b43: revert frameless (hang), S12 keep/divert split (PBL contract), sphist+tpop diag

tools/sbl_uni.py

@@ -136,6 +136,9 @@ def main():
     if "--trapn" in sys.argv:
         _trap_n = [int(sys.argv[sys.argv.index("--trapn") + 1])]
     _spmax = [0x085FFF00]
+    _spd = [None]
+    _spb = {} if '--sphist' in sys.argv else None
+    _tpop = [] if '--tpop' in sys.argv else None
     _splog = [] if "--spytrack" in sys.argv else None
     elog = [] if "--entrylog" in sys.argv else None
     _prev = [0]
@@ -152,9 +155,35 @@ def main():
     def hook_code(mu, addr, size, data):
         count[0] += 1
         last[0] = addr
+        if _spb is not None:
+            try:
+                _spn = mu.reg_read(UC_ARM_REG_SP)
+            except Exception:
+                _spn = None
+            if _spn is not None and _spd[0] is not None and _spn != _spd[0]:
+                _e = _spb.get(_prev[0])
+                if _e is None:
+                    _spb[_prev[0]] = [_spn - _spd[0], 1]
+                else:
+                    _e[0] += _spn - _spd[0]
+                    _e[1] += 1
+            _spd[0] = _spn
+        if _tpop is not None and _prev[0] == 0x8007B66 and len(_tpop) < 3000:
+            _tpop.append((count[0], addr))
         if count[0] % 200000 == 0:
             from unicorn.arm_const import UC_ARM_REG_SP as _SX
-            print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)), flush=True)
+            _RR = mu.reg_read
+            from unicorn.arm_const import UC_ARM_REG_R4 as _R4
+            from unicorn.arm_const import UC_ARM_REG_R5 as _R5
+            from unicorn.arm_const import UC_ARM_REG_R6 as _R6
+            from unicorn.arm_const import UC_ARM_REG_R7 as _R7
+            from unicorn.arm_const import UC_ARM_REG_R8 as _R8
+            from unicorn.arm_const import UC_ARM_REG_R9 as _R9
+            from unicorn.arm_const import UC_ARM_REG_R10 as _RA
+            from unicorn.arm_const import UC_ARM_REG_R11 as _RB
+            print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)),
+                  hex(_RR(_R4)), hex(_RR(_R5)), hex(_RR(_R6)), hex(_RR(_R7)),
+                  hex(_RR(_R8)), hex(_RR(_R9)), hex(_RR(_RA)), hex(_RR(_RB)), flush=True)
         _pp = _prev[0]
         _prev[0] = addr
         if addr == _pp + 2 or addr == _pp + 4:
@@ -505,17 +534,20 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding becomes
-    # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
-    # non-code => ip=poll resumption 0x8007779; else keep pushed-lr
-    # (NO add-sp: marches on mid-entries! un-leak dropped, helper-leak
-    # down is harmless); restore r7; ACK peripheral bit1; bx lr.
-    # PBL would place the real ARM helper here.
+    # S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
+    # smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr).
+    # keep (odd code): appended tail restores r7, ACKs bit1, bx lr to
+    # wrapper tail (paired pop, balanced). default (STUBV/even/non-code,
+    # i.e. unpaired entry): shared restore/ACK then bx ip to poll
+    # resumption 0x8007779 (no tail visit, no pop, no creep). PBL would
+    # place the real ARM helper here.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de58d3b06e3003840e303005ce10900000a0100"
-        "1ce30700000a2c3ca0e1080053e30000001a050000ea"
-        "2c3ea0e1080053e30000001a010000ea79c707e300c8"
-        "40e300700ae3737040e30c309fe5002093e5022082e3"
+        "04c09de58d3b06e3003840e303005ce10900000a"
+        "01001ce30700000a2c3ca0e1080053e30000001a"
+        "0d0000ea2c3ea0e1080053e30000001a090000ea"
+        "79c707e300c840e300700ae3737040e30c309fe5"
+        "002093e5022082e3002083e51cff2fe100a17300"
+        "00700ae3737040e30c309fe5002093e5022082e3"
         "002083e51eff2fe100a17300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
@@ -736,6 +768,16 @@ def main():
             a, sz = int(a, 0), int(sz, 0)
             print(f"mem[{a:#x}+{sz:#x}]:")
             print(bytes(mu.mem_read(a, sz)).hex())
+    if _tpop is not None:
+        print('tpop:', len(_tpop))
+        from collections import Counter as _C
+        _cc = _C((a >> 12) << 12 for _, a in _tpop)
+        print(sorted(_cc.items(), key=lambda kv: -kv[1])[:12])
+    if _spb is not None:
+        print('sphist:')
+        _sk = sorted(_spb, key=lambda k: -_spb[k][0])[:25]
+        for _k in _sk:
+            print(hex(_k), 'total=', _spb[_k][0], 'n=', _spb[_k][1])
     print("UART:", "".join(uart_out)[:160])
     print(f"stubguard-hits: {_swn[0]}")
     for _pc, _a, _s in _swlog: