Crash while enable SMP

[hshh]

I have a server is running Apache with PHP-FCGI. It's dual XEON.While I
enable SMP, server will panic in anytime. The server is running very stable
while no SMP enabled. I changed the hardware except hard disk, but no
different, still panic.

# uname -a
FreeBSD test.hshh.org 6.1-RELEASE-p10 FreeBSD 6.1-RELEASE-p10 #0: Sat Dec  9
03:42:49 CST 2006     root at test.hshh.org:/usr/obj/usr/src/sys/SMP  i386

I added debugger to SMP kernel config file.
options         WITNESS
options         KDB
options         KDB_UNATTENDED


And after panic, it was coredump successfully. Attached backtrace
infomation. What's the problem? Please help.

# kgdb kernel.debug vmcore.0

[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so:
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
lock order reversal: (sleepable after non-sleepable)
 1st 0xc54771ec pmap (pmap) @ i386/i386/pmap.c:2714
 2nd 0xc066c3a4 user map (user map) @ vm/vm_map.c:2997


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc05e8e20
stack pointer           = 0x28:0xe3251bcc
frame pointer           = 0x28:0xe3251be0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 3 (g_up)
trap number             = 12
panic: page fault
cpuid = 0
Uptime: 1h15m10s
Dumping 1023 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 1023MB (261872 pages) 1007 991 975 959 943 927 911 895 879 863
847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559
543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255
239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt full
#0  doadump () at pcpu.h:165
No locals.
#1  0xc04d7b07 in boot (howto=260) at ../../../kern/kern_shutdown.c:402
        first_buf_printf = 1
#2  0xc04d7dcd in panic (fmt=0xc060cbcc "%s") at
../../../kern/kern_shutdown.c:558
        td = (struct thread *) 0xc46e7a80
        bootopt = 260
        newpanic = 1
        ap = 0xe3251b08 "¬ cÀ"
        buf = "page fault", '\0' <repeats 245 times>
#3  0xc05eb806 in trap_fatal (frame=0xe3251b8c, eva=0) at
../../../i386/i386/trap.c:836
        code = 40
        type = 12
        ss = 40
        esp = 0
        softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27, ssd_dpl
= 0, ssd_p = 1, ssd_xx = 4, ssd_xx1 = 0,
  ssd_def32 = 1, ssd_gran = 1}
        msg = 0x0
#4  0xc05eb50f in trap_pfault (frame=0xe3251b8c, usermode=0, eva=0) at
../../../i386/i386/trap.c:744
        va = 0
        vm = (struct vmspace *) 0x0
        map = 0xc066c360
        rv = 1
        ftype = 1 '\001'
        td = (struct thread *) 0xc46e7a80
        p = (struct proc *) 0xc475c418
#5  0xc05eb175 in trap (frame=
      {tf_fs = -1067253752, tf_es = -484114392, tf_ds = -1068761048, tf_edi
= -1048840664, tf_esi = 64, tf_ebp = -484107296, tf_isp = -484107336, tf_ebx
= -1040792712, tf_edx = 59, tf_ecx = 0, tf_eax = 0, tf_trapno = 12, tf_err =
0, tf_eip = -1067545056, tf_cs = 32, tf_eflags = 66182, tf_esp =
-1048840664, tf_ss = -484107288}) at ../../../i386/i386/trap.c:434
        td = (struct thread *) 0xc46e7a80
        p = (struct proc *) 0xc475c418
        sticks = 3810859920
        i = 0
        ucode = 0
        type = 12
        code = 0
        eva = 0
#6  0xc05d9baa in calltrap () at ../../../i386/i386/exception.s:139
No locals.
#7  0xc05e8e20 in pmap_clear_modify (m=0xc17bf628) at
../../../i386/i386/pmap.c:2715
No locals.
---Type <return> to continue, or q <return> to quit---
#8  0xc05bd115 in vm_page_set_validclean (m=0xc17bf628, base=0, size=4096)
at ../../../vm/vm_page.c:1530
        frag = 59
        endoff = 4096
#9  0xc051a66c in vfs_page_set_valid (bp=0xd897ede8, off=203522048,
pageno=0, m=0xc17bf628) at ../../../kern/vfs_bio.c:3265
        soff = 203522048
        eoff = Unhandled dwarf expression opcode 0x93
(kgdb)