diff --git a/qemu/saimaa.c b/qemu/saimaa.c index e9eb0c7..38a551c 100644 --- a/qemu/saimaa.c +++ b/qemu/saimaa.c @@ -104,15 +104,15 @@ static void saimaa_tmr_init(Object *obj) /* Stubs region handle for set_readonly after scaffold implant. */ static MemoryRegion *saimaa_stubs_mr; -/* DDRLOW stub trap [0x08006B80,0x08006C50): serves the scaffolded bytes - * (S/maze/S6/banner/S7 stubs) on read/fetch, ignores SBL heap-clobber +/* DDRLOW stub trap [0x08006B80,0x08006C90): serves the scaffolded bytes + * (S/maze/S6/banner/S7/S9 stubs) on read/fetch, ignores SBL heap-clobber * writes. Uni parity: deferred-restore guard in sbl_uni.py (wider: - * [0x080068C0,0x08006C50), also covers PBL stub). + * [0x080068C0,0x08006C90), also covers PBL stub). * Snapshot is taken AFTER ELF load + all stub writes (readback). * PBL stub [0x080068C0,0x080068F4) and the ELF-text gap below stay plain * RAM: PBL runs once (if at all), gap holds real hot SBL code. */ #define SAIMAA_DSTUB_BASE 0x08006B80 -#define SAIMAA_DSTUB_SIZE 0x000000D0 +#define SAIMAA_DSTUB_SIZE 0x00000110 static uint8_t saimaa_dstub_mem[SAIMAA_DSTUB_SIZE]; static uint64_t saimaa_dstub_read(void *opaque, hwaddr off, unsigned size) @@ -654,6 +654,29 @@ static void saimaa_machine_init(MachineState *machine) cpu_physical_memory_write(0x08006C10 + k, &word, 4); } } + /* S9 stublet at 0x08006C48 (62B, b22): labyrinth-epilogue + * exit router (0x801B6BE pop.w -> b.w S9). Empty frames -> + * restore r0/r4/r5/sl/fp, reset sp to 0x085FFF00, jump to + * sbl_main 0x802f69d via ip. Assembled with keystone. */ + { + static const uint8_t s9[] = { + 0x05, 0x9b, 0x0b, 0xb1, 0xbd, 0xe8, 0xf0, 0x81, + 0x00, 0x20, 0x40, 0xf2, 0x00, 0x04, 0xc0, 0xf2, + 0x22, 0x04, 0x40, 0xf2, 0x00, 0x05, 0xc0, 0xf2, + 0x22, 0x05, 0x40, 0xf2, 0x00, 0x0a, 0xc0, 0xf6, + 0x06, 0x0a, 0x41, 0xf2, 0x00, 0x0b, 0xc0, 0xf6, + 0x06, 0x0b, 0x4f, 0xf6, 0x00, 0x73, 0xc0, 0xf6, + 0x5f, 0x03, 0x9d, 0x46, 0x4f, 0xf2, 0x9d, 0x6c, + 0xc0, 0xf6, 0x02, 0x0c, 0x60, 0x47, + }; + size_t k; + for (k = 0; k < sizeof(s9); k += 4) { + uint32_t word = 0; + size_t n = sizeof(s9) - k < 4 ? sizeof(s9) - k : 4; + __builtin_memcpy(&word, &s9[k], n); + cpu_physical_memory_write(0x08006C48 + k, &word, 4); + } + } { uint32_t fill = 0x08006B8D; uint32_t a; diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py index 218e2f4..d831a18 100644 --- a/tools/sbl_patch.py +++ b/tools/sbl_patch.py @@ -730,6 +730,74 @@ def main(): save(d, 'img0_b21.elf') + # b22 = b21 + rollback assert NOP (0x801671C blx + b.n self): + # boot_rollback_version.c:580 (code 0x302E) fires (versions zeroed); + # caller (sbl_main) ignores r0 (movs r0,#0 after), so fall-through + # to the success pop is safe. Same idiom as banner site. + d = bytearray(base) + + for va, (a, b) in BLX2BL.items(): + + set4(d, va, b) + + for va, exp, new in [ + + (0x802F664, 'e4f77efc', 'c046c046'), + + (0x802F672, 'e6f7bbfa', 'c046c046'), + + (0x802F678, 'e9f7fef9', 'c046c046'), + + (0x801B71E, '9847fee7', 'c046c046'), + + (0x8008396, 'fef780f9', 'c046c046'), + + (0x8016184, 'fdf790fc', 'c046c046'), + + (0x801B76C, '280b0508', '00000708'), + + (0x8017AFC, 'bde8fc87', 'eef74fb8'), + + (0x802F690, '9847fee7', 'c046c046'), + + (0x801671C, '9847fee7', 'c046c046'), + + (0x8013BAC, 'f8bd0a4a', 'f3f730b8'), + + ]: + + assert hx(d, va) == exp, (hex(va), hx(d, va)) + + set4(d, va, new) + + # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs (see b18). + o = off(0x8006682) + + assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6) + + d[o:o + 6] = bytes.fromhex('c046c046c046') + + o = off(0x8013AA8) + + assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8) + + d[o:o + 4] = bytes.fromhex('c046c046') + + o = off(0x8013BA6) + + assert d[o:o + 2].hex() == 'b888', (hex(0x8013BA6), hx(d, 0x8013BA6, 2)) + + d[o:o + 2] = bytes.fromhex('ff20') + + # Logger S8 (see b21). + o = off(0x8034810) + + assert d[o:o + 4].hex() == 'bde8fc87', hx(d, 0x8034810) + + d[o:o + 2] = bytes.fromhex('7047') + + save(d, 'img0_b22.elf') + diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py index 88a8b6b..cf94ef0 100644 --- a/tools/sbl_uni.py +++ b/tools/sbl_uni.py @@ -236,6 +236,7 @@ def main(): # immune to [0]-writes that clobber a static maze copy from unicorn.arm_const import UC_ARM_REG_PC as _PC _nulllog = [] + _halt_on_null = "--haltonnull" in sys.argv def hook_null(mu, addr, size, data): if len(_nulllog) < 10: @@ -247,6 +248,8 @@ def main(): r, lr, sp = [], -1, -1 # walk back: find the branch source from hist _nulllog.append((count[0], r, lr, sp)) + if _halt_on_null and len(_nulllog) == 1: + return False mu.reg_write(_PC, STUB + 1) mu.hook_add(UC_HOOK_CODE, hook_null, begin=0x0, end=0xFFF) @@ -313,6 +316,15 @@ def main(): "ff2c13d940f20004c0f2220440f20005c0f2220540f2000a" "c0f6060a41f2000bc0f6060bdff800f081f60208dff800f0" "a53b0108")) + # S9 stublet (62B @0x08006C48, b22): labyrinth-epilogue exit router. + # ldr r3,[sp,#0x14]: nonzero -> original pop.w (legit return); + # zero (empty scaffold frames) -> restore r0/r4/r5/sl/fp, reset sp + # to 0x085FFF00 (fresh STUBV-fill stack), jump to sbl_main 0x802f69d + # via ip (no literal loads). + mu.mem_write(0x08006C48, bytes.fromhex( + "059b0bb1bde8f081002040f20004c0f2220440f20005c0f2" + "220540f2000ac0f6060a41f2000bc0f6060b4ff60073c0f6" + "5f039d464ff29d6cc0f6020c6047")) # stack zone fill (STUBV odd) mu.mem_write(0x085F0000, struct.pack(" {cur:#x}") + for n, prev, cur in elog[:10]: + print(f" FIRST insn#{n} {prev:#x} -> {cur:#x}") + for n, prev, cur in elog[-10:]: + print(f" LAST insn#{n} {prev:#x} -> {cur:#x}") if _splog is not None: print(f"sp-highs: {len(_splog)}") for n, pc, sp in _splog: