sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IMEM tripwire 4B

Browse Source
This commit is contained in:
lumia-emu
2026-09-14 00:17:06 +00:00
parent 503c334b2e
commit 5362f0a6f8
3 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sbl-bringup.md
+1 -1
View File
@@ -173,4 +173,4 @@
(2B, в success-путь). (2B, в success-путь).
- Урок: полный IMEM-poison ломает IMEM-стек (счётчики читают - Урок: полный IMEM-poison ломает IMEM-стек (счётчики читают
0xFFFFFFFF вместо свежих нулей → underflow → wild-pop). Только 0xFFFFFFFF вместо свежих нулей → underflow → wild-pop). Только
tripwire 16B на входе дрейфа `[0x8600000,0x8600010)`. tripwire 4B на входе дрейфа `[0x8600000,0x8600004)`.
qemu/saimaa.c
+3 -6
View File
@@ -822,14 +822,11 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(a, &fill, 4); cpu_physical_memory_write(a, &fill, 4);
} }
} }
/* IMEM tripwire [0x8600000,0x8600010): drift-sink trap. /* IMEM tripwire [0x8600000,0x8600004): drift-sink trap.
* Rest of IMEM stays zeros (SBL stack reads data there). */ * Must stay 4B (wider poison corrupts IMEM-stack reads). */
{ {
uint32_t p = 0xFFFFFFFF; uint32_t p = 0xFFFFFFFF;
uint32_t a; cpu_physical_memory_write(0x08600000, &p, 4);
for (a = 0x08600000; a < 0x08600010; a += 4) {
cpu_physical_memory_write(a, &p, 4);
}
} }
/* pop-site slots -> stublets (sp values from cpu traces) */ /* pop-site slots -> stublets (sp values from cpu traces) */
v = 0x802f65d; /* S1 pop10 @fef0: resume sbl_main */ v = 0x802f65d; /* S1 pop10 @fef0: resume sbl_main */
tools/sbl_uni.py
+4 -5
View File
@@ -474,12 +474,11 @@ def main():
"60474af20007c0f2730747f2797cc0f6000c6047")) "60474af20007c0f2730747f2797cc0f6000c6047"))
# stack zone fill (STUBV odd) # stack zone fill (STUBV odd)
mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4)) mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
# IMEM tripwire [0x8600000,0x8600010): drift-sink trap (UDF). # IMEM tripwire [0x8600000,0x8600004): drift-sink trap (UDF).
# Fill-drift falls through here sequentially; faults LOUDLY at # Fill-drift falls through here sequentially; faults LOUDLY at
# entry instead of sledding silently to IMEM-top. Rest of IMEM # entry. Must stay 4B: wider poison corrupts IMEM-stack reads
# stays zeros (SBL IMEM-stack reads data there; full poison # (SBL frames live at 0x860000C+, counters underflow on 0xFF!).
# corrupts counters (0xFFFFFFFF vs fresh 0)!). mu.mem_write(0x08600000, b"\xff\xff\xff\xff")
mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * 4)
# pop-site slots (sp values from traces) # pop-site slots (sp values from traces)
for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665), for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665),
(0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681), (0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681),