Correct installable address whitelist (#816)

* Correct installable address whitelist

blacklist is stored at 0xb088~0xb0bf, which is ulong[14] in
{start(inclusive), end(exclusive)} pair.
one thing to note is that boot9 use inclusive comparing with
blacklist start for both section load address and
section load address + section size (comparing logic is
at 0xa42e~0xa449), so if the firm fits perfectly at the end
of the space right before the blacklisted range,
it'll also be rejected.

* shrink vram drive size to avoid bleeding into blacklisted range
This commit is contained in:
Danny Tsai 2023-07-22 08:39:08 +08:00 committed by GitHub
parent 11b05d7a3d
commit 8b362c977a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 4 deletions

View File

@ -18,7 +18,7 @@ export COMMON_DIR := ../common
# Definitions for initial RAM disk # Definitions for initial RAM disk
VRAM_OUT := $(OUTDIR)/vram0.tar VRAM_OUT := $(OUTDIR)/vram0.tar
VRAM_DATA := data VRAM_DATA := data
VRAM_FLAGS := --make-new --path-limit 99 --size-limit 262144 VRAM_FLAGS := --make-new --path-limit 99 --size-limit 228864
ifeq ($(NTRBOOT),1) ifeq ($(NTRBOOT),1)
VRAM_SCRIPTS := resources/gm9/scripts VRAM_SCRIPTS := resources/gm9/scripts
endif endif
@ -90,7 +90,7 @@ vram0:
@$(MAKE) --no-print-directory -C $(@D) @$(MAKE) --no-print-directory -C $(@D)
firm: $(ELF) vram0 firm: $(ELF) vram0
@test `wc -c <$(VRAM_OUT)` -le 262144 @test `wc -c <$(VRAM_OUT)` -le 228864
@mkdir -p $(call dirname,"$(FIRM)") $(call dirname,"$(FIRMD)") @mkdir -p $(call dirname,"$(FIRM)") $(call dirname,"$(FIRMD)")
@echo "[FLAVOR] $(FLAVOR)" @echo "[FLAVOR] $(FLAVOR)"
@echo "[VERSION] $(VERSION)" @echo "[VERSION] $(VERSION)"

View File

@ -41,7 +41,7 @@ Build `GodMode9.firm` via `make firm`. This requires [firmtool](https://github.c
You may run `make release` to get a nice, release-ready package of all required files. To build __SafeMode9__ (a bricksafe variant of GodMode9, with limited write permissions) instead of GodMode9, compile with `make FLAVOR=SafeMode9`. To switch screens, compile with `make SWITCH_SCREENS=1`. For additional customization, you may choose the internal font by replacing `font_default.frf` inside the `data` directory. You may also hardcode the brightness via `make FIXED_BRIGHTNESS=x`, whereas `x` is a value between 0...15. You may run `make release` to get a nice, release-ready package of all required files. To build __SafeMode9__ (a bricksafe variant of GodMode9, with limited write permissions) instead of GodMode9, compile with `make FLAVOR=SafeMode9`. To switch screens, compile with `make SWITCH_SCREENS=1`. For additional customization, you may choose the internal font by replacing `font_default.frf` inside the `data` directory. You may also hardcode the brightness via `make FIXED_BRIGHTNESS=x`, whereas `x` is a value between 0...15.
Further customization is possible by hardcoding `aeskeydb.bin` (just put the file into the `data` folder when compiling). All files put into the `data` folder will turn up in the `V:` drive, but keep in mind there's a hard 256KiB limit for all files inside, including overhead. A standalone script runner is compiled by providing `autorun.gm9` (again, in the `data` folder) and building with `make SCRIPT_RUNNER=1`. There's more possibility for customization, read the Makefiles to learn more. Further customization is possible by hardcoding `aeskeydb.bin` (just put the file into the `data` folder when compiling). All files put into the `data` folder will turn up in the `V:` drive, but keep in mind there's a hard 223.5KiB limit for all files inside, including overhead. A standalone script runner is compiled by providing `autorun.gm9` (again, in the `data` folder) and building with `make SCRIPT_RUNNER=1`. There's more possibility for customization, read the Makefiles to learn more.
To build a .firm signed with SPI boot keys (for ntrboot and the like), run `make NTRBOOT=1`. You may need to rename the output files if the ntrboot installer you use uses hardcoded filenames. Some features such as boot9 / boot11 access are not currently available from the ntrboot environment. To build a .firm signed with SPI boot keys (for ntrboot and the like), run `make NTRBOOT=1`. You may need to rename the output files if the ntrboot installer you use uses hardcoded filenames. Some features such as boot9 / boot11 access are not currently available from the ntrboot environment.

View File

@ -12,18 +12,19 @@
// valid addresses for FIRM section loading // valid addresses for FIRM section loading
// pairs of start / end address, provided by Wolfvak // pairs of start / end address, provided by Wolfvak
#define FIRM_VALID_ADDRESS \ #define FIRM_VALID_ADDRESS \
0x08000040, 0x08100000, \
0x18000000, 0x18600000, \ 0x18000000, 0x18600000, \
0x1FF00000, 0x1FFFFC00 0x1FF00000, 0x1FFFFC00
// valid addresses (installable) for FIRM section loading // valid addresses (installable) for FIRM section loading
#define FIRM_VALID_ADDRESS_INSTALL \ #define FIRM_VALID_ADDRESS_INSTALL \
FIRM_VALID_ADDRESS, \ FIRM_VALID_ADDRESS, \
0x08000040, 0x080F7FFF, \
0x10000000, 0x10200000 0x10000000, 0x10200000
// valid addresses (bootable) for FIRM section loading // valid addresses (bootable) for FIRM section loading
#define FIRM_VALID_ADDRESS_BOOT \ #define FIRM_VALID_ADDRESS_BOOT \
FIRM_VALID_ADDRESS, \ FIRM_VALID_ADDRESS, \
0x08000040, 0x08100000, \
0x20000000, 0x27FFFA00 0x20000000, 0x27FFFA00
static const u32 whitelist_boot[] = { FIRM_VALID_ADDRESS_BOOT }; static const u32 whitelist_boot[] = { FIRM_VALID_ADDRESS_BOOT };