On Sun, 1 May 2005 15:53:12 +0200
R=E9mi Zara <remi_zara@mac.com> wrote:

> > Let me rephrase - where does this instruction branch to?  You can =20
> > do an
> > objdump on just the openfirm.o file.
>=20
> I'm not sure I'm counting right, but it seems to branch on itself

That's just because it hasn't been run through the linker.

        ofw_stack();
        if (buflen > PAGE_SIZE)
                return -1;=20
        args.phandle =3D handle;
        args.prop =3D prop;
        args.buf =3D OF_buf;
        args.buflen =3D buflen;
        if (openfirmware(&args) =3D=3D -1)
                return -1;
        if (args.size > buflen)
                args.size =3D buflen;
        if (args.size > 0)
                ofbcopy(OF_buf, buf, args.size);
        return args.size;=20


> 000001d8 <OF_getprop>:
> 1d8:   94 21 ff d0     stwu    r1,-48(r1)
> 1dc:   7c 08 02 a6     mflr    r0
> 1e0:   93 c1 00 28     stw     r30,40(r1)
> 1e4:   7c de 33 78     mr      r30,r6
> 1e8:   93 41 00 18     stw     r26,24(r1)
> 1ec:   3f 40 00 00     lis     r26,0
> 1f0:   93 61 00 1c     stw     r27,28(r1)
> 1f4:   7c bb 2b 78     mr      r27,r5
> 1f8:   93 81 00 20     stw     r28,32(r1)
> 1fc:   7c 9c 23 78     mr      r28,r4
> 200:   93 a1 00 24     stw     r29,36(r1)
> 204:   7c 7d 1b 78     mr      r29,r3
> 208:   93 e1 00 2c     stw     r31,44(r1)
> 20c:   90 01 00 34     stw     r0,52(r1)
> 210:   48 00 00 01     bl      210 <OF_getprop+0x38>

        ofw_stack();

> 214:   2c 1e 10 00     cmpwi   r30,4096
> 218:   3d 20 00 00     lis     r9,0
> 21c:   3b e9 00 00     addi    r31,r9,0
> 220:   38 a0 ff ff     li      r5,-1
> 224:   7f e3 fb 78     mr      r3,r31
> 228:   41 81 00 5c     bgt-    284 <OF_getprop+0xac>

        if (buflen > PAGE_SIZE)
                return -1;=20

284 is the return route.

> 22c:   80 1a 00 00     lwz     r0,0(r26)
> 230:   93 bf 00 0c     stw     r29,12(r31)
> 234:   93 9f 00 10     stw     r28,16(r31)
> 238:   93 df 00 18     stw     r30,24(r31)
> 23c:   90 1f 00 14     stw     r0,20(r31)

        args.phandle =3D handle;
        args.prop =3D prop;
        args.buf =3D OF_buf;
        args.buflen =3D buflen;

> 240:   48 00 00 01     bl      240 <OF_getprop+0x68>
> 244:   38 a0 ff ff     li      r5,-1
> 248:   2c 03 ff ff     cmpwi   r3,-1
> 24c:   41 82 00 38     beq-    284 <OF_getprop+0xac>

        if (openfirmware(&args) =3D=3D -1)
                return -1;

> 250:   80 7f 00 1c     lwz     r3,28(r31)
> 254:   7f 64 db 78     mr      r4,r27
> 258:   7c 03 f0 00     cmpw    r3,r30
> 25c:   40 81 00 0c     ble-    268 <OF_getprop+0x90>
> 260:   93 df 00 1c     stw     r30,28(r31)      =20

        if (args.size > buflen)
                args.size =3D buflen;

> 264:   7f c3 f3 78     mr      r3,r30
> 268:   2c 03 00 00     cmpwi   r3,0
> 26c:   7c 65 1b 78     mr      r5,r3
> 270:   40 81 00 10     ble-    280 <OF_getprop+0xa8>

        if (args.size > 0)
                ofbcopy(OF_buf, buf, args.size);

> 274:   80 7a 00 00     lwz     r3,0(r26)
> 278:   48 00 00 01     bl      278 <OF_getprop+0xa0>
> 27c:   80 7f 00 1c     lwz     r3,28(r31)
> 280:   7c 65 1b 78     mr      r5,r3

return route, which takes the result to be returned (args.size) from r5
and returns it via r3:

> 284:   80 01 00 34     lwz     r0,52(r1)
> 288:   7c a3 2b 78     mr      r3,r5
> 28c:   83 41 00 18     lwz     r26,24(r1)
> 290:   83 61 00 1c     lwz     r27,28(r1)
> 294:   7c 08 03 a6     mtlr    r0
> 298:   83 81 00 20     lwz     r28,32(r1)
> 29c:   83 a1 00 24     lwz     r29,36(r1)
> 2a0:   83 c1 00 28     lwz     r30,40(r1)
> 2a4:   83 e1 00 2c     lwz     r31,44(r1)
> 2a8:   38 21 00 30     addi    r1,r1,48
> 2ac:   4e 80 00 20     blr

So it appears the exception occurs when there is a jump back into the OF
client interface (openfirmware(&args)).

This is possibly the problem:

ENTRY(openfirmware)
        mflr    0                       /* save return address */
        stw     0,4(1) =20
        stwu    1,-16(1)                /* setup stack frame */
       =20
        mfmsr   4                       /* save msr */
        stw     4,8(1)
 =20
        lis     4,openfirmware_entry@ha /* get firmware entry point */
        lwz     4,openfirmware_entry@l(4)
        mtlr    4=20
 =20
        li      0,0                     /* clear battable translations*/
       mtdbatu 2,0
        mtdbatu 3,0
        mtibatu 2,0
        mtibatu 3,0
       =20
The 601 BAT settings are not the same as the rest of the PowerPC
architecture.  The above wipes out the BAT mapping.  Have you moved Open
Firmware above 8M?

tim