b24 scaffold: S12 + poll-bit2 baked, default b24

2026-09-13 11:37:15 +00:00
parent ff4c3a54a0
commit 48969c60f3
4 changed files with 24 additions and 1 deletions
@@ -335,12 +335,20 @@ def main():
    # PBL version-table fabrication (b23): [0x080528D0] = STUBV so the
    # rollback query's blx calls maze (returns 0 = versions OK).
    W32(0x080528D0, STUBV)
+    # HW-ready bit fabrication (b25): [0x073A100] bit2 = peripheral
+    # status done-bit (SBL only reads it, never writes; HW would set it).
+    # Poll is lsls#29+bpl (checks bit2, NOT bit31!).
+    W32(0x073A100, 0x00000004)
    # PBL world-switch Thumb-stub (b24): the ARM trampoline at 0x221EF8
    # is entered in Thumb (mode confusion at dispatch); real ARM would
    # save regs/CPS to MON and call TZ (not loaded yet). Stub returns 0
    # to the dispatcher via stale lr (TZ bringup deferred).
    # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
    mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
+    # S12-stub (b25): blx #0x8006964 lands in file-zero padding (PBL
+    # would place an ARM helper there at runtime). Caller ignores r0
+    # (movs r0,#0 after), so bx lr no-op return is safe.
+    mu.mem_write(0x08006964, bytes([0x70, 0x47]))
    # stack zone fill (STUBV odd)
    mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
    # pop-site slots (sp values from traces)