There are two blobs embedded into the u-boot image which are linked to run
at an address which is different from where they actually end up in the
ROM, one called "realmode" and one called "bios". There are realmode_setup
and bios_setup functions which prepare those blobs by copying them into the
location they're supposed to run from, among other things.
During u-boot relocation from ROM to RAM, the text and a few data segments
are copied over. The realmode and bios sections are not copied, and so the
only place they can be read from is their original location in the ROM.
Looking specifically at the bios blob, there are symbols defined in the
linker script called __bios_start and __bios_size which are defined to be
the start and size of the blob in the ROM.
In the bios_setup function, there seem to be two mistakes happening. First,
the offset from ROM to RAM is being added to __bios_start which implies that
this code expects to use the copy moved to RAM. No such copy is made, so
that's wrong. More subtly, when u-boot relocates itself, it goes through
all of the relocations stored in .rel.dyn and fixes them up. This has the
effect of transforming the __bios_start reference in bios_setup so that it
refers to the version in RAM (if one existed) instead of the one in ROM. To
correct for that, the offset actually needs to be subtracted out again to
translate the address back into the ROM.
The net effect is that for both blobs, a + needs to be changed to a -.
Signed-off-by: Gabe Black <gabeblack@chromium.org>