diff --git a/qemu/saimaa.c b/qemu/saimaa.c index 473e409..dc4f8f5 100644 --- a/qemu/saimaa.c +++ b/qemu/saimaa.c @@ -32,6 +32,9 @@ #define SAIMAA_OCIMEM_SIZE 0x00100000 #define SAIMAA_DDRLOW_BASE 0x08000000 #define SAIMAA_DDRLOW_SIZE 0x00600000 +/* High DDRLOW for our stubs (SBL heap reuses 0x0806xxxx) */ +#define SAIMAA_DDRHI_BASE 0x08610000 +#define SAIMAA_DDRHI_SIZE 0x00FF0000 /* ..0x09600000 */ #define SAIMAA_IMEM_BASE 0x08600000 #define SAIMAA_IMEM_SIZE 0x00010000 #define SAIMAA_DDRH_A_BASE 0x80000000 @@ -112,8 +115,8 @@ static uint64_t saimaa_vec_read(void *opaque, hwaddr off, unsigned size) int th = cpu ? cpu->env.thumb : 0; uint32_t mb0 = 0, mb1 = 0; if (saimaa_vec_n < 3) { - cpu_physical_memory_read(0x08062200, &mb0, 4); - cpu_physical_memory_read(0x08062204, &mb1, 4); + cpu_physical_memory_read(0x08800200, &mb0, 4); + cpu_physical_memory_read(0x08800204, &mb1, 4); } fprintf(stderr, "saimaa-vec: %s off=0x%x pc=0x%lx", size == 2 ? "fetch?" : "read", @@ -245,13 +248,14 @@ static void saimaa_machine_init(MachineState *machine) { "saimaa.rpm", SAIMAA_RPM_BASE, SAIMAA_RPM_SIZE }, { "saimaa.ocimem", SAIMAA_OCIMEM_BASE, SAIMAA_OCIMEM_SIZE }, { "saimaa.ddrlow", SAIMAA_DDRLOW_BASE, SAIMAA_DDRLOW_SIZE }, + { "saimaa.ddrhi", SAIMAA_DDRHI_BASE, SAIMAA_DDRHI_SIZE }, { "saimaa.imem", SAIMAA_IMEM_BASE, SAIMAA_IMEM_SIZE }, { "saimaa.ddrhigh_a", SAIMAA_DDRH_A_BASE, SAIMAA_DDRH_A_SIZE }, { "saimaa.ddrhigh_b", SAIMAA_DDRH_B_BASE, SAIMAA_DDRH_B_SIZE }, { "saimaa.mystrom", SAIMAA_MYSTROM_BASE, SAIMAA_MYSTROM_SIZE }, { "saimaa.smem", SAIMAA_SMEM_BASE, SAIMAA_SMEM_SIZE }, }; - for (i = 0; i < 9; i++) { + for (i = 0; i < 10; i++) { MemoryRegion *ram = g_new(MemoryRegion, 1); memory_region_init_ram(ram, NULL, rams[i].n, rams[i].s, &error_fatal); @@ -436,14 +440,14 @@ static void saimaa_machine_init(MachineState *machine) * (sp values from cpu traces, b10 image) */ { uint32_t magic = 0x00000000; /* IMEM poll spins WHILE equal */ - uint32_t S = 0x08062100, STUB = 0x08062120; - uint32_t STUBV = 0x08062121; /* odd: blx stays Thumb */ + uint32_t S = 0x08800000, STUB = 0x08800020; + uint32_t STUBV = 0x08800021; /* odd: blx stays Thumb */ uint32_t w; uint16_t h0 = 0x2000, h1 = 0x4770; /* movs r0,#0; bx lr */ uint32_t v; /* pointer maze in owned RAM for SBL1 struct chains. * STUB = mailbox logger + return-0: records lr/sp at entry - * to 0x08062200 for post-mortem, then movs r0,#0; bx lr. */ + * to 0x08800200 for post-mortem, then movs r0,#0; bx lr. */ w = S + 8; cpu_physical_memory_write(S, &w, 4); /* [struct+4] is another fn ptr (e.g. 0x801b72e ldr r3,[r0,#4] @@ -455,7 +459,7 @@ static void saimaa_machine_init(MachineState *machine) * Bad lr (not 0x08xxxxxx) spins with IRQs off instead of * jumping into the void. 36 bytes. */ static const uint8_t mb[] = { - 0x42, 0xf2, 0x00, 0x2c, 0xc0, 0xf6, 0x06, 0x0c, + 0x40, 0xf2, 0x00, 0x2c, 0xc0, 0xf6, 0x80, 0x0c, 0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0, 0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1, 0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6, @@ -472,7 +476,7 @@ static void saimaa_machine_init(MachineState *machine) cpu_physical_memory_write(0x087c29d18, &S, 4); cpu_physical_memory_write(0x08050b28, &S, 4); cpu_physical_memory_write(0x08070000, &S, 4); - /* S6 stublet at 0x08062160: rebuild popped frame regs, + /* S6 stublet at 0x08800060: rebuild popped frame regs, * return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */ { static const uint8_t s6[] = { @@ -486,10 +490,10 @@ static void saimaa_machine_init(MachineState *machine) uint32_t word = 0; size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4; __builtin_memcpy(&word, &s6[k], n); - cpu_physical_memory_write(0x08062160 + k, &word, 4); + cpu_physical_memory_write(0x08800060 + k, &word, 4); } } - /* Banner stub at 0x08062170: print r0 string via UARTDM + /* Banner stub at 0x08800070: print r0 string via UARTDM * (b16 redirects 0x802f690 blx here). Built from qemu/banner.S: * push frame, print loop, ldr pc,=0x802f694 (callee noreturn). * 28 bytes total. */ @@ -506,13 +510,13 @@ static void saimaa_machine_init(MachineState *machine) uint32_t word = 0; size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4; __builtin_memcpy(&word, &bn[k], n); - cpu_physical_memory_write(0x08062170 + k, &word, 4); + cpu_physical_memory_write(0x08800070 + k, &word, 4); } } /* stack zone defaults to plain-stub addr: every register * popped from untouched stack becomes callable (returns 0). */ { - uint32_t fill = 0x08062121; + uint32_t fill = 0x08800021; uint32_t a; for (a = 0x085F0000; a < 0x08600000; a += 4) { cpu_physical_memory_write(a, &fill, 4); @@ -600,7 +604,7 @@ static void saimaa_machine_init(MachineState *machine) static void saimaa_post_reset(void *opaque) { - uint32_t S = 0x08062100; + uint32_t S = 0x08800000; (void)opaque; /* Re-apply pokes that live inside ROM-covered ranges (rom_reset * restores file bytes over them). */ diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py index 60b4feb..265014c 100644 --- a/tools/sbl_patch.py +++ b/tools/sbl_patch.py @@ -148,7 +148,7 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', '4af030bb'), + (0x8017AFC, 'bde8fc87', 'e8f3b0b2'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va)) set4(d, va, new) @@ -174,8 +174,8 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', '4af030bb'), - (0x802F690, '9847fee7', '32f06ebd'), + (0x8017AFC, 'bde8fc87', 'e8f3b0b2'), + (0x802F690, '9847fee7', 'd0f3eeb4'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va)) set4(d, va, new) @@ -200,7 +200,7 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', '4af030bb'), + (0x8017AFC, 'bde8fc87', 'e8f3b0b2'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va)) set4(d, va, new)