On Sat, Jul 25, 2026 at 10:54 AM Mark Millard <[email protected]> wrote: > > On 7/25/26 09:51, Bjoern A. Zeeb wrote: > > On Sat, 25 Jul 2026, Mark Millard wrote: > > > > Sorry, > > > > is the tail of your dmesg going along the lines of: > > > > devmatch trying to load rtw89 > > rtw89 trying to laod firmware > > that fails > > device attach fails > > panic? > > Unfortutely, the core.text.* files end with: > > QUOTE > ddb capture buffer > > ddb: ddb_capture: kvm_nlist > END QUOTE > > The screen display is mostly the backtrace. What does show are messages > about: > > . . . could not load firmware image, error 2 > Trying to load binary firmware from . . . > . . . could not load binary firmware . . . either > . . . could not load firmware image, error 2 > Trying to load binary firmware from . . . > . . . could not load binary firmware . . . either > . . . could not load fimrware image . . . > . . . failed to wait firmware completion > . . . failed to setup chip information > > Fatal trap 9 . . . > . . . > > For reference (from an earlier screen shot from a debug kernel test): > > rax shows: deadc0dedeadc0de > rsi shows: deadc0dedeadc13e > > (So such shows up both at #35 and at the fatal trap 9 point.) > > current thread resports: (devctl/devctl) > > I'll also note in the backtrace it shows 0xdeadc0dedeadc13e > as involved in the atomic_fetchadd_int falure: > > . . . > #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880, > #13 <signal handler called> > #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e, > . . . > > > > > > > More below. > > > > > >> On 7/25/26 04:31, Bjoern A. Zeeb wrote: > >>> On Fri, 24 Jul 2026, Mark Millard wrote: > >>> > >>> > >>> .... > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/ > >>>> linux/device.h:376 > >>>> No locals. > >>>> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/ > >>>> linux/pci.h:474 > >>>> No locals. > >>>> #21 lkpi_pci_dev_release (dev=0xfffff8014e842a00) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/ > >>>> linux_pci.c:374 > >>> > >>> That would be my recent change I assume. > >>> > >>> > >>> Can you test this? > >>> > >>> % git diff > >>> diff --git sys/compat/linuxkpi/common/src/linux_pci.c sys/compat/ > >>> linuxkpi/common/src/linux_pci.c > >>> index a49254425b5d..b1c28a188b94 100644 > >>> --- sys/compat/linuxkpi/common/src/linux_pci.c > >>> +++ sys/compat/linuxkpi/common/src/linux_pci.c > >>> @@ -370,7 +370,7 @@ lkpi_pci_dev_release(struct device *dev) > >>> */ > >>> > >>> /* Clear the hierarchy recursively to root. */ > >>> - if (pdev->bus->self != pdev) { > >>> + if (pdev->bus->self != pdev && pdev->bus->self != NULL) { > >>> pci_dev_put(pdev->bus->self); > >>> pdev->bus->self = NULL; > >>> } > >>> > >> > >> See later below. > >> > >>> > >>> > >>>> pdev = 0xfffff8014e842a00 > >>>> #22 0xffffffff80eed1c8 in linux_kobject_release (kref=<optimized out>) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/ > >>>> linux_kobject.c:186 > >>>> kobj = 0xfffff8014e842a50 > >>>> name = 0xfffff80107bcd670 "rtw890" > >>>> #23 0xffffffff80ef11ea in kref_put (kref=0xdeadc0dedeadc13e, > >>>> rel=<optimized out>) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/ > >>>> linux/kref.h:73 > >>>> No locals. > >>>> #24 kobject_put (kobj=0xfffff8014e842a50) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/ > >>>> linux/kobject.h:113 > >>>> No locals. > >>>> #25 put_device (dev=0xfffff8014e842a00) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/include/ > >>>> linux/device.h:376 > >>>> No locals. > >>>> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>, > >>>> id=<optimized out>, pdev=0xfffff8014e842a00) > >>>> at > >>>> /home/pkgbuild/worktrees/main/sys/compat/linuxkpi/common/src/ > >>>> linux_pci.c:744 > >>>> rid = 2304 > >>>> parent = <optimized out> > >>>> isdrm = <optimized out> > >>>> error = <optimized out> > >>>> rle = <optimized out> > >>>> pbus = <optimized out> > >>>> ppbus = <optimized out> > >>>> #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff8010799a800) > >>>> at ./device_if.h:195 > >>>> _m = <optimized out> > >>>> rc = <optimized out> > >>>> #28 device_attach (dev=0xfffff8010799a800) > >>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2630 > >>>> attachentropy = 32965 > >>>> saved_vnet = 0x0 > >>>> attachtime = 1943114510 > >>>> error = <optimized out> > >>>> #29 0xffffffff80c53255 in device_probe_and_attach > >>>> (dev=0xfffff8014e842a00, > >>>> dev@entry=0xfffff8010799a800) > >>>> at /home/pkgbuild/worktrees/main/sys/kern/subr_bus.c:2579 > >>> ... > >>> > >> > >> I built a new kernel pair (debug and non-debug) based on updating the > >> pkgbase /usr/src/ the system is based on. > >> > >> Booting the debug build still failed. The deadc0de based value that is > >> assocaited with the longest lasting stack frame from with such a value > >> is reported is still in the dsw for: > >> > >> #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40) > >> at /usr/src/sys/fs/devfs/devfs_vnops.c:964 > >> dev = 0xfffff801072a1800 > >> ref = 0 > >> vp = 0xfffff8014c11a6e0 > >> com = 2157462540 > >> td = 0xfffff80149a31780 > >> dsw = 0xdeadc0dedeadc0de > >> error = <optimized out> > >> fgn = <optimized out> > >> p = <optimized out> > >> i = <optimized out> > >> sess = <optimized out> > >> vpold = <optimized out> > >> > >> So I would expect #0 .. #34 to all be after that specific problem. > > > > I would assume that's an uninitialized value but I haven't looked at > > that ioctl code. > > Values based on 0xdeadc0dedeadc0de show up in rax and rsi in the > register dump, in the atomic_fetchadd_int failure, and in #35. > > > > > If there's a problem already then different story. > > Seems suggestive of the fatal trap 9 being dependent on the odd value in > #35, not that I've analyzed the code involved between those two points. > > > > > > >> The new gdb report follows . . . > >> > >> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/kernel... > >> Reading symbols from > >> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/kernel.debug... > >> . . . > >> Reading symbols from /boot/kernel.amd64-usr_src-DEBUG/smbus.ko... > >> Reading symbols from > >> /usr/lib/debug//boot/kernel.amd64-usr_src-DEBUG/smbus.ko.debug... > >> __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57 > >> 57 __asm("movq %%gs:%c1,%0" : "=r" (td) > >> (kgdb) #0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57 > >> td = <optimized out> > >> #1 doadump (textdump=textdump@entry=0) > >> at /usr/src/sys/kern/kern_shutdown.c:399 > >> error = 0 > >> coredump = <optimized out> > >> #2 0xffffffff804c77da in db_dump (dummy=<optimized out>, > >> dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized > >> out>) > >> at /usr/src/sys/ddb/db_command.c:596 > >> error = <optimized out> > >> #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>, > >> cmd_table=<optimized out>, dopager=true) > >> at /usr/src/sys/ddb/db_command.c:508 > >> modif = "\000Bځ\377\377\377\377\n", '\000' <repeats 15 times>, > >> "x\000\000\000\000\000\000\000\b\000\000\0000\000\000\000\340♥\002\376\377\377`♥\002\376\377\377\375(\321f\355\177)[ > >> 㙥\002\376\377\377D\236L\200\377\377\377\377\017", '\000' <repeats 15 > >> times>, > >> "\020\220\275\201\377\377\377\377\000\000\000\000\000\000\000\000\200\027\243I\001\370\377\377" > >> addr = -2134482909 > >> count = -1 > >> cmd = 0xffffffff81a16ff8 <db_cmds+616> > >> have_addr = <optimized out> > >> t = <optimized out> > >> result = <optimized out> > >> #4 0xffffffff804c72ad in db_command_loop () > >> at /usr/src/sys/ddb/db_command.c:555 > >> No locals. > >> #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized > >> out>) > >> at /usr/src/sys/ddb/db_main.c:267 > >> jb = {{_jb = {0, -2187654995128, -2187654994976, -8790562629760, > >> -2120123568, -2187654995104, -2187654994432, -2142458264, > >> -2187654995008, -2136782033, -2116402656, 3}}} > >> bkpt = false > >> watchpt = false > >> prev_jb = 0x0 > >> why = <optimized out> > >> #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0, > >> tf=tf@entry=0xfffffe02a599e600) at /usr/src/sys/kern/subr_kdb.c:790 > >> __pc = 0x0 > >> __pc = 0x0 > >> other_cpus = {__bits = {18446744071583149600, > >> 18446741886054557328, > >> 4294967282, 5, 2778326384, 0, 3545567873046937600, > >> 18446744071575110192, 18446744071582117664, > >> 18446744071582540027, > >> 0, 12, 18446741886054557056, 0, 18446741886054559552, > >> 11100633178600}} > >> be = 0xffffffff81a17b50 <ddb_dbbe> > >> intr = 70 > >> did_stop_cpus = <optimized out> > >> handled = <optimized out> > >> #7 0xffffffff811a0335 in trap (frame=<optimized out>) > >> at /usr/src/sys/amd64/amd64/trap.c:702 > >> __pc = 0x0 > >> __pc = 0x0 > >> __pc = 0x0 > >> ksi = {ksi_link = {tqe_next = 0x1, tqe_prev = 0xfffff82ae17f6f00}, > >> ksi_info = {si_signo = 5, si_errno = 0, si_code = -1, si_pid > >> = 0, > >> si_uid = 2778326608, si_status = -510, > >> si_addr = 0xffffffff80c708ab <_vprintf+139>, si_value = { > >> sival_int = 5, sival_ptr = 0xffffffff00000005, sigval_int > >> = 5, > >> sigval_ptr = 0xffffffff00000005}, _reason = {_fault = { > >> _trapno = 0}, _timer = {_timerid = 0, _overrun = 0}, > >> _mesgq = { > >> _mqd = 0}, _poll = {_band = 0}, _capsicum = {_syscall = > >> 0}, > >> __spare__ = {__spare1__ = 0, __spare2__ = {-1516640848, > >> -510, > >> 128, 0, -1516640848, -510, 128}}}}, ksi_flags = > >> 977421312, > >> ksi_sigq = 0x696e6170203a7265} > >> signo = 0 > >> ucode = 256 > >> td = <optimized out> > >> p = 0xfffffe0366641040 > >> dr6 = 0 > >> type = 3 > >> addr = <optimized out> > >> pf = <optimized out> > >> i = <optimized out> > >> #8 <signal handler called> > >> No locals. > >> #9 kdb_enter (why=<optimized out>, msg=<optimized out>) > >> at /usr/src/sys/kern/subr_kdb.c:556 > >> No locals. > >> #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>, > >> ap=ap@entry=0xfffffe02a599e830) at /usr/src/sys/kern/ > >> kern_shutdown.c:962 > >> buf = "general protection fault", '\000' <repeats 231 times> > >> __pc = 0x0 > >> __pc = 0x0 > >> __pc = 0x0 > >> other_cpus = {__bits = {4294934527, 0 <repeats 15 times>}} > >> td = 0xfffff80149a31780 > >> bootopt = <optimized out> > >> newpanic = <optimized out> > >> #11 0xffffffff80c10c43 in panic ( > >> fmt=0xffffffff81da4260 <cnputs_mtx> "\241@)\201\377\377\377\377") > >> at /usr/src/sys/kern/kern_shutdown.c:887 > >> ap = {{gp_offset = 16, fp_offset = 48, > >> overflow_arg_area = 0xfffffe02a599e860, > >> reg_save_area = 0xfffffe02a599e800}} > >> #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880, > >> eva=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:1031 > >> type = <optimized out> > >> #13 <signal handler called> > >> No locals. > >> #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e, > >> v=4294967295) at /usr/src/sys/amd64/include/atomic.h:194 > >> No locals. > >> #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1) > >> at /usr/src/sys/sys/refcount.h:149 > >> old = <optimized out> > >> #16 refcount_release (count=0xdeadc0dedeadc13e) > >> at /usr/src/sys/sys/refcount.h:171 > >> No locals. > >> #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:72 > >> No locals. > >> #18 kobject_put (kobj=0xdeadc0dedeadc12e) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113 > >> No locals. > >> #19 put_device (dev=0xdeadc0dedeadc0de) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376 > >> No locals. > >> #20 pci_dev_put (pdev=0xdeadc0dedeadc0de) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/pci.h:474 > >> No locals. > > > > The above has changed if I am not wrong... > > > >> #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00) > >> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:374 > >> pdev = 0xfffff8015a144a00 > >> #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>) > >> at /usr/src/sys/compat/linuxkpi/common/src/linux_kobject.c:186 > >> kobj = 0xfffff8015a144a50 > >> name = 0xfffff82ae1802610 "rtw890" > >> #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e, > >> rel=<optimized out>) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kref.h:73 > >> No locals. > >> #24 kobject_put (kobj=0xfffff8015a144a50) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/kobject.h:113 > >> No locals. > >> #25 put_device (dev=0xfffff8015a144a00) > >> at /usr/src/sys/compat/linuxkpi/common/include/linux/device.h:376 > >> No locals. > > > > And I misread this before. > > > > This is the error case in linux_pci_attach_device(): > > > > You may notice my comment there: > > > > 734 > > 735 /* XXX the cleanup does not match the allocation up there. */ > > 736 out_probe: > > 737 free(pdev->bus, M_DEVBUF); > > 738 spin_lock_destroy(&pdev->pcie_cap_lock); > > 739 linux_pdev_dma_uninit(pdev); > > 740 out_dma_init: > > 741 spin_lock(&pci_lock); > > 742 list_del(&pdev->links); > > 743 spin_unlock(&pci_lock); > > 744 put_device(&pdev->dev); // <<<<<<<<< here > > 745 return (-error); > > 746 } > > > > > > There's D57430 and D57431 still open that no one has reviewed so far. > > You could try to apply them. > > I expect I'll take a look at doing such later. > > > > > The earlieE change I'll just commit anyway as it is needed as well. > > Sounds good. > > > > > /bz > > > > > >> #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>, > >> id=<optimized out>, pdev=0xfffff8015a144a00) > >> at /usr/src/sys/compat/linuxkpi/common/src/linux_pci.c:744 > >> rid = 2304 > >> parent = <optimized out> > >> isdrm = <optimized out> > >> error = <optimized out> > >> rle = <optimized out> > >> pbus = <optimized out> > >> ppbus = <optimized out> > > > > Just to make it easier to see where deadc0de occurs in the backtrace: > > #1 doadump (textdump=textdump@entry=0) > #2 0xffffffff804c77da in db_dump (dummy=<optimized out>, > #3 0xffffffff804c768a in db_command (last_cmdp=<optimized out>, > #4 0xffffffff804c72ad in db_command_loop () > #5 0xffffffff804caee0 in db_trap (type=<optimized out>, code=<optimized > out>) > #6 0xffffffff80c66b1f in kdb_trap (type=type@entry=3, code=code@entry=0, > #7 0xffffffff811a0335 in trap (frame=<optimized out>) > #8 <signal handler called> > #9 kdb_enter (why=<optimized out>, msg=<optimized out>) > #10 0xffffffff80c10dc9 in vpanic (fmt=<optimized out>, > #11 0xffffffff80c10c43 in panic ( > #12 0xffffffff811a065f in trap_fatal (frame=0xfffffe02a599e880, > #13 <signal handler called> > #14 0xffffffff80ef1845 in atomic_fetchadd_int (p=0xdeadc0dedeadc13e, > #15 refcount_releasen (count=0xdeadc0dedeadc13e, n=1) > #16 refcount_release (count=0xdeadc0dedeadc13e) > #17 kref_put (kref=0xdeadc0dedeadc13e, rel=<optimized out>) > #18 kobject_put (kobj=0xdeadc0dedeadc12e) > #19 put_device (dev=0xdeadc0dedeadc0de) > #20 pci_dev_put (pdev=0xdeadc0dedeadc0de) > #21 lkpi_pci_dev_release (dev=0xfffff8015a144a00) > #22 0xffffffff80eed308 in linux_kobject_release (kref=<optimized out>) > #23 0xffffffff80ef132a in kref_put (kref=0xdeadc0dedeadc13e, > #24 kobject_put (kobj=0xfffff8015a144a50) > #25 put_device (dev=0xfffff8015a144a00) > #26 linux_pci_attach_device (dev=<optimized out>, pdrv=<optimized out>, > #27 0xffffffff80c536c6 in DEVICE_ATTACH (dev=0xfffff801079af800) > #28 device_attach (dev=0xfffff801079af800) at > /usr/src/sys/kern/subr_bus.c:2630 > #29 0xffffffff80c53255 in device_probe_and_attach (dev=0xfffff8015a144a00, > #30 0xffffffff80892e32 in pci_driver_added (dev=0xfffff801079af900, > #31 0xffffffff80c50b19 in BUS_DRIVER_ADDED (_dev=0xfffff801079af900, > #32 devclass_driver_added (dc=dc@entry=0xfffff8010198e500, > #33 0xffffffff80c59cab in device_do_deferred_actions () > #34 0xffffffff80c595f6 in devctl2_ioctl (cdev=<optimized out>, > cmd=2157462540, > #35 0xffffffff80a7ac9c in devfs_ioctl (ap=0xfffffe02a599ec40) > dsw = 0xdeadc0dedeadc0de > #36 0xffffffff81278951 in VOP_IOCTL_APV ( > #37 0xffffffff80d3ea0f in VOP_IOCTL (vp=<optimized out>, > #38 0xffffffff80d3ea0f in vn_ioctl (fp=<optimized out>, com=<optimized > out>, > #39 0xffffffff80a7b3be in devfs_ioctl_f (fp=0xfffff8015a144a00, > #40 0xffffffff80c95dbd in fo_ioctl (fp=0xfffff8014d5e3a50, com=2157462540, > #41 kern_ioctl (td=td@entry=0xfffff80149a31780, fd=<optimized out>, > #42 0xffffffff80c95a9f in sys_ioctl (td=0xfffff80149a31780, > #43 0xffffffff811a13ec in syscallenter (td=0xfffff80149a31780) > #44 amd64_syscall (td=0xfffff80149a31780, traced=0) > #45 <signal handler called> > #46 0x00000a1894a4148a in ?? () > > > -- > === > Mark Millard > marklmi at yahoo.com >
Drive-by comment, I don't know this code. It seems to suggest pdev->bus in lkpi_pci_dev_release points to a freed object. Back in linux_pci_attach_device (frame #26), in the probe failure path that does goto out_probe, we free(pdev->bus, M_DEVBUF), and then call put_device(&pdev->dev) (frame #25), and then in lkpi_pci_dev_release (frame #21) we try to use the freed pdev->bus. You could try assigning pdev->bus to a distinct junk value after the free in linux_pci_attach_device to confirm this. Ryan
