Panic in 6.2-PRERELEASE with bge on amd64

[Sven Willenberger]

I am starting a new thread on this as what I had assumed was a panic in
nfsd turns out to be an issue with the bge driver. This is an amd64 box,
dual processor (SMP kernel) that happens to be running nfsd. About every
3-5 days the kernel panics and I have finally managed to get a core
dump. 
The system: FreeBSD 6.2-PRERELEASE #8: Tue Jan  2 10:57:39 EST 2007

The short and dirty of the dump:

# kgdb /usr/obj/usr/src/sys/MSPOOL/kernel.debug /var/crash/vmcore.0
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd".

Unread portion of the kernel message buffer:
lock order reversal: (sleepable after non-sleepable)
 1st 0xffffffff8836b010 bge0 (network driver) @ /usr/src/sys/dev/bge/if_bge.c:2675
 2nd 0xffffffff805f26b0 user map (user map) @ /usr/src/sys/vm/vm_map.c:3074
KDB: stack backtrace:
witness_checkorder() at witness_checkorder+0x4da
_sx_xlock() at _sx_xlock+0x51
vm_map_lookup() at vm_map_lookup+0x44
vm_fault() at vm_fault+0xba
trap_pfault() at trap_pfault+0x13c
trap() at trap+0x1f9
calltrap() at calltrap+0x5
--- trap 0xc, rip = 0xffffffff801d5f17, rsp = 0xffffffffb371ab50, rbp = 0xffffffffb371aba0 ---
bge_rxeof() at bge_rxeof+0x3b7
bge_intr() at bge_intr+0x1c8
ithread_loop() at ithread_loop+0x14c
fork_exit() at fork_exit+0xbb
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffffffb371ad00, rbp = 0 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x28
fault code              = supervisor write, page not present
instruction pointer     = 0x8:0xffffffff801d5f17
stack pointer           = 0x10:0xffffffffb371ab50
frame pointer           = 0x10:0xffffffffb371aba0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 28 (irq24: bge0)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 3d4h18m42s

#0  doadump () at pcpu.h:172
172     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:172
#1  0xffffffff802771b9 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xffffffff80276c4b in panic (fmt=0xffffffff8044160c "%s") at /usr/src/sys/kern/kern_shutdown.c:565
#3  0xffffffff803ebba6 in trap_fatal (frame=0xc, eva=18446742978291675136) at /usr/src/sys/amd64/amd64/trap.c:660
#4  0xffffffff803ebee3 in trap_pfault (frame=0xffffffffb371aaa0, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:573
#5  0xffffffff803ec0f9 in trap (frame=
      {tf_rdi = 0, tf_rsi = 0, tf_rdx = 1, tf_rcx = 499, tf_r8 = 2521427970, tf_r9 = -1099500152320, tf_rax = 0, tf_rbx = -1263948192, tf_rbp = -1284396128, tf_r10 = 0, tf_r11 = 0, tf_r12 = -2009681920, tf_r13 = 0, tf_r14 = 0, tf_r15 = -1099499984896, tf_trapno = 12, tf_addr = 40, tf_flags = -1263948192, tf_err = 2, tf_rip = -2145558761, tf_cs = 8, tf_rflags = 66071, tf_rsp = -1284396192, tf_ss = 16})
    at /usr/src/sys/amd64/amd64/trap.c:352
#6  0xffffffff803d779b in calltrap () at /usr/src/sys/amd64/amd64/exception.S:168
#7  0xffffffff801d5f17 in bge_rxeof (sc=0xffffffff8836b000) at /usr/src/sys/dev/bge/if_bge.c:2528
#8  0xffffffff801db818 in bge_intr (xsc=0x0) at /usr/src/sys/dev/bge/if_bge.c:2707
#9  0xffffffff8025f2bc in ithread_loop (arg=0xffffff0000b1b320) at /usr/src/sys/kern/kern_intr.c:682
#10 0xffffffff8025e00b in fork_exit (callout=0xffffffff8025f170 <ithread_loop>, arg=0xffffff0000b1b320, frame=0xffffffffb371ac50)
    at /usr/src/sys/kern/kern_fork.c:821
#11 0xffffffff803d7afe in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:394

If more information is needed (disassemble, etc) please let me know. In
the interim I may switch to either using the base100 ethernet port (fxp)
or turn off SMP.

Sven