arti/vt1200
1
0 Fork 1
mirror of https://git.k-space.ee/arti/vt1200.git synced 2026-10-31 12:05:05 +02:00
Code Wiki Activity

Commit Graph

  • 1d8656ca10 udpstream: PIXBLT L,XY blit primitive (vram.asm) and a 256 KB .bss master arti 2026-10-30 17:44:27 +02:00
  • 636b3d6985 udpstream: the CPU store path costs ~14 us/store regardless of destination arti 2026-10-30 17:42:22 +02:00
  • 9b3f02cf02 udpstream: DRAM benchmark writes to a .bss buffer, not a guessed address arti 2026-10-30 17:39:27 +02:00
  • fb095eb778 udpstream: alternating-frame flash (30.7 fps sustained) + DRAM store benchmark + ROM cross-check arti 2026-10-30 17:34:47 +02:00
  • d99a9cdb6c udpstream: hardware FILL L makes full-screen writes 70x faster (30.6 fps on the unit) arti 2026-10-30 17:32:59 +02:00
  • 1571328a6b NETWORK_REPORT: osboot 3 of 3 on the unit; scripted hand-back is 7 s load + 40 s restart arti 2026-10-30 17:20:28 +02:00
  • ed185279ca udpstream: the payload announces itself; test-osboot.sh has no sleep arti 2026-10-30 17:19:28 +02:00
  • f74bd7ae05 NETWORK_REPORT: osboot works on the unit -- 40 s, Terminal Manager back arti 2026-10-30 17:12:41 +02:00
  • baffb8292e udpstream: osboot -- jump to the OS cold start (0x3F5788C0), the path that quietens the LANCE arti 2026-10-30 17:10:45 +02:00
  • 504d63a705 udpstream: the soft reboot has never worked (0/2) -- attempt 1 was a manual power cycle arti 2026-10-30 17:07:50 +02:00
  • f1dc5e7f6e udpstream: reboot is 1-in-2 on the real unit, not a working hand-back arti 2026-10-30 17:06:49 +02:00
  • 55236fbf54 NETWORK_REPORT: the firmware has no software reboot (Ghidra check of the test menu) arti 2026-10-30 17:03:04 +02:00
  • 41e21b6494 udpstream: reboot works on the real unit (88 s), and correct the earlier call arti 2026-10-30 17:01:25 +02:00
  • 0563cb08e8 udpstream: LANCE command payload -- peek/poke/jump/reboot, benchmark, driver-matched RX arti 2026-10-30 16:57:15 +02:00
  • e51c7b94cf NETWORK_REPORT: the broadcast payload works on the real VT1200 (TX 5, RX 5) arti 2026-10-30 16:24:06 +02:00
  • f251672d5d udpstream: payload sends and receives raw Ethernet with its own LANCE driver arti 2026-10-30 16:21:02 +02:00
  • dfc968e906 udpstream: lance_bcast -- raw Ethernet broadcast TX + RX with no ROM code arti 2026-10-30 16:05:31 +02:00
  • e3d04d6459 NETWORK_REPORT: correct 64.3 -- the Ethernet Port Error banner is a clean-boot condition arti 2026-10-30 16:03:19 +02:00
  • b6f193262a udpstream: drop the old white-box ok/tx-done indicators arti 2026-10-30 16:02:40 +02:00
  • 4dda186241 NETWORK_REPORT: text panel on the unit -- REST=0x0073 shows the chip hand-back works arti 2026-10-30 16:01:58 +02:00
  • 895e059383 build-lance.sh: fail the build if .text overlaps the marker block arti 2026-10-30 15:58:16 +02:00
  • c0ae3ecd27 fix crash: marker block overlapped .text after the text panel grew it arti 2026-10-30 15:57:30 +02:00
  • 3cd03cdc19 fix crash: 0x23CC50 is the RDP pointer, not a CSR0 shadow arti 2026-10-30 15:56:08 +02:00
  • 2ec9787435 udpstream: text panel (labelled hex) and an instrumented chip restore arti 2026-10-30 15:54:03 +02:00
  • 53ff57fe45 NETWORK_REPORT: confirmed on real silicon -- lance_fixlen works, loopback completes arti 2026-10-30 15:45:30 +02:00
  • a4ed68c0e4 README: rewrite as the project front page -- status, findings, tidbits arti 2026-10-30 12:03:01 +02:00
  • 8ff16b5b73 NETWORK_REPORT: machine-generated coverage -- 26 unmapped entries found and mapped arti 2026-10-30 11:25:54 +02:00
  • c02d475678 NETWORK_REPORT: map the remaining function entries; explain the label-vs-entry gap arti 2026-10-30 01:43:59 +02:00
  • 3a685b2775 NETWORK_REPORT: map the TCP helpers, socket/queue helpers and utilities arti 2026-10-30 01:43:21 +02:00
  • 8c8e0c4e24 NETWORK_REPORT: map the last addressed functions (codec table, dispatchers, re-arm) arti 2026-10-30 01:42:05 +02:00
  • 8d8f8656df NETWORK_REPORT: correct 54.4's coverage claim in place arti 2026-10-30 01:41:06 +02:00
  • 68f3c677df NETWORK_REPORT: cite the tcp_dooptions/tcp_mss call sites instead of an em dash arti 2026-10-30 01:40:55 +02:00
  • a390601aa9 NETWORK_REPORT: finish the mapping honestly -- glue vs source, plus quotes arti 2026-10-30 01:40:42 +02:00
  • 1364b37e83 NETWORK_REPORT: PCB offsets confirmed against struct inpcb arti 2026-10-30 01:39:49 +02:00
  • b8899645d0 NETWORK_REPORT: finish the BSD mapping (rip_input, tcp_input switches, ICMP checksums) arti 2026-10-30 01:39:37 +02:00
  • 3ad5a691b8 NETWORK_REPORT: map every reversed function to 4.4BSD source arti 2026-10-30 01:39:09 +02:00
  • b5fe6935e1 NETWORK_REPORT: CSRG tree provenance; IDON clearing shown to be optional arti 2026-10-30 01:35:58 +02:00
  • b534bab7d7 NETWORK_REPORT: provenance from 386BSD history, corroborating the ICMP case set arti 2026-10-30 01:31:48 +02:00
  • 874d1fbbf5 networking RE report + LANCE payload variants arti 2026-10-30 01:25:21 +02:00
  • 41b0979aef c-hello: first C program on the VT1200, running on real hardware arti 2026-10-29 18:25:38 +02:00
  • 6338095683 tools: add as34/ld34 TMS34010 binutils, ported to 64-bit Linux arti 2026-10-22 14:19:14 +03:00
  • f3d26ad687 dwt: trace the bottom diagnostics message box to @0xCB640 and the RAM message table SDD 2026-10-18 17:49:13 +03:00
  • 225394e1ae dwt: xtext draws text in a real X window on the VT1200; TFTP retarget fetches the COFF SDD 2026-10-18 17:28:08 +03:00
  • 3c16824f5b dwt: record that the owner moved windows on the real unit (extra windows are not a bug) SDD 2026-10-18 17:28:01 +03:00
  • edc26855fd dwt: full ROM dump over rdebug is byte-identical to vt1200_v22.bin (md5 match) SDD 2026-10-18 17:25:18 +03:00
  • 09f8607466 dwt/tcpip: LAN TFTP client (100.103.255.254) and a verified self-contained fetch + load on the real unit SDD 2026-10-18 17:12:00 +03:00
  • efef682b63 dwt/evidence: real-unit Diagnostics dialog and the session-manager hang after the first ROM-test run SDD 2026-10-18 17:07:11 +03:00
  • e2c18ee70b dwt: NVRAM dump over rdebug (settings block) and LANCE address ROM read; both match the model SDD 2026-10-18 17:06:12 +03:00
  • 0db6dd2e65 dwt: real-unit menu-driven Ethernet Address ROM test passes (All Diagnostics Passed); 24 is the separate port/termination test SDD 2026-10-18 17:02:55 +03:00
  • 6195556524 dwt: mailbox_watch.py -- poll 0x27C190/0x16F0 across a boot; results are consumed before rdebug is reachable SDD 2026-10-18 16:57:45 +03:00
  • 2df00d32e5 dwt: real-unit MOP console works; SHOW reports Monitor Type VR319; TEST refused with DWT IN USE while a window is open SDD 2026-10-18 16:40:19 +03:00
  • 1c1f804a13 dwt: real X11 app via rdebug -- hostload --real; xhello window on the terminal (status 0, stage 6) SDD 2026-10-18 16:32:58 +03:00
  • 736e2c84a4 dwt: 50%-pattern real-unit capture at the correct 1280x1024/256-stride geometry SDD 2026-10-18 16:30:30 +03:00
  • 479d822aca dwt/screenshot: real geometry is 1280x1024 with a 256-byte stride (160B image + 96B mask); --real captures the full screen SDD 2026-10-18 16:26:37 +03:00
  • 6adc04ba02 dwt/screenshot: --real reads the 1024x2048 interleaved framebuffer and keeps the even rows 1:1; corrects the earlier doubling SDD 2026-10-18 16:22:24 +03:00
  • 71588e5405 dwt/screenshot: --field even for the real unit's line-interleaved framebuffer; the capture now matches the glass SDD 2026-10-18 16:18:27 +03:00
  • d6d6a7d44a dwt: real-unit note -- root background is white, TM stipple is a display-mode/fetch effect, not a setting SDD 2026-10-18 16:12:44 +03:00
  • f696a2e8f6 dwt/screenshot: --stretch for the real unit's 1024->1280 display; record geometry and the background stipple SDD 2026-10-18 16:11:24 +03:00
  • 4a0e1235c7 dwt: first real-unit contact -- TCP 771 and the computed challenge work; ROM peek matches v2.2; screenshot over peek SDD 2026-10-18 15:55:48 +03:00
  • 8588340527 dwt/loader: end-to-end host loader over rdebug SDD 2026-10-18 15:34:25 +03:00
  • bebc0ccbc1 reference: map the ROM's third-party code -- MIT X11 R4, BSD 4.3 TCP/IP + BIND + telnet, TI RTS, and the font licences SDD 2026-10-18 15:25:43 +03:00
  • 01923ecb69 dwt/tcpip: map the socket API and fetch a file over TFTP into RAM SDD 2026-10-18 15:24:34 +03:00
  • 139d89a10c dwt/loader: COFF loader places GSPLNK images and runs them via create_process SDD 2026-10-18 15:19:44 +03:00
  • dcca6bee4d dwt: map the firmware heap -- payload scratch sits inside the largest free block; document malloc/free and add heapmap.py SDD 2026-10-18 14:47:14 +03:00
  • a94e99579f dwt/gui: injected X window works via create_process SDD 2026-10-18 14:28:58 +03:00
  • a5769d3d2e dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs SDD 2026-10-18 14:08:31 +03:00
  • c0f142300b dwt/screenshot.py: network screenshot over rdebug peek (VRAM -> PNG), verified against the live OS SDD 2026-10-18 13:49:19 +03:00
  • 2cc3ab1c79 dwt/exploit.py: default to the computed dwt_prf answer -- echo is the known-failing mode and made a bare --peek look like a closed socket SDD 2026-10-18 11:28:00 +03:00
  • 0e4075958b dwt: rdebug opcode 8 puts attacker text in the TM Messages box SDD 2026-10-18 11:03:01 +03:00
  • 619aff0a93 dwt: visual injection -- confirm the persistent box on the live OS, and record that the blink is not established (toggle period is ~1536 frames, not 30) SDD 2026-10-18 03:24:38 +03:00
  • 05f1895bf5 dwt: visual injection experiments via the returning rdebug jump SDD 2026-10-18 03:22:59 +03:00
  • 1e5c095b72 dwt: reverse the dwt_prf challenge; remote poke/jump now works SDD 2026-10-18 02:36:23 +03:00
  • 041c82cb73 dwt: runtime oracle and ground-truth vectors for the dwt_prf challenge transform SDD 2026-10-18 02:30:49 +03:00
  • 5645bb00b3 dwt: exploit client and gate analysis; remote execution blocked at the challenge SDD 2026-10-18 02:20:16 +03:00
  • 2c7b2e8c2e dwt: gate B is real; challenge args must follow the answer SDD 2026-10-18 02:19:54 +03:00
  • bd58af3569 dwt: gate A is a 2-bit field and is open; correct the static reading SDD 2026-10-18 02:07:18 +03:00
  • a18881f45d dwt: MOP console carrier client, protocol notes, and emulator evidence SDD 2026-10-18 02:02:17 +03:00
  • 0a1042e81f dwt: correct the Done\n reply length (payload includes its NUL, len field = payload+1) SDD 2026-10-18 01:55:56 +03:00
  • 68a1aeabdc dwt: static analysis of rdebug / DWT console -- poke+jump exist, gated by a config word and a 16-byte handshake SDD 2026-10-18 01:55:41 +03:00
  • be32e8a138 harness: regenerate duart2_default_tm_frame3000.png -- the cited evidence image predated the LANCE and contradicted the README (no MAC on screen) SDD 2026-10-18 01:21:41 +03:00
  • 1608a68cdb hello-world: the TMS34010 SDK assembles code that runs on the emulated VT1200 SDD 2026-10-18 01:20:38 +03:00
  • 0c3d24b93b tools/tms34010-sdk: the two dis34 bugs are fixed (af7d3565a5) -- record it, with the 2623/6235-line scale of the correction SDD 2026-10-18 00:55:12 +03:00
  • af7d3565a5 dis34: print long relative JR as jr and surface B-file SP as b15 SDD 2026-10-18 00:54:34 +03:00
  • 8bc8d90ea6 tools/tms34010-sdk: record the results -- GSPA (not as34), byte-exact round trip at bit 0x3F208000, 1990 tools are OS/2, dosemu 5x faster, plus the traps SDD 2026-10-18 00:40:25 +03:00
  • 7d299451da reference: TMS34010 SDK investigation; prove GSPA round trip SDD 2026-10-18 00:39:32 +03:00
  • 960b256b00 tools/tms34010-sdk: add DOSBOX.md -- how to run the SDK's DOS tools headless and at speed, with measurements SDD 2026-10-18 00:12:18 +03:00
  • 1ec84abf03 tools: TMS34010 SDK (curated) -- the 1987 ASM/LNK package and the 1990 Code Generation Tools, so the project has an assembler/linker/compiler it was missing; scanned docs excluded SDD 2026-10-17 23:59:24 +03:00
  • c21cab05f8 harness: net-setup.sh -- recreate the tap+bridge the harness needs (they do not survive a reboot) SDD 2026-10-17 14:15:17 +03:00
  • 307df67f9d harness/mame: the TFTP PCF loader skips BITMAPS, so the n*4 overflow is not on that path arti 2026-10-17 14:14:07 +03:00
  • 3a51b95317 harness/fontwork: reproduction scripts for the TFTP Disk-full investigation arti 2026-10-16 22:03:49 +03:00
  • 7efb4880f0 harness: the TFTP font 'Disk full' is the terminal's own tftp_close, not a storage or map bug arti 2026-10-16 22:03:16 +03:00
  • 1051bf2940 patches: MAME is now pushed as a full repo (branch vt1200-local) -- correct the README, which said it was not, and say why the patch is still kept SDD 2026-10-16 17:50:58 +03:00
  • 1561e34967 patches: capture the MAME local edits as a 50-line patch (the MAME remote rejects shallow updates, so a mirror would cost GBs for a 50-line diff) SDD 2026-10-16 17:42:13 +03:00
  • 264d5330ad harness/serve.py: optional BOOTP responder (--bootp) so the VT1200 gets an IP at boot SDD 2026-10-16 17:27:00 +03:00
  • d4a3ccc42c harness: model the battery-backed NVR at bit 0x6000000 arti 2026-10-16 17:25:04 +03:00
  • b6da987aae harness: dump the LANCE DMA; the C - LANCE TEST's failing frame carries no FCS by design arti 2026-10-16 17:12:02 +03:00
  • 5ed4048720 gitignore: ignore root RAM dumps (ROM stays tracked) and the Ghidra transient lock; untrack the lock file SDD 2026-10-16 17:11:29 +03:00
  • f05200e44e gitignore: cover test frame dumps written into the project root, not just harness/mame/ SDD 2026-10-16 17:11:01 +03:00
  • 82ab65bc82 run.sh: document ScrollLock (UI_TOGGLE_UI) as the fix when MAME's menu stops responding, and that closing the window is a clean exit SDD 2026-10-16 17:01:04 +03:00
  • 14f78f3cbe plan: the network provider must be selected per device (interface=-1 is none); index 0 = taptun on this build; NVRAM must not be isolated SDD 2026-10-16 16:56:24 +03:00