Tears of the Kingdom 1.4.3's main stopped the rewriter at three new shapes:
- An atomic update's retry path moved out of line: the failed stxr branches to
ldxr; cmp; b.eq <the stxr>, which re-enters the window at its store
(main+0x18598 -> 0x181fc, 8 sites). retry_block / site_retry_window give
that block a patch copy of its own: the retry block and the window's tail
from the store on, under one prologue, so no memory access falls between
the exclusive load and the store.
- A window no longer spans a second exclusive load. A retry block's ldxr at
main+0x5a4674 used to open a window that ran on into the next, unrelated
ldxr ... stxr loop, and branches to that loop's head landed mid-window.
- Jump tables whose entries are relative to an adr, not to the table
(main+0x393bb0: adr x18; ldrsw x1,[x17,x0,lsl #2]; add x18,x18,x1; br x18),
with the bounds check on a copied register (mov w16,w15) and, once, a
table base built far from the dispatch: every adrp + add pair building
that register in the function is tried, and a table is accepted only if
exactly one makes every target an instruction of the function.
jump_adr_offsets is tried only where jump_offsets finds nothing.
main now rewrites (134 windows, 8 retry windows, 814 tpidr_el0 reads as in
the census). Every other extracted module of every title (31: Mario 1.0 and
1.2.1, Engage, Metroid, Sentinels, 3D World, Breath of the Wild, Link's
Awakening, Odyssey, Hades) gives byte-identical output; only
build_src.sha256, the rewriter's own hash, differs.
seedds
495963cfa3