Roflin
30563b166d
Previous version launched the image it had just received, which is the one
thing that cannot be made safe: a broken build hangs the console and the
checks can only catch a truncated or non-DOL image, never a plausible but
broken one.
The flow is now receive -> write to SD -> boot /boot.dol:
- netboot_sd_write() mounts the card (auto-detecting SD2SP2, then SD Gecko
slot B, then slot A), writes the image to the path the host asked for,
and READS IT BACK AND COMPARES. A half-written .dol that still parses is
exactly the failure this design exists to avoid, and the card is the one
component here with no other integrity check.
- netboot_boot_file() then loads /boot.dol -- a known-good Swiss -- and
launches that instead.
So the only image this ever jumps into is one that was already known good. A
broken test build costs nothing: Swiss comes up and can load anything,
including the previous build. If the SD write or verify fails, nothing is
launched at all and the menu is still there.
The destination path travels in the DONE frame rather than being baked in, so
the host decides where the build lands (send-dol.py --dest, default
/gc_bba_test.dol).
libfat is unmounted before the jump: leaving the card mounted hands the next
image a filesystem libfat still thinks it owns, on an EXI channel it is about
to reinitialise.
Note the SD Gecko in memory-card slot A shares EXI channel 0 with the BBA
(channel 0, device 2). libogc arbitrates, but SD2SP2 is on its own channel
and avoids the question -- hence the detection order.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
77 lines
3.5 KiB
C
77 lines
3.5 KiB
C
#ifndef NETBOOT_H
|
|
#define NETBOOT_H
|
|
|
|
#include <gccore.h>
|
|
#include <stddef.h>
|
|
|
|
/* Self-update over the BBA: receive a .dol via raw ethernet and launch it.
|
|
*
|
|
* Deliberately NOT built on an IP stack. Frames carry a private ethertype
|
|
* and a 12-byte header, so there is no ARP, no IP, no checksums and no
|
|
* libogc network driver competing with us for the EXI channel -- it reuses
|
|
* exactly the two paths the test suite already proves on hardware:
|
|
* bba_tx_bytes() for TX and the SPRAM ring at RRP for RX.
|
|
*
|
|
* The transfer is STOP-AND-WAIT (one block in flight, ACKed before the next).
|
|
* That is not just simplicity: the gateware does not consume RRP, so
|
|
* RXFrameAssembler can overwrite ring pages the GC has not read yet. One
|
|
* block in flight means the ring never has more than one frame outstanding,
|
|
* so the missing overflow protection cannot bite. Do not "optimise" this
|
|
* into a sliding window without adding RBFI-style protection first.
|
|
*/
|
|
|
|
#define NB_ETHERTYPE 0x88B5u /* IEEE 802 local experimental ethertype 1 */
|
|
#define NB_MAGIC 0x47435550u /* "GCUP" */
|
|
|
|
#define NB_OP_DATA 0x01u /* host -> GC: one block */
|
|
#define NB_OP_ACK 0x02u /* GC -> host: block received */
|
|
#define NB_OP_DONE 0x03u /* host -> GC: transfer complete, launch */
|
|
|
|
#define NB_BLOCK_MAX 1024u /* payload bytes per frame */
|
|
|
|
/* Reserve the staging region at the top of MEM1. MUST be called early in
|
|
* main(), before anything else allocates, and the pointer it returns is where
|
|
* netboot_receive() should stage the image. Returns NULL if MEM1 is too
|
|
* small (it never is on real hardware).
|
|
*
|
|
* The image CANNOT live in an ordinary malloc'd buffer: DOL sections load from
|
|
* 0x80003100 upward and would overwrite it partway through the copy. This
|
|
* carves the top of MEM1 and hands it to SYS_SetArena1Hi so libogc will not
|
|
* allocate there either. */
|
|
void *netboot_reserve(u32 *out_max);
|
|
|
|
/* Receive a .dol into `dst`. Returns its length, or <0 on error.
|
|
* `status` (optional) is called with a human-readable progress line. */
|
|
int netboot_receive(void *dst, u32 maxlen,
|
|
void (*status)(const char *msg));
|
|
|
|
/* Mount whichever SD interface is present (SD Gecko slot A or B, or SD2SP2)
|
|
* and write `len` bytes to `path` (e.g. "/gc_bba_test.dol"), verifying the
|
|
* result by reading it back. Returns 0 on success, <0 on error.
|
|
*
|
|
* NOTE the SD Gecko in memory-card slot A shares EXI channel 0 with the BBA
|
|
* (which is channel 0, device 2). libogc arbitrates, but SD2SP2 -- on its own
|
|
* channel -- avoids the question entirely. */
|
|
int netboot_sd_write(const char *path, const void *buf, u32 len,
|
|
void (*status)(const char *msg));
|
|
|
|
/* Read `path` off the SD card into `dst` and launch it. Does not return on
|
|
* success. Returns <0 if it cannot be read or is not a plausible DOL.
|
|
*
|
|
* This is how the update completes: we NEVER jump into the image we just
|
|
* received, only into a known-good /boot.dol (Swiss). A broken test build
|
|
* therefore costs nothing -- Swiss still comes up and can load whatever you
|
|
* want, including the previous build. */
|
|
int netboot_boot_file(const char *path, void *dst, u32 maxlen,
|
|
void (*status)(const char *msg));
|
|
|
|
/* Destination path the host asked for in its DONE frame (default
|
|
* "/gc_bba_test.dol"). */
|
|
const char *netboot_dest_path(void);
|
|
|
|
/* Launch a .dol image already in memory. Does not return on success.
|
|
* Returns <0 if the image is not a plausible DOL. */
|
|
int netboot_launch(const void *dol);
|
|
|
|
#endif
|