From fcb1eb9d3b45265c998f00f540bb2a0cb3c246b7 Mon Sep 17 00:00:00 2001
From: Michael M <mchtly@gmail.com>
Date: Thu, 10 Aug 2017 10:42:53 -0700
Subject: [PATCH] dsp_rom: skip bootucode_ax when running from entrypoint

This could cause the first branch of the bootucode procedure, which
takes its parameters from the AX registers, to run during the ROM init
sequence. Since the ROM doesn't set any of the AX registers, the values
aren't meaningful, and can cause bad DMA transfers and crashes.
---
 Data/Sys/GC/dsp_rom.bin                  | Bin 8192 -> 8192 bytes
 Source/Core/Core/DSP/DSPCore.cpp         |  28 +++++++++++++----------
 docs/DSP/free_dsp_rom/dsp_rom.ds         |   3 ++-
 docs/DSP/free_dsp_rom/dsp_rom_readme.txt |  10 ++++++++
 4 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/Data/Sys/GC/dsp_rom.bin b/Data/Sys/GC/dsp_rom.bin
index f36fefb45f5f150d44b373d502fde06cf79a520e..34a454df859619825d7269ea2c0f8a31a9edd9a7 100644
GIT binary patch
delta 12
TcmZp0XmFU&%XnmCUy(cjA+iNC

delta 12
TcmZp0XmFU&%eZx8Uy(cjA!h|7

diff --git a/Source/Core/Core/DSP/DSPCore.cpp b/Source/Core/Core/DSP/DSPCore.cpp
index befda9fcda..aec6b9dd50 100644
--- a/Source/Core/Core/DSP/DSPCore.cpp
+++ b/Source/Core/Core/DSP/DSPCore.cpp
@@ -41,22 +41,26 @@ static bool VerifyRoms()
     u32 hash_drom;  // dsp_coef.bin
   };
 
-  static const std::array<DspRomHashes, 5> known_roms = {
-      {// Official Nintendo ROM
-       {0x66f334fe, 0xf3b93527},
+  static const std::array<DspRomHashes, 6> known_roms = {{
+      // Official Nintendo ROM
+      {0x66f334fe, 0xf3b93527},
 
-       // LM1234 replacement ROM (Zelda UCode only)
-       {0x9c8f593c, 0x10000001},
+      // LM1234 replacement ROM (Zelda UCode only)
+      {0x9c8f593c, 0x10000001},
 
-       // delroth's improvement on LM1234 replacement ROM (Zelda and AX only,
-       // IPL/Card/GBA still broken)
-       {0xd9907f71, 0xb019c2fb},
+      // delroth's improvement on LM1234 replacement ROM (Zelda and AX only,
+      // IPL/Card/GBA still broken)
+      {0xd9907f71, 0xb019c2fb},
 
-       // above with improved resampling coefficients
-       {0xd9907f71, 0xdb6880c1},
+      // above with improved resampling coefficients
+      {0xd9907f71, 0xdb6880c1},
 
-       // above with support for GBA ucode
-       {0x3aa4a793, 0xa4a575f5}}};
+      // above with support for GBA ucode
+      {0x3aa4a793, 0xa4a575f5},
+
+      // above with fix to skip bootucode_ax when running from ROM entrypoint
+      {0x128ea7a2, 0xa4a575f5},
+  }};
 
   u32 hash_irom = HashAdler32((u8*)g_dsp.irom, DSP_IROM_BYTE_SIZE);
   u32 hash_drom = HashAdler32((u8*)g_dsp.coef, DSP_COEF_BYTE_SIZE);
diff --git a/docs/DSP/free_dsp_rom/dsp_rom.ds b/docs/DSP/free_dsp_rom/dsp_rom.ds
index bf94ac49a4..7e845f8a02 100644
--- a/docs/DSP/free_dsp_rom/dsp_rom.ds
+++ b/docs/DSP/free_dsp_rom/dsp_rom.ds
@@ -55,7 +55,8 @@ param5:
 	jnz mainloop+#IROM_BASE
 	call wait_for_cpu_mbox+#IROM_BASE
 	lr $AR0, @CMBL
-	jmp 0x80b5
+	; skip the branch of bootucode that uses the AX registers
+	jmp bootucode_ix+#IROM_BASE
 
 wait_dma:
 	lrs		$AC0.M, @DSCR
diff --git a/docs/DSP/free_dsp_rom/dsp_rom_readme.txt b/docs/DSP/free_dsp_rom/dsp_rom_readme.txt
index 8a3ff8c79b..51ee21eba3 100644
--- a/docs/DSP/free_dsp_rom/dsp_rom_readme.txt
+++ b/docs/DSP/free_dsp_rom/dsp_rom_readme.txt
@@ -1,3 +1,13 @@
+Legal GC/WII DSP IROM replacement (v0.3.1)
+-------------------------------------------------------
+
+- irom: When running from the ROM entrypoint, skip the bootucode_ax branch
+  of the bootucode procedure. Since the ROM doesn't set any of the AX
+  registers, it could cause bad DMA transfers and crashes.
+
+ligfx
+10/aug/2017
+
 Legal GC/WII DSP IROM replacement (v0.3)
 -------------------------------------------------------