arti/vt1200
1
0 Fork 1
mirror of https://git.k-space.ee/arti/vt1200.git synced 2026-10-30 12:03:54 +02:00
Code Wiki Activity
Files
master
vt1200/dwt/tcpip/build/tftpc.lst
T
SDD 01923ecb69 dwt/tcpip: map the socket API and fetch a file over TFTP into RAM 
The firmware's tftp_open hangs in its resolver from the rdebug process, so
the payload speaks RFC 783 over the firmware socket API: socket(2,2,0),
sendto(RRQ), recvfrom(DATA)/ACK into a malloc'd buffer, close. Verified
live: 600 B fetched from 192.168.99.1 into the malloc buffer, server RRQ
logged, and rdebug peek matches probe.bin byte-for-byte.

Notes: dwt/notes/TCPIP.md (function table, ABI, limits) and the
loader/transport hand-off in dwt/notes/LOADER_CROSS.md.
2026-10-18 15:24:34 +03:00

383 lines
16 KiB
Plaintext
Raw Permalink Blame History

GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 1
0001 ; tftpc.asm -- minimal TFTP read client built on the fi
0002 ;
0003 ; The firmware's own tftp_open() calls a resolver that
0004 ; called from the rdebug process (dwt/notes/TCPIP.md),
0005 ; RFC 783 directly: RRQ, DATA/ACK, 512-byte blocks, one
0006 ;
0007 ; socket = 3F5C9A00h socket(2,2,0) -> fd
0008 ; sendto = 3F5D3D70h sendto(fd, buf, len, flags, t
0009 ; recvfrom = 3F5D7D50h recvfrom(fd, buf, len, flags,
0010 ; close = 3F5E8930h close(fd)
0011 ; malloc = 3F701230h malloc(bytes) -> bit pointer
0012 ;
0013 ; The transfer is 600 bytes, so DATA 1 is 512 (full) an
0014 ; (short); the short block ends the transfer. ACKs go
0015 ; recvfrom reports, not to a hard-coded port.
0016 ;
0017 ; Evidence cells (32-bit, bit addresses):
0018 ; 0187C000 stage (1 malloc, 2 socket, 3 receiving, 4
0019 ; 0187C020 fd
0020 ; 0187C040 destination buffer (malloc)
0021 ; 0187C060 total bytes fetched
0022 ; 0187C080 last recvfrom length
0023 ; 0187C0A0 last DATA block word as read from the wir
0024 ; 0187C0C0 marker 05A5A5A5h when the fetch completed
0025 ; 0187C200 entry SP
0026 ; 0187C220 entry A14
0027 ;
0028 ; Scratch (fixed bit addresses, above this image):
0029 ; 01875000 argument area
0030 ; 01876000 receive buffer (2048 bytes)
0031 ; 0187A000 recvfrom source sockaddr
0032 ; 0187A080 recvfrom sockaddr length
0033 ; 0187A100 ACK packet (4 bytes)
0034
0035 00000000 .text
0036 00000000 _start:
0037 00000000 0550 setf 16, 0, 0
0038 00000010 0740 setf 32, 0, 1
0039 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
00000030 FF00
0040 00000040 078F move sp, @0187C200h, 1
00000050 0187C200
0041 00000070 078E move a14, @0187C220h, 1
00000080 0187C220
0042
0043 000000A0 09E0 movi 1, a0, L
000000B0 00000001
0044 000000D0 0780 move a0, @0187C000h, 1
000000E0 0187C000
0045
0046 ; ---- buf = malloc(010000h) -------------------------
0047 00000100 A3CF move a14, -*sp, 1
0048 00000110 09EE movi 01875000h, a14, L
00000120 01875000
0049 00000140 09E0 movi 010000h, a0, L
00000150 00010000
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 2
0050 00000170 920E move a0, *a14+, 1
0051 00000180 0D5F calla 3F701230h
00000190 3F701230
0052 000001B0 07AF move @0187C200h, sp, 1
000001C0 0187C200
0053 000001E0 07AE move @0187C220h, a14, 1
000001F0 0187C220
0054 00000210 0550 setf 16, 0, 0
0055 00000220 0740 setf 32, 0, 1
0056 00000230 0788 move a8, @0187C040h, 1
00000240 0187C040
0057 00000260 4D0B move a8, a11 ; dest cursor (callee-saved)
0058 00000270 4D08 move a8, a8
0059 00000280 CA00 jreq fail
00000290 010F
0060
0061 000002A0 09E0 movi 2, a0, L
000002B0 00000002
0062 000002D0 0780 move a0, @0187C000h, 1
000002E0 0187C000
0063
0064 ; ---- fd = socket(2,2,0) ----------------------------
0065 00000300 09EE movi 01875000h, a14, L
00000310 01875000
0066 00000330 09E0 movi 0, a0, L
00000340 00000000
0067 00000360 920E move a0, *a14+, 1
0068 00000370 09E0 movi 2, a0, L
00000380 00000002
0069 000003A0 920E move a0, *a14+, 1
0070 000003B0 09E0 movi 2, a0, L
000003C0 00000002
0071 000003E0 920E move a0, *a14+, 1
0072 000003F0 0D5F calla 3F5C9A00h
00000400 3F5C9A00
0073 00000420 07AF move @0187C200h, sp, 1
00000430 0187C200
0074 00000450 07AE move @0187C220h, a14, 1
00000460 0187C220
0075 00000480 0550 setf 16, 0, 0
0076 00000490 0740 setf 32, 0, 1
0077 000004A0 0788 move a8, @0187C020h, 1
000004B0 0187C020
0078 000004D0 4D09 move a8, a9 ; fd (callee-saved)
0079 000004E0 4D08 move a8, a8
0080 000004F0 C400 jrlt fail
00000500 00E8
0081
0082 ; ---- sendto(fd, RRQ, 28, 0, SADDR, 16) -------------
0083 00000510 09EE movi 01875000h, a14, L
00000520 01875000
0084 00000540 09E0 movi 16, a0, L
00000550 00000010
0085 00000570 920E move a0, *a14+, 1
0086 00000580 09E0 movi SADDR, a0, L
00000590 00001530'
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 3
0087 000005B0 920E move a0, *a14+, 1
0088 000005C0 09E0 movi 0, a0, L
000005D0 00000000
0089 000005F0 920E move a0, *a14+, 1
0090 00000600 09E0 movi 28, a0, L
00000610 0000001C
0091 00000630 920E move a0, *a14+, 1
0092 00000640 09E0 movi RRQ, a0, L
00000650 00001450'
0093 00000670 920E move a0, *a14+, 1
0094 00000680 932E move a9, *a14+, 1
0095 00000690 0D5F calla 3F5D3D70h
000006A0 3F5D3D70
0096 000006C0 07AF move @0187C200h, sp, 1
000006D0 0187C200
0097 000006F0 07AE move @0187C220h, a14, 1
00000700 0187C220
0098 00000720 0550 setf 16, 0, 0
0099 00000730 0740 setf 32, 0, 1
0100 00000740 4D08 move a8, a8
0101 00000750 C400 jrlt fail
00000760 00C2
0102
0103 00000770 09E0 movi 3, a0, L
00000780 00000003
0104 000007A0 0780 move a0, @0187C000h, 1
000007B0 0187C000
0105 000007D0 4400 sub a0, a0
0106 000007E0 0780 move a0, @0187C060h, 1 ; total = 0
000007F0 0187C060
0107
0108 00000810 recv_loop:
0109 ; ---- recvfrom(fd, BUF, 2048, 0, &FROM, &FROMLEN) ---
0110 ; arg5 is a POINTER to the socklen (as tftp_read passe
0111 ; value is initialised to 16 first.
0112 00000810 09E0 movi 16, a0, L
00000820 00000010
0113 00000840 0780 move a0, @0187A080h, 1 ; fromlen = 16
00000850 0187A080
0114 00000870 09EE movi 01875000h, a14, L
00000880 01875000
0115 000008A0 09E0 movi 0187A080h, a0, L
000008B0 0187A080
0116 000008D0 920E move a0, *a14+, 1 ; arg5 = &fromlen
0117 000008E0 09E0 movi 0187A000h, a0, L
000008F0 0187A000
0118 00000910 920E move a0, *a14+, 1 ; arg4 = &from
0119 00000920 09E0 movi 0, a0, L
00000930 00000000
0120 00000950 920E move a0, *a14+, 1 ; arg3 = flags
0121 00000960 09E0 movi 00800h, a0, L
00000970 00000800
0122 00000990 920E move a0, *a14+, 1 ; arg2 = 2048
0123 000009A0 09E0 movi 01876000h, a0, L
000009B0 01876000
0124 000009D0 920E move a0, *a14+, 1 ; arg1 = receive buffer
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 4
0125 000009E0 932E move a9, *a14+, 1 ; arg0 = fd
0126 000009F0 0D5F calla 3F5D7D50h
00000A00 3F5D7D50
0127 00000A20 07AF move @0187C200h, sp, 1
00000A30 0187C200
0128 00000A50 07AE move @0187C220h, a14, 1
00000A60 0187C220
0129 00000A80 0550 setf 16, 0, 0
0130 00000A90 0740 setf 32, 0, 1
0131
0132 00000AA0 0788 move a8, @0187C080h, 1 ; last length
00000AB0 0187C080
0133 00000AD0 4D08 move a8, a8
0134 00000AE0 C600 jrle fail
00000AF0 0089
0135
0136 ; opcode: wire 00 03 -> little-endian word 0300h
0137 00000B00 05A0 move @01876000h, a0, 0
00000B10 01876000
0138 00000B30 0B40 cmpi 0300h, a0
00000B40 FCFF
0139 00000B50 CB00 jrne fail ; only DATA is accepted
00000B60 0082
0140
0141 00000B70 05A4 move @01876010h, a4, 0 ; block number, wire order
00000B80 01876010
0142 00000BA0 0784 move a4, @0187C0A0h, 1
00000BB0 0187C0A0
0143
0144 00000BD0 4D03 move a8, a3
0145 00000BE0 1483 subk 4, a3 ; payload length
0146
0147 ; ---- total += payload, dest += payload -------------
0148 00000BF0 07A1 move @0187C060h, a1, 1
00000C00 0187C060
0149 00000C20 4061 add a3, a1
0150 00000C30 0781 move a1, @0187C060h, 1 ; total += payload (bytes)
00000C40 0187C060
0151 00000C60 4D66 move a11, a6 ; copy destination
0152 00000C70 4C62 move a3, a2
0153 00000C80 2462 sll 3, a2 ; bytes -> bits: pointers are bit addresse
0154 00000C90 404B add a2, a11 ; dest cursor advances now (do NOT add by
0155
0156 ; ---- copy payload from BUF+4 to a6, one byte at a ti
0157 ; Interrupts are disabled for the copy so a 512-byte c
0158 ; with respect to the firmware's ISRs.
0159 00000CA0 0360 dint
0160 00000CB0 09E5 movi 01876020h, a5, L
00000CC0 01876020
0161 00000CE0 4C62 move a3, a2
0162 00000CF0 0783 move a3, @0187C0E0h, 1 ; payload length
00000D00 0187C0E0
0163 00000D20 0782 move a2, @0187C140h, 1 ; copy count
00000D30 0187C140
0164 00000D50 0786 move a6, @0187C120h, 1 ; write start
00000D60 0187C120
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 5
0165 00000D80 078B move a11, @0187C100h, 1 ; cursor after advance
00000D90 0187C100
0166 00000DB0 0785 move a5, @0187C160h, 1 ; source
00000DC0 0187C160
0167 00000DE0 CA05 jreq copy_done
0168 00000DF0 copy_bytes:
0169 00000DF0 8EA0 movb *a5, a0
0170 00000E00 8C06 movb a0, *a6
0171 00000E10 1105 addk 8, a5 ; one byte
0172 00000E20 1106 addk 8, a6
0173 00000E30 3CA2 dsjs a2, copy_bytes
0174 00000E40 copy_done:
0175 00000E40 0D60 eint
0176
0177 ; ---- ACK: 00 04 <block as received> ----------------
0178 00000E50 09E0 movi 00400h, a0, L
00000E60 00000400
0179 00000E80 0580 move a0, @0187A100h, 0
00000E90 0187A100
0180 00000EB0 0584 move a4, @0187A110h, 0
00000EC0 0187A110
0181
0182 00000EE0 09EE movi 01875000h, a14, L
00000EF0 01875000
0183 00000F10 09E0 movi 16, a0, L
00000F20 00000010
0184 00000F40 920E move a0, *a14+, 1
0185 00000F50 09E0 movi 0187A000h, a0, L
00000F60 0187A000
0186 00000F80 920E move a0, *a14+, 1
0187 00000F90 09E0 movi 0, a0, L
00000FA0 00000000
0188 00000FC0 920E move a0, *a14+, 1
0189 00000FD0 09E0 movi 4, a0, L
00000FE0 00000004
0190 00001000 920E move a0, *a14+, 1
0191 00001010 09E0 movi 0187A100h, a0, L
00001020 0187A100
0192 00001040 920E move a0, *a14+, 1
0193 00001050 932E move a9, *a14+, 1
0194 00001060 0D5F calla 3F5D3D70h
00001070 3F5D3D70
0195 00001090 07AF move @0187C200h, sp, 1
000010A0 0187C200
0196 000010C0 07AE move @0187C220h, a14, 1
000010D0 0187C220
0197 000010F0 0550 setf 16, 0, 0
0198 00001100 0740 setf 32, 0, 1
0199 00001110 4D08 move a8, a8
0200 00001120 C426 jrlt fail
0201
0202 ; short block ends the transfer; full block means read
0203 00001130 07A2 move @0187C080h, a2, 1
00001140 0187C080
0204 00001160 1482 subk 4, a2
0205 00001170 0B42 cmpi 512, a2
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 6
00001180 FDFF
0206 00001190 C402 jrlt close_it
0207 000011A0 C000 jruc recv_loop
000011B0 FF65
0208
0209 000011C0 close_it:
0210 000011C0 09E0 movi 4, a0, L
000011D0 00000004
0211 000011F0 0780 move a0, @0187C000h, 1
00001200 0187C000
0212 00001220 09EE movi 01875000h, a14, L
00001230 01875000
0213 00001250 932E move a9, *a14+, 1
0214 00001260 0D5F calla 3F5E8930h ; close(fd)
00001270 3F5E8930
0215 00001290 07AF move @0187C200h, sp, 1
000012A0 0187C200
0216 000012C0 07AE move @0187C220h, a14, 1
000012D0 0187C220
0217 000012F0 0550 setf 16, 0, 0
0218 00001300 0740 setf 32, 0, 1
0219 00001310 09E0 movi 05A5A5A5h, a0, L
00001320 05A5A5A5
0220 00001340 0780 move a0, @0187C0C0h, 1
00001350 0187C0C0
0221 00001370 4508 sub a8, a8
0222 00001380 C009 jruc epilogue
0223
0224 00001390 fail:
0225 00001390 09E0 movi 0FFh, a0, L
000013A0 000000FF
0226 000013C0 0780 move a0, @0187C000h, 1
000013D0 0187C000
0227 000013F0 09E8 movi 0FFFFFFFFh, a8, L
00001400 FFFFFFFF
0228 00001420 epilogue:
0229 00001420 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
00001430 00FF
0230 00001440 0960 rets
0231
0232 00001450 RRQ:
0233 00001450 0100 .word 00100h ; opcode 1 (00 01)
0234 00001460 7764 .word 07764h ; "dw"
0235 00001470 2F74 .word 02F74h ; "t/"
0236 00001480 6374 .word 06374h ; "tc"
0237 00001490 6970 .word 06970h ; "pi"
0238 000014A0 2F70 .word 02F70h ; "p/"
0239 000014B0 7270 .word 07270h ; "pr"
0240 000014C0 626F .word 0626Fh ; "ob"
0241 000014D0 2E65 .word 02E65h ; "e."
0242 000014E0 6962 .word 06962h ; "bi"
0243 000014F0 006E .word 0006Eh ; "n\0"
0244 00001500 636F .word 0636Fh ; "oc"
0245 00001510 6574 .word 06574h ; "te"
0246 00001520 0074 .word 00074h ; "t\0"
0247 00001530 SADDR:
GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 15:23:35 2026
(c) Copyright 1985, 1987, Texas Instruments Inc.
PAGE 7
0248 00001530 0002 .word 00002h ; sin_family = AF_INET
0249 00001540 4500 .word 04500h ; sin_port = htons(69)
0250 00001550 A8C0 .word 0A8C0h ; 192.168
0251 00001560 0163 .word 00163h ; .99.1
0252 00001570 0000 .word 0
0253 00001580 0000 .word 0
0254 00001590 0000 .word 0
0255 000015A0 0000 .word 0
0256 .end
No Errors, No Warnings
View Git Blame Copy Permalink