Bug 258994 - iic(4): Panics on Nanopi Neo when using 16-bit device addressing width: panic: Assertion strlen(description) < MAX_W_NAME failed at ... sys/kern/subr_witness.c:1914
Summary: iic(4): Panics on Nanopi Neo when using 16-bit device addressing width: panic...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.2-RELEASE
Hardware: arm Any
: --- Affects Some People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash, needs-qa
Depends on:
Blocks:
 
Reported: 2021-10-07 23:11 UTC by alydiomc
Modified: 2021-10-13 10:31 UTC (History)
2 users (show)

See Also:
koobs: maintainer-feedback? (wulf)
koobs: mfc-stable13?
koobs: mfc-stable12?


Attachments
twsi.c driver (21.18 KB, text/plain)
2021-10-12 11:55 UTC, alydiomc
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description alydiomc 2021-10-07 23:11:02 UTC
On Nanopi NEO (Allwinner H3), accessing I2C EEPROM with 16-bit addressing width panics the OS. This seems working on RPI.

Same issue experienced on:
    FreeBSD 12.2 Release
    FreeBSD 13.0 Release
    FreeBSD 13.0 Stable

root@nanopi-neo:~ # uname -a
FreeBSD nanopi-neo 14.0-CURRENT FreeBSD 14.0-CURRENT #1 main-n249946-824bbb9a408-dirty: Fri Oct  8 05:34:21 PST 2021     root@media.klyren.net:/zdata0/work/obj/zdata0/src-14-CURRENT/arm.armv7/sys/GENERIC  arm

root@nanopi-neo:~ # dmesg |grep ii
iichb0: <Allwinner Integrated I2C Bus Controller> mem 0x1c2ac00-0x1c2afff irq 40 on simplebus0
iicbus0: <OFW I2C bus> on iichb0
miibus0: <MII bus> on awg0
ukphy0: <Generic IEEE 802.3u media interface> PHY 0 on miibus0
ukphy1: <Generic IEEE 802.3u media interface> PHY 1 on miibus0
iic0: <I2C generic I/O> on iicbus0

root@nanopi-neo:~ # i2c -s -f /dev/iic0
57 68

root@nanopi-neo:~ # i2c -a 0x57 -f /dev/iic0 -d r -o 1 -w 16 -c 1 -m tr
panic: Assertion strlen(description) < MAX_W_NAME failed at /zdata0/src-14-CURRENT/sys/kern/subr_witness.c:1914
ðñòóôõö÷øùúûüýþÿtime = 1633646823
KDB: stack backtrace:
db_trace_self() at db_trace_self
         pc = 0xc05b2e24  lr = 0xc007b07c (db_trace_self_wrapper+0x30)
         sp = 0xd89e8928  fp = 0xd89e8a40
db_trace_self_wrapper() at db_trace_self_wrapper+0x30
         pc = 0xc007b07c  lr = 0xc02dddbc (vpanic+0x17c)
         sp = 0xd89e8a48  fp = 0xd89e8a68
         r4 = 0x00000100  r5 = 0x00000000
         r6 = 0xc0708d0c  r7 = 0xc08e8aa8
vpanic() at vpanic+0x17c
         pc = 0xc02dddbc  lr = 0xc02ddb60 (doadump)
         sp = 0xd89e8a70  fp = 0xd89e8a74
         r4 = 0xc10a0878  r5 = 0xc10a0830
         r6 = 0xc08be7bc  r7 = 0xc079bd0e
         r8 = 0x0000019e  r9 = 0x0000019d
        r10 = 0xc0ad95f0
doadump() at doadump
         pc = 0xc02ddb60  lr = 0xc034f3b4 (enroll+0x540)
         sp = 0xd89e8a7c  fp = 0xd89e8aa8
         r4 = 0xc0ad95f0  r5 = 0xd89e8a74
         r6 = 0xc02ddb60 r10 = 0xd89e8a7c
enroll() at enroll+0x540
         pc = 0xc034f3b4  lr = 0xc034f878 (witness_init+0xb0)
         sp = 0xd89e8ab0  fp = 0xd89e8ab8
         r4 = 0xd2caffa0  r5 = 0x00000000
         r6 = 0xd8f2b754  r7 = 0xc00b1074
         r8 = 0xd8cc17c0  r9 = 0xc0889ed0
        r10 = 0xd2e0e040
witness_init() at witness_init+0xb0
         pc = 0xc034f878  lr = 0xc02e7b04 (sx_init_flags+0x88)
         sp = 0xd89e8ac0  fp = 0xd89e8ad0
         r4 = 0xd2caffa0 r10 = 0xd2e0e040
sx_init_flags() at sx_init_flags+0x88
         pc = 0xc02e7b04  lr = 0xc00b10b8 (iicopen+0x44)
         sp = 0xd89e8ad8  fp = 0xd89e8ae0
         r4 = 0xd2caffa0  r5 = 0xd2a4ce00
iicopen() at iicopen+0x44
         pc = 0xc00b10b8  lr = 0xc01d8784 (devfs_open+0x12c)
         sp = 0xd89e8ae8  fp = 0xd89e8b20
         r4 = 0xd2a4ce00  r5 = 0x00000000
devfs_open() at devfs_open+0x12c
         pc = 0xc01d8784  lr = 0xc06a5324 (VOP_OPEN_APV+0x50)
         sp = 0xd89e8b28  fp = 0xd89e8b40
         r4 = 0xd89e8b50  r5 = 0xc08a9fd4
         r6 = 0xc09138c5  r7 = 0x00000003
         r8 = 0xd8f71e00  r9 = 0xd89e8b50
        r10 = 0xd8cc17c0
VOP_OPEN_APV() at VOP_OPEN_APV+0x50
         pc = 0xc06a5324  lr = 0xc03e0dec (vn_open_vnode+0x184)
         sp = 0xd89e8b48  fp = 0xd89e8ba8
         r4 = 0xd8f2b754  r5 = 0x00000000
         r6 = 0xd2e0e040 r10 = 0xd8cc17c0
vn_open_vnode() at vn_open_vnode+0x184
         pc = 0xc03e0dec  lr = 0xc03e0828 (vn_open_cred+0x578)
         sp = 0xd89e8bb0  fp = 0xd89e8cc0
         r4 = 0x00000001  r5 = 0xd89e8cf8
         r6 = 0x00000003  r7 = 0xd89e8d58
         r8 = 0xd89e8dc0  r9 = 0x00000000
        r10 = 0x00000000
vn_open_cred() at vn_open_cred+0x578
         pc = 0xc03e0828  lr = 0xc03e02a8 (vn_open+0x24)
         sp = 0xd89e8cc8  fp = 0xd89e8cd0
         r4 = 0xd8cc17c0  r5 = 0xd89e8cf8
         r6 = 0x00000000  r7 = 0xd89e8cf8
         r8 = 0xffffff9c  r9 = 0x00000012
        r10 = 0xbfbfee4b
vn_open() at vn_open+0x24
         pc = 0xc03e02a8  lr = 0xc03d6f30 (kern_openat+0x258)
         sp = 0xd89e8cd8  fp = 0xd89e8db8
kern_openat() at kern_openat+0x258
         pc = 0xc03d6f30  lr = 0xc03d71b8 (sys_openat+0x2c)
         sp = 0xd89e8dc0  fp = 0xd89e8dc8
         r4 = 0xd8cc17c0  r5 = 0x00000001
         r6 = 0xc08b42bc  r7 = 0x00000000
         r8 = 0x00000000  r9 = 0xd8cc1a68
        r10 = 0xd8cc0530
sys_openat() at sys_openat+0x2c
         pc = 0xc03d71b8  lr = 0xc05d5128 (swi_handler+0x15c)
         sp = 0xd89e8dd0  fp = 0xd89e8e40
swi_handler() at swi_handler+0x15c
         pc = 0xc05d5128  lr = 0xc05b574c (swi_exit)
         sp = 0xd89e8e48  fp = 0xbfbfe780
         r4 = 0x201f8a44  r5 = 0x00044190
         r6 = 0xbfbfec98  r7 = 0x000001f3
         r8 = 0x00000001  r9 = 0x00010b92
        r10 = 0x00000000
swi_exit() at swi_exit
         pc = 0xc05b574c  lr = 0xc05b574c (swi_exit)
         sp = 0xd89e8e48  fp = 0xbfbfe780
KDB: enter: panic
[ thread pid 985 tid 100114 ]
Stopped at      kdb_enter+0x58: ldrb    r15, [r15, r15, ror r15]!
db> ps
  pid  ppid  pgrp   uid  state   wmesg   wchan       cmd
  985   972   985     0  R+      CPU 1               i2c
  972   971   972     0  S+      pause   0xd8cc0928  csh
  971     1   971     0  Ss+     wait    0xd2dacc40  login
  952     1   952     0  Ss      select  0xd2c954a4  sshd
  925     1   925     0  Ss      nanslp  0xc0ac3d8e  cron
  914     1   914   123  Ss      (threaded)          ntpd
100117                   S       select  0xd2ccb224  ntpd
100122                   S       usem    0xd2dc5e80  ntpd
  870     1   870     0  Ss      select  0xd2cb2664  syslogd
  682     1   682     0  Ss      select  0xd2cb2524  devd
  284     1   284     0  Ss      select  0xd2cb2624  wpa_supplicant
   23     0     0     0  DL      mmcsd d 0xd2ccce00  [mmcsd0: mmc/sd card]
   22     0     0     0  DL      -       0xc0b31af0  [soaiod4]
   21     0     0     0  DL      -       0xc0b31af0  [soaiod3]
   20     0     0     0  DL      -       0xc0b31af0  [soaiod2]
   19     0     0     0  DL      -       0xc0b31af0  [soaiod1]
   18     0     0     0  DL      syncer  0xc0b32960  [syncer]
   17     0     0     0  DL      vlruwt  0xd173d388  [vnlru]
   16     0     0     0  DL      (threaded)          [bufdaemon]
100084                   D       qsleep  0xc0b31fdc  [bufdaemon]
100087                   D       -       0xc0915700  [bufspacedaemon-0]
100104                   D       sdflush 0xd2d98c84  [/ worker]
   15     0     0     0  DL      psleep  0xc0b36930  [vmdaemon]
    9     0     0     0  DL      (threaded)          [pagedaemon]
100082                   D       psleep  0xc0b36290  [dom0]
100092                   D       launds  0xc0b3629c  [laundry: dom0]
100093                   D       umarcl  0xc056eeb4  [uma]
    8     0     0     0  DL      -       0xc0939e18  [rand_harvestq]
   14     0     0     0  DL      (threaded)          [usb]
100046                   D       -       0xd280400c  [usbus0]
100047                   D       -       0xd280403c  [usbus0]
100048                   D       -       0xd280406c  [usbus0]
100049                   D       -       0xd280409c  [usbus0]
100050                   D       -       0xd28040cc  [usbus0]
100052                   D       -       0xd17a6c84  [usbus1]
100053                   D       -       0xd17a6cb4  [usbus1]
100054                   D       -       0xd17a6ce4  [usbus1]
100055                   D       -       0xd17a6d14  [usbus1]
100056                   D       -       0xd17a6d44  [usbus1]
100058                   D       -       0xd280daac  [usbus2]
100059                   D       -       0xd280dadc  [usbus2]
100060                   D       -       0xd280db0c  [usbus2]
100061                   D       -       0xd280db3c  [usbus2]
100062                   D       -       0xd280db6c  [usbus2]
100064                   D       -       0xd2838c84  [usbus3]
100065                   D       -       0xd2838cb4  [usbus3]
100066                   D       -       0xd2838ce4  [usbus3]
100067                   D       -       0xd2838d14  [usbus3]
100068                   D       -       0xd2838d44  [usbus3]
100070                   D       -       0xd284aaac  [usbus4]
100071                   D       -       0xd284aadc  [usbus4]
100072                   D       -       0xd284ab0c  [usbus4]
100073                   D       -       0xd284ab3c  [usbus4]
100074                   D       -       0xd284ab6c  [usbus4]
    7     0     0     0  DL      (threaded)          [cam]
100039                   D       -       0xc09361c0  [doneq0]
100040                   D       -       0xc0936140  [async]
100080                   D       -       0xc093606c  [scanner]
    6     0     0     0  DL      crypto_ 0xc3bbfdac  [crypto returns 3]
    5     0     0     0  DL      crypto_ 0xc3bbfd7c  [crypto returns 2]
    4     0     0     0  DL      crypto_ 0xc3bbfd4c  [crypto returns 1]
    3     0     0     0  DL      crypto_ 0xc3bbfd1c  [crypto returns 0]
    2     0     0     0  DL      crypto_ 0xc0b352ec  [crypto]
   13     0     0     0  DL      seqstat 0xd0495dcc  [sequencer 00]
   12     0     0     0  DL      (threaded)          [geom]
100026                   D       -       0xc0ab2d38  [g_event]
100027                   D       -       0xc0ab2d3c  [g_up]
100028                   D       -       0xc0ab2d40  [g_down]
   11     0     0     0  WL      (threaded)          [intr]
100010                   I                           [swi6: Giant taskq]
100016                   I                           [swi5: fast taskq]
100018                   I                           [swi6: task queue]
100019                   I                           [swi1: netisr 0]
100020                   I                           [swi4: clock (0)]
100021                   I                           [swi4: clock (1)]
100022                   I                           [swi4: clock (2)]
100023                   I                           [swi4: clock (3)]
100024                   I                           [swi3: vm]
100041                   I                           [gic0,s11: gpio0]
100042                   I                           [gic0,s45: gpio1]
100043                   I                           [gic0,s50: a31dmac0]
100044                   I                           [gic0,s60: aw_mmc0]
100045                   I                           [gic0,s71: musbotg0]
100051                   I                           [gic0,s72: ehci0]
100057                   I                           [gic0,s73: ohci0]
100063                   I                           [gic0,s78: ehci1]
100069                   I                           [gic0,s79: ohci1]
100075                   I                           [gic0,s82: awg0]
100076                   I                           [swi0: uart]
100077                   I                           [gic0,s31:-_thermal0]
100081                   I                           [gic0,s6: iichb0]
   10     0     0     0  RL      (threaded)          [idle]
100002                   Run     CPU 0               [idle: cpu0]
100003                   CanRun                      [idle: cpu1]
100004                   Run     CPU 2               [idle: cpu2]
100005                   Run     CPU 3               [idle: cpu3]
    1     0     1     0  SLs     wait    0xc29fdc40  [init]
    0     0     0     0  DLs     (threaded)          [kernel]
100000                   D       swapin  0xc0ab31c0  [swapper]
100006                   D       -       0xc3bc0400  [softirq_0]
100007                   D       -       0xc3bc0300  [softirq_1]
100008                   D       -       0xc3bc0200  [softirq_2]
100009                   D       -       0xc3bc0100  [softirq_3]
100011                   D       -       0xd0453e00  [in6m_free taskq]
100012                   D       -       0xd0453d00  [thread taskq]
100013                   D       -       0xd0453c00  [aiod_kick taskq]
100014                   D       -       0xd0453b00  [deferred_unmount ta]
100015                   D       -       0xd0453a00  [inm_free taskq]
100017                   D       -       0xd0453800  [kqueue_ctx taskq]
100025                   D       -       0xd0453600  [firmware taskq]
100030                   D       -       0xd0453500  [crypto_0]
100031                   D       -       0xd0453500  [crypto_1]
100032                   D       -       0xd0453500  [crypto_2]
100033                   D       -       0xd0453500  [crypto_3]
100079                   D       -       0xd173fa00  [CAM taskq]
100095                   D       -       0xd2cdce00  [rtwn0 net80211 task]
db>
Comment 1 Kubilay Kocak freebsd_committer freebsd_triage 2021-10-08 02:30:57 UTC
^Triage: Set Version to earliest confirmed (12.2-R)
Comment 2 Vladimir Kondratyev freebsd_committer 2021-10-08 16:30:11 UTC
4 byte constant string "iic" did not pass length check for 64 byte buffer. That is strange.

You definitely have some sort of memory corruption. Through local source modification, out of buffer write or hardware failure.
Comment 3 alydiomc 2021-10-12 11:55:59 UTC
Created attachment 228624 [details]
twsi.c driver
Comment 4 alydiomc 2021-10-12 11:57:52 UTC
Comment on attachment 228624 [details]
twsi.c driver

Seems the driver does not handle 16bit wide addressing properly.

I made some modification. Looks to be working.

root@nanopi-neo:~/prog/I2C # ./i2c -s -f /dev/iic0
Scanning I2C devices on /dev/iic0: 57 68

root@nanopi-neo:~/prog/I2C # ./i2c -a 0x57 -f /dev/iic0 -d r -o 0 -w 16 -c 16 -m tr
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f

root@nanopi-neo:~/prog/I2C # echo -n "test" | ./i2c -a 0x57 -f /dev/iic0 -d w -o 0x6 -w 16 -c 4 -m tr
root@nanopi-neo:~/prog/I2C # ./i2c -a 0x57 -f /dev/iic0 -d r -o 0 -w 16 -c 16 -m tr
00 01 02 03 04 05 74 65 73 74 0a 0b 0c 0d 0e 0f

root@nanopi-neo:~/prog/I2C # date;./ds1307 -s;./ds1307 -r
Tue Oct 12 19:45:35 PST 2021
19:45:35 12/10/2021

root@nanopi-neo:~/prog/I2C # ./i2c -a 0x68 -f /dev/iic0 -d r -o 0 -w 8 -c 1 -m tr
15
root@nanopi-neo:~/prog/I2C # ./i2c -a 0x68 -f /dev/iic0 -d r -o 0 -w 8 -c 1 -m tr
16
Comment 5 alydiomc 2021-10-12 12:01:01 UTC
on i2c(8), i also adjusted the parsing of offset. Seems LSB is being sent first. I need MSB first.

off.off16 =  (((uint16_t)i2c_opt.off << 8) & 0xff00) | (((uint16_t)i2c_opt.off >> 8) & 0x00ff);
Comment 6 Vladimir Kondratyev freebsd_committer 2021-10-13 07:13:26 UTC
Could upload it as a diff against base version rather than entire content
Comment 7 alydiomc 2021-10-13 10:31:36 UTC
(In reply to Vladimir Kondratyev from comment #6)

Yeah! Sorry, this is my first. :)  

Will do next time. Thank you!