From fda762acc8316d66098a4398dd57c2e2ca19258b Mon Sep 17 00:00:00 2001
From: SashegDev <gdsasheg@gmail.com>
Date: Fri, 11 Sep 2026 08:35:46 +0000
Subject: [PATCH] saimaa: stubs region readonly after implant

---
 qemu/saimaa.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index e9806d3..c7a9e1e 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -35,6 +35,10 @@
 /* High DDRLOW for our stubs (SBL heap reuses 0x0806xxxx) */
 #define SAIMAA_DDRHI_BASE    0x08610000
 #define SAIMAA_DDRHI_SIZE    0x00FF0000 /* ..0x09600000 */
+/* Stubs carve-out inside DDRHI (SBL heap overwrites plain RAM):
+ * maze+S6+banner+mailbox live here, set read-only after implant. */
+#define SAIMAA_STUBS_BASE    0x08800000
+#define SAIMAA_STUBS_SIZE    0x00000300
 #define SAIMAA_IMEM_BASE     0x08600000
 #define SAIMAA_IMEM_SIZE     0x00010000
 #define SAIMAA_DDRH_A_BASE   0x80000000
@@ -94,6 +98,9 @@ static void saimaa_tmr_init(Object *obj)
     sysbus_init_mmio(dev, &s->iomem);
 }
 
+/* Stubs region handle for set_readonly after scaffold implant. */
+static MemoryRegion *saimaa_stubs_mr;
+
 /* ---- minimal MSM UARTDM stub: TX prints, status always ready ---- */
 #define TYPE_SAIMAA_VEC "saimaa-vec"
 #define TYPE_SAIMAA_UART "saimaa-uart"
@@ -248,19 +255,27 @@ static void saimaa_machine_init(MachineState *machine)
         { "saimaa.rpm", SAIMAA_RPM_BASE, SAIMAA_RPM_SIZE },
         { "saimaa.ocimem", SAIMAA_OCIMEM_BASE, SAIMAA_OCIMEM_SIZE },
         { "saimaa.ddrlow", SAIMAA_DDRLOW_BASE, SAIMAA_DDRLOW_SIZE },
-        { "saimaa.ddrhi", SAIMAA_DDRHI_BASE, SAIMAA_DDRHI_SIZE },
+        { "saimaa.ddrhi_lo", SAIMAA_DDRHI_BASE,
+          SAIMAA_STUBS_BASE - SAIMAA_DDRHI_BASE },
+        { "saimaa.stubs", SAIMAA_STUBS_BASE, SAIMAA_STUBS_SIZE },
+        { "saimaa.ddrhi_hi", SAIMAA_STUBS_BASE + SAIMAA_STUBS_SIZE,
+          SAIMAA_DDRHI_BASE + SAIMAA_DDRHI_SIZE -
+          (SAIMAA_STUBS_BASE + SAIMAA_STUBS_SIZE) },
         { "saimaa.imem", SAIMAA_IMEM_BASE, SAIMAA_IMEM_SIZE },
         { "saimaa.ddrhigh_a", SAIMAA_DDRH_A_BASE, SAIMAA_DDRH_A_SIZE },
         { "saimaa.ddrhigh_b", SAIMAA_DDRH_B_BASE, SAIMAA_DDRH_B_SIZE },
         { "saimaa.mystrom", SAIMAA_MYSTROM_BASE, SAIMAA_MYSTROM_SIZE },
         { "saimaa.smem", SAIMAA_SMEM_BASE, SAIMAA_SMEM_SIZE },
     };
-    for (i = 0; i < 10; i++) {
+    for (i = 0; i < 11; i++) {
         MemoryRegion *ram = g_new(MemoryRegion, 1);
         memory_region_init_ram(ram, NULL, rams[i].n, rams[i].s,
                                &error_fatal);
-	memory_region_add_subregion_overlap(sysmem, rams[i].b, ram,
+ 	memory_region_add_subregion_overlap(sysmem, rams[i].b, ram,
                                               1);
+        if (!strcmp(rams[i].n, "saimaa.stubs")) {
+            saimaa_stubs_mr = ram;
+        }
         if (!strcmp(rams[i].n, "saimaa.mystrom")) {
             /* Mystery handler ROM: ARM mov r0,#0; bx lr repeating,
              * so unknown blx targets return 0 instead of faulting. */
@@ -595,6 +610,9 @@ static void saimaa_machine_init(MachineState *machine)
                 printf("saimaa: uefi tables live\n");
             }
             printf("saimaa: slots live\n");
+            /* Freeze stubs: any SBL write here now faults loudly
+             * (data abort with DFAR) instead of silent corruption. */
+            memory_region_set_readonly(saimaa_stubs_mr, true);
         }
         printf("saimaa: SBL1 %s loaded (%zd bytes), entry 0x%lx\n",
                sms->sbl1, sz, (unsigned long)entry);