kern/72548: Panic on LOR in mga_drm on amd64

[Shaun Jurrens]

>Number:         72548
>Category:       kern
>Synopsis:       Panic on LOR in mga_drm on amd64
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct 11 22:20:25 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Shaun Jurrens
>Release:        FreeBSD 5.3-BETA7
>Organization:
N.A.
>Environment:
FreeBSD dakota 5.3-BETA7 FreeBSD 5.3-BETA7 #13: Mon Oct 11 01:22:45 CEST 2004     root at dakota:/usr/obj/usr/src/sys/DAKOTA64  amd64

>Description:
     lock order reversal
 1st 0xffffff00009ec4c0 drm device (drm device) @ /usr/src/sys/dev/drm/drm_irq.h:192
 2nd 0xffffffff805b4320 ACPI root bus (ACPI root bus) @ /usr/src/sys/dev/acpica/acpi.c:913

KDB: stack backtrace:
witness_checkorder() at 0xffffffff80293bb8 = witness_checkorder+0x648
_sx_xlock() at 0xffffffff80273541 = _sx_xlock+0x51
acpi_release_resource() at 0xffffffff80180d52 = acpi_release_resource+0x42
resource_list_release() at 0xffffffff80283a35 = resource_list_release+0x115
mga_irq_uninstall() at 0xffffffff801c1dcd = mga_irq_uninstall+0x6d
mga_control() at 0xffffffff801c1e35 = mga_control+0x55
spec_ioctl() at 0xffffffff80230a59 = spec_ioctl+0x179
vn_ioctl() at 0xffffffff802d4ee5 = vn_ioctl+0x105
ioctl() at 0xffffffff80295144 = ioctl+0x144
syscall() at 0xffffffff803c386b = syscall+0x4ab
Xfast_syscall() at 0xffffffff803b1e18 = Xfast_syscall+0xa8
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x200c31f70, rsp = 0x7fffffffec38,
 rbp = 0x103a200 ---
KDB: enter: witness_checkorder
Fatal trap 3: breakpoint instruction fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x8:0xffffffff8028754f
stack pointer           = 0x10:0xffffffffa4ae3810
frame pointer           = 0x10:0xffffffffa4ae3820
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, IOPL = 3
current process         = 557 (Xorg)
trap number             = 3
panic: breakpoint instruction fault
cpuid = 0
KDB: stack backtrace:
panic() at 0xffffffff8026d2ee = panic+0x24e
trap_fatal() at 0xffffffff803c2c03 = trap_fatal+0x323
trap() at 0xffffffff803c3041 = trap+0x171
alltraps_with_regs_pushed() at 0xffffffff803b1cdb = alltraps_with_regs_pushed+0x
5
_sx_xlock() at 0xffffffff80273541 = _sx_xlock+0x51
acpi_release_resource() at 0xffffffff80180d52 = acpi_release_resource+0x42
resource_list_release() at 0xffffffff80283a35 = resource_list_release+0x115
mga_irq_uninstall() at 0xffffffff801c1dcd = mga_irq_uninstall+0x6d
mga_control() at 0xffffffff801c1e35 = mga_control+0x55
spec_ioctl() at 0xffffffff80230a59 = spec_ioctl+0x179
vn_ioctl() at 0xffffffff802d4ee5 = vn_ioctl+0x105
ioctl() at 0xffffffff80295144 = ioctl+0x144
syscall() at 0xffffffff803c386b = syscall+0x4ab
Xfast_syscall() at 0xffffffff803b1e18 = Xfast_syscall+0xa8
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x200c31f70, rsp = 0x7fffffffec38,
 rbp = 0x103a200 ---
Uptime: 55m59s

>How-To-Repeat:
enable 'device          mgadrm' in kernel config. 
do 'shutdown -r now'

also using the following debugging options in KERNCONF:

options         ADAPTIVE_GIANT          # Giant mutex is adaptive.
options         PREEMPTION
options         FULL_PREEMPTION
options         MUTEX_DEBUG
options         WITNESS
options         WITNESS_KDB
options         WITNESS_SKIPSPIN

options         INVARIANTS
options         INVARIANT_SUPPORT

and 

options         SCHED_4BSD        (fwiw)

crashdump available upon request or dump analysis... the dump is pretty large

>Fix:
eric thought just "drop the lock around that call out of the drm..."
>Release-Note:
>Audit-Trail:
>Unformatted: