b43: revert frameless (hang), S12 keep/divert split (PBL contract), sphist+tpop diag

qemu/run-sbl.sh

@@ -5,7 +5,7 @@
 set -e
 cd "$(dirname "$0")/.."
 QEMU=~/qemu-src/qemu-8.2.2/build/qemu-system-arm
-B=${1:-b40}
+B=${1:-b43}
 IMG=fw/img/emmc-real.img
 if [ ! -f "$IMG" ]; then
   echo "no $IMG — сначала: python3 tools/ffu_extract.py fw/dl/RM1127_059X5R5_orig.ffu --emmc-user fw/img/user-real.bin"

qemu/saimaa.c

@@ -788,11 +788,12 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
-             /* S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding
+             /* S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
              * becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr);
-             * ip==STUBV/even/non-code => ip=poll resumption 0x8007779;
+             * keep (odd code): appended tail restores r7, ACKs bit1,
-             * else keep pushed-lr (NO add-sp!); restore r7;
+             * ([literal2 0x073A100]) and bx lr to wrapper tail (paired
-             * ACK peripheral bit1 ([literal 0x073A100]); bx lr.
+             * pop, balanced). default: shared restore/ACK then bx ip to
+             * poll resumption (no tail visit, no creep).
              * PBL would place the real ARM helper here. */
             {
                 static const uint8_t s12[] = {
@@ -801,15 +802,18 @@ static void saimaa_machine_init(MachineState *machine)
                     0x09, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3,
                     0x07, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1,
                     0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
-                    0x05, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1,
+                    0x0d, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1,
                     0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
-                    0x01, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3,
+                    0x09, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3,
                     0x00, 0xc8, 0x40, 0xe3, 0x00, 0x70, 0x0a, 0xe3,
                     0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
                     0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
+                    0x00, 0x20, 0x83, 0xe5, 0x1c, 0xff, 0x2f, 0xe1,
+                    0x00, 0xa1, 0x73, 0x00, 0x00, 0x70, 0x0a, 0xe3,
+                    0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
+                    0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
                     0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
-                    0x00, 0xa1, 0x73, 0x00,
+                    0x00, 0xa1, 0x73, 0x00,};
-                };
                 size_t k;
                 for (k = 0; k < sizeof(s12); k += 4) {
                     uint32_t word = 0;

tools/sbl_patch.py

@@ -2843,6 +2843,357 @@ def main():
 
     save(d, 'img0_b41.elf')
 
+    # b42 = b41 + frameless S12-wrapper (push/pop removed):
+    # tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K.
+    # S12 needs no pushed lr (both paths bx lr to wrapper tail); r4
+    # untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral.
+    # b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A):
+    # mid-function entry skipped the 48B prologue push; epilogue pop.w
+    # then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap).
+    # Via prologue the frame balances and S20-pop returns to the caller.
+    # b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop):
+    # b25 chained the wrapper pop to bx ip; with S12 preserving sp the
+    # frame is intact, while bx ip orphaned 8B per call (105M sp-smash).
+    # Content below = b39 body with the 0x8007B66 hunk reverted to pop.
+    # naked clock leaf never sets r3 (stale stacked return addr,
+    # observed 0x8007975); the store writes 0xffff over live code,
+    # faulting the next fetch there. Peripheral write, nothing in emu
+    # reads it back (polls use scaffolded [0x73A100]). Same rationale
+    # as the b17 stm NOP. 2B->2B, no eating.
+    d = bytearray(base)
+
+    for va, (a, b) in BLX2BL.items():
+
+        set4(d, va, b)
+
+    for va, exp, new in [
+
+        (0x802F664, 'e4f77efc', 'c046c046'),
+
+        (0x802F672, 'e6f7bbfa', 'c046c046'),
+
+        (0x802F678, 'e9f7fef9', 'c046c046'),
+
+        (0x801B71E, '9847fee7', 'c046c046'),
+
+        (0x8008396, 'fef780f9', 'c046c046'),
+
+        (0x8016184, 'fdf790fc', 'c046c046'),
+
+        (0x801B76C, '280b0508', '00000708'),
+
+        (0x8017AFC, 'bde8fc87', 'eef74fb8'),
+
+        (0x802F690, '9847fee7', 'c046c046'),
+
+        (0x801671C, '9847fee7', 'c046c046'),
+
+        (0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
+
+        (0x801B6BE, 'bde8f081', 'ebf7c3ba'),
+
+        (0x8016720, '10bd0000', 'f0f7b2ba'),
+
+        (0x8034810, 'bde8fc87', 'd2f76eba'),
+
+        (0x8007798, 'bde8f08f', 'fff7c3ba'),
+
+        (0x8016334, 'f0f7a4ff', 'c046c046'),
+
+        (0x8016342, 'f0f79eef', 'f0f79dbf'),
+
+        (0x802F9A0, 'ffe70648', 'd7f7c4b9'),
+
+        (0x802F9B2, 'fee78817', 'd7f7bbb9'),
+
+        (0x802F9A2, 'c4b943f2', 'd7f7c3b9'),
+
+        (0x800EB96, 'bde8fe8f', 'f8f7cfb8'),
+
+        (0x8007916, 'bde8f09f', 'fff720ba'),
+
+    ]:
+
+        assert hx(d, va) == exp, (hex(va), hx(d, va))
+
+        set4(d, va, new)
+
+    # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
+    o = off(0x8006682)
+
+    assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
+
+    d[o:o + 6] = bytes.fromhex('c046c046c046')
+
+    o = off(0x8013AA8)
+
+    assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
+
+    d[o:o + 4] = bytes.fromhex('c046c046')
+
+    o = off(0x8013BA6)
+
+    assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
+
+    d[o:o + 2] = bytes.fromhex('ff20')
+
+    # b40: S12-wrapper pop RESTORED (revert b25 chain at this site).
+    # b25 sent pop to bx ip because the pop read scratch; with S12
+    # preserving sp the frame is intact, while bx ip orphaned 8B per
+    # call and smashed sp into text at 105M. S16 keeps serving B66.
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    # Clock S11 (see b24).
+    o = off(0x800E988)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    # Poll re-init skip (see b27).
+    o = off(0x8007748)
+
+    assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
+
+    d[o:o + 2] = bytes.fromhex('14e0')
+
+    # Poll-epilogue add NOP (see b28).
+    o = off(0x8007794)
+
+    assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # Partition wrap-check (see b33).
+    o = off(0x801844E)
+
+    assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2)
+
+    d[o:o + 2] = bytes.fromhex('04e0')
+
+    # Hang-site neutralize (see b34).
+    o = off(0x8018458)
+
+    assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2)
+
+    d[o:o + 2] = bytes.fromhex('ffe7')
+
+    # Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046).
+    o = off(0x800E986)
+
+    assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # b41 retarget.
+    o = off(0x8007790)
+
+    assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790)
+
+    d[o:o + 4] = bytes.fromhex('07f0bbfb')
+
+    # b42 frameless wrapper.
+    o = off(0x8007B5E)
+
+    assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    save(d, 'img0_b42.elf')
+
+    # b43 = b42 revert (frameless hangs: tail bx lr loops on
+    # stale lr). The push is load-bearing (saves caller return for S12
+    # keep-path). PBL contract instead: keep returns to tail, default
+    # diverts (S12 scaffold change, no image bytes for that part).
+    # b42 = b41 + frameless S12-wrapper (push/pop removed):
+    # tail pop read garbage pc (->0x0/0x407) on misaligned sp: +8B x27/K.
+    # S12 needs no pushed lr (both paths bx lr to wrapper tail); r4
+    # untouched by blob; r0=0 via tail movs. Wrapper now sp-neutral.
+    # b41 = b40 + desert-call retarget (0x8007790 bl EB90 -> EB0A):
+    # mid-function entry skipped the 48B prologue push; epilogue pop.w
+    # then over-popped 48B per S20 visit (100B/Kinsn creep, S20-rerun trap).
+    # Via prologue the frame balances and S20-pop returns to the caller.
+    # b40 = b39 + S12-wrapper pop restore (0x8007B66 bx ip -> pop):
+    # b25 chained the wrapper pop to bx ip; with S12 preserving sp the
+    # frame is intact, while bx ip orphaned 8B per call (105M sp-smash).
+    # Content below = b39 body with the 0x8007B66 hunk reverted to pop.
+    # naked clock leaf never sets r3 (stale stacked return addr,
+    # observed 0x8007975); the store writes 0xffff over live code,
+    # faulting the next fetch there. Peripheral write, nothing in emu
+    # reads it back (polls use scaffolded [0x73A100]). Same rationale
+    # as the b17 stm NOP. 2B->2B, no eating.
+    d = bytearray(base)
+
+    for va, (a, b) in BLX2BL.items():
+
+        set4(d, va, b)
+
+    for va, exp, new in [
+
+        (0x802F664, 'e4f77efc', 'c046c046'),
+
+        (0x802F672, 'e6f7bbfa', 'c046c046'),
+
+        (0x802F678, 'e9f7fef9', 'c046c046'),
+
+        (0x801B71E, '9847fee7', 'c046c046'),
+
+        (0x8008396, 'fef780f9', 'c046c046'),
+
+        (0x8016184, 'fdf790fc', 'c046c046'),
+
+        (0x801B76C, '280b0508', '00000708'),
+
+        (0x8017AFC, 'bde8fc87', 'eef74fb8'),
+
+        (0x802F690, '9847fee7', 'c046c046'),
+
+        (0x801671C, '9847fee7', 'c046c046'),
+
+        (0x8013BAC, 'f8bd0a4a', 'f3f730b8'),
+
+        (0x801B6BE, 'bde8f081', 'ebf7c3ba'),
+
+        (0x8016720, '10bd0000', 'f0f7b2ba'),
+
+        (0x8034810, 'bde8fc87', 'd2f76eba'),
+
+        (0x8007798, 'bde8f08f', 'fff7c3ba'),
+
+        (0x8016334, 'f0f7a4ff', 'c046c046'),
+
+        (0x8016342, 'f0f79eef', 'f0f79dbf'),
+
+        (0x802F9A0, 'ffe70648', 'd7f7c4b9'),
+
+        (0x802F9B2, 'fee78817', 'd7f7bbb9'),
+
+        (0x802F9A2, 'c4b943f2', 'd7f7c3b9'),
+
+        (0x800EB96, 'bde8fe8f', 'f8f7cfb8'),
+
+        (0x8007916, 'bde8f09f', 'fff720ba'),
+
+    ]:
+
+        assert hx(d, va) == exp, (hex(va), hx(d, va))
+
+        set4(d, va, new)
+
+    # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18).
+    o = off(0x8006682)
+
+    assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
+
+    d[o:o + 6] = bytes.fromhex('c046c046c046')
+
+    o = off(0x8013AA8)
+
+    assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
+
+    d[o:o + 4] = bytes.fromhex('c046c046')
+
+    o = off(0x8013BA6)
+
+    assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2))
+
+    d[o:o + 2] = bytes.fromhex('ff20')
+
+    # b40: S12-wrapper pop RESTORED (revert b25 chain at this site).
+    # b25 sent pop to bx ip because the pop read scratch; with S12
+    # preserving sp the frame is intact, while bx ip orphaned 8B per
+    # call and smashed sp into text at 105M. S16 keeps serving B66.
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    # Clock S11 (see b24).
+    o = off(0x800E988)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x800E988, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    # Poll re-init skip (see b27).
+    o = off(0x8007748)
+
+    assert d[o:o + 2].hex() == '96b1', hx(d, 0x8007748, 2)
+
+    d[o:o + 2] = bytes.fromhex('14e0')
+
+    # Poll-epilogue add NOP (see b28).
+    o = off(0x8007794)
+
+    assert d[o:o + 2].hex() == '07b0', hx(d, 0x8007794, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # Partition wrap-check (see b33).
+    o = off(0x801844E)
+
+    assert d[o:o + 2].hex() == '04d3', hx(d, 0x801844E, 2)
+
+    d[o:o + 2] = bytes.fromhex('04e0')
+
+    # Hang-site neutralize (see b34).
+    o = off(0x8018458)
+
+    assert d[o:o + 2].hex() == 'fee7', hx(d, 0x8018458, 2)
+
+    d[o:o + 2] = bytes.fromhex('ffe7')
+
+    # Clock-store NOP: str r1,[r3] (2B 1960) -> mov r8,r8 (2B c046).
+    o = off(0x800E986)
+
+    assert d[o:o + 2].hex() == '1960', hx(d, 0x800E986, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    # b41 retarget.
+    o = off(0x8007790)
+
+    assert d[o:o + 4].hex() == '07f0fef9', hx(d, 0x8007790)
+
+    d[o:o + 4] = bytes.fromhex('07f0bbfb')
+
+    # b42 frameless wrapper.
+    o = off(0x8007B5E)
+
+    assert d[o:o + 2].hex() == '10b5', hx(d, 0x8007B5E, 2)
+
+    d[o:o + 2] = bytes.fromhex('c046')
+
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '10bd', hx(d, 0x8007B66, 2)
+
+    d[o:o + 2] = bytes.fromhex('7047')
+
+    # b43 revert frameless.
+    o = off(0x8007B5E)
+
+    assert d[o:o + 2].hex() == 'c046', hx(d, 0x8007B5E, 2)
+
+    d[o:o + 2] = bytes.fromhex('10b5')
+
+    o = off(0x8007B66)
+
+    assert d[o:o + 2].hex() == '7047', hx(d, 0x8007B66, 2)
+
+    d[o:o + 2] = bytes.fromhex('10bd')
+
+    save(d, 'img0_b43.elf')
+
+
+
 
 
 

tools/sbl_uni.py

@@ -136,6 +136,9 @@ def main():
     if "--trapn" in sys.argv:
         _trap_n = [int(sys.argv[sys.argv.index("--trapn") + 1])]
     _spmax = [0x085FFF00]
+    _spd = [None]
+    _spb = {} if '--sphist' in sys.argv else None
+    _tpop = [] if '--tpop' in sys.argv else None
     _splog = [] if "--spytrack" in sys.argv else None
     elog = [] if "--entrylog" in sys.argv else None
     _prev = [0]
@@ -152,9 +155,35 @@ def main():
     def hook_code(mu, addr, size, data):
         count[0] += 1
         last[0] = addr
+        if _spb is not None:
+            try:
+                _spn = mu.reg_read(UC_ARM_REG_SP)
+            except Exception:
+                _spn = None
+            if _spn is not None and _spd[0] is not None and _spn != _spd[0]:
+                _e = _spb.get(_prev[0])
+                if _e is None:
+                    _spb[_prev[0]] = [_spn - _spd[0], 1]
+                else:
+                    _e[0] += _spn - _spd[0]
+                    _e[1] += 1
+            _spd[0] = _spn
+        if _tpop is not None and _prev[0] == 0x8007B66 and len(_tpop) < 3000:
+            _tpop.append((count[0], addr))
         if count[0] % 200000 == 0:
             from unicorn.arm_const import UC_ARM_REG_SP as _SX
-            print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)), flush=True)
+            _RR = mu.reg_read
+            from unicorn.arm_const import UC_ARM_REG_R4 as _R4
+            from unicorn.arm_const import UC_ARM_REG_R5 as _R5
+            from unicorn.arm_const import UC_ARM_REG_R6 as _R6
+            from unicorn.arm_const import UC_ARM_REG_R7 as _R7
+            from unicorn.arm_const import UC_ARM_REG_R8 as _R8
+            from unicorn.arm_const import UC_ARM_REG_R9 as _R9
+            from unicorn.arm_const import UC_ARM_REG_R10 as _RA
+            from unicorn.arm_const import UC_ARM_REG_R11 as _RB
+            print('prog:', count[0], hex(addr), hex(mu.reg_read(_SX)),
+                  hex(_RR(_R4)), hex(_RR(_R5)), hex(_RR(_R6)), hex(_RR(_R7)),
+                  hex(_RR(_R8)), hex(_RR(_R9)), hex(_RR(_RA)), hex(_RR(_RB)), flush=True)
         _pp = _prev[0]
         _prev[0] = addr
         if addr == _pp + 2 or addr == _pp + 4:
@@ -505,17 +534,20 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding becomes
+    # S12-stub (b27/b43, 132B @0x08006964, ARM): blx-to-padding
-    # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
+    # smart dispatcher (PBL contract): ldr ip,[sp,#4] (=pushed lr).
-    # non-code => ip=poll resumption 0x8007779; else keep pushed-lr
+    # keep (odd code): appended tail restores r7, ACKs bit1, bx lr to
-    # (NO add-sp: marches on mid-entries! un-leak dropped, helper-leak
+    # wrapper tail (paired pop, balanced). default (STUBV/even/non-code,
-    # down is harmless); restore r7; ACK peripheral bit1; bx lr.
+    # i.e. unpaired entry): shared restore/ACK then bx ip to poll
-    # PBL would place the real ARM helper here.
+    # resumption 0x8007779 (no tail visit, no pop, no creep). PBL would
+    # place the real ARM helper here.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de58d3b06e3003840e303005ce10900000a0100"
+        "04c09de58d3b06e3003840e303005ce10900000a"
-        "1ce30700000a2c3ca0e1080053e30000001a050000ea"
+        "01001ce30700000a2c3ca0e1080053e30000001a"
-        "2c3ea0e1080053e30000001a010000ea79c707e300c8"
+        "0d0000ea2c3ea0e1080053e30000001a090000ea"
-        "40e300700ae3737040e30c309fe5002093e5022082e3"
+        "79c707e300c840e300700ae3737040e30c309fe5"
+        "002093e5022082e3002083e51cff2fe100a17300"
+        "00700ae3737040e30c309fe5002093e5022082e3"
         "002083e51eff2fe100a17300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
@@ -736,6 +768,16 @@ def main():
             a, sz = int(a, 0), int(sz, 0)
             print(f"mem[{a:#x}+{sz:#x}]:")
             print(bytes(mu.mem_read(a, sz)).hex())
+    if _tpop is not None:
+        print('tpop:', len(_tpop))
+        from collections import Counter as _C
+        _cc = _C((a >> 12) << 12 for _, a in _tpop)
+        print(sorted(_cc.items(), key=lambda kv: -kv[1])[:12])
+    if _spb is not None:
+        print('sphist:')
+        _sk = sorted(_spb, key=lambda k: -_spb[k][0])[:25]
+        for _k in _sk:
+            print(hex(_k), 'total=', _spb[_k][0], 'n=', _spb[_k][1])
     print("UART:", "".join(uart_out)[:160])
     print(f"stubguard-hits: {_swn[0]}")
     for _pc, _a, _s in _swlog: