panic: _mtx_lock_sleep: recursed on non-recursive mutex pmap

Hi,

On today's CURRENT I get panic.

Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 7.0-CURRENT #28: Fri Apr 28 16:34:14 ULAST 2006
    tsgan_at_gw.micom.mng.net:/usr/obj/usr/src/sys/GW
WARNING: WITNESS option enabled, expect reduced performance.
ACPI APIC Table: <INTEL  D865PERL>
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Pentium(R) 4 CPU 2.40GHz (2394.01-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf29  Stepping = 9
  
Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x4400<CNTX-ID,XTPR>
real memory  = 266534912 (254 MB)
avail memory = 251121664 (239 MB)
ioapic0 <Version 2.0> irqs 0-23 on motherboard
kbd1 at kbdmux0
acpi0: <INTEL D865PERL> on motherboard
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
cpu0: <ACPI CPU> on acpi0
acpi_throttle0: <ACPI CPU Throttling> on cpu0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <Intel 82865 host to AGP bridge> on hostb0
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pci1: <ACPI PCI bus> on pcib1
vgapci0: <VGA-compatible display> mem 
0xf7000000-0xf7ffffff,0xfa000000-0xfbffffff irq 16 at device 0.0 on pci1
uhci0: <Intel 82801EB (ICH5) USB controller USB-A> port 0xcc00-0xcc1f 
irq 16 at device 29.0 on pci0
uhci0: [GIANT-LOCKED]
usb0: <Intel 82801EB (ICH5) USB controller USB-A> on uhci0
usb0: USB revision 1.0
uhub0: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
uhub0: 2 ports with 2 removable, self powered
uhci1: <Intel 82801EB (ICH5) USB controller USB-B> port 0xd000-0xd01f 
irq 19 at device 29.1 on pci0
uhci1: [GIANT-LOCKED]
usb1: <Intel 82801EB (ICH5) USB controller USB-B> on uhci1
usb1: USB revision 1.0
uhub1: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb1
uhub1: 2 ports with 2 removable, self powered
uhci2: <Intel 82801EB (ICH5) USB controller USB-C> port 0xd400-0xd41f 
irq 18 at device 29.2 on pci0
uhci2: [GIANT-LOCKED]
usb2: <Intel 82801EB (ICH5) USB controller USB-C> on uhci2
usb2: USB revision 1.0
uhub2: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb2
uhub2: 2 ports with 2 removable, self powered
uhci3: <Intel 82801EB (ICH5) USB controller USB-D> port 0xd800-0xd81f 
irq 16 at device 29.3 on pci0
uhci3: [GIANT-LOCKED]
usb3: <Intel 82801EB (ICH5) USB controller USB-D> on uhci3
usb3: USB revision 1.0
uhub3: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb3
uhub3: 2 ports with 2 removable, self powered
ehci0: <Intel 82801EB/R (ICH5) USB 2.0 controller> mem 
0xf9100000-0xf91003ff irq 23 at device 29.7 on pci0
ehci0: [GIANT-LOCKED]
usb4: EHCI version 1.0
usb4: companion controllers, 2 ports each: usb0 usb1 usb2 usb3
usb4: <Intel 82801EB/R (ICH5) USB 2.0 controller> on ehci0
usb4: USB revision 2.0
uhub4: <Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb4
uhub4: 8 ports with 8 removable, self powered
pcib2: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci2: <ACPI PCI bus> on pcib2
rl0: <RealTek 8139 10/100BaseTX> port 0xb800-0xb8ff mem 
0xf9020000-0xf90200ff irq 17 at device 2.0 on pci2
miibus0: <MII bus> on rl0
rlphy0: <RealTek internal media interface> on miibus0
rlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
rl0: Ethernet address: 00:50:bf:1c:bb:cd
my0: <Myson MTD80X Based Fast Ethernet Card> port 0xb400-0xb4ff mem 
0xf9020400-0xf90207ff irq 18 at device 4.0 on pci2
my0: autoneg not complete, my0: no carrier
my0: Ethernet address: 00:a1:b0:08:c7:37
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH5 UDMA100 controller> port 
0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf at device 31.1 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
atapci1: <Intel ICH5 SATA150 controller> port 
0xec00-0xec07,0xe800-0xe803,0xe400-0xe407,0xe000-0xe003,0xdc00-0xdc0f 
irq 18 at device 31.2 on pci0
ata2: <ATA channel 0> on atapci1
ata3: <ATA channel 1> on atapci1
pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
pci0: <multimedia, audio> at device 31.5 (no driver attached)
acpi_button0: <Sleep Button> on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
sio0: configured irq 4 not in bitmap of probed irqs 0
sio0: port may not be enabled
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on 
acpi0
sio0: type 16550A, console
sio0: [FAST]
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio1: configured irq 3 not in bitmap of probed irqs 0
sio1: port may not be enabled
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 2394013872 Hz quality 800
Timecounters tick every 1.000 msec
ipfw2 (+ipv6) initialized, divert loadable, rule-based forwarding 
enabled, default to accept, logging limited to 100 packets/entry by default
ad0: DMA limited to UDMA33, controller found non-ATA66 cable
ad0: 28629MB <Seagate ST330630A 3.17> at ata0-master UDMA33
ad1: DMA limited to UDMA33, controller found non-ATA66 cable
ad1: 28629MB <Seagate ST330630A 3.17> at ata0-slave UDMA33
acd0: CDROM <SAMSUNG CD-ROM SC-152A/C201> at ata1-master PIO4
ad3: 28629MB <Seagate ST330620A 3.28> at ata1-slave UDMA100
Trying to mount root from ufs:/dev/ad0s1a
lock order reversal:
 1st 0xc150e0a8 pmap (pmap) _at_ /usr/src/sys/i386/i386/pmap.c:2111
 2nd 0xc104c078 system map (system map) _at_ /usr/src/sys/vm/vm_map.c:1096
KDB: stack backtrace:
kdb_backtrace(0,ffffffff,c07c9398,c07c9460,c078e284) at kdb_backtrace+0x29
witness_checkorder(c104c078,9,c0730429,448) at witness_checkorder+0x586
_mtx_lock_flags(c104c078,0,c0730429,448) at _mtx_lock_flags+0x6b
_vm_map_lock(c104c000,c0730429,448) at _vm_map_lock+0x23
vm_map_find(c104c000,0,0,0,cb29ba68,1000,1,7,7,4) at vm_map_find+0x2d
kmem_alloc_nofault(c104c000,1000,c06d02a3,c0814138,c122f8b8) at 
kmem_alloc_nofault+0x37
get_pv_entry(c150e0a8,0,0,bfefeffc,cb29badc) at get_pv_entry+0x110
pmap_insert_entry(c150e0a8,bfbff000,c122f8b8,0,c122d428) at 
pmap_insert_entry+0x3e
pmap_enter(c150e0a8,bfbff000,c122f8b8,7,0,c103f168,0,c072fe72,380) at 
pmap_enter+0x1de
vm_fault(c150e000,bfbff000,2,8,c1501360) at vm_fault+0x10a4
trap_pfault(cb29bc90,0,bfbfffff) at trap_pfault+0xce
trap(c1500008,c0730028,28,c078936a,bfbfffff) at trap+0x401
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc06d29a1, esp = 0xcb29bcd0, ebp = 0xcb29bd0c ---
subyte(0,cb29bd38) at subyte+0x25
fork_exit(c054487c,0,cb29bd38) at fork_exit+0xa4
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xcb29bd6c, ebp = 0 ---
panic: _mtx_lock_sleep: recursed on non-recursive mutex pmap _at_ 
/usr/src/sys/i386/i386/pmap.c:1843

KDB: enter: panic
[thread pid 1 tid 100007 ]
Stopped at      kdb_enter+0x2b: nop
db> trace
Tracing pid 1 tid 100007 td 0xc1501360
kdb_enter(c07178b8) at kdb_enter+0x2b
panic(c07167cf,c07356bc,c073895e,733,c1501404) at panic+0xbb
_mtx_lock_sleep(c08338e0,c1501360,0,c073895e,733) at _mtx_lock_sleep+0x39
_mtx_lock_flags(c08338e0,0,c073895e,733,0) at _mtx_lock_flags+0x94
pmap_remove(c08338e0,cc612000,cc613000) at pmap_remove+0x59
vm_map_delete(c104c000,cc612000,cc613000,c1230200,cc612000) at 
vm_map_delete+0x159
vm_map_remove(c104c000,cc612000,cc613000,cb29ba3c,c06cfee7) at 
vm_map_remove+0x42
kmem_free(c104c000,cc612000,1000,c0814138,0) at kmem_free+0x25
free_pv_entry(c08338e0,cc612040,c122fd80,6a31563,c08338e0) at 
free_pv_entry+0x1cf
pmap_remove_entry(c08338e0,c122fd80,ca988000) at pmap_remove_entry+0xa8
pmap_remove_pte(c08338e0,bff2a620,ca988000) at pmap_remove_pte+0xc6
pmap_remove(c08338e0,ca948000,ca98a000) at pmap_remove+0x114
vm_map_delete(c10430a8,ca948000,ca98a000,c10430a8,c0730281,1d2) at 
vm_map_delete+0x159
kmem_free_wakeup(c10430a8,ca948000,41400,c14fed80,cb29bc5c) at 
kmem_free_wakeup+0x38
exec_free_args(cb29bc90) at exec_free_args+0x1e
do_execve(c1501360,cb29bc90,0,cb29bc90,bfbffff2) at do_execve+0xb43
kern_execve(c1501360,cb29bc90,0) at kern_execve+0x7c
execve(c1501360,cb29bcf0,bfbfffe4,bfbffff2,bfbfffe8,bfbffffd,bfbfffec,0) 
at execve+0x2f
start_init(0,cb29bd38) at start_init+0x20b
fork_exit(c054487c,0,cb29bd38) at fork_exit+0xa4
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xcb29bd6c, ebp = 0x3b ---
db> wh
Tracing pid 1 tid 100007 td 0xc1501360
kdb_enter(c07178b8) at kdb_enter+0x2b
panic(c07167cf,c07356bc,c073895e,733,c1501404) at panic+0xbb
_mtx_lock_sleep(c08338e0,c1501360,0,c073895e,733) at _mtx_lock_sleep+0x39
_mtx_lock_flags(c08338e0,0,c073895e,733,0) at _mtx_lock_flags+0x94
pmap_remove(c08338e0,cc612000,cc613000) at pmap_remove+0x59
vm_map_delete(c104c000,cc612000,cc613000,c1230200,cc612000) at 
vm_map_delete+0x159
vm_map_remove(c104c000,cc612000,cc613000,cb29ba3c,c06cfee7) at 
vm_map_remove+0x42
kmem_free(c104c000,cc612000,1000,c0814138,0) at kmem_free+0x25
free_pv_entry(c08338e0,cc612040,c122fd80,6a31563,c08338e0) at 
free_pv_entry+0x1cf
pmap_remove_entry(c08338e0,c122fd80,ca988000) at pmap_remove_entry+0xa8
pmap_remove_pte(c08338e0,bff2a620,ca988000) at pmap_remove_pte+0xc6
pmap_remove(c08338e0,ca948000,ca98a000) at pmap_remove+0x114
vm_map_delete(c10430a8,ca948000,ca98a000,c10430a8,c0730281,1d2) at 
vm_map_delete+0x159
kmem_free_wakeup(c10430a8,ca948000,41400,c14fed80,cb29bc5c) at 
kmem_free_wakeup+0x38
exec_free_args(cb29bc90) at exec_free_args+0x1e
do_execve(c1501360,cb29bc90,0,cb29bc90,bfbffff2) at do_execve+0xb43
kern_execve(c1501360,cb29bc90,0) at kern_execve+0x7c
execve(c1501360,cb29bcf0,bfbfffe4,bfbffff2,bfbfffe8,bfbffffd,bfbfffec,0) 
at execve+0x2f
start_init(0,cb29bd38) at start_init+0x20b
fork_exit(c054487c,0,cb29bd38) at fork_exit+0xa4
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xcb29bd6c, ebp = 0x3b ---
db>