>Number:         21810
>Category:       kern
>Synopsis:       trap 200 with 3Com 905C-TX (Broadcom)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 06 15:41:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     Makoto Fujiwara
>Release:        NetBSD 1.6L,1.6T
>Organization:
KINU Corporation

>Environment:
	
	
System: NetBSD harry 1.6T NetBSD 1.6T (INSECURE-L2CR) #0: Thu May 29 15:06:18 UTC 2003 root@serv:/export/20030516-utc/src/sys/arch/macppc/compile/INSECURE-L2CR macppc
Architecture: powerpc
Machine: macppc
>Description:
(1) trap type 200:
I have my kernel trap 200 at ifconfig when 3Com 3c905C-TX 10/100 
NIC installed on my NetBSD/macppc machine.

The log may look like following: 
-----------------------------
Configuring network interfaces: ex0
trap type 200 at 1999d8
Stopped in pid 67 (ifconfig) at ex_mii_bitbang_read+0x20:       sync

db> trace
at ex_mii_readreg+70
at bmtphy_status+54
at mii_phy_status+18
at bmtphy_service+110
at mii_pollstat+4c
at ex_media_stat+2c
at ifmedia_ioctl+130
at ex_ioctl+70
at ifioctl+764
at soo_ioctl+168
at sys_ioctl+388
at syscall_plain+fc
at syscalltrap+c0
at end+132fba0
at end+131436c
at end+13117e0
at end+1310f64
at end+41322298
db> 
-----------------------------

>How-To-Repeat:
	Have 3Com 905C-TX NIC card inserted, and have ifconfig.ex0
        file setup, boot to multi-user with GENERIC kernel

(2) easy work around:
By removing bmtphy from GENERIC kernel:
169c169
< bmtphy*       at mii? phy ?                   # Broadcom BCM5201/BCM5202 PHYs
---
> #mtphy*       at mii? phy ?                   # Broadcom BCM5201/BCM5202 PHYs

it works as
ex0 at pci1 dev 6 function 0: 3Com 3c905C-TX 10/100 Ethernet with mngmt (rev. 0x6c)
ex0: interrupting at irq 26
ex0: MAC address 00:02:1e:f5:yy:xx
ukphy1 at ex0 phy 24: Generic IEEE 802.3u media interface
ukphy1: Broadcom 3c905C internal PHY (OUI 0x000818, model 0x0017), rev. 4
ukphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto

>Fix:
  (First of all, thanks Izumi Tsutsui and Masanari Tsubai, to 
   get above tweak and this patch)

(3) fix on bmyphy.c
Then I have looked at bmtphy.c and ukphy.c, and apply the patch
attached to move the timing of register read:
   getting following and works OK:

ex0 at pci1 dev 6 function 0: 3Com 3c905C-TX 10/100 Ethernet with mngmt (rev. 0x
6c)
ex0: interrupting at irq 26
ex0: MAC address 00:02:1e:f5:yy:xx
bmtphy0 at ex0 phy 24: Broadcom 3c905C internal PHY, rev. 4
bmtphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto

Index: /e/serv/20030516-utc/src/sys/dev/mii/bmtphy.c
===================================================================
RCS file: /e/CVSup/main/src/sys/dev/mii/bmtphy.c,v
retrieving revision 1.13
diff -u -r1.13 bmtphy.c
--- /e/serv/20030516-utc/src/sys/dev/mii/bmtphy.c	2003/05/02 19:42:35	1.13
+++ src/sys/dev/mii/bmtphy.c	2003/06/05 23:59:35
@@ -236,7 +236,6 @@
 	mii->mii_media_active = IFM_ETHER;
 
 	bmsr = PHY_READ(sc, MII_BMSR) | PHY_READ(sc, MII_BMSR);
-	aux_csr = PHY_READ(sc, MII_BMTPHY_AUX_CSR);
 
 	if (bmsr & BMSR_LINK)
 		mii->mii_media_status |= IFM_ACTIVE;
@@ -262,6 +261,7 @@
 			return;
 		}
 
+		aux_csr = PHY_READ(sc, MII_BMTPHY_AUX_CSR);
 		if (aux_csr & AUX_CSR_SPEED)
 			mii->mii_media_active |= IFM_100_TX;
 		else


>Release-Note:
>Audit-Trail:
>Unformatted: