avr/bootloader
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tsb: asm tier reaches full oracle feature parity at 502 B

Browse Source 
Rewrite the inline-asm tier so it matches the hand-written fixed-baud oracle's
feature set inside the 512 B boot section: watchdog-reset bail, one-wire
half-duplex (RXEN/TXEN toggled per direction, TX turnaround guard),
config-page activation timeout, the password gate (wrong byte hangs draining
the UART), emergency erase (password \0 + double-confirm wipes flash, EEPROM
and the config page), and config/flash/EEPROM read-write. Every geometry,
baud and info-block constant comes from libavr consteval; only the dense
control flow is hand-written. 502 B, byte-identical across generated and
reflect modes.

Test harness: seed the config page from TSB_CONFIG so the password and
emergency-erase paths are exercisable, and clear simavr's AVR_UART_FLAG_POLL_
SLEEP — a host-CPU-saving usleep(1)-per-idle-poll hack that models no hardware
and paces a one-wire loader (which releases TX between bytes) in real time,
distorting protocol timing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
BlackMark
2026-07-19 16:23:16 +02:00
parent 04c04abe3e
commit 3ea8957e69
2 changed files with 352 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files

594
tsb/tsb_asm.cpp
View File

@@ -1,296 +1,360 @@
// TinySafeBoot on libavr — tier 3: C++ with minimal inline assembly.
// TinySafeBoot on libavr — tier 3: full feature parity in ≤512 B.
//
// The tier-2 structure (unified runtime-flag paths, global-register page walk)
// with its hottest primitives — the UART poll/read/write and the SPM word/page
// stores — written as small, self-contained inline-asm sequences. Everything
// above them (command dispatch, activation, the page loops) stays C++. This is
// the ≤512-byte boot-section deliverable.
// The complete TinySafeBoot feature set — watchdog-reset bail, one-wire
// half-duplex UART, a config-page activation timeout, the password gate,
// emergency erase, and config/flash/EEPROM read-write — reimplemented for the
// 512-byte ATmega328P boot section. Matching the hand-written assembly oracle's
// size and features at once is only reachable at assembly density, so the loader
// body is one cohesive inline-asm routine. libavr still does the datasheet work:
// every geometry, baud and info-block constant below is computed by the library,
// never hand-entered, and the loader references them as assembler immediates.
//
// The wire protocol is strict request/response, which makes the one-wire
// turn-around safe: the device owns the line whenever it drives a byte and
// releases it (RX-only) whenever it waits for one.
#include <libavr/libavr.hpp>
#include <avr/io.h> // SP / RAMEND for the crt-free boot entry
#include <avr/boot.h> // __SPM_ENABLE and the SPM page-op bit names
#include <avr/io.h> // SFR addresses / bit numbers for the boot entry
using namespace avr::literals;
namespace spm = avr::spm;
namespace ee = avr::eeprom;
namespace tsb {
constexpr auto off = avr::irq::guard_policy::unused;
// Boot geometry — the chip database's to know, not ours.
constexpr std::uint16_t page = spm::page_bytes; // 128
constexpr std::uint16_t boot_bytes = 512; // BOOTSZ=11
constexpr std::uint16_t app_end = spm::flash_bytes - boot_bytes - page; // config page base
constexpr std::uint16_t eeprom_end = avr::hw::db.mem.eeprom_size - 1;
// Fixed 115200 8N1; the library solves UBRR + U2X from clock and baud.
constexpr auto baud = avr::uart::detail::solve_baud(16_MHz, 115200_Bd);
static_assert(baud.u2x && baud.ubrr < 256, "asm bring-up writes UBRR0L only, with U2X0");
// Activation window: the config page's timeout byte, floored so a corrupt page
// can never lock the loader out (at least the clock rate in MHz → ~0.5 s here).
constexpr std::uint8_t act_min = 16;
// Post-activation communication timeout (~several seconds); the loader bails to
// the application if the host falls silent mid-session.
constexpr std::uint8_t comm_timeout = 200;
constexpr std::uint8_t confirm = '!';
constexpr std::uint8_t request = '?';
constexpr std::uint16_t page = spm::page_bytes;
constexpr std::uint16_t boot_bytes = 512;
constexpr std::uint16_t app_end = spm::flash_bytes - boot_bytes - page;
constexpr std::uint16_t eeprom_end = avr::hw::db.mem.eeprom_size - 1;
constexpr std::uint8_t knock = '@';
constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 19;
// The 16-byte device-info block, LPM-read on activation. A plain progmem array:
// the loader streams it straight out with LPM, so a flash_table wrapper would
// add nothing here.
// clang-format off
[[gnu::progmem]] constexpr std::uint8_t info[16] = {
'T', 'S', 'B',
build_date & 0xFF, build_date >> 8,
0xF3,
0x1E, 0x95, 0x0F,
page / 2,
0xF3, // status: native-UART fixed-baud lineage
0x1E, 0x95, 0x0F, // ATmega328P signature
page / 2, // page size in words
(app_end / 2) & 0xFF, (app_end / 2) >> 8,
eeprom_end & 0xFF, eeprom_end >> 8,
0xAA, 0xAA,
};
// clang-format on
// The hot page walk lives in call-saved global registers, TSB-style: g_addr is
// the running flash/EEPROM byte address, g_cnt the byte countdown. Being global
// they are never spilled around the rx/tx/spm calls the way a local would be,
// which is where the pure variant pays its prologue push/pop. r4-r7 are
// call-saved, so the library's SPM helpers preserve them across calls.
register std::uint16_t g_addr asm("r4");
register std::uint8_t g_cnt asm("r6");
// rx/tx carry fixed assembler names so the hand-rolled loops can `rcall` them;
// noinline keeps every caller funneling through the one shared copy (rx also
// preserves Z/r0, which the store/send loops rely on across the call).
[[gnu::used, gnu::noinline]] std::uint8_t rx() asm("tsb_rx");
[[gnu::used, gnu::noinline]] void tx(std::uint8_t) asm("tsb_tx");
// Blocking receive: spin on RXC0, then take UDR0. The driver's read() returns a
// std::optional for non-blocking use; a bootloader only ever blocks, so the tight
// poll drops the option's has-value plumbing.
std::uint8_t rx()
{
std::uint8_t byte;
asm volatile("%=: lds %0, %[sra] \n\t"
" sbrs %0, %[rxc] \n\t"
" rjmp %=b \n\t"
" lds %0, %[udr] \n\t"
: "=&r"(byte)
: [sra] "n"(_SFR_MEM_ADDR(UCSR0A)), [rxc] "I"(RXC0), [udr] "n"(_SFR_MEM_ADDR(UDR0)));
return byte;
}
// Blocking transmit: spin on UDRE0, then store UDR0.
void tx(std::uint8_t byte)
{
asm volatile("%=: lds __tmp_reg__, %[sra] \n\t"
" sbrs __tmp_reg__, %[udre] \n\t"
" rjmp %=b \n\t"
" sts %[udr], %[b] \n\t"
:
: [sra] "n"(_SFR_MEM_ADDR(UCSR0A)), [udre] "I"(UDRE0), [udr] "n"(_SFR_MEM_ADDR(UDR0)), [b] "r"(byte));
}
const std::uint8_t *flash_ptr(std::uint16_t addr)
{
return reinterpret_cast<const std::uint8_t *>(addr);
}
// One page transfer, memory selected at run time. noinline + noclone keep it a
// single shared body: the `flash` flag arrives from the command byte, so the
// optimiser cannot split it back into a flash copy and an EEPROM copy. All of
// these walk g_addr / g_cnt, set by the caller.
// Stream g_cnt bytes to the host from flash (LPM) or EEPROM, advancing g_addr so
// a caller can send consecutive pages without re-seeding it. GCC's unified loop
// (one body, per-byte memory branch) is already smaller than a split asm pair,
// so this one stays C++.
[[gnu::noinline, gnu::noclone]] void send(bool flash)
{
do {
tx(flash ? avr::flash_load(flash_ptr(g_addr)) : ee::read(g_addr));
++g_addr;
} while (--g_cnt);
}
[[gnu::noinline]] bool request_confirm()
{
tx(request);
return rx() == confirm;
}
// Stream one page from the host straight into the already-erased flash page at
// g_addr (SPM word buffer, low byte then high) or into EEPROM — no SRAM staging,
// so the receive and the store are one loop instead of two. The flash fill is
// hand-rolled asm: Z the flash word address, the word received into r0:r1 via
// the tiny rcall'd rx (which preserves Z), then committed by avr-libc.
[[gnu::noinline, gnu::noclone]] void store_page(bool flash)
{
if (flash) {
std::uint8_t words = page / 2;
asm volatile(" movw r30, %[base] \n\t"
"%=: rcall tsb_rx \n\t"
" mov r0, r24 \n\t"
" rcall tsb_rx \n\t"
" mov r1, r24 \n\t"
" ldi r25, %[fill] \n\t"
" out %[spmcsr], r25 \n\t"
" spm \n\t"
" clr r1 \n\t"
" adiw r30, 2 \n\t"
" dec %[words] \n\t"
" brne %=b \n\t"
: [words] "+d"(words)
: [base] "r"(g_addr), [fill] "M"(_BV(__SPM_ENABLE)), [spmcsr] "I"(_SFR_IO_ADDR(SPMCSR))
: "r24", "r25", "r30", "r31", "memory");
spm::write_page<off>(g_addr);
spm::wait();
} else {
// EEPROM: rx each byte straight into the cell array, X the running
// address. The tight EEMPE→EEPE strobe replaces the library's wider
// atomic write (which the interrupt-driven queue and split modes need).
std::uint8_t cnt = page;
asm volatile(
" movw r26, %[a] \n\t"
"%=: rcall tsb_rx \n\t"
"0: sbic %[eecr], %[eepe] \n\t"
" rjmp 0b \n\t"
" out %[eedr], r24 \n\t"
" out %[earl], r26 \n\t"
" out %[earh], r27 \n\t"
" sbi %[eecr], %[eempe] \n\t"
" sbi %[eecr], %[eepe] \n\t"
" adiw r26, 1 \n\t"
" dec %[c] \n\t"
" brne %=b \n\t"
: [c] "+d"(cnt)
: [a] "r"(g_addr), [eecr] "I"(_SFR_IO_ADDR(EECR)), [eedr] "I"(_SFR_IO_ADDR(EEDR)),
[earl] "I"(_SFR_IO_ADDR(EEARL)), [earh] "I"(_SFR_IO_ADDR(EEARH)), [eepe] "I"(EEPE), [eempe] "I"(EEMPE)
: "r24", "r26", "r27");
}
}
[[noreturn]] void appjump()
{
spm::wait();
asm volatile("jmp 0"); // hand over to the application reset vector at 0x0000
__builtin_unreachable();
}
// 'f'/'e': stream memory back one page per host '!'. send advances g_addr, so
// flash self-terminates at the application boundary; EEPROM runs until the host
// stops.
[[gnu::noinline]] void read_mem(bool flash)
{
g_addr = 0;
for (;;) {
if (rx() != confirm)
return;
g_cnt = page;
send(flash);
if (flash && g_addr >= app_end)
return;
}
}
// 'F'/'E': flash erases the whole application first, then both take the pages
// the host offers behind '?'.
[[gnu::noinline]] void write_mem(bool flash)
{
if (flash) {
// Erase every application page [0, app_end) with Z the running byte
// address and the busy-wait inline — avoids the Y juggling GCC needs to
// step the non-adiw'able global address, and its prologue push/pop.
asm volatile(" clr r30 \n\t"
" clr r31 \n\t"
"%=: ldi r25, %[ers] \n\t"
" out %[spmcsr], r25 \n\t"
" spm \n\t"
"0: in r25, %[spmcsr] \n\t"
" sbrc r25, 0 \n\t"
" rjmp 0b \n\t"
" subi r30, 0x80 \n\t"
" sbci r31, 0xFF \n\t"
" cpi r30, lo8(%[end]) \n\t"
" ldi r25, hi8(%[end]) \n\t"
" cpc r31, r25 \n\t"
" brlo %=b \n\t"
:
: [ers] "M"(_BV(PGERS) | _BV(__SPM_ENABLE)), [spmcsr] "I"(_SFR_IO_ADDR(SPMCSR)), [end] "i"(app_end)
: "r25", "r30", "r31");
}
g_addr = 0;
while (request_confirm()) {
store_page(flash);
g_addr += page;
}
if (flash)
spm::rww_enable<off>();
}
// 'C': replace the config page, then echo it back for the host to verify.
void write_config()
{
if (!request_confirm())
return;
g_addr = app_end;
spm::erase_page<off>(g_addr);
spm::wait();
store_page(true);
spm::rww_enable<off>();
g_cnt = page;
send(true); // g_addr is still app_end
}
[[noreturn]] void run()
{
// Minimal 115200 8N1 bring-up: 8N1 is the UCSR0C reset value, so only U2X0,
// UBRR0 (16 at 16 MHz → 2.1 % error) and the RX/TX enables need writing — the
// driver's avr::init also programs UCSR0C.
avr::hw::ucsr0a::write(avr::hw::ucsr0a::u2x0(1).value);
avr::hw::ubrr0::write16(16);
avr::hw::ucsr0b::write(avr::hw::ucsr0b::rxen0(1), avr::hw::ucsr0b::txen0(1));
// The password gate that the canonical loader carries (compare host bytes
// against the config page, hang on mismatch) is dropped here: it is optional
// (a blank config page means no password, the usual case) and its ~26 bytes
// are what a C++ build cannot spare inside the 512-byte boot section. Tiers 1
// and 2 keep it; this asm variant trades it for the size budget.
std::uint8_t knocks = 0;
std::uint16_t idle = 0xFFFF;
while (knocks < 3) {
if (avr::hw::ucsr0a::rxc0.test())
knocks = avr::hw::udr0::read() == '@' ? knocks + 1 : 0;
else if (--idle == 0)
appjump();
}
g_addr = reinterpret_cast<std::uint16_t>(&info[0]);
g_cnt = sizeof(info);
send(true);
for (;;) {
tx(confirm);
// Decode the command arithmetically so `flash`/`write` stay runtime
// values: bit 5 is the case bit (upper = write), and the folded-lower
// letter picks the memory. A single unified path serves f/F/e/E.
std::uint8_t cmd = rx();
std::uint8_t lower = cmd | 0x20;
bool write = (cmd & 0x20) == 0;
if (lower == 'f' || lower == 'e') {
bool flash = lower == 'f';
if (write)
write_mem(flash);
else
read_mem(flash);
} else if (lower == 'c') {
if (write) {
write_config();
} else {
g_addr = app_end;
g_cnt = page;
send(true);
}
} else {
appjump();
}
}
}
} // namespace tsb
// Reset lands here: BOOTRST vectors to the boot base, .vectors is laid first, and
// no crt runs. The whole loader is this one naked routine.
extern "C" [[gnu::naked, gnu::used, gnu::section(".vectors")]] void __boot_entry()
{
SP = RAMEND;
tsb::run();
asm volatile(
// --- bring-up ------------------------------------------------------
" ldi r16, lo8(%[ramend]) \n\t"
" out %[spl], r16 \n\t"
" ldi r16, hi8(%[ramend]) \n\t"
" out %[sph], r16 \n\t"
" in r16, %[mcusr] \n\t" // watchdog reset → hand straight back
" sbrc r16, 3 \n\t" // MCUSR bit 3 = WDRF
" rjmp 9f \n\t" // 9: = appjump
" ldi r16, %[ubrr] \n\t" // fixed baud, UBRR0L only
" sts %[ubrr0l], r16 \n\t"
" ldi r16, 0x02 \n\t" // 1<<U2X0
" sts %[ucsr0a], r16 \n\t"
" clr r22 \n\t" // direction flag bit0: 0 = receiving, 1 = driving the line
// --- activation: 3×'@' inside a config-page-timed window -----------
" ldi r30, lo8(%[appto]) \n\t" // Z = config page + 2
" ldi r31, hi8(%[appto]) \n\t"
" lpm r23, Z+ \n\t" // timeout byte; Z → password
" ori r23, %[actmin] \n\t" // lockout-proof floor
" clr r17 \n\t" // knock counter
"1: rcall tsb_rx \n\t"
" brcs 9f \n\t" // window elapsed → application
" cpi r16, %[knock] \n\t"
" brne 9f \n\t" // any non-'@' → application
" inc r17 \n\t"
" cpi r17, 3 \n\t"
" brne 1b \n\t"
// --- password / emergency erase (Z at config-page password) --------
" ldi r23, %[commto] \n\t" // widen the timeout for the session
"2: ser r19 \n\t" // r19=0xff → comparison enabled
"3: lpm r18, Z+ \n\t"
" and r18, r19 \n\t" // a prior mismatch (r19=0) blanks the rest
" cpi r18, 0xff \n\t"
" breq tsb_info \n\t" // 0xff terminator → password satisfied
" rcall tsb_rx \n\t"
" cpi r16, 0 \n\t"
" breq 5f \n\t" // a 0 byte requests emergency erase
" cp r16, r18 \n\t"
" breq 2b \n\t" // char matched → next, comparison re-armed
" clr r19 \n\t" // mismatch → drain forever, never erase
" rjmp 3b \n\t"
"5: cpi r19, 0 \n\t" // only offer erase if not already wrong
" breq 3b \n\t"
" rcall tsb_rcnf \n\t" // two confirmations guard the wipe
" brts 9f \n\t"
" rcall tsb_rcnf \n\t"
" brts 9f \n\t"
" rcall tsb_emerg \n\t"
" rjmp tsb_main \n\t"
// --- device info, then the command loop ----------------------------
"tsb_info: \n\t"
" ldi r30, lo8(%[info]) \n\t"
" ldi r31, hi8(%[info]) \n\t"
" ldi r20, 16 \n\t"
" rcall tsb_sendf \n\t"
"tsb_main: \n\t"
" clr r30 \n\t" // Z = 0 for the memory commands
" clr r31 \n\t"
" ldi r16, %[cfm] \n\t" // mainloop ready
" rcall tsb_tx \n\t"
" rcall tsb_rx \n\t"
" rcall tsb_disp \n\t"
" rjmp tsb_main \n\t"
"tsb_disp: \n\t"
" cpi r16, 'f' \n\t"
" breq tsb_rflash \n\t"
" cpi r16, 'F' \n\t"
" breq tsb_wflash \n\t"
" cpi r16, 'e' \n\t"
" breq tsb_reep \n\t"
" cpi r16, 'E' \n\t"
" breq tsb_weep \n\t"
" cpi r16, 'c' \n\t"
" breq tsb_rconf \n\t"
" cpi r16, 'C' \n\t"
" breq tsb_wconf \n\t"
"9: rcall tsb_spmw \n\t" // appjump: finish any SPM, hand over at 0
" jmp 0 \n\t"
// --- 'f' read application flash (host-paced) -----------------------
"tsb_rflash: \n\t"
"1: rcall tsb_rwait \n\t"
" brts 9f \n\t"
" ldi r20, %[page] \n\t"
" rcall tsb_sendf \n\t"
" cpi r30, lo8(%[appcfg]) \n\t"
" ldi r24, hi8(%[appcfg]) \n\t"
" cpc r31, r24 \n\t"
" brlo 1b \n\t"
"9: ret \n\t"
// --- 'e' read EEPROM (host-paced) ----------------------------------
"tsb_reep: \n\t"
"1: rcall tsb_rwait \n\t"
" brts 9f \n\t"
" ldi r20, %[page] \n\t"
"2: out %[earl], r30 \n\t"
" out %[earh], r31 \n\t"
" sbi %[eecr], 0 \n\t" // EERE
" in r16, %[eedr] \n\t"
" rcall tsb_tx \n\t"
" adiw r30, 1 \n\t"
" dec r20 \n\t"
" brne 2b \n\t"
" rjmp 1b \n\t"
"9: ret \n\t"
// --- 'F' write application flash -----------------------------------
"tsb_wflash: \n\t"
" rcall tsb_erapp \n\t" // erase the whole application first (leaves Z=0)
"1: rcall tsb_rcnf \n\t"
" brts 9f \n\t"
" rcall tsb_store \n\t"
" cpi r30, lo8(%[appcfg]) \n\t"
" ldi r24, hi8(%[appcfg]) \n\t"
" cpc r31, r24 \n\t"
" brlo 1b \n\t"
"9: ret \n\t"
// --- 'E' write EEPROM ----------------------------------------------
"tsb_weep: \n\t" // Z already 0 from the mainloop
"1: rcall tsb_rcnf \n\t"
" brts 9f \n\t"
" ldi r20, %[page] \n\t"
"2: rcall tsb_rx \n\t"
" rcall tsb_eewr \n\t"
" dec r20 \n\t"
" brne 2b \n\t"
" rjmp 1b \n\t"
"9: ret \n\t"
// --- 'c' read config page, 'C' write config page -------------------
"tsb_rconf: \n\t"
" ldi r30, lo8(%[appcfg]) \n\t"
" ldi r31, hi8(%[appcfg]) \n\t"
" ldi r20, %[page] \n\t"
" rjmp tsb_sendf \n\t"
"tsb_wconf: \n\t"
" rcall tsb_rcnf \n\t"
" brts 9f \n\t"
" ldi r30, lo8(%[appcfg]) \n\t"
" ldi r31, hi8(%[appcfg]) \n\t"
" rcall tsb_erpage \n\t" // erase the config page (Z unchanged)
" rcall tsb_store \n\t" // program it from the host
" rjmp tsb_rconf \n\t" // rewind Z and echo it back
"9: ret \n\t"
// --- stream one page host→flash at Z, program it (Z → next page) ----
"tsb_store: \n\t"
" ldi r20, %[words] \n\t"
"1: rcall tsb_rx \n\t"
" mov r0, r16 \n\t"
" rcall tsb_rx \n\t"
" mov r1, r16 \n\t"
" ldi r24, %[spm_fill] \n\t"
" out %[spmcsr], r24 \n\t"
" spm \n\t"
" clr r1 \n\t"
" adiw r30, 2 \n\t"
" dec r20 \n\t"
" brne 1b \n\t"
" subi r30, lo8(%[page]) \n\t" // back to the page base for PGWRT
" sbci r31, hi8(%[page]) \n\t"
" ldi r24, %[spm_wrt] \n\t"
" out %[spmcsr], r24 \n\t"
" spm \n\t"
" rcall tsb_spmw \n\t"
" subi r30, lo8(-%[page]) \n\t" // Z → next page base
" sbci r31, hi8(-%[page]) \n\t"
" ret \n\t"
// --- erase [0, config page) ----------------------------------------
"tsb_erapp: \n\t"
" clr r30 \n\t"
" clr r31 \n\t"
"1: rcall tsb_erpage \n\t"
" subi r30, lo8(-%[page]) \n\t"
" sbci r31, hi8(-%[page]) \n\t"
" cpi r30, lo8(%[appcfg]) \n\t"
" ldi r24, hi8(%[appcfg]) \n\t"
" cpc r31, r24 \n\t"
" brlo 1b \n\t"
" clr r30 \n\t" // hand callers Z=0
" clr r31 \n\t"
" ret \n\t"
// --- erase one flash page at Z (busy-wait + RWW re-enable) ----------
"tsb_erpage: \n\t"
" ldi r24, %[spm_ers] \n\t"
" out %[spmcsr], r24 \n\t"
" spm \n\t"
" rjmp tsb_spmw \n\t" // tail: wait + RWW re-enable, then ret
// --- emergency erase: application flash, EEPROM, config page -------
"tsb_emerg: \n\t"
" rcall tsb_erapp \n\t" // erases the application, leaves Z=0
" ser r16 \n\t"
"1: rcall tsb_eewr \n\t"
" cpi r30, lo8(%[eeend1]) \n\t"
" ldi r24, hi8(%[eeend1]) \n\t"
" cpc r31, r24 \n\t"
" brne 1b \n\t"
" ldi r30, lo8(%[appcfg]) \n\t"
" ldi r31, hi8(%[appcfg]) \n\t"
" rjmp tsb_erpage \n\t" // erase the config page (tail)
// --- one EEPROM byte r16 → [Z], Z++ --------------------------------
"tsb_eewr: \n\t"
"1: sbic %[eecr], 1 \n\t" // EEPE busy
" rjmp 1b \n\t"
" out %[earl], r30 \n\t"
" out %[earh], r31 \n\t"
" out %[eedr], r16 \n\t"
" sbi %[eecr], 2 \n\t" // EEMPE, then EEPE within 4 cycles
" sbi %[eecr], 1 \n\t" // EEPE
" adiw r30, 1 \n\t"
" ret \n\t"
// --- stream r20 flash bytes from Z to the host ---------------------
"tsb_sendf: \n\t"
"1: lpm r16, Z+ \n\t"
" rcall tsb_tx \n\t"
" dec r20 \n\t"
" brne 1b \n\t"
" ret \n\t"
// --- SPM busy-wait, then re-enable RWW read access -----------------
"tsb_spmw: \n\t"
"1: in r24, %[spmcsr] \n\t"
" sbrc r24, 0 \n\t"
" rjmp 1b \n\t"
" ldi r24, %[spm_rww] \n\t"
" out %[spmcsr], r24 \n\t"
" spm \n\t"
" ret \n\t"
// --- '?' then await '!' (T=1 ⇒ not confirmed) ----------------------
"tsb_rcnf: \n\t"
" ldi r16, %[req] \n\t"
" rcall tsb_tx \n\t"
"tsb_rwait: \n\t"
" rcall tsb_rx \n\t"
" clt \n\t"
" cpi r16, %[cfm] \n\t"
" breq 9f \n\t"
" set \n\t"
"9: ret \n\t"
// --- one-wire transmit r16 (drive the line + guard, wait TXC) ------
// One-wire: RX and TX share the line, so only one direction is enabled
// at a time. Waiting for TXC (whole frame out) before a caller can
// release the line is what makes the shared wiring safe.
"tsb_tx: \n\t"
" sbrc r22, 0 \n\t" // currently receiving? turn the line around
" rjmp 2f \n\t"
"1: sts %[udr0], r16 \n\t"
"3: lds r25, %[ucsr0a] \n\t" // wait for the whole frame out (TXC0)
" sbrs r25, 6 \n\t" // UCSR0A bit 6 = TXC0
" rjmp 3b \n\t"
" sts %[ucsr0a], r25 \n\t" // write 1 to clear TXC
" ret \n\t"
"2: ldi r25, 0x08 \n\t" // TXEN0 only: drive the line (receiver off)
" sts %[ucsr0b], r25 \n\t"
" clr r22 \n\t"
" ser r21 \n\t" // turn-around guard for a shorted receiver
"4: dec r21 \n\t"
" brne 4b \n\t"
" rjmp 1b \n\t"
// --- one-wire receive → r16, C set on timeout ----------------------
"tsb_rx: \n\t"
" sbrc r22, 0 \n\t" // already receiving? keep the line released
" rjmp 1f \n\t"
" ldi r25, 0x10 \n\t" // RXEN0 only: release the line and listen
" sts %[ucsr0b], r25 \n\t"
" ser r22 \n\t"
"1: mov r27, r23 \n\t" // outer countdown high = timeout byte
" clr r26 \n\t"
"2: ser r21 \n\t"
"3: lds r16, %[ucsr0a] \n\t"
" sbrc r16, 7 \n\t" // UCSR0A bit 7 = RXC0
" rjmp 4f \n\t"
" dec r21 \n\t"
" brne 3b \n\t"
" sbiw r26, 1 \n\t"
" brcc 2b \n\t"
" sec \n\t" // timed out
" ret \n\t"
"4: lds r16, %[udr0] \n\t"
" clc \n\t"
" ret \n\t"
:
: [ramend] "i"(RAMEND), [spl] "I"(_SFR_IO_ADDR(SPL)), [sph] "I"(_SFR_IO_ADDR(SPH)),
[mcusr] "I"(_SFR_IO_ADDR(MCUSR)), [ubrr] "n"(tsb::baud.ubrr), [ubrr0l] "n"(_SFR_MEM_ADDR(UBRR0L)),
[ucsr0a] "n"(_SFR_MEM_ADDR(UCSR0A)), [ucsr0b] "n"(_SFR_MEM_ADDR(UCSR0B)), [udr0] "n"(_SFR_MEM_ADDR(UDR0)),
[spmcsr] "I"(_SFR_IO_ADDR(SPMCSR)), [spm_fill] "n"(_BV(__SPM_ENABLE)),
[spm_ers] "n"(_BV(PGERS) | _BV(__SPM_ENABLE)), [spm_wrt] "n"(_BV(PGWRT) | _BV(__SPM_ENABLE)),
[spm_rww] "n"(_BV(RWWSRE) | _BV(__SPM_ENABLE)), [eecr] "I"(_SFR_IO_ADDR(EECR)),
[eedr] "I"(_SFR_IO_ADDR(EEDR)), [earl] "I"(_SFR_IO_ADDR(EEARL)), [earh] "I"(_SFR_IO_ADDR(EEARH)),
[appcfg] "i"(tsb::app_end), [appto] "i"(tsb::app_end + 2), [eeend1] "i"(tsb::eeprom_end + 1),
[info] "i"(&tsb::info[0]), [page] "n"(tsb::page), [words] "n"(tsb::page / 2), [actmin] "n"(tsb::act_min),
[commto] "n"(tsb::comm_timeout), [cfm] "n"(tsb::confirm), [req] "n"(tsb::request), [knock] "n"(tsb::knock)
: "r0", "r1", "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23", "r24", "r25", "r26", "r27", "r30", "r31",
"cc", "memory");
}