CydandClaude Fable 5
a8ec285b8e
make_patch.py gains --baud31250: one byte beyond the wedge patch — the SCI init operand at $D62B ($30 -> $02). BAUD $30 = /13 prescale, /1 divider (2MHz E / 208 = 9615); $02 = /1, /4 -> 31250 exactly, 3.3x faster. The init write also confirms the 8MHz crystal, which is why 19200/38400 are unreachable and why 62500/125k are left alone pending an ISR cycle count. - 24 bytes changed vs original (sha256 9f866cf3...); re-disassembly diff vs the classic patched image shows exactly the one operand line, and the classic build still reproduces 3fc8170c... (script regression-safe). - PC side: SerialPortTransport takes an optional baudRate (default 9600, runtime untouched); RioSerialMonitor + --mash accept --baud 31250. - Caveats documented in README/ANALYSIS: non-standard rate (FTDI-class adapters only, no 16550s); native games still speak 9600 so this chip is bench/RIOJoy-only; validate the wedge patch at 9600 first. 275 tests green; mash --selftest regression unchanged (FAIL/exit-1). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
85 lines
3.6 KiB
Python
85 lines
3.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Apply the RIO v4.2 reply-wedge fix to RIOv4_2.bin -> RIOv4_2_patched.bin.
|
|
|
|
Fix (see RIOv4_2-ANALYSIS.md): clear the reply-in-progress latch $2521 on
|
|
EVERY reply teardown, not just the $2522-gated success path.
|
|
|
|
1. Give-up path: redirect $D9DD `JMP $DA2F` to a stub at free ROM $DFF0
|
|
that clears $2521/$2522 then continues to $DA2F.
|
|
2. Success path: make $DA00's clear of $2521/$2522 unconditional.
|
|
|
|
With --baud31250, additionally retune the SCI from 9600 to 31250 baud
|
|
(-> RIOv4_2_patched_31250.bin): the init at $D62A loads BAUD ($102B) with
|
|
$30 (prescale /13, divider /1 -> 2MHz E / (16*13) = 9615). $02 selects
|
|
prescale /1, divider /4 -> 2MHz / (16*4) = 31250 exactly. One operand
|
|
byte at $D62B. NOTE: 31250 is a non-standard rate — FTDI-class USB
|
|
adapters produce it exactly; classic 16550 UARTs cannot. The native
|
|
games still expect 9600, so a 31250 chip is bench/RIOJoy-only until the
|
|
games are patched.
|
|
|
|
Each edit asserts the exact original bytes first, so a wrong assumption
|
|
aborts instead of corrupting the image. Address == file offset.
|
|
"""
|
|
import sys, hashlib
|
|
|
|
BAUD31250 = "--baud31250" in sys.argv
|
|
args = [a for a in sys.argv[1:] if not a.startswith("--")]
|
|
SRC = args[0] if len(args) > 0 else "RIOv4_2.bin"
|
|
DST = args[1] if len(args) > 1 else (
|
|
"RIOv4_2_patched_31250.bin" if BAUD31250 else "RIOv4_2_patched.bin")
|
|
|
|
d = bytearray(open(SRC, "rb").read())
|
|
assert len(d) == 0x10000, f"expected 64KB image, got {len(d)}"
|
|
orig_sha = hashlib.sha256(d).hexdigest()
|
|
assert orig_sha == "60a88718835c654b6135dbec7721c40ef99dca07df2ad4b57eedeb24037a5f73", \
|
|
f"unexpected source image {orig_sha}"
|
|
|
|
def patch(addr, expect, new):
|
|
got = bytes(d[addr:addr+len(expect)])
|
|
assert got == bytes(expect), (
|
|
f"@${addr:04X}: expected {got.hex()} to be {bytes(expect).hex()}")
|
|
assert len(new) == len(expect), "length mismatch"
|
|
d[addr:addr+len(new)] = bytes(new)
|
|
|
|
# --- edit 1: give-up path redirect ---------------------------------------
|
|
# $D9DD 7E DA 2F JMP $DA2F -> 7E DF F0 JMP $DFF0
|
|
patch(0xD9DD, [0x7E, 0xDA, 0x2F], [0x7E, 0xDF, 0xF0])
|
|
|
|
# stub at $DFF0 (was erased $FF): CLR $2521; CLR $2522; JMP $DA2F
|
|
patch(0xDFF0, [0xFF]*8,
|
|
[0x7F, 0x25, 0x21, # CLR $2521
|
|
0x7F, 0x25, 0x22, # CLR $2522
|
|
0x7E, 0xDA]) # JMP $DA2F (hi + first target byte)
|
|
patch(0xDFF8, [0xFF], [0x2F]) # JMP low byte
|
|
|
|
# --- edit 2: success teardown, unconditional clear -----------------------
|
|
# $DA21 B6 25 22 LDAA $2522
|
|
# $DA24 81 01 CMPA #$01
|
|
# $DA26 26 06 BNE $DA2E
|
|
# $DA28 7F 25 21 CLR $2521
|
|
# $DA2B 7F 25 22 CLR $2522 (13 bytes $DA21-$DA2D; $DA2E RTS untouched)
|
|
# -> CLR $2521 ; CLR $2522 ; NOP x7
|
|
patch(0xDA21,
|
|
[0xB6,0x25,0x22, 0x81,0x01, 0x26,0x06, 0x7F,0x25,0x21, 0x7F,0x25,0x22],
|
|
[0x7F,0x25,0x21, 0x7F,0x25,0x22, 0x01,0x01,0x01,0x01,0x01,0x01,0x01])
|
|
assert d[0xDA2E] == 0x39, "RTS at $DA2E must be intact"
|
|
|
|
# --- edit 3 (--baud31250 only): SCI 9600 -> 31250 --------------------------
|
|
# $D62A 86 30 LDAA #$30 (SCP=/13, SCR=/1) -> 86 02 (SCP=/1, SCR=/4)
|
|
# then STAA $102B (BAUD). 2MHz E-clock: 2e6/(16*13)=9615 -> 2e6/(16*4)=31250.
|
|
if BAUD31250:
|
|
assert d[0xD62A] == 0x86 and bytes(d[0xD62C:0xD62F]) == bytes([0xB7,0x10,0x2B]), \
|
|
"expected LDAA #imm ; STAA $102B at $D62A"
|
|
patch(0xD62B, [0x30], [0x02])
|
|
|
|
open(DST, "wb").write(d)
|
|
new_sha = hashlib.sha256(d).hexdigest()
|
|
# byte-diff report
|
|
diffs = [(a, orig, d[a]) for a, orig in
|
|
enumerate(open(SRC,"rb").read()) if d[a] != orig]
|
|
print(f"source : {SRC} sha256 {orig_sha}")
|
|
print(f"patched: {DST} sha256 {new_sha}")
|
|
print(f"{len(diffs)} bytes changed:")
|
|
for a, o, n in diffs:
|
|
print(f" ${a:04X}: {o:02X} -> {n:02X}")
|