sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stubs relayout: maze guard 36B, S6->0x8062160, banner->0x8062170

Browse Source
This commit is contained in:
SashegDev
2026-09-11 07:44:19 +00:00
parent 474c3c8318
commit 72f23b43c9
3 changed files with 23 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qemu/maze.S
+9
View File
@@ -2,6 +2,9 @@
.cpu cortex-a7
.thumb
@ maze entry logger: record lr/sp to mailbox 0x08062200, return 0.
@ Guard: if lr is outside known-good SBL/stub ranges, spin with
@ interrupts disabled instead of jumping into the void (post-mortem
@ via vec trap regs).
.text
.global maze_stub
maze_stub:
@@ -10,4 +13,10 @@ maze_stub:
str lr, [r12]
str sp, [r12, #4]
movs r0, #0
lsr r12, lr, #24
cmp r12, #0x08
bne maze_hang
bx lr
maze_hang:
cpsid i
b maze_hang
qemu/saimaa.c
+10 -6
View File
@@ -439,11 +439,15 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(S + 4, &STUB, 4);
cpu_physical_memory_write(S + 8, &STUB, 4);
{
/* from qemu/maze.S: movw/movt r12; str lr/sp; movs; bx */
/* from qemu/maze.S: mailbox logger + lr-range guard.
* Bad lr (not 0x08xxxxxx) spins with IRQs off instead of
* jumping into the void. 36 bytes. */
static const uint8_t mb[] = {
0x42, 0xf2, 0x00, 0x2c, 0xc0, 0xf6, 0x06, 0x0c,
0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0,
0x00, 0x20, 0x70, 0x47,
0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1,
0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6,
0xfd, 0xe7, 0x00, 0x00,
};
size_t k;
for (k = 0; k < sizeof(mb); k += 4) {
@@ -456,7 +460,7 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x087c29d18, &S, 4);
cpu_physical_memory_write(0x08050b28, &S, 4);
cpu_physical_memory_write(0x08070000, &S, 4);
/* S6 stublet at 0x08062140: rebuild popped frame regs,
/* S6 stublet at 0x08062160: rebuild popped frame regs,
* return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */
{
static const uint8_t s6[] = {
@@ -470,10 +474,10 @@ static void saimaa_machine_init(MachineState *machine)
uint32_t word = 0;
size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4;
__builtin_memcpy(&word, &s6[k], n);
cpu_physical_memory_write(0x08062140 + k, &word, 4);
cpu_physical_memory_write(0x08062160 + k, &word, 4);
}
}
/* Banner stub at 0x08062150: print r0 string via UARTDM
/* Banner stub at 0x08062170: print r0 string via UARTDM
* (b16 redirects 0x802f690 blx here). Built from qemu/banner.S:
* push frame, print loop, ldr pc,=0x802f694 (callee noreturn).
* 28 bytes total. */
@@ -489,7 +493,7 @@ static void saimaa_machine_init(MachineState *machine)
uint32_t word = 0;
size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4;
__builtin_memcpy(&word, &bn[k], n);
cpu_physical_memory_write(0x08062150 + k, &word, 4);
cpu_physical_memory_write(0x08062170 + k, &word, 4);
}
}
/* stack zone defaults to plain-stub addr: every register