b25: S12v3/S16v2 smart-return baked

docs/sbl-bringup.md

@@ -109,6 +109,7 @@
   scaffold, ARM! т.к. blx-imm на чётный): preset ip=S16 + ACK bit1
   `[0x73A100]` (side effect для poll#2) + `bx lr`. Литерал `[0x8006980]`.
 - Helper-pop `0x8007B66` читает scratch (счётчики 0-4 вместо pushed lr,
-  фреймы съедены null-циклами) → S16 (b25): цепочка S12(ip) → B66
+  фреймы съедены null-циклами) → S16v2 (b25 smart): B66 (`pop` → `bx ip`,
-  (`pop` → `bx ip`, 2B без пожирания) → S16 (restore r7, прыжок
+  2B) → S16 проверяет ip (odd + top 8 = legit pushed-lr → `bx ip`;
-  `0x8007779`). B66-патч в ELF (b25), S12/S16 в scaffold.
+  иначе default: restore r7, прыжок `0x8007779`). S12v3 грузит ip из
+  `[sp+4]` (pushed lr) + ACK bit1. B66-патч в ELF (b25), S12/S16 в scaffold.

qemu/saimaa.c

@@ -104,15 +104,15 @@ static void saimaa_tmr_init(Object *obj)
 /* Stubs region handle for set_readonly after scaffold implant. */
 static MemoryRegion *saimaa_stubs_mr;
 
-/* DDRLOW stub trap [0x08006B80,0x08006CE0): serves the scaffolded bytes
+/* DDRLOW stub trap [0x08006B80,0x08006CF0): serves the scaffolded bytes
  * (S/maze/S6/banner/S7/S9/S10/S16 stubs) on read/fetch, ignores SBL
  * heap-clobber writes. Uni parity: deferred-restore guard in sbl_uni.py
- * (wider: [0x080068C0,0x08006CE0), also covers PBL stub).
+ * (wider: [0x080068C0,0x08006CF0), also covers PBL stub).
  * Snapshot is taken AFTER ELF load + all stub writes (readback).
  * PBL stub [0x080068C0,0x080068F4) and the ELF-text gap below stay plain
  * RAM: PBL runs once (if at all), gap holds real hot SBL code. */
 #define SAIMAA_DSTUB_BASE 0x08006B80
-#define SAIMAA_DSTUB_SIZE 0x00000160
+#define SAIMAA_DSTUB_SIZE 0x00000170
 static uint8_t saimaa_dstub_mem[SAIMAA_DSTUB_SIZE];
 
 static uint64_t saimaa_dstub_read(void *opaque, hwaddr off, unsigned size)
@@ -710,16 +710,16 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
-            /* S12-stub (b25, 32B @0x08006964, ARM): blx-to-padding
+             /* S12-stub (b25, 28B @0x08006964, ARM): blx-to-padding
-             * becomes movw/movt ip (=S16) + ACK peripheral bit1
+             * becomes ldr ip,[sp,#4] (=pushed lr, for B66 bx-ip chain)
-             * ([0x073A100], literal pool after code) + bx lr.
+             * + ACK peripheral bit1 ([0x073A100], literal pool after
-             * PBL would place the real ARM helper here. */
+             * code) + bx lr. PBL would place the real ARM helper here. */
             {
                 static const uint8_t s12[] = {
-                    0xc1, 0xcc, 0x06, 0xe3, 0x00, 0xc8, 0x40, 0xe3,
+                    0x04, 0xc0, 0x9d, 0xe5, 0x0c, 0x30, 0x9f, 0xe5,
-                    0x0c, 0x30, 0x9f, 0xe5, 0x00, 0x20, 0x93, 0xe5,
+                    0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
-                    0x02, 0x20, 0x82, 0xe3, 0x00, 0x20, 0x83, 0xe5,
+                    0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
-                    0x1e, 0xff, 0x2f, 0xe1, 0x00, 0xa1, 0x73, 0x00,
+                    0x00, 0xa1, 0x73, 0x00,
                 };
                 size_t k;
                 for (k = 0; k < sizeof(s12); k += 4) {
@@ -729,14 +729,18 @@ static void saimaa_machine_init(MachineState *machine)
                     cpu_physical_memory_write(0x08006964 + k, &word, 4);
                 }
             }
-            /* S16-stublet (b25, 18B @0x08006CC0): helper-pop chain exit.
+            /* S16-stublet (b25, 44B @0x08006CC0): smart return for the
-             * restore r7 (peripheral base); jump to poll resumption
+             * B66 bx-ip chain. ip odd + top 8 (code) => bx ip (legit
-             * 0x8007779 via ip. Entered via B66 bx ip (ip preset by S12). */
+             * pushed-lr return); else default (restore r7, jump poll
+             * resumption 0x8007779 via ip). */
             {
                 static const uint8_t s16[] = {
-                    0x4a, 0xf2, 0x00, 0x07, 0xc0, 0xf2, 0x73, 0x07,
+                    0x1c, 0xf0, 0x01, 0x0f, 0x09, 0xd0, 0x5f, 0xea,
-                    0x47, 0xf2, 0x79, 0x7c, 0xc0, 0xf6, 0x00, 0x0c,
+                    0x1c, 0x63, 0x08, 0x2b, 0x00, 0xd1, 0x60, 0x47,
-                    0x60, 0x47,
+                    0x5f, 0xea, 0x1c, 0x73, 0x08, 0x2b, 0x00, 0xd1,
+                    0x60, 0x47, 0x4a, 0xf2, 0x00, 0x07, 0xc0, 0xf2,
+                    0x73, 0x07, 0x47, 0xf2, 0x79, 0x7c, 0xc0, 0xf6,
+                    0x00, 0x08, 0xc0, 0x47,
                 };
                 size_t k;
                 for (k = 0; k < sizeof(s16); k += 4) {

tools/sbl_uni.py

@@ -382,17 +382,18 @@ def main():
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
     # S12-stub (b25): blx #0x8006964 (BLX-imm to even => ARM mode!) lands
     # in file-zero padding (PBL would place an ARM helper). ARM version:
-    # movw/movt ip (=S16 addr, for the pop-site chain); ldr r3,[pc,#12]
+    # ldr ip,[sp,#4] (=pushed lr, for the B66 bx-ip chain); ldr r3,[pc]
     # (literal [0x8006980] = 0x073A100); ACK peripheral bit1 (the real
     # helper's side effect that poll#2 waits for); bx lr.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "c1cc06e300c840e30c309fe5002093e5022082e3002083e5"
+        "04c09de50c309fe5002093e5022082e3002083e51eff2fe1"
-        "1eff2fe100a17300"))
+        "00a17300"))
-    # S16-stublet (b25, 18B @0x08006CC0): helper-pop chain exit.
+    # S16-stublet (b25, 44B @0x08006CC0): smart return for B66 bx ip.
-    # restore r7 (=0x73A000 peripheral base, trashed by labyrinth pops);
+    # ip odd + top 8 (DDRLOW/DDRHIGH code) => bx ip (legit pushed-lr
-    # jump to poll-loop resumption 0x8007779 via ip.
+    # return); else default (restore r7, jump poll resumption 0x8007779).
     mu.mem_write(0x08006CC0, bytes.fromhex(
-        "4af20007c0f2730747f2797cc0f6000c6047"))
+        "1cf0010f09d05fea1c63082b00d160475fea1c73082b00d"
+        "160474af20007c0f2730747f2797cc0f6000c6047"))
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
     # pop-site slots (sp values from traces)
@@ -429,7 +430,7 @@ def main():
     # --- end parity ---
     # stub range is readonly on HW/QEMU: ignore SBL heap-clobber writes,
     # keep maze/stublets intact (restore-on-write with reentrancy guard)
-    STUB_LO, STUB_HI = 0x080068C0, 0x08006CE0  # +S7/S9/S10/S16 + banner
+    STUB_LO, STUB_HI = 0x080068C0, 0x08006CF0  # +S7/S9/S10/S16 + banner
     stub_snap = bytes(mu.mem_read(STUB_LO, STUB_HI - STUB_LO))
     _inww = [False]
     _swn = [0]