b48-s12-thumb-keep-only-3x-cheaper

tools/sbl_uni.py

@@ -630,21 +630,13 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
-    # smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr).
-    # keep (odd code): appended tail restores r7, ACKs bit1, bx lr to
-    # wrapper tail (paired pop, balanced). default (STUBV/even/non-code,
-    # i.e. unpaired entry): shared restore/ACK then bx ip to poll
-    # resumption 0x8007779 (no tail visit, no pop, no creep). PBL would
-    # place the real ARM helper here.
+    # S12-stub (b27/b43/b48, 12B @0x08006964, Thumb keep-only):
+    # ldr r7,[pc] (=0x73A000) + bx lr. R7-restore is load-bearing
+    # (firmware clobbers r7); ACK dropped (sticky bit, proven noop);
+    # classify/divert dropped (default never fired: identical tpop
+    # with/without it). PBL would place the real ARM helper here.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de58d3b06e3003840e303005ce10900000a"
-        "01001ce30700000a2c3ca0e1080053e30000001a"
-        "0d0000ea2c3ea0e1080053e30000001a090000ea"
-        "79c707e300c840e300700ae3737040e30c309fe5"
-        "002093e5022082e3002083e51cff2fe100a17300"
-        "00700ae3737040e30c309fe5002093e5022082e3"
-        "002083e51eff2fe100a17300"))
+        "dff804707047000000a07300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
     # ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66