On Mon, Dec 17, 2018 at 10:29:18AM +0100, Christophe Leroy wrote: > > With patches 1-3: > > [ 0.000000] setbat(0, c0000000, 00000000, 01000000, 311) > > [ 0.000000] setbat(2, c1000000, 01000000, 00800000, 311) > > [ 0.000000] setbat(4, d0000000, 10000000, 02000000, 791) > > What we see is that BAT0 is not used in the origin. I have always wondered > the reason, maybe there is something odd behind and BAT0 shall no ne used. > > Could you try and modify find_free_bat() so that it starts at b = 1 instead > of b = 0 ? In this case, setbat is called with index 2, 3, and 4, but the Wii still doesn't boot. > > According to arch/powerpc/include/asm/book3s/32/hash.h, > > - 0x591 = _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_COHERENT | _PAGE_PRESENT > > - 0x311 = _PAGE_EXEC | _PAGE_ACCESSED | _PAGE_COHERENT | _PAGE_PRESENT > > - 0x791 = _PAGE_RW | _PAGE_EXEC | _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_COHERENT | _PAGE_PRESENT > > > > Yes, patch 1 added _PAGE_EXEC which explains this 0x200. > Do you confirm it still works well with only patch 1 ? Patch 1 alone boots to userspace. Jonathan