kern/38776: ttyflags LOCKDEBUG error

[martin%aprisoft.de@localhost]

>Number:         38776
>Category:       kern
>Synopsis:       ttyflags LOCKDEBUG error
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 28 09:45:00 +0000 2008
>Originator:     Martin Husemann
>Release:        NetBSD 4.99.63
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD nelly.aprisoft.de 4.99.63 NetBSD 4.99.63 (NELLY) #17: Mon May 26 
12:29:40 CEST 2008 
martin%emmas.aprisoft.de@localhost:/nelly/usr/src/sys/arch/sparc64/compile/NELLY
 sparc64
Architecture: sparc64
Machine: sparc64
>Description:

Booting a -current LOCKDEBUG kernel on one of my machines causes a reproducable
error:

com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com0: console
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
[..]
ast0 at isa0 port 0x2a0-0x2bf irq 5
com2 at ast0 slave 0: ns16550a, working fifo
com3 at ast0 slave 1: ns16550a, working fifo
com4 at ast0 slave 2: ns16550a, working fifo
com5 at ast0 slave 3: ns16550a, working fifo
[..]
Setting tty flags.
Reader / writer lock error: rw_vector_enter: assertion failed: !cpu_intr_p()

lock address : 0x00000000c9cf9b80 type     :     sleep/adaptive
shared holds :                  0 exclusive:                  0
shares wanted:                  0 exclusive:                  0
current cpu  :                  0 last held:              65535
current lwp  : 0x00000000caec6c60 last held: 000000000000000000
last locked  : 0x00000000c01a7860 unlocked : 0x00000000c01a1a28
initialized  : 0x00000000c01a6e6f
owner/count  : 000000000000000000 flags    : 0x0000000000000008

Turnstile chain at 0xc0337960.
=> No active turnstile for this lock.

panic: LOCKDEBUG
Stopped in pid 27.1 (ttyflags) at       netbsd:breakpoint+0x4:  popl    %ebp
db{0}> bt
breakpoint(0,ca571c8c,c02a82d2,ca571c7c,caeaf388,c02d3d8c,ca571ca0,c01fdc8f,c02d
6917,c02d3e5f) at netbsd:breakpoint+0x4
panic(c02d6917,c02d3e5f,c02ba331,c02d3d8c,c02d3d8c,12ba331,8,c9cf9b7c,caec6c60,c
9cf9b80) at netbsd:panic+0x18d
lockdebug_abort1(c02d3d8c,1,c02ba331,c02d3d8c,c032ac40,c9cf9b7c,ca571d00,c01e3cb
a,c032ac40,ca571cfc) at netbsd:lockdebug_abort1+0xa7
rw_abort(c032ac40,ca571cfc,c02a82d2,c033b6dc,c032ac40,caec6c60,c01fe965,c033b6ec
,c032ac40,ca571cfc) at netbsd:rw_abort+0x21
rw_vector_enter(c9cf9b80,0,7,c032ac40,c032ac40,c9cf9b7c,ca571e30,c01a15d0,c9cf9b
7c,ca571d5c) at netbsd:rw_vector_enter+0x202
vm_map_lock_read(c9cf9b7c,ca571d5c,c02a82d2,c03397c8,c03354b4,ca571d6c,c02a82d2,
c00097c8,c03354b4,ca571d8c) at netbsd:vm_map_lock_read+0x1e
uvm_fault_internal(c9cf9b7c,0,1,0,0,ca571e5c,c01e811d,c9cf4690,6,cae7eda0) at ne
tbsd:uvm_fault_internal+0xa0
trap() at netbsd:trap+0x60b
--- trap (number 6) ---
device_is_active(5,c9ce7be0,6,c02f5480,c9ce7be0,1,c02f5480,c01d7059,6,c025ea39) 
a
t netbsd:device_is_active+0x6
comintr(c09b6000,2b8,7,c025ea39,1,0,0,0,6,8) at netbsd:comintr+0x2a
astintr(c09b6100,cae7ea2c,0,0,0,0,0,0,0,0) at netbsd:astintr+0x7d
DDB lost frame for netbsd:Xintr_legacy5+0xbb, trying 0xca571f74
Xintr_legacy5() at netbsd:Xintr_legacy5+0xbb
--- interrupt ---
--- switch to interrupt stack ---
Xspllower(6,1,58,d,c09e4d0c,c9cd6be4,0,0,c01fa524,caec6c60) at netbsd:Xspllower+
0xf
comopen(802,5,2000,caec6c60,0,c9cdffac,cae7eb2c,c02441b4,cae7eb1c,2000) at netbs
d:comopen+0x292
cdev_open(802,5,2000,caec6c60,cae5c2a4,0,cae5c2a4,4,caec6c60,802) at netbsd:cdev
_open+0x5a
spec_open(cae7eb88,c9cf56c0,0,4,c9cebb40,c02bb6e0,cae5c2a4,5,c9ce6f00,0) at netb
sd:spec_open+0x15d
VOP_OPEN(cae5c2a4,5,c9ce6f00,cae5c2a4,0,0,c9ce6f00,0,1,0) at netbsd:VOP_OPEN+0x6
1
vn_open(cae7ec68,5,0,fffffffb,c9cf5600,c9cf4690,c9cf56c0,c01db451,8,bfbfe958) at
 netbsd:vn_open+0x121
sys_open(caec6c60,cae7ed00,cae7ed28,c9cf4690,bfbfd000,c9cf9b7c,0,bfbfe958,4,0) a
t netbsd:sys_open+0xa5
syscall(cae7ed48,b3,ab,1f,1f,bfbfe958,2,bfbfee68,0,bbbe9860) at netbsd:syscall+0
xa0
db{0}> 


>How-To-Repeat:
just boot that machine ;-)

>Fix:
n/a