mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
dwt/loader: COFF loader places GSPLNK images and runs them via create_process
This commit is contained in:
SDD committed
1 parent
dcca6bee4d
commit
139d89a10c
42 files changed
+3822
No files matched your search
@@ -0,0 +1,338 @@
|
||||
-- loader.lua -- debugger-assisted COFF loader acceptance harness.
|
||||
--
|
||||
-- Boots the firmware with VT1200_SKIP_LEVEL1=1 (the documented divergence) to
|
||||
-- the OS, then at frame LOADER_AT pokes:
|
||||
-- * the loader payload at bit 0x01880000 (raw dwt/loader/build/loader.bin)
|
||||
-- * a GSPLNK COFF image at LOADER_BUF (default bit 0x01900000)
|
||||
-- * the loader descriptor at 0x01882C00
|
||||
-- and sets PC = 0x01880000. It does not use the network, the rdebug service
|
||||
-- or any firmware transport: this is the debugger-assisted milestone.
|
||||
--
|
||||
-- The loader itself copies the COFF sections to their linked bit addresses and
|
||||
-- calls create_process(entry, "LOADER", 0x6000, 1, 0). This script only pokes
|
||||
-- the input and reads the result; it never writes the app's code or markers.
|
||||
--
|
||||
-- Env:
|
||||
-- LOADER_BIN loader payload (default dwt/loader/build/loader.bin)
|
||||
-- LOADER_COFF app COFF (default dwt/loader/build/marker.coff)
|
||||
-- LOADER_BUF COFF buffer bit address (default 0x01900000)
|
||||
-- LOADER_AT injection frame (default 2500)
|
||||
-- LOADER_END inspection/exit frame (default 2700)
|
||||
-- LOADER_OUT evidence directory (default dwt/loader/evidence)
|
||||
-- LOADER_SNAP 1 = write a PNG at LOADER_END (default 0)
|
||||
-- LOADER_VERBOSE 1 = print the result block every 25 frames
|
||||
|
||||
local function hex(v, w) return string.format("%0" .. (w or 8) .. "X", v) end
|
||||
|
||||
local machine = manager.machine
|
||||
local cpu = machine.devices[':maincpu']
|
||||
local dbg = machine.debugger
|
||||
local prog = cpu.spaces['program']
|
||||
|
||||
if not dbg then
|
||||
print("LOADER: debugger not enabled; pass -debug")
|
||||
machine:exit()
|
||||
return
|
||||
end
|
||||
|
||||
local AT = tonumber(os.getenv("LOADER_AT") or "2500")
|
||||
local ENDF = tonumber(os.getenv("LOADER_END") or "2700")
|
||||
local BIN = os.getenv("LOADER_BIN") or "dwt/loader/build/loader.bin"
|
||||
local COFF = os.getenv("LOADER_COFF") or "dwt/loader/build/marker.coff"
|
||||
local BUF = tonumber(os.getenv("LOADER_BUF") or "0x01900000")
|
||||
local OUT = os.getenv("LOADER_OUT") or "dwt/loader/evidence"
|
||||
local SNAP = os.getenv("LOADER_SNAP") == "1"
|
||||
local MODE = tonumber(os.getenv("LOADER_MODE") or "0")
|
||||
local A8DESC = os.getenv("LOADER_A8_DESC") == "1"
|
||||
local VERBOSE = os.getenv("LOADER_VERBOSE") == "1"
|
||||
|
||||
local LOADER_BASE = 0x01880000
|
||||
local DESC = 0x01882C00
|
||||
local RESULT = 0x01882D00
|
||||
local RETURN_STUB = 0x01883100
|
||||
local RETURN_SP = 0x01883110
|
||||
|
||||
local function rd(p) return io.open(p, "rb") end
|
||||
local function slurp(p)
|
||||
local f, err = rd(p)
|
||||
if not f then error("cannot open " .. p .. ": " .. tostring(err)) end
|
||||
local s = f:read("*a")
|
||||
f:close()
|
||||
return s
|
||||
end
|
||||
|
||||
local function u16(s, o)
|
||||
return s:byte(o + 1) + s:byte(o + 2) * 256
|
||||
end
|
||||
|
||||
local function u32(s, o)
|
||||
return s:byte(o + 1) + s:byte(o + 2) * 256
|
||||
+ s:byte(o + 3) * 65536 + s:byte(o + 4) * 16777216
|
||||
end
|
||||
|
||||
local function parse_coff(d)
|
||||
local c = { data = d }
|
||||
c.magic = u16(d, 0)
|
||||
c.nscns = u16(d, 2)
|
||||
c.opthdr = u16(d, 16)
|
||||
c.sections = {}
|
||||
if c.opthdr > 0 then
|
||||
c.optmagic = u16(d, 20)
|
||||
c.entry = u32(d, 20 + 16)
|
||||
c.textstart = u32(d, 20 + 20)
|
||||
c.datastart = u32(d, 20 + 24)
|
||||
end
|
||||
local base = 20 + c.opthdr
|
||||
for i = 0, c.nscns - 1 do
|
||||
local o = base + i * 40
|
||||
local name = d:sub(o + 1, o + 8):gsub("%z", "")
|
||||
c.sections[#c.sections + 1] = {
|
||||
name = name,
|
||||
paddr = u32(d, o + 8),
|
||||
size = u32(d, o + 16), -- bits
|
||||
scnptr = u32(d, o + 20),
|
||||
flags = u32(d, o + 36),
|
||||
}
|
||||
end
|
||||
return c
|
||||
end
|
||||
|
||||
local function poke_bytes(bitaddr, data)
|
||||
local n = math.floor((#data + 1) / 2)
|
||||
for i = 0, n - 1 do
|
||||
local lo = data:byte(i * 2 + 1) or 0
|
||||
local hi = data:byte(i * 2 + 2) or 0
|
||||
prog:write_u16(bitaddr + i * 16, lo + hi * 256)
|
||||
end
|
||||
return n
|
||||
end
|
||||
|
||||
local function verify_bytes(bitaddr, data)
|
||||
local n = math.floor((#data + 1) / 2)
|
||||
local bad = 0
|
||||
for i = 0, n - 1 do
|
||||
local lo = data:byte(i * 2 + 1) or 0
|
||||
local hi = data:byte(i * 2 + 2) or 0
|
||||
if prog:read_u16(bitaddr + i * 16) ~= lo + hi * 256 then
|
||||
bad = bad + 1
|
||||
end
|
||||
end
|
||||
return n, bad
|
||||
end
|
||||
|
||||
local function w32(a, v) prog:write_u32(a, v) end
|
||||
local function r32(a)
|
||||
local ok, v = pcall(function() return prog:read_u32(a) end)
|
||||
if ok then return v end
|
||||
return 0xDEADBEEF
|
||||
end
|
||||
|
||||
local loader = slurp(BIN)
|
||||
local coff = slurp(COFF)
|
||||
local app = parse_coff(coff)
|
||||
|
||||
print(string.format("LOADER: payload %s (%d B) -> bit %s", BIN, #loader, hex(LOADER_BASE)))
|
||||
print(string.format("LOADER: COFF %s (%d B) -> bit %s", COFF, #coff, hex(BUF)))
|
||||
print(string.format("LOADER: file magic=%04X nscns=%d opthdr=%d optmagic=%s entry=%s textstart=%s",
|
||||
app.magic, app.nscns, app.opthdr,
|
||||
app.optmagic and string.format("%04X", app.optmagic) or "none",
|
||||
hex(app.entry or 0), hex(app.textstart or 0)))
|
||||
for _, s in ipairs(app.sections) do
|
||||
print(string.format("LOADER: sec %-8s paddr=%s size=%d bits (%d B) scnptr=%#x flags=%#x",
|
||||
s.name, hex(s.paddr), s.size, math.floor(s.size / 8), s.scnptr, s.flags))
|
||||
end
|
||||
|
||||
local TRACE = os.getenv("LOADER_TRACE") == "1"
|
||||
|
||||
local frames = 0
|
||||
local injected = false
|
||||
local done = false
|
||||
local last_count = -1
|
||||
|
||||
local function status_name(v)
|
||||
local t = {
|
||||
[0] = "OK",
|
||||
[1] = "bad descriptor",
|
||||
[2] = "truncated COFF / section headers",
|
||||
[3] = "bad COFF magic",
|
||||
[4] = "section size not whole words",
|
||||
[5] = "target outside RAM",
|
||||
[6] = "target overlaps loader page or COFF buffer",
|
||||
[7] = "relocation records present (unsupported)",
|
||||
[8] = "target not in a free-list block",
|
||||
[9] = "no entry point",
|
||||
}
|
||||
return t[v] or ("error " .. tostring(v))
|
||||
end
|
||||
|
||||
local function result_dump()
|
||||
local st = r32(RESULT + 0x000)
|
||||
print(string.format(
|
||||
"LOADER: result status=%d (%s) entry=%s text=%s/%d bits data=%s/%d bits bss=%s/%d bits relocs=%d pcb=%s nscns=%d len=%d",
|
||||
st, status_name(st), hex(r32(RESULT + 0x020)),
|
||||
hex(r32(RESULT + 0x040)), r32(RESULT + 0x060),
|
||||
hex(r32(RESULT + 0x080)), r32(RESULT + 0x0A0),
|
||||
hex(r32(RESULT + 0x0C0)), r32(RESULT + 0x0E0),
|
||||
r32(RESULT + 0x100), hex(r32(RESULT + 0x120)),
|
||||
r32(RESULT + 0x140), r32(RESULT + 0x160)))
|
||||
end
|
||||
|
||||
local function inject()
|
||||
-- 1. loader itself
|
||||
local n, bad = 0, 0
|
||||
poke_bytes(LOADER_BASE, loader)
|
||||
n, bad = verify_bytes(LOADER_BASE, loader)
|
||||
print(string.format("LOADER: loader poked %d words, readback %d bad at %s",
|
||||
n, bad, hex(LOADER_BASE)))
|
||||
|
||||
-- 2. COFF image
|
||||
poke_bytes(BUF, coff)
|
||||
n, bad = verify_bytes(BUF, coff)
|
||||
print(string.format("LOADER: COFF poked %d words, readback %d bad at %s",
|
||||
n, bad, hex(BUF)))
|
||||
|
||||
-- 3. pre-fill every .bss section with A5A5, so a loaded zero is meaningful
|
||||
for _, s in ipairs(app.sections) do
|
||||
if s.flags & 0x80 ~= 0 then
|
||||
for i = 0, math.floor(s.size / 16) - 1 do
|
||||
prog:write_u16(s.paddr + i * 16, 0xA5A5)
|
||||
end
|
||||
print(string.format("LOADER: pre-filled .bss %s..%s with A5A5",
|
||||
hex(s.paddr), hex(s.paddr + s.size)))
|
||||
end
|
||||
end
|
||||
|
||||
-- 4. descriptor: magic "LD" "R1", buf, len, mode=0 (spin)
|
||||
w32(DESC + 0x00, 0)
|
||||
prog:write_u16(DESC + 0x00, 0x4C44)
|
||||
prog:write_u16(DESC + 0x10, 0x5231)
|
||||
w32(DESC + 0x20, BUF)
|
||||
w32(DESC + 0x40, #coff)
|
||||
w32(DESC + 0x60, MODE)
|
||||
print(string.format("LOADER: descriptor @%s magic=%04X/%04X buf=%s len=%d mode=%d",
|
||||
hex(DESC), prog:read_u16(DESC + 0x00), prog:read_u16(DESC + 0x10),
|
||||
hex(r32(DESC + 0x20)), r32(DESC + 0x40), r32(DESC + 0x60)))
|
||||
|
||||
-- 5. return stub. mode 0 ignores it (the loader jumps to ORIG_PC
|
||||
-- itself); mode 1 returns here, and the stub resumes the interrupted
|
||||
-- PC so the caller yields and the scheduler can run the child.
|
||||
local orig_pc = cpu.state['PC'].value
|
||||
if MODE == 1 then
|
||||
prog:write_u16(RETURN_STUB, 0xC080) -- jauc <orig_pc>
|
||||
prog:write_u16(RETURN_STUB + 0x10, orig_pc & 0xFFFF)
|
||||
prog:write_u16(RETURN_STUB + 0x20, math.floor(orig_pc / 0x10000) & 0xFFFF)
|
||||
else
|
||||
prog:write_u16(RETURN_STUB, 0xC0FF) -- jruc self
|
||||
end
|
||||
|
||||
-- 6. enter the loader. A8=0 selects the fixed descriptor; SP points at
|
||||
-- the return slot so mode=1 would return to the spin stub.
|
||||
-- Leave SP alone for mode 0: the loader pushes onto the current
|
||||
-- process stack, then restores it and resumes at ORIG_PC. (mode 1
|
||||
-- would use the return stub.)
|
||||
w32(0x01882A20, orig_pc) -- LD_ORIG_PC
|
||||
print(string.format("LOADER: will resume at %s after create_process", hex(orig_pc)))
|
||||
cpu.state['A8'].value = A8DESC and DESC or 0
|
||||
if MODE == 1 then
|
||||
-- Simulate a CALLA from the current process: push the return
|
||||
-- address on the *firmware* stack (a real transport would do this).
|
||||
local sp = cpu.state['SP'].value - 0x20
|
||||
w32(sp, RETURN_STUB)
|
||||
cpu.state['SP'].value = sp
|
||||
end
|
||||
cpu.state['PC'].value = LOADER_BASE
|
||||
injected = true
|
||||
print(string.format("LOADER: frame %d: entered loader at %s (caller SP=%s)",
|
||||
frames, hex(LOADER_BASE), hex(cpu.state['SP'].value)))
|
||||
end
|
||||
|
||||
local function inspect()
|
||||
result_dump()
|
||||
|
||||
-- Verify the placement from RAM: .text/.data must equal the file bytes.
|
||||
for _, s in ipairs(app.sections) do
|
||||
if s.scnptr ~= 0 and s.size > 0 then
|
||||
local nb = math.floor(s.size / 8)
|
||||
local bytes = coff:sub(s.scnptr + 1, s.scnptr + nb)
|
||||
local _, bad = verify_bytes(s.paddr, bytes)
|
||||
print(string.format("LOADER: placed %s at %s: %d bytes, %d differing",
|
||||
s.name, hex(s.paddr), nb, bad))
|
||||
end
|
||||
end
|
||||
|
||||
local base = COFF:match("([^/]+)$") or COFF
|
||||
if base:find("marker") then
|
||||
print(string.format("LOADER: marker app: start=%s data=%s data2=%s bss=%s count=%d",
|
||||
hex(r32(0x018E0000)), hex(r32(0x018E0020)), hex(r32(0x018E0040)),
|
||||
hex(r32(0x018E0060)), r32(0x018E0080)))
|
||||
elseif base:find("xhello") then
|
||||
print(string.format("LOADER: xhello: stage=%d strlen=%d display=%s root=%s window=%s sync=%s",
|
||||
r32(0x01890140), r32(0x01890160), hex(r32(0x01890100)),
|
||||
hex(r32(0x01890110)), hex(r32(0x01890120)), hex(r32(0x01890130))))
|
||||
end
|
||||
print(string.format("LOADER: PC at inspection = %s", hex(cpu.state['PC'].value)))
|
||||
end
|
||||
|
||||
emu.register_frame_done(function()
|
||||
frames = frames + 1
|
||||
if frames == AT and not injected then
|
||||
inject()
|
||||
if TRACE then dbg:command("trace /tmp/opencode/ld1.tr") end
|
||||
end
|
||||
if injected and TRACE and frames == AT + 1 then
|
||||
dbg:command("trace off")
|
||||
print("LOADER: trace written to /tmp/opencode/ld.tr")
|
||||
end
|
||||
if injected and not done then
|
||||
if TRACE and frames <= AT + 40 then
|
||||
print(string.format("LOADER: trace f=%d PC=%s SP=%s A14=%s status=%s entry=%s",
|
||||
frames, hex(cpu.state['PC'].value), hex(cpu.state['SP'].value),
|
||||
hex(cpu.state['A14'].value), hex(r32(RESULT + 0x000)),
|
||||
hex(r32(RESULT + 0x020))))
|
||||
end
|
||||
local st = r32(RESULT + 0x000)
|
||||
-- status 0 means OK; nonzero is final too once parsing has begun
|
||||
if st ~= 0xFFFFFFFF and not done then
|
||||
-- The loader writes 0 on success. A nonzero status is final
|
||||
-- only after it has been written once (it is 0 from power-on,
|
||||
-- so require the loader to have run: PC no longer at entry or
|
||||
-- the app counter moved).
|
||||
end
|
||||
if VERBOSE and frames % 25 == 0 then
|
||||
result_dump()
|
||||
end
|
||||
if base_contains_marker then
|
||||
local c = r32(0x018E0080)
|
||||
if c ~= last_count then
|
||||
if last_count ~= -1 then
|
||||
print(string.format("LOADER: marker counter %d -> %d (child running)",
|
||||
last_count, c))
|
||||
end
|
||||
last_count = c
|
||||
end
|
||||
end
|
||||
end
|
||||
if frames >= ENDF then
|
||||
if injected then
|
||||
done = true
|
||||
inspect()
|
||||
if SNAP then
|
||||
local screen = nil
|
||||
for _, s in pairs(machine.screens) do screen = s break end
|
||||
if screen then
|
||||
local out = OUT .. "/loader_frame" .. frames .. ".png"
|
||||
local ok, err = pcall(function() return screen:snapshot(out) end)
|
||||
print(string.format("LOADER: snapshot %s ok=%s %s",
|
||||
out, tostring(ok), tostring(err or "")))
|
||||
end
|
||||
end
|
||||
end
|
||||
machine:exit()
|
||||
end
|
||||
end, "vt1200-loader")
|
||||
|
||||
-- (Lua has no forward use of a name defined later; set a small flag here.)
|
||||
base_contains_marker = (COFF:match("([^/]+)$") or ""):find("marker") ~= nil
|
||||
|
||||
dbg.visible_cpu = cpu
|
||||
dbg.execution_state = 'run'
|
||||
Reference in new issue
Block a user