[Bug 290098] bhyve crashes when trying to run a 9front VM

From: <bugzilla-noreply_at_freebsd.org>
Date: Wed, 05 Nov 2025 21:07:20 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290098

--- Comment #17 from Bakul Shah <bakul@iitbombay.org> ---
Finally getting around to this.... I set a breakpoint on the line
in question and ran bhyve until the assert was triggered. I don't
know PCI or bhyve code well but happy to work with anyone to track
this down. Note also that a netbsd vm dies on the same assert.

Running bhyve under gdb I see
[Switching to LWP 252876 of process 93322]

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2a900,
    idx=0, registration=1) at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb) c
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2ac00,
    idx=0, registration=1) at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb)
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2a900,
    idx=0, registration=1) at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb)
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2ac00,
    idx=0, registration=1) at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb)
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2a900,
    idx=0, registration=registration@entry=1)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb) c
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2a900,
    idx=0, registration=registration@entry=1)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb)
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2ac00,
    idx=0, registration=registration@entry=1)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb)
Continuing.

Thread 20 "vcpu 0" hit Breakpoint 1, modify_bar_registration (pi=0x801e2ac00,
    idx=0, registration=registration@entry=1)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:706
706             assert(error == 0);
(gdb)
Continuing.
Assertion failed: (error == 0), function modify_bar_registration, file
/usr/src/usr.sbin/bhyve/pci_emul.c, line 706.

Thread 20 "vcpu 0" received signal SIGABRT, Aborted.
Sent by thr_kill() from pid 93322 and user 0.
0x0000000801b409ea in thr_kill () from /lib/libsys.so.7
(gdb) where
#0  0x0000000801b409ea in thr_kill () from /lib/libsys.so.7
#1  0x00000008018c8804 in raise () from /lib/libc.so.7
#2  0x0000000801979969 in abort () from /lib/libc.so.7
#3  0x00000008018ab3f1 in __assert () from /lib/libc.so.7
#4  0x0000000001067d27 in modify_bar_registration (pi=0x801e2af00, idx=1,
    registration=registration@entry=1)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:706
#5  0x00000000010679a9 in register_bar (pi=0x3dbcc, idx=6)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:723
#6  0x00000000010677f6 in pci_cfgrw (in=<optimized out>, bus=<optimized out>,
    slot=<optimized out>, func=<optimized out>, coff=<optimized out>,
    bytes=<optimized out>, valp=0x7fffddbead0c)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:2367
#7  0x0000000001068134 in pci_emul_cfgdata (ctx=<optimized out>, in=252876,
    port=<optimized out>, bytes=0, eax=<optimized out>, arg=<optimized out>)
    at /usr/src/usr.sbin/bhyve/pci_emul.c:2468
#8  0x0000000001080a89 in emulate_inout (ctx=0x801e1a000, vcpu=0x801e0d060,
    vmexit=vmexit@entry=0x7fffddbeaec8)
    at /usr/src/usr.sbin/bhyve/amd64/inout.c:222
#9  0x000000000107de50 in vmexit_inout (ctx=0x3dbcc, vcpu=0x6,
    vmrun=<optimized out>) at /usr/src/usr.sbin/bhyve/amd64/vmexit.c:84
#10 0x0000000001050740 in vm_loop (ctx=0x801e1a000, vcpu=0x801e0d060)
    at /usr/src/usr.sbin/bhyve/bhyverun.c:651
#11 0x000000000104f4c7 in fbsdrun_start_thread (param=0x801e0b040)
    at /usr/src/usr.sbin/bhyve/bhyverun.c:563
#12 0x00000008011d0d21 in ?? () from /lib/libthr.so.3
#13 0x0000000000000000 in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffddbeb000

-- 
You are receiving this mail because:
You are the assignee for the bug.