Jump from assembly to C problem with boot code on MCF52233

[Petter]

Hello,

I am in the process of making a boot-code for field flash upgrade of the
MCF52233. The MCF52235EVB is "compatible" with our product, and the
software without boot-code is similar to this:
http://forums.freescale.com/freescale/board/message?board.id=CFCOMM&thread.id=2553
(which is a minimal TCP/IP stack without a RTOS running from flash on
the MCF52235EVB, and can be compiled with the CodeSourcery toolchain)

My problem occurs when jumping from assembly to C language in the
application-code (boot-code runs initially and does this "switch"
flawlessly).

The output from gdb and my debugger (BDI2000) at the problem location:
----- 8< ----- 8< -----
(gdb) monitor rd
D0 : 00000000 00000000 00000030 00000006
D4 : 00000018 a661a87d c40f9216 56d33015
A0 : 00000000 44035a4c 200000fc 401d0024
A4 : 1d047492 667d0fa0 00000000 20007ff0
PC : 00027fac     SR : 00002704
(gdb) monitor info
    Target state      : debug mode
    Debug entry cause : single step
    Current PC        : 0x00027fac
(gdb) monitor ti
    Target state      : debug mode
    Debug entry cause : single step
    Current PC        : 0x00000466
(gdb) monitor rd
D0 : 00000000 00000000 00000030 00000006
D4 : 00000018 a661a87d c40f9216 56d33015
A0 : 00000000 44035a4c 200000fc 401d0024
A4 : 1d047492 667d0fa0 00000000 20007fe8
PC : 00000466     SR : 00002704
(gdb) 
----- 8< ----- 8< -----

The code at 0x466 is the default vector handler for the boot-code, and
seems to be related to an exception. The RAM vector table for the
application-code (with exception "decoding") has not been set up yet.

The disassembly before and after the jump:
----- 8< ----- 8< -----
   1001c:       7000            moveq #0,%d0
   1001e:       7200            moveq #0,%d1
   10020:       2f08            movel %a0,%sp at -
   10022:       2f00            movel %d0,%sp at -
   10024:       2f01            movel %d1,%sp at -
   10026:       2f0e            movel %fp,%sp at -
   10028:       4ef9 0002 7fac  jmp 27fac <__start1>
----- 8< ----- 8< -----
00027fac <__start1>:
   27fac:       4e56 fffc       linkw %fp,#-4
   27fb0:       2f02            movel %d2,%sp at -
   27fb2:       203c 0003 5550  movel #218448,%d0
   27fb8:       0c80 2000 0000  cmpil #536870912,%d0
   27fbe:       672e            beqs 27fee <__start1+0x42>
----- 8< ----- 8< -----

Here is some parts of relevant pieces in the linker script (...
indicates removed stuff):
----- 8< ----- 8< -----
OUTPUT_ARCH(m68k)
ENTRY(__start)
SEARCH_DIR(.)
__DYNAMIC  =  0;

MEMORY
{
  rom (rx) : ORIGIN = 64K, LENGTH = 192K
  ram (rwx) : ORIGIN = 512M, LENGTH = 32K
  bootloader (rx) : ORIGIN = 0K, LENGTH = 48K
  bootconst (rx) : ORIGIN = 48K, LENGTH = 16K
}

PROVIDE (__stack = ORIGIN (ram) + LENGTH (ram));
...

SECTIONS
{
  .text :
  {
    CREATE_OBJECT_SYMBOLS
    *(.app_start .app_start.*)
    *(.text .text.*)
    *(.gnu.linkonce.t.*)
    ...
    . = ALIGN(0x4);
    __INIT_SECTION__ = . ;
    LONG (0x4e560000)	/* linkw %fp,#0 */
    *(.init)
    SHORT (0x4e5e)	/* unlk %fp */
    SHORT (0x4e75)	/* rts */

    . = ALIGN(0x4);
    __FINI_SECTION__ = . ;
    LONG (0x4e560000)	/* linkw %fp,#0 */
    *(.fini)
    SHORT (0x4e5e)	/* unlk %fp */
    SHORT (0x4e75)	/* rts */
    *(.lit)

    . = ALIGN(4);
    _etext = .;
  } >rom

  ...

  .bootloader :
  {
    __interrupt_vector_boot = .;
    cf-boot.o(.bootloader)
    *(.bootloader .bootloader.*)
  } >bootloader

  .bootconst :
  {
    *(.bootconst .bootconst.*)
  } >bootconst
}
----- 8< ----- 8< -----

Did I miss something regarding the linkw instruction in the linker
script? Or is some assembly magic required before the jump?