S12v5: r7 restore in-stub

docs/sbl-bringup.md

@@ -132,3 +132,4 @@
 - S12v4 (scaffold, без ELF): smart dispatcher в самом S12 (проверка
   pushed-lr + ACK + возврат) — S16 больше не нужен в цепочке (остаётся
   как fallback).
+- S12v5: +restore r7 (peripheral base, S16 dormant) прямо в S12.

qemu/saimaa.c

@@ -732,11 +732,11 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
-             /* S12-stub (b27, 84B @0x08006964, ARM): blx-to-padding
+             /* S12-stub (b27, 92B @0x08006964, ARM): blx-to-padding
              * becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr);
              * ip==STUBV/even/non-code => ip=poll resumption 0x8007779;
-             * else keep pushed-lr; then ACK peripheral bit1
+             * else keep pushed-lr; restore r7 (peripheral base);
-             * ([literal 0x073A100]); bx lr.
+             * ACK peripheral bit1 ([literal 0x073A100]); bx lr.
              * PBL would place the real ARM helper here. */
             {
                 static const uint8_t s12[] = {
@@ -747,7 +747,8 @@ static void saimaa_machine_init(MachineState *machine)
                     0x08, 0x00, 0x53, 0xe3, 0x04, 0x00, 0x00, 0x0a,
                     0x2c, 0x3e, 0xa0, 0xe1, 0x08, 0x00, 0x53, 0xe3,
                     0x01, 0x00, 0x00, 0x0a, 0x79, 0xc7, 0x07, 0xe3,
-                    0x00, 0xc8, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
+                    0x00, 0xc8, 0x40, 0xe3, 0x00, 0x70, 0x0a, 0xe3,
+                    0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
                     0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
                     0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
                     0x00, 0xa1, 0x73, 0x00,

tools/sbl_uni.py

@@ -104,6 +104,13 @@ def main():
     calls = [] if "--calltrace" in sys.argv else None
     rets = [] if "--retrace" in sys.argv else None
     qlog = [] if "--querylog" in sys.argv else None
+    # frozen-maze breaker: maze entries with identical lr and no bl
+    # between them mean a zero-state-change spin (maze->mid-fn->maze).
+    # After K, redirect once to poll resumption (fresh bls unfreeze lr).
+    _fmlr = [None]
+    _fmct = [0]
+    _FMK = 50
+    _FMPC = 0x8007779
     _traps = []
     _trap_n = [0]
     if "--trap" in sys.argv:
@@ -127,6 +134,25 @@ def main():
     def hook_code(mu, addr, size, data):
         count[0] += 1
         last[0] = addr
+        if 0x08006B8C <= addr < 0x08006B9E:
+            try:
+                _lr = mu.reg_read(_LR)
+            except Exception:
+                _lr = None
+            if _lr == _fmlr[0]:
+                _fmct[0] += 1
+                if _fmct[0] >= _FMK:
+                    _fmct[0] = 0
+                    _fmlr[0] = None
+                    mu.reg_write(_PC, _FMPC)
+                    return
+            else:
+                _fmlr[0] = _lr
+                _fmct[0] = 0
+        elif _fmlr[0] is not None:
+            # any non-maze fetch: reset only on bl (lr change means
+            # fresh calls; other insns keep the freeze assessment)
+            pass
         if _splog is not None:
             try:
                 sp = mu.reg_read(UC_ARM_REG_SP)
@@ -385,16 +411,17 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27, 84B @0x08006964, ARM): blx-to-padding becomes
+    # S12-stub (b27, 92B @0x08006964, ARM): blx-to-padding becomes
     # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
     # non-code => ip=poll resumption 0x8007779; else keep pushed-lr;
-    # then ACK peripheral bit1 ([literal 0x073A100]); bx lr.
+    # restore r7 (peripheral base, S16 dormant); ACK peripheral bit1
-    # PBL would place the real ARM helper here.
+    # ([literal 0x073A100]); bx lr. PBL would place the real helper.
     mu.mem_write(0x08006964, bytes.fromhex(
         "04c09de58d3b06e3003840e303005ce10700000a0100"
         "1ce30500000a2c3ca0e1080053e30400000a2c3ea0e1"
-        "080053e30100000a79c707e300c840e30c309fe50020"
+        "080053e30100000a79c707e300c840e300700ae37370"
-        "93e5022082e3002083e51eff2fe100a17300"))
+        "40e30c309fe5002093e5022082e3002083e51eff2fe1"
+        "00a17300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
     # ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66