ARM9260EJ-S MMU初始化问题

2007-08-25 11:01:14 455 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

Arm9裸机逆向实战：AT91SAM9260 Bootloader分析与主镜像提取 Bootloader是嵌入式系统启动的基石，它负责硬件初始化、存储加载与控制权移交。理解其工作原理需深入ARM架构、NAND Flash控制器、时钟树配置及中断向量表机制。本文以AT91SAM9260（Arm926EJ-S内核）为对象，解析裸机环境下无操作系统依赖的启动流程，涵盖串口协议识别、SWD调试接入、ECC校验剥离、向量表重映射等关键技术点。内容聚焦真实硬件逆向过程，适用于嵌入式安全研究、固件分析及底层开发工程师，尤其对Arm9 bootloader逆向、NAND Flash镜像提取等高频搜索场景提阅读详情

我在初始化ARM9260EJ-S CPU（AT91SAM9260EJ-S）时遇到了一个问题，SDRAM 8M，按Section初始化，影射成8个块，每块1M，SDRAM的物理地址为0x20000000,未启动MMU时,SDRAM上的所有读写都正常,启动MMU之后,0x20500000开始的1M SDRAM读写就发现异常,MMU初始化的代码如下：

//*----------------------------------------------------------------------------
//* \fn AT91F_InitMMU
//* \brief Initialize MMU
//*----------------------------------------------------------------------------
void AT91_ARM_MMUInit(void)
{
int i;
unsigned int *pTranslationTable=(unsigned int *)_MMUTT_STARTADDRESS;

AT91_ARM_DisableDCache();
AT91_ARM_DisableICache();

AT91_ARM_CleanDCache();//
AT91_ARM_InvalidateICache();
AT91_ARM_DisableMMU();
AT91_ARM_InvalidateIDTLB();

// Program the TTB
AT91_ARM_WriteTTB(_MMUTT_STARTADDRESS);

// Program the domain access register
AT91_ARM_WriteDomain(0x55555555);
//能否访问将根据节或页描述符中的访问权限位确定

// Reset table entries
for (i = 0; i < 4096; ++i)
pTranslationTable[i] = 0;

// Program level 1 page table entry
pTranslationTable[0x0] =
(0x200 << 20) | // Physical Address(SDRAM-1ST)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain 15
1 << 4 | //
3 << 2 | // C=B=1
0x2; // Set as 1 Mbyte section

//
pTranslationTable[0x1] =
(0x001 << 20) | // Physical Address(INTROM)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain 15
(1 << 4 ) | //
(0 << 2 ) | // C=B=0
0x2; // Set as 1 Mbyte section
pTranslationTable[0x2] =
(0x002 << 20) | // Physical Address(INTSRAM0)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain 15
(1 << 4 ) | //
(3 << 2 ) | // C=B=1
0x2; // Set as 1 Mbyte section
pTranslationTable[0x3] =
(0x003 << 20) | // Physical Address(INTSRAM1)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain 15
(1 << 4) | //
(3 << 2) | // C=B=1
0x2; // Set as 1 Mbyte section
pTranslationTable[0x5] =
(0x005 << 20) | // Physical Address(UHP)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain 15
(1 << 4) | //
(0 << 2) | // C=B=0
0x2; // Set as 1 Mbyte section

//map extern rom (flash 4M)
pTranslationTable[0x100] =
(0x100 << 20) | // Physical Address(flash -1)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(0 << 2 ) | // C=B=0
0x2; // Set as 1 Mbyte section
pTranslationTable[0x101] =
(0x101 << 20) | // Physical Address
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(0 << 2 ) | // C=B=0
0x2; // Set as 1 Mbyte section
pTranslationTable[0x102] =
(0x102 << 20) | // Physical Address
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(0 << 2 ) | // C=B=0
0x2; // Set as 1 Mbyte section
pTranslationTable[0x103] =
(0x103 << 20) | // Physical Address
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(0 << 2 ) | // C=B=0
0x2; // Set as 1 Mbyte section

//map sdram (8M)
pTranslationTable[0x200] =
(0x200 << 20) | // Physical Address
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(3 << 2 ) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x201] =
(0x201 << 20) | // Physical Address
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(3 << 2 ) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x202] =
(0x202 << 20) | // Physical Address
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(3 << 2 ) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x203] =
(0x203 << 20) | // Physical Address
(3 << 10) | // Access in user mode
(15 << 5) | // Domain
(1 << 4 ) | //
(3 << 2 ) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x204] =
(0x204 << 20) | // Physical Address
(3 << 10) | // Access in user mode
(15 << 5) | // Domain
(1 << 4 ) | //
(3 << 2 ) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x205] =
(0x205 << 20) | // Physical Address
( 3 << 10) | // Access in user mode
( 15 << 5) | // Domain
( 1 << 4) | //
( 3 << 2) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x206] =
(0x206 << 20) | // Physical Address
( 3 << 10) | // Access in user mode
( 15 << 5) | // Domain
( 1 << 4) | //
( 3 << 2) | // C=B=1
0x2; // Set as 1M byte section
pTranslationTable[0x207] =
(0x207 << 20) | // Physical Address
( 1 << 10) | // Access in supervisor mode
( 15 << 5) | // Domain
( 1 << 4) | //
( 3 << 2) | // C=B=1
0x2; // Set as 1M byte section

//map regiseter
pTranslationTable[0xFFF] =
(0xFFF << 20) | // Physical Address (REGISTER)
(1 << 10) | // Access in supervisor mode
(15 << 5) | // Domain
(1 << 4 ) | //
(0 << 2 ) | // C=B=0
0x2; // Set as 1M byte section

AT91_ARM_WriteFCSEPID(0);
AT91_ARM_EnableAlignFault();

// Enable the MMU
AT91_ARM_EnableMMU();
AT91_ARM_EnableICache();
AT91_ARM_EnableDCache();
}

...全文