Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de
- Reply: Bjoern A. Zeeb: "Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de"
- In reply to: Mark Millard : "Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 25 Jul 2026 20:16:36 UTC
On 7/25/26 10:54, Mark Millard wrote:
> On 7/25/26 09:51, Bjoern A. Zeeb wrote:
>> On Sat, 25 Jul 2026, Mark Millard wrote:
>>
>> Sorry,
>>
>> is the tail of your dmesg going along the lines of:
>>
>> devmatch trying to load rtw89
>> rtw89 trying to laod firmware
>> that fails
>> device attach fails
>> panic?
>
> Unfortutely, the core.text.* files end with:
>
> QUOTE
> ddb capture buffer
>
> ddb: ddb_capture: kvm_nlist
> END QUOTE
>
> The screen display is mostly the backtrace. What does show are messages
> about:
>
> . . . could not load firmware image, error 2
> Trying to load binary firmware from . . .
> . . . could not load binary firmware . . . either
> . . . could not load firmware image, error 2
> Trying to load binary firmware from . . .
> . . . could not load binary firmware . . . either
> . . . could not load fimrware image . . .
> . . . failed to wait firmware completion
> . . . failed to setup chip information
>
> Fatal trap 9 . . .
> . . .
>
> For reference (from an earlier screen shot from a debug kernel test):
>
> rax shows: deadc0dedeadc0de
> rsi shows: deadc0dedeadc13e
>
> (So such shows up both at #35 and at the fatal trap 9 point.)
>
> current thread resports: (devctl/devctl)
>
> I'll also note in the backtrace it shows 0xdeadc0dedeadc13e
> as involved in the atomic_fetchadd_int falure:
>
> . . .
> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
> #13 <signal handler called>
> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
> . . .
>
>>
>>
>> More below.
>>
>>
>>> On 7/25/26 04:31, Bjoern A. Zeeb wrote:
>>>> On Fri, 24 Jul 2026, Mark Millard wrote:
>>>>
>>>>
>>>> ....
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>>> linux/device.h:376
>>>>> No locals.
>>>>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>>> linux/pci.h:474
>>>>> No locals.
>>>>> #21 lkpi_pci_dev_release (dev=0xfffff8014e842a00)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>>>> linux_pci.c:374
>>>>
>>>> That would be my recent change I assume.
>>>>
>>>>
>>>> Can you test this?
>>>>
>>>> % git diff
>>>> diff --git sys/compat/linuxkpi/common/src/linux_pci.c sys/compat/
>>>> linuxkpi/common/src/linux_pci.c
>>>> index a49254425b5d..b1c28a188b94 100644
>>>> --- sys/compat/linuxkpi/common/src/linux_pci.c
>>>> +++ sys/compat/linuxkpi/common/src/linux_pci.c
>>>> @@ -370,7 +370,7 @@ lkpi_pci_dev_release(struct device *dev)
>>>> */
>>>>
>>>> /* Clear the hierarchy recursively to root. */
>>>> - if (pdev->bus->self != pdev) {
>>>> + if (pdev->bus->self != pdev && pdev->bus->self != NULL) {
>>>> pci_dev_put(pdev->bus->self);
>>>> pdev->bus->self = NULL;
>>>> }
>>>>
>>>
>>> See later below.
>>>
>>>>
>>>>
>>>>> pdev = 0xfffff8014e842a00
>>>>> #22 0xffffffff80eed1c8 in linux_kobject_release (kref=<optimized out>)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>>>> linux_kobject.c:186
>>>>> kobj = 0xfffff8014e842a50
>>>>> name = 0xfffff80107bcd670 "rtw890"
>>>>> #23 0xffffffff80ef11ea in kref_put (kref=0xdeadc0dedeadc13e,
>>>>> rel=<optimized out>)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>>> linux/kref.h:73
>>>>> No locals.
>>>>> #24 kobject_put (kobj=0xfffff8014e842a50)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>>> linux/kobject.h:113
>>>>> No locals.
>>>>> #25 put_device (dev=0xfffff8014e842a00)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>>>> linux/device.h:376
>>>>> No locals.
>>>>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
>>>>> id=<optimized out>, pdev=0xfffff8014e842a00)
>>>>> at
>>>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>>>> linux_pci.c:744
>>>>> rid = 2304
>>>>> parent = <optimized out>
>>>>> isdrm = <optimized out>
>>>>> error = <optimized out>
>>>>> rle = <optimized out>
>>>>> pbus = <optimized out>
>>>>> ppbus = <optimized out>
>>>>> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff8010799a800)
>>>>> at ./device_if.h:195
>>>>> _m = <optimized out>
>>>>> rc = <optimized out>
>>>>> #28 device_attach (dev=0xfffff8010799a800)
>>>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2630
>>>>> attachentropy = 32965
>>>>> saved_vnet = 0x0
>>>>> attachtime = 1943114510
>>>>> error = <optimized out>
>>>>> #29 0xffffffff80c53255 in device_probe_and_attach
>>>>> (dev=0xfffff8014e842a00,
>>>>> dev@entry=0xfffff8010799a800)
>>>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2579
>>>> ...
>>>>
>>>
>>> I built a new kernel pair (debug and non-debug) based on updating the
>>> pkgbase /usr/src/ the system is based on.
>>>
>>> Booting the debug build still failed. The deadc0de based value that is
>>> assocaited with the longest lasting stack frame from with such a value
>>> is reported is still in the dsw for:
>>>
>>> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
>>> at /usr/src/sys/fs/devfs/devfs_vnops.c:964
>>> dev = 0xfffff801072a1800
>>> ref = 0
>>> vp = 0xfffff8014c11a6e0
>>> com = 2157462540
>>> td = 0xfffff80149a31780
>>> dsw = 0xdeadc0dedeadc0de
>>> error = <optimized out>
>>> fgn = <optimized out>
>>> p = <optimized out>
>>> i = <optimized out>
>>> sess = <optimized out>
>>> vpold = <optimized out>
>>>
>>> So I would expect #0 .. #34 to all be after that specific problem.
>>
>> I would assume that's an uninitialized value but I haven't looked at
>> that ioctl code.
>
> Values based on 0xdeadc0dedeadc0de show up in rax and rsi in the
> register dump, in the atomic_fetchadd_int failure, and in #35.
>
>>
>> If there's a problem already then different story.
>
> Seems suggestive of the fatal trap 9 being dependent on the odd value in
> #35, not that I've analyzed the code involved between those two points.
>
>>
>>
>>> The new gdb report follows . . .
>>>
>>> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/kernel...
>>> Reading symbols from
>>> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/kernel.debug...
>>> . . .
>>> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/smbus.ko...
>>> Reading symbols from
>>> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/smbus.ko.debug...
>>> __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
>>> 57 __asm("movq %%gs:%c1,%0" : "=r" (td)
>>> (kgdb) #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
>>> td = <optimized out>
>>> #1 doadump (textdump=textdump@entry=0)
>>> at /usr/src/sys/kern/kern_shutdown.c:399
>>> error = 0
>>> coredump = <optimized out>
>>> #2 0xffffffff804c77da in db_dump (dummy=<optimized out>,
>>> dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized
>>> out>)
>>> at /usr/src/sys/ddb/db_command.c:596
>>> error = <optimized out>
>>> #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
>>> cmd_table=<optimized out>, dopager=true)
>>> at /usr/src/sys/ddb/db_command.c:508
>>> modif = "\000Bځ\377\377\377\377\n", '\000' <repeats 15 times>,
>>> "x\000\000\000\000\000\000\000\b\000\000\0000\000\000\000\340♥\002\376\377\377`♥\002\376\377\377\375(\321f\355\177)[
>>> 㙥\002\376\377\377D\236L\200\377\377\377\377\017", '\000' <repeats 15
>>> times>,
>>> "\020\220\275\201\377\377\377\377\000\000\000\000\000\000\000\000\200\027\243I\001\370\377\377"
>>> addr = -2134482909
>>> count = -1
>>> cmd = 0xffffffff81a16ff8 <db_cmds+616>
>>> have_addr = <optimized out>
>>> t = <optimized out>
>>> result = <optimized out>
>>> #4 0xffffffff804c72ad in db_command_loop ()
>>> at /usr/src/sys/ddb/db_command.c:555
>>> No locals.
>>> #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
>>> out>)
>>> at /usr/src/sys/ddb/db_main.c:267
>>> jb = {{_jb = {0, -2187654995128, -2187654994976, -8790562629760,
>>> -2120123568, -2187654995104, -2187654994432, -2142458264,
>>> -2187654995008, -2136782033, -2116402656, 3}}}
>>> bkpt = false
>>> watchpt = false
>>> prev_jb = 0x0
>>> why = <optimized out>
>>> #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
>>> tf=tf@entry=0xfffffe02a599e600) at /usr/src/sys/kern/subr_kdb.c:790
>>> __pc = 0x0
>>> __pc = 0x0
>>> other_cpus = {__bits = {18446744071583149600,
>>> 18446741886054557328,
>>> 4294967282, 5, 2778326384, 0, 3545567873046937600,
>>> 18446744071575110192, 18446744071582117664,
>>> 18446744071582540027,
>>> 0, 12, 18446741886054557056, 0, 18446741886054559552,
>>> 11100633178600}}
>>> be = 0xffffffff81a17b50 <ddb_dbbe>
>>> intr = 70
>>> did_stop_cpus = <optimized out>
>>> handled = <optimized out>
>>> #7 0xffffffff811a0335 in trap (frame=<optimized out>)
>>> at /usr/src/sys/amd64/amd64/trap.c:702
>>> __pc = 0x0
>>> __pc = 0x0
>>> __pc = 0x0
>>> ksi = {ksi_link = {tqe_next = 0x1, tqe_prev = 0xfffff82ae17f6f00},
>>> ksi_info = {si_signo = 5, si_errno = 0, si_code = -1, si_pid
>>> = 0,
>>> si_uid = 2778326608, si_status = -510,
>>> si_addr = 0xffffffff80c708ab <_vprintf+139>, si_value = {
>>> sival_int = 5, sival_ptr = 0xffffffff00000005, sigval_int
>>> = 5,
>>> sigval_ptr = 0xffffffff00000005}, _reason = {_fault = {
>>> _trapno = 0}, _timer = {_timerid = 0, _overrun = 0},
>>> _mesgq = {
>>> _mqd = 0}, _poll = {_band = 0}, _capsicum = {_syscall =
>>> 0},
>>> __spare__ = {__spare1__ = 0, __spare2__ = {-1516640848,
>>> -510,
>>> 128, 0, -1516640848, -510, 128}}}}, ksi_flags =
>>> 977421312,
>>> ksi_sigq = 0x696e6170203a7265}
>>> signo = 0
>>> ucode = 256
>>> td = <optimized out>
>>> p = 0xfffffe0366641040
>>> dr6 = 0
>>> type = 3
>>> addr = <optimized out>
>>> pf = <optimized out>
>>> i = <optimized out>
>>> #8 <signal handler called>
>>> No locals.
>>> #9 kdb_enter (why=<optimized out>, msg=<optimized out>)
>>> at /usr/src/sys/kern/subr_kdb.c:556
>>> No locals.
>>> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
>>> ap=ap@entry=0xfffffe02a599e830) at /usr/src/sys/kern/
>>> kern_shutdown.c:962
>>> buf = "general protection fault", '\000' <repeats 231 times>
>>> __pc = 0x0
>>> __pc = 0x0
>>> __pc = 0x0
>>> other_cpus = {__bits = {4294934527, 0 <repeats 15 times>}}
>>> td = 0xfffff80149a31780
>>> bootopt = <optimized out>
>>> newpanic = <optimized out>
>>> #11 0xffffffff80c10c43 in panic (
>>> fmt=0xffffffff81da4260 <cnputs_mtx> "\241@)\201\377\377\377\377")
>>> at /usr/src/sys/kern/kern_shutdown.c:887
>>> ap = {{gp_offset = 16, fp_offset = 48,
>>> overflow_arg_area = 0xfffffe02a599e860,
>>> reg_save_area = 0xfffffe02a599e800}}
>>> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
>>> eva=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:1031
>>> type = <optimized out>
>>> #13 <signal handler called>
>>> No locals.
>>> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
>>> v=4294967295) at /usr/src/sys/amd64/include/atomic.h:194
>>> No locals.
>>> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
>>> at /usr/src/sys/sys/refcount.h:149
>>> old = <optimized out>
>>> #16 refcount_release (count=0xdeadc0dedeadc13e)
>>> at /usr/src/sys/sys/refcount.h:171
>>> No locals.
>>> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:72
>>> No locals.
>>> #18 kobject_put (kobj=0xdeadc0dedeadc12e)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
>>> No locals.
>>> #19 put_device (dev=0xdeadc0dedeadc0de)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
>>> No locals.
>>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/pci.h:474
>>> No locals.
>>
>> The above has changed if I am not wrong...
>>
>>> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
>>> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:374
>>> pdev = 0xfffff8015a144a00
>>> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
>>> at /usr/src/sys/compat/linuxkpi/common/src/linux_kobject.c:186
>>> kobj = 0xfffff8015a144a50
>>> name = 0xfffff82ae1802610 "rtw890"
>>> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
>>> rel=<optimized out>)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:73
>>> No locals.
>>> #24 kobject_put (kobj=0xfffff8015a144a50)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
>>> No locals.
>>> #25 put_device (dev=0xfffff8015a144a00)
>>> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
>>> No locals.
>>
>> And I misread this before.
>>
>> This is the error case in linux_pci_attach_device():
>>
>> You may notice my comment there:
>>
>> 734
>> 735 /* XXX the cleanup does not match the allocation up there. */
>> 736 out_probe:
>> 737 free(pdev->bus, M_DEVBUF);
>> 738 spin_lock_destroy(&pdev->pcie_cap_lock);
>> 739 linux_pdev_dma_uninit(pdev);
>> 740 out_dma_init:
>> 741 spin_lock(&pci_lock);
>> 742 list_del(&pdev->links);
>> 743 spin_unlock(&pci_lock);
>> 744 put_device(&pdev->dev); // <<<<<<<<< here
>> 745 return (-error);
>> 746 }
>>
>>
>> There's D57430 and D57431 still open that no one has reviewed so far.
>> You could try to apply them.
>
> I expect I'll take a look at doing such later.
D57431 did not apply cleanly to the source code that pkgbase supplied in
/usr/src/sys/ (started from not having the prior one line patch you had
me test):
# git apply D57430.diff
# git apply D57431.diff
error: patch failed: sys/compat/linuxkpi/common/src/linux_pci.c:342
error: sys/compat/linuxkpi/common/src/linux_pci.c: patch does not apply
>
>>
>> The earlieE change I'll just commit anyway as it is needed as well.
>
> Sounds good.
>
>>
>> /bz
>>
>>
>>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
>>> id=<optimized out>, pdev=0xfffff8015a144a00)
>>> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:744
>>> rid = 2304
>>> parent = <optimized out>
>>> isdrm = <optimized out>
>>> error = <optimized out>
>>> rle = <optimized out>
>>> pbus = <optimized out>
>>> ppbus = <optimized out>
>>
>
> Just to make it easier to see where deadc0de occurs in the backtrace:
>
> #1 doadump (textdump=textdump@entry=0)
> #2 0xffffffff804c77da in db_dump (dummy=<optimized out>,
> #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
> #4 0xffffffff804c72ad in db_command_loop ()
> #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
> out>)
> #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
> #7 0xffffffff811a0335 in trap (frame=<optimized out>)
> #8 <signal handler called>
> #9 kdb_enter (why=<optimized out>, msg=<optimized out>)
> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
> #11 0xffffffff80c10c43 in panic (
> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
> #13 <signal handler called>
> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
> #16 refcount_release (count=0xdeadc0dedeadc13e)
> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
> #18 kobject_put (kobj=0xdeadc0dedeadc12e)
> #19 put_device (dev=0xdeadc0dedeadc0de)
> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
> #24 kobject_put (kobj=0xfffff8015a144a50)
> #25 put_device (dev=0xfffff8015a144a00)
> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff801079af800)
> #28 device_attach (dev=0xfffff801079af800) at
> /usr/src/sys/kern/subr_bus.c:2630
> #29 0xffffffff80c53255 in device_probe_and_attach (dev=0xfffff8015a144a00,
> #30 0xffffffff80892e32 in pci_driver_added (dev=0xfffff801079af900,
> #31 0xffffffff80c50b19 in BUS_DRIVER_ADDED (_dev=0xfffff801079af900,
> #32 devclass_driver_added (dc=dc@entry=0xfffff8010198e500,
> #33 0xffffffff80c59cab in device_do_deferred_actions ()
> #34 0xffffffff80c595f6 in devctl2_ioctl (cdev=<optimized out>,
> cmd=2157462540,
> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
> dsw = 0xdeadc0dedeadc0de
> #36 0xffffffff81278951 in VOP_IOCTL_APV (
> #37 0xffffffff80d3ea0f in VOP_IOCTL (vp=<optimized out>,
> #38 0xffffffff80d3ea0f in vn_ioctl (fp=<optimized out>, com=<optimized
> out>,
> #39 0xffffffff80a7b3be in devfs_ioctl_f (fp=0xfffff8015a144a00,
> #40 0xffffffff80c95dbd in fo_ioctl (fp=0xfffff8014d5e3a50, com=2157462540,
> #41 kern_ioctl (td=td@entry=0xfffff80149a31780, fd=<optimized out>,
> #42 0xffffffff80c95a9f in sys_ioctl (td=0xfffff80149a31780,
> #43 0xffffffff811a13ec in syscallenter (td=0xfffff80149a31780)
> #44 amd64_syscall (td=0xfffff80149a31780, traced=0)
> #45 <signal handler called>
> #46 0x00000a1894a4148a in ?? ()
>
>
--
===
Mark Millard
marklmi at yahoo.com