b24: world-switch stub + clock S11

tools/sbl_uni.py

@@ -158,7 +158,11 @@ def main():
                 inside = _elo <= addr < _ehi
                 if inside and not _inrng[_i]:
                     if len(elog) < 20000:
-                        elog.append((count[0], _prev[0], addr))
+                        try:
+                            _th = (mu.reg_read(_CPSR) >> 5) & 1
+                        except Exception:
+                            _th = -1
+                        elog.append((count[0], _prev[0], addr, _th))
                 _inrng[_i] = inside
             _prev[0] = addr
         if calls is not None and size in (2, 4):
@@ -331,6 +335,12 @@ def main():
     # PBL version-table fabrication (b23): [0x080528D0] = STUBV so the
     # rollback query's blx calls maze (returns 0 = versions OK).
     W32(0x080528D0, STUBV)
+    # PBL world-switch Thumb-stub (b24): the ARM trampoline at 0x221EF8
+    # is entered in Thumb (mode confusion at dispatch); real ARM would
+    # save regs/CPS to MON and call TZ (not loaded yet). Stub returns 0
+    # to the dispatcher via stale lr (TZ bringup deferred).
+    # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
+    mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
     # pop-site slots (sp values from traces)
@@ -435,7 +445,7 @@ def main():
                 wlolog.append((pc, addr, size, value))
 
         mu.hook_add(UC_HOOK_MEM_WRITE, hook_wlo,
-                    begin=0x08000000, end=0x085FFFFF)
+                    begin=0x00200000, end=0x085FFFFF)
         import atexit as _ax2
 
         def _dwlo():
@@ -479,10 +489,10 @@ def main():
         print("hist:", [hex(pc) for pc, _ in list(hist)[-12:]])
     if elog is not None:
         print(f"entries: {len(elog)}")
-        for n, prev, cur in elog[:10]:
-            print(f"  FIRST insn#{n} {prev:#x} -> {cur:#x}")
-        for n, prev, cur in elog[-10:]:
-            print(f"  LAST insn#{n} {prev:#x} -> {cur:#x}")
+        for n, prev, cur, th in elog[:10]:
+            print(f"  FIRST insn#{n} {prev:#x} -> {cur:#x}{'t' if th == 1 else ('a' if th == 0 else '?')}")
+        for n, prev, cur, th in elog[-10:]:
+            print(f"  LAST insn#{n} {prev:#x} -> {cur:#x}{'t' if th == 1 else ('a' if th == 0 else '?')}")
     if _splog is not None:
         print(f"sp-highs: {len(_splog)}")
         for n, pc, sp in _splog: