sbl: b12 chain, slots, maze, stubs, docs current

qemu/saimaa.c

@@ -290,42 +290,58 @@ static void saimaa_machine_init(MachineState *machine)
     ARM_CPU(first_cpu)->env.cp15.nsacr |= (3u << 10);
     ARM_CPU(first_cpu)->env.vfp.xregs[ARM_VFP_FPEXC] |= (1u << 30);
         /* Boot scaffolding for SBL1 BringUp (WIP stub-driven PBL):
-         * pop-compensation stublets at 0x08062000 pin sp and route onward,
+         * static continuation slots for shared-epilogue pops.
-         * so repeated pops always hit valid slots. */
+         * sp advances linearly (no compensation); one slot per pop site.
+         * (sp values from cpu traces, b10 image) */
         {
-            static const unsigned char stub_blob[] = { 0xf0, 0xb4, 0x2d, 0xe9, 0x00, 0x5f, 0xdf, 0xf8, 0x6c, 0xc0, 0xcd, 0xf8, 0x24, 0xc0, 0xdf, 0xf8, 0x68, 0xf0, 0x30, 0xb4, 0xdf, 0xf8, 0x64, 0xc0, 0xcd, 0xf8, 0x04, 0xc0, 0xdf, 0xf8, 0x60, 0xf0, 0xf0, 0xb4, 0x2d, 0xe9, 0x00, 0x5f, 0xdf, 0xf8, 0x5c, 0xc0, 0xcd, 0xf8, 0x24, 0xc0, 0xdf, 0xf8, 0x58, 0xf0, 0xf0, 0xb5, 0x01, 0xb4, 0xdf, 0xf8, 0x54, 0xc0, 0xcd, 0xf8, 0x14, 0xc0, 0xdf, 0xf8, 0x50, 0xf0, 0xf0, 0xb4, 0x2d, 0xe9, 0x00, 0x5f, 0xdf, 0xf8, 0x48, 0xc0, 0xcd, 0xf8, 0x24, 0xc0, 0xdf, 0xf8, 0x44, 0xf0, 0xf0, 0xb5, 0x01, 0xb4, 0xdf, 0xf8, 0x40, 0xc0, 0xcd, 0xf8, 0x14, 0xc0, 0xdf, 0xf8, 0x3c, 0xf0, 0xf0, 0xb5, 0x07, 0xb4, 0xdf, 0xf8, 0x38, 0xc0, 0xcd, 0xf8, 0x1c, 0xc0, 0xdf, 0xf8, 0x34, 0xf0, 0x01, 0x20, 0x06, 0x08, 0x5d, 0xf6, 0x02, 0x08, 0x13, 0x20, 0x06, 0x08, 0x65, 0xf6, 0x02, 0x08, 0x21, 0x20, 0x06, 0x08, 0xa5, 0x3b, 0x01, 0x08, 0x43, 0x20, 0x06, 0x08, 0x81, 0xf6, 0x02, 0x08, 0x33, 0x20, 0x06, 0x08, 0x83, 0x61, 0x01, 0x08, 0x55, 0x20, 0x06, 0x08, 0x8d, 0x8a, 0x01, 0x08, 0x65, 0x20, 0x06, 0x08, 0x7d, 0xf6, 0x02, 0x08 };
             uint32_t magic = 0x00000000; /* IMEM poll spins WHILE equal */
             uint32_t S = 0x08062100, STUB = 0x08062120;
             uint32_t w;
             uint16_t h0 = 0x2000, h1 = 0x4770; /* movs r0,#0; bx lr */
-            size_t k;
             uint32_t v;
-            for (k = 0; k < sizeof(stub_blob); k += 4) {
-                uint32_t word;
-                __builtin_memcpy(&word, &stub_blob[k], 4);
-                cpu_physical_memory_write(0x08062000 + k, &word, 4);
-            }
             /* pointer maze in owned RAM for SBL1 struct chains */
             w = S + 8;
             cpu_physical_memory_write(S, &w, 4);
             cpu_physical_memory_write(S + 8, &STUB, 4);
             cpu_physical_memory_write(STUB, &h0, 2);
             cpu_physical_memory_write(STUB + 2, &h1, 2);
+            cpu_physical_memory_write(STUB + 4, &STUB, 4);
             cpu_physical_memory_write(0x087c29d18, &S, 4);
             cpu_physical_memory_write(0x08050b28, &S, 4);
             cpu_physical_memory_write(0x08070000, &S, 4);
+            /* stack zone defaults to plain-stub addr: every register
+             * popped from untouched stack becomes callable (returns 0). */
+            {
+                uint32_t fill = 0x08062121;
+                uint32_t a;
+                for (a = 0x085F0000; a < 0x08600000; a += 4) {
+                    cpu_physical_memory_write(a, &fill, 4);
+                }
+            }
             /* pop-site slots -> stublets (sp values from cpu traces) */
-            v = 0x08062001; /* S1 pop10 */
+            v = 0x802f65d; /* S1 pop10 @fef0: resume sbl_main */
             cpu_physical_memory_write(0x085FFF14, &v, 4);
-            v = 0x08062013; /* S2 pop2 */
+            v = 0x802f665; /* S2 pop2 @ff18: walker site (NOP) */
             cpu_physical_memory_write(0x085FFF1C, &v, 4);
-            v = 0x08062021; /* S3 pop10 */
+            v = 0x8013ba5; /* S3 pop10 @ff20: 0x8013b7c loop */
             cpu_physical_memory_write(0x085FFF44, &v, 4);
-            cpu_physical_memory_write(0x085FFF7C, &v, 4);
+            v = 0x802f681; /* S4 pop6 @ff48: back to sbl_main */
-            v = 0x08062033; /* S4 pop6 (stublet chains S5) */
+            cpu_physical_memory_write(0x085FFF5C, &v, 4);
-            cpu_physical_memory_write(0x085FFF34, &v, 4);
+            v = 0x8016183; /* S5 pop10 @ff50: 0x8013ae4 caller */
+            cpu_physical_memory_write(0x085FFF74, &v, 4);
+            {   /* words that popped regs must read as 0 (not stub-fill) */
+                uint32_t z = 0;
+                cpu_physical_memory_write(0x085FFF58, &z, 4); /* r7 src */
+            }
+            {   /* installer-path slots + zero words */
+                uint32_t z = 0;
+                uint32_t z2 = 0;
+                cpu_physical_memory_write(0x085FFF34, &z2, 4); /* S3 r7 */
+                cpu_physical_memory_write(0x085FFF54, &z2, 4);
+                cpu_physical_memory_write(0x085FFF6C, &z, 4); /* r7 src */
+            }
             cpu_physical_memory_write(0x08600944, &magic, 4);
-            printf("saimaa: stub-scaffold live\n");
+            printf("saimaa: slots live\n");
         }
         printf("saimaa: SBL1 %s loaded (%zd bytes), entry 0x%lx\n",
                sms->sbl1, sz, (unsigned long)entry);

tools/sbl_patch.py

@@ -108,6 +108,31 @@ def main():
     assert d[o:o + 4].hex() == 'e9f700fa', hx(d, 0x802F678)
     d[o:o + 4] = bytes.fromhex('c046c046')
     save(d, 'img0_b10.elf')
+    # b11 = b10 with installer-bl restored (redirect, installer runs again)
+    o = off(0x802F678)
+    assert d[o:o + 4].hex() == 'c046c046'
+    d[o:o + 4] = bytes.fromhex('e9f700fa')
+    save(d, 'img0_b11.elf')
+    # b12: b10-variant with jump-table entry0 NOP (fall into entry1/case-1);
+    # rebuilt from b10 base (installer stays skipped)
+    d = bytearray(base)
+    for va, (a, b) in BLX2BL.items():
+        set4(d, va, b)
+    for va, exp, new in [
+        (0x802F664, 'e4f77efc', 'c046c046'),
+        (0x802F672, 'e6f7bbfa', 'c046c046'),
+        (0x802F678, 'e9f7fef9', 'c046c046'),
+        (0x801B71E, '9847fee7', 'c046c046'),
+        (0x8008396, 'fef780f9', 'c046c046'),
+        (0x8016184, 'fdf790fc', 'c046c046'),
+        (0x801B76C, '280b0508', '00000708'),
+    ]:
+        assert hx(d, va) == exp, (hex(va), hx(d, va))
+        set4(d, va, new)
+    o = off(0x8013AA8)
+    assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)
+    d[o:o + 4] = bytes.fromhex('c046c046')
+    save(d, 'img0_b12.elf')
 
 
 if __name__ == '__main__':