kernel/2413: 3c985B card causes kernel panic on alpha

[jcs@rt.fm]

>Number:         2413
>Category:       kernel
>Synopsis:       3c985B gigabit card causes kernel panic on alpha
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Feb 19 18:50:02 MST 2002
>Last-Modified:
>Originator:     Joshua Stein
>Organization:
net
>Release:        OpenBSD 3.0-current
>Environment:
	
	System      : OpenBSD 3.0
	Architecture: OpenBSD.alpha
	Machine     : alpha
>Description:
A 3c985 gigabit card causes a kernel panic on alpha.  Tested on 3.0-stable and
3.0-current kernels, with 3c905 10/100 card installed and removed (crashes the
same in all 4 situations).
>How-To-Repeat:

1) Find an AlphaStation 200.
2) Buy a 3Com 3c985B gigabit card, add to AlphaStation.
3) Boot 3.0-stable or 3.0-current kernel, watch it panic.

Entering bsd at 0xfffffc0000230000...
[ using 506784 bytes of bsd ELF symbol table ]
consinit: not using prom console
Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2002 OpenBSD. All rights reserved.  http://www.OpenBSD.org

OpenBSD 3.0-current (GENERIC) #3: Mon Feb 18 01:16:57 MST 2002
    deraadt@alpha.openbsd.org:/usr/src/sys/arch/alpha/compile/GENERIC
AlphaStation 200 4/233, 233MHz
8192 byte page size, 1 processor.
total memory = 268435456 (262144K)
(2048000 reserved for PROM, 266387456 used by OpenBSD)
avail memory = 227688448 (222352K)
using 3251 buffers containing 26632192 bytes (26008K) of memory
mainbus0 (root)
cpu0 at mainbus0: ID 0 (primary), 21064A-0 (unknown minor type 0)
apecs0 at mainbus0: DECchip 21071 Core Logic chipset
apecs0: DC21071-CA pass 2, 64-bit memory bus
apecs0: DC21071-DA pass 2
pci0 at apecs0 bus 0
siop0 at pci0 dev 6 function 0 "Symbios Logic 53c810" rev 0x02: isa irq 11
scsibus0 at siop0: 8 targets
sd0 at scsibus0 targ 0 lun 0: <SEAGATE, ST32171N, 0484> SCSI2 0/direct fixed
siop0: target 0 now using tagged 8 bit 10 MHz 8 REQ/ACK offset xfers
sd0: 2062MB, 5172 cyl, 5 head, 163 sec, 512 bytes/sec, 4223444 sec total
sd1 at scsibus0 targ 2 lun 0: <IBM, DDRS-39130, S97B> SCSI2 0/direct fixed
siop0: target 2 now using tagged 8 bit 10 MHz 8 REQ/ACK offset xfers
sd1: 8715MB, 8387 cyl, 10 head, 212 sec, 512 bytes/sec, 17850000 sec total
cd0 at scsibus0 targ 4 lun 0: <TOSHIBA, CD-ROM XM-6201TA, 1030> SCSI2 5/cdrom removable
siop0: target 4 now using 8 bit 10 MHz 8 REQ/ACK offset xfers
sio0 at pci0 dev 7 function 0 "Intel 82378IB PCI-ISA" rev 0x43
de0 at pci0 dev 11 function 0 "DEC 21040" rev 0x24: isa irq 5
de0: DEC 21040 [10Mb/s] pass 2.4 address 00:00:f8:23:49:04
ti0 at pci0 dev 12 function 0 "3Com 3c985" rev 0x01
fatal kernel trap:

    trap entry = 0x2 (memory management fault)
    a0         = 0x7ffffe012010800
    a1         = 0x1
    a2         = 0x1
    pc         = 0xfffffc000060e174
    ra         = 0xfffffc000055d5b4
    curproc    = 0xfffffc0000732b88
        pid = 0, comm = 

panic: trap
Stopped at      Debugger+0x4:   ret     zero,(ra)
RUN AT LEAST 'trace' AND 'ps' AND INCLUDE OUTPUT WHEN REPORTING THIS PANIC!
DO NOT EVEN BOTHER REPORTING THIS WITHOUT INCLUDING THAT INFORMATION!
ddb> trace
Debugger(6, 1, 5, 8, 3, 8) at Debugger+0x4
panic(fffffc0000678052, 1, 1, 2, fffffc00001f5990, 8) at panic+0x128
trap(?, ?, ?, ?, fffffc00001f5990, 8) at trap+0x604
XentMM(?, ?, ?, ?, ?, 8) at XentMM+0x20
bzero(?, ?, 68, 2000, fffffc0000561520, fffffe0000026000) at bzero+0x54
ti_mem(?, ?, 68, 0, fffffc0000561520, fffffe0000026000) at ti_mem+0xd4
ti_attach(?, ?, ?, ?, ?, ?) at ti_attach+0x2b8
config_attach(?, ?, ?, ?, ?, ?) at config_attach+0x244
config_found_sm(?, ?, ?, ?, ?, ?) at config_found_sm+0x54
pciattach(?, fffffe000000de00, ?, ?, ?, ?) at pciattach+0x2e4
config_attach(?, ?, ?, ?, ?, ?) at config_attach+0x244
config_found_sm(?, ?, ?, ?, ?, ?) at config_found_sm+0x54
apecsattach(?, ?, ?, ?, ?, ?) at apecsattach+0x1c8
config_attach(?, ?, ?, ?, ?, ?) at config_attach+0x244
config_found_sm(?, ?, ?, ?, ?, ?) at config_found_sm+0x54
mbattach(?, ?, ?, ?, ?, ?) at mbattach+0x160
config_attach(?, ?, ?, ?, ?, ?) at config_attach+0x244
config_rootfound(?, ?, ?, ?, ?, ?) at config_rootfound+0x78
cpu_configure(?, ?, ?, ?, ?, ?) at cpu_configure+0x48
main(?, ?, ?, ?, ?, ?) at main+0xf8
Lstart1(?, ?, ?, ?, ?, ?) at Lstart1+0x60
Lstart1(?, ?, ?, ?, ?, ?) at Lstart1+0x60
[ endless scrolling of 'Lstart1()' lines ]

dmesg with ti disabled (but still plugged in):

[ using 490496 bytes of bsd ELF symbol table ]
consinit: not using prom console
Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2001 OpenBSD. All rights reserved.  http://www.OpenBSD.org

OpenBSD 3.0-stable (GENERIC) #0: Sun Jan  6 17:02:53 CST 2002
    jcs@sketch:/export/stable/src/sys/arch/alpha/compile/GENERIC
AlphaStation 200 4/233, 233MHz
8192 byte page size, 1 processor.
total memory = 268435456 (262144K)
(2048000 reserved for PROM, 266387456 used by OpenBSD)
avail memory = 227958784 (222616K)
using 3251 buffers containing 26632192 bytes (26008K) of memory
User Kernel Config
UKC> disable ti
 81 ti* disabled
UKC> exit
Continuing...
mainbus0 (root)
cpu0 at mainbus0: ID 0 (primary), 21064A-0 (unknown minor type 0)
apecs0 at mainbus0: DECchip 21071 Core Logic chipset
apecs0: DC21071-CA pass 2, 64-bit memory bus
apecs0: DC21071-DA pass 2
pci0 at apecs0 bus 0
siop0 at pci0 dev 6 function 0 "Symbios Logic 53c810" rev 0x02: isa irq 11, scsibus0 at siop0: 8 targets
sd0 at scsibus0 targ 0 lun 0: <SEAGATE, ST32171N, 0484> SCSI2 0/direct fixed
siop0: target 0 now using tagged 8 bit 10 MHz 8 REQ/ACK offset xfers
sd0: 2062MB, 5172 cyl, 5 head, 163 sec, 512 bytes/sec, 4223444 sec total
sd1 at scsibus0 targ 2 lun 0: <IBM, DDRS-39130, S97B> SCSI2 0/direct fixed
siop0: target 2 now using tagged 8 bit 10 MHz 8 REQ/ACK offset xfers
sd1: 8715MB, 8387 cyl, 10 head, 212 sec, 512 bytes/sec, 17850000 sec total
cd0 at scsibus0 targ 4 lun 0: <TOSHIBA, CD-ROM XM-6201TA, 1030> SCSI2 5/cdrom removable
siop0: target 4 now using 8 bit 10 MHz 8 REQ/ACK offset xfers
sio0 at pci0 dev 7 function 0 "Intel 82378IB PCI-ISA" rev 0x43
"DEC 21040" rev 0x24 at pci0 dev 11 function 0 not configured
"3Com 3c985" rev 0x01 at pci0 dev 12 function 0 not configured
xl0 at pci0 dev 13 function 0 "3Com 3c905 100Base-TX" rev 0x00: isa irq 15 address 00:a0:24:c3:39:84
nsphy0 at xl0 phy 24: DP83840 10/100 media interface, rev. 0
isa0 at sio0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
pckbc0 at isa0 port 0x60/5
lpt0 at isa0 port 0x3bc/4 irq 7
mcclock0 at isa0 port 0x70/2: mc146818 or compatible
root on sd0a swap on sd0b
rootdev=0x800 rrootdev=0x800 rawdev=0x802

>Fix:
	Don't know.

>Audit-Trail:
>Unformatted: