Debug: couldn't track down call_addr

Hi!
I've got a problem loading Pistachio on my PPC. I could track down the
problem until control jumps to call_addr:

piggybacker/ofppc/main.cc:

L4_Word32_t prom_entry ( void * args )
{
  return ((L4_Word32_t(*)( void * ))call_addr)( args );
}

There my debugger jumps to assembler code, which I don't understand. I
found that the value of call_addr is set in
piggybacker/common/ieee1275.cc:
  prom_init: call_addr = (L4_Word32_t)r5;

And r5 has the value of of1275entry, which is an argument to
loader_main. loader main is the piggybacker entry point. The value of
of1275entry has been calculated in piggybacker/ofppc/crt0.S, which is
executed at startup.

But where does of1275 point to?

Thanks for help,

Martin.