mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-31 12:05:05 +02:00
arti
ed185279ca
Loading the COFF over rdebug pokes thousands of words one at a time, so how
long the payload takes to appear varies by tens of seconds -- a fixed sleep is
either wasteful or too short. The payload now broadcasts three frames the
moment its ring is armed: ethertype 0x88B6, 'K' 'S', opcode 0xFF, magic
"LANC". `vtcmd.py wait` listens for it; measured at 8.7 s in MAME.
Two details found by measurement:
* The announce must use TX slot 0, because the chip transmits only from its
ring position -- arming slot 7 while the position is 0 never sends
anything (the first attempt did exactly that and was silently lost).
* After the announce the reply cursor advances to slot 1 to match the chip's
new position, so replies do not collide with the announce descriptor.
txfull then stays 0 across consecutive replies; before this it read 1.
test-osboot.sh ties the hand-back together with no sleep: listen, load, wait
for the announce, stats, osboot, wait for :771. Report sections 73.3/73.4.
67 lines
2.1 KiB
Bash
Executable File
67 lines
2.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# test-osboot.sh -- take the LANCE over, then hand it back with `osboot`.
|
|
#
|
|
# sudo ./test-osboot.sh [iface] [host]
|
|
#
|
|
# The point of this script is that it contains no sleep. The payload
|
|
# broadcasts an announce frame (ethertype 0x88B6, opcode 0xFF, magic "LANC")
|
|
# as soon as its RX ring is armed, so the host starts listening first and acts
|
|
# the moment the payload is really up. Loading the COFF over rdebug is slow
|
|
# (thousands of word pokes), and a fixed sleep either wastes seconds or is too
|
|
# short -- waiting for the announce is exact.
|
|
#
|
|
# Steps:
|
|
# 1. listen for the announce (background)
|
|
# 2. load dwt/loader/hostload.py, which pokes and jumps into the payload
|
|
# 3. when the announce arrives, read stats and send `osboot`
|
|
# 4. wait for the terminal's rdebug port to come back
|
|
#
|
|
# `osboot` jumps to the OS cold start at 0x3F5788C0, which STOPs the LANCE and
|
|
# re-programs the board window before restarting the OS. Measured: 40 s twice.
|
|
|
|
IFACE=${1:-vt1200}
|
|
HOST=${2:-100.103.100.103}
|
|
HERE=$(cd "$(dirname "$0")" && pwd)
|
|
ROOT=$(cd "$HERE/../.." && pwd)
|
|
LOG=${LOG:-/tmp/vt1200-osboot.log}
|
|
|
|
if [ "$(id -u)" != "0" ]; then
|
|
echo "run as root: raw sockets and rdebug need it" >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "[*] listening for the announce on $IFACE"
|
|
python3 "$HERE/vtcmd.py" wait --iface "$IFACE" --wait-timeout 240 &
|
|
LISTENER=$!
|
|
|
|
echo "[*] loading $(basename "$HERE")/build/lance_cmd.coff onto $HOST"
|
|
python3 "$ROOT/dwt/loader/hostload.py" --host "$HOST" \
|
|
--coff "$HERE/build/lance_cmd.coff" --real --no-screenshot \
|
|
> "$LOG" 2>&1 &
|
|
|
|
if ! wait "$LISTENER"; then
|
|
echo "[!] no announce: the payload did not start (see $LOG)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "[*] payload is up, stats:"
|
|
python3 "$HERE/vtcmd.py" stats --iface "$IFACE" || true
|
|
|
|
echo "[*] handing back with osboot"
|
|
python3 "$HERE/vtcmd.py" osboot --iface "$IFACE" || exit 1
|
|
|
|
echo "[*] waiting for rdebug :771 on $HOST"
|
|
T0=$(date +%s)
|
|
i=0
|
|
while [ $i -lt 36 ]; do
|
|
sleep 5
|
|
i=$((i + 1))
|
|
if timeout 2 sh -c "</dev/tcp/$HOST/771" 2>/dev/null; then
|
|
echo "[+] back after $(( $(date +%s) - T0 ))s"
|
|
exit 0
|
|
fi
|
|
done
|
|
|
|
echo "[!] did not come back within 180 s" >&2
|
|
exit 1
|