Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de
- Reply: Bjoern A. Zeeb: "Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de"
- In reply to: Mark Millard : "Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 25 Jul 2026 18:48:09 UTC
On Sat, Jul 25, 2026 at 10:54 AM Mark Millard <marklmi@yahoo.com> wrote:
>
> On 7/25/26 09:51, Bjoern A. Zeeb wrote:
> > On Sat, 25 Jul 2026, Mark Millard wrote:
> >
> > Sorry,
> >
> > is the tail of your dmesg going along the lines of:
> >
> > devmatch trying to load rtw89
> > rtw89 trying to laod firmware
> > that fails
> > device attach fails
> > panic?
>
> Unfortutely, the core.text.* files end with:
>
> QUOTE
> ddb capture buffer
>
> ddb: ddb_capture: kvm_nlist
> END QUOTE
>
> The screen display is mostly the backtrace. What does show are messages
> about:
>
> . . . could not load firmware image, error 2
> Trying to load binary firmware from . . .
> . . . could not load binary firmware . . . either
> . . . could not load firmware image, error 2
> Trying to load binary firmware from . . .
> . . . could not load binary firmware . . . either
> . . . could not load fimrware image . . .
> . . . failed to wait firmware completion
> . . . failed to setup chip information
>
> Fatal trap 9 . . .
> . . .
>
> For reference (from an earlier screen shot from a debug kernel test):
>
> rax shows: deadc0dedeadc0de
> rsi shows: deadc0dedeadc13e
>
> (So such shows up both at #35 and at the fatal trap 9 point.)
>
> current thread resports: (devctl/devctl)
>
> I'll also note in the backtrace it shows 0xdeadc0dedeadc13e
> as involved in the atomic_fetchadd_int falure:
>
> . . .
> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
> #13 <signal handler called>
> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
> . . .
>
> >
> >
> > More below.
> >
> >
> >> On 7/25/26 04:31, Bjoern A. Zeeb wrote:
> >>> On Fri, 24 Jul 2026, Mark Millard wrote:
> >>>
> >>>
> >>> ....
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
> >>>> linux/device.h:376
> >>>> No locals.
> >>>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
> >>>> linux/pci.h:474
> >>>> No locals.
> >>>> #21 lkpi_pci_dev_release (dev=0xfffff8014e842a00)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
> >>>> linux_pci.c:374
> >>>
> >>> That would be my recent change I assume.
> >>>
> >>>
> >>> Can you test this?
> >>>
> >>> % git diff
> >>> diff --git sys/compat/linuxkpi/common/src/linux_pci.c sys/compat/
> >>> linuxkpi/common/src/linux_pci.c
> >>> index a49254425b5d..b1c28a188b94 100644
> >>> --- sys/compat/linuxkpi/common/src/linux_pci.c
> >>> +++ sys/compat/linuxkpi/common/src/linux_pci.c
> >>> @@ -370,7 +370,7 @@ lkpi_pci_dev_release(struct device *dev)
> >>> */
> >>>
> >>> /* Clear the hierarchy recursively to root. */
> >>> - if (pdev->bus->self != pdev) {
> >>> + if (pdev->bus->self != pdev && pdev->bus->self != NULL) {
> >>> pci_dev_put(pdev->bus->self);
> >>> pdev->bus->self = NULL;
> >>> }
> >>>
> >>
> >> See later below.
> >>
> >>>
> >>>
> >>>> pdev = 0xfffff8014e842a00
> >>>> #22 0xffffffff80eed1c8 in linux_kobject_release (kref=<optimized out>)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
> >>>> linux_kobject.c:186
> >>>> kobj = 0xfffff8014e842a50
> >>>> name = 0xfffff80107bcd670 "rtw890"
> >>>> #23 0xffffffff80ef11ea in kref_put (kref=0xdeadc0dedeadc13e,
> >>>> rel=<optimized out>)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
> >>>> linux/kref.h:73
> >>>> No locals.
> >>>> #24 kobject_put (kobj=0xfffff8014e842a50)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
> >>>> linux/kobject.h:113
> >>>> No locals.
> >>>> #25 put_device (dev=0xfffff8014e842a00)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
> >>>> linux/device.h:376
> >>>> No locals.
> >>>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
> >>>> id=<optimized out>, pdev=0xfffff8014e842a00)
> >>>> at
> >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
> >>>> linux_pci.c:744
> >>>> rid = 2304
> >>>> parent = <optimized out>
> >>>> isdrm = <optimized out>
> >>>> error = <optimized out>
> >>>> rle = <optimized out>
> >>>> pbus = <optimized out>
> >>>> ppbus = <optimized out>
> >>>> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff8010799a800)
> >>>> at ./device_if.h:195
> >>>> _m = <optimized out>
> >>>> rc = <optimized out>
> >>>> #28 device_attach (dev=0xfffff8010799a800)
> >>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2630
> >>>> attachentropy = 32965
> >>>> saved_vnet = 0x0
> >>>> attachtime = 1943114510
> >>>> error = <optimized out>
> >>>> #29 0xffffffff80c53255 in device_probe_and_attach
> >>>> (dev=0xfffff8014e842a00,
> >>>> dev@entry=0xfffff8010799a800)
> >>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2579
> >>> ...
> >>>
> >>
> >> I built a new kernel pair (debug and non-debug) based on updating the
> >> pkgbase /usr/src/ the system is based on.
> >>
> >> Booting the debug build still failed. The deadc0de based value that is
> >> assocaited with the longest lasting stack frame from with such a value
> >> is reported is still in the dsw for:
> >>
> >> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
> >> at /usr/src/sys/fs/devfs/devfs_vnops.c:964
> >> dev = 0xfffff801072a1800
> >> ref = 0
> >> vp = 0xfffff8014c11a6e0
> >> com = 2157462540
> >> td = 0xfffff80149a31780
> >> dsw = 0xdeadc0dedeadc0de
> >> error = <optimized out>
> >> fgn = <optimized out>
> >> p = <optimized out>
> >> i = <optimized out>
> >> sess = <optimized out>
> >> vpold = <optimized out>
> >>
> >> So I would expect #0 .. #34 to all be after that specific problem.
> >
> > I would assume that's an uninitialized value but I haven't looked at
> > that ioctl code.
>
> Values based on 0xdeadc0dedeadc0de show up in rax and rsi in the
> register dump, in the atomic_fetchadd_int failure, and in #35.
>
> >
> > If there's a problem already then different story.
>
> Seems suggestive of the fatal trap 9 being dependent on the odd value in
> #35, not that I've analyzed the code involved between those two points.
>
> >
> >
> >> The new gdb report follows . . .
> >>
> >> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/kernel...
> >> Reading symbols from
> >> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/kernel.debug...
> >> . . .
> >> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/smbus.ko...
> >> Reading symbols from
> >> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/smbus.ko.debug...
> >> __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
> >> 57 __asm("movq %%gs:%c1,%0" : "=r" (td)
> >> (kgdb) #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
> >> td = <optimized out>
> >> #1 doadump (textdump=textdump@entry=0)
> >> at /usr/src/sys/kern/kern_shutdown.c:399
> >> error = 0
> >> coredump = <optimized out>
> >> #2 0xffffffff804c77da in db_dump (dummy=<optimized out>,
> >> dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized
> >> out>)
> >> at /usr/src/sys/ddb/db_command.c:596
> >> error = <optimized out>
> >> #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
> >> cmd_table=<optimized out>, dopager=true)
> >> at /usr/src/sys/ddb/db_command.c:508
> >> modif = "\000Bځ\377\377\377\377\n", '\000' <repeats 15 times>,
> >> "x\000\000\000\000\000\000\000\b\000\000\0000\000\000\000\340♥\002\376\377\377`♥\002\376\377\377\375(\321f\355\177)[
> >> 㙥\002\376\377\377D\236L\200\377\377\377\377\017", '\000' <repeats 15
> >> times>,
> >> "\020\220\275\201\377\377\377\377\000\000\000\000\000\000\000\000\200\027\243I\001\370\377\377"
> >> addr = -2134482909
> >> count = -1
> >> cmd = 0xffffffff81a16ff8 <db_cmds+616>
> >> have_addr = <optimized out>
> >> t = <optimized out>
> >> result = <optimized out>
> >> #4 0xffffffff804c72ad in db_command_loop ()
> >> at /usr/src/sys/ddb/db_command.c:555
> >> No locals.
> >> #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
> >> out>)
> >> at /usr/src/sys/ddb/db_main.c:267
> >> jb = {{_jb = {0, -2187654995128, -2187654994976, -8790562629760,
> >> -2120123568, -2187654995104, -2187654994432, -2142458264,
> >> -2187654995008, -2136782033, -2116402656, 3}}}
> >> bkpt = false
> >> watchpt = false
> >> prev_jb = 0x0
> >> why = <optimized out>
> >> #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
> >> tf=tf@entry=0xfffffe02a599e600) at /usr/src/sys/kern/subr_kdb.c:790
> >> __pc = 0x0
> >> __pc = 0x0
> >> other_cpus = {__bits = {18446744071583149600,
> >> 18446741886054557328,
> >> 4294967282, 5, 2778326384, 0, 3545567873046937600,
> >> 18446744071575110192, 18446744071582117664,
> >> 18446744071582540027,
> >> 0, 12, 18446741886054557056, 0, 18446741886054559552,
> >> 11100633178600}}
> >> be = 0xffffffff81a17b50 <ddb_dbbe>
> >> intr = 70
> >> did_stop_cpus = <optimized out>
> >> handled = <optimized out>
> >> #7 0xffffffff811a0335 in trap (frame=<optimized out>)
> >> at /usr/src/sys/amd64/amd64/trap.c:702
> >> __pc = 0x0
> >> __pc = 0x0
> >> __pc = 0x0
> >> ksi = {ksi_link = {tqe_next = 0x1, tqe_prev = 0xfffff82ae17f6f00},
> >> ksi_info = {si_signo = 5, si_errno = 0, si_code = -1, si_pid
> >> = 0,
> >> si_uid = 2778326608, si_status = -510,
> >> si_addr = 0xffffffff80c708ab <_vprintf+139>, si_value = {
> >> sival_int = 5, sival_ptr = 0xffffffff00000005, sigval_int
> >> = 5,
> >> sigval_ptr = 0xffffffff00000005}, _reason = {_fault = {
> >> _trapno = 0}, _timer = {_timerid = 0, _overrun = 0},
> >> _mesgq = {
> >> _mqd = 0}, _poll = {_band = 0}, _capsicum = {_syscall =
> >> 0},
> >> __spare__ = {__spare1__ = 0, __spare2__ = {-1516640848,
> >> -510,
> >> 128, 0, -1516640848, -510, 128}}}}, ksi_flags =
> >> 977421312,
> >> ksi_sigq = 0x696e6170203a7265}
> >> signo = 0
> >> ucode = 256
> >> td = <optimized out>
> >> p = 0xfffffe0366641040
> >> dr6 = 0
> >> type = 3
> >> addr = <optimized out>
> >> pf = <optimized out>
> >> i = <optimized out>
> >> #8 <signal handler called>
> >> No locals.
> >> #9 kdb_enter (why=<optimized out>, msg=<optimized out>)
> >> at /usr/src/sys/kern/subr_kdb.c:556
> >> No locals.
> >> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
> >> ap=ap@entry=0xfffffe02a599e830) at /usr/src/sys/kern/
> >> kern_shutdown.c:962
> >> buf = "general protection fault", '\000' <repeats 231 times>
> >> __pc = 0x0
> >> __pc = 0x0
> >> __pc = 0x0
> >> other_cpus = {__bits = {4294934527, 0 <repeats 15 times>}}
> >> td = 0xfffff80149a31780
> >> bootopt = <optimized out>
> >> newpanic = <optimized out>
> >> #11 0xffffffff80c10c43 in panic (
> >> fmt=0xffffffff81da4260 <cnputs_mtx> "\241@)\201\377\377\377\377")
> >> at /usr/src/sys/kern/kern_shutdown.c:887
> >> ap = {{gp_offset = 16, fp_offset = 48,
> >> overflow_arg_area = 0xfffffe02a599e860,
> >> reg_save_area = 0xfffffe02a599e800}}
> >> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
> >> eva=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:1031
> >> type = <optimized out>
> >> #13 <signal handler called>
> >> No locals.
> >> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
> >> v=4294967295) at /usr/src/sys/amd64/include/atomic.h:194
> >> No locals.
> >> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
> >> at /usr/src/sys/sys/refcount.h:149
> >> old = <optimized out>
> >> #16 refcount_release (count=0xdeadc0dedeadc13e)
> >> at /usr/src/sys/sys/refcount.h:171
> >> No locals.
> >> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:72
> >> No locals.
> >> #18 kobject_put (kobj=0xdeadc0dedeadc12e)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
> >> No locals.
> >> #19 put_device (dev=0xdeadc0dedeadc0de)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
> >> No locals.
> >> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/pci.h:474
> >> No locals.
> >
> > The above has changed if I am not wrong...
> >
> >> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
> >> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:374
> >> pdev = 0xfffff8015a144a00
> >> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
> >> at /usr/src/sys/compat/linuxkpi/common/src/linux_kobject.c:186
> >> kobj = 0xfffff8015a144a50
> >> name = 0xfffff82ae1802610 "rtw890"
> >> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
> >> rel=<optimized out>)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:73
> >> No locals.
> >> #24 kobject_put (kobj=0xfffff8015a144a50)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
> >> No locals.
> >> #25 put_device (dev=0xfffff8015a144a00)
> >> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
> >> No locals.
> >
> > And I misread this before.
> >
> > This is the error case in linux_pci_attach_device():
> >
> > You may notice my comment there:
> >
> > 734
> > 735 /* XXX the cleanup does not match the allocation up there. */
> > 736 out_probe:
> > 737 free(pdev->bus, M_DEVBUF);
> > 738 spin_lock_destroy(&pdev->pcie_cap_lock);
> > 739 linux_pdev_dma_uninit(pdev);
> > 740 out_dma_init:
> > 741 spin_lock(&pci_lock);
> > 742 list_del(&pdev->links);
> > 743 spin_unlock(&pci_lock);
> > 744 put_device(&pdev->dev); // <<<<<<<<< here
> > 745 return (-error);
> > 746 }
> >
> >
> > There's D57430 and D57431 still open that no one has reviewed so far.
> > You could try to apply them.
>
> I expect I'll take a look at doing such later.
>
> >
> > The earlieE change I'll just commit anyway as it is needed as well.
>
> Sounds good.
>
> >
> > /bz
> >
> >
> >> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
> >> id=<optimized out>, pdev=0xfffff8015a144a00)
> >> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:744
> >> rid = 2304
> >> parent = <optimized out>
> >> isdrm = <optimized out>
> >> error = <optimized out>
> >> rle = <optimized out>
> >> pbus = <optimized out>
> >> ppbus = <optimized out>
> >
>
> Just to make it easier to see where deadc0de occurs in the backtrace:
>
> #1 doadump (textdump=textdump@entry=0)
> #2 0xffffffff804c77da in db_dump (dummy=<optimized out>,
> #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
> #4 0xffffffff804c72ad in db_command_loop ()
> #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
> out>)
> #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
> #7 0xffffffff811a0335 in trap (frame=<optimized out>)
> #8 <signal handler called>
> #9 kdb_enter (why=<optimized out>, msg=<optimized out>)
> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
> #11 0xffffffff80c10c43 in panic (
> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
> #13 <signal handler called>
> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
> #16 refcount_release (count=0xdeadc0dedeadc13e)
> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
> #18 kobject_put (kobj=0xdeadc0dedeadc12e)
> #19 put_device (dev=0xdeadc0dedeadc0de)
> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
> #24 kobject_put (kobj=0xfffff8015a144a50)
> #25 put_device (dev=0xfffff8015a144a00)
> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff801079af800)
> #28 device_attach (dev=0xfffff801079af800) at
> /usr/src/sys/kern/subr_bus.c:2630
> #29 0xffffffff80c53255 in device_probe_and_attach (dev=0xfffff8015a144a00,
> #30 0xffffffff80892e32 in pci_driver_added (dev=0xfffff801079af900,
> #31 0xffffffff80c50b19 in BUS_DRIVER_ADDED (_dev=0xfffff801079af900,
> #32 devclass_driver_added (dc=dc@entry=0xfffff8010198e500,
> #33 0xffffffff80c59cab in device_do_deferred_actions ()
> #34 0xffffffff80c595f6 in devctl2_ioctl (cdev=<optimized out>,
> cmd=2157462540,
> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
> dsw = 0xdeadc0dedeadc0de
> #36 0xffffffff81278951 in VOP_IOCTL_APV (
> #37 0xffffffff80d3ea0f in VOP_IOCTL (vp=<optimized out>,
> #38 0xffffffff80d3ea0f in vn_ioctl (fp=<optimized out>, com=<optimized
> out>,
> #39 0xffffffff80a7b3be in devfs_ioctl_f (fp=0xfffff8015a144a00,
> #40 0xffffffff80c95dbd in fo_ioctl (fp=0xfffff8014d5e3a50, com=2157462540,
> #41 kern_ioctl (td=td@entry=0xfffff80149a31780, fd=<optimized out>,
> #42 0xffffffff80c95a9f in sys_ioctl (td=0xfffff80149a31780,
> #43 0xffffffff811a13ec in syscallenter (td=0xfffff80149a31780)
> #44 amd64_syscall (td=0xfffff80149a31780, traced=0)
> #45 <signal handler called>
> #46 0x00000a1894a4148a in ?? ()
>
>
> --
> ===
> Mark Millard
> marklmi at yahoo.com
>
Drive-by comment, I don't know this code.
It seems to suggest pdev->bus in lkpi_pci_dev_release points to a
freed object. Back in linux_pci_attach_device (frame #26), in the
probe failure path that does goto out_probe, we free(pdev->bus,
M_DEVBUF), and then call put_device(&pdev->dev) (frame #25), and then
in lkpi_pci_dev_release (frame #21) we try to use the freed pdev->bus.
You could try assigning pdev->bus to a distinct junk value after the
free in linux_pci_attach_device to confirm this.
Ryan