From nobody@FreeBSD.org  Sun Mar 16 12:40:21 2008
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 217141065673
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 16 Mar 2008 12:40:21 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 2C5918FC1D
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 16 Mar 2008 12:40:21 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m2GCauiS062307
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 16 Mar 2008 12:36:56 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.2/8.14.1/Submit) id m2GCauSi062306;
	Sun, 16 Mar 2008 12:36:56 GMT
	(envelope-from nobody)
Message-Id: <200803161236.m2GCauSi062306@www.freebsd.org>
Date: Sun, 16 Mar 2008 12:36:56 GMT
From: lunarbase <lunarbase+unx@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [7.0R][cardbus][dc] a cardbus dc0 causes a system freeze while transferring large data
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         121761
>Category:       kern
>Synopsis:       [cardbus] [dc] a cardbus dc0 causes a system freeze while transferring large data (7.0R)
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Mar 16 12:50:01 UTC 2008
>Closed-Date:    
>Last-Modified:  Wed Jan 14 20:39:53 UTC 2009
>Originator:     lunarbase
>Release:        7.0R
>Organization:
>Environment:
FreeBSD 7.0-RELEASE #9: Sun Mar  9 19:46:49 JST 2008 i386

>Description:
A file 'cardbus_cis.c' is already patched with following one because the initialization always failed.
http://www.freebsd.org/cgi/query-pr.cgi?pr=115623

While transferring data, dc0 sometimes freezes a FreeBSD kernel. This was happened unpredictably when trasferring large data.

A large data transferring example:
	fetch -p -o /dev/null ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/7.0-RELEASE-i386-livefs.iso

This may relate with this issue.
http://www.freebsd.org/cgi/query-pr.cgi?pr=121555

An ed1 pccard device with POWER ON KEY DEIVCE dc0(*) didn't occur such a system freeze.

(*)See '[7.0R][pccard][cardbus] an ed1 network pccard's CIS wasn't read unless a cardbus network card dc0 had been inserted'


The dc0 card detail:

cbb0: card inserted: event=0x00000000, state=30000821
cbb0: cbb_power: 3V
interrupt storm detected on "irq9:"; throttling interrupt source
cardbus0: CIS pointer is 0x107
cardbus0: CIS in option rom
TUPLE: LINKTARGET [3]: 43 49 53
Product version: 5.0
Product name: IBM | 10/100 EtherJet CardBus | IBMC-10/100 | 1.04 | 
TUPLE: Unknown(0x88) [4]: xx xx xx xx
TUPLE: Unknown(0x8a) [12]: xx xx xx xx xx xx xx xx xx xx xx xx
TUPLE: Unknown(0x8b) [4]: 00 00 00 00
Manufacturer ID: a400130181
TUPLE: Unknown(0x44) [4]: c1 bd 9c 27
Functions: Network Adaptor, Multi-Functioned
Function Extension: 0406xxxxxxxxxxxx
Function Extension: 0102
Function Extension: 0280969800
Function Extension: 0200e1f505
Function Extension: 0301
Function Extension: 0303
Function Extension: 0501
TUPLE: Unknown(0x1c) [4]: 02 4f 02 ff
TUPLE: Unknown(0x04) [7]: 03 02 03 01 00 00 ff
TUPLE: Unknown(0x05) [8]: 41 b0 b0 bc 8e 0e fb 04
TUPLE: Unknown(0x05) [9]: 02 b8 02 b0 bc 8e 1c fb 04
TUPLE: Unknown(0x14) [0]:
CIS reading done
dc0: <Xircom X3201 10/100BaseTX> port 0x1000-0x107f mem 0x88000000-0x880007ff,0x88001000-0x880017ff irq 9 at device 0.0 on cardbus0
miibus0: <MII bus> on dc0
tdkphy0: <TDK 78Q2120 media interface> PHY 0 on miibus0
tdkphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
dc0: Ethernet address: xx:xx:xx:xx:xx:xx
dc0: [ITHREAD]

>How-To-Repeat:
Try following command on dc0 deivce.
fetch -p -o /dev/null ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/7.0-RELEASE-i386-livefs.iso

>Fix:


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: vwe 
State-Changed-When: Tue Mar 18 22:28:59 UTC 2008 
State-Changed-Why:  

Please try to break into debugger when the system appears to hang and create 
a backtrace. 
If that doesn't work, please try if running a WITNESS enabled kernel 
is showing any messages. Without a backtrace, there's not really a chance 
to investigate this. 
I'm wondering what may make you assume this issue is related to PR 121555? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=121761 
State-Changed-From-To: feedback->open 
State-Changed-By: linimon 
State-Changed-When: Sat Mar 22 05:58:32 UTC 2008 
State-Changed-Why:  
Feedback received. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=121761 
>Unformatted:

From feedback to audit trail:

> >Please try to break into debugger when the system appears to hang and create
> >a backtrace.

It's impossible because this freezes everything before generating the core file.

> >If that doesn't work, please try if running a WITNESS enabled kernel
> >is showing any messages. Without a backtrace, there's not really a chance
> >to investigate this.

I did cvsup FreeBSD kernel source files with "*default tag=RELENG_7".
The version was:
 Edit src/sys/conf/NOTES
  Add delta 1.1454.2.3 2008.03.18.17.32.09 piso
 Edit src/sys/conf/files
  Add delta 1.1243.2.7 2008.03.18.17.32.09 piso

Used conf file is GENERIC with following options:
makeoptions     DEBUG=-g                # Build kernel with gdb(1) debug symbol
options         WITNESS                 # Enable checks to detect deadlocks and
options         WITNESS_SKIPSPIN        # Don't run witness on spinlocks for sp
options         INVARIANTS              #Enable calls of extra sanity checking
options         INVARIANT_SUPPORT       #Extra sanity checks of internal struct

I applyed this patch for recognition of dc0 cardbus device.
http://www.freebsd.org/cgi/query-pr.cgi?pr=115623

I compiled it by (make makekernel KERNCONF=GENERIC.DEBUG && make
installkernel KERNCONF=GENERIC.DEBUG), then powered my ThinkPad i1400
off and powered it on.
RELENG_7 showed a login message, and I logged in.
I inserted a dc0 device (IBM 10/100 EtherJet CardBus), then it wasn't
recognized.
This was described in http://www.freebsd.org/cgi/query-pr.cgi?pr=121759 .
In this time, the card type was recognized, but the system said about
something failure of the CIS.

> >interrupt storm detected on "irq9:"; throttling interrupt source
> >cardbus1: Bad header in rom 0: [0] ffff
> >cardbus1: Unable to allocate resources for CIS
> >dc0: <Xircom X3201 10/100BaseTX> port 0x1000-0x107f mem
0x88000000-0x880007ff,0x88001000-0x880017ff irq 9 at device 0.0 on
cardbus1
> >dc0: No station address in CIS!
> >device_attach: dc0 attach returned 6

Other recognition pattern from PR121759:
> >interrupt storm detected on "irq9:"; throttling interrupt source
> >cardbus0: CIS pointer is 0xff7
> >cardbus0: CIS in option rom
> >cardbus0: Bad header in rom 0: [0] ffff
> >cardbus0: Unable to allocate resources for CIS
> >cardbus0: Warning: Bogus CIS ignored
> >cardbus0: <network, ethernet> at device 0.0 (no driver attached)

I removed the card, and reinserted it. The card was recognized successfully.

> >interrupt storm detected on "irq9:"; throttling interrupt source
> >dc0: <Xircom X3201 10/100BaseTX> port 0x1000-0x107f mem
0x88000000-0x880007ff,0x88001000-0x880017ff irq 9 at device 0.0 on
cardbus1
> >miibus0: <MII bus> on dc0
> >tdkphy0: <TDK 78Q2120 media interface> PHY 0 on miibus0
> >tdkphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
> >dc0: Ethernet address: xx:xx:xx:xx:xx:xx
> >dc0: [ITHREAD]

I executed a following command.

fetch -p -o /dev/null
ftp://ftp.jp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/7.0-RELEASE-i386-livefs.iso

After transferring about 20MB data, everything freezed !
No core file was generated and no message was shown on the screen.

> >I'm wondering what may make you assume this issue is related to PR 121555?
Because I found the problem report about transferring data on 7.0R


* Boot message on ThinkPad i1400 (2611-436)
Copyright (c) 1992-2008 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 7.0-STABLE #0: Thu Mar 20 22:07:49 JST 2008
    xxx@xxx.xxx:/usr/obj/src/sys/GENERIC.DEBUG
WARNING: WITNESS option enabled, expect reduced performance.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD-K6(tm) 3D processor (299.94-MHz 586-class CPU)
  Origin = "AuthenticAMD"  Id = 0x58c  Stepping = 12
  Features=0x8021bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8,PGE,MMX>
  AMD Features=0x80000800<SYSCALL,3DNow!>
real memory  = 201261056 (191 MB)
avail memory = 182935552 (174 MB)
kbd1 at kbdmux0
K6-family MTRR support enabled (2 registers)
ath_hal: 0.9.20.3 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413)
cpu0 on motherboard
pcib0: <Host to PCI bridge> pcibus 0 on motherboard
pir0: <PCI Interrupt Routing Table: 7 Entries> on motherboard
pci0: <PCI bus> on pcib0
$PIR: No matching entry for 0.11.INTA
isab0: <PCI-ISA bridge> at device 2.0 on pci0
isa0: <ISA bus> on isab0
cbb0: <O2Micro OZ6832/6833 PCI-CardBus Bridge> irq 9 at device 5.0 on pci0
cardbus0: <CardBus bus> on cbb0
pccard0: <16-bit PCCard bus> on cbb0
cbb0: [ITHREAD]
cbb1: <O2Micro OZ6832/6833 PCI-CardBus Bridge> irq 9 at device 5.1 on pci0
cardbus1: <CardBus bus> on cbb1
pccard1: <16-bit PCCard bus> on cbb1
cbb1: [ITHREAD]
vgapci0: <VGA-compatible display> mem
0xd000000-0xdffffff,0xe000000-0xe1fffff,0xe200000-0xe2fffff irq 9 at
device 6.0 on pci0
atapci0: <AcerLabs M5229 UDMA33 controller> port
0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0x6090-0x609f irq 15 at device
11.0 on pci0
ata0: <ATA channel 0> on atapci0
ata0: [ITHREAD]
ata1: <ATA channel 1> on atapci0
ata1: [ITHREAD]
pci0: <bridge> at device 12.0 (no driver attached)
ohci0: <AcerLabs M5237 (Aladdin-V) USB controller> mem
0xe300000-0xe300fff irq 10 at device 15.0 on pci0
ohci0: [GIANT-LOCKED]
ohci0: [ITHREAD]
usb0: OHCI version 1.0, legacy support
usb0: <AcerLabs M5237 (Aladdin-V) USB controller> on ohci0
usb0: USB revision 1.0
uhub0: <AcerLabs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
uhub0: 2 ports with 2 removable, self powered
PnP device failed to report resource data
pmtimer0 on isa0
orm0: <ISA Option ROM> at iomem 0xc0000-0xc9fff pnpid ORM0000 on isa0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
atkbd0: [ITHREAD]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: [ITHREAD]
psm0: model Generic PS/2 mouse, device ID 0
fdc0: <Enhanced floppy controller> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
fdc0: [FILTER]
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
ppc0: <Parallel port> at port 0x3bc-0x3c3 irq 7 on isa0
ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode
ppbus0: <Parallel port bus> on ppc0
ppbus0: [ITHREAD]
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
ppc0: [GIANT-LOCKED]
ppc0: [ITHREAD]
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio0: [FILTER]
sio1: configured irq 3 not in bitmap of probed irqs 0
sio1: port may not be enabled
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
unknown: <PNP0c01> can't assign resources (memory)
unknown: <PNP0c02> can't assign resources (memory)
unknown: <PNP0303> can't assign resources (port)
unknown: <IBM3780> can't assign resources (irq)
unknown: <PNP0400> can't assign resources (port)
unknown: <PNP0501> can't assign resources (port)
unknown: <PNP0700> can't assign resources (port)
Timecounter "TSC" frequency 299942654 Hz quality 800
Timecounters tick every 1.000 msec
ad0: 4xxxMB <IBM DBCA-204860 xxxxxxxx> at ata0-master UDMA33
acd0: CDROM <CRN-8241B/1.16> at ata1-master PIO4

