From 72f23b43c9a381fee065eb76a551879a27a24225 Mon Sep 17 00:00:00 2001
From: SashegDev <gdsasheg@gmail.com>
Date: Fri, 11 Sep 2026 07:44:19 +0000
Subject: [PATCH] stubs relayout: maze guard 36B, S6->0x8062160,
 banner->0x8062170

---
 qemu/maze.S        |  9 +++++++++
 qemu/saimaa.c      | 16 ++++++++++------
 tools/sbl_patch.py |  8 ++++----
 3 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/qemu/maze.S b/qemu/maze.S
index 384492b..8b3641e 100644
--- a/qemu/maze.S
+++ b/qemu/maze.S
@@ -2,6 +2,9 @@
     .cpu cortex-a7
     .thumb
     @ maze entry logger: record lr/sp to mailbox 0x08062200, return 0.
+    @ Guard: if lr is outside known-good SBL/stub ranges, spin with
+    @ interrupts disabled instead of jumping into the void (post-mortem
+    @ via vec trap regs).
     .text
     .global maze_stub
 maze_stub:
@@ -10,4 +13,10 @@ maze_stub:
     str lr, [r12]
     str sp, [r12, #4]
     movs r0, #0
+    lsr r12, lr, #24
+    cmp r12, #0x08
+    bne maze_hang
     bx lr
+maze_hang:
+    cpsid i
+    b maze_hang
diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 62445b9..32bca44 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -439,11 +439,15 @@ static void saimaa_machine_init(MachineState *machine)
             cpu_physical_memory_write(S + 4, &STUB, 4);
             cpu_physical_memory_write(S + 8, &STUB, 4);
             {
-                /* from qemu/maze.S: movw/movt r12; str lr/sp; movs; bx */
+                /* from qemu/maze.S: mailbox logger + lr-range guard.
+                 * Bad lr (not 0x08xxxxxx) spins with IRQs off instead of
+                 * jumping into the void. 36 bytes. */
                 static const uint8_t mb[] = {
                     0x42, 0xf2, 0x00, 0x2c, 0xc0, 0xf6, 0x06, 0x0c,
                     0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0,
-                    0x00, 0x20, 0x70, 0x47,
+                    0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1,
+                    0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6,
+                    0xfd, 0xe7, 0x00, 0x00,
                 };
                 size_t k;
                 for (k = 0; k < sizeof(mb); k += 4) {
@@ -456,7 +460,7 @@ static void saimaa_machine_init(MachineState *machine)
             cpu_physical_memory_write(0x087c29d18, &S, 4);
             cpu_physical_memory_write(0x08050b28, &S, 4);
             cpu_physical_memory_write(0x08070000, &S, 4);
-            /* S6 stublet at 0x08062140: rebuild popped frame regs,
+            /* S6 stublet at 0x08062160: rebuild popped frame regs,
              * return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */
             {
                 static const uint8_t s6[] = {
@@ -470,10 +474,10 @@ static void saimaa_machine_init(MachineState *machine)
                     uint32_t word = 0;
                     size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4;
                     __builtin_memcpy(&word, &s6[k], n);
-                    cpu_physical_memory_write(0x08062140 + k, &word, 4);
+                    cpu_physical_memory_write(0x08062160 + k, &word, 4);
                 }
             }
-            /* Banner stub at 0x08062150: print r0 string via UARTDM
+            /* Banner stub at 0x08062170: print r0 string via UARTDM
              * (b16 redirects 0x802f690 blx here). Built from qemu/banner.S:
              * push frame, print loop, ldr pc,=0x802f694 (callee noreturn).
              * 28 bytes total. */
@@ -489,7 +493,7 @@ static void saimaa_machine_init(MachineState *machine)
                     uint32_t word = 0;
                     size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4;
                     __builtin_memcpy(&word, &bn[k], n);
-                    cpu_physical_memory_write(0x08062150 + k, &word, 4);
+                    cpu_physical_memory_write(0x08062170 + k, &word, 4);
                 }
             }
             /* stack zone defaults to plain-stub addr: every register
diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py
index 4390876..60b4feb 100644
--- a/tools/sbl_patch.py
+++ b/tools/sbl_patch.py
@@ -148,7 +148,7 @@ def main():
         (0x8016184, 'fdf790fc', 'c046c046'),
         (0x801B76C, '280b0508', '00000708'),
         (0x8006684, '01f807bd', '46c046c0'),
-        (0x8017AFC, 'bde8fc87', '4af020bb'),
+        (0x8017AFC, 'bde8fc87', '4af030bb'),
     ]:
         assert hx(d, va) == exp, (hex(va), hx(d, va))
         set4(d, va, new)
@@ -174,8 +174,8 @@ def main():
         (0x8016184, 'fdf790fc', 'c046c046'),
         (0x801B76C, '280b0508', '00000708'),
         (0x8006684, '01f807bd', '46c046c0'),
-        (0x8017AFC, 'bde8fc87', '4af020bb'),
-        (0x802F690, '9847fee7', 'f032bd5e'),
+        (0x8017AFC, 'bde8fc87', '4af030bb'),
+        (0x802F690, '9847fee7', '32f06ebd'),
     ]:
         assert hx(d, va) == exp, (hex(va), hx(d, va))
         set4(d, va, new)
@@ -200,7 +200,7 @@ def main():
         (0x8016184, 'fdf790fc', 'c046c046'),
         (0x801B76C, '280b0508', '00000708'),
         (0x8006684, '01f807bd', '46c046c0'),
-        (0x8017AFC, 'bde8fc87', '4af020bb'),
+        (0x8017AFC, 'bde8fc87', '4af030bb'),
     ]:
         assert hx(d, va) == exp, (hex(va), hx(d, va))
         set4(d, va, new)