Okay. I have an idea. Let’s see what happens if we treat…
06: 00 B5 push {lr}
… as the start of this weird code(?) sequence. It pushes the link register (i.e., the return address to the caller).
08: 42 40 eors r2, r0
0a: 00 2A cmp r2, #0
This XORs R2 and R0 and compares the result against zero. But that’s just a decoy, as we’ll see.
0c: 00 F0 02 F8 bl #0x14
This calls into…
14: 70 46 mov r0, lr
16: 00 47 bx r0
… which moves the return address to R0, and then returns. Using the addresses in this disassembly (not in the actual boot ROM), the return address is 0x10; but LR and, therefore, R0 will actually contain 0x11 because the LSB signifies Thumb mode.
None of the previous three instructions modifies the flags. (I checked in the ARM reference manual.) Thus, “BHS” (branch unsigned higher or same) uses the flags from the “CMP R2,#0” above. _Every_ value of R2 is higher (in the unsigned sense) or same as 0. Hence, the following branch is always taken:
10: F6 D2 bhs #0
… to…
00: 11 38 subs r0, #0x11
R0 contained 0x11 relative to the start of this code sequence. (The absolute address in boot ROM is of course different.) Now, R0 points to the start of the code sequence.
02: C0 7A ldrb r0, [r0, #0xb]
This loads the byte at offset 0xB in this code sequence. Look above, it is 0x2A.
04: 00 BD pop {pc}
This returns to the caller, using the LR pushed at the beginning. The return value in R0 is 0x2A.
0x2A is 42 (decimal)! Could this be an Easter egg; a very obfuscated way of returning 42, the Answer to the Ultimate Question of Life, the Universe, and Everything? (Remember that the Raspberry design team is from Britain, same as Douglas Adams.)
Nice description of the correct intended behavior! It is indeed an Easter Egg; a function that returns the answer to the Ultimate Question of Life, the Universe, and Everything.
After the addition of double-precision floating point support in V2 of the boot ROM (B1 silicon), we had just over 30 bytes spare. Removing any of the slightly obtuse space-saving techniques already used in the code always resulted in code that didn't fit, so we were left with the free space.
Nature abhors a vacuum, so I decided on an Easter Egg (note there is no secure code in the RP2040 boot ROM). It was surprisingly challenging to come up with some very short code which actually did something, but whose purpose was not immediately obvious. I was also super interested to see how long it would take someone to find it - 15 months apparently :-)
Hopefully it provided you some amusement/puzzle value... I sort of hoped it would be more confusing the more ARM assembly you knew, as it potentially sets off all sorts of wrong pattern-matching in the brain.
None of the previous three instructions modifies the flags. (I checked in the ARM reference manual.) Thus, “BHS” (branch unsigned higher or same) uses the flags from the “CMP R2,#0” above. _Every_ value of R2 is higher (in the unsigned sense) or same as 0. Hence, the following branch is always taken:
… to… R0 contained 0x11 relative to the start of this code sequence. (The absolute address in boot ROM is of course different.) Now, R0 points to the start of the code sequence. This loads the byte at offset 0xB in this code sequence. Look above, it is 0x2A. This returns to the caller, using the LR pushed at the beginning. The return value in R0 is 0x2A.0x2A is 42 (decimal)! Could this be an Easter egg; a very obfuscated way of returning 42, the Answer to the Ultimate Question of Life, the Universe, and Everything? (Remember that the Raspberry design team is from Britain, same as Douglas Adams.)