From 470e41751d2bde0a761df4429f9ea42758c7a279 Mon Sep 17 00:00:00 2001 From: deadprogram Date: Thu, 20 Aug 2026 09:02:28 +0200 Subject: [PATCH] esp32s3: fix register-window corruption under interrupt load Remove the C3 bluetooth hook addresses from esp32s3.ld (on the S3 they point into the ROM md5/crc thunk table, and being bare assignments they also shadowed the blob's own definitions), keep the interrupt frame clear of the 16-byte windowed-ABI save area below SP, and make tinygo_swapTask hold INTLEVEL across the stack switch while keeping the running frame's WINDOWSTART bit set. Signed-off-by: deadprogram --- src/internal/task/task_stack_esp32.S | 31 +- targets/esp32s3-interrupts.S | 85 ++- targets/esp32s3.ld | 1019 +++++++++++++++++++++++++- 3 files changed, 1120 insertions(+), 15 deletions(-) diff --git a/src/internal/task/task_stack_esp32.S b/src/internal/task/task_stack_esp32.S index 1b1608d06..60691b434 100644 --- a/src/internal/task/task_stack_esp32.S +++ b/src/internal/task/task_stack_esp32.S @@ -72,10 +72,13 @@ tinygo_swapTask: // below, after the stack switch is done. This prevents stale overflow // when the new goroutine's calls rotate back into these panes. - // Restore interrupts. + // Reload the saved PS, but do NOT restore it yet: everything from the stack + // switch below through the retw.n must stay masked. Once sp points at the + // new task's stack, the memory below sp is that task's save area -- the + // a0-a3 the retw.n is about to reload through a window underflow. An + // interrupt landing in that gap builds its frame there and overwrites them, + // and a garbage a0 makes the next retw an Illegal Instruction. l32i a4, sp, 4 // reload saved PS - wsr.ps a4 - rsync // At this point, the following is true: // WindowStart == 1 << WindowBase @@ -97,16 +100,24 @@ tinygo_swapTask: // register also stores the parent register window. l32i.n a0, sp, 0 - // Clear ALL WindowStart bits. With all windows spilled to the stack, - // we must ensure no stale WS bits remain: the retw.n below will trigger - // underflow4 to load the new goroutine's registers from the new stack - // (which sets the appropriate WS bit via rfwu). Any stale WS bits - // (from spill helpers or the old goroutine) would cause spurious - // overflows of garbage register values into memory. - movi a5, 0 + // Drop every WindowStart bit except this window's. Stale bits (from the + // spill helpers or the old goroutine) would overflow garbage registers into + // memory. This window's own bit has to stay set: zeroing WindowStart marks + // the running frame dead, so an interrupt arriving here returns through a + // retw that underflows into a save area nothing ever wrote. Keeping it + // costs nothing -- WindowStart[WindowBase - n] is still clear, so the + // retw.n below underflows as intended. + rsr a6, WINDOWBASE + movi a5, 1 + ssl a6 + sll a5, a5 // a5 = 1 << WindowBase wsr a5, WINDOWSTART rsync + // Now that the new task's window state is consistent, take interrupts back. + wsr.ps a4 + rsync + // Return into the new stack. This instruction will trigger a window // underflow, reloading the saved registers from the stack. retw.n diff --git a/targets/esp32s3-interrupts.S b/targets/esp32s3-interrupts.S index cc181e3a4..dad2b0a60 100644 --- a/targets/esp32s3-interrupts.S +++ b/targets/esp32s3-interrupts.S @@ -299,13 +299,37 @@ _handle_kernel_exc: .global _handle_level1 _handle_level1: - // --- allocate 96-byte exception frame on the interrupted stack --- + // --- EXCCAUSE 5 (alloca / MOVSP) is not a fault, it is a request --- + // + // MOVSP raises this whenever it moves the stack pointer while the caller's + // register window is still live in the register file: the hardware is + // asking us to spill that window, not reporting an error. LLVM emits MOVSP + // for any call that needs a 7th argument on the stack (the windowed ABI + // passes six in registers), so it shows up in ordinary C and Go code alike. + // + // Without this, such a call takes a fatal user exception. The check goes + // first, before any state is touched, so a0 is still in EXCSAVE1 where + // _xt_alloca_exc wants it and every other cause falls through to the + // handler below completely unchanged. + rsr a0, EXCCAUSE + bnei a0, 5, 1f + j _xt_alloca_exc +1: + rsr a0, EXCSAVE1 // restore a0 clobbered by the EXCCAUSE read + + // --- allocate the exception frame on the interrupted stack --- // Layout (offsets from a1 after adjustment): // 0: a0 4: a1(orig) 8: a2 12: a3 16: a4 20: a5 // 24: a6 28: a7 32: a8 36: a9 40: a10 44: a11 // 48: a12 52: a13 56: a14 60: a15 - // 64: SAR 68: EPC1 72: PS - addi a0, a1, -96 // a0 = new frame pointer + // 64: SAR 68: EPC1 72: PS 76: WINDOWBASE 80: WINDOWSTART + // + // 128, not the 88 the layout needs: the 16 bytes below the interrupted SP + // are the windowed-ABI caller save area, written by window overflow and + // read back by underflow. Clobbering them corrupts the interrupted code's + // a0, which surfaces later as an Illegal Instruction on its retw. ESP-IDF + // reserves the same gap (the 0x20 in XT_STK_FRMSZ). + addi a0, a1, -128 // a0 = new frame pointer s32i a1, a0, 4 // save original a1 (SP) mov a1, a0 // a1 = frame pointer @@ -339,6 +363,15 @@ _handle_level1: // level-1 interrupts. rsr a2, PS s32i a2, a1, 72 // save PS (with EXCM=1 set by hardware) + + // Window state as it was at the fault. Reading it from the C handler + // instead describes the handler: getting there costs a callx4, and the + // printfs rotate and spill windows of their own. + rsr a3, WINDOWBASE + s32i a3, a1, 76 + rsr a3, WINDOWSTART + s32i a3, a1, 80 + movi a3, ~0x1F // mask: clear INTLEVEL (bits 0-3) + EXCM (bit 4) and a2, a2, a3 movi a3, 1 // INTLEVEL = 1 @@ -412,6 +445,52 @@ _handle_level1: rfe +// ----------------------------------------------------------------------- +// Alloca (MOVSP) exception handler. +// +// Rotates back to the window that executed MOVSP, fixes up PS.OWB to match +// the new WINDOWBASE, and falls into the window underflow handler that +// corresponds to the caller's call size. The underflow handler spills the +// window and returns to the interrupted MOVSP via rfwu, which then completes. +// +// All of the interruptee's registers are intact except a0, which is in +// EXCSAVE1. PS.EXCM is set by the hardware, so this cannot be interrupted. +// The registers of the base-save area are free scratch here, because taking +// this exception means they have already been spilled and the underflow +// handler will restore them. +// ----------------------------------------------------------------------- + .balign 4 + .global _xt_alloca_exc +_xt_alloca_exc: + rsr a0, WINDOWBASE // grab WINDOWBASE before rotw changes it + rotw -1 // WINDOWBASE goes to a4, new a0-a3 are scratch + rsr a2, PS + extui a3, a2, 8, 4 // a3 = PS.OWB (shift 8, 4 bits) + xor a3, a3, a4 // bits that changed from old to current WB + rsr a4, EXCSAVE1 // restore the interruptee's a0 (now in a4) + slli a3, a3, 8 + xor a2, a2, a3 // flip those bits in PS.OWB + wsr a2, PS // PS.OWB now matches the new WINDOWBASE + rsync + + // Dispatch on the call size encoded in the interruptee's return address: + // bits 31:30 of a0 are 00/01 for call4, 10 for call8, 11 for call12. + // + // The canonical sequence branches straight to the underflow vectors with + // _bbci.l, but that has only an 8-bit displacement and this handler lives + // outside the vector table, well out of reach. Inverting each test and + // putting the vector target on a full-range `j` is the same dispatch + // without the range limit. + _bbsi.l a4, 31, 1f + j _window_underflow4 +1: + rotw -1 // interruptee's a0 moves to a8 + _bbsi.l a8, 30, 2f + j _window_underflow8 +2: + rotw -1 + j _window_underflow12 + // ----------------------------------------------------------------------- // Default weak espradio_user_exception: infinite loop halt. // Overridden by the strong definition in espradio's isr.c when linked. diff --git a/targets/esp32s3.ld b/targets/esp32s3.ld index 6a08f2998..8a6652d51 100644 --- a/targets/esp32s3.ld +++ b/targets/esp32s3.ld @@ -330,8 +330,1023 @@ intr_matrix_set = 0x40001b54; ets_intr_lock = 0x40001b60; ets_intr_unlock = 0x40001b6c; ets_isr_attach = 0x40001b78; +ets_isr_mask = 0x40001b84; ets_isr_unmask = 0x40001b90; +/* Clock. ets_update_cpu_frequency writes the ticks-per-microsecond value that + * ROM ets_delay_us() busy-waits against. TinyGo raises the CPU clock without + * calling it, so anything relying on ROM delays -- the BT controller leans on + * them all through RF and baseband bring-up -- gets a delay scaled by the stale + * boot frequency. */ +ets_get_cpu_frequency = 0x40001a40; +ets_update_cpu_frequency = 0x40001a4c; + +/*************************************** + Group bluetooth + ***************************************/ + +/* Functions */ +bt_rf_coex_get_dft_cfg = 0x40002a78; +bt_rf_coex_hooks_p_set = 0x40002a84; +btdm_con_maxevtime_cal_impl = 0x40002a90; +btdm_controller_get_compile_version_impl = 0x40002a9c; +btdm_controller_rom_data_init = 0x40002aa8; +btdm_dis_privacy_err_report_impl = 0x40002ab4; +btdm_disable_adv_delay_impl = 0x40002ac0; +btdm_enable_scan_continue_impl = 0x40002acc; +btdm_enable_scan_forever_impl = 0x40002ad8; +btdm_get_power_state_impl = 0x40002ae4; +btdm_get_prevent_sleep_flag_impl = 0x40002af0; +btdm_power_state_active_impl = 0x40002afc; +btdm_switch_phy_coded_impl = 0x40002b08; +hci_acl_data_handler = 0x40002b14; +hci_disconnect_cmd_handler = 0x40002b20; +hci_le_con_upd_cmd_handler = 0x40002b2c; +hci_le_ltk_req_neg_reply_cmd_handler = 0x40002b38; +hci_le_ltk_req_reply_cmd_handler = 0x40002b44; +hci_le_rd_chnl_map_cmd_handler = 0x40002b50; +hci_le_rd_phy_cmd_handler = 0x40002b5c; +hci_le_rd_rem_feats_cmd_handler = 0x40002b68; +hci_le_rem_con_param_req_neg_reply_cmd_handler = 0x40002b74; +hci_le_rem_con_param_req_reply_cmd_handler = 0x40002b80; +hci_le_set_data_len_cmd_handler = 0x40002b8c; +hci_le_set_phy_cmd_handler = 0x40002b98; +hci_le_start_enc_cmd_handler = 0x40002ba4; +hci_rd_auth_payl_to_cmd_handler = 0x40002bb0; +hci_rd_rem_ver_info_cmd_handler = 0x40002bbc; +hci_rd_rssi_cmd_handler = 0x40002bc8; +hci_rd_tx_pwr_lvl_cmd_handler = 0x40002bd4; +hci_vs_set_pref_slave_evt_dur_cmd_handler = 0x40002be0; +hci_vs_set_pref_slave_latency_cmd_handler = 0x40002bec; +hci_wr_auth_payl_to_cmd_handler = 0x40002bf8; +ll_channel_map_ind_handler = 0x40002c04; +ll_connection_param_req_handler = 0x40002c10; +ll_connection_param_rsp_handler = 0x40002c1c; +ll_connection_update_ind_handler = 0x40002c28; +ll_enc_req_handler = 0x40002c34; +ll_enc_rsp_handler = 0x40002c40; +ll_feature_req_handler = 0x40002c4c; +ll_feature_rsp_handler = 0x40002c58; +ll_length_req_handler = 0x40002c64; +ll_length_rsp_handler = 0x40002c70; +ll_min_used_channels_ind_handler = 0x40002c7c; +ll_pause_enc_req_handler = 0x40002c88; +ll_pause_enc_rsp_handler = 0x40002c94; +ll_phy_req_handler = 0x40002ca0; +ll_phy_rsp_handler = 0x40002cac; +ll_phy_update_ind_handler = 0x40002cb8; +ll_ping_req_handler = 0x40002cc4; +ll_ping_rsp_handler = 0x40002cd0; +ll_slave_feature_req_handler = 0x40002cdc; +ll_start_enc_req_handler = 0x40002ce8; +ll_start_enc_rsp_handler = 0x40002cf4; +ll_terminate_ind_handler = 0x40002d00; +ll_version_ind_handler = 0x40002d0c; +llc_auth_payl_nearly_to_handler = 0x40002d18; +llc_auth_payl_real_to_handler = 0x40002d24; +llc_encrypt_ind_handler = 0x40002d30; +llc_hci_command_handler_wrapper = 0x40002d3c; +llc_ll_connection_param_req_pdu_send = 0x40002d48; +llc_ll_connection_param_rsp_pdu_send = 0x40002d54; +llc_ll_connection_update_ind_pdu_send = 0x40002d60; +llc_ll_enc_req_pdu_send = 0x40002d6c; +llc_ll_enc_rsp_pdu_send = 0x40002d78; +llc_ll_feature_req_pdu_send = 0x40002d84; +llc_ll_feature_rsp_pdu_send = 0x40002d90; +llc_ll_length_req_pdu_send = 0x40002d9c; +llc_ll_length_rsp_pdu_send = 0x40002da8; +llc_ll_pause_enc_req_pdu_send = 0x40002db4; +llc_ll_pause_enc_rsp_pdu_send = 0x40002dc0; +llc_ll_phy_req_pdu_send = 0x40002dcc; +llc_ll_phy_rsp_pdu_send = 0x40002dd8; +llc_ll_ping_req_pdu_send = 0x40002de4; +llc_ll_ping_rsp_pdu_send = 0x40002df0; +llc_ll_start_enc_req_pdu_send = 0x40002dfc; +llc_ll_start_enc_rsp_pdu_send = 0x40002e08; +llc_ll_terminate_ind_pdu_send = 0x40002e14; +llc_ll_unknown_rsp_pdu_send = 0x40002e20; +llc_llcp_ch_map_update_ind_pdu_send = 0x40002e2c; +llc_llcp_phy_upd_ind_pdu_send = 0x40002e38; +llc_llcp_version_ind_pdu_send = 0x40002e44; +llc_op_ch_map_upd_ind_handler = 0x40002e50; +llc_op_con_upd_ind_handler = 0x40002e5c; +llc_op_disconnect_ind_handler = 0x40002e68; +llc_op_dl_upd_ind_handler = 0x40002e74; +llc_op_encrypt_ind_handler = 0x40002e80; +llc_op_feats_exch_ind_handler = 0x40002e8c; +llc_op_le_ping_ind_handler = 0x40002e98; +llc_op_phy_upd_ind_handler = 0x40002ea4; +llc_op_ver_exch_ind_handler = 0x40002eb0; +llc_stopped_ind_handler = 0x40002ebc; +lld_acl_rx_ind_handler = 0x40002ec8; +lld_acl_tx_cfm_handler = 0x40002ed4; +lld_adv_end_ind_handler = 0x40002ee0; +lld_adv_rep_ind_handler = 0x40002eec; +lld_ch_map_upd_cfm_handler = 0x40002ef8; +lld_con_estab_ind_handler = 0x40002f04; +lld_con_evt_sd_evt_time_set = 0x40002f10; +lld_con_offset_upd_ind_handler = 0x40002f1c; +lld_con_param_upd_cfm_handler = 0x40002f28; +lld_disc_ind_handler = 0x40002f34; +lld_init_end_ind_handler = 0x40002f40; +lld_llcp_rx_ind_handler_wrapper = 0x40002f4c; +lld_llcp_tx_cfm_handler = 0x40002f58; +lld_per_adv_end_ind_handler = 0x40002f64; +lld_per_adv_rep_ind_handler = 0x40002f70; +lld_per_adv_rx_end_ind_handler = 0x40002f7c; +lld_phy_coded_500k_get = 0x40002f88; +lld_phy_upd_cfm_handler = 0x40002f94; +lld_scan_end_ind_handler = 0x40002fa0; +lld_scan_req_ind_handler = 0x40002fac; +lld_sync_start_req_handler = 0x40002fb8; +lld_test_end_ind_handler = 0x40002fc4; +lld_update_rxbuf_handler = 0x40002fd0; +llm_ch_map_update_ind_handler = 0x40002fdc; +llm_hci_command_handler_wrapper = 0x40002fe8; +llm_scan_period_to_handler = 0x40002ff4; +r_Add2SelfBigHex256 = 0x40003000; +r_AddBigHex256 = 0x4000300c; +r_AddBigHexModP256 = 0x40003018; +r_AddP256 = 0x40003024; +r_AddPdiv2_256 = 0x40003030; +r_GF_Jacobian_Point_Addition256 = 0x4000303c; +r_GF_Jacobian_Point_Double256 = 0x40003048; +r_GF_Point_Jacobian_To_Affine256 = 0x40003054; +r_MultiplyBigHexByUint32_256 = 0x40003060; +r_MultiplyBigHexModP256 = 0x4000306c; +r_MultiplyByU16ModP256 = 0x40003078; +r_SubtractBigHex256 = 0x40003084; +r_SubtractBigHexMod256 = 0x40003090; +r_SubtractBigHexUint32_256 = 0x4000309c; +r_SubtractFromSelfBigHex256 = 0x400030a8; +r_SubtractFromSelfBigHexSign256 = 0x400030b4; +r_aes_alloc = 0x400030c0; +r_aes_ccm_continue = 0x400030cc; +r_aes_ccm_process_e = 0x400030d8; +r_aes_ccm_xor_128_lsb = 0x400030e4; +r_aes_ccm_xor_128_msb = 0x400030f0; +r_aes_cmac_continue = 0x400030fc; +r_aes_cmac_start = 0x40003108; +r_aes_k1_continue = 0x40003114; +r_aes_k2_continue = 0x40003120; +r_aes_k3_continue = 0x4000312c; +r_aes_k4_continue = 0x40003138; +r_aes_shift_left_128 = 0x40003144; +r_aes_start = 0x40003150; +r_aes_xor_128 = 0x4000315c; +r_assert_err = 0x40003168; +r_assert_param = 0x40003174; +r_assert_warn = 0x40003180; +r_bigHexInversion256 = 0x4000318c; +r_ble_sw_cca_check_isr = 0x40003198; +r_ble_util_buf_acl_tx_alloc = 0x400031a4; +r_ble_util_buf_acl_tx_elt_get = 0x400031b0; +r_ble_util_buf_acl_tx_free = 0x400031bc; +r_ble_util_buf_acl_tx_free_in_isr = 0x400031c8; +r_ble_util_buf_adv_tx_alloc = 0x400031d4; +r_ble_util_buf_adv_tx_free = 0x400031e0; +r_ble_util_buf_adv_tx_free_in_isr = 0x400031ec; +r_ble_util_buf_env_deinit = 0x400031f8; +r_ble_util_buf_env_init = 0x40003204; +r_ble_util_buf_get_rx_buf_nb = 0x40003210; +r_ble_util_buf_get_rx_buf_size = 0x4000321c; +r_ble_util_buf_llcp_tx_alloc = 0x40003228; +r_ble_util_buf_llcp_tx_free = 0x40003234; +r_ble_util_buf_rx_alloc = 0x40003240; +r_ble_util_buf_rx_alloc_in_isr = 0x4000324c; +r_ble_util_buf_rx_free = 0x40003258; +r_ble_util_buf_rx_free_in_isr = 0x40003264; +r_ble_util_buf_set_rx_buf_nb = 0x40003270; +r_ble_util_buf_set_rx_buf_size = 0x4000327c; +r_ble_util_data_rx_buf_reset = 0x40003288; +r_bt_bb_get_intr_mask = 0x40003294; +r_bt_bb_intr_clear = 0x400032a0; +r_bt_bb_intr_mask_set = 0x400032ac; +r_bt_bb_isr = 0x400032b8; +r_bt_rf_coex_cfg_set = 0x400032c4; +r_bt_rf_coex_conn_dynamic_pti_en_get = 0x400032d0; +r_bt_rf_coex_conn_phy_coded_data_time_limit_en_get = 0x400032dc; +r_bt_rf_coex_ext_adv_dynamic_pti_en_get = 0x400032e8; +r_bt_rf_coex_ext_scan_dynamic_pti_en_get = 0x400032f4; +r_bt_rf_coex_legacy_adv_dynamic_pti_en_get = 0x40003300; +r_bt_rf_coex_per_adv_dynamic_pti_en_get = 0x4000330c; +r_bt_rf_coex_pti_table_get = 0x40003318; +r_bt_rf_coex_st_param_get = 0x40003324; +r_bt_rf_coex_st_param_set = 0x40003330; +r_bt_rf_coex_sync_scan_dynamic_pti_en_get = 0x4000333c; +r_bt_rma_apply_rule_cs_fmt = 0x40003348; +r_bt_rma_apply_rule_cs_idx = 0x40003354; +r_bt_rma_configure = 0x40003360; +r_bt_rma_deregister_rule_cs_fmt = 0x4000336c; +r_bt_rma_deregister_rule_cs_idx = 0x40003378; +r_bt_rma_get_ant_by_act = 0x40003384; +r_bt_rma_init = 0x40003390; +r_bt_rma_register_rule_cs_fmt = 0x4000339c; +r_bt_rma_register_rule_cs_idx = 0x400033a8; +r_bt_rtp_apply_rule_cs_fmt = 0x400033b4; +r_bt_rtp_apply_rule_cs_idx = 0x400033c0; +r_bt_rtp_deregister_rule_cs_fmt = 0x400033cc; +r_bt_rtp_deregister_rule_cs_idx = 0x400033d8; +r_bt_rtp_get_txpwr_idx_by_act = 0x400033e4; +r_bt_rtp_init = 0x400033f0; +r_bt_rtp_register_rule_cs_fmt = 0x400033fc; +r_bt_rtp_register_rule_cs_idx = 0x40003408; +r_btdm_isr = 0x40003414; +r_btdm_task_post = 0x40003420; +r_btdm_task_post_from_isr = 0x4000342c; +r_btdm_task_recycle = 0x40003438; +r_cali_phase_match_p = 0x40003444; +r_cmp_abs_time = 0x40003450; +r_cmp_dest_id = 0x4000345c; +r_cmp_timer_id = 0x40003468; +r_co_bdaddr_compare = 0x40003474; +r_co_ble_pkt_dur_in_us = 0x40003480; +r_co_list_extract = 0x4000348c; +r_co_list_extract_after = 0x40003498; +r_co_list_extract_sublist = 0x400034a4; +r_co_list_find = 0x400034b0; +r_co_list_init = 0x400034bc; +r_co_list_insert_after = 0x400034c8; +r_co_list_insert_before = 0x400034d4; +r_co_list_merge = 0x400034e0; +r_co_list_pool_init = 0x400034ec; +r_co_list_pop_front = 0x400034f8; +r_co_list_push_back = 0x40003504; +r_co_list_push_back_sublist = 0x40003510; +r_co_list_push_front = 0x4000351c; +r_co_list_size = 0x40003528; +r_co_nb_good_le_channels = 0x40003534; +r_co_util_pack = 0x40003540; +r_co_util_read_array_size = 0x4000354c; +r_co_util_unpack = 0x40003558; +r_dbg_env_deinit = 0x40003564; +r_dbg_env_init = 0x40003570; +r_dbg_platform_reset_complete = 0x4000357c; +r_dl_upd_proc_start = 0x40003588; +r_dump_data = 0x40003594; +r_ecc_abort_key256_generation = 0x400035a0; +r_ecc_gen_new_public_key = 0x400035ac; +r_ecc_gen_new_secret_key = 0x400035b8; +r_ecc_generate_key256 = 0x400035c4; +r_ecc_get_debug_Keys = 0x400035d0; +r_ecc_init = 0x400035dc; +r_ecc_is_valid_point = 0x400035e8; +r_ecc_multiplication_event_handler = 0x400035f4; +r_ecc_point_multiplication_win_256 = 0x40003600; +r_emi_alloc_em_mapping_by_offset = 0x4000360c; +r_emi_base_reg_lut_show = 0x40003618; +r_emi_em_base_reg_show = 0x40003624; +r_emi_free_em_mapping_by_offset = 0x40003630; +r_emi_get_em_mapping_idx_by_offset = 0x4000363c; +r_emi_get_mem_addr_by_offset = 0x40003648; +r_emi_overwrite_em_mapping_by_offset = 0x40003654; +r_esp_vendor_hci_command_handler = 0x40003660; +r_get_stack_usage = 0x4000366c; +r_h4tl_acl_hdr_rx_evt_handler = 0x40003678; +r_h4tl_cmd_hdr_rx_evt_handler = 0x40003684; +r_h4tl_cmd_pld_rx_evt_handler = 0x40003690; +r_h4tl_eif_io_event_post = 0x4000369c; +r_h4tl_eif_register = 0x400036a8; +r_h4tl_init = 0x400036b4; +r_h4tl_out_of_sync = 0x400036c0; +r_h4tl_out_of_sync_check = 0x400036cc; +r_h4tl_read_hdr = 0x400036d8; +r_h4tl_read_next_out_of_sync = 0x400036e4; +r_h4tl_read_payl = 0x400036f0; +r_h4tl_read_start = 0x400036fc; +r_h4tl_rx_acl_hdr_extract = 0x40003708; +r_h4tl_rx_cmd_hdr_extract = 0x40003714; +r_h4tl_rx_done = 0x40003720; +r_h4tl_start = 0x4000372c; +r_h4tl_stop = 0x40003738; +r_h4tl_tx_done = 0x40003744; +r_h4tl_tx_evt_handler = 0x40003750; +r_h4tl_write = 0x4000375c; +r_hci_acl_tx_data_alloc = 0x40003768; +r_hci_acl_tx_data_received = 0x40003774; +r_hci_basic_cmd_send_2_controller = 0x40003780; +r_hci_ble_adv_report_filter_check = 0x4000378c; +r_hci_ble_adv_report_tx_check = 0x40003798; +r_hci_ble_conhdl_register = 0x400037a4; +r_hci_ble_conhdl_unregister = 0x400037b0; +r_hci_build_acl_data = 0x400037bc; +r_hci_build_cc_evt = 0x400037c8; +r_hci_build_cs_evt = 0x400037d4; +r_hci_build_evt = 0x400037e0; +r_hci_build_le_evt = 0x400037ec; +r_hci_cmd_get_max_param_size = 0x400037f8; +r_hci_cmd_received = 0x40003804; +r_hci_cmd_reject = 0x40003810; +r_hci_evt_mask_check = 0x4000381c; +r_hci_evt_mask_set = 0x40003828; +r_hci_fc_acl_buf_size_set = 0x40003834; +r_hci_fc_acl_en = 0x40003840; +r_hci_fc_acl_packet_sent = 0x4000384c; +r_hci_fc_check_host_available_nb_acl_packets = 0x40003858; +r_hci_fc_host_nb_acl_pkts_complete = 0x40003864; +r_hci_fc_init = 0x40003870; +r_hci_look_for_cmd_desc = 0x4000387c; +r_hci_look_for_evt_desc = 0x40003888; +r_hci_look_for_le_evt_desc = 0x40003894; +r_hci_look_for_le_evt_desc_esp = 0x400038a0; +r_hci_pack_bytes = 0x400038ac; +r_hci_register_vendor_desc_tab = 0x400038b8; +r_hci_send_2_controller = 0x400038c4; +r_hci_send_2_host = 0x400038d0; +r_hci_tl_c2h_data_flow_on = 0x400038dc; +r_hci_tl_cmd_hdr_rx_evt_handler = 0x400038e8; +r_hci_tl_cmd_pld_rx_evt_handler = 0x400038f4; +r_hci_tl_get_pkt = 0x40003900; +r_hci_tl_hci_pkt_handler = 0x4000390c; +r_hci_tl_hci_tx_done_evt_handler = 0x40003918; +r_hci_tl_inc_nb_h2c_cmd_pkts = 0x40003924; +r_hci_tl_save_pkt = 0x40003930; +r_hci_tl_send = 0x4000393c; +r_hci_tx_done = 0x40003948; +r_hci_tx_start = 0x40003954; +r_hci_tx_trigger = 0x40003960; +r_isValidSecretKey_256 = 0x4000396c; +r_ke_check_malloc = 0x40003978; +r_ke_event_callback_set = 0x40003984; +r_ke_event_clear = 0x40003990; +r_ke_event_flush = 0x4000399c; +r_ke_event_get = 0x400039a8; +r_ke_event_get_all = 0x400039b4; +r_ke_event_init = 0x400039c0; +r_ke_event_schedule = 0x400039cc; +r_ke_event_set = 0x400039d8; +r_ke_flush = 0x400039e4; +r_ke_free = 0x400039f0; +r_ke_handler_search = 0x400039fc; +r_ke_init = 0x40003a08; +r_ke_is_free = 0x40003a14; +r_ke_malloc = 0x40003a20; +r_ke_mem_init = 0x40003a2c; +r_ke_mem_is_empty = 0x40003a38; +r_ke_mem_is_in_heap = 0x40003a44; +r_ke_msg_alloc = 0x40003a50; +r_ke_msg_dest_id_get = 0x40003a5c; +r_ke_msg_discard = 0x40003a68; +r_ke_msg_forward = 0x40003a74; +r_ke_msg_forward_new_id = 0x40003a80; +r_ke_msg_free = 0x40003a8c; +r_ke_msg_in_queue = 0x40003a98; +r_ke_msg_save = 0x40003aa4; +r_ke_msg_send = 0x40003ab0; +r_ke_msg_send_basic = 0x40003abc; +r_ke_msg_src_id_get = 0x40003ac8; +r_ke_queue_extract = 0x40003ad4; +r_ke_queue_insert = 0x40003ae0; +r_ke_sleep_check = 0x40003aec; +r_ke_state_get = 0x40003af8; +r_ke_state_set = 0x40003b04; +r_ke_task_check = 0x40003b10; +r_ke_task_create = 0x40003b1c; +r_ke_task_delete = 0x40003b28; +r_ke_task_handler_get = 0x40003b34; +r_ke_task_init = 0x40003b40; +r_ke_task_msg_flush = 0x40003b4c; +r_ke_task_saved_update = 0x40003b58; +r_ke_task_schedule = 0x40003b64; +r_ke_time = 0x40003b70; +r_ke_time_cmp = 0x40003b7c; +r_ke_time_past = 0x40003b88; +r_ke_timer_active = 0x40003b94; +r_ke_timer_adjust_all = 0x40003ba0; +r_ke_timer_clear = 0x40003bac; +r_ke_timer_init = 0x40003bb8; +r_ke_timer_schedule = 0x40003bc4; +r_ke_timer_set = 0x40003bd0; +r_led_init = 0x40003bdc; +r_led_set_all = 0x40003be8; +r_llc_aes_res_cb = 0x40003bf4; +r_llc_ch_map_up_proc_err_cb = 0x40003c00; +r_llc_cleanup = 0x40003c0c; +r_llc_cmd_cmp_send = 0x40003c18; +r_llc_cmd_stat_send = 0x40003c24; +r_llc_con_move_cbk = 0x40003c30; +r_llc_con_plan_set_update = 0x40003c3c; +r_llc_con_upd_param_in_range = 0x40003c48; +r_llc_disconnect = 0x40003c54; +r_llc_disconnect_end = 0x40003c60; +r_llc_disconnect_proc_continue = 0x40003c6c; +r_llc_disconnect_proc_err_cb = 0x40003c78; +r_llc_dl_chg_check = 0x40003c84; +r_llc_dle_proc_err_cb = 0x40003c90; +r_llc_feats_exch_proc_err_cb = 0x40003c9c; +r_llc_hci_cmd_handler_tab_p_get = 0x40003ca8; +r_llc_hci_command_handler = 0x40003cb4; +r_llc_hci_con_param_req_evt_send = 0x40003cc0; +r_llc_hci_con_upd_info_send = 0x40003ccc; +r_llc_hci_disconnected_dis = 0x40003cd8; +r_llc_hci_dl_upd_info_send = 0x40003ce4; +r_llc_hci_enc_evt_send = 0x40003cf0; +r_llc_hci_feats_info_send = 0x40003cfc; +r_llc_hci_le_phy_upd_cmp_evt_send = 0x40003d08; +r_llc_hci_ltk_request_evt_send = 0x40003d14; +r_llc_hci_nb_cmp_pkts_evt_send = 0x40003d20; +r_llc_hci_version_info_send = 0x40003d2c; +r_llc_init_term_proc = 0x40003d38; +r_llc_iv_skd_rand_gen = 0x40003d44; +r_llc_le_ping_proc_continue = 0x40003d50; +r_llc_le_ping_proc_err_cb = 0x40003d5c; +r_llc_le_ping_restart = 0x40003d68; +r_llc_le_ping_set = 0x40003d74; +r_llc_ll_pause_enc_rsp_ack_handler = 0x40003d80; +r_llc_ll_reject_ind_ack_handler = 0x40003d8c; +r_llc_ll_reject_ind_pdu_send = 0x40003d98; +r_llc_ll_start_enc_rsp_ack_handler = 0x40003da4; +r_llc_ll_terminate_ind_ack = 0x40003db0; +r_llc_ll_unknown_ind_handler = 0x40003dbc; +r_llc_llcp_send = 0x40003dc8; +r_llc_llcp_state_set = 0x40003dd4; +r_llc_llcp_trans_timer_set = 0x40003de0; +r_llc_llcp_tx_check = 0x40003dec; +r_llc_loc_ch_map_proc_continue = 0x40003df8; +r_llc_loc_con_upd_proc_continue = 0x40003e04; +r_llc_loc_con_upd_proc_err_cb = 0x40003e10; +r_llc_loc_dl_upd_proc_continue = 0x40003e1c; +r_llc_loc_encrypt_proc_continue = 0x40003e28; +r_llc_loc_encrypt_proc_err_cb = 0x40003e34; +r_llc_loc_feats_exch_proc_continue = 0x40003e40; +r_llc_loc_phy_upd_proc_continue = 0x40003e4c; +r_llc_loc_phy_upd_proc_err_cb = 0x40003e58; +r_llc_msg_handler_tab_p_get = 0x40003e64; +r_llc_pref_param_compute = 0x40003e70; +r_llc_proc_collision_check = 0x40003e7c; +r_llc_proc_err_ind = 0x40003e88; +r_llc_proc_get = 0x40003e94; +r_llc_proc_id_get = 0x40003ea0; +r_llc_proc_reg = 0x40003eac; +r_llc_proc_state_get = 0x40003eb8; +r_llc_proc_state_set = 0x40003ec4; +r_llc_proc_timer_pause_set = 0x40003ed0; +r_llc_proc_timer_set = 0x40003edc; +r_llc_proc_unreg = 0x40003ee8; +r_llc_rem_ch_map_proc_continue = 0x40003ef4; +r_llc_rem_con_upd_proc_continue = 0x40003f00; +r_llc_rem_con_upd_proc_err_cb = 0x40003f0c; +r_llc_rem_dl_upd_proc = 0x40003f18; +r_llc_rem_encrypt_proc_continue = 0x40003f24; +r_llc_rem_encrypt_proc_err_cb = 0x40003f30; +r_llc_rem_phy_upd_proc_continue = 0x40003f3c; +r_llc_rem_phy_upd_proc_err_cb = 0x40003f48; +r_llc_role_get = 0x40003f54; +r_llc_sk_gen = 0x40003f60; +r_llc_start = 0x40003f6c; +r_llc_stop = 0x40003f78; +r_llc_ver_exch_loc_proc_continue = 0x40003f84; +r_llc_ver_proc_err_cb = 0x40003f90; +r_llcp_pdu_handler_tab_p_get = 0x40003f9c; +r_lld_aa_gen = 0x40003fa8; +r_lld_adv_adv_data_set = 0x40003fb4; +r_lld_adv_adv_data_update = 0x40003fc0; +r_lld_adv_aux_ch_idx_set = 0x40003fcc; +r_lld_adv_aux_evt_canceled_cbk = 0x40003fd8; +r_lld_adv_aux_evt_start_cbk = 0x40003fe4; +r_lld_adv_coex_check_ext_adv_synced = 0x40003ff0; +r_lld_adv_coex_env_reset = 0x40003ffc; +r_lld_adv_duration_update = 0x40004008; +r_lld_adv_dynamic_pti_process = 0x40004014; +r_lld_adv_end = 0x40004020; +r_lld_adv_evt_canceled_cbk = 0x4000402c; +r_lld_adv_evt_start_cbk = 0x40004038; +r_lld_adv_ext_chain_construct = 0x40004044; +r_lld_adv_ext_pkt_prepare = 0x40004050; +r_lld_adv_frm_cbk = 0x4000405c; +r_lld_adv_frm_isr = 0x40004068; +r_lld_adv_frm_skip_isr = 0x40004074; +r_lld_adv_init = 0x40004080; +r_lld_adv_pkt_rx = 0x4000408c; +r_lld_adv_pkt_rx_connect_ind = 0x40004098; +r_lld_adv_pkt_rx_send_scan_req_evt = 0x400040a4; +r_lld_adv_rand_addr_update = 0x400040b0; +r_lld_adv_restart = 0x400040bc; +r_lld_adv_scan_rsp_data_set = 0x400040c8; +r_lld_adv_scan_rsp_data_update = 0x400040d4; +r_lld_adv_set_tx_power = 0x400040e0; +r_lld_adv_start = 0x400040ec; +r_lld_adv_stop = 0x400040f8; +r_lld_adv_sync_info_set = 0x40004104; +r_lld_adv_sync_info_update = 0x40004110; +r_lld_calc_aux_rx = 0x4000411c; +r_lld_cca_alloc = 0x40004128; +r_lld_cca_data_reset = 0x40004134; +r_lld_cca_free = 0x40004140; +r_lld_ch_assess_data_get = 0x4000414c; +r_lld_ch_idx_get = 0x40004158; +r_lld_ch_map_set = 0x40004164; +r_lld_channel_assess = 0x40004170; +r_lld_con_activity_act_offset_compute = 0x4000417c; +r_lld_con_activity_offset_compute = 0x40004188; +r_lld_con_ch_map_update = 0x40004194; +r_lld_con_cleanup = 0x400041a0; +r_lld_con_current_tx_power_get = 0x400041ac; +r_lld_con_data_flow_set = 0x400041b8; +r_lld_con_data_len_update = 0x400041c4; +r_lld_con_data_tx = 0x400041d0; +r_lld_con_enc_key_load = 0x400041dc; +r_lld_con_event_counter_get = 0x400041e8; +r_lld_con_evt_canceled_cbk = 0x400041f4; +r_lld_con_evt_duration_min_get = 0x40004200; +r_lld_con_evt_max_eff_time_cal = 0x4000420c; +r_lld_con_evt_sd_evt_time_get = 0x40004218; +r_lld_con_evt_start_cbk = 0x40004224; +r_lld_con_evt_time_update = 0x40004230; +r_lld_con_free_all_tx_buf = 0x4000423c; +r_lld_con_frm_cbk = 0x40004248; +r_lld_con_frm_isr = 0x40004254; +r_lld_con_frm_skip_isr = 0x40004260; +r_lld_con_init = 0x4000426c; +r_lld_con_llcp_tx = 0x40004278; +r_lld_con_max_lat_calc = 0x40004284; +r_lld_con_offset_get = 0x40004290; +r_lld_con_param_update = 0x4000429c; +r_lld_con_phys_update = 0x400042a8; +r_lld_con_pref_slave_evt_dur_set = 0x400042b4; +r_lld_con_pref_slave_latency_set = 0x400042c0; +r_lld_con_rssi_get = 0x400042cc; +r_lld_con_rx = 0x400042d8; +r_lld_con_rx_channel_assess = 0x400042e4; +r_lld_con_rx_enc = 0x400042f0; +r_lld_con_rx_isr = 0x400042fc; +r_lld_con_rx_link_info_check = 0x40004308; +r_lld_con_rx_llcp_check = 0x40004314; +r_lld_con_rx_sync_time_update = 0x40004320; +r_lld_con_sched = 0x4000432c; +r_lld_con_set_tx_power = 0x40004338; +r_lld_con_start = 0x40004344; +r_lld_con_stop = 0x40004350; +r_lld_con_tx = 0x4000435c; +r_lld_con_tx_enc = 0x40004368; +r_lld_con_tx_isr = 0x40004374; +r_lld_con_tx_len_update = 0x40004380; +r_lld_con_tx_len_update_for_intv = 0x4000438c; +r_lld_con_tx_len_update_for_rate = 0x40004398; +r_lld_con_tx_prog = 0x400043a4; +r_lld_conn_dynamic_pti_process = 0x400043b0; +r_lld_continue_scan_rx_isr_end_process = 0x400043bc; +r_lld_ext_scan_dynamic_pti_process = 0x400043c8; +r_lld_hw_cca_end_isr = 0x400043d4; +r_lld_hw_cca_evt_handler = 0x400043e0; +r_lld_hw_cca_isr = 0x400043ec; +r_lld_init_cal_anchor_point = 0x400043f8; +r_lld_init_compute_winoffset = 0x40004404; +r_lld_init_connect_req_pack = 0x40004410; +r_lld_init_end = 0x4000441c; +r_lld_init_evt_canceled_cbk = 0x40004428; +r_lld_init_evt_start_cbk = 0x40004434; +r_lld_init_frm_cbk = 0x40004440; +r_lld_init_frm_eof_isr = 0x4000444c; +r_lld_init_frm_skip_isr = 0x40004458; +r_lld_init_init = 0x40004464; +r_lld_init_process_pkt_rx = 0x40004470; +r_lld_init_process_pkt_rx_adv_ext_ind = 0x4000447c; +r_lld_init_process_pkt_rx_adv_ind_or_direct_ind = 0x40004488; +r_lld_init_process_pkt_rx_aux_connect_rsp = 0x40004494; +r_lld_init_process_pkt_tx = 0x400044a0; +r_lld_init_process_pkt_tx_cal_con_timestamp = 0x400044ac; +r_lld_init_sched = 0x400044b8; +r_lld_init_set_tx_power = 0x400044c4; +r_lld_init_start = 0x400044d0; +r_lld_init_stop = 0x400044dc; +r_lld_instant_proc_end = 0x400044e8; +r_lld_llcp_rx_ind_handler = 0x400044f4; +r_lld_per_adv_ch_map_update = 0x40004500; +r_lld_per_adv_chain_construct = 0x4000450c; +r_lld_per_adv_cleanup = 0x40004518; +r_lld_per_adv_coex_env_reset = 0x40004524; +r_lld_per_adv_data_set = 0x40004530; +r_lld_per_adv_data_update = 0x4000453c; +r_lld_per_adv_dynamic_pti_process = 0x40004548; +r_lld_per_adv_evt_canceled_cbk = 0x40004554; +r_lld_per_adv_evt_start_cbk = 0x40004560; +r_lld_per_adv_ext_pkt_prepare = 0x4000456c; +r_lld_per_adv_frm_cbk = 0x40004578; +r_lld_per_adv_frm_isr = 0x40004584; +r_lld_per_adv_frm_skip_isr = 0x40004590; +r_lld_per_adv_init = 0x4000459c; +r_lld_per_adv_init_info_get = 0x400045a8; +r_lld_per_adv_list_add = 0x400045b4; +r_lld_per_adv_list_rem = 0x400045c0; +r_lld_per_adv_sched = 0x400045cc; +r_lld_per_adv_set_tx_power = 0x400045d8; +r_lld_per_adv_start = 0x400045e4; +r_lld_per_adv_stop = 0x400045f0; +r_lld_per_adv_sync_info_get = 0x400045fc; +r_lld_process_cca_data = 0x40004608; +r_lld_ral_search = 0x40004614; +r_lld_read_clock = 0x40004620; +r_lld_res_list_add = 0x4000462c; +r_lld_res_list_clear = 0x40004638; +r_lld_res_list_is_empty = 0x40004644; +r_lld_res_list_local_rpa_get = 0x40004650; +r_lld_res_list_peer_rpa_get = 0x4000465c; +r_lld_res_list_peer_update = 0x40004668; +r_lld_res_list_priv_mode_update = 0x40004674; +r_lld_res_list_rem = 0x40004680; +r_lld_reset_reg = 0x4000468c; +r_lld_rpa_renew = 0x40004698; +r_lld_rpa_renew_evt_canceled_cbk = 0x400046a4; +r_lld_rpa_renew_evt_start_cbk = 0x400046b0; +r_lld_rpa_renew_instant_cbk = 0x400046bc; +r_lld_rxdesc_check = 0x400046c8; +r_lld_rxdesc_free = 0x400046d4; +r_lld_scan_create_sync = 0x400046e0; +r_lld_scan_create_sync_cancel = 0x400046ec; +r_lld_scan_end = 0x400046f8; +r_lld_scan_evt_canceled_cbk = 0x40004704; +r_lld_scan_evt_start_cbk = 0x40004710; +r_lld_scan_frm_cbk = 0x4000471c; +r_lld_scan_frm_eof_isr = 0x40004728; +r_lld_scan_frm_rx_isr = 0x40004734; +r_lld_scan_frm_skip_isr = 0x40004740; +r_lld_scan_init = 0x4000474c; +r_lld_scan_params_update = 0x40004758; +r_lld_scan_process_pkt_rx = 0x40004764; +r_lld_scan_process_pkt_rx_adv_rep = 0x40004770; +r_lld_scan_process_pkt_rx_aux_adv_ind = 0x4000477c; +r_lld_scan_process_pkt_rx_aux_chain_ind = 0x40004788; +r_lld_scan_process_pkt_rx_aux_scan_rsp = 0x40004794; +r_lld_scan_process_pkt_rx_ext_adv = 0x400047a0; +r_lld_scan_process_pkt_rx_ext_adv_ind = 0x400047ac; +r_lld_scan_process_pkt_rx_legacy_adv = 0x400047b8; +r_lld_scan_restart = 0x400047c4; +r_lld_scan_sched = 0x400047d0; +r_lld_scan_set_tx_power = 0x400047dc; +r_lld_scan_start = 0x400047e8; +r_lld_scan_stop = 0x400047f4; +r_lld_scan_sync_accept = 0x40004800; +r_lld_scan_sync_info_unpack = 0x4000480c; +r_lld_scan_trunc_ind = 0x40004818; +r_lld_sw_cca_evt_handler = 0x40004824; +r_lld_sw_cca_isr = 0x40004830; +r_lld_sync_ch_map_update = 0x4000483c; +r_lld_sync_cleanup = 0x40004848; +r_lld_sync_evt_canceled_cbk = 0x40004854; +r_lld_sync_evt_start_cbk = 0x40004860; +r_lld_sync_frm_cbk = 0x4000486c; +r_lld_sync_frm_eof_isr = 0x40004878; +r_lld_sync_frm_rx_isr = 0x40004884; +r_lld_sync_frm_skip_isr = 0x40004890; +r_lld_sync_init = 0x4000489c; +r_lld_sync_process_pkt_rx = 0x400048a8; +r_lld_sync_process_pkt_rx_aux_sync_ind = 0x400048b4; +r_lld_sync_process_pkt_rx_pkt_check = 0x400048c0; +r_lld_sync_scan_dynamic_pti_process = 0x400048cc; +r_lld_sync_sched = 0x400048d8; +r_lld_sync_start = 0x400048e4; +r_lld_sync_stop = 0x400048f0; +r_lld_sync_trunc_ind = 0x400048fc; +r_lld_test_cleanup = 0x40004908; +r_lld_test_evt_canceled_cbk = 0x40004914; +r_lld_test_evt_start_cbk = 0x40004920; +r_lld_test_freq2chnl = 0x4000492c; +r_lld_test_frm_cbk = 0x40004938; +r_lld_test_frm_isr = 0x40004944; +r_lld_test_init = 0x40004950; +r_lld_test_rx_isr = 0x4000495c; +r_lld_test_set_tx_power = 0x40004968; +r_lld_test_start = 0x40004974; +r_lld_test_stop = 0x40004980; +r_lld_update_rxbuf = 0x4000498c; +r_lld_update_rxbuf_isr = 0x40004998; +r_lld_white_list_add = 0x400049a4; +r_lld_white_list_rem = 0x400049b0; +r_llm_activity_free_get = 0x400049bc; +r_llm_activity_free_set = 0x400049c8; +r_llm_activity_syncing_get = 0x400049d4; +r_llm_adv_con_len_check = 0x400049e0; +r_llm_adv_hdl_to_id = 0x400049ec; +r_llm_adv_rep_flow_control_check = 0x400049f8; +r_llm_adv_rep_flow_control_update = 0x40004a04; +r_llm_adv_reports_list_check = 0x40004a10; +r_llm_adv_set_all_release = 0x40004a1c; +r_llm_adv_set_dft_params = 0x40004a28; +r_llm_adv_set_release = 0x40004a34; +r_llm_aes_res_cb = 0x40004a40; +r_llm_ble_update_adv_flow_control = 0x40004a4c; +r_llm_ch_map_update = 0x40004a58; +r_llm_cmd_cmp_send = 0x40004a64; +r_llm_cmd_stat_send = 0x40004a70; +r_llm_dev_list_empty_entry = 0x40004a7c; +r_llm_dev_list_search = 0x40004a88; +r_llm_env_adv_dup_filt_deinit = 0x40004a94; +r_llm_env_adv_dup_filt_init = 0x40004aa0; +r_llm_init_ble_adv_report_flow_contol = 0x40004aac; +r_llm_is_dev_connected = 0x40004ab8; +r_llm_is_dev_synced = 0x40004ac4; +r_llm_is_non_con_act_ongoing_check = 0x40004ad0; +r_llm_is_wl_accessible = 0x40004adc; +r_llm_le_evt_mask_check = 0x40004ae8; +r_llm_le_features_get = 0x40004af4; +r_llm_link_disc = 0x40004b00; +r_llm_master_ch_map_get = 0x40004b0c; +r_llm_msg_handler_tab_p_get = 0x40004b18; +r_llm_no_activity = 0x40004b24; +r_llm_per_adv_slot_dur = 0x40004b30; +r_llm_plan_elt_get = 0x40004b3c; +r_llm_rx_path_comp_get = 0x40004b48; +r_llm_scan_start = 0x40004b54; +r_llm_scan_sync_acad_attach = 0x40004b60; +r_llm_scan_sync_acad_detach = 0x40004b6c; +r_llm_send_adv_lost_event_to_host = 0x40004b78; +r_llm_tx_path_comp_get = 0x40004b84; +r_misc_deinit = 0x40004b90; +r_misc_free_em_buf_in_isr = 0x40004b9c; +r_misc_init = 0x40004ba8; +r_misc_msg_handler_tab_p_get = 0x40004bb4; +r_notEqual256 = 0x40004bc0; +r_phy_upd_proc_start = 0x40004bcc; +r_platform_reset = 0x40004bd8; +r_register_esp_vendor_cmd_handler = 0x40004be4; +r_rf_em_init = 0x40004bf0; +r_rf_force_agc_enable = 0x40004bfc; +r_rf_reg_rd = 0x40004c08; +r_rf_reg_wr = 0x40004c14; +r_rf_reset = 0x40004c20; +r_rf_rssi_convert = 0x40004c2c; +r_rf_rw_v9_le_disable = 0x40004c38; +r_rf_rw_v9_le_enable = 0x40004c44; +r_rf_sleep = 0x40004c50; +r_rf_txpwr_cs_get = 0x40004c5c; +r_rf_txpwr_dbm_get = 0x40004c68; +r_rf_util_cs_fmt_convert = 0x40004c74; +r_rw_crypto_aes_ccm = 0x40004c80; +r_rw_crypto_aes_encrypt = 0x40004c8c; +r_rw_crypto_aes_init = 0x40004c98; +r_rw_crypto_aes_k1 = 0x40004ca4; +r_rw_crypto_aes_k2 = 0x40004cb0; +r_rw_crypto_aes_k3 = 0x40004cbc; +r_rw_crypto_aes_k4 = 0x40004cc8; +r_rw_crypto_aes_rand = 0x40004cd4; +r_rw_crypto_aes_result_handler = 0x40004ce0; +r_rw_crypto_aes_s1 = 0x40004cec; +r_rw_cryto_aes_cmac = 0x40004cf8; +r_rw_v9_init_em_radio_table = 0x40004d04; +r_rwble_isr = 0x40004d10; +r_rwble_sleep_enter = 0x40004d1c; +r_rwble_sleep_wakeup_end = 0x40004d28; +r_rwbtdm_isr_wrapper = 0x40004d34; +r_rwip_active_check = 0x40004d40; +r_rwip_aes_encrypt = 0x40004d4c; +r_rwip_assert = 0x40004d58; +r_rwip_crypt_evt_handler = 0x40004d64; +r_rwip_crypt_isr_handler = 0x40004d70; +r_rwip_eif_get = 0x40004d7c; +r_rwip_half_slot_2_lpcycles = 0x40004d88; +r_rwip_hus_2_lpcycles = 0x40004d94; +r_rwip_isr = 0x40004da0; +r_rwip_lpcycles_2_hus = 0x40004dac; +r_rwip_prevent_sleep_clear = 0x40004db8; +r_rwip_prevent_sleep_set = 0x40004dc4; +r_rwip_schedule = 0x40004dd0; +r_rwip_sleep = 0x40004ddc; +r_rwip_sw_int_handler = 0x40004de8; +r_rwip_sw_int_req = 0x40004df4; +r_rwip_time_get = 0x40004e00; +r_rwip_timer_10ms_handler = 0x40004e0c; +r_rwip_timer_10ms_set = 0x40004e18; +r_rwip_timer_hs_handler = 0x40004e24; +r_rwip_timer_hs_set = 0x40004e30; +r_rwip_timer_hus_handler = 0x40004e3c; +r_rwip_timer_hus_set = 0x40004e48; +r_rwip_wakeup = 0x40004e54; +r_rwip_wakeup_end = 0x40004e60; +r_rwip_wlcoex_set = 0x40004e6c; +r_sch_alarm_clear = 0x40004e78; +r_sch_alarm_init = 0x40004e84; +r_sch_alarm_prog = 0x40004e90; +r_sch_alarm_set = 0x40004e9c; +r_sch_alarm_timer_isr = 0x40004ea8; +r_sch_arb_conflict_check = 0x40004eb4; +r_sch_arb_elt_cancel = 0x40004ec0; +r_sch_arb_event_start_isr = 0x40004ecc; +r_sch_arb_init = 0x40004ed8; +r_sch_arb_insert = 0x40004ee4; +r_sch_arb_prog_timer = 0x40004ef0; +r_sch_arb_remove = 0x40004efc; +r_sch_arb_sw_isr = 0x40004f08; +r_sch_plan_chk = 0x40004f14; +r_sch_plan_clock_wrap_offset_update = 0x40004f20; +r_sch_plan_init = 0x40004f2c; +r_sch_plan_interval_req = 0x40004f38; +r_sch_plan_offset_max_calc = 0x40004f44; +r_sch_plan_offset_req = 0x40004f50; +r_sch_plan_position_range_compute = 0x40004f5c; +r_sch_plan_rem = 0x40004f68; +r_sch_plan_req = 0x40004f74; +r_sch_plan_set = 0x40004f80; +r_sch_prog_end_isr = 0x40004f8c; +r_sch_prog_init = 0x40004f98; +r_sch_prog_push = 0x40004fa4; +r_sch_prog_rx_isr = 0x40004fb0; +r_sch_prog_skip_isr = 0x40004fbc; +r_sch_prog_tx_isr = 0x40004fc8; +r_sch_slice_bg_add = 0x40004fd4; +r_sch_slice_bg_remove = 0x40004fe0; +r_sch_slice_compute = 0x40004fec; +r_sch_slice_fg_add = 0x40004ff8; +r_sch_slice_fg_remove = 0x40005004; +r_sch_slice_init = 0x40005010; +r_sch_slice_per_add = 0x4000501c; +r_sch_slice_per_remove = 0x40005028; +r_sdk_config_get_bt_sleep_enable = 0x40005034; +r_sdk_config_get_hl_derived_opts = 0x40005040; +r_sdk_config_get_opts = 0x4000504c; +r_sdk_config_get_priv_opts = 0x40005058; +r_sdk_config_set_bt_sleep_enable = 0x40005064; +r_sdk_config_set_hl_derived_opts = 0x40005070; +r_sdk_config_set_opts = 0x4000507c; +r_specialModP256 = 0x40005088; +r_unloaded_area_init = 0x40005094; +r_vhci_flow_off = 0x400050a0; +r_vhci_flow_on = 0x400050ac; +r_vhci_notify_host_send_available = 0x400050b8; +r_vhci_send_to_host = 0x400050c4; +r_vnd_hci_command_handler = 0x400050d0; +r_vshci_init = 0x400050dc; +vnd_hci_command_handler_wrapper = 0x400050e8; +r_lld_legacy_adv_dynamic_pti_get = 0x400050f4; +r_lld_legacy_adv_dynamic_pti_process = 0x40005100; +r_lld_ext_adv_dynamic_pti_get = 0x4000510c; +r_lld_ext_adv_dynamic_aux_pti_process = 0x40005118; +r_lld_ext_adv_dynamic_pti_process = 0x40005124; +r_lld_adv_ext_pkt_prepare_set = 0x40005130; +r_lld_adv_ext_chain_none_construct = 0x4000513c; +r_lld_adv_ext_chain_connectable_construct = 0x40005148; +r_lld_adv_ext_chain_scannable_construct = 0x40005154; +r_lld_adv_pkt_rx_connect_post = 0x40005160; +r_lld_adv_start_init_evt_param = 0x4000516c; +r_lld_adv_start_set_cs = 0x40005178; +r_lld_adv_start_update_filter_policy = 0x40005184; +r_lld_adv_start_schedule_asap = 0x40005190; +r_lld_con_tx_prog_new_packet_coex = 0x4000519c; +r_lld_con_tx_prog_new_packet = 0x400051a8; +r_lld_per_adv_dynamic_pti_get = 0x400051b4; +r_lld_per_adv_evt_start_chm_upd = 0x400051c0; +r_lld_ext_scan_dynamic_pti_get = 0x400051cc; +r_lld_scan_try_sched = 0x400051d8; +r_lld_sync_insert = 0x400051e4; +r_sch_prog_ble_push = 0x400051f0; +r_sch_prog_bt_push = 0x400051fc; +r_lld_init_evt_end_type_set = 0x40005208; +r_lld_init_evt_end_type_get = 0x40005214; +r_lld_adv_direct_adv_use_rpa_addr_state_set = 0x40005220; +r_lld_adv_direct_adv_use_rpa_addr_state_get = 0x4000522c; +r_lld_init_evt_end_type_check_state_set = 0x40005238; +r_lld_init_evt_end_type_check_state_get = 0x40005244; +/* Data (.data, .bss, .rodata) */ +bt_rf_coex_cfg_p = 0x3fceffa8; +bt_rf_coex_hooks_p = 0x3fceffa4; +btdm_env_p = 0x3fceffa0; +g_rw_controller_task_handle = 0x3fceff9c; +g_rw_init_sem = 0x3fceff98; +g_rw_schd_queue = 0x3fceff94; +lld_init_env = 0x3fceff90; +lld_rpa_renew_env = 0x3fceff8c; +lld_scan_env = 0x3fceff88; +lld_scan_sync_env = 0x3fceff84; +lld_test_env = 0x3fceff80; +p_ble_util_buf_env = 0x3fceff7c; +p_lld_env = 0x3fceff78; +p_llm_env = 0x3fceff74; +r_h4tl_eif_p = 0x3fceff70; +r_hli_funcs_p = 0x3fceff6c; +r_ip_funcs_p = 0x3fceff68; +r_modules_funcs_p = 0x3fceff64; +r_osi_funcs_p = 0x3fceff60; +r_plf_funcs_p = 0x3fceff5c; +vhci_env_p = 0x3fceff58; +aa_gen = 0x3fceff54; +aes_env = 0x3fceff48; +bt_rf_coex_cfg_cb = 0x3fcefef8; +btdm_pwr_state = 0x3fcefef4; +btdm_slp_err = 0x3fcefef0; +ecc_env = 0x3fcefee8; +esp_handler = 0x3fcefee0; +esp_vendor_cmd = 0x3fcefed8; +g_adv_delay_dis = 0x3fcefed4; +g_conflict_elt = 0x3fcefed0; +g_eif_api = 0x3fcefec0; +g_event_empty = 0x3fcefeb4; +g_llc_state = 0x3fcefeaa; +g_llm_state = 0x3fcefea9; +g_max_evt_env = 0x3fcefea7; +g_misc_state = 0x3fcefea6; +g_rma_rule_db = 0x3fcefe8a; +g_rtp_rule_db = 0x3fcefe6e; +g_scan_forever = 0x3fcefe6d; +g_time_msb = 0x3fcefe6c; +h4tl_env = 0x3fcefe44; +hci_env = 0x3fcefe21; +hci_ext_host = 0x3fcefe20; +hci_fc_env = 0x3fcefe18; +hci_tl_env = 0x3fcefdec; +ke_env = 0x3fcefdbc; +ke_event_env = 0x3fcefd7c; +ke_task_env = 0x3fcefd00; +llc_env = 0x3fcefcd8; +lld_adv_env = 0x3fcefcb0; +lld_con_env = 0x3fcefc88; +lld_exp_sync_pos_tab = 0x3fcefc80; +lld_per_adv_env = 0x3fcefc58; +lld_sync_env = 0x3fcefc30; +llm_le_adv_flow_env = 0x3fcefc24; +rw_sleep_enable = 0x3fcefc20; +rwble_env = 0x3fcefc18; +rwip_env = 0x3fcefbfc; +rwip_param = 0x3fcefbf0; +rwip_prog_delay = 0x3fcefbec; +rwip_rf = 0x3fcefbb4; +sch_alarm_env = 0x3fcefbac; +sch_arb_env = 0x3fcefb98; +sch_plan_env = 0x3fcefb90; +sch_prog_env = 0x3fcefa8c; +sch_slice_env = 0x3fcefa2c; +sch_slice_params = 0x3fcefa24; +timer_env = 0x3fcefa1c; +unloaded_area = 0x3fcefa18; +vshci_state = 0x3fcefa14; +TASK_DESC_LLC = 0x3fcefa08; +TASK_DESC_LLM = 0x3fcef9fc; +TASK_DESC_VSHCI = 0x3fcef9f0; +co_default_bdaddr = 0x3fcef9e8; +dbg_assert_block = 0x3fcef9e4; +g_bt_plf_log_level = 0x3fcef9e0; +hci_cmd_desc_tab_vs_esp = 0x3fcef9bc; +hci_command_handler_tab_esp = 0x3fcef9a4; +privacy_en = 0x3fcef9a0; +sdk_cfg_priv_opts = 0x3fcef958; +BasePoint_x_256 = 0x3ff1ffdc; +BasePoint_y_256 = 0x3ff1ffbc; +DebugE256PublicKey_x = 0x3ff1ff9c; +DebugE256PublicKey_y = 0x3ff1ff7c; +DebugE256SecretKey = 0x3ff1ff5c; +ECC_4Win_Look_up_table = 0x3ff1f7a0; +LLM_AA_CT1 = 0x3ff1f79a; +LLM_AA_CT2 = 0x3ff1f798; +RF_TX_PW_CONV_TBL = 0x3ff1f790; +TASK_DESC_MISC = 0x3ff1f784; +adv_evt_prop2type = 0x3ff1f766; +adv_evt_type2prop = 0x3ff1f761; +aes_cmac_zero = 0x3ff1f751; +aes_k2_salt = 0x3ff1f741; +aes_k3_id64 = 0x3ff1f73c; +aes_k3_salt = 0x3ff1f72c; +aes_k4_id6 = 0x3ff1f728; +aes_k4_salt = 0x3ff1f718; +bigHexP256 = 0x3ff1f6ec; +byte_tx_time = 0x3ff1f6e2; +co_null_bdaddr = 0x3ff1f6dc; +co_phy_mask_to_rate = 0x3ff1f6d7; +co_phy_mask_to_value = 0x3ff1f6d2; +co_phy_to_rate = 0x3ff1f6ce; +co_phy_value_to_mask = 0x3ff1f6ca; +co_rate_to_byte_dur_us = 0x3ff1f6c5; +co_rate_to_phy = 0x3ff1f6c0; +co_rate_to_phy_mask = 0x3ff1f6bc; +co_sca2ppm = 0x3ff1f6ac; +coef_B = 0x3ff1f680; +connect_req_dur_tab = 0x3ff1f678; +ecc_Jacobian_InfinityPoint256 = 0x3ff1f5f4; +em_base_reg_lut = 0x3ff1f526; +fixed_tx_time = 0x3ff1f51e; +h4tl_msgtype2hdrlen = 0x3ff1f518; +hci_cmd_desc_root_tab = 0x3ff1f4e8; +hci_cmd_desc_tab_ctrl_bb = 0x3ff1f47c; +hci_cmd_desc_tab_info_par = 0x3ff1f44c; +hci_cmd_desc_tab_le = 0x3ff1f0b0; +hci_cmd_desc_tab_lk_ctrl = 0x3ff1f098; +hci_cmd_desc_tab_stat_par = 0x3ff1f08c; +hci_cmd_desc_tab_vs = 0x3ff1f050; +hci_evt_desc_tab = 0x3ff1f008; +hci_evt_le_desc_tab = 0x3ff1ef68; +hci_evt_le_desc_tab_esp = 0x3ff1ef60; +hci_rsvd_evt_msk = 0x3ff1ef57; +lld_aux_phy_to_rate = 0x3ff1ef54; +lld_init_max_aux_dur_tab = 0x3ff1ef4c; +lld_scan_map_legacy_pdu_to_evt_type = 0x3ff1ef44; +lld_scan_max_aux_dur_tab = 0x3ff1ef3c; +lld_sync_max_aux_dur_tab = 0x3ff1ef34; +llm_local_le_feats = 0x3ff1ef2c; +llm_local_le_states = 0x3ff1ef24; +llm_local_supp_cmds = 0x3ff1eefc; +maxSecretKey_256 = 0x3ff1eedc; +max_data_tx_time = 0x3ff1eed4; +one_bits = 0x3ff1eec3; +rwip_coex_cfg = 0x3ff1eebe; +rwip_priority = 0x3ff1eea8; +veryBigHexP256 = 0x3ff1ee5c; + +/* bluetooth hook funcs -- deliberately NOT defined here. + * + * libbtdm_app.a exports all 34 r_*_hook symbols itself. The C3 ROM has hook + * stubs at 0x40001c60-0x40001ce4; the S3 ROM has the md5/hmac/crc thunk table + * there (r_lld_scan_start_hook 0x40001c74 == __call_MD5Final). Left undefined + * so a missing hook is a link error, not a jump into ROM. */ + + /*************************************** Group rom_pp @@ -737,5 +1752,5 @@ PROVIDE(rom_rx_gain_force = 0x4000642c); /* Data (.data, .bss, .rodata) */ phy_param_rom = 0x3fcef81c; -/* Other ROM symbols */ -g_scan_forever = 0x3fcefe6d; +/* g_scan_forever was defined here as a one-off before the ROM bluetooth group + * above carried it; the group is now the single source. */