Okay. I have an idea. Let’s see what happens if we treat…
06: 00 B5 push {lr}
… as the start of this weird code(?) sequence. It pushes the link register (i.e., the return address to the caller).
08: 42 40 eors r2, r0
0a: 00 2A cmp r2, #0
This XORs R2 and R0 and compares the result against zero. But that’s just a decoy, as we’ll see.
0c: 00 F0 02 F8 bl #0x14
This calls into…
14: 70 46 mov r0, lr
16: 00 47 bx r0
… which moves the return address to R0, and then returns. Using the addresses in this disassembly (not in the actual boot ROM), the return address is 0x10; but LR and, therefore, R0 will actually contain 0x11 because the LSB signifies Thumb mode.
None of the previous three instructions modifies the flags. (I checked in the ARM reference manual.) Thus, “BHS” (branch unsigned higher or same) uses the flags from the “CMP R2,#0” above. _Every_ value of R2 is higher (in the unsigned sense) or same as 0. Hence, the following branch is always taken:
10: F6 D2 bhs #0
… to…
00: 11 38 subs r0, #0x11
R0 contained 0x11 relative to the start of this code sequence. (The absolute address in boot ROM is of course different.) Now, R0 points to the start of the code sequence.
02: C0 7A ldrb r0, [r0, #0xb]
This loads the byte at offset 0xB in this code sequence. Look above, it is 0x2A.
04: 00 BD pop {pc}
This returns to the caller, using the LR pushed at the beginning. The return value in R0 is 0x2A.
0x2A is 42 (decimal)! Could this be an Easter egg; a very obfuscated way of returning 42, the Answer to the Ultimate Question of Life, the Universe, and Everything? (Remember that the Raspberry design team is from Britain, same as Douglas Adams.)
None of the previous three instructions modifies the flags. (I checked in the ARM reference manual.) Thus, “BHS” (branch unsigned higher or same) uses the flags from the “CMP R2,#0” above. _Every_ value of R2 is higher (in the unsigned sense) or same as 0. Hence, the following branch is always taken:
… to… R0 contained 0x11 relative to the start of this code sequence. (The absolute address in boot ROM is of course different.) Now, R0 points to the start of the code sequence. This loads the byte at offset 0xB in this code sequence. Look above, it is 0x2A. This returns to the caller, using the LR pushed at the beginning. The return value in R0 is 0x2A.0x2A is 42 (decimal)! Could this be an Easter egg; a very obfuscated way of returning 42, the Answer to the Ultimate Question of Life, the Universe, and Everything? (Remember that the Raspberry design team is from Britain, same as Douglas Adams.)