On Thu, Apr 30, 2009 at 12:41:30PM +0200, Manuel Lauss wrote: > This is really embarrassing: The oops is what happens when you > ioremap(0x10) and write 0xffffffff at the resulting address (0xa0000010). That address is the TLB reload handler. You just overwrote the TLB exception hander. 0xffffffff is sd $31, -1($31) which is a MIPS III that is 64-bit instruction which the Alchemy core duly honors with a reserved instruction exception. The handler is running with c0_status.exl=1 so the EPC will point to the LL instruction but the exception printed in the panic will be the 2nd exception. Case closed, I'd say. Ralf
