68030, 68040 and 68060 MMU support (really!)

[Toni Wilen]

winuae.zip updated yet again. Sarge's installer now runs (until it asks for non-existing CD..)

I guess Gayle IDE ATAPI CDROM emulation is needed next... (at least it is simpler than SCSI adapter emulation)

[gilgamesh]

Yeah, I've seen the installer running. I think the progress is simply incredible.

[Toni Wilen]

Originally Posted by gilgamesh

Yeah, I've seen the installer running. I think the progress is simply incredible.

Progress happened years ago in Aranym, I "only" needed to find how and what to merge without breaking everything else and without slowing down other emulation modes.

btw, you can press ALT+function key to open another console when installer is open and play with basic shell commands/look for /proc entries without need for real installation. Pointless and useless but so is running Linux on emulated Amiga

Remember that there is no:

- CDROM hardware emulation (except CD32/CDTV but I don't think Linux supports those..)
- Ethernet (uaenet is AmigaOS driver)
- Graphics card (Picasso96 is AmigaOS driver, only framebuffer is hardware emulated)

[mark_k]

Originally Posted by Toni Wilen

Bus type does not really matter much, hardware level SCSI/IDE CDROM is not worth the trouble. (Just for installing Linux = not worth the trouble. MMU at least can be used in AmigaOS side too)

[I guess this is getting off-topic for this thread, but...]

Rather than SCSI CD-ROM drive emulation, is there any possibility to "own" a real SCSI device connected to the PC's SCSI controller? In other words, all commands sent by the emulated Amiga are passed straight through to the drive and Windows wouldn't send any commands to the drive itself since WinUAE owns it.

[Toni Wilen]

Originally Posted by mark_k

[I guess this is getting off-topic for this thread, but...]

Rather than SCSI CD-ROM drive emulation, is there any possibility to "own" a real SCSI device connected to the PC's SCSI controller? In other words, all commands sent by the emulated Amiga are passed straight through to the drive and Windows wouldn't send any commands to the drive itself since WinUAE owns it.

It is possible (and off topic) but it requires real hardware access in separate thread or winuae would always pause when real CDROM is seeking or doing any other slow operation and I am not really interested just for mostly useless "real" cdrom emulation.

[Toni Wilen]

Network stuff moved, http://eab.abime.net/showthread.php?t=47388

[jotd]

Toni I just tested a little more today.

Looks like MMU is working in the WHDLoad context but with 2 bugs:

1) when there's an access fault, the PC is after the faulty instruction. On a real amiga, the PC is on the instruction (so resuming execution triggers access fault again)

2) I was able to use it only when I start with MMU on. If I enable it after having booted, it is not active. Maybe something to do with 68040.library at startup?

Anyway, this is not very convenient at the time being but looks very promising!!!

thanks

[Toni Wilen]

Originally Posted by jotd

Toni I just tested a little more today.

Looks like MMU is working in the WHDLoad context but with 2 bugs:

1) when there's an access fault, the PC is after the faulty instruction. On a real amiga, the PC is on the instruction (so resuming execution triggers access fault again)

Perhaps you tested write faults because they don't restart on 68040? (only on 68060 all faults restart. btw, 68060 MMU is nearly identical to 68040 MMU, only status registers and exception vectors are different. Perhaps 68060 MMU option is possible in future..)

EDIT: AFAIK 68040 can even delay write faults (writes are async), PC may not always point to immediately next instruction.. ("write" = instruction that does "normal" single write at the end, this does not include special cases like MOVEM to memory)

What was the exact instruction?

2) I was able to use it only when I start with MMU on. If I enable it after having booted, it is not active. Maybe something to do with 68040.library at startup?

I can guarantee that this is possible but I'll try

[Wepl]

my 68040 test machine is now configured, will next add full 68040 mmu support (Snoop/Protect) and afterwards test it with WinUAE

[jotd]

Wouldn't that be a dream if finding whdload access faults with WinUAE was possible?

[gilgamesh]

Finally found a way to install without that unsatisfied demand for a CDROM. Just use the initrd22.gz from hd-media folder (Sarge) as initial ramdisk. Now the installation hangs at the network adapter, so I will describe the problem in the appropriate thread.

[NewDeli]

I am not sure this will help much, but CheckMMU reports no cookie.

With a 040, SET040 is needed in the path to run it.
After installing
I simply typed

• SET040 fastrom
• checkMMU

and here is the result :



Oh, I am lamulating in case you hadn't notice yet .


To answer Kyon's question, the MMU is also used by WHDload.
So you might want to enable it. Check that your game icon doesn't have the nommu set, if that's the case put it into ().
In WHDload prefs, remove the ; in front of MMU and you're done.

This is especially useful with the latest WinUAE betas, in which the emulation is more accurate,
and a missing MMU is reported as an error by the slave (missing in the meaning : unticked in WinUAE).

[StingRay]

Originally Posted by Deleauvive

To answer Kyon's question, the MMU is also used by WHDload.
So you might want to enable it.

To quote Toni:

Originally Posted by Toni Wilen

It is only (possibly) useful if you are programmer or want to play with Linux (or other Unix based stuff). Just ignore it. Completely.

And this is 100% correct. You don't need any MMU support in WHDLoad if you aren't coding slaves.

[Toni Wilen]

Originally Posted by Deleauvive

I am not sure this will help much, but CheckMMU reports no cookie.

Works for me. Too old version? (latest beta is not new enough)

[Predabot]

Hey guys, did the development and testing of the MMU-support stop here? Seems like some people lost interest... But surely, MMU-support could lead to some cool stuff?

So... anything new to report?

[Toni Wilen]

MMU emulation works except there is some unknown corner case that is practically impossible to debug using current method (in Linux some user space programs crash randomly)

I don't really care about MMU in emulation, for me it was yet another interesting learning experience (how exactly 68040 MMU works etc..)

[gilgamesh]

Btw, did anybody succeed in installing NetBSD yet? You need a disk partitioning tool, which I don't have, for that. It's probably not hard with WB 2.0 or newer.

[Toni Wilen]

Possible good news: I was cleaning up MMU code (put back C++ exception handler now that WinUAE compiles as C++) and decided to disable some MMU table caching in MMU code (speed optimization)

NetBSD MMU error crash disappeared.

It seems cache gets out of sync in some situations ("slow" MMU table routines return "access ok" but cache says "nothing mapped here")

http://www.winuae.net/files/b/winuae.zip

I'll contact Aranym developers if I can't find any obvious reasons for this error (perhaps it is some Atari-specific assumption somewhere that simply won't work with Amiga or something..)

Hopefully it is now possible to create installed netbsd or linux hardfile

[alexh]

Heh, cool. Good work. I'm sure some nutters on here will be trying it as I type.

[Toni Wilen]

It works, Debian Sarge successfully installed.

dmesg:

Linux version 2.4.27-amiga (root@dl360-g3) (gcc version 2.95.4 20010319 (prerelease)) #1 Wed May 31 16:30:52 MDT 2006
Amiga hardware found: [A4000] VIDEO BLITTER AUDIO FLOPPY A4000_IDE KEYBOARD MOUSE SERIAL PARALLEL A3000_CLK CHIP_RAM PAULA LISA ALICE_PAL ZORRO3 
On node 0 totalpages: 131072
zone(0): 131072 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda1
Console: colour dummy device 80x25
Calibrating delay loop... 0.97 BogoMIPS
Memory: 515572k/524288k available (1544k kernel code, 7056k data, 116k init)
kmem_create: Forcing size word alignment - mm_struct
kmem_create: Forcing size word alignment - filp
kmem_create: Forcing size word alignment - dquot
Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
Inode cache hash table entries: 32768 (order: 6, 262144 bytes)
kmem_create: Forcing size word alignment - inode_cache
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
kmem_create: Forcing size word alignment - bdev_cache
kmem_create: Forcing size word alignment - cdev_cache
kmem_create: Forcing size word alignment - kiobuf
Buffer cache hash table entries: 32768 (order: 5, 131072 bytes)
Page-cache hash table entries: 131072 (order: 7, 524288 bytes)
POSIX conformance testing by UNIFIX
Zorro: Probing AutoConfig expansion devices: 3 devices
Zorro: Address space collision on device Zorro device 07db0300 (Hacker Test Board) [10000000:2fffffff]
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
kmem_create: Forcing size word alignment - file_lock_cache
VFS: Disk quotas vdquot_6.5.1
Journalled Block Device driver loaded
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x0
Console: switching to colour frame buffer device 80x25
fb0: Amiga AGA frame buffer device, using 1280K of video memory
clgen: Driver for Cirrus Logic based graphic boards, v1.9.9.1
clgen: no supported board found.
pty: 256 Unix98 ptys configured
Amiga-builtin serial driver version 4.30
ttyS00 is the amiga builtin serial port
Amiga mouse installed.
kmem_create: Forcing size word alignment - blkdev_requests
FD: probing units
found fd0 
Unable to get major 2 for floppy
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: loaded (max 8 devices)
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
ide0: Gayle IDE interface (A4000 style)
hda: UAE-IDE debian.vhd, ATA DISK drive
ide0 at 0x80dd2020 on irq 12
hda: attached ide-disk driver.
hda: 4096000 sectors (2097 MB) w/256KiB Cache, CHS=16253/4/63
hda: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }
hda: task_no_data_intr: error=0x04 { DriveStatusError }
Partition check:
 /dev/ide/host0/bus0/target0/lun0: RDSK p1 p2
SCSI subsystem driver Revision: 1.00
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP: routing cache hash table of 4096 buckets, 32Kbytes
TCP: Hash tables configured (established 131072 bind 65536)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
EXT3-fs: INFO: recovery required on readonly filesystem.
EXT3-fs: write access will be enabled during recovery.
kjournald starting.  Commit interval 5 seconds
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
VFS: Mounted root (ext3 filesystem) readonly.
Adding Swap: 122968k swap-space (priority -1)
EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,1), internal journal
eth0: A2065 at 0x00e90000, Ethernet Address 00:80:10:4d:5b:61
fd0: accessing DD 3.5-disk with Amiga-layout
fd0: accessing DD 3.5-disk with Amiga-layout
FAT: bogus logical sector size 17264
VFS: Can't find a valid FAT filesystem on dev 02:00.
fd0: accessing DD 3.5-disk with Amiga-layout

[gilgamesh]

Awesome, simply awesome!

[andreas]

EAB. Where Miracles Happen Every Day.™

(RCK, go make this a brand, already! (before someone beats you to it))

To a both more serious and technical note:

hda: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }
hda: task_no_data_intr: error=0x04 { DriveStatusError }

Now that the main uglinesses are finally ironed out, there is time to tackle the above, obviously rather minor issues.

Andreas, it may not be a problem at all.
http://www.captain.at/howto-linux-dr...tatuserror.php

The gist of those messages is that the drive may have received a command it did not understand. Maybe the linux driver is sending something odd, or maybe the emulated drive is missing a command. Or a timing issue possibly. Basically a command sent was not understood for some reason.

The fellow from the article does go on to say that you sometimes see those messages pop up in the kernel log on occasion with a healthy system.

In any event I'm off to go try it myself. Linux on Winuae - exciting!

[andreas]

Nonetheless, these messages do look ugly, whatsoever. (Always.)

[mark_k]

Hi,

In the MAME 0.141u3 changelog there is this:

M680x0 updates [Hans Ostermeyer]
* Instruction cache emulated on '020 and later
* Fixed interaction between MMU and bfextu/bfexts/bfins
* Added fsgldiv, fsglmul, and fscc FPU instructions
* Fixed fault address in stack frame
* Fixed supervisor violation bit in MMU status register
* Add fmovem modes 1 and 3
* Various other MMU fixes

I don't know if the MMU emulation was originally developed by the same author, but might WinUAE benefit from those fixes?

[Toni Wilen]

Probably something totally different and license incompatible anyway.

[Toni Wilen]

Next emulator "Previous" (http://previous.alternative-system.com/) has 68030 MMU under development (based on Aranym 68040 MMU/UAE CPU emulator) and is GPL compatible.

UAE 68030 MMU emulation probably will be done someday..

[Toni Wilen]

Previous 68030 MMU emulation is now working, UAE merge will happen..

EDIT:

Merge done. Mostly missing bus error exception handler implemented. Still some work do to.

A3000 boot ROM and Enforcer confirmed working!

[Toni Wilen]

Thread title changed. It is time to start testing 68030 MMU.

http://www.winuae.net/files/b/winuae.zip

Tested and seems to work:

A3000 1.3 SuperKickstart
Enforcer
WHDLoad (at least it does not crash)

Debian Linux finds root drive and then it seems to get in infinite bus error loop.
Amix should now technically work, not yet tested..
NetBSD not yet tested.

[Toni Wilen]

68060 MMU implemented, at least Enforcer works.

[mark_k]

Nice work! I'll try testing that with SetCPU FASTROM/KICKROM/CARDROM options and the MMULib tools MuFastROM, MuFastZero etc. Could possibly also be tested (by someone else ) with Emplant and/or ShapeShifter MMU-using video drivers and virtual memory software.

Now you just need to add SCSI tape drive emulation and I can try my copy of AMIX. [That's not entirely a joke. Adding minimal read-only support to at least allow the AMIX installer to read the tape might not actually be hugely difficult.]

[mark_k]

I tried out mmu.library and some programs which come with it: http://aminet.net/package/util/libs/MMULib

It seems that running anything which opens mmu.library (MuScan, MuFastROM, MuForce etc.) results in the machine resetting. WinUAE log output when that happens looks something like this:

68030 MMU enabled. Page size = 32768
Function code lookup enabled, FC = 6
Table FCL at 00202240: index = 6, Function code lookup enabled, FC = 6
Table FCL at 00202240: index = 6, Function code lookup enabled, FC = 1
Table FCL at 00202240: index = 1, Function code lookup enabled, FC = 6
Table FCL at 00202240: index = 6, Function code lookup enabled, FC = 5
Table FCL at 00202240: index = 5, MMU disabled
68030 MMU enabled. Page size = 1024
MMU: page fault (logical addr=00202286 SSW=0325 read=0 size=2 fc=5 pc=00f80be0)
MMU: page fault (logical addr=00202282 SSW=0305 read=0 size=4 fc=5 pc=00f80be0)
MMU: double bus error, rebooting..

Or with 68040+MMU CPU

Illegal instruction: 4e7a at 00363A2C -> 00363A3C
68040 MMU: enabled=0 page8k=0
68040 MMU: enabled=0 page8k=0
68040 MMU: enabled=1 page8k=0
MMU: double bus error, rebooting..
68040 MMU: enabled=0 page8k=0

[Toni Wilen]

Originally Posted by mark_k

It seems that running anything which opens mmu.library (MuScan, MuFastROM, MuForce etc.) results in the machine resetting.

Works fine here (both 68030 and 68040)

MMU: page fault (logical addr=00202286 SSW=0325 read=0 size=2 fc=5 pc=00f80be0)
MMU: page fault (logical addr=00202282 SSW=0305 read=0 size=4 fc=5 pc=00f80be0)

This makes no sense if you have RAM at 00200000. These messages means 00202282 is write protected or mapped as invalid..

[mark_k]

Originally Posted by Toni Wilen

EDIT: Actually it does not get that far, it tries to find SCSI HD but it accesses DMAC/SCSI chip quite differently compared to A590/A2091/A3000 Amiga boot roms and it hangs.. Need to implement missing WD SCSI chip functionality first.

Could the files /usr/sys/amiga/alien/a2091.c and /usr/sys/amiga/alien/a3091.c in the AMIX kernel configuration package (conf.cpio) be of any help there?

I'll try testing the MMULib tools when booting from a clean floppy disk and report back.

[Toni Wilen]

Amix and wd33c93 stuff moved to separate threads.

[mark_k]

Would you be able to build a winuae.exe which pauses emulation or halts on a double bus error?

Hopefully I can use something like SnoopDOS to figure out what system functions are being called before I get the crash/reboot, and see the details on screen before the crash. As far as I remember the Mu... tools did work from this hard disk on my real 68030 A2000. (I tried booting/running them from a clean floppy disk and they do work from there in WinUAE.)

[Toni Wilen]

Originally Posted by mark_k

Would you be able to build a winuae.exe which pauses emulation or halts on a double bus error?

Done. Now CPU halts (just like real CPU would do)

[mark_k]

Thanks. That allowed me to use SnoopDOS and see ENV:MMU-Configuration was being read shortly before the hang. It turns out I had an entry to write-protect $200000-$27FFFF. The Kickstart image was loaded there by ReKick on my A2000, but I recently changed my emulated config to use 3.1 ROM not ReKick, so there was actually RAM there.

In the case when the CPU is halted, is it worth telling the user that somehow? Also I noticed the CPU indicator still reads 100% when the CPU is halted.

[Toni Wilen]

Originally Posted by mark_k

Thanks. That allowed me to use SnoopDOS and see ENV:MMU-Configuration was being read shortly before the hang. It turns out I had an entry to write-protect $200000-$27FFFF. The Kickstart image was loaded there by ReKick on my A2000, but I recently changed my emulated config to use 3.1 ROM not ReKick, so there was actually RAM there.

Bah, not an emulation bug

In the case when the CPU is halted, is it worth telling the user that somehow? Also I noticed the CPU indicator still reads 100% when the CPU is halted.

I changed it to show "HALTx" where x = halt reason code (I also changed all non-MMU related insta-resets to halts), OSD CPU% becomes yellow and shows Hx.

[Wepl]

I started to check the 68030 with WHDLoad and my qa.slave.
There is a strange fault with many (but not all) checks while whdload is leaving and saving the contents of the custom registers.

winuaelog.txt

51-703 [1498 107-010]: MMU: page fault (logical addr=00BFDE00 SSW=0315 read=0 size=1 fc=5 pc=009d5ec4)
51-703 [1498 132-011]: MMU: page fault (logical addr=00BFDF00 SSW=0315 read=0 size=1 fc=5 pc=009d5ee4)
51-703 [1498 220-013]: MMU: page fault (logical addr=00DFF002 SSW=0365 read=1 size=2 fc=5 pc=009d5f78)
51-703 [1498 108-014]: MMU: page fault (logical addr=009F7474 SSW=0325 read=0 size=2 fc=5 pc=009d5f78)
51-703 [1498 121-015]: MMU disabled

.whdl_register

************************* 04-Jan-13 13:00:43 ************************17.2.5225***
Slave='QA.Slave' (14320 bytes)
ShadowMem   52D940 -   539940 (  49152) AbsolutMem     C000 -    40000 ( 212992)
Resload     9D5000 -   9DC2D8 (  29400) at 9D5000  GL=$9EF000
Slave       9F8000 -   9FB7CC (  14284) at 9F8000  BaseMemSize=$40000
ExpMem      9DE000 -   9EE000 (  65536) at 9DE000
attn=207(UAE,30) fc=4 kn=1000 cs=FD26 rw=0 zpt=-1 ep=0 ei=0
setcpu=33D(DC,IC,SCB,ECB,BNC)

Exception "Access Fault" ($B008) PC = $9D5F78 (Resload $F78) Word Write to
$9F7474

$009d5f3a move.b       ($200,a5),(4,a1)               ;$009f1200 $00dff004
$009d5f40 move.b       (a5),(2,a1)                    ;$009f1000 $00dff002
$009d5f44 move.b       ($300,a5),(5,a1)               ;$009f1300 $00dff005
$009d5f4a move.b       ($100,a5),(3,a1)               ;$009f1100 $00dff003
$009d5f50 move.b       ($c00,a6),($16,a0)             ;$009f2910 $009f6442
$009d5f56 move.b       ($c00,a5),($16,a1)             ;$009f1c00 $00dff016
$009d5f5c move.l       d4,a1
$009d5f5e lea          ($2d10,a4),a6                  ;$009f1d10
$009d5f62 lea          ($2000,a4),a5                  ;$009f1000
$009d5f66 moveq        #0,d0
$009d5f68 btst         #0,(0,a6,d0.w)                 ;$009f1d12
$009d5f6e beq.b        $9d5f7e
$009d5f70 btst         #1,(0,a6,d0.w)                 ;$009f1d12
$009d5f76 bne.b        $9d5f7e
$009d5f78 move.w       (0,a1,d0.w),(0,a5,d0.w)        ;$00dff002 $009f1002
$009d5f7e addq.w       #2,d0
$009d5f80 cmpi.w       #$1fe,d0
$009d5f84 bls.b        $9d5f68
$009d5f86 move.w       (2,a1),d1                      ;$00dff002
$009d5f8a andi.w       #$180,d1
$009d5f8e beq.b        $9d5fa4
$009d5f90 move.w       #$f00,d0
$009d5f94 bsr.w        $9d65b4
$009d5f98 move.w       #$7fff,($96,a1)                ;$00dff096
$009d5f9e move.w       #$7fff,($9a,a1)                ;$00dff09a
$009d5fa4 move.w       ($1c,a1),d1                    ;$00dff01c
$009d5fa8 andi.w       #$7fff,d1
$009d5fac beq.b        $9d5fc2
$009d5fae move.w       #$f,d0

exception stackframe:
$009EBF44 2700009D 5F78B008 00000325 00000000 009F7474 00003BB1 00002000 00000000
$009EBF64 00000000 009F7474 00008000 009F7474 00000000 00000003 00000000 00000000
$009EBF84 00000000 00000000 00000000 00002000 0000B008 00DF2000 00000000
regular stack:
$009EBFA0 2000009F A670B008 00000325 00000000 00DFF084 00003D41 00000001 00000000
$009EBFC0 00000000 00DFF084 00000000 00DFF084 00000000 00000001 00000000 00000000
$009EBFE0 00000000 00000000 00000000 00000000 00000000 00000001 00000084 009F82D6
$009EC000 DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD
$009EC020 DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD DDDDDDDD

  ----0---- ----1---- ----2---- ----3---- ----4---- ----5---- ----6---- ----7----
Dx        2         0         0         2    DFF000  D5D5D5D5    9D5C1A  D7D70207
Ax   9F642C    DFF000    9F6318    9F646C    9EF000    9F1000    9F1D10

                 TTSM III   XNZVC
›1mPC=  9D5F78›22m  SR %0010011100000000  USP=3FC00  ›1mISP=9EBF44  ›22mMSP=3F800
VBR=9F0000  SFC=4  DFC=4  CACR=2101  CAAR=0  TT0=00FF8540  TT1=00000000
TC=00000000  CRP=80000002009FE000  SRP=80000002009FE000  MMUSR=0000

         MEDRAAAABVCPSDT          YZ  PMRCBSDAAAA
intena=%›1m0000000000000000›22m dmacon=%›1m0010000000000000›22m adkcon=$1100
intreq=%›1m0000000000100000›22m
vposr....A100  vhposr...01DC  joy0dat..0200  joy1dat..0000  clxdat...8000  
pot0dat..0000  pot1dat..0000  potinp...5500  serdatr..3000  dskbytr..0000  
vposw....F004  bltafwm..FFFF  bltalwm..FFFF  cop1lc...0000  cop1lcl..5000  
cop2lc...0000  cop2lcl..5000  spr0ctl..0000  spr0data.0000  spr0datb.0000  
spr1ctl..0000  spr1data.0000  spr1datb.0000  spr2ctl..0000  spr2data.0000  
spr2datb.0000  spr3ctl..0000  spr3data.0000  spr3datb.0000  spr4ctl..0000  
spr4data.0000  spr4datb.0000  spr5ctl..0000  spr5data.0000  spr5datb.0000  
spr6ctl..0000  spr6data.0000  spr6datb.0000  spr7ctl..0000  spr7data.0000  
spr7datb.0000

but (0,a5,d0.w) should point to $009f1002 and not to $9F7474 as the access fault tells

is there maybe a bug?

to reproduce:

whdload qa.slave mmu custom1=92325 SplashDelay=0

qa.slave is in WHDLoad_dev at WHDLoad/Src/qa