Re: badaddr() panics when TT is enabled

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

> Here is a patch.
> According to 68030 Users' Manual (Fig.9-39 in p.9-62), the T bit of
> MMUSR should be checked before any other bits.

Looks correct.
At least a patched GENERIC kernel works on my NWS-1750:
---


Testing memories................ done.
16M bytes available.

SONY NET WORK STATION MC68030 Monitor Release 1.1B
Model NWS-1750, Machine ID #10557, Ethernet address 08:00:46:00:35:36

NEWS> bo
NetBSD/news68k Primary Boot
NetBSD/news68k Secondary Boot, Revision 1.8 (Thu Aug  4 15:30:37 UTC 2022) (from NetBSD 9.3)
Booting hd(0,0,0)
3066604+104572 [236528+223913]=0x376ddc

[   1.0000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003,
[   1.0000000]     2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013,
[   1.0000000]     2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023
[   1.0000000]     The NetBSD Foundation, Inc.  All rights reserved.
[   1.0000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
[   1.0000000]     The Regents of the University of California.  All rights reserved.

[   1.0000000] NetBSD 10.99.3 (GENERIC) #2: Wed Apr 12 23:12:40 JST 2023
[   1.0000000] 	tsutsui@mirage:/s/cvs/src/sys/arch/news68k/compile/GENERIC
[   1.0000000] SONY NET WORK STATION, Model NWS-1750, Machine ID #10557
[   1.0000000] total memory = 16368 KB
[   1.0000000] avail memory = 11976 KB
[   1.0000000] mainbus0 (root)
[   1.0000000] hb0 at mainbus0
[   1.0000000] le0 at hb0 addr 0xe0f00000 ipl 4: address 08:00:46:00:35:36
[   1.0000000] le0: 8 receive buffers, 2 transmit buffers
[   1.0000000] timer0 at hb0 addr 0xe1000000 ipl 6
[   1.0000000] mkclock0 at hb0 addr 0xe0d80000: mk48t02
[   1.0000000] kbc0 at hb0 addr 0xe0d00000 ipl 5
[   1.0000000] kb0 at kbc0
[   1.0000000] wskbd0 at kb0 (mux ignored)
[   1.0000000] ms0 at kbc0
[   1.0000000] wsmouse0 at ms0 (mux ignored)
[   1.0000000] zsc0 at hb0 addr 0xe0d40000 ipl 5 vect 64
[   1.0000000] zstty0 at zsc0 channel 0 (console i/o)
[   1.0000000] zstty1 at zsc0 channel 1
[   1.0000000] si0 at hb0 addr 0xe0cc0000 ipl 4
[   1.0000000] scsibus0 at si0: 8 targets, 8 luns per target
[   1.0400030] scsibus0: waiting 2 seconds for devices to settle...
[   1.2000030] WARNING: system needs entropy for security; see entropy(7)
[   3.0600030] sd0 at scsibus0 target 0 lun 0: <MELCO, DSC-UE8.3G, 1.05> disk fixed
[   3.1000030] sd0: 8010 MB, 18988 cyl, 8 head, 108 sec, 512 bytes/sect x 16405632 sectors
[   3.1300030] sd0: async, 8-bit transfers
[   6.2800030] st0 at scsibus0 target 5 lun 0: <WANGTEK, SCSI-36, A> tape removable
[   6.3100030] st0: drive empty
[   6.3300030] st0: async, 8-bit transfers
[   7.1300030] swwdog0: software watchdog initialized
[   7.1400030] boot device: sd0
[   7.1800030] root on sd0a dumps on sd0b
[   7.2600030] root file system type: ffs
[   7.2800030] kern.module.path=/stand/news68k/10.99.3/modules
Wed Apr 12 14:15:26 GMT 2023
Starting root file system check:

 :
---

Some comments:

> --- a/src/sys/arch/m68k/m68k/busaddrerr.s
> +++ b/src/sys/arch/m68k/m68k/busaddrerr.s
> @@ -219,7 +219,12 @@ Lbe10:
>  	jeq	Lbe10a			| if no, done
>  	movql	#5,%d0			| else supervisor program access
>  Lbe10a:
> -	ptestr	%d0,%a0@,#7		| do a table search
> +	ptestr	%d0,%a0@,#0		| check without table search

I prefer a comment like "check entire the ATC" per UM 9.7.4.

> +	pmove	%psr,%sp@

Put "save result" comment as the existing #7 check?

> +	movw	%sp@,%d1
> +	btst	#6,%d1			| TT?

Also prefer "transparent (TT0 or TT1)?" or so per UM Table 9-3.

> +	jne	Lisberr1		| yes -> bus error
> +	ptestr	%d0,%a0@,#7		| no, do a table search
>  	pmove	%psr,%sp@		| save result
>  	movb	%sp@,%d1
>  	btst	#2,%d1			| invalid (incl. limit viol. and berr)?


> I have confirmed it on luna68k (real LUNA-I):
>  - lcd_match() uses badaddr().  It works on an address that
>    device is present even with above patch.
>  - The following is a PoC patch.  0xc0000000 on LUNA-I is in TT
>    area and causes a bus error.  badaddr() without above patch
>    panics for this address but with above patch don't panic.

How about enabling enabling badaddr() in spc_mainbus_match()
and specify the second SPC on LUNA-I?
(I should check it myself but I'm a bit lazy)

---
Izumi Tsutsui