Re: kern/57063: Kernel panic in -current in iic_attach

[Brad Spencer <brad%anduin.eldar.org@localhost>]

Taylor R Campbell <riastradh%NetBSD.org@localhost> writes:

> The following reply was made to PR kern/57063; it has been noted by GNATS.
>
> From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
> To: brad%anduin.eldar.org@localhost
> Cc: gnats-bugs%NetBSD.org@localhost, bouyer%NetBSD.org@localhost
> Subject: Re: kern/57063: Kernel panic in -current in iic_attach
> Date: Tue, 18 Oct 2022 10:16:28 +0000
>
>  > kernel: page fault trap, code=3D0
>  > Stopped in pid 0.0 (system) at  netbsd:iic_attach+0x64: movq    %rax,70(%=
>  r12)
>  > iic_attach() at netbsd:iic_attach
>  
>  This is almost certainly because something in dwiic_attach failed, but
>  pci_dwiic_attach blithely ignored the failure and barged ahead trying
>  to attach a child with unininitialized i2cbus_attach_args having a
>  null i2c tag:
>  
>  https://nxr.netbsd.org/xref/src/sys/arch/x86/pci/dwiic_pci.c?r=3D1.8#280
>  
>      280 	dwiic_attach(&sc->sc_dwiic);
>      281=20
>      282 	config_found(self, &sc->sc_dwiic.sc_iba, iicbus_print, CFARGS_NONE=
>  );
>  


I looked into this some more.  If you leave out dwiic from the kernel,
the panic goes away, so that confirms that it is dwiic.

I messed with the code for a while until I really needed the DOM0
functional and this is what I noted:

o The driver wants a device that returns 0x44570140 in the
DW_IC_COMP_TYPE register

o My device returns 0xf000eef3 in that register, so the driver fails in
dwiic_init

o Upon failing in dwiic_init a 1 is returned back to dwiic_attach and
back to pci_dwiic_attach.  However, none of the sub-drivers for PCI,
ACPI or FDT catch this fail and do the config anyway as Taylor noted.

o If you do the obvious:


--- dwiic_pci.c.DIST    2021-10-28 06:59:10.187238063 -0400
+++ dwiic_pci.c 2022-10-18 08:31:42.976592974 -0400
@@ -277,11 +277,10 @@
                aprint_verbose_dev(self, "no matching ACPI node\n");
        }
 
-       dwiic_attach(&sc->sc_dwiic);
-
-       config_found(self, &sc->sc_dwiic.sc_iba, iicbus_print, CFARGS_NONE);
-
-       pmf_device_register(self, dwiic_suspend, dwiic_resume);
+       if (dwiic_attach(&sc->sc_dwiic)) {
+               config_found(self, &sc->sc_dwiic.sc_iba, iicbus_print, CFARGS_NONE);
+               pmf_device_register(self, dwiic_suspend, dwiic_resume);
+       }
 
 out:
        return;

you will avoid the panic I send-pr'ed about, but will panic later
because the interrupts are apparently set up and a crash occurs in
dwiic_intr (assuming I read the screen correctly) at a later time.

o If you comment out the type check in dwiic_init and and try to use the
device I have anyway you do not appear to get a panic anywhere, but the
driver reports fails in other ways indicating that the device I have
really won't work with the driver:

[     1.000003] dwiic0 at pci0 dev 21 function 0: I2C controller instance 0
[     1.000003] dwiic0: interrupting at ioapic0 pin 16
[     1.000003] dwiic0: failed to disable
[     1.000003] dwiic0: failed to disable
[     1.000003] iic0 at dwiic0: I2C bus
[     1.000003] dwiic1 at pci0 dev 21 function 1autoconfiguration error: : can't map register space




-- 
Brad Spencer - brad%anduin.eldar.org@localhost - KC8VKS - http://anduin.eldar.org