The small and simple program below will crash the kernel on a
four-CPU 4/670 immediately. It's running -current of last monday,
but the problem seems more generic than that.

Nothing useable, at least not for me, is gotten from it.
It don't jump into DDB when breaked, by some strange reason.

panic message:

Sat Feb  1 13:54:28 CET 2003

NetBSD/sparc (sister) (console)

login: data fault: pc=0xf018120c addr=0x0 sfsr=326<PERR=0,LVL=3,AT=1,FT=1,FAV,OW>
xcall(cpu3,0xf0263bc4): couldn't ping cpus: cpu0panic: kernel faultxcall(cpu3,0xf0263bc4): couldn't ping cpus:
 cpu0syncing disks... xcall(cpu3,0xf0263bc4): couldn't ping cpus:~stopping on keyboard abort
Type  'go' to resume
Type  help  for more information
<#0> ok sync
panic: PROM sync command
Frame pointer is at 0xf02eabe0
Call traceback:
  pc = 0xf0266618  args = (0xf0002000, 0xfe01c010, 0x0, 0x0, 0xf02ead08, 0x0, 0xf02eac50) fp = 0xf02eac50
  pc = 0xf0193a08  args = (0x104, 0x0, 0xfe012000, 0xf032c000, 0xffff, 0xf032bc9c, 0xf02eacc0) fp = 0xf02eacc0
  pc = 0xf0261ad8  args = (0xf02d2e50, 0xf032c000, 0xf032c000, 0x104, 0xffef201c, 0x0, 0xf02ead28) fp = 0xf02ead28
  pc = 0xffd549e8  args = (0xffef53d0, 0x3e3bc3b3, 0x0, 0x0, 0x0, 0x0, 0xf02ead90) fp = 0xf02ead90
  pc = 0xf022ecb4  args = (0xf02fbe64, 0xffd40f40, 0xf02f7400, 0xf032c000, 0x1fffff, 0xfffffffc, 0xf02eadf0) fp = 0xf02eadf0
  pc = 0xf0230f0c  args = (0x0, 0x100, 0xf03055b8, 0x0, 0x11, 0x1, 0xf02eae58) fp = 0xf02eae58
  pc = 0xf022f24c  args = (0xf086ae70, 0x0, 0xf0230e84, 0x634f, 0x0, 0x0, 0xf02eaec8) fp = 0xf02eaec8
  pc = 0xf022e7c0  args = (0x8, 0xf07f0e90, 0xfe024000, 0xf0002000, 0xffff, 0xe, 0xf02eaf30) fp = 0xf02eaf30
  pc = 0xf0008b10  args = (0x0, 0xf022e780, 0xd00, 0x118000e7, 0x200, 0xe, 0xf02eaf98) fp = 0xf02eaf98
  pc = 0xf0221010  args = (0x400400, 0x0, 0xb00, 0x0, 0xe8f, 0xf032bc9c, 0xf66643b0) fp = 0xf66643b0

dump to dev 7,1 not possible
xcall(cpu0,0xf0263bc4): couldn't ping cpus: cpu1 cpu2 cpu3xcall(cpu0,0xf0263bc4): couldn't ping cpus: cpu1 cpu2 cpu3xcall(cpu0,0xf0263bc4): couldn't ping cpus: cpu1 cpu2 cpu3xcall(cpu0,0xf0263bc4): couldn't ping cpus: cpu1 cpu2 cpu3rebooting
 
Resetting ... 


The following small program from Jens Nilsson causes the panic:


/*
 * This program panics NetBSD/i386 20011117 in nathanw_sa branch
 * running in vmware 2.0.
 *
 * It also seems to panic NetBSD/sparc MP current 20030201 .
 *
 * Start the program and press enter, within a second and the
 * kernel will panic.
 */

#include <sys/types.h>

#include <err.h>
#include <poll.h>
#include <pthread.h>
#include <string.h>
#include <unistd.h>

#define WAKE_DELAY 1000

static int wake_fd;

static void *wake_thread(void *);

int
main(int argc, char *argv[])
{
	struct pollfd	pfds[2];
	pthread_t	wake_tid;
	int		fd[2], wake_read_fd, e;
	char		b[100];

	if (pipe(fd) != 0)
		err(1, "pipe");

	wake_fd = fd[1];
	wake_read_fd = fd[0];

	memset(pfds, 0, sizeof(struct pollfd) * 2);

	pfds[0].fd = wake_read_fd;
	pfds[0].events = POLLIN;
	pfds[1].fd = STDIN_FILENO;
	pfds[1].events = POLLIN;

	e = pthread_create(&wake_tid, NULL, wake_thread, "wake_thread");
	if (e != 0)
		errx(1, "pthread_create: %s", strerror(e));

	for ( ;; ) {
		warnx("main: waiting for IO");
		if (poll(pfds, 2, INFTIM) == -1)
			err(1, "poll");

		if (pfds[0].revents) {
			warnx("awakened by wake_thread, revents 0x%x",
				(int)pfds[0].revents);
			if (read(wake_read_fd, b, sizeof(b)) == -1)
				err(1, "main: read wake_read_fd");
		}
		if (pfds[1].revents) {
			warnx("got input from stdin, revents 0x%x",
				(int)pfds[1].revents);
			if (read(STDIN_FILENO, b, sizeof(b)) == -1)
				err(1, "main: read stdin");
		}
	}
	

}


static void *
wake_thread(void *arg)
{
	struct pollfd pfd;
	char	*name;
	char	b;

	name = arg;

	memset(&pfd, 0, sizeof(struct pollfd));

	for ( ;; ) {
		/*
		 * For some reason "poll(NULL, 0, WAKE_DELAY)"
		 * didn't work, but I suppose that's another issue.
		 */
		if (poll(&pfd, 1, WAKE_DELAY) == -1)
			err(1, "%s: poll", name);

		warnx("%s: wakening main", name);
		if (write(wake_fd, &b, 1) != 1)
			err(1, "%s: write", name);
	}
}