From d0a62a86c83be29d926a91a51c540c926cf79dfe Mon Sep 17 00:00:00 2001
From: lumia-emu <lumia-emu@local>
Date: Mon, 14 Sep 2026 00:12:29 +0000
Subject: [PATCH] bake table-root fabrication

---
 qemu/saimaa.c    | 11 +++++++++++
 tools/sbl_uni.py |  7 +++++++
 2 files changed, 18 insertions(+)

diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 81c5293..0f8d902 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -734,6 +734,17 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x08006B8D;
                 cpu_physical_memory_write(0x080528D0, &v, 4);
             }
+            /* PBL dispatcher-table fabrication (b33): retarget literal
+             * [0x80164F0] (image: hash blob!) to scratch struct at
+             * 0x08600200 with [0x18]=2 (ready -> dispatch). */
+            {
+                uint32_t v = 0x08600200;
+                cpu_physical_memory_write(0x08600200, &v, 4);
+                v = 0x00000002;
+                cpu_physical_memory_write(0x08600214, &v, 4);
+                v = 0x08600200;
+                cpu_physical_memory_write(0x080164F0, &v, 4);
+            }
             /* HW-ready bits (b25/b26): [0x073A100] bits 0,1,2 (SBL
              * read-only polls: bit2 poll#1, bit1 poll#2, bit0 gate). */
             {
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index ef7b581..48e7fdf 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -434,6 +434,13 @@ def main():
     # PBL version-table fabrication (b23): [0x080528D0] = STUBV so the
     # rollback query's blx calls maze (returns 0 = versions OK).
     W32(0x080528D0, STUBV)
+    # PBL dispatcher-table fabrication (b33): [0x80164F0] (literal pool,
+    # image default points at hash blob!) retargeted to scratch struct
+    # at 0x08600200 with [0x18]=2 (ready-flag -> world-switch dispatch;
+    # TZ deferred via OCIMEM stub). IMEM scratch (below SBL IMEM stack).
+    W32(0x08600200, 0x08600200)
+    W32(0x08600214, 0x00000002)
+    W32(0x080164F0, 0x08600200)
     # HW-ready bit fabrication (b25): [0x073A100] bits 0,1,2 = peripheral
     # status done-bits (poll#1 checks bit2 (lsls#29), poll#2 bit1 (lsls#30),
     # post-poll gate bit0 (lsls#31)). SBL only reads it, never writes.