refactored assembler routines from exceptions.S into mmu.c (access exception handler). Seems to be better, but still hang.

.gdbinit

@@ -1,7 +1,7 @@
 #set disassemble-next-line on
 define tr
-	#target remote | m68k-bdm-gdbserver pipe /dev/bdmcf3
+	target remote | m68k-bdm-gdbserver pipe /dev/bdmcf3
-	target remote | m68k-bdm-gdbserver pipe /dev/tblcf3
+	#target remote | m68k-bdm-gdbserver pipe /dev/tblcf3
 	#target dbug /dev/ttyS0
 	#monitor bdm-reset
 end

Makefile

@@ -32,6 +32,7 @@ NATIVECC=gcc
 INCLUDE=-Iinclude
 CFLAGS=-mcpu=5474 \
 		-Wall \
+		-g \
 		-Os \
 		-fomit-frame-pointer \
 		-ffreestanding \
@@ -246,7 +247,7 @@ define EX_TEMPLATE
 $(1)_MAPFILE=$(1)/$$(basename $$(FLASH_EXEC)).map
 $(1)/$$(FLASH_EXEC): $(1)/$(LIBBAS) $(LDCSRC)
 	$(CPP) $(INCLUDE) -DOBJDIR=$(1)/objs -P -DFORMAT_ELF=$(FORMAT_ELF) -D$$(MACHINE) $(LDCSRC) -o $(1)/$$(LDCFILE)
-	$(LD) --oformat $$(FORMAT) -Map $$($(1)_MAPFILE) --cref -T $(1)/$$(LDCFILE) -o $$@
+	$(LD) -g --oformat $$(FORMAT) -Map $$($(1)_MAPFILE) --cref -T $(1)/$$(LDCFILE) -o $$@
 ifeq ($(COMPILE_ELF),Y)
 	$(OBJCOPY) -O srec $$@ $$(basename $$@).s19
 else

sys/exceptions.S

@@ -391,14 +391,10 @@ reset_vector:
 // cannot use the supervisor stack in here. Therefore we first switch to a safe stack
 // (RAMBAR0, the processor internal SRAM)
 access_exception:
-		// no point in disabling interrupts within an exception handler
-		// move.w	#0x2700,sr			// disable interrupt
-
-
 		// save current SSP
 
 		move.l	sp,__SUP_SP			// defined in linker script: top of SRAM0
-		lea		__SUP_SP - 4,sp		// now we can savely use the stack
+		lea		__SUP_SP - 4,sp		// now we can savely use this as stack
 
 		// save gcc scratch registers, others will be handled by called function
 		lea		-4*4(sp),sp
@@ -407,32 +403,20 @@ access_exception:
 		
 		move.l	__SUP_SP,a0			// original stack pointer
 
-		move.l	4(a0),-(sp)			// format status word
+		move.l	(a0),-(sp)			// format status word
-		move.l	(a0),-(sp)			// program counter at access error
+		move.l	4(a0),-(sp)			// program counter at access error
 
-		jsr		_access_exception
+		jsr		_access_exception	// note the undescore
 		lea		2*4(sp),sp			// adjust stack
 
 		tst.l	d0					// handled?
-		bne		bus_error
+		beq		bus_error			// no
 
 		movem.l	(sp),d0-d1/a0-a1	// restore scratch registers
 		lea		4*4(sp),sp
 
-		
-		move.l	(sp)+,a0
-		move.l	(sp)+,d0
-		move.l	__SUP_SP,sp
-
-		bra		bus_error			// everything else is a classic bus error
-
-		movem.l	(sp),d0-d1/a0-a2	// restore gcc scratch registers
-		lea		5*4(sp),sp
-
 		// revert stack trickery
 
-		move.l	(sp)+,a0
-		move.l	(sp)+,d0
 		move.l	__SUP_SP,sp
 
 
@@ -440,10 +424,11 @@ access_exception:
 
 bus_error:
 
+		movem.l	(sp),d0-d1/a0-a1	// restore scratch registers
+		lea		4*4(sp),sp
+
 		// revert stack trickery
 
-		move.l	(sp)+,a0
-		move.l	(sp)+,d0			// restore register
 		move.l	__SUP_SP,sp			// restore original stack
 
 		bra		std_exc_vec

sys/mmu.c

@@ -60,12 +60,12 @@
 #error "unknown machine!"
 #endif /* MACHINE_FIREBEE */
 
-//#define DEBUG_MMU
+#define DBG_MMU
-#ifdef DEBUG_MMU
+#ifdef DBG_MMU
 #define dbg(format, arg...) do { xprintf("DEBUG: " format, ##arg);} while(0)
 #else
 #define dbg(format, arg...) do {;} while (0)
-#endif /* DEBUG_MMU */
+#endif /* DBG_MMU */
 
 /*
  * set ASID register
@@ -404,12 +404,14 @@ bool access_exception(uint32_t pc, uint32_t format_status)
 	int fault_status;
 	uint32_t fault_address;
 	bool is_tlb_miss = false;	/* assume access error is not a TLB miss */
-	extern uint8_t __FASTRAM_END[];
+	extern uint8_t _FASTRAM_END[];
-	uint32_t FASTRAM_END = (uint32_t) &__FASTRAM_END[0];
+	uint32_t FASTRAM_END = (uint32_t) &_FASTRAM_END[0];
 
-	fault_status = (((format_status & 0xc000000) >> 26) |
+	fault_status = (((format_status & 0xc000000) >> 24) |
 					((format_status & 0x30000) >> 16));
 
+	dbg("%s: pc=%p, format_status = %p, fault_status = 0x%x\r\n", __FUNCTION__, pc, format_status, fault_status);
+
 	/*
 	 * determine if access fault was caused by a TLB miss
 	 */
@@ -419,6 +421,7 @@ bool access_exception(uint32_t pc, uint32_t format_status)
 		case 0x6:	/* TLB miss on extension word of instruction fetch */
 		case 0xa:	/* TLB miss on data write */
 		case 0xe:	/* TLB miss on data read or read-modify-write */
+			dbg("%s: access fault because of TLB miss at %p\r\n", __FUNCTION__, pc);
 			is_tlb_miss = true;
 			break;
 
@@ -449,13 +452,13 @@ bool access_exception(uint32_t pc, uint32_t format_status)
 			}
 		}
 	}
-	return is_tlb_miss;
+	return false;
 }
 
 
 void mmutr_miss(uint32_t address)
 {
-	dbg("MMU TLB MISS at 0x%08x\r\n", address);
+	dbg("MMU TLB MISS accessing 0x%08x\r\n", address);
 	flush_and_invalidate_caches();
 
 	/* add missed page to TLB */