b22: rollback NOP + S9v3 baked (sp reset)
This commit is contained in:
lumia-emu
+27
-4
@@ -104,15 +104,15 @@ static void saimaa_tmr_init(Object *obj)
|
||||
/* Stubs region handle for set_readonly after scaffold implant. */
|
||||
static MemoryRegion *saimaa_stubs_mr;
|
||||
|
||||
/* DDRLOW stub trap [0x08006B80,0x08006C50): serves the scaffolded bytes
|
||||
* (S/maze/S6/banner/S7 stubs) on read/fetch, ignores SBL heap-clobber
|
||||
/* DDRLOW stub trap [0x08006B80,0x08006C90): serves the scaffolded bytes
|
||||
* (S/maze/S6/banner/S7/S9 stubs) on read/fetch, ignores SBL heap-clobber
|
||||
* writes. Uni parity: deferred-restore guard in sbl_uni.py (wider:
|
||||
* [0x080068C0,0x08006C50), also covers PBL stub).
|
||||
* [0x080068C0,0x08006C90), also covers PBL stub).
|
||||
* Snapshot is taken AFTER ELF load + all stub writes (readback).
|
||||
* PBL stub [0x080068C0,0x080068F4) and the ELF-text gap below stay plain
|
||||
* RAM: PBL runs once (if at all), gap holds real hot SBL code. */
|
||||
#define SAIMAA_DSTUB_BASE 0x08006B80
|
||||
#define SAIMAA_DSTUB_SIZE 0x000000D0
|
||||
#define SAIMAA_DSTUB_SIZE 0x00000110
|
||||
static uint8_t saimaa_dstub_mem[SAIMAA_DSTUB_SIZE];
|
||||
|
||||
static uint64_t saimaa_dstub_read(void *opaque, hwaddr off, unsigned size)
|
||||
@@ -654,6 +654,29 @@ static void saimaa_machine_init(MachineState *machine)
|
||||
cpu_physical_memory_write(0x08006C10 + k, &word, 4);
|
||||
}
|
||||
}
|
||||
/* S9 stublet at 0x08006C48 (62B, b22): labyrinth-epilogue
|
||||
* exit router (0x801B6BE pop.w -> b.w S9). Empty frames ->
|
||||
* restore r0/r4/r5/sl/fp, reset sp to 0x085FFF00, jump to
|
||||
* sbl_main 0x802f69d via ip. Assembled with keystone. */
|
||||
{
|
||||
static const uint8_t s9[] = {
|
||||
0x05, 0x9b, 0x0b, 0xb1, 0xbd, 0xe8, 0xf0, 0x81,
|
||||
0x00, 0x20, 0x40, 0xf2, 0x00, 0x04, 0xc0, 0xf2,
|
||||
0x22, 0x04, 0x40, 0xf2, 0x00, 0x05, 0xc0, 0xf2,
|
||||
0x22, 0x05, 0x40, 0xf2, 0x00, 0x0a, 0xc0, 0xf6,
|
||||
0x06, 0x0a, 0x41, 0xf2, 0x00, 0x0b, 0xc0, 0xf6,
|
||||
0x06, 0x0b, 0x4f, 0xf6, 0x00, 0x73, 0xc0, 0xf6,
|
||||
0x5f, 0x03, 0x9d, 0x46, 0x4f, 0xf2, 0x9d, 0x6c,
|
||||
0xc0, 0xf6, 0x02, 0x0c, 0x60, 0x47,
|
||||
};
|
||||
size_t k;
|
||||
for (k = 0; k < sizeof(s9); k += 4) {
|
||||
uint32_t word = 0;
|
||||
size_t n = sizeof(s9) - k < 4 ? sizeof(s9) - k : 4;
|
||||
__builtin_memcpy(&word, &s9[k], n);
|
||||
cpu_physical_memory_write(0x08006C48 + k, &word, 4);
|
||||
}
|
||||
}
|
||||
{
|
||||
uint32_t fill = 0x08006B8D;
|
||||
uint32_t a;
|
||||
|
||||
@@ -730,6 +730,74 @@ def main():
|
||||
|
||||
save(d, 'img0_b21.elf')
|
||||
|
||||
# b22 = b21 + rollback assert NOP (0x801671C blx + b.n self):
|
||||
# boot_rollback_version.c:580 (code 0x302E) fires (versions zeroed);
|
||||
# caller (sbl_main) ignores r0 (movs r0,#0 after), so fall-through
|
||||
# to the success pop is safe. Same idiom as banner site.
|
||||
d = bytearray(base)
|
||||
|
||||
for va, (a, b) in BLX2BL.items():
|
||||
|
||||
set4(d, va, b)
|
||||
|
||||
for va, exp, new in [
|
||||
|
||||
(0x802F664, 'e4f77efc', 'c046c046'),
|
||||
|
||||
(0x802F672, 'e6f7bbfa', 'c046c046'),
|
||||
|
||||
(0x802F678, 'e9f7fef9', 'c046c046'),
|
||||
|
||||
(0x801B71E, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x8008396, 'fef780f9', 'c046c046'),
|
||||
|
||||
(0x8016184, 'fdf790fc', 'c046c046'),
|
||||
|
||||
(0x801B76C, '280b0508', '00000708'),
|
||||
|
||||
(0x8017AFC, 'bde8fc87', 'eef74fb8'),
|
||||
|
||||
(0x802F690, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x801671C, '9847fee7', 'c046c046'),
|
||||
|
||||
(0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
|
||||
|
||||
]:
|
||||
|
||||
assert hx(d, va) == exp, (hex(va), hx(d, va))
|
||||
|
||||
set4(d, va, new)
|
||||
|
||||
# Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
|
||||
o = off(0x8006682)
|
||||
|
||||
assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
|
||||
|
||||
d[o:o + 6] = bytes.fromhex('c046c046c046')
|
||||
|
||||
o = off(0x8013AA8)
|
||||
|
||||
assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
|
||||
|
||||
d[o:o + 4] = bytes.fromhex('c046c046')
|
||||
|
||||
o = off(0x8013BA6)
|
||||
|
||||
assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('ff20')
|
||||
|
||||
# Logger S8 (see b21).
|
||||
o = off(0x8034810)
|
||||
|
||||
assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810)
|
||||
|
||||
d[o:o + 2] = bytes.fromhex('7047')
|
||||
|
||||
save(d, 'img0_b22.elf')
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+17
-3
@@ -236,6 +236,7 @@ def main():
|
||||
# immune to [0]-writes that clobber a static maze copy
|
||||
from unicorn.arm_const import UC_ARM_REG_PC as _PC
|
||||
_nulllog = []
|
||||
_halt_on_null = "--haltonnull" in sys.argv
|
||||
|
||||
def hook_null(mu, addr, size, data):
|
||||
if len(_nulllog) < 10:
|
||||
@@ -247,6 +248,8 @@ def main():
|
||||
r, lr, sp = [], -1, -1
|
||||
# walk back: find the branch source from hist
|
||||
_nulllog.append((count[0], r, lr, sp))
|
||||
if _halt_on_null and len(_nulllog) == 1:
|
||||
return False
|
||||
mu.reg_write(_PC, STUB + 1)
|
||||
|
||||
mu.hook_add(UC_HOOK_CODE, hook_null, begin=0x0, end=0xFFF)
|
||||
@@ -313,6 +316,15 @@ def main():
|
||||
"ff2c13d940f20004c0f2220440f20005c0f2220540f2000a"
|
||||
"c0f6060a41f2000bc0f6060bdff800f081f60208dff800f0"
|
||||
"a53b0108"))
|
||||
# S9 stublet (62B @0x08006C48, b22): labyrinth-epilogue exit router.
|
||||
# ldr r3,[sp,#0x14]: nonzero -> original pop.w (legit return);
|
||||
# zero (empty scaffold frames) -> restore r0/r4/r5/sl/fp, reset sp
|
||||
# to 0x085FFF00 (fresh STUBV-fill stack), jump to sbl_main 0x802f69d
|
||||
# via ip (no literal loads).
|
||||
mu.mem_write(0x08006C48, bytes.fromhex(
|
||||
"059b0bb1bde8f081002040f20004c0f2220440f20005c0f2"
|
||||
"220540f2000ac0f6060a41f2000bc0f6060b4ff60073c0f6"
|
||||
"5f039d464ff29d6cc0f6020c6047"))
|
||||
# stack zone fill (STUBV odd)
|
||||
mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
|
||||
# pop-site slots (sp values from traces)
|
||||
@@ -349,7 +361,7 @@ def main():
|
||||
# --- end parity ---
|
||||
# stub range is readonly on HW/QEMU: ignore SBL heap-clobber writes,
|
||||
# keep maze/stublets intact (restore-on-write with reentrancy guard)
|
||||
STUB_LO, STUB_HI = 0x080068C0, 0x08006C50 # +S7 + banner tail
|
||||
STUB_LO, STUB_HI = 0x080068C0, 0x08006C90 # +S7/S9 + banner tail
|
||||
stub_snap = bytes(mu.mem_read(STUB_LO, STUB_HI - STUB_LO))
|
||||
_inww = [False]
|
||||
_swn = [0]
|
||||
@@ -461,8 +473,10 @@ def main():
|
||||
print("hist:", [hex(pc) for pc, _ in list(hist)[-12:]])
|
||||
if elog is not None:
|
||||
print(f"entries: {len(elog)}")
|
||||
for n, prev, cur in elog[-30:]:
|
||||
print(f" insn#{n} {prev:#x} -> {cur:#x}")
|
||||
for n, prev, cur in elog[:10]:
|
||||
print(f" FIRST insn#{n} {prev:#x} -> {cur:#x}")
|
||||
for n, prev, cur in elog[-10:]:
|
||||
print(f" LAST insn#{n} {prev:#x} -> {cur:#x}")
|
||||
if _splog is not None:
|
||||
print(f"sp-highs: {len(_splog)}")
|
||||
for n, pc, sp in _splog:
|
||||
|
||||
Reference in New Issue
Block a user