sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

b25: S12v3/S16v2 smart-return baked

Browse Source
This commit is contained in:
SashegDev
2026-09-13 12:05:17 +00:00
parent c875e8712f
commit 13b314e9cf
3 changed files with 34 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qemu/saimaa.c
+21 -17
View File
@@ -104,15 +104,15 @@ static void saimaa_tmr_init(Object *obj)
/* Stubs region handle for set_readonly after scaffold implant. */
static MemoryRegion *saimaa_stubs_mr;
/* DDRLOW stub trap [0x08006B80,0x08006CE0): serves the scaffolded bytes
/* DDRLOW stub trap [0x08006B80,0x08006CF0): serves the scaffolded bytes
* (S/maze/S6/banner/S7/S9/S10/S16 stubs) on read/fetch, ignores SBL
* heap-clobber writes. Uni parity: deferred-restore guard in sbl_uni.py
* (wider: [0x080068C0,0x08006CE0), also covers PBL stub).
* (wider: [0x080068C0,0x08006CF0), also covers PBL stub).
* Snapshot is taken AFTER ELF load + all stub writes (readback).
* PBL stub [0x080068C0,0x080068F4) and the ELF-text gap below stay plain
* RAM: PBL runs once (if at all), gap holds real hot SBL code. */
#define SAIMAA_DSTUB_BASE 0x08006B80
#define SAIMAA_DSTUB_SIZE 0x00000160
#define SAIMAA_DSTUB_SIZE 0x00000170
static uint8_t saimaa_dstub_mem[SAIMAA_DSTUB_SIZE];
static uint64_t saimaa_dstub_read(void *opaque, hwaddr off, unsigned size)
@@ -710,16 +710,16 @@ static void saimaa_machine_init(MachineState *machine)
uint32_t v = 0x47702000;
cpu_physical_memory_write(0x00221EF8, &v, 4);
}
/* S12-stub (b25, 32B @0x08006964, ARM): blx-to-padding
* becomes movw/movt ip (=S16) + ACK peripheral bit1
* ([0x073A100], literal pool after code) + bx lr.
* PBL would place the real ARM helper here. */
/* S12-stub (b25, 28B @0x08006964, ARM): blx-to-padding
* becomes ldr ip,[sp,#4] (=pushed lr, for B66 bx-ip chain)
* + ACK peripheral bit1 ([0x073A100], literal pool after
* code) + bx lr. PBL would place the real ARM helper here. */
{
static const uint8_t s12[] = {
0xc1, 0xcc, 0x06, 0xe3, 0x00, 0xc8, 0x40, 0xe3,
0x0c, 0x30, 0x9f, 0xe5, 0x00, 0x20, 0x93, 0xe5,
0x02, 0x20, 0x82, 0xe3, 0x00, 0x20, 0x83, 0xe5,
0x1e, 0xff, 0x2f, 0xe1, 0x00, 0xa1, 0x73, 0x00,
0x04, 0xc0, 0x9d, 0xe5, 0x0c, 0x30, 0x9f, 0xe5,
0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
0x00, 0xa1, 0x73, 0x00,
};
size_t k;
for (k = 0; k < sizeof(s12); k += 4) {
@@ -729,14 +729,18 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x08006964 + k, &word, 4);
}
}
/* S16-stublet (b25, 18B @0x08006CC0): helper-pop chain exit.
* restore r7 (peripheral base); jump to poll resumption
* 0x8007779 via ip. Entered via B66 bx ip (ip preset by S12). */
/* S16-stublet (b25, 44B @0x08006CC0): smart return for the
* B66 bx-ip chain. ip odd + top 8 (code) => bx ip (legit
* pushed-lr return); else default (restore r7, jump poll
* resumption 0x8007779 via ip). */
{
static const uint8_t s16[] = {
0x4a, 0xf2, 0x00, 0x07, 0xc0, 0xf2, 0x73, 0x07,
0x47, 0xf2, 0x79, 0x7c, 0xc0, 0xf6, 0x00, 0x0c,
0x60, 0x47,
0x1c, 0xf0, 0x01, 0x0f, 0x09, 0xd0, 0x5f, 0xea,
0x1c, 0x63, 0x08, 0x2b, 0x00, 0xd1, 0x60, 0x47,
0x5f, 0xea, 0x1c, 0x73, 0x08, 0x2b, 0x00, 0xd1,
0x60, 0x47, 0x4a, 0xf2, 0x00, 0x07, 0xc0, 0xf2,
0x73, 0x07, 0x47, 0xf2, 0x79, 0x7c, 0xc0, 0xf6,
0x00, 0x08, 0xc0, 0x47,
};
size_t k;
for (k = 0; k < sizeof(s16); k += 4) {