Roflin
b438960eb5
Copying to SD and rebooting is now the slowest part of the loop. Z in the
test app pulls a new .dol over the adapter and launches it.
Deliberately NOT built on an IP stack. Frames carry a private ethertype
(0x88B5, IEEE 802 local experimental 1) and a 12-byte header, so there is no
ARP, no IP, no checksums, and no libogc network driver competing with our raw
driver for the EXI channel. It reuses exactly the two paths the suite already
proves on hardware: bba_tx_bytes() for TX and the SPRAM ring at RRP for RX.
A side benefit is that each update is a few hundred round trips through that
path -- a soak test we did not have.
STOP-AND-WAIT is load-bearing, not laziness. The gateware does not consume
RRP, so RXFrameAssembler can overwrite ring pages the GC has not read yet;
there is no overflow protection. One block in flight means the ring never
holds more than one unread frame, so the missing protection cannot bite. Both
the header and the README say not to make this a sliding window without adding
RBFI-style protection first.
Failure behaviour, so a bad update never costs a power cycle:
- 30 s idle with no frames, or 5 s mid-transfer, aborts to the menu rather
than hanging.
- A duplicate block is RE-ACKed rather than ignored, because a duplicate
means our previous ACK was lost and re-ACKing is what lets the host move
on.
- netboot_receive() re-asserts the NCRA SR bit first: an earlier test may
have left receive disabled, and then this would wait forever for frames
the gateware is not storing.
- netboot_launch() refuses an image whose entry point or first text section
is not in MEM1 instead of jumping into a mis-parsed header.
The jump itself is the one unavoidable risk: once sections are copied and
interrupts are off, a bad image hangs the console hard enough to need a power
cycle. The MEM1 check is what stands between a truncated transfer and that.
Host side is scripts/send-dol.py (AF_PACKET, needs sudo). The GC's MAC is
discovered from its first ACK, so neither side needs an address configured.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
42 lines
1.7 KiB
C
42 lines
1.7 KiB
C
#ifndef NETBOOT_H
|
|
#define NETBOOT_H
|
|
|
|
#include <gccore.h>
|
|
#include <stddef.h>
|
|
|
|
/* Self-update over the BBA: receive a .dol via raw ethernet and launch it.
|
|
*
|
|
* Deliberately NOT built on an IP stack. Frames carry a private ethertype
|
|
* and a 12-byte header, so there is no ARP, no IP, no checksums and no
|
|
* libogc network driver competing with us for the EXI channel -- it reuses
|
|
* exactly the two paths the test suite already proves on hardware:
|
|
* bba_tx_bytes() for TX and the SPRAM ring at RRP for RX.
|
|
*
|
|
* The transfer is STOP-AND-WAIT (one block in flight, ACKed before the next).
|
|
* That is not just simplicity: the gateware does not consume RRP, so
|
|
* RXFrameAssembler can overwrite ring pages the GC has not read yet. One
|
|
* block in flight means the ring never has more than one frame outstanding,
|
|
* so the missing overflow protection cannot bite. Do not "optimise" this
|
|
* into a sliding window without adding RBFI-style protection first.
|
|
*/
|
|
|
|
#define NB_ETHERTYPE 0x88B5u /* IEEE 802 local experimental ethertype 1 */
|
|
#define NB_MAGIC 0x47435550u /* "GCUP" */
|
|
|
|
#define NB_OP_DATA 0x01u /* host -> GC: one block */
|
|
#define NB_OP_ACK 0x02u /* GC -> host: block received */
|
|
#define NB_OP_DONE 0x03u /* host -> GC: transfer complete, launch */
|
|
|
|
#define NB_BLOCK_MAX 1024u /* payload bytes per frame */
|
|
|
|
/* Receive a .dol into `dst`. Returns its length, or <0 on error.
|
|
* `status` (optional) is called with a human-readable progress line. */
|
|
int netboot_receive(void *dst, u32 maxlen,
|
|
void (*status)(const char *msg));
|
|
|
|
/* Launch a .dol image already in memory. Does not return on success.
|
|
* Returns <0 if the image is not a plausible DOL. */
|
|
int netboot_launch(const void *dol);
|
|
|
|
#endif
|