Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de

On 7/25/26 09:51, Bjoern A. Zeeb wrote:
> On Sat, 25 Jul 2026, Mark Millard wrote:
> 
> Sorry,
> 
> is the tail of your dmesg going along the lines of:
> 
> devmatch trying to load rtw89
> rtw89 trying to laod firmware
> that fails
> device attach fails
> panic?

Unfortutely, the core.text.* files end with:

QUOTE
ddb capture buffer

ddb: ddb_capture: kvm_nlist
END QUOTE

The screen display is mostly the backtrace. What does show are messages
about:

. . . could not load firmware image, error 2
Trying to load binary firmware from . . .
. . . could not load binary firmware . . . either
. . . could not load firmware image, error 2
Trying to load binary firmware from . . .
. . . could not load binary firmware . . . either
. . . could not load fimrware image . . .
. . . failed to wait firmware completion
. . . failed to setup chip information

Fatal trap 9 . . .
. . .

For reference (from an earlier screen shot from a debug kernel test):

rax shows: deadc0dedeadc0de
rsi shows: deadc0dedeadc13e

(So such shows up both at #35 and at the fatal trap 9 point.)

current thread resports: (devctl/devctl)

I'll also note in the backtrace it shows 0xdeadc0dedeadc13e
as involved in the atomic_fetchadd_int falure:

. . .
#12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
#13 <signal handler called>
#14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
. . .

> 
> 
> More below.
> 
> 
>> On 7/25/26 04:31, Bjoern A. Zeeb wrote:
>>> On Fri, 24 Jul 2026, Mark Millard wrote:
>>>
>>>
>>> ....
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>> linux/device.h:376
>>>> No locals.
>>>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>> linux/pci.h:474
>>>> No locals.
>>>> #21 lkpi_pci_dev_release (dev=0xfffff8014e842a00)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>>> linux_pci.c:374
>>>
>>> That would be my recent change I assume.
>>>
>>>
>>> Can you test this?
>>>
>>> % git diff
>>> diff --git sys/compat/linuxkpi/common/src/linux_pci.c sys/compat/
>>> linuxkpi/common/src/linux_pci.c
>>> index a49254425b5d..b1c28a188b94 100644
>>> --- sys/compat/linuxkpi/common/src/linux_pci.c
>>> +++ sys/compat/linuxkpi/common/src/linux_pci.c
>>> @@ -370,7 +370,7 @@ lkpi_pci_dev_release(struct device *dev)
>>>          */
>>>
>>>         /* Clear the hierarchy recursively to root. */
>>> -       if (pdev->bus->self != pdev) {
>>> +       if (pdev->bus->self != pdev && pdev->bus->self != NULL) {
>>>                 pci_dev_put(pdev->bus->self);
>>>                 pdev->bus->self = NULL;
>>>         }
>>>
>>
>> See later below.
>>
>>>
>>>
>>>>        pdev = 0xfffff8014e842a00
>>>> #22 0xffffffff80eed1c8 in linux_kobject_release (kref=<optimized out>)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>>> linux_kobject.c:186
>>>>        kobj = 0xfffff8014e842a50
>>>>        name = 0xfffff80107bcd670 "rtw890"
>>>> #23 0xffffffff80ef11ea in kref_put (kref=0xdeadc0dedeadc13e,
>>>>    rel=<optimized out>)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>> linux/kref.h:73
>>>> No locals.
>>>> #24 kobject_put (kobj=0xfffff8014e842a50)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>> linux/kobject.h:113
>>>> No locals.
>>>> #25 put_device (dev=0xfffff8014e842a00)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>> linux/device.h:376
>>>> No locals.
>>>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
>>>>    id=<optimized out>, pdev=0xfffff8014e842a00)
>>>>    at
>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>>> linux_pci.c:744
>>>>        rid = 2304
>>>>        parent = <optimized out>
>>>>        isdrm = <optimized out>
>>>>        error = <optimized out>
>>>>        rle = <optimized out>
>>>>        pbus = <optimized out>
>>>>        ppbus = <optimized out>
>>>> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff8010799a800)
>>>>    at ./device_if.h:195
>>>>        _m = <optimized out>
>>>>        rc = <optimized out>
>>>> #28 device_attach (dev=0xfffff8010799a800)
>>>>    at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2630
>>>>        attachentropy = 32965
>>>>        saved_vnet = 0x0
>>>>        attachtime = 1943114510
>>>>        error = <optimized out>
>>>> #29 0xffffffff80c53255 in device_probe_and_attach
>>>> (dev=0xfffff8014e842a00,
>>>>    dev@entry=0xfffff8010799a800)
>>>>    at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2579
>>> ...
>>>
>>
>> I built a new kernel pair (debug and non-debug) based on updating the
>> pkgbase /usr/src/ the system is based on.
>>
>> Booting the debug build still failed. The deadc0de based value that is
>> assocaited with the longest lasting stack frame from with such a value
>> is reported is still in the dsw for:
>>
>> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
>>    at /usr/src/sys/fs/devfs/devfs_vnops.c:964
>>        dev = 0xfffff801072a1800
>>        ref = 0
>>        vp = 0xfffff8014c11a6e0
>>        com = 2157462540
>>        td = 0xfffff80149a31780
>>        dsw = 0xdeadc0dedeadc0de
>>        error = <optimized out>
>>        fgn = <optimized out>
>>        p = <optimized out>
>>        i = <optimized out>
>>        sess = <optimized out>
>>        vpold = <optimized out>
>>
>> So I would expect #0 .. #34 to all be after that specific problem.
> 
> I would assume that's an uninitialized value but I haven't looked at
> that ioctl code.

Values based on 0xdeadc0dedeadc0de show up in rax and rsi in the
register dump, in the atomic_fetchadd_int failure, and in #35.

> 
> If there's a problem already then different story.

Seems suggestive of the fatal trap 9 being dependent on the odd value in
#35, not that I've analyzed the code involved between those two points.

> 
> 
>> The new gdb report follows . . .
>>
>> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/kernel...
>> Reading symbols from
>> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/kernel.debug...
>> . . .
>> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/smbus.ko...
>> Reading symbols from
>> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/smbus.ko.debug...
>> __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
>> 57              __asm("movq %%gs:%c1,%0" : "=r" (td)
>> (kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
>>        td = <optimized out>
>> #1  doadump (textdump=textdump@entry=0)
>>    at /usr/src/sys/kern/kern_shutdown.c:399
>>        error = 0
>>        coredump = <optimized out>
>> #2  0xffffffff804c77da in db_dump (dummy=<optimized out>,
>>    dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized
>> out>)
>>    at /usr/src/sys/ddb/db_command.c:596
>>        error = <optimized out>
>> #3  0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
>>    cmd_table=<optimized out>, dopager=true)
>>    at /usr/src/sys/ddb/db_command.c:508
>>        modif = "\000Bځ\377\377\377\377\n", '\000' <repeats 15 times>,
>> "x\000\000\000\000\000\000\000\b\000\000\0000\000\000\000\340♥\002\376\377\377`♥\002\376\377\377\375(\321f\355\177)[
>> 㙥\002\376\377\377D\236L\200\377\377\377\377\017", '\000' <repeats 15
>> times>,
>> "\020\220\275\201\377\377\377\377\000\000\000\000\000\000\000\000\200\027\243I\001\370\377\377"
>>        addr = -2134482909
>>        count = -1
>>        cmd = 0xffffffff81a16ff8 <db_cmds+616>
>>        have_addr = <optimized out>
>>        t = <optimized out>
>>        result = <optimized out>
>> #4  0xffffffff804c72ad in db_command_loop ()
>>    at /usr/src/sys/ddb/db_command.c:555
>> No locals.
>> #5  0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
>> out>)
>>    at /usr/src/sys/ddb/db_main.c:267
>>        jb = {{_jb = {0, -2187654995128, -2187654994976, -8790562629760,
>>              -2120123568, -2187654995104, -2187654994432, -2142458264,
>>              -2187654995008, -2136782033, -2116402656, 3}}}
>>        bkpt = false
>>        watchpt = false
>>        prev_jb = 0x0
>>        why = <optimized out>
>> #6  0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
>>    tf=tf@entry=0xfffffe02a599e600) at /usr/src/sys/kern/subr_kdb.c:790
>>        __pc = 0x0
>>        __pc = 0x0
>>        other_cpus = {__bits = {18446744071583149600,
>> 18446741886054557328,
>>            4294967282, 5, 2778326384, 0, 3545567873046937600,
>>            18446744071575110192, 18446744071582117664,
>> 18446744071582540027,
>>            0, 12, 18446741886054557056, 0, 18446741886054559552,
>>            11100633178600}}
>>        be = 0xffffffff81a17b50 <ddb_dbbe>
>>        intr = 70
>>        did_stop_cpus = <optimized out>
>>        handled = <optimized out>
>> #7  0xffffffff811a0335 in trap (frame=<optimized out>)
>>    at /usr/src/sys/amd64/amd64/trap.c:702
>>        __pc = 0x0
>>        __pc = 0x0
>>        __pc = 0x0
>>        ksi = {ksi_link = {tqe_next = 0x1, tqe_prev = 0xfffff82ae17f6f00},
>>          ksi_info = {si_signo = 5, si_errno = 0, si_code = -1, si_pid
>> = 0,
>>            si_uid = 2778326608, si_status = -510,
>>            si_addr = 0xffffffff80c708ab <_vprintf+139>, si_value = {
>>              sival_int = 5, sival_ptr = 0xffffffff00000005, sigval_int
>> = 5,
>>              sigval_ptr = 0xffffffff00000005}, _reason = {_fault = {
>>                _trapno = 0}, _timer = {_timerid = 0, _overrun = 0},
>> _mesgq = {
>>                _mqd = 0}, _poll = {_band = 0}, _capsicum = {_syscall =
>> 0},
>>              __spare__ = {__spare1__ = 0, __spare2__ = {-1516640848,
>> -510,
>>                  128, 0, -1516640848, -510, 128}}}}, ksi_flags =
>> 977421312,
>>          ksi_sigq = 0x696e6170203a7265}
>>        signo = 0
>>        ucode = 256
>>        td = <optimized out>
>>        p = 0xfffffe0366641040
>>        dr6 = 0
>>        type = 3
>>        addr = <optimized out>
>>        pf = <optimized out>
>>        i = <optimized out>
>> #8  <signal handler called>
>> No locals.
>> #9  kdb_enter (why=<optimized out>, msg=<optimized out>)
>>    at /usr/src/sys/kern/subr_kdb.c:556
>> No locals.
>> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
>>    ap=ap@entry=0xfffffe02a599e830) at /usr/src/sys/kern/
>> kern_shutdown.c:962
>>        buf = "general protection fault", '\000' <repeats 231 times>
>>        __pc = 0x0
>>        __pc = 0x0
>>        __pc = 0x0
>>        other_cpus = {__bits = {4294934527, 0 <repeats 15 times>}}
>>        td = 0xfffff80149a31780
>>        bootopt = <optimized out>
>>        newpanic = <optimized out>
>> #11 0xffffffff80c10c43 in panic (
>>    fmt=0xffffffff81da4260 <cnputs_mtx> "\241@)\201\377\377\377\377")
>>    at /usr/src/sys/kern/kern_shutdown.c:887
>>        ap = {{gp_offset = 16, fp_offset = 48,
>>            overflow_arg_area = 0xfffffe02a599e860,
>>            reg_save_area = 0xfffffe02a599e800}}
>> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
>>    eva=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:1031
>>        type = <optimized out>
>> #13 <signal handler called>
>> No locals.
>> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
>>    v=4294967295) at /usr/src/sys/amd64/include/atomic.h:194
>> No locals.
>> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
>>    at /usr/src/sys/sys/refcount.h:149
>>        old = <optimized out>
>> #16 refcount_release (count=0xdeadc0dedeadc13e)
>>    at /usr/src/sys/sys/refcount.h:171
>> No locals.
>> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:72
>> No locals.
>> #18 kobject_put (kobj=0xdeadc0dedeadc12e)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
>> No locals.
>> #19 put_device (dev=0xdeadc0dedeadc0de)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
>> No locals.
>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/pci.h:474
>> No locals.
> 
> The above has changed if I am not wrong...
> 
>> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
>>    at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:374
>>        pdev = 0xfffff8015a144a00
>> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
>>    at /usr/src/sys/compat/linuxkpi/common/src/linux_kobject.c:186
>>        kobj = 0xfffff8015a144a50
>>        name = 0xfffff82ae1802610 "rtw890"
>> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
>>    rel=<optimized out>)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:73
>> No locals.
>> #24 kobject_put (kobj=0xfffff8015a144a50)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
>> No locals.
>> #25 put_device (dev=0xfffff8015a144a00)
>>    at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
>> No locals.
> 
> And I misread this before.
> 
> This is the error case in linux_pci_attach_device():
> 
> You may notice my comment there:
> 
>     734
>     735 /* XXX the cleanup does not match the allocation up there. */
>     736 out_probe:
>     737         free(pdev->bus, M_DEVBUF);
>     738         spin_lock_destroy(&pdev->pcie_cap_lock);
>     739         linux_pdev_dma_uninit(pdev);
>     740 out_dma_init:
>     741         spin_lock(&pci_lock);
>     742         list_del(&pdev->links);
>     743         spin_unlock(&pci_lock);
>     744         put_device(&pdev->dev);            // <<<<<<<<< here
>     745         return (-error);
>     746 }
> 
> 
> There's D57430 and D57431 still open that no one has reviewed so far.
> You could try to apply them.

I expect I'll take a look at doing such later.

> 
> The earlieE change I'll just commit anyway as it is needed as well.

Sounds good.

> 
> /bz
> 
> 
>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
>>    id=<optimized out>, pdev=0xfffff8015a144a00)
>>    at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:744
>>        rid = 2304
>>        parent = <optimized out>
>>        isdrm = <optimized out>
>>        error = <optimized out>
>>        rle = <optimized out>
>>        pbus = <optimized out>
>>        ppbus = <optimized out>
> 

Just to make it easier to see where deadc0de occurs in the backtrace:

#1  doadump (textdump=textdump@entry=0)
#2  0xffffffff804c77da in db_dump (dummy=<optimized out>,
#3  0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
#4  0xffffffff804c72ad in db_command_loop ()
#5  0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
out>)
#6  0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
#7  0xffffffff811a0335 in trap (frame=<optimized out>)
#8  <signal handler called>
#9  kdb_enter (why=<optimized out>, msg=<optimized out>)
#10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
#11 0xffffffff80c10c43 in panic (
#12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
#13 <signal handler called>
#14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
#15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
#16 refcount_release (count=0xdeadc0dedeadc13e)
#17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
#18 kobject_put (kobj=0xdeadc0dedeadc12e)
#19 put_device (dev=0xdeadc0dedeadc0de)
#20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
#21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
#22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
#23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
#24 kobject_put (kobj=0xfffff8015a144a50)
#25 put_device (dev=0xfffff8015a144a00)
#26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
#27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff801079af800)
#28 device_attach (dev=0xfffff801079af800) at
/usr/src/sys/kern/subr_bus.c:2630
#29 0xffffffff80c53255 in device_probe_and_attach (dev=0xfffff8015a144a00,
#30 0xffffffff80892e32 in pci_driver_added (dev=0xfffff801079af900,
#31 0xffffffff80c50b19 in BUS_DRIVER_ADDED (_dev=0xfffff801079af900,
#32 devclass_driver_added (dc=dc@entry=0xfffff8010198e500,
#33 0xffffffff80c59cab in device_do_deferred_actions ()
#34 0xffffffff80c595f6 in devctl2_ioctl (cdev=<optimized out>,
cmd=2157462540,
#35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
        dsw = 0xdeadc0dedeadc0de
#36 0xffffffff81278951 in VOP_IOCTL_APV (
#37 0xffffffff80d3ea0f in VOP_IOCTL (vp=<optimized out>,
#38 0xffffffff80d3ea0f in vn_ioctl (fp=<optimized out>, com=<optimized
out>,
#39 0xffffffff80a7b3be in devfs_ioctl_f (fp=0xfffff8015a144a00,
#40 0xffffffff80c95dbd in fo_ioctl (fp=0xfffff8014d5e3a50, com=2157462540,
#41 kern_ioctl (td=td@entry=0xfffff80149a31780, fd=<optimized out>,
#42 0xffffffff80c95a9f in sys_ioctl (td=0xfffff80149a31780,
#43 0xffffffff811a13ec in syscallenter (td=0xfffff80149a31780)
#44 amd64_syscall (td=0xfffff80149a31780, traced=0)
#45 <signal handler called>
#46 0x00000a1894a4148a in ?? ()


-- 
===
Mark Millard
marklmi at yahoo.com