sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

maze v2: reject even lr (no ARM drift)

Browse Source
This commit is contained in:
lumia-emu
2026-09-14 00:30:18 +00:00
parent 3d011f2994
commit d3e2efe7ba
3 changed files with 38 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qemu/saimaa.c
+20 -29
View File
@@ -167,14 +167,15 @@ struct SaimaaUartState {
static int saimaa_vec_n;
static uint64_t saimaa_vec_read(void *opaque, hwaddr off, unsigned size)
{
/* Maze blob mirrored at [0,18) for THUMB fetches: null-jump fetches
* (bx r0=0, pop 0, ldr pc,=0) execute the maze and return via lr —
* uni parity (hook_null -> STUB). ARM-mode fetches (real exception
* entry) keep BKPT vectors below. Data probes elsewhere read 0. */
static const uint8_t maze[18] = {
/* Maze blob v2 mirrored at [0,24) for THUMB fetches: null-jump
* fetches (bx r0=0, pop 0, ldr pc,=0) execute the maze and return
* via lr — uni parity (hook_null -> STUB). ARM-mode fetches (real
* exception entry) keep BKPT vectors below. Data probes elsewhere
* read 0. */
static const uint8_t maze[24] = {
0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1,
0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6,
0xfd, 0xe7,
0x08, 0x0f, 0x03, 0xd1, 0x1e, 0xf0, 0x01, 0x0f,
0x00, 0xd0, 0x70, 0x47, 0x72, 0xb6, 0xfd, 0xe7,
};
{
ARMCPU *cpu = ARM_CPU(current_cpu);
@@ -555,13 +556,15 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(S + 4, &STUBV, 4);
cpu_physical_memory_write(S + 8, &STUBV, 4);
{
/* Minimal maze: movs r0,#0; bx lr (4B). No mailbox, no
* guard — vec trap already reports fault state. Less
* surface for SBL heap clobbers. */
/* Maze v2 (24B @STUB): movs r0,#0; return 0 via lr ONLY
* if lr is odd Thumb in DDR (top 8); even lr (stale
* mid-fn raw addr!) would ARM-drift (STM-clobbers +
* IMEM fault), so hang loud instead. Overlaps S6 head
* ([B9E,BA4), S6 dormant, documented below). */
static const uint8_t mb[] = {
0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1,
0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6,
0xfd, 0xe7,
0x08, 0x0f, 0x03, 0xd1, 0x1e, 0xf0, 0x01, 0x0f,
0x00, 0xd0, 0x70, 0x47, 0x72, 0xb6, 0xfd, 0xe7,
};
size_t k;
for (k = 0; k < sizeof(mb); k += 4) {
@@ -574,23 +577,11 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x087c29d18, &S, 4);
cpu_physical_memory_write(0x08050b28, &S, 4);
cpu_physical_memory_write(0x08070000, &S, 4);
/* S6 stublet at 0x08006B9E: rebuild popped frame regs,
* return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */
{
static const uint8_t s6[] = {
0xbd, 0xe8, 0xfc, 0x47, /* ldmia.w sp!,{r2-r9,sl,lr} */
0x43, 0xf6, 0xa5, 0x3e, /* movw lr,#0x3ba5 */
0xc0, 0xf6, 0x01, 0x0e, /* movt lr,#0x801 */
0x70, 0x47, /* bx lr */
};
size_t k;
for (k = 0; k < sizeof(s6); k += 4) {
uint32_t word = 0;
size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4;
__builtin_memcpy(&word, &s6[k], n);
cpu_physical_memory_write(0x08006B9E + k, &word, 4);
}
}
/* S6 stublet DISABLED (maze v2 overlaps its head [B9E,BA4);
* S6 dormant, never entered (b14 goes to 0x8005B9E).
* Bytes kept for reference (would live at 0x08006B9E):
* ldmia.w sp!,{r2-r9,sl,lr}; movw lr,#0x3ba5;
* movt lr,#0x801; bx lr. */
/* Banner stub at 0x08006BAC: print r0 string via UARTDM
* (b16 redirects 0x802f690 blx here). Built from qemu/banner.S:
* push frame, print loop, ldr pc,=0x802f694 (callee noreturn).