>Number:         31380
>Category:       kern
>Synopsis:       Detaching a wi PCMCIA card panics netbsd-3
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 23 19:21:00 +0000 2005
>Originator:     Hauke Fath <hauke@Espresso.Rhein-Neckar.DE>
>Release:        NetBSD 3.0_BETA
>Organization:
-- 
/~\  The ASCII Ribbon Campaign                    Hauke Fath
\ /    No HTML/RTF in email	        Institut für Nachrichtentechnik
 X     No Word docs in email	                  TU Darmstadt
/ \  Respect for open standards              Ruf +49-6151-16-3281
>Environment:
	
	
System: NetBSD quiche 3.0_BETA NetBSD 3.0_BETA (QUICHE) #4: Mon Sep 5 22:10:05 CEST 2005 hauke@quiche:/usr/src/sys/arch/i386/compile/QUICHE i386
Architecture: i386
Machine: i386
>Description:

Pulling the prism-based Netgear 16 bit PCMCIA card from my Thinkpad T23 panics reproducibly:

cbb0: wait took 0.020150s
pcmcia0: CIS version PC Card Standard 5.0
pcmcia0: CIS info: NETGEAR MA401RA Wireless PC, Card, ISL37300P, Eval-RevA
pcmcia0: Manufacturer code 0xb, product 0x7300
pcmcia0: function 0: network adapter, ccr addr 3e0 mask 1
pcmcia0: function 0, config table entry 1: I/O card; irq mask ffff; iomask 6, iospace 0-3f; io16 irqpulse irqlevel
wi0 at pcmcia0 function 0: <NETGEAR MA401RA Wireless PC, Card, ISL37300P, Eval-RevA>
wi0: 802.11 address 00:09:5b:54:f1:e5
wi0: using RF:PRISM2.5 MAC:ISL3873B(PCMCIA)
wi0: Intersil Firmware: Primary (1.1.1), Station (1.7.4)
wi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps

[...]

wi0: timeout in wi_seek to ffff/0
wi0: wi_rx_intr read fid ffff failed
wi0: spurious alloc ffff != 134, alloc 0 queue 0 start 0 alloced 3 queued 0 started 0
wi0: timeout in wi_seek to ffff/8
wi0: wi_tx_intr read fid ffff failed
wi0: timeout in wi_seek to ffff/0
wi0: wi_tx_ex_intr read fid ffff failed
wi0: timeout in wi_seek to ffff/0
panic: kernel diagnostic assertion "sc->sc_txcmds > 0" failed: file "../../../../dev/ic/wi.c", line 1749
Stopped at      netbsd:cpu_Debugger+0x4:        popl    %ebp
db> t
cpu_Debugger(c055111d,c0687dcc,c0687dc0,c01cd8c0,c0ef3000) at netbsd:cpu_Debugger+0x4
panic(c05a27e0,c052687c,c052a87a,c052a760,6d5) at netbsd:panic+0x12b
__assert(c052687c,c052a760,6d5,c052a87a,c0ef3000) at netbsd:__assert+0x2e
wi_cmd_intr(c0ef3000,c0273db0,4,c0bc1540,0) at netbsd:wi_cmd_intr+0x76
wi_intr(c0ef3000,1,0,c0bc4340,0) at netbsd:wi_intr+0x258
pccbbintr_function(c0b48000,0,89640010,10030,339d0010) at netbsd:pccbbintr_function+0x98
Xintr_legacy11() at netbsd:Xintr_legacy11+0xad
--- interrupt ---
mpidle(c05f4e80,0,c05f5760,282,c04ec350) at netbsd:mpidle
ltsleep(c05f4cc0,4,c0549a9b,0,0) at netbsd:ltsleep+0x3de
uvm_scheduler(c05f4ca0,0,c05f917c,c053227d,0) at netbsd:uvm_scheduler+0x14c
main(0,0,0,0,0) at netbsd:main+0x781
db> reboot
syncing disks... done
wi0: wi_cmd: busy bit won't clear.
panic: pccbb_pcmcia_delay: called in interrupt context
Stopped at      netbsd:cpu_Debugger+0x4:        popl    %ebp
db>


>How-To-Repeat:

	Insert Netgear MA401 PCMCIA wlan card into Thinkpad, 
start dhclient on it (or configure manually), and pull the card. 
Notebook freezes (why does the kernel debugger _still_ not switch 
from X11 to text console?). Boot to serial console, watch it panic.

>Fix:
	No idea.

>Unformatted: