> Though I tried to see source of binutils, it didn't find that
> 'bnlsr' was said. I rewrote `bnlsr' of src/lib/libc/arch/powerpc/SYS.h
> to `bnslr', and compiled.
> # I chose 'bnslr' though I didn't know it well :-)

This is correct.

> init: copying out flags `-s' 3
> init: copying out path `/sbin/init' 11
> exc_isi|exc_user srr1=0x4000d032 at 0x40074
> exc_dsi|exc_user=0xa7988 dsisr=0x42000000 at 0x400b0
> exc_dsi|exc_user=0xa9674 dsisr=0xa000000 at 0x400d8
> exc_isi|exc_user srr1=0x4000d032 at 0x43460
> exc_dsi|exc_user=0xacd34 dsisr=0x42000000 at 0x434d0
> exc_isi|exc_user srr1=0x4000d032 at 0x64814
> exc_isi|exc_user srr1=0x4000d032 at 0x4ec80
> exc_isi|exc_user srr1=0x4000d032 at 0x5912c
> exc_isi|exc_user srr1=0x4000f032 at 0x5e794
> exc_dsi|exc_user=0x6737c dsisr=0x42000000 at 0x5e7b8
> trapsignal

Hmm, don't know why init would get a segmentation violation here.  If you
didn't already, compile init with -g and look where the offending address in
the code is and how it got there.  Depending on your implementation of DDB
you might also want to set a breakpoint at vm_fault and look why it doesn't
want to give init access to the page at 67000.

> Stopped at      Debugger+0x10:  lwz r0, r1, 0x14,
> db> ps
>   pid proc     addr     uid  ppid  pgrp  flag stat em  comm         wchan
>     2 0xe048fe00 0xed089000   0     0     0  000204  3  netbsd  pagedaemon   th
> rd_sleep 0xd5d20
>     1 0xe048a100 0xed085000   0     0     0  004004  2  netbsd  init
>     0 0xdb3b0 0x104000   0    -1     0  000204  3  netbsd  swapper   scheduler 0
> xdb3b0
> db> c
> Process (pid 1) got signal 11
> exc_dsi|exc_user=0x6737c dsisr=0x42000000 at 0x5e7b8
> trapsignal
> Stopped at      Debugger+0x10:  lwz r0, r1, 0x14,

This is to be expected after the above.
-- 
ws@TooLs.DE     (Wolfgang Solfrank, TooLs GmbH) 	+49-228-985800