Two panics for the price of one: acpi_cpu_idle *and* turnstiles

syncing disks, buffers remaining... 
done
Uptime: 1h25m24s
Shutting down ACPI
terneRle btoroatpi n1g2. .w.i
 h interrupts disabled
panic: Assertion td->td_turnstile != NULL failed at
../../../kern/subr_turnstile.c:437
cpuid = 0; 
Debugger("panic")
Stopped at      Debugger+0x55:  xchgl   %ebx,in_Debugger.0
db> trace
Debugger(c08970b3,0,c08965b6,c8f3b9f4,100) at Debugger+0x55
panic(c08965b6,c0899f01,c0899cde,1b5,c0963060) at panic+0x156
turnstile_wait(c2001000,c095ec00,c21f73c0,1cc,257) at turnstile_wait+0x2ac
_mtx_lock_sleep(c095ec00,0,c08ad29a,df,18d50000) at _mtx_lock_sleep+0x125
_mtx_lock_flags(c095ec00,0,c08ad29a,df,369e99) at _mtx_lock_flags+0x98
vm_fault(c095b5e0,0,1,0,c1380780) at vm_fault+0x5a
trap_pfault(c8f3bc04,0,9c,fc,9c) at trap_pfault+0x109
trap(c0820018,10,10,0,10) at trap+0x333
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc047c5b9, esp = 0xc8f3bc44, ebp = 0xc8f3bc64 ---
AcpiHwLowLevelRead(10,c8f3bc80,94,10,0) at AcpiHwLowLevelRead+0x19
AcpiHwRegisterRead(0,1,c8f3bca0,0,c137fa98) at AcpiHwRegisterRead+0x71
AcpiGetRegister(1,c8f3bccc,0,3e8,0) at AcpiGetRegister+0x61
acpi_cpu_idle(c8f3bd0c,c0658b0c,c095ec00,2,c0894e2b) at acpi_cpu_idle+0x63
cpu_idle(c095ec00,2,c0894e2b,53,14b) at cpu_idle+0x28
idle_proc(0,c8f3bd48,c0894ce0,311,0) at idle_proc+0x3c
fork_exit(c0658ad0,0,c8f3bd48) at fork_exit+0xb4
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xc8f3bd7c, ebp = 0 ---

Feel the kernel love.  :-). 

(kgdb) l *0xc047c5b9
0xc047c5b9 is in AcpiHwLowLevelRead
(../../../contrib/dev/acpica/hwregs.c:836).
831         /*
832          * Must have a valid pointer to a GAS structure, and
833          * a non-zero address within. However, don't return an error
834          * because the PM1A/B code must not fail if B isn't present.
835          */
836         if ((!Reg) ||
837             (!ACPI_VALID_ADDRESS (Reg->Address)))
838         {
839             return (AE_OK);
840         }

Sounds like the turnstiles problem is really just a casualty.

The GDB love:

#7  0xc0828d19 in trap (frame=
      {tf_fs = -923550716, tf_es = 0, tf_ds = 156, tf_edi = 252, tf_esi =
156, tf_ebp = 0, tf_isp = 0, tf_ebx = 1, tf_edx = -1053295976, tf_ecx = 1,
tf_eax = 2, tf_trapno = -923550720, tf_err = -1065219437, tf_eip = 252,
tf_cs = -923550592, tf_eflags = 16, tf_esp = 0, tf_ss = -923550620})
    at ../../../i386/i386/trap.c:319
#8  0xc0828993 in i386_ldt_grow (td=0xc0820018, len=1)
    at ../../../i386/i386/sys_machdep.c:643
#9  0xc0814478 in dumpsys (di=0x10) at
../../../i386/i386/dump_machdep.c:92
#10 0xc047c2c1 in AcpiHwRegisterRead (UseLock=0 '\0', RegisterId=223, 
    ReturnValue=0x12) at ../../../contrib/dev/acpica/hwregs.c:601
#11 0xc047c011 in AcpiGetRegister (RegisterId=18, ReturnValue=0x12, 
    Flags=3230323354) at ../../../contrib/dev/acpica/hwregs.c:375
#12 0xc0499d63 in acpi_cpu_idle () at ../../../dev/acpica/acpi_cpu.c:741
#13 0xc081ce98 in freebsd4_sigreturn (td=0xc095ec00, uap=0x12)
    at ../../../i386/i386/machdep.c:839
#14 0xc0658b0c in idle_proc (dummy=0x0) at ../../../kern/kern_idle.c:86
#15 0xc0658804 in fork_exit (callout=0xc0658ad0 <idle_proc>, arg=0x12, 
    frame=0x12) at ../../../kern/kern_fork.c:793
(kgdb) up
#10 0xc047c2c1 in AcpiHwRegisterRead (UseLock=0 '\0', RegisterId=223, 
    ReturnValue=0x12) at ../../../contrib/dev/acpica/hwregs.c:601
601             Status = AcpiHwLowLevelRead (16, &Value1,
&AcpiGbl_FADT->XPm1aEvtBlk);

Peter suggests that the ACPI idle hooks should not be invoked after ACPI
has been terminated :-).

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert_at_fledge.watson.org      Network Associates Laboratories