kern/121761: [7.0R][cardbus][dc] a cardbus dc0 causes a system freeze while transferring large data

[lunarbase]

>Number:         121761
>Category:       kern
>Synopsis:       [7.0R][cardbus][dc] a cardbus dc0 causes a system freeze while transferring large data
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Mar 16 12:50:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     lunarbase
>Release:        7.0R
>Organization:
>Environment:
FreeBSD 7.0-RELEASE #9: Sun Mar  9 19:46:49 JST 2008 i386

>Description:
A file 'cardbus_cis.c' is already patched with following one because the initialization always failed.
http://www.freebsd.org/cgi/query-pr.cgi?pr=115623

While transferring data, dc0 sometimes freezes a FreeBSD kernel. This was happened unpredictably when trasferring large data.

A large data transferring example:
	fetch -p -o /dev/null ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/7.0-RELEASE-i386-livefs.iso

This may relate with this issue.
http://www.freebsd.org/cgi/query-pr.cgi?pr=121555

An ed1 pccard device with POWER ON KEY DEIVCE dc0(*) didn't occur such a system freeze.

(*)See '[7.0R][pccard][cardbus] an ed1 network pccard's CIS wasn't read unless a cardbus network card dc0 had been inserted'


The dc0 card detail:

cbb0: card inserted: event=0x00000000, state=30000821
cbb0: cbb_power: 3V
interrupt storm detected on "irq9:"; throttling interrupt source
cardbus0: CIS pointer is 0x107
cardbus0: CIS in option rom
TUPLE: LINKTARGET [3]: 43 49 53
Product version: 5.0
Product name: IBM | 10/100 EtherJet CardBus | IBMC-10/100 | 1.04 | 
TUPLE: Unknown(0x88) [4]: xx xx xx xx
TUPLE: Unknown(0x8a) [12]: xx xx xx xx xx xx xx xx xx xx xx xx
TUPLE: Unknown(0x8b) [4]: 00 00 00 00
Manufacturer ID: a400130181
TUPLE: Unknown(0x44) [4]: c1 bd 9c 27
Functions: Network Adaptor, Multi-Functioned
Function Extension: 0406xxxxxxxxxxxx
Function Extension: 0102
Function Extension: 0280969800
Function Extension: 0200e1f505
Function Extension: 0301
Function Extension: 0303
Function Extension: 0501
TUPLE: Unknown(0x1c) [4]: 02 4f 02 ff
TUPLE: Unknown(0x04) [7]: 03 02 03 01 00 00 ff
TUPLE: Unknown(0x05) [8]: 41 b0 b0 bc 8e 0e fb 04
TUPLE: Unknown(0x05) [9]: 02 b8 02 b0 bc 8e 1c fb 04
TUPLE: Unknown(0x14) [0]:
CIS reading done
dc0: <Xircom X3201 10/100BaseTX> port 0x1000-0x107f mem 0x88000000-0x880007ff,0x88001000-0x880017ff irq 9 at device 0.0 on cardbus0
miibus0: <MII bus> on dc0
tdkphy0: <TDK 78Q2120 media interface> PHY 0 on miibus0
tdkphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
dc0: Ethernet address: xx:xx:xx:xx:xx:xx
dc0: [ITHREAD]

>How-To-Repeat:
Try following command on dc0 deivce.
fetch -p -o /dev/null ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/7.0/7.0-RELEASE-i386-livefs.iso

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: