if_sk locking problems

See attached dmesg. At boot time, there is one malloc() with a mutex
held and a reversal between the skc0 and kernel environment locks.
When I started & stopped tcpdump, there was a reversal between the skc0
and global bpf locks.


Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 5.2-tjr #0: Wed Mar 10 12:23:23 EST 2004
    tim_at_dev.robbins.dropbear.id.au:/usr/obj/home/tim/p4/src/sys/GENERIC
Preloaded elf kernel "/boot/kernel/kernel" at 0xc09d7000.
Preloaded elf module "/boot/kernel/acpi.ko" at 0xc09d721c.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD Athlon(tm) 64 Processor 3000+ (2002.57-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0xf48  Stepping = 8
  Features=0x78bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2>
  AMD Features=0xe0500000<NX,AMIE,LM,DSP,3DNow!>
real memory  = 536018944 (511 MB)
avail memory = 514793472 (490 MB)
ACPI APIC Table: <A M I  OEMAPIC >
ioapic0: Changing APIC ID to 1
ioapic0 <Version 0.3> irqs 0-23 on motherboard
Pentium Pro MTRR support enabled
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
acpi0: <A M I OEMRSDT> on motherboard
pcibios: BIOS version 2.10
Found $PIR table, 12 entries at 0xc00f5ae0
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
acpi_cpu0: <CPU> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <VIA Generic host to PCI bridge> mem 0xf8000000-0xfbffffff at device 0.0 on pci0
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pcib1: could not get PCI interrupt routing table for \\_SB_.PCI0.P0P1 - AE_NOT_FOUND
pci1: <ACPI PCI bus> on pcib1
pci1: <display, VGA> at device 0.0 (no driver attached)
fwohci0: <VIA VT6306> port 0xbc00-0xbc7f mem 0xf7b00000-0xf7b007ff irq 16 at device 7.0 on pci0
fwohci0: OHCI version 1.0 (ROM=1)
fwohci0: No. of Isochronous channel is 4.
fwohci0: EUI64 00:e0:18:00:00:62:33:52
fwohci0: Phy 1394a available S400, 2 ports.
fwohci0: Link S400, max_rec 2048 bytes.
firewire0: <IEEE1394(FireWire) bus> on fwohci0
fwe0: <Ethernet over FireWire> on firewire0
if_fwe0: Fake Ethernet address: 02:e0:18:62:33:52
sbp0: <SBP-2/SCSI over FireWire> on firewire0
fwohci0: Initiate bus reset
fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
atapci0: <Promise PDC20378 SATA150 controller> port 0xcc00-0xcc7f,0xdc00-0xdc0f,0xec00-0xec3f mem 0xf7c00000-0xf7c1ffff,0xf7d00000-0xf7d00fff irq 18 at device 8.0 on pci0
atapci0: [MPSAFE]
ata2: at 0xf7d00000 on atapci0
ata2: [MPSAFE]
ata3: at 0xf7d00000 on atapci0
ata3: [MPSAFE]
ata4: at 0xf7d00000 on atapci0
ata4: [MPSAFE]
skc0: <3Com 3C940 Gigabit Ethernet> port 0xb000-0xb0ff mem 0xf7e00000-0xf7e03fff irq 17 at device 10.0 on pci0
skc0: 3Com Gigabit LOM (3C940)
sk0: <Marvell Semiconductor, Inc. Yukon> on skc0
sk0: Ethernet address: 00:0e:a6:74:74:52
malloc() of "512" with the following non-sleepable locks held:
exclusive sleep mutex skc0 (network driver) r = 0 (0xc4538ac0) locked _at_ /home/tim/p4/src/sys/pci/if_sk.c:1357
miibus0: <MII bus> on sk0
e1000phy0: <Marvell 88E1000 Gigabit PHY> on miibus0
lock order reversal
 1st 0xc4538ac0 skc0 (network driver) _at_ /home/tim/p4/src/sys/pci/if_sk.c:661
 2nd 0xc0871b80 kernel environment (kernel environment) _at_ /home/tim/p4/src/sys/kern/kern_environment.c:288
Stack backtrace:
backtrace(0,ffffffff,c087e340,c087ec50,c080f7ac) at backtrace+0x12
witness_checkorder(c0871b80,1,c07b1171,120) at witness_checkorder+0x593
_sx_slock(c0871b80,c07b1171,120,c0c21a20,a) at _sx_slock+0x54
getenv(c079b720,c4541300,c4538880,c4538880,0) at getenv+0x2f
getenv_quad(c079b720,c0c21a60,c07de3b0,c07de3b0,c0c21a88) at getenv_quad+0x11
getenv_int(c079b720,c0869514,c07de3b0,c4538880,c4538880) at getenv_int+0x12
e1000phy_attach(c4538880) at e1000phy_attach+0x18
device_probe_and_attach(c4538880) at device_probe_and_attach+0x99
bus_generic_attach(c4538900,c4400400,f0000000,c06c92a0,c06c92d0) at bus_generic_attach+0x16
miibus_attach(c4538900) at miibus_attach+0x3d
device_probe_and_attach(c4538900) at device_probe_and_attach+0x99
bus_generic_attach(c4538980,c453d000,0,c453d000,c0c21b60) at bus_generic_attach+0x16
mii_phy_probe(c4538980,c453d1f4,c06c92a0,c06c92d0) at mii_phy_probe+0xd4
sk_attach(c4538980) at sk_attach+0x34e
device_probe_and_attach(c4538980) at device_probe_and_attach+0x99
bus_generic_attach(c4455180,c05f65ca,c081e5f8,c07de3b0,c07de3b0) at bus_generic_attach+0x16
skc_attach(c4455180) at skc_attach+0x61e
device_probe_and_attach(c4455180) at device_probe_and_attach+0x99
bus_generic_attach(c4454200,0,c4454200,c4454200,0) at bus_generic_attach+0x16
acpi_pci_attach(c4454200) at acpi_pci_attach+0x9c
device_probe_and_attach(c4454200) at device_probe_and_attach+0x99
bus_generic_attach(c443d400,c443d400,c43820b0,0,c43820a0) at bus_generic_attach+0x16
acpi_pcib_attach(c443d400,c43820b0,0,c0c21c94,c05f6620) at acpi_pcib_attach+0xaa
acpi_pcib_acpi_attach(c443d400) at acpi_pcib_acpi_attach+0x188
device_probe_and_attach(c443d400) at device_probe_and_attach+0x99
bus_generic_attach(c443d900,c1973280,0,c443d880,c0c21cfc) at bus_generic_attach+0x16
acpi_probe_children(c443d900,c443d900,c443d900,0,c0c21d1c) at acpi_probe_children+0x65
acpi_attach(c443d900) at acpi_attach+0x493
device_probe_and_attach(c443d900) at device_probe_and_attach+0x99
bus_generic_attach(c443da80,c443da80,c443da80,c0c21d60,c05f2ee5) at bus_generic_attach+0x16
nexus_attach(c443da80) at nexus_attach+0x13
device_probe_and_attach(c443da80) at device_probe_and_attach+0x99
root_bus_configure(c197ac80,c07d0f91,0) at root_bus_configure+0x16
configure(0,c1ec00,c1e000,0,c043c5c5) at configure+0x1b
mi_startup() at mi_startup+0x96
begin() at begin+0x2c
e1000phy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX-FDX, auto
atapci1: <VIA 8237 SATA150 controller> port 0xd000-0xd0ff,0xd400-0xd40f,0xd800-0xd803,0xe000-0xe007,0xe400-0xe403,0xe800-0xe807 irq 20 at device 15.0 on pci0
atapci1: [MPSAFE]
ata5: at 0xe800 on atapci1
ata5: [MPSAFE]
ata6: at 0xe000 on atapci1
ata6: [MPSAFE]
atapci2: <VIA 8237 UDMA133 controller> port 0xfc00-0xfc0f at device 15.1 on pci0
ata0: at 0x1f0 irq 14 on atapci2
ata0: [MPSAFE]
ata1: at 0x170 irq 15 on atapci2
ata1: [MPSAFE]
uhci0: <VIA 83C572 USB controller> port 0xb400-0xb41f irq 21 at device 16.0 on pci0
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub0: port error, restarting port 1
uhub0: port error, giving up port 1
uhub0: port error, restarting port 2
uhub0: port error, giving up port 2
ums0: Microsoft Microsoft 5-Button Mouse with IntelliEye(TM), rev 1.10/3.00, addr 2, iclass 3/1
ums0: 5 buttons and Z dir.
uhci1: <VIA 83C572 USB controller> port 0xb800-0xb81f irq 21 at device 16.1 on pci0
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub1: port error, restarting port 1
uhub1: port error, giving up port 1
uhub1: port error, restarting port 2
uhub1: port error, giving up port 2
uhci2: <VIA 83C572 USB controller> port 0xc000-0xc01f irq 21 at device 16.2 on pci0
usb2: <VIA 83C572 USB controller> on uhci2
usb2: USB revision 1.0
uhub2: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhub2: port error, restarting port 1
uhub2: port error, giving up port 1
uhub2: port error, restarting port 2
uhub2: port error, giving up port 2
uhci3: <VIA 83C572 USB controller> port 0xc400-0xc41f irq 21 at device 16.3 on pci0
usb3: <VIA 83C572 USB controller> on uhci3
usb3: USB revision 1.0
uhub3: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
uhub3: port error, restarting port 1
uhub3: port error, giving up port 1
uhub3: port error, restarting port 2
uhub3: port error, giving up port 2
pci0: <serial bus, USB> at device 16.4 (no driver attached)
isab0: <PCI-ISA bridge> at device 17.0 on pci0
isa0: <ISA bus> on isab0
pci0: <multimedia, audio> at device 17.5 (no driver attached)
acpi_button0: <Power Button> on acpi0
acpi_button1: <Sleep Button> on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
fdc0: <Enhanced floppy controller (i82077, NE72065 or clone)> port 0x3f7,0x3f0-0x3f5 irq 6 drq 2 on acpi0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
ppc0 port 0x378-0x37f irq 7 on acpi0
ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode
ppbus0: <Parallel port bus> on ppc0
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
sio0: configured irq 3 not in bitmap of probed irqs 0
sio0: port may not be enabled
sio0 port 0x2f8-0x2ff irq 3 on acpi0
sio0: type 16550A
sio1: configured irq 4 not in bitmap of probed irqs 0
sio1: port may not be enabled
sio1 port 0x3f8-0x3ff irq 4 on acpi0
sio1: type 16550A
orm0: <Option ROM> at iomem 0xc0000-0xcefff on isa0
pmtimer0 on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 2002569683 Hz quality 800
Timecounters tick every 10.000 msec
ad0: 38166MB <ST340014A> [77545/16/63] at ata0-master UDMA100
acd0: CDRW <LITE-ON COMBO SOHC-5232K> at ata1-slave PIO4
Mounting root from ufs:/dev/ad0s1a
sk0: promiscuous mode enabled
lock order reversal
 1st 0xc08a2800 bpf global lock (bpf global lock) _at_ /home/tim/p4/src/sys/net/bpf.c:384
 2nd 0xc4538ac0 skc0 (network driver) _at_ /home/tim/p4/src/sys/pci/if_sk.c:1192
Stack backtrace:
backtrace(0,ffffffff,c087e4f8,c087e340,c080e47c) at backtrace+0x12
witness_checkorder(c4538ac0,9,c07c5a44,4a8) at witness_checkorder+0x593
_mtx_lock_flags(c4538ac0,0,c07c5a44,4a8) at _mtx_lock_flags+0x67
sk_ioctl(c453d000,80206910,ddc8aa5c,c07bc383,ddc8aa80) at sk_ioctl+0x36
ifpromisc(c453d000,0) at ifpromisc+0x92
bpf_detachd(c51af700) at bpf_detachd+0x26
bpfclose(c51af600,1,2000,c493c3f0,c51af600) at bpfclose+0x7f
spec_close(ddc8ab00,ddc8ab28,c0632c1c,ddc8ab00,c0853e80) at spec_close+0x2b1
spec_vnoperate(ddc8ab00) at spec_vnoperate+0x13
vn_close(c4d50d34,1,c4fd1a00,c493c3f0,ddc8ab98) at vn_close+0x40
vn_closefile(c46cd770,c493c3f0) at vn_closefile+0x1e
fdrop_locked(c46cd770,c493c3f0,c1961d90,0,c07b0e19) at fdrop_locked+0x117
fdrop(c46cd770,c493c3f0,3,c493c3f0,ddc8abf4) at fdrop+0x24
closef(c46cd770,c493c3f0) at closef+0x1db
fdfree(c493c3f0,c5300ed8,c5300e2c,0,c07b13ab) at fdfree+0x2eb
exit1(c493c3f0,0,c0872240,0,c07b13ab) at exit1+0x402
sys_exit(c493c3f0,ddc8ad14,1,1,296) at sys_exit+0x27
syscall(2f,2f,2f,8162000,ffffffff) at syscall+0x217
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (1), eip = 0x2820ff5f, esp = 0xbfbfe7dc, ebp = 0xbfbfe7f8 ---
sk0: promiscuous mode disabled