Booting 7200/90 news

["Wojciech Galazka" <wgalazka.dev%gmail.com@localhost>]

After finishing with mftb I went further on and then got stopped on
another problem.
I have no clue really this time how to tackle this. Any help is appreciated.

0 > boot enet:,\b4.xcf wg2
...
>> NetBSD/macppc OpenFirmware Boot, Revision 1.10
>> (n4%pmg4.wg.net@localhost, Mon Aug 18 20:50:19 UTC 2008)
>> Open Firmware version 1.x
...
 start=0x100000

trap: kernel read DSI trap @ 0x4ffd000 by 0x21d428 (DSISR 0x40000000,
err=14), lr 0x28f6e8
panic: trap
Stopped in pid 0.1 (system) at  netbsd:cpu_Debugger+0x10:       lwz
 r0, r1, 0x14
db> trace
0x003d8cd0: at panic+0x21c
0x003d8d20: at trap+0x100
0x003d8db0: kernel DSI read trap @ 0x4ffd000 by initmsgbuf+0x24: srr1=0x1030
            r1=0x3d8e70 cr=0x30000055 xer=0xe000be6f ctr=0
dsisr=0x40000000 mq=0x8
0x003d8e70: at mutex_vector_exit+0x58
0x003d8e80: at oea_startup+0x58
0x003d8ed0: at cpu_startup+0x10
0x003d8ee0: at main+0x4c
0x003d8f30: at 0x100094
db> show registers
r0          0x223f48    panic+0x220
r1          0x3d8cc0    _prop_dictionary_keysym32_pool+0x54190
r2          0x337f60    cpu_info
r3          0x337f60    cpu_info
r4          0x32efc0    __link_set_bufq_strats_sym_bufq_strat_dummy+0x40
r5          0x337f60    cpu_info
r6          0x10024c    ofw_stack+0x48
r7          0x33b7b0    firmstk+0xff0
r8          0x1030
r9          0x340000    idstate+0x138c
r10         0
r11         0x340000    idstate+0x138c
r12         0x30001055
r13         0xdeadbeef
r14         0xdeadbeef
r15         0xdeadbeef
r16         0xdeadbeef
r17         0xdeadbeef
r18         0xdeadbeef
r19         0xdeadbeef
r20         0xdeadbeef
r21         0xdeadbeef
r22         0xdeadbeef
r23         0xdeadbeef
r24         0x340000    idstate+0x138c
r25         0x4ffd000
r26         0x3368f0    proc0
r27         0x3d5000    _prop_dictionary_keysym32_pool+0x504d0
r28         0x340000    idstate+0x138c
r29         0x340000    idstate+0x138c
r30         0x3091a4    null_vnodeop_entries+0xd0
r31         0x100
iar         0x28d894    cpu_Debugger+0x10
msr         0x1030
lr          0x28d894    cpu_Debugger+0x10
ctr         0x29f5e4    cnflush
cr          0x50001053
xer         0xe000be6f
mq          0x4
netbsd:cpu_Debugger+0x10:       lwz     r0, r1, 0x14
db>  reboot

Decoding dsisr=0x40000000
Data access exception (not an alignment exception)
Bit 1 set
Set if the translation of an attempted access is not found in the primary hash
table entry group (HTEG), or in the rehashed secondary HTEG, or in the range of
a BAT register.

Source code follows

/usr/src/sys/arch/powerpc/oea/oea_machdep.c
void
oea_startup(const char *model)
{
        uintptr_t sz;
        void *v;
        vaddr_t minaddr, maxaddr;
        char pbuf[9];
        u_int i;

        KASSERT(curcpu() != NULL);
        KASSERT(lwp0.l_cpu != NULL);
        KASSERT(curcpu()->ci_intstk != 0);
        KASSERT(curcpu()->ci_intrdepth == -1);

        /*
         * If the msgbuf is not in segment 0, allocate KVA for it and access
         * it via mapped pages.  [This prevents unneeded BAT switches.]
         */
        sz = round_page(MSGBUFSIZE);
        v = (void *) msgbuf_paddr;
        if (msgbuf_paddr + sz > SEGMENT_LENGTH) {
                minaddr = 0;
                if (uvm_map(kernel_map, &minaddr, sz,
                                NULL, UVM_UNKNOWN_OFFSET, 0,
                                UVM_MAPFLAG(UVM_PROT_NONE, UVM_PROT_NONE,
                                    UVM_INH_NONE, UVM_ADV_NORMAL, 0)) != 0)
                        panic("startup: cannot allocate VM for msgbuf");
                v = (void *)minaddr;
                for (i = 0; i < sz; i += PAGE_SIZE) {
                        pmap_kenter_pa(minaddr + i, msgbuf_paddr + i,
                            VM_PROT_READ|VM_PROT_WRITE);
                }
                pmap_update(pmap_kernel());
        }
        initmsgbuf(v, sz);  << gets trapped inside initmsgbuf() and does not 
return

        printf("%s%s", copyright, version);

Something must be wrong with msgbuf_paddr that v points to.
There were no problems in arch/powerpc/oea/pmap.c where
msgbuf_paddr is allocated (checked with PMAPCHECK, PMAPDEBUG defined).

/usr/src/sys/kern/subr_log.c
void
initmsgbuf(void *bf, size_t bufsize)
{
        struct kern_msgbuf *mbp;
        long new_bufs;
        int iif = 0;

        /* Sanity-check the given size. */
        if (bufsize < sizeof(struct kern_msgbuf))
                return;

        mbp = msgbufp = (struct kern_msgbuf *)bf;

        new_bufs = bufsize - offsetof(struct kern_msgbuf, msg_bufc);

/* the if statement was reaaranged to access variables one after another */

        if (mbp->msg_magic != MSG_MAGIC)     iif |= 1;  << DSI trap comes here
        if (mbp->msg_bufs != new_bufs)       iif |= 2;
        if (mbp->msg_bufr < 0)               iif |= 4;
        if (mbp->msg_bufr >= mbp->msg_bufs)  iif |= 8;
        if (mbp->msg_bufx < 0)               iif |=16;
        if (mbp->msg_bufx >= mbp->msg_bufs)  iif |=32;

Any attempt to reference msgbuf_paddr, in this case pointed to by mbp results
is DSI exception as shown at the beginning of the message.

        if (iif) {
                /*
                 * If the buffer magic number is wrong, has changed
                 * size (which shouldn't happen often), or is
                 * internally inconsistent, initialize it.
                 */
                memset(bf, 0, bufsize);
                mbp->msg_magic = MSG_MAGIC;
                mbp->msg_bufs = new_bufs;
        }
        /* mark it as ready for use. */
        msgbufmapped = msgbufenabled = 1;
}