dsp_rom: skip bootucode_ax when running from entrypoint

This could cause the first branch of the bootucode procedure, which takes its parameters from the AX registers, to run during the ROM init sequence. Since the ROM doesn't set any of the AX registers, the values aren't meaningful, and can cause bad DMA transfers and crashes.
Ben754 · Aug 10, 2017 · fcb1eb9 · fcb1eb9
1 parent f2a9ad0
commit fcb1eb9
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 13 deletions.
diff --git a/Data/Sys/GC/dsp_rom.bin b/Data/Sys/GC/dsp_rom.bin
diff --git a/Source/Core/Core/DSP/DSPCore.cpp b/Source/Core/Core/DSP/DSPCore.cpp
@@ -41,22 +41,26 @@ static bool VerifyRoms()
     u32 hash_drom;  // dsp_coef.bin
   };
 
-  static const std::array<DspRomHashes, 5> known_roms = {
-      {// Official Nintendo ROM
-       {0x66f334fe, 0xf3b93527},
+  static const std::array<DspRomHashes, 6> known_roms = {{
+      // Official Nintendo ROM
+      {0x66f334fe, 0xf3b93527},
 
-       // LM1234 replacement ROM (Zelda UCode only)
-       {0x9c8f593c, 0x10000001},
+      // LM1234 replacement ROM (Zelda UCode only)
+      {0x9c8f593c, 0x10000001},
 
-       // delroth's improvement on LM1234 replacement ROM (Zelda and AX only,
-       // IPL/Card/GBA still broken)
-       {0xd9907f71, 0xb019c2fb},
+      // delroth's improvement on LM1234 replacement ROM (Zelda and AX only,
+      // IPL/Card/GBA still broken)
+      {0xd9907f71, 0xb019c2fb},
 
-       // above with improved resampling coefficients
-       {0xd9907f71, 0xdb6880c1},
+      // above with improved resampling coefficients
+      {0xd9907f71, 0xdb6880c1},
 
-       // above with support for GBA ucode
-       {0x3aa4a793, 0xa4a575f5}}};
+      // above with support for GBA ucode
+      {0x3aa4a793, 0xa4a575f5},
+
+      // above with fix to skip bootucode_ax when running from ROM entrypoint
+      {0x128ea7a2, 0xa4a575f5},
+  }};
 
   u32 hash_irom = HashAdler32((u8*)g_dsp.irom, DSP_IROM_BYTE_SIZE);
   u32 hash_drom = HashAdler32((u8*)g_dsp.coef, DSP_COEF_BYTE_SIZE);

diff --git a/docs/DSP/free_dsp_rom/dsp_rom.ds b/docs/DSP/free_dsp_rom/dsp_rom.ds
@@ -55,7 +55,8 @@ param5:
 	jnz mainloop+#IROM_BASE
 	call wait_for_cpu_mbox+#IROM_BASE
 	lr $AR0, @CMBL
-	jmp 0x80b5
+	; skip the branch of bootucode that uses the AX registers
+	jmp bootucode_ix+#IROM_BASE
 
 wait_dma:
 	lrs		$AC0.M, @DSCR

diff --git a/docs/DSP/free_dsp_rom/dsp_rom_readme.txt b/docs/DSP/free_dsp_rom/dsp_rom_readme.txt
@@ -1,3 +1,13 @@
+Legal GC/WII DSP IROM replacement (v0.3.1)
+-------------------------------------------------------
+
+- irom: When running from the ROM entrypoint, skip the bootucode_ax branch
+  of the bootucode procedure. Since the ROM doesn't set any of the AX
+  registers, it could cause bad DMA transfers and crashes.
+
+ligfx
+10/aug/2017
+
 Legal GC/WII DSP IROM replacement (v0.3)
 -------------------------------------------------------