From owner-freebsd-bugs  Sun May 12 17:10:09 1996
Return-Path: owner-bugs
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id RAA24770
          for bugs-outgoing; Sun, 12 May 1996 17:10:09 -0700 (PDT)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id RAA24764
          Sun, 12 May 1996 17:10:05 -0700 (PDT)
Resent-Date: Sun, 12 May 1996 17:10:05 -0700 (PDT)
Resent-Message-Id: <199605130010.RAA24764@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org, nox@jelal.hb.north.de
Received: from deceased.hb.north.de (deceased.hb.north.de [194.94.232.249])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id RAA24580
          for <FreeBSD-gnats-submit@freebsd.org>; Sun, 12 May 1996 17:07:34 -0700 (PDT)
Received: from jelal.hb.north.de by deceased.hb.north.de with uucp
	(Smail3.1.29.1) id m0uIl5W-0016I5C; Mon, 13 May 96 02:02 MET DST
Received: by jelal.hb.north.de (SMail-ST 0.95gcc/2.5+)
	id AA00373; Mon, 13 May 1996 01:08:06 +0100 (CET)
Received: (from nox@localhost) by saturn.hb.north.de (8.7.5/8.7.3) id AAA02946; Mon, 13 May 1996 00:20:55 +0200 (MET DST)
Message-Id: <199605122220.AAA02946@saturn.hb.north.de>
Date: Mon, 13 May 1996 00:20:55 +0200 (MET DST)
From: nox@jelal.hb.north.de
Reply-To: nox@jelal.hb.north.de
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: kern/1195: vm_page_unhold: hold count < 0!!!
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         1195
>Category:       kern
>Synopsis:       stable with DIAGNOSTIC panics `vm_page_unhold: hold count < 0'
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun May 12 17:10:02 PDT 1996
>Last-Modified:
>Originator:     Juergen Lock
>Organization:
orga-what?
>Release:        FreeBSD 2.1-STABLE i386
>Environment:

	-stable as of ~a week old, but problem seen since, uh, 2.0?

>Description:

	Every time i make a DIAGNOSTIC kernel and then dump more than
a few MB to tape using afio, i get this.  Then i disable the panic
and everything is well again.  So this itself is not critical but...

>How-To-Repeat:

	(boot DIAGNOSTIC kernel, install afio, mount scratch monk.. errm, tape)

	find /usr/src | afio -G 2 -o -v -f -b 5120 -c 1000 -s 100000x -Z /dev/nrst0

>Fix:
	
	As all the problematic calls seem to come out of vunmapbuf,

Index: i386/i386/vm_machdep.c
@@ -783,8 +783,20 @@
 	/*
 	 * release the data page
 	 */
+#ifdef DIAGNOSTIC
+		vm_page_t foo;
+		pa = pmap_kextract((vm_offset_t) addr);
+		foo = PHYS_TO_VM_PAGE(pa);
+		if (foo->hold_count <= 0) {
+			/* panic in vm_page_unhold -> printf */
+			printf("vunmapbuf: vm_page_unhold: hold count %d <= 0!!!\n", foo->hold_count);
+			foo->hold_count = 1;
+		}
+		vm_page_unhold(foo);
+#else
 		pa = pmap_kextract((vm_offset_t) addr);
 		vm_page_unhold(PHYS_TO_VM_PAGE(pa));
+#endif
 	}
 }
 
now try the write again and you get a console full of these printfs.

 hope it helps...
	Juergen
>Audit-Trail:
>Unformatted: