b40: S12-wrapper pop restore kills 8B/call leak; uni DDRHI parity; run-sbl b40

tools/sbl_uni.py

@@ -30,6 +30,7 @@ RAMS = [
     (0x00400000, 0x07400000),   # RPM range (heap-ish)
     (0x08000000, 0x00600000),   # DDRLOW
     (0x08600000, 0x00010000),   # IMEM
+    (0x08610000, 0x00FF0000),   # DDRHI (QEMU parity; IMEM-stack spillover)
     (0x80000000, 0x07C00000),   # DDRHIGH_A
     (0x87C00000, 0x00800000),   # SMEM(+SBL BSS)
     (0x07800000, 0x000AF000),   # leak-sink HI (S12 frame march;
@@ -350,25 +351,11 @@ def main():
             except Exception:
                 pass
     mu.hook_add(UC_HOOK_MEM_WRITE, hook_txt, begin=0x802F600, end=0x802F700)
-    _splog2 = []
-    def hook_spck(mu, addr, size, data):
-        try:
-            from unicorn.arm_const import UC_ARM_REG_SP as _S
-            sp = mu.reg_read(_S)
-        except Exception:
-            return
-        if not (0x07800000 <= sp < 0x08610000):
-            if len(_splog2) < 5:
-                _splog2.append((count[0], addr, sp))
-    mu.hook_add(UC_HOOK_CODE, hook_spck)
     import atexit as _ax3
     def _dtx():
         print('txt-writes:', len(_txtlog))
         for n, pc, a, sz, v, sp, lr in _txtlog:
             print('  insn', n, hex(pc), hex(a), sz, hex(v), hex(sp), hex(lr))
-        print('sp-trips:', len(_splog2))
-        for n, pc, sp in _splog2:
-            print('  insn', n, hex(pc), hex(sp))
     _ax3.register(_dtx)
     # null-fetch redirect: branch-to-0 lands in maze (movs r0,#0; bx lr),
     # immune to [0]-writes that clobber a static maze copy