xref: /freebsd/sys/kern/subr_witness.c (revision 262e143bd46171a6415a5b28af260a5efa2a3db8)
1 /*-
2  * Copyright (c) 1998 Berkeley Software Design, Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  * 3. Berkeley Software Design Inc's name may not be used to endorse or
13  *    promote products derived from this software without specific prior
14  *    written permission.
15  *
16  * THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN INC ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN INC BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  *	from BSDI $Id: mutex_witness.c,v 1.1.2.20 2000/04/27 03:10:27 cp Exp $
29  *	and BSDI $Id: synch_machdep.c,v 2.3.2.39 2000/04/27 03:10:25 cp Exp $
30  */
31 
32 /*
33  * Implementation of the `witness' lock verifier.  Originally implemented for
34  * mutexes in BSD/OS.  Extended to handle generic lock objects and lock
35  * classes in FreeBSD.
36  */
37 
38 /*
39  *	Main Entry: witness
40  *	Pronunciation: 'wit-n&s
41  *	Function: noun
42  *	Etymology: Middle English witnesse, from Old English witnes knowledge,
43  *	    testimony, witness, from 2wit
44  *	Date: before 12th century
45  *	1 : attestation of a fact or event : TESTIMONY
46  *	2 : one that gives evidence; specifically : one who testifies in
47  *	    a cause or before a judicial tribunal
48  *	3 : one asked to be present at a transaction so as to be able to
49  *	    testify to its having taken place
50  *	4 : one who has personal knowledge of something
51  *	5 a : something serving as evidence or proof : SIGN
52  *	  b : public affirmation by word or example of usually
53  *	      religious faith or conviction <the heroic witness to divine
54  *	      life -- Pilot>
55  *	6 capitalized : a member of the Jehovah's Witnesses
56  */
57 
58 /*
59  * Special rules concerning Giant and lock orders:
60  *
61  * 1) Giant must be acquired before any other mutexes.  Stated another way,
62  *    no other mutex may be held when Giant is acquired.
63  *
64  * 2) Giant must be released when blocking on a sleepable lock.
65  *
66  * This rule is less obvious, but is a result of Giant providing the same
67  * semantics as spl().  Basically, when a thread sleeps, it must release
68  * Giant.  When a thread blocks on a sleepable lock, it sleeps.  Hence rule
69  * 2).
70  *
71  * 3) Giant may be acquired before or after sleepable locks.
72  *
73  * This rule is also not quite as obvious.  Giant may be acquired after
74  * a sleepable lock because it is a non-sleepable lock and non-sleepable
75  * locks may always be acquired while holding a sleepable lock.  The second
76  * case, Giant before a sleepable lock, follows from rule 2) above.  Suppose
77  * you have two threads T1 and T2 and a sleepable lock X.  Suppose that T1
78  * acquires X and blocks on Giant.  Then suppose that T2 acquires Giant and
79  * blocks on X.  When T2 blocks on X, T2 will release Giant allowing T1 to
80  * execute.  Thus, acquiring Giant both before and after a sleepable lock
81  * will not result in a lock order reversal.
82  */
83 
84 #include <sys/cdefs.h>
85 __FBSDID("$FreeBSD$");
86 
87 #include "opt_ddb.h"
88 #include "opt_witness.h"
89 
90 #include <sys/param.h>
91 #include <sys/bus.h>
92 #include <sys/kdb.h>
93 #include <sys/kernel.h>
94 #include <sys/ktr.h>
95 #include <sys/lock.h>
96 #include <sys/malloc.h>
97 #include <sys/mutex.h>
98 #include <sys/proc.h>
99 #include <sys/sysctl.h>
100 #include <sys/systm.h>
101 
102 #include <ddb/ddb.h>
103 
104 #include <machine/stdarg.h>
105 
106 /* Easier to stay with the old names. */
107 #define	lo_list		lo_witness_data.lod_list
108 #define	lo_witness	lo_witness_data.lod_witness
109 
110 /* Define this to check for blessed mutexes */
111 #undef BLESSING
112 
113 #define WITNESS_COUNT 1024
114 #define WITNESS_CHILDCOUNT (WITNESS_COUNT * 4)
115 /*
116  * XXX: This is somewhat bogus, as we assume here that at most 1024 threads
117  * will hold LOCK_NCHILDREN * 2 locks.  We handle failure ok, and we should
118  * probably be safe for the most part, but it's still a SWAG.
119  */
120 #define LOCK_CHILDCOUNT (MAXCPU + 1024) * 2
121 
122 #define	WITNESS_NCHILDREN 6
123 
124 struct witness_child_list_entry;
125 
126 struct witness {
127 	const	char *w_name;
128 	struct	lock_class *w_class;
129 	STAILQ_ENTRY(witness) w_list;		/* List of all witnesses. */
130 	STAILQ_ENTRY(witness) w_typelist;	/* Witnesses of a type. */
131 	struct	witness_child_list_entry *w_children;	/* Great evilness... */
132 	const	char *w_file;
133 	int	w_line;
134 	u_int	w_level;
135 	u_int	w_refcount;
136 	u_char	w_Giant_squawked:1;
137 	u_char	w_other_squawked:1;
138 	u_char	w_same_squawked:1;
139 	u_char	w_displayed:1;
140 };
141 
142 struct witness_child_list_entry {
143 	struct	witness_child_list_entry *wcl_next;
144 	struct	witness *wcl_children[WITNESS_NCHILDREN];
145 	u_int	wcl_count;
146 };
147 
148 STAILQ_HEAD(witness_list, witness);
149 
150 #ifdef BLESSING
151 struct witness_blessed {
152 	const	char *b_lock1;
153 	const	char *b_lock2;
154 };
155 #endif
156 
157 struct witness_order_list_entry {
158 	const	char *w_name;
159 	struct	lock_class *w_class;
160 };
161 
162 #ifdef BLESSING
163 static int	blessed(struct witness *, struct witness *);
164 #endif
165 static int	depart(struct witness *w);
166 static struct	witness *enroll(const char *description,
167 				struct lock_class *lock_class);
168 static int	insertchild(struct witness *parent, struct witness *child);
169 static int	isitmychild(struct witness *parent, struct witness *child);
170 static int	isitmydescendant(struct witness *parent, struct witness *child);
171 static int	itismychild(struct witness *parent, struct witness *child);
172 static void	removechild(struct witness *parent, struct witness *child);
173 static int	sysctl_debug_witness_watch(SYSCTL_HANDLER_ARGS);
174 static const char *fixup_filename(const char *file);
175 static struct	witness *witness_get(void);
176 static void	witness_free(struct witness *m);
177 static struct	witness_child_list_entry *witness_child_get(void);
178 static void	witness_child_free(struct witness_child_list_entry *wcl);
179 static struct	lock_list_entry *witness_lock_list_get(void);
180 static void	witness_lock_list_free(struct lock_list_entry *lle);
181 static struct	lock_instance *find_instance(struct lock_list_entry *lock_list,
182 					     struct lock_object *lock);
183 static void	witness_list_lock(struct lock_instance *instance);
184 #ifdef DDB
185 static void	witness_leveldescendents(struct witness *parent, int level);
186 static void	witness_levelall(void);
187 static void	witness_displaydescendants(void(*)(const char *fmt, ...),
188 					   struct witness *, int indent);
189 static void	witness_display_list(void(*prnt)(const char *fmt, ...),
190 				     struct witness_list *list);
191 static void	witness_display(void(*)(const char *fmt, ...));
192 static void	witness_list(struct thread *td);
193 #endif
194 
195 SYSCTL_NODE(_debug, OID_AUTO, witness, CTLFLAG_RW, 0, "Witness Locking");
196 
197 /*
198  * If set to 0, witness is disabled.  If set to a non-zero value, witness
199  * performs full lock order checking for all locks.  At runtime, this
200  * value may be set to 0 to turn off witness.  witness is not allowed be
201  * turned on once it is turned off, however.
202  */
203 static int witness_watch = 1;
204 TUNABLE_INT("debug.witness.watch", &witness_watch);
205 SYSCTL_PROC(_debug_witness, OID_AUTO, watch, CTLFLAG_RW | CTLTYPE_INT, NULL, 0,
206     sysctl_debug_witness_watch, "I", "witness is watching lock operations");
207 
208 #ifdef KDB
209 /*
210  * When KDB is enabled and witness_kdb is set to 1, it will cause the system
211  * to drop into kdebug() when:
212  *	- a lock hierarchy violation occurs
213  *	- locks are held when going to sleep.
214  */
215 #ifdef WITNESS_KDB
216 int	witness_kdb = 1;
217 #else
218 int	witness_kdb = 0;
219 #endif
220 TUNABLE_INT("debug.witness.kdb", &witness_kdb);
221 SYSCTL_INT(_debug_witness, OID_AUTO, kdb, CTLFLAG_RW, &witness_kdb, 0, "");
222 
223 /*
224  * When KDB is enabled and witness_trace is set to 1, it will cause the system
225  * to print a stack trace:
226  *	- a lock hierarchy violation occurs
227  *	- locks are held when going to sleep.
228  */
229 int	witness_trace = 1;
230 TUNABLE_INT("debug.witness.trace", &witness_trace);
231 SYSCTL_INT(_debug_witness, OID_AUTO, trace, CTLFLAG_RW, &witness_trace, 0, "");
232 #endif /* KDB */
233 
234 #ifdef WITNESS_SKIPSPIN
235 int	witness_skipspin = 1;
236 #else
237 int	witness_skipspin = 0;
238 #endif
239 TUNABLE_INT("debug.witness.skipspin", &witness_skipspin);
240 SYSCTL_INT(_debug_witness, OID_AUTO, skipspin, CTLFLAG_RDTUN,
241     &witness_skipspin, 0, "");
242 
243 static struct mtx w_mtx;
244 static struct witness_list w_free = STAILQ_HEAD_INITIALIZER(w_free);
245 static struct witness_list w_all = STAILQ_HEAD_INITIALIZER(w_all);
246 static struct witness_list w_spin = STAILQ_HEAD_INITIALIZER(w_spin);
247 static struct witness_list w_sleep = STAILQ_HEAD_INITIALIZER(w_sleep);
248 static struct witness_child_list_entry *w_child_free = NULL;
249 static struct lock_list_entry *w_lock_list_free = NULL;
250 
251 static int w_free_cnt, w_spin_cnt, w_sleep_cnt, w_child_free_cnt, w_child_cnt;
252 SYSCTL_INT(_debug_witness, OID_AUTO, free_cnt, CTLFLAG_RD, &w_free_cnt, 0, "");
253 SYSCTL_INT(_debug_witness, OID_AUTO, spin_cnt, CTLFLAG_RD, &w_spin_cnt, 0, "");
254 SYSCTL_INT(_debug_witness, OID_AUTO, sleep_cnt, CTLFLAG_RD, &w_sleep_cnt, 0,
255     "");
256 SYSCTL_INT(_debug_witness, OID_AUTO, child_free_cnt, CTLFLAG_RD,
257     &w_child_free_cnt, 0, "");
258 SYSCTL_INT(_debug_witness, OID_AUTO, child_cnt, CTLFLAG_RD, &w_child_cnt, 0,
259     "");
260 
261 static struct witness w_data[WITNESS_COUNT];
262 static struct witness_child_list_entry w_childdata[WITNESS_CHILDCOUNT];
263 static struct lock_list_entry w_locklistdata[LOCK_CHILDCOUNT];
264 
265 static struct witness_order_list_entry order_lists[] = {
266 	/*
267 	 * sx locks
268 	 */
269 	{ "proctree", &lock_class_sx },
270 	{ "allproc", &lock_class_sx },
271 	{ NULL, NULL },
272 	/*
273 	 * Various mutexes
274 	 */
275 	{ "Giant", &lock_class_mtx_sleep },
276 	{ "filedesc structure", &lock_class_mtx_sleep },
277 	{ "pipe mutex", &lock_class_mtx_sleep },
278 	{ "sigio lock", &lock_class_mtx_sleep },
279 	{ "process group", &lock_class_mtx_sleep },
280 	{ "process lock", &lock_class_mtx_sleep },
281 	{ "session", &lock_class_mtx_sleep },
282 	{ "uidinfo hash", &lock_class_mtx_sleep },
283 	{ "uidinfo struct", &lock_class_mtx_sleep },
284 	{ "allprison", &lock_class_mtx_sleep },
285 	{ NULL, NULL },
286 	/*
287 	 * Sockets
288 	 */
289 	{ "filedesc structure", &lock_class_mtx_sleep },
290 	{ "accept", &lock_class_mtx_sleep },
291 	{ "so_snd", &lock_class_mtx_sleep },
292 	{ "so_rcv", &lock_class_mtx_sleep },
293 	{ "sellck", &lock_class_mtx_sleep },
294 	{ NULL, NULL },
295 	/*
296 	 * Routing
297 	 */
298 	{ "so_rcv", &lock_class_mtx_sleep },
299 	{ "radix node head", &lock_class_mtx_sleep },
300 	{ "rtentry", &lock_class_mtx_sleep },
301 	{ "ifaddr", &lock_class_mtx_sleep },
302 	{ NULL, NULL },
303 	/*
304 	 * Multicast - protocol locks before interface locks, after UDP locks.
305 	 */
306 	{ "udpinp", &lock_class_mtx_sleep },
307 	{ "in_multi_mtx", &lock_class_mtx_sleep },
308 	{ "igmp_mtx", &lock_class_mtx_sleep },
309 	{ "if_addr_mtx", &lock_class_mtx_sleep },
310 	{ NULL, NULL },
311 	/*
312 	 * UNIX Domain Sockets
313 	 */
314 	{ "unp", &lock_class_mtx_sleep },
315 	{ "so_snd", &lock_class_mtx_sleep },
316 	{ NULL, NULL },
317 	/*
318 	 * UDP/IP
319 	 */
320 	{ "udp", &lock_class_mtx_sleep },
321 	{ "udpinp", &lock_class_mtx_sleep },
322 	{ "so_snd", &lock_class_mtx_sleep },
323 	{ NULL, NULL },
324 	/*
325 	 * TCP/IP
326 	 */
327 	{ "tcp", &lock_class_mtx_sleep },
328 	{ "tcpinp", &lock_class_mtx_sleep },
329 	{ "so_snd", &lock_class_mtx_sleep },
330 	{ NULL, NULL },
331 	/*
332 	 * SLIP
333 	 */
334 	{ "slip_mtx", &lock_class_mtx_sleep },
335 	{ "slip sc_mtx", &lock_class_mtx_sleep },
336 	{ NULL, NULL },
337 	/*
338 	 * netatalk
339 	 */
340 	{ "ddp_list_mtx", &lock_class_mtx_sleep },
341 	{ "ddp_mtx", &lock_class_mtx_sleep },
342 	{ NULL, NULL },
343 	/*
344 	 * BPF
345 	 */
346 	{ "bpf global lock", &lock_class_mtx_sleep },
347 	{ "bpf interface lock", &lock_class_mtx_sleep },
348 	{ "bpf cdev lock", &lock_class_mtx_sleep },
349 	{ NULL, NULL },
350 	/*
351 	 * NFS server
352 	 */
353 	{ "nfsd_mtx", &lock_class_mtx_sleep },
354 	{ "so_snd", &lock_class_mtx_sleep },
355 	{ NULL, NULL },
356 	/*
357 	 * CDEV
358 	 */
359 	{ "system map", &lock_class_mtx_sleep },
360 	{ "vm page queue mutex", &lock_class_mtx_sleep },
361 	{ "vnode interlock", &lock_class_mtx_sleep },
362 	{ "cdev", &lock_class_mtx_sleep },
363 	{ NULL, NULL },
364 	/*
365 	 * spin locks
366 	 */
367 #ifdef SMP
368 	{ "ap boot", &lock_class_mtx_spin },
369 #endif
370 	{ "rm.mutex_mtx", &lock_class_mtx_spin },
371 	{ "hptlock", &lock_class_mtx_spin },
372 	{ "sio", &lock_class_mtx_spin },
373 #ifdef __i386__
374 	{ "cy", &lock_class_mtx_spin },
375 #endif
376 	{ "uart_hwmtx", &lock_class_mtx_spin },
377 	{ "sabtty", &lock_class_mtx_spin },
378 	{ "zstty", &lock_class_mtx_spin },
379 	{ "ng_node", &lock_class_mtx_spin },
380 	{ "ng_worklist", &lock_class_mtx_spin },
381 	{ "taskqueue_fast", &lock_class_mtx_spin },
382 	{ "intr table", &lock_class_mtx_spin },
383 	{ "sleepq chain", &lock_class_mtx_spin },
384 	{ "sched lock", &lock_class_mtx_spin },
385 	{ "turnstile chain", &lock_class_mtx_spin },
386 	{ "td_contested", &lock_class_mtx_spin },
387 	{ "callout", &lock_class_mtx_spin },
388 	{ "entropy harvest mutex", &lock_class_mtx_spin },
389 	/*
390 	 * leaf locks
391 	 */
392 	{ "allpmaps", &lock_class_mtx_spin },
393 	{ "vm page queue free mutex", &lock_class_mtx_spin },
394 	{ "icu", &lock_class_mtx_spin },
395 #ifdef SMP
396 	{ "smp rendezvous", &lock_class_mtx_spin },
397 #if defined(__i386__) || defined(__amd64__)
398 	{ "tlb", &lock_class_mtx_spin },
399 #endif
400 #ifdef __sparc64__
401 	{ "ipi", &lock_class_mtx_spin },
402 	{ "rtc_mtx", &lock_class_mtx_spin },
403 #endif
404 #endif
405 	{ "clk", &lock_class_mtx_spin },
406 	{ "mutex profiling lock", &lock_class_mtx_spin },
407 	{ "kse zombie lock", &lock_class_mtx_spin },
408 	{ "ALD Queue", &lock_class_mtx_spin },
409 #ifdef __ia64__
410 	{ "MCA spin lock", &lock_class_mtx_spin },
411 #endif
412 #if defined(__i386__) || defined(__amd64__)
413 	{ "pcicfg", &lock_class_mtx_spin },
414 	{ "NDIS thread lock", &lock_class_mtx_spin },
415 #endif
416 	{ "tw_osl_io_lock", &lock_class_mtx_spin },
417 	{ "tw_osl_q_lock", &lock_class_mtx_spin },
418 	{ "tw_cl_io_lock", &lock_class_mtx_spin },
419 	{ "tw_cl_intr_lock", &lock_class_mtx_spin },
420 	{ "tw_cl_gen_lock", &lock_class_mtx_spin },
421 	{ NULL, NULL },
422 	{ NULL, NULL }
423 };
424 
425 #ifdef BLESSING
426 /*
427  * Pairs of locks which have been blessed
428  * Don't complain about order problems with blessed locks
429  */
430 static struct witness_blessed blessed_list[] = {
431 };
432 static int blessed_count =
433 	sizeof(blessed_list) / sizeof(struct witness_blessed);
434 #endif
435 
436 /*
437  * List of locks initialized prior to witness being initialized whose
438  * enrollment is currently deferred.
439  */
440 STAILQ_HEAD(, lock_object) pending_locks =
441     STAILQ_HEAD_INITIALIZER(pending_locks);
442 
443 /*
444  * This global is set to 0 once it becomes safe to use the witness code.
445  */
446 static int witness_cold = 1;
447 
448 /*
449  * This global is set to 1 once the static lock orders have been enrolled
450  * so that a warning can be issued for any spin locks enrolled later.
451  */
452 static int witness_spin_warn = 0;
453 
454 /*
455  * The WITNESS-enabled diagnostic code.  Note that the witness code does
456  * assume that the early boot is single-threaded at least until after this
457  * routine is completed.
458  */
459 static void
460 witness_initialize(void *dummy __unused)
461 {
462 	struct lock_object *lock;
463 	struct witness_order_list_entry *order;
464 	struct witness *w, *w1;
465 	int i;
466 
467 	/*
468 	 * We have to release Giant before initializing its witness
469 	 * structure so that WITNESS doesn't get confused.
470 	 */
471 	mtx_unlock(&Giant);
472 	mtx_assert(&Giant, MA_NOTOWNED);
473 
474 	CTR1(KTR_WITNESS, "%s: initializing witness", __func__);
475 	mtx_init(&w_mtx, "witness lock", NULL, MTX_SPIN | MTX_QUIET |
476 	    MTX_NOWITNESS);
477 	for (i = 0; i < WITNESS_COUNT; i++)
478 		witness_free(&w_data[i]);
479 	for (i = 0; i < WITNESS_CHILDCOUNT; i++)
480 		witness_child_free(&w_childdata[i]);
481 	for (i = 0; i < LOCK_CHILDCOUNT; i++)
482 		witness_lock_list_free(&w_locklistdata[i]);
483 
484 	/* First add in all the specified order lists. */
485 	for (order = order_lists; order->w_name != NULL; order++) {
486 		w = enroll(order->w_name, order->w_class);
487 		if (w == NULL)
488 			continue;
489 		w->w_file = "order list";
490 		for (order++; order->w_name != NULL; order++) {
491 			w1 = enroll(order->w_name, order->w_class);
492 			if (w1 == NULL)
493 				continue;
494 			w1->w_file = "order list";
495 			if (!itismychild(w, w1))
496 				panic("Not enough memory for static orders!");
497 			w = w1;
498 		}
499 	}
500 	witness_spin_warn = 1;
501 
502 	/* Iterate through all locks and add them to witness. */
503 	while (!STAILQ_EMPTY(&pending_locks)) {
504 		lock = STAILQ_FIRST(&pending_locks);
505 		STAILQ_REMOVE_HEAD(&pending_locks, lo_list);
506 		KASSERT(lock->lo_flags & LO_WITNESS,
507 		    ("%s: lock %s is on pending list but not LO_WITNESS",
508 		    __func__, lock->lo_name));
509 		lock->lo_witness = enroll(lock->lo_type, lock->lo_class);
510 	}
511 
512 	/* Mark the witness code as being ready for use. */
513 	witness_cold = 0;
514 
515 	mtx_lock(&Giant);
516 }
517 SYSINIT(witness_init, SI_SUB_WITNESS, SI_ORDER_FIRST, witness_initialize, NULL)
518 
519 static int
520 sysctl_debug_witness_watch(SYSCTL_HANDLER_ARGS)
521 {
522 	int error, value;
523 
524 	value = witness_watch;
525 	error = sysctl_handle_int(oidp, &value, 0, req);
526 	if (error != 0 || req->newptr == NULL)
527 		return (error);
528 	error = suser(req->td);
529 	if (error != 0)
530 		return (error);
531 	if (value == witness_watch)
532 		return (0);
533 	if (value != 0)
534 		return (EINVAL);
535 	witness_watch = 0;
536 	return (0);
537 }
538 
539 void
540 witness_init(struct lock_object *lock)
541 {
542 	struct lock_class *class;
543 
544 	/* Various sanity checks. */
545 	class = lock->lo_class;
546 	if (lock->lo_flags & LO_INITIALIZED)
547 		panic("%s: lock (%s) %s is already initialized", __func__,
548 		    class->lc_name, lock->lo_name);
549 	if ((lock->lo_flags & LO_RECURSABLE) != 0 &&
550 	    (class->lc_flags & LC_RECURSABLE) == 0)
551 		panic("%s: lock (%s) %s can not be recursable", __func__,
552 		    class->lc_name, lock->lo_name);
553 	if ((lock->lo_flags & LO_SLEEPABLE) != 0 &&
554 	    (class->lc_flags & LC_SLEEPABLE) == 0)
555 		panic("%s: lock (%s) %s can not be sleepable", __func__,
556 		    class->lc_name, lock->lo_name);
557 	if ((lock->lo_flags & LO_UPGRADABLE) != 0 &&
558 	    (class->lc_flags & LC_UPGRADABLE) == 0)
559 		panic("%s: lock (%s) %s can not be upgradable", __func__,
560 		    class->lc_name, lock->lo_name);
561 
562 	/*
563 	 * If we shouldn't watch this lock, then just clear lo_witness.
564 	 * Otherwise, if witness_cold is set, then it is too early to
565 	 * enroll this lock, so defer it to witness_initialize() by adding
566 	 * it to the pending_locks list.  If it is not too early, then enroll
567 	 * the lock now.
568 	 */
569 	lock->lo_flags |= LO_INITIALIZED;
570 	if (witness_watch == 0 || panicstr != NULL ||
571 	    (lock->lo_flags & LO_WITNESS) == 0)
572 		lock->lo_witness = NULL;
573 	else if (witness_cold) {
574 		STAILQ_INSERT_TAIL(&pending_locks, lock, lo_list);
575 		lock->lo_flags |= LO_ENROLLPEND;
576 	} else
577 		lock->lo_witness = enroll(lock->lo_type, class);
578 }
579 
580 void
581 witness_destroy(struct lock_object *lock)
582 {
583 	struct witness *w;
584 
585 	if (witness_cold)
586 		panic("lock (%s) %s destroyed while witness_cold",
587 		    lock->lo_class->lc_name, lock->lo_name);
588 	if ((lock->lo_flags & LO_INITIALIZED) == 0)
589 		panic("%s: lock (%s) %s is not initialized", __func__,
590 		    lock->lo_class->lc_name, lock->lo_name);
591 
592 	/* XXX: need to verify that no one holds the lock */
593 	if ((lock->lo_flags & (LO_WITNESS | LO_ENROLLPEND)) == LO_WITNESS &&
594 	    lock->lo_witness != NULL) {
595 		w = lock->lo_witness;
596 		mtx_lock_spin(&w_mtx);
597 		MPASS(w->w_refcount > 0);
598 		w->w_refcount--;
599 
600 		/*
601 		 * Lock is already released if we have an allocation failure
602 		 * and depart() fails.
603 		 */
604 		if (w->w_refcount != 0 || depart(w))
605 			mtx_unlock_spin(&w_mtx);
606 	}
607 
608 	/*
609 	 * If this lock is destroyed before witness is up and running,
610 	 * remove it from the pending list.
611 	 */
612 	if (lock->lo_flags & LO_ENROLLPEND) {
613 		STAILQ_REMOVE(&pending_locks, lock, lock_object, lo_list);
614 		lock->lo_flags &= ~LO_ENROLLPEND;
615 	}
616 	lock->lo_flags &= ~LO_INITIALIZED;
617 }
618 
619 #ifdef DDB
620 static void
621 witness_levelall (void)
622 {
623 	struct witness_list *list;
624 	struct witness *w, *w1;
625 
626 	/*
627 	 * First clear all levels.
628 	 */
629 	STAILQ_FOREACH(w, &w_all, w_list) {
630 		w->w_level = 0;
631 	}
632 
633 	/*
634 	 * Look for locks with no parent and level all their descendants.
635 	 */
636 	STAILQ_FOREACH(w, &w_all, w_list) {
637 		/*
638 		 * This is just an optimization, technically we could get
639 		 * away just walking the all list each time.
640 		 */
641 		if (w->w_class->lc_flags & LC_SLEEPLOCK)
642 			list = &w_sleep;
643 		else
644 			list = &w_spin;
645 		STAILQ_FOREACH(w1, list, w_typelist) {
646 			if (isitmychild(w1, w))
647 				goto skip;
648 		}
649 		witness_leveldescendents(w, 0);
650 	skip:
651 		;	/* silence GCC 3.x */
652 	}
653 }
654 
655 static void
656 witness_leveldescendents(struct witness *parent, int level)
657 {
658 	struct witness_child_list_entry *wcl;
659 	int i;
660 
661 	if (parent->w_level < level)
662 		parent->w_level = level;
663 	level++;
664 	for (wcl = parent->w_children; wcl != NULL; wcl = wcl->wcl_next)
665 		for (i = 0; i < wcl->wcl_count; i++)
666 			witness_leveldescendents(wcl->wcl_children[i], level);
667 }
668 
669 static void
670 witness_displaydescendants(void(*prnt)(const char *fmt, ...),
671 			   struct witness *parent, int indent)
672 {
673 	struct witness_child_list_entry *wcl;
674 	int i, level;
675 
676 	level = parent->w_level;
677 	prnt("%-2d", level);
678 	for (i = 0; i < indent; i++)
679 		prnt(" ");
680 	if (parent->w_refcount > 0)
681 		prnt("%s", parent->w_name);
682 	else
683 		prnt("(dead)");
684 	if (parent->w_displayed) {
685 		prnt(" -- (already displayed)\n");
686 		return;
687 	}
688 	parent->w_displayed = 1;
689 	if (parent->w_refcount > 0) {
690 		if (parent->w_file != NULL)
691 			prnt(" -- last acquired @ %s:%d", parent->w_file,
692 			    parent->w_line);
693 	}
694 	prnt("\n");
695 	for (wcl = parent->w_children; wcl != NULL; wcl = wcl->wcl_next)
696 		for (i = 0; i < wcl->wcl_count; i++)
697 			    witness_displaydescendants(prnt,
698 				wcl->wcl_children[i], indent + 1);
699 }
700 
701 static void
702 witness_display_list(void(*prnt)(const char *fmt, ...),
703 		     struct witness_list *list)
704 {
705 	struct witness *w;
706 
707 	STAILQ_FOREACH(w, list, w_typelist) {
708 		if (w->w_file == NULL || w->w_level > 0)
709 			continue;
710 		/*
711 		 * This lock has no anscestors, display its descendants.
712 		 */
713 		witness_displaydescendants(prnt, w, 0);
714 	}
715 }
716 
717 static void
718 witness_display(void(*prnt)(const char *fmt, ...))
719 {
720 	struct witness *w;
721 
722 	KASSERT(!witness_cold, ("%s: witness_cold", __func__));
723 	witness_levelall();
724 
725 	/* Clear all the displayed flags. */
726 	STAILQ_FOREACH(w, &w_all, w_list) {
727 		w->w_displayed = 0;
728 	}
729 
730 	/*
731 	 * First, handle sleep locks which have been acquired at least
732 	 * once.
733 	 */
734 	prnt("Sleep locks:\n");
735 	witness_display_list(prnt, &w_sleep);
736 
737 	/*
738 	 * Now do spin locks which have been acquired at least once.
739 	 */
740 	prnt("\nSpin locks:\n");
741 	witness_display_list(prnt, &w_spin);
742 
743 	/*
744 	 * Finally, any locks which have not been acquired yet.
745 	 */
746 	prnt("\nLocks which were never acquired:\n");
747 	STAILQ_FOREACH(w, &w_all, w_list) {
748 		if (w->w_file != NULL || w->w_refcount == 0)
749 			continue;
750 		prnt("%s\n", w->w_name);
751 	}
752 }
753 #endif /* DDB */
754 
755 /* Trim useless garbage from filenames. */
756 static const char *
757 fixup_filename(const char *file)
758 {
759 
760 	if (file == NULL)
761 		return (NULL);
762 	while (strncmp(file, "../", 3) == 0)
763 		file += 3;
764 	return (file);
765 }
766 
767 int
768 witness_defineorder(struct lock_object *lock1, struct lock_object *lock2)
769 {
770 
771 	if (witness_watch == 0 || panicstr != NULL)
772 		return (0);
773 
774 	/* Require locks that witness knows about. */
775 	if (lock1 == NULL || lock1->lo_witness == NULL || lock2 == NULL ||
776 	    lock2->lo_witness == NULL)
777 		return (EINVAL);
778 
779 	MPASS(!mtx_owned(&w_mtx));
780 	mtx_lock_spin(&w_mtx);
781 
782 	/*
783 	 * If we already have either an explicit or implied lock order that
784 	 * is the other way around, then return an error.
785 	 */
786 	if (isitmydescendant(lock2->lo_witness, lock1->lo_witness)) {
787 		mtx_unlock_spin(&w_mtx);
788 		return (EDOOFUS);
789 	}
790 
791 	/* Try to add the new order. */
792 	CTR3(KTR_WITNESS, "%s: adding %s as a child of %s", __func__,
793 	    lock2->lo_type, lock1->lo_type);
794 	if (!itismychild(lock1->lo_witness, lock2->lo_witness))
795 		return (ENOMEM);
796 	mtx_unlock_spin(&w_mtx);
797 	return (0);
798 }
799 
800 void
801 witness_checkorder(struct lock_object *lock, int flags, const char *file,
802     int line)
803 {
804 	struct lock_list_entry **lock_list, *lle;
805 	struct lock_instance *lock1, *lock2;
806 	struct lock_class *class;
807 	struct witness *w, *w1;
808 	struct thread *td;
809 	int i, j;
810 
811 	if (witness_cold || witness_watch == 0 || lock->lo_witness == NULL ||
812 	    panicstr != NULL)
813 		return;
814 
815 	/*
816 	 * Try locks do not block if they fail to acquire the lock, thus
817 	 * there is no danger of deadlocks or of switching while holding a
818 	 * spin lock if we acquire a lock via a try operation.  This
819 	 * function shouldn't even be called for try locks, so panic if
820 	 * that happens.
821 	 */
822 	if (flags & LOP_TRYLOCK)
823 		panic("%s should not be called for try lock operations",
824 		    __func__);
825 
826 	w = lock->lo_witness;
827 	class = lock->lo_class;
828 	td = curthread;
829 	file = fixup_filename(file);
830 
831 	if (class->lc_flags & LC_SLEEPLOCK) {
832 		/*
833 		 * Since spin locks include a critical section, this check
834 		 * implicitly enforces a lock order of all sleep locks before
835 		 * all spin locks.
836 		 */
837 		if (td->td_critnest != 0 && !kdb_active)
838 			panic("blockable sleep lock (%s) %s @ %s:%d",
839 			    class->lc_name, lock->lo_name, file, line);
840 
841 		/*
842 		 * If this is the first lock acquired then just return as
843 		 * no order checking is needed.
844 		 */
845 		if (td->td_sleeplocks == NULL)
846 			return;
847 		lock_list = &td->td_sleeplocks;
848 	} else {
849 		/*
850 		 * If this is the first lock, just return as no order
851 		 * checking is needed.  We check this in both if clauses
852 		 * here as unifying the check would require us to use a
853 		 * critical section to ensure we don't migrate while doing
854 		 * the check.  Note that if this is not the first lock, we
855 		 * are already in a critical section and are safe for the
856 		 * rest of the check.
857 		 */
858 		if (PCPU_GET(spinlocks) == NULL)
859 			return;
860 		lock_list = PCPU_PTR(spinlocks);
861 	}
862 
863 	/*
864 	 * Check to see if we are recursing on a lock we already own.  If
865 	 * so, make sure that we don't mismatch exclusive and shared lock
866 	 * acquires.
867 	 */
868 	lock1 = find_instance(*lock_list, lock);
869 	if (lock1 != NULL) {
870 		if ((lock1->li_flags & LI_EXCLUSIVE) != 0 &&
871 		    (flags & LOP_EXCLUSIVE) == 0) {
872 			printf("shared lock of (%s) %s @ %s:%d\n",
873 			    class->lc_name, lock->lo_name, file, line);
874 			printf("while exclusively locked from %s:%d\n",
875 			    lock1->li_file, lock1->li_line);
876 			panic("share->excl");
877 		}
878 		if ((lock1->li_flags & LI_EXCLUSIVE) == 0 &&
879 		    (flags & LOP_EXCLUSIVE) != 0) {
880 			printf("exclusive lock of (%s) %s @ %s:%d\n",
881 			    class->lc_name, lock->lo_name, file, line);
882 			printf("while share locked from %s:%d\n",
883 			    lock1->li_file, lock1->li_line);
884 			panic("excl->share");
885 		}
886 		return;
887 	}
888 
889 	/*
890 	 * Try locks do not block if they fail to acquire the lock, thus
891 	 * there is no danger of deadlocks or of switching while holding a
892 	 * spin lock if we acquire a lock via a try operation.
893 	 */
894 	if (flags & LOP_TRYLOCK)
895 		return;
896 
897 	/*
898 	 * Check for duplicate locks of the same type.  Note that we only
899 	 * have to check for this on the last lock we just acquired.  Any
900 	 * other cases will be caught as lock order violations.
901 	 */
902 	lock1 = &(*lock_list)->ll_children[(*lock_list)->ll_count - 1];
903 	w1 = lock1->li_lock->lo_witness;
904 	if (w1 == w) {
905 		if (w->w_same_squawked || (lock->lo_flags & LO_DUPOK) ||
906 		    (flags & LOP_DUPOK))
907 			return;
908 		w->w_same_squawked = 1;
909 		printf("acquiring duplicate lock of same type: \"%s\"\n",
910 			lock->lo_type);
911 		printf(" 1st %s @ %s:%d\n", lock1->li_lock->lo_name,
912 		    lock1->li_file, lock1->li_line);
913 		printf(" 2nd %s @ %s:%d\n", lock->lo_name, file, line);
914 #ifdef KDB
915 		goto debugger;
916 #else
917 		return;
918 #endif
919 	}
920 	MPASS(!mtx_owned(&w_mtx));
921 	mtx_lock_spin(&w_mtx);
922 	/*
923 	 * If we know that the the lock we are acquiring comes after
924 	 * the lock we most recently acquired in the lock order tree,
925 	 * then there is no need for any further checks.
926 	 */
927 	if (isitmychild(w1, w)) {
928 		mtx_unlock_spin(&w_mtx);
929 		return;
930 	}
931 	for (j = 0, lle = *lock_list; lle != NULL; lle = lle->ll_next) {
932 		for (i = lle->ll_count - 1; i >= 0; i--, j++) {
933 
934 			MPASS(j < WITNESS_COUNT);
935 			lock1 = &lle->ll_children[i];
936 			w1 = lock1->li_lock->lo_witness;
937 
938 			/*
939 			 * If this lock doesn't undergo witness checking,
940 			 * then skip it.
941 			 */
942 			if (w1 == NULL) {
943 				KASSERT((lock1->li_lock->lo_flags & LO_WITNESS) == 0,
944 				    ("lock missing witness structure"));
945 				continue;
946 			}
947 			/*
948 			 * If we are locking Giant and this is a sleepable
949 			 * lock, then skip it.
950 			 */
951 			if ((lock1->li_lock->lo_flags & LO_SLEEPABLE) != 0 &&
952 			    lock == &Giant.mtx_object)
953 				continue;
954 			/*
955 			 * If we are locking a sleepable lock and this lock
956 			 * is Giant, then skip it.
957 			 */
958 			if ((lock->lo_flags & LO_SLEEPABLE) != 0 &&
959 			    lock1->li_lock == &Giant.mtx_object)
960 				continue;
961 			/*
962 			 * If we are locking a sleepable lock and this lock
963 			 * isn't sleepable, we want to treat it as a lock
964 			 * order violation to enfore a general lock order of
965 			 * sleepable locks before non-sleepable locks.
966 			 */
967 			if (((lock->lo_flags & LO_SLEEPABLE) != 0 &&
968 			    (lock1->li_lock->lo_flags & LO_SLEEPABLE) == 0))
969 				goto reversal;
970 			/*
971 			 * If we are locking Giant and this is a non-sleepable
972 			 * lock, then treat it as a reversal.
973 			 */
974 			if ((lock1->li_lock->lo_flags & LO_SLEEPABLE) == 0 &&
975 			    lock == &Giant.mtx_object)
976 				goto reversal;
977 			/*
978 			 * Check the lock order hierarchy for a reveresal.
979 			 */
980 			if (!isitmydescendant(w, w1))
981 				continue;
982 		reversal:
983 			/*
984 			 * We have a lock order violation, check to see if it
985 			 * is allowed or has already been yelled about.
986 			 */
987 			mtx_unlock_spin(&w_mtx);
988 #ifdef BLESSING
989 			/*
990 			 * If the lock order is blessed, just bail.  We don't
991 			 * look for other lock order violations though, which
992 			 * may be a bug.
993 			 */
994 			if (blessed(w, w1))
995 				return;
996 #endif
997 			if (lock1->li_lock == &Giant.mtx_object) {
998 				if (w1->w_Giant_squawked)
999 					return;
1000 				else
1001 					w1->w_Giant_squawked = 1;
1002 			} else {
1003 				if (w1->w_other_squawked)
1004 					return;
1005 				else
1006 					w1->w_other_squawked = 1;
1007 			}
1008 			/*
1009 			 * Ok, yell about it.
1010 			 */
1011 			if (((lock->lo_flags & LO_SLEEPABLE) != 0 &&
1012 			    (lock1->li_lock->lo_flags & LO_SLEEPABLE) == 0))
1013 				printf(
1014 		"lock order reversal: (sleepable after non-sleepable)\n");
1015 			else if ((lock1->li_lock->lo_flags & LO_SLEEPABLE) == 0
1016 			    && lock == &Giant.mtx_object)
1017 				printf(
1018 		"lock order reversal: (Giant after non-sleepable)\n");
1019 			else
1020 				printf("lock order reversal:\n");
1021 			/*
1022 			 * Try to locate an earlier lock with
1023 			 * witness w in our list.
1024 			 */
1025 			do {
1026 				lock2 = &lle->ll_children[i];
1027 				MPASS(lock2->li_lock != NULL);
1028 				if (lock2->li_lock->lo_witness == w)
1029 					break;
1030 				if (i == 0 && lle->ll_next != NULL) {
1031 					lle = lle->ll_next;
1032 					i = lle->ll_count - 1;
1033 					MPASS(i >= 0 && i < LOCK_NCHILDREN);
1034 				} else
1035 					i--;
1036 			} while (i >= 0);
1037 			if (i < 0) {
1038 				printf(" 1st %p %s (%s) @ %s:%d\n",
1039 				    lock1->li_lock, lock1->li_lock->lo_name,
1040 				    lock1->li_lock->lo_type, lock1->li_file,
1041 				    lock1->li_line);
1042 				printf(" 2nd %p %s (%s) @ %s:%d\n", lock,
1043 				    lock->lo_name, lock->lo_type, file, line);
1044 			} else {
1045 				printf(" 1st %p %s (%s) @ %s:%d\n",
1046 				    lock2->li_lock, lock2->li_lock->lo_name,
1047 				    lock2->li_lock->lo_type, lock2->li_file,
1048 				    lock2->li_line);
1049 				printf(" 2nd %p %s (%s) @ %s:%d\n",
1050 				    lock1->li_lock, lock1->li_lock->lo_name,
1051 				    lock1->li_lock->lo_type, lock1->li_file,
1052 				    lock1->li_line);
1053 				printf(" 3rd %p %s (%s) @ %s:%d\n", lock,
1054 				    lock->lo_name, lock->lo_type, file, line);
1055 			}
1056 #ifdef KDB
1057 			goto debugger;
1058 #else
1059 			return;
1060 #endif
1061 		}
1062 	}
1063 	lock1 = &(*lock_list)->ll_children[(*lock_list)->ll_count - 1];
1064 	/*
1065 	 * If requested, build a new lock order.  However, don't build a new
1066 	 * relationship between a sleepable lock and Giant if it is in the
1067 	 * wrong direction.  The correct lock order is that sleepable locks
1068 	 * always come before Giant.
1069 	 */
1070 	if (flags & LOP_NEWORDER &&
1071 	    !(lock1->li_lock == &Giant.mtx_object &&
1072 	    (lock->lo_flags & LO_SLEEPABLE) != 0)) {
1073 		CTR3(KTR_WITNESS, "%s: adding %s as a child of %s", __func__,
1074 		    lock->lo_type, lock1->li_lock->lo_type);
1075 		if (!itismychild(lock1->li_lock->lo_witness, w))
1076 			/* Witness is dead. */
1077 			return;
1078 	}
1079 	mtx_unlock_spin(&w_mtx);
1080 	return;
1081 
1082 #ifdef KDB
1083 debugger:
1084 	if (witness_trace)
1085 		kdb_backtrace();
1086 	if (witness_kdb)
1087 		kdb_enter(__func__);
1088 #endif
1089 }
1090 
1091 void
1092 witness_lock(struct lock_object *lock, int flags, const char *file, int line)
1093 {
1094 	struct lock_list_entry **lock_list, *lle;
1095 	struct lock_instance *instance;
1096 	struct witness *w;
1097 	struct thread *td;
1098 
1099 	if (witness_cold || witness_watch == 0 || lock->lo_witness == NULL ||
1100 	    panicstr != NULL)
1101 		return;
1102 	w = lock->lo_witness;
1103 	td = curthread;
1104 	file = fixup_filename(file);
1105 
1106 	/* Determine lock list for this lock. */
1107 	if (lock->lo_class->lc_flags & LC_SLEEPLOCK)
1108 		lock_list = &td->td_sleeplocks;
1109 	else
1110 		lock_list = PCPU_PTR(spinlocks);
1111 
1112 	/* Check to see if we are recursing on a lock we already own. */
1113 	instance = find_instance(*lock_list, lock);
1114 	if (instance != NULL) {
1115 		instance->li_flags++;
1116 		CTR4(KTR_WITNESS, "%s: pid %d recursed on %s r=%d", __func__,
1117 		    td->td_proc->p_pid, lock->lo_name,
1118 		    instance->li_flags & LI_RECURSEMASK);
1119 		instance->li_file = file;
1120 		instance->li_line = line;
1121 		return;
1122 	}
1123 
1124 	/* Update per-witness last file and line acquire. */
1125 	w->w_file = file;
1126 	w->w_line = line;
1127 
1128 	/* Find the next open lock instance in the list and fill it. */
1129 	lle = *lock_list;
1130 	if (lle == NULL || lle->ll_count == LOCK_NCHILDREN) {
1131 		lle = witness_lock_list_get();
1132 		if (lle == NULL)
1133 			return;
1134 		lle->ll_next = *lock_list;
1135 		CTR3(KTR_WITNESS, "%s: pid %d added lle %p", __func__,
1136 		    td->td_proc->p_pid, lle);
1137 		*lock_list = lle;
1138 	}
1139 	instance = &lle->ll_children[lle->ll_count++];
1140 	instance->li_lock = lock;
1141 	instance->li_line = line;
1142 	instance->li_file = file;
1143 	if ((flags & LOP_EXCLUSIVE) != 0)
1144 		instance->li_flags = LI_EXCLUSIVE;
1145 	else
1146 		instance->li_flags = 0;
1147 	CTR4(KTR_WITNESS, "%s: pid %d added %s as lle[%d]", __func__,
1148 	    td->td_proc->p_pid, lock->lo_name, lle->ll_count - 1);
1149 }
1150 
1151 void
1152 witness_upgrade(struct lock_object *lock, int flags, const char *file, int line)
1153 {
1154 	struct lock_instance *instance;
1155 	struct lock_class *class;
1156 
1157 	KASSERT(!witness_cold, ("%s: witness_cold", __func__));
1158 	if (lock->lo_witness == NULL || witness_watch == 0 || panicstr != NULL)
1159 		return;
1160 	class = lock->lo_class;
1161 	file = fixup_filename(file);
1162 	if ((lock->lo_flags & LO_UPGRADABLE) == 0)
1163 		panic("upgrade of non-upgradable lock (%s) %s @ %s:%d",
1164 		    class->lc_name, lock->lo_name, file, line);
1165 	if ((flags & LOP_TRYLOCK) == 0)
1166 		panic("non-try upgrade of lock (%s) %s @ %s:%d", class->lc_name,
1167 		    lock->lo_name, file, line);
1168 	if ((lock->lo_class->lc_flags & LC_SLEEPLOCK) == 0)
1169 		panic("upgrade of non-sleep lock (%s) %s @ %s:%d",
1170 		    class->lc_name, lock->lo_name, file, line);
1171 	instance = find_instance(curthread->td_sleeplocks, lock);
1172 	if (instance == NULL)
1173 		panic("upgrade of unlocked lock (%s) %s @ %s:%d",
1174 		    class->lc_name, lock->lo_name, file, line);
1175 	if ((instance->li_flags & LI_EXCLUSIVE) != 0)
1176 		panic("upgrade of exclusive lock (%s) %s @ %s:%d",
1177 		    class->lc_name, lock->lo_name, file, line);
1178 	if ((instance->li_flags & LI_RECURSEMASK) != 0)
1179 		panic("upgrade of recursed lock (%s) %s r=%d @ %s:%d",
1180 		    class->lc_name, lock->lo_name,
1181 		    instance->li_flags & LI_RECURSEMASK, file, line);
1182 	instance->li_flags |= LI_EXCLUSIVE;
1183 }
1184 
1185 void
1186 witness_downgrade(struct lock_object *lock, int flags, const char *file,
1187     int line)
1188 {
1189 	struct lock_instance *instance;
1190 	struct lock_class *class;
1191 
1192 	KASSERT(!witness_cold, ("%s: witness_cold", __func__));
1193 	if (lock->lo_witness == NULL || witness_watch == 0 || panicstr != NULL)
1194 		return;
1195 	class = lock->lo_class;
1196 	file = fixup_filename(file);
1197 	if ((lock->lo_flags & LO_UPGRADABLE) == 0)
1198 		panic("downgrade of non-upgradable lock (%s) %s @ %s:%d",
1199 		    class->lc_name, lock->lo_name, file, line);
1200 	if ((lock->lo_class->lc_flags & LC_SLEEPLOCK) == 0)
1201 		panic("downgrade of non-sleep lock (%s) %s @ %s:%d",
1202 		    class->lc_name, lock->lo_name, file, line);
1203 	instance = find_instance(curthread->td_sleeplocks, lock);
1204 	if (instance == NULL)
1205 		panic("downgrade of unlocked lock (%s) %s @ %s:%d",
1206 		    class->lc_name, lock->lo_name, file, line);
1207 	if ((instance->li_flags & LI_EXCLUSIVE) == 0)
1208 		panic("downgrade of shared lock (%s) %s @ %s:%d",
1209 		    class->lc_name, lock->lo_name, file, line);
1210 	if ((instance->li_flags & LI_RECURSEMASK) != 0)
1211 		panic("downgrade of recursed lock (%s) %s r=%d @ %s:%d",
1212 		    class->lc_name, lock->lo_name,
1213 		    instance->li_flags & LI_RECURSEMASK, file, line);
1214 	instance->li_flags &= ~LI_EXCLUSIVE;
1215 }
1216 
1217 void
1218 witness_unlock(struct lock_object *lock, int flags, const char *file, int line)
1219 {
1220 	struct lock_list_entry **lock_list, *lle;
1221 	struct lock_instance *instance;
1222 	struct lock_class *class;
1223 	struct thread *td;
1224 	register_t s;
1225 	int i, j;
1226 
1227 	if (witness_cold || witness_watch == 0 || lock->lo_witness == NULL ||
1228 	    panicstr != NULL)
1229 		return;
1230 	td = curthread;
1231 	class = lock->lo_class;
1232 	file = fixup_filename(file);
1233 
1234 	/* Find lock instance associated with this lock. */
1235 	if (class->lc_flags & LC_SLEEPLOCK)
1236 		lock_list = &td->td_sleeplocks;
1237 	else
1238 		lock_list = PCPU_PTR(spinlocks);
1239 	for (; *lock_list != NULL; lock_list = &(*lock_list)->ll_next)
1240 		for (i = 0; i < (*lock_list)->ll_count; i++) {
1241 			instance = &(*lock_list)->ll_children[i];
1242 			if (instance->li_lock == lock)
1243 				goto found;
1244 		}
1245 	panic("lock (%s) %s not locked @ %s:%d", class->lc_name, lock->lo_name,
1246 	    file, line);
1247 found:
1248 
1249 	/* First, check for shared/exclusive mismatches. */
1250 	if ((instance->li_flags & LI_EXCLUSIVE) != 0 &&
1251 	    (flags & LOP_EXCLUSIVE) == 0) {
1252 		printf("shared unlock of (%s) %s @ %s:%d\n", class->lc_name,
1253 		    lock->lo_name, file, line);
1254 		printf("while exclusively locked from %s:%d\n",
1255 		    instance->li_file, instance->li_line);
1256 		panic("excl->ushare");
1257 	}
1258 	if ((instance->li_flags & LI_EXCLUSIVE) == 0 &&
1259 	    (flags & LOP_EXCLUSIVE) != 0) {
1260 		printf("exclusive unlock of (%s) %s @ %s:%d\n", class->lc_name,
1261 		    lock->lo_name, file, line);
1262 		printf("while share locked from %s:%d\n", instance->li_file,
1263 		    instance->li_line);
1264 		panic("share->uexcl");
1265 	}
1266 
1267 	/* If we are recursed, unrecurse. */
1268 	if ((instance->li_flags & LI_RECURSEMASK) > 0) {
1269 		CTR4(KTR_WITNESS, "%s: pid %d unrecursed on %s r=%d", __func__,
1270 		    td->td_proc->p_pid, instance->li_lock->lo_name,
1271 		    instance->li_flags);
1272 		instance->li_flags--;
1273 		return;
1274 	}
1275 
1276 	/* Otherwise, remove this item from the list. */
1277 	s = intr_disable();
1278 	CTR4(KTR_WITNESS, "%s: pid %d removed %s from lle[%d]", __func__,
1279 	    td->td_proc->p_pid, instance->li_lock->lo_name,
1280 	    (*lock_list)->ll_count - 1);
1281 	for (j = i; j < (*lock_list)->ll_count - 1; j++)
1282 		(*lock_list)->ll_children[j] =
1283 		    (*lock_list)->ll_children[j + 1];
1284 	(*lock_list)->ll_count--;
1285 	intr_restore(s);
1286 
1287 	/* If this lock list entry is now empty, free it. */
1288 	if ((*lock_list)->ll_count == 0) {
1289 		lle = *lock_list;
1290 		*lock_list = lle->ll_next;
1291 		CTR3(KTR_WITNESS, "%s: pid %d removed lle %p", __func__,
1292 		    td->td_proc->p_pid, lle);
1293 		witness_lock_list_free(lle);
1294 	}
1295 }
1296 
1297 /*
1298  * Warn if any locks other than 'lock' are held.  Flags can be passed in to
1299  * exempt Giant and sleepable locks from the checks as well.  If any
1300  * non-exempt locks are held, then a supplied message is printed to the
1301  * console along with a list of the offending locks.  If indicated in the
1302  * flags then a failure results in a panic as well.
1303  */
1304 int
1305 witness_warn(int flags, struct lock_object *lock, const char *fmt, ...)
1306 {
1307 	struct lock_list_entry *lle;
1308 	struct lock_instance *lock1;
1309 	struct thread *td;
1310 	va_list ap;
1311 	int i, n;
1312 
1313 	if (witness_cold || witness_watch == 0 || panicstr != NULL)
1314 		return (0);
1315 	n = 0;
1316 	td = curthread;
1317 	for (lle = td->td_sleeplocks; lle != NULL; lle = lle->ll_next)
1318 		for (i = lle->ll_count - 1; i >= 0; i--) {
1319 			lock1 = &lle->ll_children[i];
1320 			if (lock1->li_lock == lock)
1321 				continue;
1322 			if (flags & WARN_GIANTOK &&
1323 			    lock1->li_lock == &Giant.mtx_object)
1324 				continue;
1325 			if (flags & WARN_SLEEPOK &&
1326 			    (lock1->li_lock->lo_flags & LO_SLEEPABLE) != 0)
1327 				continue;
1328 			if (n == 0) {
1329 				va_start(ap, fmt);
1330 				vprintf(fmt, ap);
1331 				va_end(ap);
1332 				printf(" with the following");
1333 				if (flags & WARN_SLEEPOK)
1334 					printf(" non-sleepable");
1335 				printf(" locks held:\n");
1336 			}
1337 			n++;
1338 			witness_list_lock(lock1);
1339 		}
1340 	if (PCPU_GET(spinlocks) != NULL) {
1341 		/*
1342 		 * Since we already hold a spinlock preemption is
1343 		 * already blocked.
1344 		 */
1345 		if (n == 0) {
1346 			va_start(ap, fmt);
1347 			vprintf(fmt, ap);
1348 			va_end(ap);
1349 			printf(" with the following");
1350 			if (flags & WARN_SLEEPOK)
1351 				printf(" non-sleepable");
1352 			printf(" locks held:\n");
1353 		}
1354 		n += witness_list_locks(PCPU_PTR(spinlocks));
1355 	}
1356 	if (flags & WARN_PANIC && n)
1357 		panic("witness_warn");
1358 #ifdef KDB
1359 	else if (witness_kdb && n)
1360 		kdb_enter(__func__);
1361 	else if (witness_trace && n)
1362 		kdb_backtrace();
1363 #endif
1364 	return (n);
1365 }
1366 
1367 const char *
1368 witness_file(struct lock_object *lock)
1369 {
1370 	struct witness *w;
1371 
1372 	if (witness_cold || witness_watch == 0 || lock->lo_witness == NULL)
1373 		return ("?");
1374 	w = lock->lo_witness;
1375 	return (w->w_file);
1376 }
1377 
1378 int
1379 witness_line(struct lock_object *lock)
1380 {
1381 	struct witness *w;
1382 
1383 	if (witness_cold || witness_watch == 0 || lock->lo_witness == NULL)
1384 		return (0);
1385 	w = lock->lo_witness;
1386 	return (w->w_line);
1387 }
1388 
1389 static struct witness *
1390 enroll(const char *description, struct lock_class *lock_class)
1391 {
1392 	struct witness *w;
1393 
1394 	if (witness_watch == 0 || panicstr != NULL)
1395 		return (NULL);
1396 	if ((lock_class->lc_flags & LC_SPINLOCK) && witness_skipspin)
1397 		return (NULL);
1398 	mtx_lock_spin(&w_mtx);
1399 	STAILQ_FOREACH(w, &w_all, w_list) {
1400 		if (w->w_name == description || (w->w_refcount > 0 &&
1401 		    strcmp(description, w->w_name) == 0)) {
1402 			w->w_refcount++;
1403 			mtx_unlock_spin(&w_mtx);
1404 			if (lock_class != w->w_class)
1405 				panic(
1406 				"lock (%s) %s does not match earlier (%s) lock",
1407 				    description, lock_class->lc_name,
1408 				    w->w_class->lc_name);
1409 			return (w);
1410 		}
1411 	}
1412 	/*
1413 	 * We issue a warning for any spin locks not defined in the static
1414 	 * order list as a way to discourage their use (folks should really
1415 	 * be using non-spin mutexes most of the time).  However, several
1416 	 * 3rd part device drivers use spin locks because that is all they
1417 	 * have available on Windows and Linux and they think that normal
1418 	 * mutexes are insufficient.
1419 	 */
1420 	if ((lock_class->lc_flags & LC_SPINLOCK) && witness_spin_warn)
1421 		printf("WITNESS: spin lock %s not in order list", description);
1422 	if ((w = witness_get()) == NULL)
1423 		return (NULL);
1424 	w->w_name = description;
1425 	w->w_class = lock_class;
1426 	w->w_refcount = 1;
1427 	STAILQ_INSERT_HEAD(&w_all, w, w_list);
1428 	if (lock_class->lc_flags & LC_SPINLOCK) {
1429 		STAILQ_INSERT_HEAD(&w_spin, w, w_typelist);
1430 		w_spin_cnt++;
1431 	} else if (lock_class->lc_flags & LC_SLEEPLOCK) {
1432 		STAILQ_INSERT_HEAD(&w_sleep, w, w_typelist);
1433 		w_sleep_cnt++;
1434 	} else {
1435 		mtx_unlock_spin(&w_mtx);
1436 		panic("lock class %s is not sleep or spin",
1437 		    lock_class->lc_name);
1438 	}
1439 	mtx_unlock_spin(&w_mtx);
1440 	return (w);
1441 }
1442 
1443 /* Don't let the door bang you on the way out... */
1444 static int
1445 depart(struct witness *w)
1446 {
1447 	struct witness_child_list_entry *wcl, *nwcl;
1448 	struct witness_list *list;
1449 	struct witness *parent;
1450 
1451 	MPASS(w->w_refcount == 0);
1452 	if (w->w_class->lc_flags & LC_SLEEPLOCK) {
1453 		list = &w_sleep;
1454 		w_sleep_cnt--;
1455 	} else {
1456 		list = &w_spin;
1457 		w_spin_cnt--;
1458 	}
1459 	/*
1460 	 * First, we run through the entire tree looking for any
1461 	 * witnesses that the outgoing witness is a child of.  For
1462 	 * each parent that we find, we reparent all the direct
1463 	 * children of the outgoing witness to its parent.
1464 	 */
1465 	STAILQ_FOREACH(parent, list, w_typelist) {
1466 		if (!isitmychild(parent, w))
1467 			continue;
1468 		removechild(parent, w);
1469 	}
1470 
1471 	/*
1472 	 * Now we go through and free up the child list of the
1473 	 * outgoing witness.
1474 	 */
1475 	for (wcl = w->w_children; wcl != NULL; wcl = nwcl) {
1476 		nwcl = wcl->wcl_next;
1477         	w_child_cnt--;
1478 		witness_child_free(wcl);
1479 	}
1480 
1481 	/*
1482 	 * Detach from various lists and free.
1483 	 */
1484 	STAILQ_REMOVE(list, w, witness, w_typelist);
1485 	STAILQ_REMOVE(&w_all, w, witness, w_list);
1486 	witness_free(w);
1487 
1488 	return (1);
1489 }
1490 
1491 /*
1492  * Add "child" as a direct child of "parent".  Returns false if
1493  * we fail due to out of memory.
1494  */
1495 static int
1496 insertchild(struct witness *parent, struct witness *child)
1497 {
1498 	struct witness_child_list_entry **wcl;
1499 
1500 	MPASS(child != NULL && parent != NULL);
1501 
1502 	/*
1503 	 * Insert "child" after "parent"
1504 	 */
1505 	wcl = &parent->w_children;
1506 	while (*wcl != NULL && (*wcl)->wcl_count == WITNESS_NCHILDREN)
1507 		wcl = &(*wcl)->wcl_next;
1508 	if (*wcl == NULL) {
1509 		*wcl = witness_child_get();
1510 		if (*wcl == NULL)
1511 			return (0);
1512         	w_child_cnt++;
1513 	}
1514 	(*wcl)->wcl_children[(*wcl)->wcl_count++] = child;
1515 
1516 	return (1);
1517 }
1518 
1519 
1520 static int
1521 itismychild(struct witness *parent, struct witness *child)
1522 {
1523 	struct witness_list *list;
1524 
1525 	MPASS(child != NULL && parent != NULL);
1526 	if ((parent->w_class->lc_flags & (LC_SLEEPLOCK | LC_SPINLOCK)) !=
1527 	    (child->w_class->lc_flags & (LC_SLEEPLOCK | LC_SPINLOCK)))
1528 		panic(
1529 		"%s: parent (%s) and child (%s) are not the same lock type",
1530 		    __func__, parent->w_class->lc_name,
1531 		    child->w_class->lc_name);
1532 
1533 	if (!insertchild(parent, child))
1534 		return (0);
1535 
1536 	if (parent->w_class->lc_flags & LC_SLEEPLOCK)
1537 		list = &w_sleep;
1538 	else
1539 		list = &w_spin;
1540 	return (1);
1541 }
1542 
1543 static void
1544 removechild(struct witness *parent, struct witness *child)
1545 {
1546 	struct witness_child_list_entry **wcl, *wcl1;
1547 	int i;
1548 
1549 	for (wcl = &parent->w_children; *wcl != NULL; wcl = &(*wcl)->wcl_next)
1550 		for (i = 0; i < (*wcl)->wcl_count; i++)
1551 			if ((*wcl)->wcl_children[i] == child)
1552 				goto found;
1553 	return;
1554 found:
1555 	(*wcl)->wcl_count--;
1556 	if ((*wcl)->wcl_count > i)
1557 		(*wcl)->wcl_children[i] =
1558 		    (*wcl)->wcl_children[(*wcl)->wcl_count];
1559 	MPASS((*wcl)->wcl_children[i] != NULL);
1560 	if ((*wcl)->wcl_count != 0)
1561 		return;
1562 	wcl1 = *wcl;
1563 	*wcl = wcl1->wcl_next;
1564 	w_child_cnt--;
1565 	witness_child_free(wcl1);
1566 }
1567 
1568 static int
1569 isitmychild(struct witness *parent, struct witness *child)
1570 {
1571 	struct witness_child_list_entry *wcl;
1572 	int i;
1573 
1574 	for (wcl = parent->w_children; wcl != NULL; wcl = wcl->wcl_next) {
1575 		for (i = 0; i < wcl->wcl_count; i++) {
1576 			if (wcl->wcl_children[i] == child)
1577 				return (1);
1578 		}
1579 	}
1580 	return (0);
1581 }
1582 
1583 static int
1584 isitmydescendant(struct witness *parent, struct witness *child)
1585 {
1586 	struct witness_child_list_entry *wcl;
1587 	int i, j;
1588 
1589 	if (isitmychild(parent, child))
1590 		return (1);
1591 	j = 0;
1592 	for (wcl = parent->w_children; wcl != NULL; wcl = wcl->wcl_next) {
1593 		MPASS(j < 1000);
1594 		for (i = 0; i < wcl->wcl_count; i++) {
1595 			if (isitmydescendant(wcl->wcl_children[i], child))
1596 				return (1);
1597 		}
1598 		j++;
1599 	}
1600 	return (0);
1601 }
1602 
1603 #ifdef BLESSING
1604 static int
1605 blessed(struct witness *w1, struct witness *w2)
1606 {
1607 	int i;
1608 	struct witness_blessed *b;
1609 
1610 	for (i = 0; i < blessed_count; i++) {
1611 		b = &blessed_list[i];
1612 		if (strcmp(w1->w_name, b->b_lock1) == 0) {
1613 			if (strcmp(w2->w_name, b->b_lock2) == 0)
1614 				return (1);
1615 			continue;
1616 		}
1617 		if (strcmp(w1->w_name, b->b_lock2) == 0)
1618 			if (strcmp(w2->w_name, b->b_lock1) == 0)
1619 				return (1);
1620 	}
1621 	return (0);
1622 }
1623 #endif
1624 
1625 static struct witness *
1626 witness_get(void)
1627 {
1628 	struct witness *w;
1629 
1630 	if (witness_watch == 0) {
1631 		mtx_unlock_spin(&w_mtx);
1632 		return (NULL);
1633 	}
1634 	if (STAILQ_EMPTY(&w_free)) {
1635 		witness_watch = 0;
1636 		mtx_unlock_spin(&w_mtx);
1637 		printf("%s: witness exhausted\n", __func__);
1638 		return (NULL);
1639 	}
1640 	w = STAILQ_FIRST(&w_free);
1641 	STAILQ_REMOVE_HEAD(&w_free, w_list);
1642 	w_free_cnt--;
1643 	bzero(w, sizeof(*w));
1644 	return (w);
1645 }
1646 
1647 static void
1648 witness_free(struct witness *w)
1649 {
1650 
1651 	STAILQ_INSERT_HEAD(&w_free, w, w_list);
1652 	w_free_cnt++;
1653 }
1654 
1655 static struct witness_child_list_entry *
1656 witness_child_get(void)
1657 {
1658 	struct witness_child_list_entry *wcl;
1659 
1660 	if (witness_watch == 0) {
1661 		mtx_unlock_spin(&w_mtx);
1662 		return (NULL);
1663 	}
1664 	wcl = w_child_free;
1665 	if (wcl == NULL) {
1666 		witness_watch = 0;
1667 		mtx_unlock_spin(&w_mtx);
1668 		printf("%s: witness exhausted\n", __func__);
1669 		return (NULL);
1670 	}
1671 	w_child_free = wcl->wcl_next;
1672 	w_child_free_cnt--;
1673 	bzero(wcl, sizeof(*wcl));
1674 	return (wcl);
1675 }
1676 
1677 static void
1678 witness_child_free(struct witness_child_list_entry *wcl)
1679 {
1680 
1681 	wcl->wcl_next = w_child_free;
1682 	w_child_free = wcl;
1683 	w_child_free_cnt++;
1684 }
1685 
1686 static struct lock_list_entry *
1687 witness_lock_list_get(void)
1688 {
1689 	struct lock_list_entry *lle;
1690 
1691 	if (witness_watch == 0)
1692 		return (NULL);
1693 	mtx_lock_spin(&w_mtx);
1694 	lle = w_lock_list_free;
1695 	if (lle == NULL) {
1696 		witness_watch = 0;
1697 		mtx_unlock_spin(&w_mtx);
1698 		printf("%s: witness exhausted\n", __func__);
1699 		return (NULL);
1700 	}
1701 	w_lock_list_free = lle->ll_next;
1702 	mtx_unlock_spin(&w_mtx);
1703 	bzero(lle, sizeof(*lle));
1704 	return (lle);
1705 }
1706 
1707 static void
1708 witness_lock_list_free(struct lock_list_entry *lle)
1709 {
1710 
1711 	mtx_lock_spin(&w_mtx);
1712 	lle->ll_next = w_lock_list_free;
1713 	w_lock_list_free = lle;
1714 	mtx_unlock_spin(&w_mtx);
1715 }
1716 
1717 static struct lock_instance *
1718 find_instance(struct lock_list_entry *lock_list, struct lock_object *lock)
1719 {
1720 	struct lock_list_entry *lle;
1721 	struct lock_instance *instance;
1722 	int i;
1723 
1724 	for (lle = lock_list; lle != NULL; lle = lle->ll_next)
1725 		for (i = lle->ll_count - 1; i >= 0; i--) {
1726 			instance = &lle->ll_children[i];
1727 			if (instance->li_lock == lock)
1728 				return (instance);
1729 		}
1730 	return (NULL);
1731 }
1732 
1733 static void
1734 witness_list_lock(struct lock_instance *instance)
1735 {
1736 	struct lock_object *lock;
1737 
1738 	lock = instance->li_lock;
1739 	printf("%s %s %s", (instance->li_flags & LI_EXCLUSIVE) != 0 ?
1740 	    "exclusive" : "shared", lock->lo_class->lc_name, lock->lo_name);
1741 	if (lock->lo_type != lock->lo_name)
1742 		printf(" (%s)", lock->lo_type);
1743 	printf(" r = %d (%p) locked @ %s:%d\n",
1744 	    instance->li_flags & LI_RECURSEMASK, lock, instance->li_file,
1745 	    instance->li_line);
1746 }
1747 
1748 #ifdef DDB
1749 static int
1750 witness_thread_has_locks(struct thread *td)
1751 {
1752 
1753 	return (td->td_sleeplocks != NULL);
1754 }
1755 
1756 static int
1757 witness_proc_has_locks(struct proc *p)
1758 {
1759 	struct thread *td;
1760 
1761 	FOREACH_THREAD_IN_PROC(p, td) {
1762 		if (witness_thread_has_locks(td))
1763 			return (1);
1764 	}
1765 	return (0);
1766 }
1767 #endif
1768 
1769 int
1770 witness_list_locks(struct lock_list_entry **lock_list)
1771 {
1772 	struct lock_list_entry *lle;
1773 	int i, nheld;
1774 
1775 	nheld = 0;
1776 	for (lle = *lock_list; lle != NULL; lle = lle->ll_next)
1777 		for (i = lle->ll_count - 1; i >= 0; i--) {
1778 			witness_list_lock(&lle->ll_children[i]);
1779 			nheld++;
1780 		}
1781 	return (nheld);
1782 }
1783 
1784 /*
1785  * This is a bit risky at best.  We call this function when we have timed
1786  * out acquiring a spin lock, and we assume that the other CPU is stuck
1787  * with this lock held.  So, we go groveling around in the other CPU's
1788  * per-cpu data to try to find the lock instance for this spin lock to
1789  * see when it was last acquired.
1790  */
1791 void
1792 witness_display_spinlock(struct lock_object *lock, struct thread *owner)
1793 {
1794 	struct lock_instance *instance;
1795 	struct pcpu *pc;
1796 
1797 	if (owner->td_critnest == 0 || owner->td_oncpu == NOCPU)
1798 		return;
1799 	pc = pcpu_find(owner->td_oncpu);
1800 	instance = find_instance(pc->pc_spinlocks, lock);
1801 	if (instance != NULL)
1802 		witness_list_lock(instance);
1803 }
1804 
1805 void
1806 witness_save(struct lock_object *lock, const char **filep, int *linep)
1807 {
1808 	struct lock_instance *instance;
1809 
1810 	KASSERT(!witness_cold, ("%s: witness_cold", __func__));
1811 	if (lock->lo_witness == NULL || witness_watch == 0 || panicstr != NULL)
1812 		return;
1813 	if ((lock->lo_class->lc_flags & LC_SLEEPLOCK) == 0)
1814 		panic("%s: lock (%s) %s is not a sleep lock", __func__,
1815 		    lock->lo_class->lc_name, lock->lo_name);
1816 	instance = find_instance(curthread->td_sleeplocks, lock);
1817 	if (instance == NULL)
1818 		panic("%s: lock (%s) %s not locked", __func__,
1819 		    lock->lo_class->lc_name, lock->lo_name);
1820 	*filep = instance->li_file;
1821 	*linep = instance->li_line;
1822 }
1823 
1824 void
1825 witness_restore(struct lock_object *lock, const char *file, int line)
1826 {
1827 	struct lock_instance *instance;
1828 
1829 	KASSERT(!witness_cold, ("%s: witness_cold", __func__));
1830 	if (lock->lo_witness == NULL || witness_watch == 0 || panicstr != NULL)
1831 		return;
1832 	if ((lock->lo_class->lc_flags & LC_SLEEPLOCK) == 0)
1833 		panic("%s: lock (%s) %s is not a sleep lock", __func__,
1834 		    lock->lo_class->lc_name, lock->lo_name);
1835 	instance = find_instance(curthread->td_sleeplocks, lock);
1836 	if (instance == NULL)
1837 		panic("%s: lock (%s) %s not locked", __func__,
1838 		    lock->lo_class->lc_name, lock->lo_name);
1839 	lock->lo_witness->w_file = file;
1840 	lock->lo_witness->w_line = line;
1841 	instance->li_file = file;
1842 	instance->li_line = line;
1843 }
1844 
1845 void
1846 witness_assert(struct lock_object *lock, int flags, const char *file, int line)
1847 {
1848 #ifdef INVARIANT_SUPPORT
1849 	struct lock_instance *instance;
1850 
1851 	if (lock->lo_witness == NULL || witness_watch == 0 || panicstr != NULL)
1852 		return;
1853 	if ((lock->lo_class->lc_flags & LC_SLEEPLOCK) != 0)
1854 		instance = find_instance(curthread->td_sleeplocks, lock);
1855 	else if ((lock->lo_class->lc_flags & LC_SPINLOCK) != 0)
1856 		instance = find_instance(PCPU_GET(spinlocks), lock);
1857 	else {
1858 		panic("Lock (%s) %s is not sleep or spin!",
1859 		    lock->lo_class->lc_name, lock->lo_name);
1860 	}
1861 	file = fixup_filename(file);
1862 	switch (flags) {
1863 	case LA_UNLOCKED:
1864 		if (instance != NULL)
1865 			panic("Lock (%s) %s locked @ %s:%d.",
1866 			    lock->lo_class->lc_name, lock->lo_name, file, line);
1867 		break;
1868 	case LA_LOCKED:
1869 	case LA_LOCKED | LA_RECURSED:
1870 	case LA_LOCKED | LA_NOTRECURSED:
1871 	case LA_SLOCKED:
1872 	case LA_SLOCKED | LA_RECURSED:
1873 	case LA_SLOCKED | LA_NOTRECURSED:
1874 	case LA_XLOCKED:
1875 	case LA_XLOCKED | LA_RECURSED:
1876 	case LA_XLOCKED | LA_NOTRECURSED:
1877 		if (instance == NULL) {
1878 			panic("Lock (%s) %s not locked @ %s:%d.",
1879 			    lock->lo_class->lc_name, lock->lo_name, file, line);
1880 			break;
1881 		}
1882 		if ((flags & LA_XLOCKED) != 0 &&
1883 		    (instance->li_flags & LI_EXCLUSIVE) == 0)
1884 			panic("Lock (%s) %s not exclusively locked @ %s:%d.",
1885 			    lock->lo_class->lc_name, lock->lo_name, file, line);
1886 		if ((flags & LA_SLOCKED) != 0 &&
1887 		    (instance->li_flags & LI_EXCLUSIVE) != 0)
1888 			panic("Lock (%s) %s exclusively locked @ %s:%d.",
1889 			    lock->lo_class->lc_name, lock->lo_name, file, line);
1890 		if ((flags & LA_RECURSED) != 0 &&
1891 		    (instance->li_flags & LI_RECURSEMASK) == 0)
1892 			panic("Lock (%s) %s not recursed @ %s:%d.",
1893 			    lock->lo_class->lc_name, lock->lo_name, file, line);
1894 		if ((flags & LA_NOTRECURSED) != 0 &&
1895 		    (instance->li_flags & LI_RECURSEMASK) != 0)
1896 			panic("Lock (%s) %s recursed @ %s:%d.",
1897 			    lock->lo_class->lc_name, lock->lo_name, file, line);
1898 		break;
1899 	default:
1900 		panic("Invalid lock assertion at %s:%d.", file, line);
1901 
1902 	}
1903 #endif	/* INVARIANT_SUPPORT */
1904 }
1905 
1906 #ifdef DDB
1907 static void
1908 witness_list(struct thread *td)
1909 {
1910 
1911 	KASSERT(!witness_cold, ("%s: witness_cold", __func__));
1912 	KASSERT(kdb_active, ("%s: not in the debugger", __func__));
1913 
1914 	if (witness_watch == 0)
1915 		return;
1916 
1917 	witness_list_locks(&td->td_sleeplocks);
1918 
1919 	/*
1920 	 * We only handle spinlocks if td == curthread.  This is somewhat broken
1921 	 * if td is currently executing on some other CPU and holds spin locks
1922 	 * as we won't display those locks.  If we had a MI way of getting
1923 	 * the per-cpu data for a given cpu then we could use
1924 	 * td->td_oncpu to get the list of spinlocks for this thread
1925 	 * and "fix" this.
1926 	 *
1927 	 * That still wouldn't really fix this unless we locked sched_lock
1928 	 * or stopped the other CPU to make sure it wasn't changing the list
1929 	 * out from under us.  It is probably best to just not try to handle
1930 	 * threads on other CPU's for now.
1931 	 */
1932 	if (td == curthread && PCPU_GET(spinlocks) != NULL)
1933 		witness_list_locks(PCPU_PTR(spinlocks));
1934 }
1935 
1936 DB_SHOW_COMMAND(locks, db_witness_list)
1937 {
1938 	struct thread *td;
1939 	pid_t pid;
1940 	struct proc *p;
1941 
1942 	if (have_addr) {
1943 		pid = (addr % 16) + ((addr >> 4) % 16) * 10 +
1944 		    ((addr >> 8) % 16) * 100 + ((addr >> 12) % 16) * 1000 +
1945 		    ((addr >> 16) % 16) * 10000;
1946 		/* sx_slock(&allproc_lock); */
1947 		FOREACH_PROC_IN_SYSTEM(p) {
1948 			if (p->p_pid == pid)
1949 				break;
1950 		}
1951 		/* sx_sunlock(&allproc_lock); */
1952 		if (p == NULL) {
1953 			db_printf("pid %d not found\n", pid);
1954 			return;
1955 		}
1956 		FOREACH_THREAD_IN_PROC(p, td) {
1957 			witness_list(td);
1958 		}
1959 	} else {
1960 		td = curthread;
1961 		witness_list(td);
1962 	}
1963 }
1964 
1965 DB_SHOW_COMMAND(alllocks, db_witness_list_all)
1966 {
1967 	struct thread *td;
1968 	struct proc *p;
1969 
1970 	/*
1971 	 * It would be nice to list only threads and processes that actually
1972 	 * held sleep locks, but that information is currently not exported
1973 	 * by WITNESS.
1974 	 */
1975 	FOREACH_PROC_IN_SYSTEM(p) {
1976 		if (!witness_proc_has_locks(p))
1977 			continue;
1978 		FOREACH_THREAD_IN_PROC(p, td) {
1979 			if (!witness_thread_has_locks(td))
1980 				continue;
1981 			printf("Process %d (%s) thread %p (%d)\n", p->p_pid,
1982 			    p->p_comm, td, td->td_tid);
1983 			witness_list(td);
1984 		}
1985 	}
1986 }
1987 
1988 DB_SHOW_COMMAND(witness, db_witness_display)
1989 {
1990 
1991 	witness_display(db_printf);
1992 }
1993 #endif
1994