sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

b22: rollback NOP + S9v3 baked (sp reset)

Browse Source
This commit is contained in:
SashegDev
2026-09-13 10:31:40 +00:00
parent c29860618f
commit f2510065ea
3 changed files with 112 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qemu/saimaa.c
+27 -4
View File
@@ -104,15 +104,15 @@ static void saimaa_tmr_init(Object *obj)
/* Stubs region handle for set_readonly after scaffold implant. */
static MemoryRegion *saimaa_stubs_mr;
/* DDRLOW stub trap [0x08006B80,0x08006C50): serves the scaffolded bytes
* (S/maze/S6/banner/S7 stubs) on read/fetch, ignores SBL heap-clobber
/* DDRLOW stub trap [0x08006B80,0x08006C90): serves the scaffolded bytes
* (S/maze/S6/banner/S7/S9 stubs) on read/fetch, ignores SBL heap-clobber
* writes. Uni parity: deferred-restore guard in sbl_uni.py (wider:
* [0x080068C0,0x08006C50), also covers PBL stub).
* [0x080068C0,0x08006C90), also covers PBL stub).
* Snapshot is taken AFTER ELF load + all stub writes (readback).
* PBL stub [0x080068C0,0x080068F4) and the ELF-text gap below stay plain
* RAM: PBL runs once (if at all), gap holds real hot SBL code. */
#define SAIMAA_DSTUB_BASE 0x08006B80
#define SAIMAA_DSTUB_SIZE 0x000000D0
#define SAIMAA_DSTUB_SIZE 0x00000110
static uint8_t saimaa_dstub_mem[SAIMAA_DSTUB_SIZE];
static uint64_t saimaa_dstub_read(void *opaque, hwaddr off, unsigned size)
@@ -654,6 +654,29 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x08006C10 + k, &word, 4);
}
}
/* S9 stublet at 0x08006C48 (62B, b22): labyrinth-epilogue
* exit router (0x801B6BE pop.w -> b.w S9). Empty frames ->
* restore r0/r4/r5/sl/fp, reset sp to 0x085FFF00, jump to
* sbl_main 0x802f69d via ip. Assembled with keystone. */
{
static const uint8_t s9[] = {
0x05, 0x9b, 0x0b, 0xb1, 0xbd, 0xe8, 0xf0, 0x81,
0x00, 0x20, 0x40, 0xf2, 0x00, 0x04, 0xc0, 0xf2,
0x22, 0x04, 0x40, 0xf2, 0x00, 0x05, 0xc0, 0xf2,
0x22, 0x05, 0x40, 0xf2, 0x00, 0x0a, 0xc0, 0xf6,
0x06, 0x0a, 0x41, 0xf2, 0x00, 0x0b, 0xc0, 0xf6,
0x06, 0x0b, 0x4f, 0xf6, 0x00, 0x73, 0xc0, 0xf6,
0x5f, 0x03, 0x9d, 0x46, 0x4f, 0xf2, 0x9d, 0x6c,
0xc0, 0xf6, 0x02, 0x0c, 0x60, 0x47,
};
size_t k;
for (k = 0; k < sizeof(s9); k += 4) {
uint32_t word = 0;
size_t n = sizeof(s9) - k < 4 ? sizeof(s9) - k : 4;
__builtin_memcpy(&word, &s9[k], n);
cpu_physical_memory_write(0x08006C48 + k, &word, 4);
}
}
{
uint32_t fill = 0x08006B8D;
uint32_t a;