sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

b23: S10 + table poke + S9 baked

Browse Source
This commit is contained in:
lumia-emu
2026-09-13 10:37:18 +00:00
parent 8388cc0a30
commit 830283e12b
4 changed files with 122 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qemu/saimaa.c
+26 -5
View File
@@ -104,15 +104,15 @@ static void saimaa_tmr_init(Object *obj)
/* Stubs region handle for set_readonly after scaffold implant. */
static MemoryRegion *saimaa_stubs_mr;
/* DDRLOW stub trap [0x08006B80,0x08006C90): serves the scaffolded bytes
* (S/maze/S6/banner/S7/S9 stubs) on read/fetch, ignores SBL heap-clobber
* writes. Uni parity: deferred-restore guard in sbl_uni.py (wider:
* [0x080068C0,0x08006C90), also covers PBL stub).
/* DDRLOW stub trap [0x08006B80,0x08006CA0): serves the scaffolded bytes
* (S/maze/S6/banner/S7/S9/S10 stubs) on read/fetch, ignores SBL
* heap-clobber writes. Uni parity: deferred-restore guard in sbl_uni.py
* (wider: [0x080068C0,0x08006CA0), also covers PBL stub).
* Snapshot is taken AFTER ELF load + all stub writes (readback).
* PBL stub [0x080068C0,0x080068F4) and the ELF-text gap below stay plain
* RAM: PBL runs once (if at all), gap holds real hot SBL code. */
#define SAIMAA_DSTUB_BASE 0x08006B80
#define SAIMAA_DSTUB_SIZE 0x00000110
#define SAIMAA_DSTUB_SIZE 0x00000120
static uint8_t saimaa_dstub_mem[SAIMAA_DSTUB_SIZE];
static uint64_t saimaa_dstub_read(void *opaque, hwaddr off, unsigned size)
@@ -677,6 +677,27 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x08006C48 + k, &word, 4);
}
}
/* S10 stublet at 0x08006C88 (10B, b23): rollback-exit router.
* movw/movt ip + bx ip to sbl_main 0x802f6a3. */
{
static const uint8_t s10[] = {
0x4f, 0xf2, 0xa3, 0x6c, 0xc0, 0xf6, 0x02, 0x0c,
0x60, 0x47,
};
size_t k;
for (k = 0; k < sizeof(s10); k += 4) {
uint32_t word = 0;
size_t n = sizeof(s10) - k < 4 ? sizeof(s10) - k : 4;
__builtin_memcpy(&word, &s10[k], n);
cpu_physical_memory_write(0x08006C88 + k, &word, 4);
}
}
/* PBL version-table fabrication (b23): [0x080528D0] = STUBV
* so the rollback query's blx calls maze (0 = versions OK). */
{
uint32_t v = 0x08006B8D;
cpu_physical_memory_write(0x080528D0, &v, 4);
}
{
uint32_t fill = 0x08006B8D;
uint32_t a;