>Number:         9342
>Category:       kern
>Synopsis:       Cardbus code causes panic while scanning CIS data
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Feb  3 13:00:01 2000
>Last-Modified:
>Originator:     Frank van der Linden
>Organization:
Up With NetBSD People
>Release:        NetBSD-current 20000203
>Environment:
NetBSD/i386 -current 20000203 on a noname laptop with
		O2 Micro, Inc cardbus bridge
>Description:
	With the cardbus code is enabled, and a 3Com 3c589 (i.e. a normal
	16 bit PCMCIA card) inserted, my noname laptop panics when booting.
	The panic message (10-finger copy):
=============================================================================
[...]
cbb0: interrupting at irq 10
cbb0: cacheline 0x0 lattimer 0x20
cbb0: bhlc 0x820000 lscp 0x20000000
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 0 device 0 cacheline 0x0, lattimer 0x20
pcmcia0 at cardslot0
cbb1: interrupting at irq 10
cbb1: cacheline 0x0 lattimer 0x20
cbb1: bhlc 0x820000 lscp 0x20000000
cardslot1 at cbb1 slot 1 flags 0
cardbus1 at cardslot1: bus 0 device 0 cacheline 0x0, lattimer 0x20
pcmcia1 at cardslot0
[...]
uvm_fault(0xf0297b40, 0xfc93c00, 0, 1) -> 1
kernel: page fault trap, code=0
Stopped in cardslot0 at pcmcia_scan_cis+0x1a6: movb   0((%eax, %ecx,1),%al
db> trace
pcmcia_scan_cis(f0482400, f0243130, fc938ed0, ffffffff, 0) at pcmcia_scan_cis+0x1a6
pcmcia_read_cis(f0482400, f0482e88, f0473800, f0473800, ffffffff) at pcmcia_read_cis+0x9c
pcmcia_card_attach(f0482400) at pcmcia_card_attach+0x27
cardslot_event_thread(f0473800) at cardslot_event_thread+0x1e9
=============================================================================
	The kernel config file:
=============================================================================
include "arch/i386/conf/std.i386"

maxusers	32		# estimated number of users

# CPU support.  At least one is REQUIRED.
options 	I586_CPU

# CPU-related options.
options 	VM86		# virtual 8086 emulation
options 	USER_LDT	# user-settable LDT; used by WINE
# eliminate delay no-ops in I/O; recommended on all but very old machines
options 	DUMMY_NOPS

# Misc. i386-specific options
options 	XSERVER		# X server support in console drivers

options 	WSEMUL_VT100
options 	WS_KERNEL_FG=WSCOL_RED
options 	WS_KERNEL_BG=WSCOL_WHITE
options 	WSDISPLAY_COMPAT_PCVT
options 	WSDISPLAY_COMPAT_USL
options 	WSDISPLAY_COMPAT_RAWKBD

options 	UCONSOLE	# users can use TIOCCONS (for xconsole)
options 	INSECURE	# disable kernel security levels

options 	RTC_OFFSET=-60	# hardware clock is this many mins. west of GMT

options 	KTRACE		# system call tracing via ktrace(1)

options 	SYSVMSG		# System V-like message queues
options 	SYSVSEM		# System V-like semaphores
options 	SYSVSHM		# System V-like memory sharing

options 	LKM		# loadable kernel modules

options 	DIAGNOSTIC

options 	DDB		# in-kernel debugger
options 	DDB_HISTORY_SIZE=100	# enable history editing in DDB

options 	COMPAT_12	# NetBSD 1.2,
options 	COMPAT_13	# NetBSD 1.3,
options		COMPAT_14
options 	COMPAT_386BSD_MBRPART # recognize old partition ID

options 	COMPAT_SVR4	# binary compatibility with SVR4
options 	COMPAT_LINUX	# binary compatibility with Linux
options 	COMPAT_FREEBSD	# binary compatibility with FreeBSD
options 	COMPAT_AOUT

# File systems
file-system 	FFS		# UFS
file-system 	EXT2FS		# second extended file system (linux)
file-system 	MFS		# memory file system
file-system 	NFS		# Network File System client
file-system 	CD9660		# ISO 9660 + Rock Ridge file system
file-system 	MSDOSFS		# MS-DOS file system
file-system 	KERNFS		# /kern

# File system options
options 	NFSSERVER	# Network File System server

# Networking options
options 	INET		# IP + ICMP + TCP + UDP
options 	INET6
options 	PPP_BSDCOMP	# BSD-Compress compression support for PPP
options 	PPP_DEFLATE	# Deflate compression support for PPP
options 	PPP_FILTER	# Active filter support for PPP (requires bpf)

# These options enable verbose messages for several subsystems.
# Warning, these may compile large string tables into the kernel!
options 	PCIVERBOSE	# verbose PCI device autoconfig messages
#options 	PCMCIAVERBOSE	# verbose PCMCIA configuration messages

# Kernel root file system and dump configuration.
config		netbsd	root on ? type ?

#options 	PCIC_ISA_INTR_ALLOC_MASK=0x288
#options 	PCIC_ISA_ALLOC_IOBASE=0x03a0
#options 	PCIC_ISA_ALLOC_IOSIZE=0x003f

#options 	PCIBIOS			# PCI BIOS support
#options 	PCIBIOSVERBOSE		# PCI BIOS verbose info
#options 	PCIBIOS_INTR_FIXUP	# fixup PCI interrupt routing

#
# Device configuration
#

mainbus0 at root

apm0	at mainbus0			# Advanced power management


# Basic Bus Support

# PCI bus support
pci*	at mainbus? bus ?
pci*	at pchb? bus ?

# PCI bridges
pchb*	at pci? dev ? function ?	# PCI-Host bridges
pcib*	at pci? dev ? function ?	# PCI-ISA bridges

# ISA bus support
isa*	at mainbus?
isa*	at pcib?

# CardBus bus support
cardbus*	at cardslot?
pcmcia*		at cardslot?

cbb*	at pci? dev? function ?

cardslot* 	at cbb? 

## PCMCIA bus support
#pcmcia* at pcic? controller ? socket ?
#
## ISA PCMCIA controllers
#pcic0	at isa? port 0x3e0 iomem 0xd0000 iosiz 0x4000
#pcic1	at isa? port 0x3e2 iomem 0xd4000 iosiz 0x4000

# ISA Plug-and-Play bus support
isapnp0	at isa?

ess*	at isapnp?
audio*	at ess?
opl*	at ess?
midi*	at ess?			# SB MPU401 port
midi*	at opl?			# OPL FM synth

# Coprocessor Support

# Math Coprocessor support
npx0	at isa? port 0xf0 irq 13	# x86 math coprocessor


# Console Devices

pckbc0  at isa?                 # pc keyboard controller
pckbd*  at pckbc?               # PC keyboard
# "opms" should not be enabled together with "pms" or "pmsi"
#pms*           at pckbc?               # PS/2 mouse for wsmouse
#pmsi*          at pckbc?       # PS/2 "Intelli"mouse for wsmouse
opms0           at pckbc?   # backwards compatible PS/2 mouse
vga0            at isa?
vga*            at pci?
wsdisplay*      at vga? console ?
wskbd*  at pckbd? console ?
#wsmouse*       at pms?
#wsmouse*       at pmsi?


pcppi0	at isa?
sysbeep0	at pcppi?

# Serial Devices

# ISA Plug-and-Play serial interfaces
com*	at isapnp?			# Modems and serial boards

ess*	at isapnp?

audio*  at ess?

# PCMCIA serial interfaces
com*	at pcmcia? function ?		# Modems and serial cards

# ISA serial interfaces
#options 	COM_HAYESP		# adds Hayes ESP serial board support
com0	at isa? port 0x3f8 irq 4	# Standard PC serial ports

# IDE and Related Devices

pciide* 	at pci ? dev ? function ? flags 0x0000
wd* 		at pciide? channel ? drive ? flags 0x0000
atapibus* 	at pciide? channel ?

# ATAPI devices
cd0	at atapibus? drive 0		# ATAPI CD-ROM drives

# Miscellaneous mass storage devices

# ISA floppy
fdc0	at isa? port 0x3f0 irq 6 drq 2	# standard PC floppy controllers
fd*	at fdc? drive ?			# the drives themselves

# Network Interfaces

ep*	at pcmcia? function ?		# 3Com 3c589 and 3c562 Ethernet

# Audio Devices

# The spkr driver provides a simple tone interface to the built in speaker.
spkr0	at pcppi?		# PC speaker

# disk/mass storage pseudo-devices
pseudo-device	vnd		4	# disk-like interface to files

# network pseudo-devices
pseudo-device	bpfilter	8	# Berkeley packet filter
pseudo-device	loop			# network loopback
pseudo-device	ppp		2	# Point-to-Point Protocol

# miscellaneous pseudo-devices
pseudo-device	pty		64	# pseudo-terminals
pseudo-device	gif		 4
pseudo-device	faith		 1
=========================================================================
When successfully booted (kernel config as before, only with PCMCIAVERBOSE
and using pcic at isa instead of cardbus), the bootmessages are as
follows:
=========================================================================
NetBSD 1.4R (LAP) #0: Wed Feb  2 23:04:57 MET 2000
    fvdl@frank:/usr/src/sys/arch/i386/compile/LAP
cpu0: family 5 model 4 step 3
cpu0: Intel Pentium/MMX (586-class)
total memory = 65152 KB
avail memory = 58244 KB
using 840 buffers containing 3360 KB of memory
RTC BIOS diagnostic error 20<config_unit>
BIOS32 rev. 0 found at 0xeb160
mainbus0 (root)
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled
pchb0 at pci0 dev 0 function 0
pchb0: Intel 82439TX System Controller (MTXC) (rev. 0x01)
pcib0 at pci0 dev 1 function 0
pcib0: Intel 82371AB PCI-to-ISA Bridge (PIIX4) (rev. 0x01)
pciide0 at pci0 dev 1 function 1: Intel 82371AB IDE controller (PIIX4)
pciide0: bus-master DMA support present
pciide0: primary channel wired to compatibility mode
wd0 at pciide0 channel 0 drive 0: <IBM-DTCA-23240>
wd0: drive supports 16-sector pio transfers, lba addressing
wd0: 3102 MB, 6304 cyl, 16 head, 63 sec, 512 bytes/sect x 6354432 sectors
wd0: 32-bits data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2
pciide0: primary channel interrupting at irq 14
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2 (using DMA data transfers)
pciide0: secondary channel wired to compatibility mode
atapibus0 at pciide0 channel 1
cd0 at atapibus0 drive 0: <UJDA110, , 1.05> type 5 cdrom removable
cd0: 32-bits data port
cd0: drive supports PIO mode 4, DMA mode 1
pciide0: secondary channel interrupting at irq 15
cd0(pciide0:1:0): using PIO mode 0, DMA mode 1 (using DMA data transfers)
Intel 82371AB USB Host Controller (PIIX4) (USB serial bus, revision 0x01) at pci0 dev 1 function 2 not configured
Intel 82371AB Power Management Controller (PIIX4) (miscellaneous bridge, revision 0x01) at pci0 dev 1 function 3 not configured
vga1 at pci0 dev 2 function 0: Trident Microsystems TGUI 9660 (rev. 0xd3)
wsdisplay0 at vga1: console (80x25, vt100 emulation)
2 Micro Inc OZ6832 CardBus Controller (CardBus bridge, revision 0x03) at pci0 dev 3 function 0 not configured
2 Micro Inc OZ6832 CardBus Controller (CardBus bridge, revision 0x03) at pci0 dev 3 function 1 not configured
isa0 at pcib0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
opms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
sysbeep0 at pcppi0
isapnp0 at isa0 port 0x279: ISA Plug 'n Play device support
npx0 at isa0 port 0xf0-0xff: using exception 16
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
pcic0 at isa0 port 0x3e0-0x3e1 iomem 0xd0000-0xd3fff
pcic0: controller 0 (Intel 82365SL Revision 0) has sockets A and B
pcmcia0 at pcic0 controller 0 socket 0
pcmcia1 at pcic0 controller 0 socket 1
isapnp0: read port 0x203
isapnp0: <ESS ES1869 Plug and Play AudioD, ESS0006, , > port 0x800/8 not configured
ess0 at isapnp0 port 0x220/16,0x388/4,0x330/2 irq 5 drq 1,0
ess0:: ESS Technology ES1869 [version 0x688b]
ess0: audio1 interrupting at irq 5
audio0 at ess0: half duplex, mmap, independent
opl0 at ess0: model OPL3
midi0 at opl0: ESS Yamaha OPL3
isapnp0: <ESS ES1869 Plug and Play AudioD, ESS0001, , > port 0x201/1 not configured
apm0 at mainbus0: Power Management spec V1.2
apm0: battery life expectancy: 99%
apm0: A/C state: on
apm0: battery charge state: high
apm0: estimated 1h 39m
biomask efcd netmask efcd ttymask ffcf
pcic0: controller 0 detecting irqs with mask 0xdeb8:..3..7..11
pcic0: using irq 3
pcmcia0: CIS version PCMCIA 2.0 or 2.1
pcmcia0: CIS info: 3Com Corporation, 3C589D, TP/BNC LAN Card Ver. 2a, 000002
pcmcia0: Manufacturer code 0x101, product 0x589
pcmcia0: function 0: network adapter, ccr addr 10000 mask 3
pcmcia0: function 0, config table entry 1: I/O card; irq mask ffff; iomask 4, iospace 0-f; io8 io16 irqlevel
pcmcia0: function 0, config table entry 3: I/O card; irq mask ffff; iomask 4, iospace 0-f; io8 io16 irqlevel
ep0 at pcmcia0 function 0 port 0x340-0x34f: 3Com 3c589 10Mbps Ethernet
ep0: supplying EUI64: 00:60:08:ff:fe:f1:96:3d
ep0: address 00:60:08:f1:96:3d, 8KB byte-wide FIFO, 5:3 Rx:Tx split
ep0: 10baseT, 10base5, 10base2 (default 10baseT)
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
pcmcia0: card irq 7
ep0: DAD complete for fe80:0009::0260:08ff:fef1:963d - no duplicates found
wsdisplay0: screen 1 added (80x25, vt100 emulation)
wsdisplay0: screen 2 added (80x25, vt100 emulation)
wsdisplay0: screen 3 added (80x25, vt100 emulation)
wsdisplay0: screen 4 added (80x25, vt100 emulation)
========================================================================
>How-To-Repeat:
	Boot a kernel with cardbus enabled.
>Fix:
	Unknown.
>Audit-Trail:
>Unformatted: