>Number:         9984
>Category:       kern
>Synopsis:       AVM Fritz ISDN card panics when in cardbus slot, works in pcmcia slot
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Apr 25 21:23:01 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     Martin Husemann
>Release:        cvs update from April 22, 2000
>Organization:
	
>Environment:
	
System: NetBSD rumolt.teuto.de 1.4X NetBSD 1.4X (RUMOLT) #1: Mon Apr 24 10:17:03 MEST 2000 martin@rumolt.teuto.de:/usr/src/sys-i4b/arch/i386/compile/RUMOLT i386

Machine: IBM thinkpad 770, Pentium 200 (I think), TI 1250 cardbus controller.

>Description:

An AVM Fritz! pcmcia ISDN card (all versions) causes a panic at attach time
from pcmcia_cis.c:157, where pcmcia_cis_read_1 is called the first time
for tuple.ptr and tuple.ptr points far off (about 0x2000, iirc).

Enabling pcmciacis_debug fixes this, so it seems to be a timing related
problem.

The same card, same driver, works fine in another notebook with a pcmcia
slot (no cardbus).

>How-To-Repeat:

Just insert this card into a slot and boot a kernel with support for this
card (i.e. install the ISDN4BSD source from ftp.netbsd.org:/pub/misc/isdn4bsd).

>Fix:

This patch prevents the panic, but clearly is not the right think to do.
Someone with any ideas about pcmcia/cardbus/cis internals, please help 
me debug this further...

*** /usr/src/sys/dev/pcmcia/pcmcia_cis.c	Mon Feb 21 13:31:32 2000
--- pcmcia_cis.c	Wed Apr 26 05:52:03 2000
***************
*** 157,160 ****
--- 157,161 ----
  			/* get the tuple code */
  
+ 			DELAY(1000);
  			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
  
***************
*** 180,183 ****
--- 181,185 ----
  			/* now all the normal tuples */
  
+ 			DELAY(1000);
  			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
  			switch (tuple.code) {
***************
*** 216,220 ****
--- 218,224 ----
  					*((u_int16_t *) & offset) =
  					    pcmcia_tuple_read_2(&tuple, 0);
+ 					DELAY(1000);
  					length = pcmcia_tuple_read_2(&tuple, 2);
+ 					DELAY(1000);
  					cksum = pcmcia_tuple_read_1(&tuple, 4);
  

>Release-Note:
>Audit-Trail:
>Unformatted: