0xc0676af9 in breadn (vp=0xc14c2dd0, blkno=0, size=2048, rablkno=0x0, 
rabsize=0x0, cnt=0,
    cred=0x0, bpp=0x0) at /usr/src/sys/kern/vfs_bio.c:738
#29 0xc0676ac4 in bread (vp=0xc14c2dd0, blkno=0, size=2048, cred=0x0, 
bpp=0xcb77fb90)
    at /usr/src/sys/kern/vfs_bio.c:719
#30 0xc077361f in ffs_read (ap=0x0) at /usr/src/sys/ufs/ffs/ffs_vnops.c:447
#31 0xc080195a in VOP_READ_APV (vop=0x0, a=0xcb77fc08) at vnode_if.c:643
#32 0xc077dd4d in ufs_readdir (ap=0xcb77fc90) at vnode_if.h:343
#33 0xc08023da in VOP_READDIR_APV (vop=0x0, a=0xcb77fc90) at vnode_if.c:1427
#34 0xc068e987 in getdirentries (td=0xc185dd80, uap=0xcb77fd04) at 
vnode_if.h:746
#35 0xc07f271b in syscall (frame=
      {tf_fs = 134545467, tf_es = 134545467, tf_ds = -1078001605, tf_edi = 
134558656, tf_esi = 134558656, tf_ebp = -1077941240, tf_isp = -881328796, 
tf_ebx = 672396968, tf_edx = 134624768, tf_ecx = 134561792, tf_eax = 196, 
tf_trapno = 0, tf_err = 2, tf_eip = 672247807, tf_cs = 51, tf_eflags = 582, 
tf_esp = -1077941268, tf_ss = 59}) at /usr/src/sys/i386/i386/trap.c:986
---Type <return> to continue, or q <return> to quit---
#36 0xc07dfa4f in Xint0x80_syscall () 
at /usr/src/sys/i386/i386/exception.s:200
....
(kgdb) frame 22
#22 0xc07ea868 in smp_invlpg_range (addr1=3273084928, addr2=3273101312)
    at /usr/src/sys/i386/i386/mp_machdep.c:1129
1129                    smp_tlb_shootdown(IPI_INVLRNG, addr1, addr2);
(kgdb) list
1124    void
1125    smp_invlpg_range(vm_offset_t addr1, vm_offset_t addr2)
1126    {
1127
1128            if (smp_started) {
1129                    smp_tlb_shootdown(IPI_INVLRNG, addr1, addr2);
1130    #ifdef COUNT_XINVLTLB_HITS
1131                    ipi_range++;
1132                    ipi_range_size += (addr2 - addr1) / PAGE_SIZE;
1133    #endif
(kgdb) frame 23
#23 0xc07ecbeb in pmap_invalidate_range (pmap=0xc09a40a0, sva=3273084928, 
eva=3273101312)
    at /usr/src/sys/i386/i386/pmap.c:606
606                     smp_invlpg_range(sva, eva);
(kgdb) list
601              * XXX critical sections disable interrupts again
602              */
603             if (pmap == kernel_pmap || pmap->pm_active == all_cpus) {
604                     for (addr = sva; addr < eva; addr += PAGE_SIZE)
605                             invlpg(addr);
606                     smp_invlpg_range(sva, eva);
607             } else {
608                     cpumask = PCPU_GET(cpumask);
609                     other_cpus = PCPU_GET(other_cpus);
610                     if (pmap->pm_active & cpumask)
(kgdb)

CVS idents of the source files :

/usr/src/sys/i386/i386/mp_machdep.c:
     $FreeBSD: src/sys/i386/i386/mp_machdep.c,v 1.252 2005/06/29 23:23:16 
peter Exp $
/usr/src/sys/i386/i386/pmap.c:
     $FreeBSD: src/sys/i386/i386/pmap.c,v 1.528 2005/08/11 23:38:02 alc Exp $
/usr/src/sys/kern/vfs_bio.c:
     $FreeBSD: src/sys/kern/vfs_bio.c,v 1.493 2005/08/03 05:02:08 jeff Exp $
/usr/src/sys/ufs/ffs/ffs_vnops.c:
     $FreeBSD: src/sys/ufs/ffs/ffs_vnops.c,v 1.157 2005/06/09 20:20:30 
ssouhlal Exp $