kern/41897: twa(4) cause: panic: cpu_switchto: switching above IPL_SCHED (8)

[Manuel.Bouyer%rp.lip6.fr@localhost]

>Number:         41897
>Category:       kern
>Synopsis:       twa(4) cause: panic: cpu_switchto: switching above IPL_SCHED 
>(8)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 16 13:45:00 +0000 2009
>Originator:     Manuel Bouyer
>Release:        NetBSD 5.0_STABLE
>Organization:
>Environment:
System: NetBSD hera.lip6.fr 5.0_STABLE NetBSD 5.0_STABLE (DISCO) #4: Wed Aug 12 
21:48:48 MEST 2009 
bouyer@disco:/home/bouyer/src-5/src/sys/arch/i386/compile/obj/DISCO i386
Architecture: i386
Machine: i386
>Description:
        At shutdown the system panic with:
syncing disks... done
unmounting file systems... done
panic: cpu_switchto: switching above IPL_SCHED (8)
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c03f2c4c cs 8 eflags 246 cr2 8055010 ilevel 8
Stopped in pid 10169.1 (reboot) at      netbsd:breakpoint+0x4:  popl    %ebp
db{1}> tr
breakpoint(c0646aee,ce8c28b0,c1b3a800,c070a168,ce8c288c,c033ecfc,c033ee91,ce0e2a80,ce8c28bc,c03e314a)
 at netbsd:breakpoint+0x4
panic(c0100371,8,ce0e2a80,0,0,c033eed9,ce0e2a80,cadca020,0,cc21c000) at 
netbsd:panic+0x1b0
cpu_switchto(ce0e2a80,1770,1770,c067307f,0,b53e60,2,0,c1b53e60,8) at 
netbsd:cpu_switchto+0x1e
sleepq_block(1770,0,c067307f,1770,0,0,c0713b40,cc268cb4,0,cc268cf4) at 
netbsd:sleepq_block+0xeb
ld_twa_flush(cc268cb4,0,0,c050caa0,1300,ce0e2a80,ce8c29bc,c0350cf4,1300,4) at 
netbsd:ld_twa_flush+0xeb
ldclose(1300,4,6000,ce0e2a80,6000,4,6,4,cadd8cf0,4) at netbsd:ldclose+0x86
bdev_close(1300,4,6000,ce0e2a80,0,0,ce8c2a0c,1300,6000,1000) at 
netbsd:bdev_close+0x84
spec_close(ce8c2a18,ffffffff,c0713c80,c032adca,8,c051a060,cadd8cf0,4,ffffffff,cada7a8c)
 at netbsd:spec_close+0x24b
VOP_CLOSE(cadd8cf0,4,ffffffff,0,0,1000000,0,cadd8cf0,8,ce0e2a80) at 
netbsd:VOP_CLOSE+0x6c
spec_node_revoke(cadd8cf0,1,ffffffff,ce0e2a80,0,0,1713c80,c032adca,8,c03a0e48) 
at netbsd:spec_node_revoke+0xbd
vclean(cadd8cf0,8,ce8c2acc,0,c039ffa0,ce0e2a80,c0713d00,cadd8cf0,1300,0) at 
netbsd:vclean+0x2be
vrevoke(cadd8cf0,c039ffa0,ce8c2b0c,c03ab380,ce8c2afc,0,cadd8cf0,c039ffa0,8,c03a021c)
 at netbsd:vrevoke+0x193
genfs_revoke(ce8c2afc,0,cadd8cf0,c039ffa0,8,c03a021c,c051a2e0,cadd8cf0,1,cadd8cf0)
 at netbsd:genfs_revoke+0x1a
VOP_REVOKE(cadd8cf0,1,c1b38bc0,3,0,c0713d00,1300,0,1,cc268cb4) at 
netbsd:VOP_REVOKE+0x60
vdevgone(13,0,0,3,c034dbbb,13,45,0,cc268cb4,cc268d84) at netbsd:vdevgone+0x11e
ldenddetach(cc268cb4,3,0,c06a4760,c06a4760,0,ce8c2bbc,c034dc4a,cc268d84,3) at 
netbsd:ldenddetach+0xc4
ld_twa_detach(cc268d84,3,9,ce8c2bc8,0,c0692e60,ce8c2bdc,0,0,cc269000) at 
netbsd:ld_twa_detach+0x36
config_detach(cc268d84,3,2c011500,ce8c2c00,ce8c2d00,c069e800,ce8c2c0c,c034a1ce,c06fecc0,ce8c2c00)
 at netbsd:config_detach+0x15a
twa_shutdown(0,0,ce8c2c2c,c03f92eb,8,ce0e2a80,0,0,ce8c2d00,0) at 
netbsd:twa_shutdown+0x6f
doshutdownhooks(8,ce0e2a80,0,0,ce8c2d00,0,ce8c2cdc,c034ad94,0,0) at 
netbsd:doshutdownhooks+0x2a
cpu_reboot(0,0,0,0,0,0,ce8c2c9c,c03e4af2,23,ce8c2cc0) at netbsd:cpu_reboot+0x1b
sys_reboot(ce0e2a80,ce8c2d00,ce8c2d28,ce8c2d40,c03e4af2,cd54b854,1,0,0,bfbfeed8)
 at netbsd:sys_reboot+0x74
syscall(ce8c2d48,b3,ab,1f,1f,0,12,bfbfeed8,1,ffffffff) at netbsd:syscall+0xc8

>How-To-Repeat:
        reboot a multiuser system with a twa(4) ? maybe requires root
        on the twa device.
>Fix:
        unkown, but fix or workaround would be greatly appreciated.