sbl b14: S6 pop redirected to stublet 0x8062140 (was null-sled)

2026-09-11 06:29:06 +00:00
parent 61a0b724ff
commit 22b259e818
3 changed files with 52 additions and 0 deletions
@@ -422,6 +422,23 @@ static void saimaa_machine_init(MachineState *machine)
            cpu_physical_memory_write(0x087c29d18, &S, 4);
            cpu_physical_memory_write(0x08050b28, &S, 4);
            cpu_physical_memory_write(0x08070000, &S, 4);
+            /* S6 stublet at 0x08062140: rebuild popped frame regs,
+             * return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */
+            {
+                static const uint8_t s6[] = {
+                    0xbd, 0xe8, 0xfc, 0x47, /* ldmia.w sp!,{r2-r9,sl,lr} */
+                    0x43, 0xf6, 0xa5, 0x3e, /* movw lr,#0x3ba5 */
+                    0xc0, 0xf6, 0x01, 0x0e, /* movt lr,#0x801 */
+                    0x70, 0x47,             /* bx lr */
+                };
+                size_t k;
+                for (k = 0; k < sizeof(s6); k += 4) {
+                    uint32_t word = 0;
+                    size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4;
+                    __builtin_memcpy(&word, &s6[k], n);
+                    cpu_physical_memory_write(0x08062140 + k, &word, 4);
+                }
+            }
            /* stack zone defaults to plain-stub addr: every register
             * popped from untouched stack becomes callable (returns 0). */
            {