sasheg/lumia-emulator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stubs to in-code zeros 0x8006900 (heap-proof)

Browse Source
This commit is contained in:
SashegDev
2026-09-11 08:27:23 +00:00
parent 1eee25a746
commit f449b56b05
3 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qemu/maze.S
+3 -3
View File
@@ -1,15 +1,15 @@
.syntax unified .syntax unified
.cpu cortex-a7 .cpu cortex-a7
.thumb .thumb
@ maze entry logger: record lr/sp to mailbox 0x08800200, return 0. @ maze entry logger: record lr/sp to mailbox 0x08006964, return 0.
@ Guard: if lr is outside known-good SBL/stub ranges, spin with @ Guard: if lr is outside known-good SBL/stub ranges, spin with
@ interrupts disabled instead of jumping into the void (post-mortem @ interrupts disabled instead of jumping into the void (post-mortem
@ via vec trap regs). @ via vec trap regs).
.text .text
.global maze_stub .global maze_stub
maze_stub: maze_stub:
movw r12, #:lower16:0x08800200 movw r12, #:lower16:0x08006964
movt r12, #:upper16:0x08800200 movt r12, #:upper16:0x08006964
str lr, [r12] str lr, [r12]
str sp, [r12, #4] str sp, [r12, #4]
movs r0, #0 movs r0, #0
qemu/saimaa.c
+12 -12
View File
@@ -115,8 +115,8 @@ static uint64_t saimaa_vec_read(void *opaque, hwaddr off, unsigned size)
int th = cpu ? cpu->env.thumb : 0; int th = cpu ? cpu->env.thumb : 0;
uint32_t mb0 = 0, mb1 = 0; uint32_t mb0 = 0, mb1 = 0;
if (saimaa_vec_n < 3) { if (saimaa_vec_n < 3) {
cpu_physical_memory_read(0x08800200, &mb0, 4); cpu_physical_memory_read(0x08006964, &mb0, 4);
cpu_physical_memory_read(0x08800204, &mb1, 4); cpu_physical_memory_read(0x08006968, &mb1, 4);
} }
fprintf(stderr, "saimaa-vec: %s off=0x%x pc=0x%lx", fprintf(stderr, "saimaa-vec: %s off=0x%x pc=0x%lx",
size == 2 ? "fetch?" : "read", size == 2 ? "fetch?" : "read",
@@ -440,14 +440,14 @@ static void saimaa_machine_init(MachineState *machine)
* (sp values from cpu traces, b10 image) */ * (sp values from cpu traces, b10 image) */
{ {
uint32_t magic = 0x00000000; /* IMEM poll spins WHILE equal */ uint32_t magic = 0x00000000; /* IMEM poll spins WHILE equal */
uint32_t S = 0x08800000, STUB = 0x08800020; uint32_t S = 0x08006900, STUB = 0x08006910; /* in-code zeros, safe from heap */
uint32_t STUBV = 0x08800021; /* odd: blx stays Thumb */ uint32_t STUBV = 0x08006911; /* odd: blx stays Thumb */
uint32_t w; uint32_t w;
uint16_t h0 = 0x2000, h1 = 0x4770; /* movs r0,#0; bx lr */ uint16_t h0 = 0x2000, h1 = 0x4770; /* movs r0,#0; bx lr */
uint32_t v; uint32_t v;
/* pointer maze in owned RAM for SBL1 struct chains. /* pointer maze in owned RAM for SBL1 struct chains.
* STUB = mailbox logger + return-0: records lr/sp at entry * STUB = mailbox logger + return-0: records lr/sp at entry
* to 0x08800200 for post-mortem, then movs r0,#0; bx lr. */ * to 0x08006964 for post-mortem, then movs r0,#0; bx lr. */
w = S + 8; w = S + 8;
cpu_physical_memory_write(S, &w, 4); cpu_physical_memory_write(S, &w, 4);
/* [struct+4] is another fn ptr (e.g. 0x801b72e ldr r3,[r0,#4] /* [struct+4] is another fn ptr (e.g. 0x801b72e ldr r3,[r0,#4]
@@ -459,7 +459,7 @@ static void saimaa_machine_init(MachineState *machine)
* Bad lr (not 0x08xxxxxx) spins with IRQs off instead of * Bad lr (not 0x08xxxxxx) spins with IRQs off instead of
* jumping into the void. 36 bytes. */ * jumping into the void. 36 bytes. */
static const uint8_t mb[] = { static const uint8_t mb[] = {
0x40, 0xf2, 0x00, 0x2c, 0xc0, 0xf6, 0x80, 0x0c, 0x46, 0xf6, 0x64, 0x1c, 0xc0, 0xf6, 0x00, 0x0c,
0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0, 0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0,
0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1, 0x00, 0x20, 0x4f, 0xea, 0x1e, 0x6c, 0xbc, 0xf1,
0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6, 0x08, 0x0f, 0x00, 0xd1, 0x70, 0x47, 0x72, 0xb6,
@@ -476,7 +476,7 @@ static void saimaa_machine_init(MachineState *machine)
cpu_physical_memory_write(0x087c29d18, &S, 4); cpu_physical_memory_write(0x087c29d18, &S, 4);
cpu_physical_memory_write(0x08050b28, &S, 4); cpu_physical_memory_write(0x08050b28, &S, 4);
cpu_physical_memory_write(0x08070000, &S, 4); cpu_physical_memory_write(0x08070000, &S, 4);
/* S6 stublet at 0x08800060: rebuild popped frame regs, /* S6 stublet at 0x08006934: rebuild popped frame regs,
* return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */ * return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */
{ {
static const uint8_t s6[] = { static const uint8_t s6[] = {
@@ -490,10 +490,10 @@ static void saimaa_machine_init(MachineState *machine)
uint32_t word = 0; uint32_t word = 0;
size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4; size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4;
__builtin_memcpy(&word, &s6[k], n); __builtin_memcpy(&word, &s6[k], n);
cpu_physical_memory_write(0x08800060 + k, &word, 4); cpu_physical_memory_write(0x08006934 + k, &word, 4);
} }
} }
/* Banner stub at 0x08800070: print r0 string via UARTDM /* Banner stub at 0x08006942: print r0 string via UARTDM
* (b16 redirects 0x802f690 blx here). Built from qemu/banner.S: * (b16 redirects 0x802f690 blx here). Built from qemu/banner.S:
* push frame, print loop, ldr pc,=0x802f694 (callee noreturn). * push frame, print loop, ldr pc,=0x802f694 (callee noreturn).
* 28 bytes total. */ * 28 bytes total. */
@@ -510,13 +510,13 @@ static void saimaa_machine_init(MachineState *machine)
uint32_t word = 0; uint32_t word = 0;
size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4; size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4;
__builtin_memcpy(&word, &bn[k], n); __builtin_memcpy(&word, &bn[k], n);
cpu_physical_memory_write(0x08800070 + k, &word, 4); cpu_physical_memory_write(0x08006942 + k, &word, 4);
} }
} }
/* stack zone defaults to plain-stub addr: every register /* stack zone defaults to plain-stub addr: every register
* popped from untouched stack becomes callable (returns 0). */ * popped from untouched stack becomes callable (returns 0). */
{ {
uint32_t fill = 0x08800021; uint32_t fill = 0x08006911;
uint32_t a; uint32_t a;
for (a = 0x085F0000; a < 0x08600000; a += 4) { for (a = 0x085F0000; a < 0x08600000; a += 4) {
cpu_physical_memory_write(a, &fill, 4); cpu_physical_memory_write(a, &fill, 4);
@@ -604,7 +604,7 @@ static void saimaa_machine_init(MachineState *machine)
static void saimaa_post_reset(void *opaque) static void saimaa_post_reset(void *opaque)
{ {
uint32_t S = 0x08800000; uint32_t S = 0x08006900;
(void)opaque; (void)opaque;
/* Re-apply pokes that live inside ROM-covered ranges (rom_reset /* Re-apply pokes that live inside ROM-covered ranges (rom_reset
* restores file bytes over them). */ * restores file bytes over them). */
tools/sbl_patch.py
+5 -5
View File
@@ -148,7 +148,7 @@ def main():
(0x8016184, 'fdf790fc', 'c046c046'), (0x8016184, 'fdf790fc', 'c046c046'),
(0x801B76C, '280b0508', '00000708'), (0x801B76C, '280b0508', '00000708'),
(0x8006684, '01f807bd', '46c046c0'), (0x8006684, '01f807bd', '46c046c0'),
(0x8017AFC, 'bde8fc87', 'e8f3b0b2'), (0x8017AFC, 'bde8fc87', 'eef71abf'),
]: ]:
assert hx(d, va) == exp, (hex(va), hx(d, va)) assert hx(d, va) == exp, (hex(va), hx(d, va))
set4(d, va, new) set4(d, va, new)
@@ -174,8 +174,8 @@ def main():
(0x8016184, 'fdf790fc', 'c046c046'), (0x8016184, 'fdf790fc', 'c046c046'),
(0x801B76C, '280b0508', '00000708'), (0x801B76C, '280b0508', '00000708'),
(0x8006684, '01f807bd', '46c046c0'), (0x8006684, '01f807bd', '46c046c0'),
(0x8017AFC, 'bde8fc87', 'e8f3b0b2'), (0x8017AFC, 'bde8fc87', 'eef71abf'),
(0x802F690, '9847fee7', 'd0f3eeb4'), (0x802F690, '9847fee7', 'd7f757b9'),
]: ]:
assert hx(d, va) == exp, (hex(va), hx(d, va)) assert hx(d, va) == exp, (hex(va), hx(d, va))
set4(d, va, new) set4(d, va, new)
@@ -200,7 +200,7 @@ def main():
(0x8016184, 'fdf790fc', 'c046c046'), (0x8016184, 'fdf790fc', 'c046c046'),
(0x801B76C, '280b0508', '00000708'), (0x801B76C, '280b0508', '00000708'),
(0x8006684, '01f807bd', '46c046c0'), (0x8006684, '01f807bd', '46c046c0'),
(0x8017AFC, 'bde8fc87', 'e8f3b0b2'), (0x8017AFC, 'bde8fc87', 'eef71abf'),
]: ]:
assert hx(d, va) == exp, (hex(va), hx(d, va)) assert hx(d, va) == exp, (hex(va), hx(d, va))
set4(d, va, new) set4(d, va, new)
@@ -245,7 +245,7 @@ def main():
(0x8016184, 'fdf790fc', 'c046c046'), (0x8016184, 'fdf790fc', 'c046c046'),
(0x801B76C, '280b0508', '00000708'), (0x801B76C, '280b0508', '00000708'),
(0x8006684, '01f807bd', '46c046c0'), (0x8006684, '01f807bd', '46c046c0'),
(0x8017AFC, 'bde8fc87', 'e8f3b0b2'), (0x8017AFC, 'bde8fc87', 'eef71abf'),
(0x802F690, '9847fee7', 'c046c046'), (0x802F690, '9847fee7', 'c046c046'),
]: ]:
assert hx(d, va) == exp, (hex(va), hx(d, va)) assert hx(d, va) == exp, (hex(va), hx(d, va))