arti baffb8292e udpstream: osboot -- jump to the OS cold start (0x3F5788C0), the path that quietens the LANCE ...

The reset vector is the wrong entry: it starts POST, which re-programs the
board window from a state a payload has already changed.  The firmware has a
second entry, 0x3F5788C0, where the boot gate at 0x3F2042D0 branches when it
skips level 1.  It begins with DINT, CSR0=STOP on the LANCE, and a board-window
re-program -- exactly what a takeover breaks.

MAME, from the LANCE access log: the payload's last access and the OS's first
are 130 us apart, then pc=3F578940 writes CSR0=0x0004 (STOP) and pc=3FDDCAE0
(the OS driver) re-initialises the chip, after which the OS keeps servicing it.

cmd 6 / vtcmd.py osboot.  Unit run pending; the report section is 73.

2026-10-30 17:10:45 +02:00

..

build

udpstream: osboot -- jump to the OS cold start (0x3F5788C0), the path that quietens the LANCE

2026-10-30 17:10:45 +02:00

.gitignore

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

bench-sweep.sh

udpstream: LANCE command payload -- peek/poke/jump/reboot, benchmark, driver-matched RX

2026-10-30 16:57:15 +02:00

build-lance.sh

build-lance.sh: fail the build if .text overlaps the marker block

2026-10-30 15:58:16 +02:00

build-tcp.sh

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

build.sh

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

entry.asm

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

lance_bare.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

lance_bcast.c

NETWORK_REPORT: the broadcast payload works on the real VT1200 (TX 5, RX 5)

2026-10-30 16:24:06 +02:00

lance_cmd.c

udpstream: osboot -- jump to the OS cold start (0x3F5788C0), the path that quietens the LANCE

2026-10-30 17:10:45 +02:00

lance_fixlen.c

udpstream: drop the old white-box ok/tx-done indicators

2026-10-30 16:02:40 +02:00

lance_idonclear.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

lance_init2.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

lance_longwait.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

lance_stopinit.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

lance.c

udpstream: drop the old white-box ok/tx-done indicators

2026-10-30 16:02:40 +02:00

romapi.h

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

send.py

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

sendraw.py

udpstream: payload sends and receives raw Ethernet with its own LANCE driver

2026-10-30 16:21:02 +02:00

tcpstream.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

test-bcast.sh

udpstream: payload sends and receives raw Ethernet with its own LANCE driver

2026-10-30 16:21:02 +02:00

udpstream.c

networking RE report + LANCE payload variants

2026-10-30 01:25:21 +02:00

vtcmd.py

udpstream: osboot -- jump to the OS cold start (0x3F5788C0), the path that quietens the LANCE

2026-10-30 17:10:45 +02:00