Bug 72548

     lock order reversal
 1st 0xffffff00009ec4c0 drm device (drm device) @ /usr/src/sys/dev/drm/drm_irq.h:192
 2nd 0xffffffff805b4320 ACPI root bus (ACPI root bus) @ /usr/src/sys/dev/acpica/acpi.c:913

KDB: stack backtrace:
witness_checkorder() at 0xffffffff80293bb8 = witness_checkorder+0x648
_sx_xlock() at 0xffffffff80273541 = _sx_xlock+0x51
acpi_release_resource() at 0xffffffff80180d52 = acpi_release_resource+0x42
resource_list_release() at 0xffffffff80283a35 = resource_list_release+0x115
mga_irq_uninstall() at 0xffffffff801c1dcd = mga_irq_uninstall+0x6d
mga_control() at 0xffffffff801c1e35 = mga_control+0x55
spec_ioctl() at 0xffffffff80230a59 = spec_ioctl+0x179
vn_ioctl() at 0xffffffff802d4ee5 = vn_ioctl+0x105
ioctl() at 0xffffffff80295144 = ioctl+0x144
syscall() at 0xffffffff803c386b = syscall+0x4ab
Xfast_syscall() at 0xffffffff803b1e18 = Xfast_syscall+0xa8
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x200c31f70, rsp = 0x7fffffffec38,
 rbp = 0x103a200 ---
KDB: enter: witness_checkorder
Fatal trap 3: breakpoint instruction fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x8:0xffffffff8028754f
stack pointer           = 0x10:0xffffffffa4ae3810
frame pointer           = 0x10:0xffffffffa4ae3820
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, IOPL = 3
current process         = 557 (Xorg)
trap number             = 3
panic: breakpoint instruction fault
cpuid = 0
KDB: stack backtrace:
panic() at 0xffffffff8026d2ee = panic+0x24e
trap_fatal() at 0xffffffff803c2c03 = trap_fatal+0x323
trap() at 0xffffffff803c3041 = trap+0x171
alltraps_with_regs_pushed() at 0xffffffff803b1cdb = alltraps_with_regs_pushed+0x
5
_sx_xlock() at 0xffffffff80273541 = _sx_xlock+0x51
acpi_release_resource() at 0xffffffff80180d52 = acpi_release_resource+0x42
resource_list_release() at 0xffffffff80283a35 = resource_list_release+0x115
mga_irq_uninstall() at 0xffffffff801c1dcd = mga_irq_uninstall+0x6d
mga_control() at 0xffffffff801c1e35 = mga_control+0x55
spec_ioctl() at 0xffffffff80230a59 = spec_ioctl+0x179
vn_ioctl() at 0xffffffff802d4ee5 = vn_ioctl+0x105
ioctl() at 0xffffffff80295144 = ioctl+0x144
syscall() at 0xffffffff803c386b = syscall+0x4ab
Xfast_syscall() at 0xffffffff803b1e18 = Xfast_syscall+0xa8
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x200c31f70, rsp = 0x7fffffffec38,
 rbp = 0x103a200 ---
Uptime: 55m59s

Fix: 

eric thought just "drop the lock around that call out of the drm..."
How-To-Repeat: enable 'device          mgadrm' in kernel config. 
do 'shutdown -r now'

also using the following debugging options in KERNCONF:

options         ADAPTIVE_GIANT          # Giant mutex is adaptive.
options         PREEMPTION
options         FULL_PREEMPTION
options         MUTEX_DEBUG
options         WITNESS
options         WITNESS_KDB
options         WITNESS_SKIPSPIN

options         INVARIANTS
options         INVARIANT_SUPPORT

and 

options         SCHED_4BSD        (fwiw)

crashdump available upon request or dump analysis... the dump is pretty large