panic: assertion: pmap->pm_stats.resident_count > 0 in pmap_release_free_page

[YONETANI Tomokazu]

On Mon, Dec 28, 2009 at 09:21:14PM -0800, Matthew Dillon wrote:
>     That's a better panic, for sure.  Here is another patch to try:
> 
> 	fetch http://apollo.backplane.com/DFlyMisc/pmap01.patch

Another panic from sys_vmspace_mcontrol by a slightly different workload
on vkernel (actually I caught two panics, but unfortunately the first
one ended up in an endless loop of some spinlock panics then locked up,
so all I could do was to press the reset switch).  The kernel and the vmcore
are at ~y0netan1/crash/{kern,vmcore}.23 .

#4  0xc01a14fc in panic (fmt=0xc03032de "assertion: %s in %s")
    at /usr/src/sys/kern/kern_shutdown.c:743
#5  0xc02d9376 in pmap_remove_entry (pmap=0xdaebd334,
    ptq=<value optimized out>, va=3217022976, info=0xdbb32c30)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1559
#6  pmap_remove_pte (pmap=0xdaebd334, ptq=<value optimized out>,
    va=3217022976, info=0xdbb32c30)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1640
#7  0xc02d991e in pmap_remove_page (pmap=0xdaebd334, sva=3217022976,
    eva=3217027072) at /usr/src/sys/platform/pc32/i386/pmap.c:1668
#8  pmap_remove (pmap=0xdaebd334, sva=3217022976, eva=3217027072)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1709
#9  0xc029c0d3 in vm_map_madvise (map=0xdaebd2b0, start=3217022976,
    end=3217027072, behav=10, value=0) at /usr/src/sys/vm/vm_map.c:1793
#10 0xc02a618a in sys_vmspace_mcontrol (uap=0xdbb32cf0)
    at /usr/src/sys/vm/vm_vmspace.c:469
#11 0xc02dcdbc in syscall2 (frame=0xdbb32d40)
    at /usr/src/sys/platform/pc32/i386/trap.c:1359
#12 0xc02c83f6 in Xint0x80_syscall ()
    at /usr/src/sys/platform/pc32/i386/exception.s:876

(arguments list for the frame #5 is wrong, tho)

(kgdb) fr 6
#6  pmap_remove_pte (pmap=0xdaebd334, ptq=<value optimized out>,
    va=3217022976, info=0xdbb32c30)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1640
1640                    return pmap_remove_entry(pmap, m, va, info);
(kgdb) p *pmap
$7 = {pm_pdir = 0xdbb9b000, pm_pdirm = 0xc12fd490, pm_pteobj = 0xdbb88840,
  pm_pmnode = {tqe_next = 0xd6ea6a14, tqe_prev = 0xdaebec00}, pm_pvlist = {
    tqh_first = 0xc2f79428, tqh_last = 0xc2f3bc2c}, pm_count = 1,
  pm_active = 0, pm_filler02 = 0, pm_stats = {resident_count = 2209,
    wired_count = 0}, pm_ptphint = 0xc21ae840, pm_generation = 181731}
(kgdb) p *m
$8 = {pageq = {tqe_next = 0xc1eb7880, tqe_prev = 0xc2053450}, rb_entry = {
    rbe_left = 0xc17ea020, rbe_right = 0xc17441c0, rbe_parent = 0xc1767300,
    rbe_color = 1}, object = 0xdba3eea0, pindex = 6960, phys_addr = 809406464,
  md = {pv_list_count = 2, pv_list = {tqh_first = 0xc2facbf8,
      tqh_last = 0xc2f69c20}}, queue = 258, flags = 1200, pc = 41,
  act_count = 8 '\b', busy = 0 '\000', wire_count = 0, hold_count = 0,
  valid = 255 '\377', dirty = 255 '\377', msf_hint = 0x0, action_list = {
    lh_first = 0x0}}