scaffold-worldswitch-gate-r0-18-eq-2

qemu/saimaa.c

@@ -772,6 +772,7 @@ static void saimaa_machine_init(MachineState *machine)
                 cpu_physical_memory_write(0x08024000, &v, 4);
                 v = 0x00000002;
                 cpu_physical_memory_write(0x08024014, &v, 4);
+                cpu_physical_memory_write(0x08024018, &v, 4);
                 v = 0x08024000;
                 cpu_physical_memory_write(0x080164F0, &v, 4);
             }

tools/sbl_uni.py

@@ -359,10 +359,10 @@ def main():
                             _th = (mu.reg_read(_CPSR) >> 5) & 1
                         except Exception:
                             _th = -1
-                        elog.append((count[0], _prev[0], addr, _th))
+                        elog.append((count[0], _pp, addr, _th))
                 if not inside and _inrng[_i]:
                     if len(elog) < 20000:
-                        elog.append((count[0], _prev[0], -addr, 2))
+                        elog.append((count[0], _pp, -addr, 2))
                 _inrng[_i] = inside
         if calls is not None and size in (2, 4):
             try:
@@ -456,6 +456,7 @@ def main():
             except Exception:
                 pass
     mu.hook_add(UC_HOOK_MEM_WRITE, hook_txt, begin=0x802F600, end=0x802F700)
+    mu.hook_add(UC_HOOK_MEM_WRITE, hook_txt, begin=0x80068E0, end=0x80068F0)
     import atexit as _ax3
     def _dtx():
         print('txt-writes:', len(_txtlog))
@@ -592,6 +593,7 @@ def main():
     # (ready-flag -> world-switch dispatch; TZ deferred via OCIMEM stub).
     W32(0x08024000, 0x08024000)
     W32(0x08024014, 0x00000002)
+    W32(0x08024018, 0x00000002)  # gate 0x80164B8 wants [r0,#0x18]==2
     W32(0x080164F0, 0x08024000)
     # HW-ready bit fabrication (b25/b39): [0x073A100] bits 0,1,2 = peripheral
     # status done-bits (poll#1 checks bit2 (lsls#29), poll#2 bit1 (lsls#30),