b24 scaffold: S12 + poll-bit2 baked, default b24

qemu/run-sbl.sh

@@ -5,7 +5,7 @@
 set -e
 cd "$(dirname "$0")/.."
 QEMU=~/qemu-src/qemu-8.2.2/build/qemu-system-arm
-B=${1:-b23}
+B=${1:-b24}
 IMG=fw/img/emmc-real.img
 if [ ! -f "$IMG" ]; then
   echo "no $IMG — сначала: python3 tools/ffu_extract.py fw/dl/RM1127_059X5R5_orig.ffu --emmc-user fw/img/user-real.bin"

qemu/saimaa.c

@@ -698,6 +698,11 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x08006B8D;
                 cpu_physical_memory_write(0x080528D0, &v, 4);
             }
+            /* HW-ready bit (b25): [0x073A100] bit2 (SBL read-only poll). */
+            {
+                uint32_t v = 0x00000004;
+                cpu_physical_memory_write(0x073A100, &v, 4);
+            }
             /* PBL world-switch Thumb-stub (b24, 4B @0x00221EF8):
              * movs r0,#0; bx lr (return 0 to dispatcher, TZ deferred).
              * Overwrites ARM trampoline head (recoverable from ELF). */
@@ -705,6 +710,12 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
+            /* S12-stub (b25, 2B @0x08006964): blx-to-padding becomes
+             * bx lr (caller ignores r0). PBL would place ARM helper. */
+            {
+                uint16_t v = 0x4770;
+                cpu_physical_memory_write(0x08006964, &v, 2);
+            }
             {
                 uint32_t fill = 0x08006B8D;
                 uint32_t a;