diff --git a/qemu/maze.S b/qemu/maze.S index be36a1d..d68fa04 100644 --- a/qemu/maze.S +++ b/qemu/maze.S @@ -1,16 +1,22 @@ .syntax unified .cpu cortex-a7 .thumb - @ maze entry logger: ring-buffer of (lr,sp) at 0x08006964 (8 slots), - @ return 0. Guard: bad lr spins with IRQs off. + @ maze entry logger: ring buffer of 8 (lr,sp) at MAILBOX, return 0. + @ Preserves all regs except r0 (return value) and r12 (IP, clobber-ok). .text .global maze_stub maze_stub: - movw r12, #:lower16:0x08006964 - movt r12, #:upper16:0x08006964 - ldr r12, [r12, #28] @ idx - add r12, #1 - and r12, #7 - str r12, [r12, #-28] @ hmm placeholder, replaced below + push {r0-r3} + movw r12, #:lower16:0x08006888 + movt r12, #:upper16:0x08006888 + ldr r0, [r12, #32] + add r0, #1 + and r0, #7 + str r0, [r12, #32] + lsl r0, #3 + add r0, r12 + str lr, [r0] + str sp, [r0, #4] + pop {r0-r3} movs r0, #0 bx lr diff --git a/qemu/saimaa.c b/qemu/saimaa.c index e5f5192..4257371 100644 --- a/qemu/saimaa.c +++ b/qemu/saimaa.c @@ -122,8 +122,8 @@ static uint64_t saimaa_vec_read(void *opaque, hwaddr off, unsigned size) int th = cpu ? cpu->env.thumb : 0; uint32_t mb0 = 0, mb1 = 0; if (saimaa_vec_n < 3) { - cpu_physical_memory_read(0x08006964, &mb0, 4); - cpu_physical_memory_read(0x08006968, &mb1, 4); + cpu_physical_memory_read(0x0800688e, &mb0, 4); + cpu_physical_memory_read(0x08006892, &mb1, 4); } fprintf(stderr, "saimaa-vec: %s off=0x%x pc=0x%lx", size == 2 ? "fetch?" : "read", @@ -455,8 +455,8 @@ static void saimaa_machine_init(MachineState *machine) * (sp values from cpu traces, b10 image) */ { uint32_t magic = 0x00000000; /* IMEM poll spins WHILE equal */ - uint32_t S = 0x08006900, STUB = 0x08006910; /* in-code zeros, safe from heap */ - uint32_t STUBV = 0x08006911; /* odd: blx stays Thumb */ + uint32_t S = 0x08006820, STUB = 0x08006830; /* in-code zeros, safe from heap */ + uint32_t STUBV = 0x08006831; /* odd: blx stays Thumb */ uint32_t w; uint16_t h0 = 0x2000, h1 = 0x4770; /* movs r0,#0; bx lr */ uint32_t v; @@ -475,11 +475,12 @@ static void saimaa_machine_init(MachineState *machine) * Bad lr (not 0x08xxxxxx) spins with IRQs off instead of * jumping into the void. 36 bytes. */ static const uint8_t mb[] = { - 0x46, 0xf6, 0x64, 0x1c, 0xc0, 0xf6, 0x00, 0x0c, - 0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0, - 0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1, - 0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6, - 0xfd, 0xe7, 0x00, 0x00, + 0x0f, 0xb4, 0x46, 0xf6, 0x88, 0x0c, 0xc0, 0xf6, + 0x00, 0x0c, 0xdc, 0xf8, 0x20, 0x00, 0x00, 0xf1, + 0x01, 0x00, 0x00, 0xf0, 0x07, 0x00, 0xcc, 0xf8, + 0x20, 0x00, 0x4f, 0xea, 0xc0, 0x00, 0x60, 0x44, + 0xc0, 0xf8, 0x00, 0xe0, 0xc0, 0xf8, 0x04, 0xd0, + 0x0f, 0xbc, 0x00, 0x20, 0x70, 0x47, }; size_t k; for (k = 0; k < sizeof(mb); k += 4) { @@ -492,7 +493,7 @@ static void saimaa_machine_init(MachineState *machine) cpu_physical_memory_write(0x087c29d18, &S, 4); cpu_physical_memory_write(0x08050b28, &S, 4); cpu_physical_memory_write(0x08070000, &S, 4); - /* S6 stublet at 0x08006934: rebuild popped frame regs, + /* S6 stublet at 0x0800685e: rebuild popped frame regs, * return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */ { static const uint8_t s6[] = { @@ -506,10 +507,10 @@ static void saimaa_machine_init(MachineState *machine) uint32_t word = 0; size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4; __builtin_memcpy(&word, &s6[k], n); - cpu_physical_memory_write(0x08006934 + k, &word, 4); + cpu_physical_memory_write(0x0800685e + k, &word, 4); } } - /* Banner stub at 0x08006942: print r0 string via UARTDM + /* Banner stub at 0x0800686c: print r0 string via UARTDM * (b16 redirects 0x802f690 blx here). Built from qemu/banner.S: * push frame, print loop, ldr pc,=0x802f694 (callee noreturn). * 28 bytes total. */ @@ -526,13 +527,13 @@ static void saimaa_machine_init(MachineState *machine) uint32_t word = 0; size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4; __builtin_memcpy(&word, &bn[k], n); - cpu_physical_memory_write(0x08006942 + k, &word, 4); + cpu_physical_memory_write(0x0800686c + k, &word, 4); } } /* stack zone defaults to plain-stub addr: every register * popped from untouched stack becomes callable (returns 0). */ { - uint32_t fill = 0x08006911; + uint32_t fill = 0x08006831; uint32_t a; for (a = 0x085F0000; a < 0x08600000; a += 4) { cpu_physical_memory_write(a, &fill, 4); @@ -623,7 +624,7 @@ static void saimaa_machine_init(MachineState *machine) static void saimaa_post_reset(void *opaque) { - uint32_t S = 0x08006900; + uint32_t S = 0x08006820; (void)opaque; /* Re-apply pokes that live inside ROM-covered ranges (rom_reset * restores file bytes over them). */ diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py index b36eb50..6aeadb5 100644 --- a/tools/sbl_patch.py +++ b/tools/sbl_patch.py @@ -148,7 +148,7 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', 'eef71abf'), + (0x8017AFC, 'bde8fc87', 'eef7afbe'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va)) set4(d, va, new) @@ -174,8 +174,8 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', 'eef71abf'), - (0x802F690, '9847fee7', 'd7f757b9'), + (0x8017AFC, 'bde8fc87', 'eef7afbe'), + (0x802F690, '9847fee7', 'd7f7ecb8'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va)) set4(d, va, new) @@ -200,7 +200,7 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', 'eef71abf'), + (0x8017AFC, 'bde8fc87', 'eef7afbe'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va)) set4(d, va, new) @@ -245,7 +245,7 @@ def main(): (0x8016184, 'fdf790fc', 'c046c046'), (0x801B76C, '280b0508', '00000708'), (0x8006684, '01f807bd', '46c046c0'), - (0x8017AFC, 'bde8fc87', 'eef71abf'), + (0x8017AFC, 'bde8fc87', 'eef7afbe'), (0x802F690, '9847fee7', 'c046c046'), ]: assert hx(d, va) == exp, (hex(va), hx(d, va))