Rewrite the ARM9 exception handlers, ...

- Fix patchArm9ExceptionHandlersInstall for older versions

- Fix some bugs in the ARM11 exception handlers

- Other, minor, changes

.gitignore

@@ -13,4 +13,5 @@ exceptions/arm11/build
 *.d
 *.elf
 *.cxi
-.DS_Store
+.DS_Store
+*.dmp

exceptions/arm9/Makefile

@@ -13,8 +13,8 @@ dir_build := build
 dir_out := ../../$(dir_build)
 
 ASFLAGS := -mcpu=arm946e-s
-CFLAGS := -Wall -Wextra -mthumb $(ASFLAGS) -fno-builtin -std=c11 -Wno-main -O2 -flto -ffast-math
+CFLAGS := -Wall -Wextra -marm $(ASFLAGS) -fno-builtin -std=c11 -Wno-main -Os -ffast-math
-LDFLAGS := -nostdlib
+LDFLAGS := -nostartfiles -Wl,--nmagic
 
 objects = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
           $(patsubst $(dir_source)/%.c, $(dir_build)/%.o, \

exceptions/arm9/linker.ld

@@ -4,7 +4,7 @@ OUTPUT_ARCH(arm)
 ENTRY(_start)
 SECTIONS
 {
-    . = 0x01FF7FE0;
+    . = 0x01FF8000;
 
     .text   : ALIGN(4) { *(.text.start) *(.text*); . = ALIGN(4); }
     .rodata : ALIGN(4) { *(.rodata*); . = ALIGN(4); }

exceptions/arm9/source/handlers.h

@@ -43,8 +43,9 @@ typedef struct __attribute__((packed))
     u32 additionalDataSize;
 } ExceptionDumpHeader;
 
-u32 readMPUConfig(u32 *regionSettings);
 void FIQHandler(void);
 void undefinedInstructionHandler(void);
 void dataAbortHandler(void);
 void prefetchAbortHandler(void);
+
+u32 safecpy(void *dst, const void *src, u32 len);

exceptions/arm9/source/handlers.s

@@ -22,92 +22,131 @@
 @         or requiring that modified versions of such material be marked in
 @         reasonable ways as different from the original version.
 
-.macro GEN_HANDLER name
+.macro GEN_USUAL_HANDLER name, index
-    .global \name
+    \name\()Handler:
-    .type   \name, %function
+        ldr sp, =_regs
-    \name:
+        stmia sp, {r0-r7}
-        ldr sp, =#0x02000000    @ We make the (full descending) stack point to the end of ITCM for our exception handlers. 
-                                @ It doesn't matter if we're overwriting stuff here, since we're going to reboot.
 
-        stmfd sp!, {r0-r7}      @ FIQ has its own r8-r14 regs
+        mov r0, #\index
-        ldr r1, =\@             @ macro expansion counter
         b _commonHandler
-
-    .size   \name, . - \name
 .endm
 
 .text
 .arm
-.align 4
+.balign 4
 
 .global _commonHandler
 .type   _commonHandler, %function
 _commonHandler:
+    mov r1, r0
+    mov r0, sp
     mrs r2, spsr
-    mov r6, sp
     mrs r3, cpsr
+    add r6, r0, #(8 * 4)
 
-    orr r3, #0x1c0              @ disable Imprecise Aborts, IRQ and FIQ (equivalent to "cpsid aif" on arm11)
+    orr r3, #0xc0              @ mask interrupts
     msr cpsr_cx, r3
 
-    tst r2, #0x20
-    bne noSvcBreak
-    cmp r1, #2
-    bne noSvcBreak
-
-    sub r0, lr, #4              @ calling cannotAccessAddress cause more problems that it actually solves... (I've to save a lot of regs and that's a pain tbh)
-    lsr r0, #20                 @ we'll just do some address checks (to see if it's in ARM9 internal memory)
-    cmp r0, #0x80
-    bne noSvcBreak
-    ldr r4, [lr, #-4]
-    ldr r5, =#0xe12fff7f
-    cmp r4, r5
-    bne noSvcBreak
-    bic r5, r3, #0xf
-    orr r5, #0x3
-    msr cpsr_c, r5             @ switch to supervisor mode
-    ldmfd sp, {r8-r11}^
-    ldr r2, [sp, #0x1c]        @ implementation details of the official svc handler
-    ldr r4, [sp, #0x18]
-    msr cpsr_c, r3             @ restore processor mode
-    tst r2, #0x20
-    addne lr, r4, #2           @ adjust address for later
-    moveq lr, r4
-
-    noSvcBreak:
     ands r4, r2, #0xf          @ get the mode that triggered the exception
     moveq r4, #0xf             @ usr => sys
     bic r5, r3, #0xf
     orr r5, r4
     msr cpsr_c, r5             @ change processor mode
-    stmfd r6!, {r8-lr}
+    stmia r6!, {r8-lr}
     msr cpsr_c, r3             @ restore processor mode
-    mov sp, r6
 
-    stmfd sp!, {r2,lr}         @ it's a bit of a mess, but we will fix that later
+    str lr, [r6], #4
-                               @ order of saved regs now: cpsr, pc + (2/4/8), r8-r14, r0-r7
+    str r2, [r6]
-
-    mov r0, sp
 
+    msr cpsr_cxsf, #0xdf       @ finally, switch to system mode, mask interrupts and clear flags (in case of double faults)
+    ldr sp, =0x02000000
     b mainHandler
 
-GEN_HANDLER FIQHandler
-GEN_HANDLER undefinedInstructionHandler
-GEN_HANDLER prefetchAbortHandler
-GEN_HANDLER dataAbortHandler
 
-.global readMPUConfig
+.global FIQHandler
-.type   readMPUConfig, %function
+.type   FIQHandler, %function
-readMPUConfig:
+GEN_USUAL_HANDLER FIQ, 0
-    stmfd sp!, {r4-r8, lr}
+
-    mrc p15,0,r1,c6,c0,0
+.global undefinedInstructionHandler
-    mrc p15,0,r2,c6,c1,0
+.type   undefinedInstructionHandler, %function
-    mrc p15,0,r3,c6,c2,0
+GEN_USUAL_HANDLER undefinedInstruction, 1
-    mrc p15,0,r4,c6,c3,0
+
-    mrc p15,0,r5,c6,c4,0
+.global prefetchAbortHandler
-    mrc p15,0,r6,c6,c5,0
+.type   prefetchAbortHandler, %function
-    mrc p15,0,r7,c6,c6,0
+prefetchAbortHandler:
-    mrc p15,0,r8,c6,c7,0
+    msr cpsr_cx, #0xd7                  @ mask interrupts (abort mode)
-    stmia r0, {r1-r8}
+    mrs sp, spsr
-    mrc p15,0,r0,c5,c0,2       @ read data access permission bits
+    and sp, #0x3f
-    ldmfd sp!, {r4-r8, pc}
+    cmp sp, #0x13
+    bne _prefetchAbortNormalHandler
+
+    ldr sp, =BreakPtr
+    ldr sp, [sp]
+    cmp sp, #0
+    beq _prefetchAbortNormalHandler
+    add sp, #(1*4 + 4)
+    cmp lr, sp
+    bne _prefetchAbortNormalHandler
+
+    mov sp, r8
+    pop {r8-r11}
+    ldr lr, [sp, #8]!
+    ldr sp, [sp, #4]
+    msr spsr_cxsf, sp
+    tst sp, #0x20
+    addne lr, #2                        @ adjust address for later
+
+    GEN_USUAL_HANDLER _prefetchAbortNormal, 2
+
+.global dataAbortHandler
+.type   dataAbortHandler, %function
+dataAbortHandler:
+    msr cpsr_cx, #0xd7                  @ mask interrupts (abort mode)
+    mrs sp, spsr
+    and sp, #0x3f
+    cmp sp, #0x1f
+    bne _dataAbortNormalHandler
+
+    sub lr, #8
+    adr sp, safecpy
+    cmp lr, sp
+    blo _j_dataAbortNormalHandler
+    adr sp, _safecpy_end
+    cmp lr, sp
+    bhs _j_dataAbortNormalHandler
+
+    msr spsr_f, #(1 << 30)
+    mov r12, #0
+    adds pc, lr, #4
+
+    _j_dataAbortNormalHandler:
+    add lr, #8
+
+    GEN_USUAL_HANDLER _dataAbortNormal, 3
+
+
+.global safecpy
+.type   safecpy, %function
+safecpy:
+    push {r4, lr}
+    mov r3, #0
+    movs r12, #1
+
+    _safecpy_loop:
+        ldrb r4, [r1, r3]
+        cmp r12, #0
+        beq _safecpy_loop_end
+        strb r4, [r0, r3]
+        add r3, #1
+        cmp r3, r2
+        blo _safecpy_loop
+
+    _safecpy_loop_end:
+    mov r0, r3
+    pop {r4, pc}
+
+_safecpy_end:
+
+.bss
+.balign 4
+_regs: .skip (4 * 17)

exceptions/arm9/source/mainHandler.c

@@ -32,48 +32,10 @@
 #define REG_DUMP_SIZE   4 * 17
 #define CODE_DUMP_SIZE  48
 
-bool cannotAccessAddress(const void *address)
+void __attribute__((noreturn)) mainHandler(u32 *registerDump, u32 type)
-{
-    u32 regionSettings[8];
-    u32 addr = (u32)address;
-
-    u32 dataAccessPermissions = readMPUConfig(regionSettings);
-    for(u32 i = 0; i < 8; i++)
-    {
-        if((dataAccessPermissions & 0xF) == 0 || (regionSettings[i] & 1) == 0)
-            continue; //No access / region not enabled
-
-        u32 regionAddrBase = regionSettings[i] & ~0xFFF;
-        u32 regionSize = 1 << (((regionSettings[i] >> 1) & 0x1F) + 1);
-
-        if(addr >= regionAddrBase && addr < regionAddrBase + regionSize)
-            return false;
-
-        dataAccessPermissions >>= 4;
-    }
-
-    return true;
-}
-
-static u32 __attribute__((noinline)) copyMemory(void *dst, const void *src, u32 size, u32 alignment)
-{
-    u8 *out = (u8 *)dst;
-    const u8 *in = (const u8 *)src;
-
-    if(((u32)src & (alignment - 1)) != 0 || cannotAccessAddress(src) || (size != 0 && cannotAccessAddress((u8 *)src + size - 1)))
-        return 0;
-
-    for(u32 i = 0; i < size; i++)
-        *out++ = *in++;
-
-    return size;
-}
-
-void __attribute__((noreturn)) mainHandler(u32 *regs, u32 type)
 {
     ExceptionDumpHeader dumpHeader;
 
-    u32 registerDump[REG_DUMP_SIZE / 4];
     u8 codeDump[CODE_DUMP_SIZE];
 
     dumpHeader.magic[0] = 0xDEADC0DE;
@@ -89,27 +51,22 @@ void __attribute__((noreturn)) mainHandler(u32 *regs, u32 type)
     dumpHeader.codeDumpSize = CODE_DUMP_SIZE;
     dumpHeader.additionalDataSize = 0;
 
-    //Dump registers
+    u32 cpsr = registerDump[16];
-    //Current order of saved regs: cpsr, pc, r8-r14, r0-r7
+    u32 pc   = registerDump[15] - (type < 3 ? (((cpsr & 0x20) != 0 && type == 1) ? 2 : 4) : 8);
-    u32 cpsr = regs[0];
-    u32 pc   = regs[1] - (type < 3 ? (((cpsr & 0x20) != 0 && type == 1) ? 2 : 4) : 8);
 
     registerDump[15] = pc;
-    registerDump[16] = cpsr;
-    for(u32 i = 0; i < 7; i++) registerDump[8 + i]  = regs[2 + i];
-    for(u32 i = 0; i < 8; i++) registerDump[i] = regs[9 + i]; 
 
     //Dump code
-    u8 *instr = (u8 *)pc + ((cpsr & 0x20) ? 2 : 4) - dumpHeader.codeDumpSize; //Doesn't work well on 32-bit Thumb instructions, but it isn't much of a problem
+    u8 *instr = (u8 *)pc + ((cpsr & 0x20) ? 2 : 4) - dumpHeader.codeDumpSize; //wouldn't work well on 32-bit Thumb instructions, but it isn't much of a problem
-    dumpHeader.codeDumpSize = copyMemory(codeDump, instr, dumpHeader.codeDumpSize, ((cpsr & 0x20) != 0) ? 2 : 4);
+    dumpHeader.codeDumpSize = ((u32)instr & (((cpsr & 0x20) != 0) ? 1 : 3)) != 0 ? 0 : safecpy(codeDump, instr, dumpHeader.codeDumpSize);
 
-    //Copy register dump and code dump 
+    //Copy register dump and code dump
     u8 *final = (u8 *)(FINAL_BUFFER + sizeof(ExceptionDumpHeader));
-    final += copyMemory(final, registerDump, dumpHeader.registerDumpSize, 1);
+    final += safecpy(final, registerDump, dumpHeader.registerDumpSize);
-    final += copyMemory(final, codeDump, dumpHeader.codeDumpSize, 1);
+    final += safecpy(final, codeDump, dumpHeader.codeDumpSize);
 
     //Dump stack in place
-    dumpHeader.stackDumpSize = copyMemory(final, (const void *)registerDump[13], 0x1000 - (registerDump[13] & 0xFFF), 1);
+    dumpHeader.stackDumpSize = safecpy(final, (const void *)registerDump[13], 0x1000 - (registerDump[13] & 0xFFF));
 
     dumpHeader.totalSize = sizeof(ExceptionDumpHeader) + dumpHeader.registerDumpSize + dumpHeader.codeDumpSize + dumpHeader.stackDumpSize + dumpHeader.additionalDataSize;
 

exceptions/arm9/source/start.s

@@ -26,8 +26,12 @@
 .align 4
 .global _start
 _start:
-    add pc, r0, #(handlers - .) @ Dummy instruction to prevent compiler optimizations
+    add pc, r0, #(handlers - .) @ Dummy instruction
 
+.global BreakPtr
+BreakPtr: .word 0
+
+.global handlers
 handlers:
     .word FIQHandler
     .word undefinedInstructionHandler

k11_extension/source/fatalExceptionHandlers.s

@@ -159,7 +159,7 @@ _commonHandler:
 
     _no_L2C:
 
-    cps #0x1F
+    msr cpsr_cxsf, #0xdf         @ finally, switch to system mode, mask interrupts and clear flags (in case of double faults)
     ldr sp, =exceptionStackTop
     ldr sp, [sp]
     sub sp, #0x100
@@ -221,7 +221,8 @@ prefetchAbortHandler:
     pop {r8-r11}
     ldr lr, [sp, #8]!
     ldr sp, [sp, #4]
-    msr spsr, sp
+    msr spsr_cxsf, sp
+    tst sp, #0x20
     addne lr, #2                        @ adjust address for later
 
     GEN_USUAL_HANDLER _prefetchAbortNormal, 2, 12

k11_extension/source/fatalExceptionHandlersMain.c

@@ -37,7 +37,7 @@ bool isExceptionFatal(u32 spsr, u32 *regs, u32 index)
 {
     if(CONFIG(DISABLEARM11EXCHANDLERS)) return false;
 
-    if((spsr & 0x1f) != 0x10) return true;
+    if((spsr & 0x1F) != 0x10) return true;
 
     KThread *thread = currentCoreContext->objectContext.currentThread;
     KProcess *currentProcess = currentCoreContext->objectContext.currentProcess;
@@ -65,7 +65,7 @@ bool isExceptionFatal(u32 spsr, u32 *regs, u32 index)
 extern u32 safecpy_sz;
 bool isDataAbortExceptionRangeControlled(u32 spsr, u32 addr)
 {
-    return ((spsr & 0x1F) != 0x10) && (
+    return (!(spsr & 0x20) && (spsr & 0x1F) != 0x10) && (
                 ((u32)kernelUsrCopyFuncsStart <= addr && addr < (u32)kernelUsrCopyFuncsEnd) ||
                 ((u32)safecpy <= addr && addr < (u32)safecpy + safecpy_sz)
             );
@@ -96,7 +96,7 @@ void fatalExceptionHandlersMain(u32 *registerDump, u32 type, u32 cpuId)
     registerDump[15] = pc;
 
     //Dump code
-    u8 *instr = (u8 *)pc + ((cpsr & 0x20) ? 2 : 4) - dumpHeader.codeDumpSize; //Doesn't work well on 32-bit Thumb instructions, but it isn't much of a problem
+    u8 *instr = (u8 *)pc + ((cpsr & 0x20) ? 2 : 4) - dumpHeader.codeDumpSize; //wouldn't work well on 32-bit Thumb instructions, but it isn't much of a problem
     dumpHeader.codeDumpSize = ((u32)instr & (((cpsr & 0x20) != 0) ? 1 : 3)) != 0 ? 0 : safecpy(codeDump, instr, dumpHeader.codeDumpSize);
 
     //Copy register dump and code dump

patches/reboot.s

@@ -116,9 +116,7 @@ fname: .ascii "FILE"
 .align 4
     kernelcode_start:
 
-    mrs r0, cpsr  ; disable interrupts
+    msr cpsr_cxsf, #0xD3  ; disable interrupts and clear flags
-    orr r0, #0xC0
-    msr cpsr, r0
 
     ldr sp, =copy_launch_stub_stack_top
 

source/exceptions.c

@@ -37,7 +37,7 @@
 
 void installArm9Handlers(void)
 {
-    memcpy((void *)0x01FF8000, arm9_exceptions_bin + 32, arm9_exceptions_bin_size - 32);
+    memcpy((void *)0x01FF8000, arm9_exceptions_bin, arm9_exceptions_bin_size);
 
     /* IRQHandler is at 0x08000000, but we won't handle it for some reasons
        svcHandler is at 0x08000010, but we won't handle svc either */
@@ -47,8 +47,10 @@ void installArm9Handlers(void)
     for(u32 i = 0; i < 4; i++)
     {
         *(vu32 *)(0x08000000 + offsets[i]) = 0xE51FF004;
-        *(vu32 *)(0x08000000 + offsets[i] + 4) = *((u32 *)arm9_exceptions_bin + 1 + i);
+        *(vu32 *)(0x08000000 + offsets[i] + 4) = *(vu32 *)(0x01FF8008 + 4 * i);
     }
+
+    *(vu32 *)0x01FF8004 = 0; //BreakPtr
 }
 
 void detectAndProcessExceptionDumps(void)

source/patches.c

@@ -454,7 +454,9 @@ u32 patchArm9ExceptionHandlersInstall(u8 *pos, u32 size)
 
     if(temp == NULL) return 1;
 
-    u32 *off = (u32 *)(temp - 0xA);
+    u32 *off;
+
+    for(off = (u32 *)(temp - 2); *off != 0xE5801000; off--); //Until str r1, [r0]
 
     for(u32 r0 = 0x08000000; *off != 0xE3A01040; off++) //Until mov r1, #0x40
     {
@@ -491,7 +493,15 @@ u32 patchSvcBreak9(u8 *pos, u32 size, u32 kernel9Address)
     while(*arm9SvcTable != 0) arm9SvcTable++; //Look for SVC0 (NULL)
 
     u32 *addr = (u32 *)(pos + arm9SvcTable[0x3C] - kernel9Address);
-    *addr = 0xE12FFF7F;
+
+    /*
+        mov r8, sp
+        bkpt 0xffff
+    */
+    addr[0] = 0xE1A0800D;
+    addr[1] = 0xE12FFF7F;
+
+    *(vu32 *)0x01FF8004 = arm9SvcTable[0x3C]; //BreakPtr
 
     return 0;
 }

source/start.s

@@ -27,9 +27,7 @@
 .global _start
 _start:
     @ Disable interrupts and switch to supervisor mode (also clear flags)
-    mov r4, #0x13
+    msr cpsr_cxsf, #0xD3
-    orr r4, #0x1C0
-    msr cpsr_cxsf, r4
 
     @ Check if r0-r2 are 0 (r0-sp are supposed to be 0), and for regions 0, 5 and 7 of the MPU config
     @ This is not foolproof but should work well enough