--NextPart-20060413084526-0357900
Content-Type: Text/Plain; charset=us-ascii

> > can you try LOCKDEBUG?
> 
> Did that - same panic, same backtrace, no additional output anywhere.

can you try the attached patch, with LOCKDEBUG and UVM_PAGE_TRKOWN?

YAMAMOTO Takashi

--NextPart-20060413084526-0357900
Content-Type: Text/Plain; charset=us-ascii
Content-Disposition: attachment; filename="a.diff"

Index: uvm_page.c
===================================================================
--- uvm_page.c	(revision 1571)
+++ uvm_page.c	(working copy)
@@ -1481,10 +1481,24 @@ uvm_page_unbusy(struct vm_page **pgs, in
 void
 uvm_page_own(struct vm_page *pg, const char *tag)
 {
+	struct uvm_object *uobj;
+	struct vm_anon *anon;
+
 	KASSERT((pg->flags & (PG_PAGEOUT|PG_RELEASED)) == 0);
 
+	uobj = pg->uobject;
+	anon = pg->uanon;
+	if (uobj != NULL) {
+		LOCK_ASSERT(simple_lock_held(&uobj->vmobjlock));
+	} else if (anon != NULL) {
+		LOCK_ASSERT(simple_lock_held(&anon->an_lock));
+	}
+
+	KASSERT((pg->flags & PG_WANTED) == 0);
+
 	/* gain ownership? */
 	if (tag) {
+		KASSERT((pg->flags & PG_BUSY) != 0);
 		if (pg->owner_tag) {
 			printf("uvm_page_own: page %p already owned "
 			    "by proc %d [%s]\n", pg,
@@ -1497,6 +1511,7 @@ uvm_page_own(struct vm_page *pg, const c
 	}
 
 	/* drop ownership */
+	KASSERT((pg->flags & PG_BUSY) == 0);
 	if (pg->owner_tag == NULL) {
 		printf("uvm_page_own: dropping ownership of an non-owned "
 		    "page (%p)\n", pg);

--NextPart-20060413084526-0357900--