kern/60911: fdt i2c: children with status "disabled" still attach

["trythepostoffice%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60911
>Category:       kern
>Synopsis:       fdt i2c: children with status "disabled" still attach
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Oct 20 21:50:00 +0000 2026
>Originator:     Elias Howell
>Release:        NetBSD 11.0, NetBSD-current 11.99.9 (20261019)
>Organization:
>Environment:
NetBSD armv7 11.0 NetBSD 11.0 (GENERIC) #0: Thu Jul 30 15:23:12 UTC 2026 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm
NetBSD armv7 11.99.9 NetBSD 11.99.9 (GENERIC) #0: Mon Oct 19 09:38:27 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm
>Description:
fdtbus_i2c_enumerate_devices() in sys/dev/fdt/fdt_i2c.c hands every
child of the i2c node to i2c_enumerate_device() without checking
status. A child with status = "disabled" still attaches if a driver
matches its compatible.

I was booting a Netgate SG-1000 on -current with am335x-boneblack.dtb
(only the Ethernet bits changed) and tps@24 set to disabled since the
board has no PMIC at 0x24. tps65217pmic0 attached anyway, logged
"cannot execute operation" over and over, and then panicked. That's a
separate driver bug PR to follow.

11.0 has the same gap in different code, of_enter_i2c_devs() in
sys/dev/ofw/ofw_i2c_subr.c adds every child without checking status.
On 11.0 my own dtb has tps@24 disabled with a made-up compatible, and
it still gets offered to drivers:

  tps (sg1000,no-pmic) at iic0 addr 0x24 not configured

Nothing matches so nothing attaches, but a disabled node shouldn't
get that far. The patch below is -current only.

fdt_add_bus() already skips children that aren't okay and the ACPI
side checks acpi_device_present() in acpi_i2c.c. Linux only registers
available i2c children too.

fdt_spi.c has the same loop and the same missing check. I haven't
touched it. Nothing here to test it on.
>How-To-Repeat:
Set status = "disabled" on an i2c child that a driver matches and
boot. am335x-boneblack.dtb with tps@24 disabled on 11.99.9

  tps65217pmic0 at iic0 addr 0x24tps65217pmic0: cannot execute operation
  ...
  panic: lock error: Mutex: mutex_vector_exit,749: ...
>Fix:
Skip children that aren't okay. Tested on the SG-1000, -current
b91976112 plus this and my am3_prcm patch, same dtb. tps@24 doesn't
attach anymore and there are no tps messages. seeprom0 at 0x50 and
tdahdmi0 at 0x70 still attach like before. (There is no TDA19988 on
this board, tdahdmi0 only attaches because the BBB dtb has it okay)

--- a/sys/dev/fdt/fdt_i2c.c
+++ b/sys/dev/fdt/fdt_i2c.c
@@ -160,6 +160,9 @@ fdtbus_i2c_enumerate_devices(device_t dev, devhandle_t call_handle, void *v)
                if (OF_getprop(node, "name", name, sizeof(name)) <= 0) {
                        continue;
                }
+               if (!fdtbus_status_okay(node)) {
+                       continue;
+               }
                if (fdtbus_get_reg(node, 0, &addr, NULL) != 0) {
                        continue;
                }