bake table-root fabrication

qemu/saimaa.c

@@ -734,6 +734,17 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x08006B8D;
                 cpu_physical_memory_write(0x080528D0, &v, 4);
             }
+            /* PBL dispatcher-table fabrication (b33): retarget literal
+             * [0x80164F0] (image: hash blob!) to scratch struct at
+             * 0x08600200 with [0x18]=2 (ready -> dispatch). */
+            {
+                uint32_t v = 0x08600200;
+                cpu_physical_memory_write(0x08600200, &v, 4);
+                v = 0x00000002;
+                cpu_physical_memory_write(0x08600214, &v, 4);
+                v = 0x08600200;
+                cpu_physical_memory_write(0x080164F0, &v, 4);
+            }
             /* HW-ready bits (b25/b26): [0x073A100] bits 0,1,2 (SBL
              * read-only polls: bit2 poll#1, bit1 poll#2, bit0 gate). */
             {

tools/sbl_uni.py

@@ -434,6 +434,13 @@ def main():
     # PBL version-table fabrication (b23): [0x080528D0] = STUBV so the
     # rollback query's blx calls maze (returns 0 = versions OK).
     W32(0x080528D0, STUBV)
+    # PBL dispatcher-table fabrication (b33): [0x80164F0] (literal pool,
+    # image default points at hash blob!) retargeted to scratch struct
+    # at 0x08600200 with [0x18]=2 (ready-flag -> world-switch dispatch;
+    # TZ deferred via OCIMEM stub). IMEM scratch (below SBL IMEM stack).
+    W32(0x08600200, 0x08600200)
+    W32(0x08600214, 0x00000002)
+    W32(0x080164F0, 0x08600200)
     # HW-ready bit fabrication (b25): [0x073A100] bits 0,1,2 = peripheral
     # status done-bits (poll#1 checks bit2 (lsls#29), poll#2 bit1 (lsls#30),
     # post-poll gate bit0 (lsls#31)). SBL only reads it, never writes.