Re: amd64 boot crash for lack of being set up to use of rtw89; linuxkpi calls on the stack, 0xdeadc0dedeadc13e and such involved, devfs_ioctl with dsw=0xdeadc0dedeadc0de
"Bjoern A. Zeeb" <[email protected]> Sat, 25 Jul 2026 16:51:17 +0000 (UTC)
| Newsgroups | gmane.os.freebsd.current |
|---|---|
| Message-ID | <[email protected]> |
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
--0-1176814517-1784998277=:11296
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8BIT
On Sat, 25 Jul 2026, Mark Millard wrote:
Sorry,
is the tail of your dmesg going along the lines of:
devmatch trying to load rtw89
rtw89 trying to laod firmware
that fails
device attach fails
panic?
More below.
> On 7/25/26 04:31, Bjoern A. Zeeb wrote:
>> On Fri, 24 Jul 2026, Mark Millard wrote:
>>
>>
>> ....
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>> linux/device.h:376
>>> No locals.
>>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>> linux/pci.h:474
>>> No locals.
>>> #21 lkpi_pci_dev_release (dev=0xfffff8014e842a00)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>> linux_pci.c:374
>>
>> That would be my recent change I assume.
>>
>>
>> Can you test this?
>>
>> % git diff
>> diff --git sys/compat/linuxkpi/common/src/linux_pci.c sys/compat/
>> linuxkpi/common/src/linux_pci.c
>> index a49254425b5d..b1c28a188b94 100644
>> --- sys/compat/linuxkpi/common/src/linux_pci.c
>> +++ sys/compat/linuxkpi/common/src/linux_pci.c
>> @@ -370,7 +370,7 @@ lkpi_pci_dev_release(struct device *dev)
>> */
>>
>> /* Clear the hierarchy recursively to root. */
>> - if (pdev->bus->self != pdev) {
>> + if (pdev->bus->self != pdev && pdev->bus->self != NULL) {
>> pci_dev_put(pdev->bus->self);
>> pdev->bus->self = NULL;
>> }
>>
>
> See later below.
>
>>
>>
>>> pdev = 0xfffff8014e842a00
>>> #22 0xffffffff80eed1c8 in linux_kobject_release (kref=<optimized out>)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>> linux_kobject.c:186
>>> kobj = 0xfffff8014e842a50
>>> name = 0xfffff80107bcd670 "rtw890"
>>> #23 0xffffffff80ef11ea in kref_put (kref=0xdeadc0dedeadc13e,
>>> rel=<optimized out>)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>> linux/kref.h:73
>>> No locals.
>>> #24 kobject_put (kobj=0xfffff8014e842a50)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>> linux/kobject.h:113
>>> No locals.
>>> #25 put_device (dev=0xfffff8014e842a00)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/
>>> linux/device.h:376
>>> No locals.
>>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
>>> id=<optimized out>, pdev=0xfffff8014e842a00)
>>> at
>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/
>>> linux_pci.c:744
>>> rid = 2304
>>> parent = <optimized out>
>>> isdrm = <optimized out>
>>> error = <optimized out>
>>> rle = <optimized out>
>>> pbus = <optimized out>
>>> ppbus = <optimized out>
>>> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff8010799a800)
>>> at ./device_if.h:195
>>> _m = <optimized out>
>>> rc = <optimized out>
>>> #28 device_attach (dev=0xfffff8010799a800)
>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2630
>>> attachentropy = 32965
>>> saved_vnet = 0x0
>>> attachtime = 1943114510
>>> error = <optimized out>
>>> #29 0xffffffff80c53255 in device_probe_and_attach
>>> (dev=0xfffff8014e842a00,
>>> dev@entry=0xfffff8010799a800)
>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2579
>> ...
>>
>
> I built a new kernel pair (debug and non-debug) based on updating the
> pkgbase /usr/src/ the system is based on.
>
> Booting the debug build still failed. The deadc0de based value that is
> assocaited with the longest lasting stack frame from with such a value
> is reported is still in the dsw for:
>
> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40)
> at /usr/src/sys/fs/devfs/devfs_vnops.c:964
> dev = 0xfffff801072a1800
> ref = 0
> vp = 0xfffff8014c11a6e0
> com = 2157462540
> td = 0xfffff80149a31780
> dsw = 0xdeadc0dedeadc0de
> error = <optimized out>
> fgn = <optimized out>
> p = <optimized out>
> i = <optimized out>
> sess = <optimized out>
> vpold = <optimized out>
>
> So I would expect #0 .. #34 to all be after that specific problem.
I would assume that's an uninitialized value but I haven't looked at that ioctl code.
If there's a problem already then different story.
> The new gdb report follows . . .
>
> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/kernel...
> Reading symbols from
> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/kernel.debug...
> . . .
> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/smbus.ko...
> Reading symbols from
> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/smbus.ko.debug...
> __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
> 57 __asm("movq %%gs:%c1,%0" : "=r" (td)
> (kgdb) #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
> td = <optimized out>
> #1 doadump (textdump=textdump@entry=0)
> at /usr/src/sys/kern/kern_shutdown.c:399
> error = 0
> coredump = <optimized out>
> #2 0xffffffff804c77da in db_dump (dummy=<optimized out>,
> dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized out>)
> at /usr/src/sys/ddb/db_command.c:596
> error = <optimized out>
> #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>,
> cmd_table=<optimized out>, dopager=true)
> at /usr/src/sys/ddb/db_command.c:508
> modif = "\000Bځ\377\377\377\377\n", '\000' <repeats 15 times>,
> "x\000\000\000\000\000\000\000\b\000\000\0000\000\000\000\340♥\002\376\377\377`♥\002\376\377\377\375(\321f\355\177)[
> 㙥\002\376\377\377D\236L\200\377\377\377\377\017", '\000' <repeats 15
> times>,
> "\020\220\275\201\377\377\377\377\000\000\000\000\000\000\000\000\200\027\243I\001\370\377\377"
> addr = -2134482909
> count = -1
> cmd = 0xffffffff81a16ff8 <db_cmds+616>
> have_addr = <optimized out>
> t = <optimized out>
> result = <optimized out>
> #4 0xffffffff804c72ad in db_command_loop ()
> at /usr/src/sys/ddb/db_command.c:555
> No locals.
> #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized
> out>)
> at /usr/src/sys/ddb/db_main.c:267
> jb = {{_jb = {0, -2187654995128, -2187654994976, -8790562629760,
> -2120123568, -2187654995104, -2187654994432, -2142458264,
> -2187654995008, -2136782033, -2116402656, 3}}}
> bkpt = false
> watchpt = false
> prev_jb = 0x0
> why = <optimized out>
> #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0,
> tf=tf@entry=0xfffffe02a599e600) at /usr/src/sys/kern/subr_kdb.c:790
> __pc = 0x0
> __pc = 0x0
> other_cpus = {__bits = {18446744071583149600, 18446741886054557328,
> 4294967282, 5, 2778326384, 0, 3545567873046937600,
> 18446744071575110192, 18446744071582117664,
> 18446744071582540027,
> 0, 12, 18446741886054557056, 0, 18446741886054559552,
> 11100633178600}}
> be = 0xffffffff81a17b50 <ddb_dbbe>
> intr = 70
> did_stop_cpus = <optimized out>
> handled = <optimized out>
> #7 0xffffffff811a0335 in trap (frame=<optimized out>)
> at /usr/src/sys/amd64/amd64/trap.c:702
> __pc = 0x0
> __pc = 0x0
> __pc = 0x0
> ksi = {ksi_link = {tqe_next = 0x1, tqe_prev = 0xfffff82ae17f6f00},
> ksi_info = {si_signo = 5, si_errno = 0, si_code = -1, si_pid = 0,
> si_uid = 2778326608, si_status = -510,
> si_addr = 0xffffffff80c708ab <_vprintf+139>, si_value = {
> sival_int = 5, sival_ptr = 0xffffffff00000005, sigval_int
> = 5,
> sigval_ptr = 0xffffffff00000005}, _reason = {_fault = {
> _trapno = 0}, _timer = {_timerid = 0, _overrun = 0},
> _mesgq = {
> _mqd = 0}, _poll = {_band = 0}, _capsicum = {_syscall = 0},
> __spare__ = {__spare1__ = 0, __spare2__ = {-1516640848, -510,
> 128, 0, -1516640848, -510, 128}}}}, ksi_flags =
> 977421312,
> ksi_sigq = 0x696e6170203a7265}
> signo = 0
> ucode = 256
> td = <optimized out>
> p = 0xfffffe0366641040
> dr6 = 0
> type = 3
> addr = <optimized out>
> pf = <optimized out>
> i = <optimized out>
> #8 <signal handler called>
> No locals.
> #9 kdb_enter (why=<optimized out>, msg=<optimized out>)
> at /usr/src/sys/kern/subr_kdb.c:556
> No locals.
> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>,
> ap=ap@entry=0xfffffe02a599e830) at /usr/src/sys/kern/kern_shutdown.c:962
> buf = "general protection fault", '\000' <repeats 231 times>
> __pc = 0x0
> __pc = 0x0
> __pc = 0x0
> other_cpus = {__bits = {4294934527, 0 <repeats 15 times>}}
> td = 0xfffff80149a31780
> bootopt = <optimized out>
> newpanic = <optimized out>
> #11 0xffffffff80c10c43 in panic (
> fmt=0xffffffff81da4260 <cnputs_mtx> "\241@)\201\377\377\377\377")
> at /usr/src/sys/kern/kern_shutdown.c:887
> ap = {{gp_offset = 16, fp_offset = 48,
> overflow_arg_area = 0xfffffe02a599e860,
> reg_save_area = 0xfffffe02a599e800}}
> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880,
> eva=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:1031
> type = <optimized out>
> #13 <signal handler called>
> No locals.
> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e,
> v=4294967295) at /usr/src/sys/amd64/include/atomic.h:194
> No locals.
> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1)
> at /usr/src/sys/sys/refcount.h:149
> old = <optimized out>
> #16 refcount_release (count=0xdeadc0dedeadc13e)
> at /usr/src/sys/sys/refcount.h:171
> No locals.
> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:72
> No locals.
> #18 kobject_put (kobj=0xdeadc0dedeadc12e)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
> No locals.
> #19 put_device (dev=0xdeadc0dedeadc0de)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
> No locals.
> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/pci.h:474
> No locals.
The above has changed if I am not wrong...
> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00)
> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:374
> pdev = 0xfffff8015a144a00
> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>)
> at /usr/src/sys/compat/linuxkpi/common/src/linux_kobject.c:186
> kobj = 0xfffff8015a144a50
> name = 0xfffff82ae1802610 "rtw890"
> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e,
> rel=<optimized out>)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:73
> No locals.
> #24 kobject_put (kobj=0xfffff8015a144a50)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113
> No locals.
> #25 put_device (dev=0xfffff8015a144a00)
> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376
> No locals.
And I misread this before.
This is the error case in linux_pci_attach_device():
You may notice my comment there:
734
735 /* XXX the cleanup does not match the allocation up there. */
736 out_probe:
737 free(pdev->bus, M_DEVBUF);
738 spin_lock_destroy(&pdev->pcie_cap_lock);
739 linux_pdev_dma_uninit(pdev);
740 out_dma_init:
741 spin_lock(&pci_lock);
742 list_del(&pdev->links);
743 spin_unlock(&pci_lock);
744 put_device(&pdev->dev); // <<<<<<<<< here
745 return (-error);
746 }
There's D57430 and D57431 still open that no one has reviewed so far.
You could try to apply them.
The earlieE change I'll just commit anyway as it is needed as well.
/bz
> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>,
> id=<optimized out>, pdev=0xfffff8015a144a00)
> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:744
> rid = 2304
> parent = <optimized out>
> isdrm = <optimized out>
> error = <optimized out>
> rle = <optimized out>
> pbus = <optimized out>
> ppbus = <optimized out>
--
Bjoern A. Zeeb r15:7
--0-1176814517-1784998277=:11296--