DF-5490 — pcf: iicbus child never attaches (missing DRIVER_MODULE(iicbus, pcf)) → NULL-softc panic in pcfintr

What

pcf_attach() (sys/bus/iicbus/pcf/pcf.c:200) adds an "iicbus" child to the pcf bus, but no DRIVER_MODULE(iicbus, pcf, ...) exists anywhere — the iicbus driver is registered only on the iicbb bus (sys/bus/iicbus/iicbus.c:194). DragonFly newbus probes a child only against drivers registered in the parent bus's devclass (sys/kern/subr_bus.c:1414-1484 device_probe_child), so the child never attaches: it stays state=0 (DS_NOTPRESENT) with softc == NULL forever. pcfintr() — the live IRQ handler registered by pcf_attach() (pcf.c:193-195) — calls iicbus_intr(pcf->iicbus, ...) on 8 paths (pcf.c:412, 430, 435, 445, 447, 453, 468, 475); iicbus_intr() dereferences device_get_softc(bus)->owner (iiconf.c:47-50) → NULL softc → page fault → kernel panic. ENI (chip interrupt enable) is permanently set by pcf_rst_card() (pcf.c:537), pcf_stop() (pcf.c:300) and pcfintr's own error path (pcf.c:490), so on real PCF8584 hardware in the default (non-polled) configuration the FIRST interrupt after attach panics the machine deterministically. The driver is also functionally dead: with no iicbus attachment there is no /dev/iicN and no in-tree caller can reach pcf_write/pcf_read/pcf_start.

Build (guest)

scp df5490_rig.c dfbsd:/root/
mkdir -p /usr/src/sys/bus/iicbus/df5490 && cp /root/df5490_rig.c $_/
printf 'KMOD=   df5490_rig\nSRCS=   df5490_rig.c\nSRCS+=  bus_if.h device_if.h iicbus_if.h isa_if.h\n.include <bsd.kmod.mk>\n' > /usr/src/sys/bus/iicbus/df5490/Makefile
cd /usr/src/sys/bus/iicbus/df5490 && make

Run (baseline — expect panic)

kldload iicbus && kldload pcf
kldload /usr/src/sys/bus/iicbus/df5490/df5490_rig.ko

The rig attaches pcf0 through the exact newbus API isahint uses (BUS_ADD_CHILD + bus_set_resource + device_probe_and_attach — cf. sys/bus/isa/isahint.c:53-91), because the kernel's hinted-children enumeration only reads the compiled-in devtab (subr_bus.c:2401 resource_query_string), so kenv/loader hints cannot add an isa child at runtime. After attach it dumps the child state and then invokes the exact pcfintr sink call (iicbus_intr(pcf->iicbus, INTR_RECEIVE, &data), pcf.c:475).

Expected (observed) — see panic.txt / run.log.baseline_panic_full

df5490: added pcf child pcf0, probing+attaching
pcf0: <PCF8584 I2C bus controller> at port 0x320-0x321 irq 5 on isa1
interrupt uses mplock: pcf0
df5490: device_probe_and_attach -> 0
df5490: pcf0=pcf0 state=3 children=1
df5490: child[0]=iicbus0 state=0 softc=0 devclass=iicbus     <-- never attached, NULL softc
df5490: calling iicbus_intr(child0, INTR_RECEIVE, &c) == pcfintr pcf.c:475
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0x8
Stopped at      iicbus_intr+0x18:       movq    0x8(%rax),%rbx   <-- sc->owner @ offset 8 of NULL softc

Run (fix validation — expect NO panic)

cd /usr/src && patch -p1 < fix.diff          # adds DRIVER_MODULE(iicbus, pcf, ...) + pcfintr guard
cd sys/bus/iicbus/pcf && make && cp pcf.ko /root/pcf_fixed.ko
kldload iicbus && kldload iic && kldload /root/pcf_fixed.ko
kldload /usr/src/sys/bus/iicbus/df5490/df5490_rig.ko

Expected (observed) — see run.fixed_serial.log

iicbus0: <Philips I2C bus> on pcf0 addr 0xaa
df5490: child[0]=iicbus0 state=3 softc=0xfffff8004f0e7478 devclass=iicbus
df5490: iicbus_intr RETURNED (no fault)

Guest stays up; the previously-panicking sink call is a clean no-op (owner == NULL).

Notes

• The only hardware-substituted step is IRQ delivery: on real PCF8584 silicon the chip's interrupt (enabled since probe via ENI, pcf.c:171→537) calls the registered pcfintr handler, which makes the identical iicbus_intr(pcf->iicbus, ...) call that the rig makes. The device state (pcf0 attached, irq registered, child unattached with NULL softc) is the genuine production state, created through production newbus APIs.
• Cross-observations for future audits (other files): (1) even with the fix, iicbus0's own wildcard children (ic/iic/iicsmb) did not attach/materialize /dev/iic0 — iicbus.c/iic.c child-handling question; (2) kldunload iicbus succeeded while iicbus0 was attached (module unload not pinned to attached bus children).

DF-5490 — VERDICT

Status: REPRODUCED (impact: panic / kernel NULL-pointer DoS, hardware-gated delivery). Fix validated live: baseline panics 1/1, patched module 1/1 clean.

Root cause (path:line)

1. pcf_attach() adds an iicbus child: pcf->iicbus = device_add_child(pcfdev, "iicbus", -1) — sys/bus/iicbus/pcf/pcf.c:200.
2. newbus can only probe that child against drivers registered on the pcf bus — device_probe_child() iterates dev->devclass->drivers of the parent bus (sys/kern/subr_bus.c:1414-1484). The iicbus driver is registered ONLY on the iicbb bus: DRIVER_MODULE(iicbus, iicbb, ...) — sys/bus/iicbus/iicbus.c:194. No DRIVER_MODULE(iicbus, pcf, ...) exists anywhere in the tree (verified: grep -rn 'DRIVER_MODULE(iicbus' sys/ returns exactly one hit). Sibling bridges prove the requirement: DRIVER_MODULE(smbus, ichsmb, ...) at sys/bus/smbus/ichsmb/ichsmb.c:696 and the five-line bridge enumeration at sys/bus/iicbus/iicbb.c:441-445.
3. Therefore the child never attaches: state=0 (DS_NOTPRESENT), device_get_softc(pcf->iicbus) == NULL — proven live: rig printed child[0]=iicbus0 state=0 softc=0 devclass=iicbus (panic.txt).
4. pcfintr() is a live registered interrupt handler (pcf.c:193-195; serial log: interrupt uses mplock: pcf0). All 8 of its event paths call iicbus_intr(pcf->iicbus, ...) (pcf.c:412, 430, 435, 445, 447, 453, 468, 475). iicbus_intr() does sc = device_get_softc(bus); if (sc->owner) — sys/bus/iicbus/iiconf.c:47-50 → read at offset 8 of NULL → Fatal trap 12, fault virtual address = 0x8, Stopped at iicbus_intr+0x18: movq 0x8(%rax),%rbx (panic.txt).
5. On hardware: ENI (interrupt enable) is permanently set — pcf_rst_card() pcf.c:537 (runs from probe, pcf.c:171), pcf_stop() pcf.c:300, pcfintr error path pcf.c:490. The PCF8584 asserts INT when PIN clears (any completed byte transfer, master or slave). Default configuration is interrupt mode (IIC_POLLED unset in the hint flags). First interrupt after attach ⇒ panic. Not a narrow race: every interrupt-bearing pcf deployment hits it.
6. Secondary effect: with the child dead there is no /dev/iicN, and pcf_start/pcf_write/pcf_read have no in-tree caller (iic.c ioctls need the iic child; iicsmb needs the iicsmb child; pcfclock is ppbus-based). The driver is functionally dead in-tree — and the dead code still panics via pcfintr.

Reproduction (this run)

QEMU has no PCF8584 model. The rig reproduces the exact production state and the exact sink through production APIs:

• pcf0 attached on isa1 @ io 0x320-0x321, irq 5, interrupt mode, via the same BUS_ADD_CHILD/bus_set_resource/device_probe_and_attach sequence isahint.c:53-91 performs (kenv/loader hints cannot add isa children because resource_query_string() enumerates only the compiled-in devtab — subr_bus.c:2401-2410; both /boot/device.hints (not parsed by the DF loader) and loader.conf hint.pcf.0.* kenv variables were tried and were ignored by the enumeration).
• child state dumped: iicbus0 state=0 softc=0 — the bug, observed.
• the exact call pcfintr makes — iicbus_intr(child, INTR_RECEIVE, &c) (pcf.c:475) — fired: page fault at 0x8, kernel panic, DDB (panic.txt, run.log.baseline_panic_full). 1/1 runs.

The only substituted step is who invokes the call (rig instead of the IRQ line); the pointer value, device state, and fault are identical to what the registered pcfintr handler produces on silicon.

Fix validation

fix.diff (against read-only sys/; applied only to the guest's /usr/src copy): 1. #include "../iicbus.h" + DRIVER_MODULE(iicbus, pcf, iicbus_driver, iicbus_devclass, NULL, NULL); — registers the iicbus driver on the pcf bus (mirrors ichsmb.c:696). 2. Defensive guard at pcfintr entry: return if pcf->iicbus == NULL || device_get_softc(pcf->iicbus) == NULL (covers the setup_intr→add_child window in pcf_attach:193-200 and any future registration gap).

Patched pcf.ko rebuilt in-guest (-Werror clean), loaded, rig re-run: - iicbus0: <Philips I2C bus> on pcf0 addr 0xaa — child ATTACHES (the previously-dead pcf_print_child() pcf.c:208-219 even prints now). - child[0]=iicbus0 state=3 softc=0xfffff8004f0e7478 — softc allocated. - iicbus_intr RETURNED (no fault) — the previously-panicking sink is a clean no-op (owner == NULL). Guest alive, no panic (run.fixed_serial.log). 1/1 baseline panic vs 1/1 patched clean.

Severity reasoning

No unprivileged-user reachability: the driver attaches only on PCF8584 hardware at a hinted ISA port; the panic trigger is the chip's own interrupt (or any bus event). Impact ceiling = deterministic kernel panic of the machine (DoS) + driver non-function. Per rubric ("narrow trigger, requires specific hardware") → Low, confidence certain (code path proven, state and sink reproduced live).

Attempts

1. /boot/device.hints (not parsed by DF loader) — no attach.
2. loader.conf hint.pcf.0.* kenv vars — hints present in kenv but devtab-only enumeration (subr_bus.c:2401) ignores them — no attach.
3. Rig v1 with bus_set_resource(..., cpuid=-1) for IRQ — hit unrelated nexus invalid cpuid: -1 KASSERT (nexus_alloc_resource); rig bug, fixed by passing machintr_legacy_intr_cpuid(irq) exactly as isahint.c:70-72 does.
4. Rig v2 — full success: baseline panic captured; fixed module validated.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.