diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md index e71c0ff..5f2aeb7 100644 --- a/harness/mame/NETWORK_REPORT.md +++ b/harness/mame/NETWORK_REPORT.md @@ -4479,3 +4479,219 @@ does so with no ROM code: our init block, our rings, our descriptors, our Both are fixed: `X` added, and the MAC is now one word per row (`MAC0`/`MAC1`/ `MAC2`) with `REST` moved to y 878. + +## 68. Ring overlap: the reply was discarded by the chip, not by the wire + +`lance_cmd.c` (the command/benchmark payload) received commands correctly — +`cmds` incremented and `laststat` was `0` — but no reply ever reached the host. +The TX descriptor read back as `TMD1 = 0x8000` (OWN set, STP and ENP clear) +although the code had written `0x8300`. + +The DMA log (`VT1200_LANCE_DMA_LOG`) showed the chip doing this on **all eight** +TX descriptors, round-robin, forever: + +``` +r 00309A 8000 FFFF pc=018C9B00 cyc=275084712 +w 00309A 0000 FFFF pc=018C9B00 cyc=275084712 +``` + +Read `0x8000`, write back `0x0000` — that is `transmit_poll()`'s "owned but not +start of packet" path (`am79c90.cpp:329`), which clears ownership and advances +the ring without transmitting anything. + +The cause was an address overlap, and it was arithmetic, not the chip: + +``` +RX ring: 0x3020 .. 0x309f (16 entries x 8 B) +TX ring: 0x3060 .. 0x309f +``` + +The RX ring had been grown from 8 entries to 16 (to survive bursts) but `TXR` +was left at `0x3060`, so **all eight TX descriptors lay inside the RX ring**. +The chip's RX write-back set `OWN` in what the payload believed were TX +descriptors, so every reply was rejected as a continuation fragment. + +Fixed by moving the TX ring to `0x30C0`, plus a compile-time guard so the same +mistake cannot compile again: + +```c +typedef char rx_tx_rings_do_not_overlap[(RXR + NRX * 64 <= TXR) ? 1 : -1]; +``` + +This also explains the earlier "reply buffer has the broadcast address as its +source MAC": that was a second, independent bug (the reply copied the request's +destination MAC into its own source field), fixed separately. A frame whose +source is multicast is dropped by the tap, so it would have failed even with +correct descriptors. + +## 69. Packet handling cross-checked against the four drivers + +Four implementations are available locally and were read line by line: +`original-bsd/sys/pmax/dev/if_le.c` (the firmware's ancestor, section 52), +`NetBSD-src/sys/dev/ic/am7990.c`, `linux/drivers/net/ethernet/amd/7990.c`, and +`linux/drivers/net/ethernet/amd/7990.h`. + +| | 4.4BSD `if_le.c` | NetBSD `am7990.c` | Linux `7990.c` | this payload | +|---|---|---|---|---| +| RX buffer | `LEMTU` **1518** (`if_lereg.h:13`) | `LEBLEN` **1536** (`lancereg.h:116`) | `PKT_BUFF_SIZE` **1544** (`7990.h:45`) | 1526 | +| ring | `LERBUF` | `sc_nrbuf` | 8 RX / 2 TX (`7990.h:35-36`) | 16 RX / 8 TX | +| RX length word | `-LEMTU` (`:344`) | `-LEBLEN \| 0xf000` (`:186`) | `-RX_BUFF_SIZE \| 0xf000` (`:200`) | `0xFA0A` | +| complete frame | `(rmd1 & (STP\|ENP)) == (STP\|ENP)` (`:630`) | same, `"dropping chained buffer"` (`:247`) | `(bits & POK) != POK` (`:303`) | now both bits | +| FCS | `len - 14 - 4` (`:691`) | `rmd3 - 4` (`:256`) | `(mblength & 0xfff) - 4` (`:322`) | now `- 4` | +| re-arm | clear RMD3, then OWN (`:661`) | `OWN`, `rmd2 = -LEBLEN\|ONES`, `rmd3 = 0` (`:259`) | clear mblength, then OWN (`:346`) | now all three | +| TX descriptor | `OWN\|STP\|ENP`, `tmd2=-len`, `tmd3=0` (`:485`) | same (`:513`) | `POK\|OWN`, `(-len)\|0xf000` (`:583`) | same | +| TX kick | `TDMD\|INEA` (`:491`) | `INEA\|TDMD` (`:524`) | `INEA\|TDMD` (`:583`) | now `INEA\|TDMD` | +| slot still owned | `panic("lestart")` (`:471`) | `"missing buffer"`, break (`:482`) | stop queue | skip, count `txfull` | + +### 69.1 Why the buffer must be ≥ 1518 + +All three size the RX buffer at `ETHERMTU + 14 + 4`: the chip writes the +**FCS** into the buffer and includes it in `RMD3`. The payload's counter showed +this before it was fixed — a 60-byte frame was counted as 64 bytes. The earlier +1526 was therefore already legal; a 1500-byte buffer would not have been, and +`RMD1_ENP` handling alone would have miscounted the tail of a chained frame as a +whole frame. + +### 69.2 What changed in the payload because of this + +1. a frame must have **STP and ENP** on the same descriptor, or it is counted as + `chained_dropped` and re-armed without being parsed; +2. the byte counter subtracts the 4-byte FCS; +3. re-arm restores RMD2 and clears RMD3, with ownership written last; +4. the TX kick is `INEA|TDMD`, not `STRT|TDMD` — no reference driver re-writes + `STRT`, and 4.4BSD and NetBSD both write exactly `TDMD|INEA`; +5. a TX slot that is still owned is skipped and counted in `txfull`. + +## 70. The command protocol: read and stats over the wire + +The payload (ethertype `0x88B6`, magic `'K' 'S'`) answers two commands, which is +what makes the machine debuggable while the OS is down: + +| cmd | request | reply | +|---|---|---| +| 1 `read` | 32-bit big-endian **bit** address, 16-bit length (≤ 64) | status, then the bytes | +| 2 `stats` | — | `RXF`, `bytes`, `cmds`, `chained_dropped`, `txfull`, `csr0_err` | +| other | — | status `0xE002` | + +`harness/udpstream/vtcmd.py` drives it: `stats`, `read --addr --len`, and +`bench`. The first frame after takeover is routinely lost (the ring is armed +before the receive loop runs), so requests are retried three times. + +Confirmed in MAME and on the unit: `read 0x018D0000 --len 16` returned +`01 00 00 00 55 55 …`, the payload's own MARK block — arbitrary memory over +Ethernet, with no ROM code and no OS. + +## 71. Receive throughput on the real VT1200 + +The unit and the host are joined by a **10 Mbit half-duplex hub** (the VT1200 has +coax Ethernet). That fact governs every number below: above the receiver's +capacity the *delivered* rate does not plateau, it collapses, which is what a +half-duplex collision domain does under overload. + +`bench` sends 60-byte and 1514-byte frames at a paced or unpaced rate, then reads +the payload's counters. Background traffic is subtracted by taking a `before` +reading; the payload's own control frames are subtracted explicitly +(`frames = ΔRXF − Δcmds`). + +| frame | offered | delivered | rate | `csr0_err` | +|---|---|---|---|---| +| 1514 B | 1717–1723 fps, unpaced | **99.9–100 %** | **856–858 fps, 10.37–10.39 Mbit/s** | `0x9000` | +| 60 B | 3001 frames @ 1500 fps | **99.8–99.9 %** (5 runs) | 1498–1499 fps, 88 KiB/s | `0x9000` | +| 60 B | 6001 frames @ 2000 fps | 58 % | 1165 fps | `0x9000` | +| 60 B | 12001 frames @ 4000 fps | 0.3 % | 12 fps | `0x9000` | + +Readings and their limits: + +* **Full-MTU reception is wire-limited, not code-limited.** 856–858 fps of + 1514-byte frames is 10.37–10.39 Mbit/s of frame bytes; with preamble, FCS and + inter-frame gap that is at or slightly above the nominal 10 Mbit rate + (theoretical maximum for this frame size is ~813 fps at exactly 10.000 Mbit/s, + so the link clock is a few percent fast or the sender's pacing is). Nothing was + dropped. +* **Minimum-size frames sustain ~1500 fps with ~100 % delivery.** Above that the + ring overflows and the hub also collides, and the two are not separable from + the outside. +* `csr0_err = 0x9000` is `ERR|MISS`: **the chip did run out of descriptors**, but + the bit is **sticky** in this build (it ORs CSR0 on every pass), so it records + "at some point", not "how many". It was clear before the 2000/4000 fps runs and + set afterwards, which is consistent with those runs overrunning a 16-deep ring. + A per-event counter is the next refinement; the sticky bit cannot attribute + the misses to a particular run. +* The payload's `stats`-command handling stalls the receive loop for the length + of one reply transmit, so a burst that coincides with a command can produce + misses that a pure data burst would not. + +### 71.1 What is proven and what is inferred + +**Proven:** the payload receives every frame offered up to the wire limit at full +MTU; the chip reports no error bits at that rate; 1500 fps of 60-byte frames is +reproducible at 99.8–99.9 % over five runs; the reply path works (`stats` and +`read` both answer on the unit). + +**Inferred, not proven:** that the collapse above ~2000 fps of 60-byte frames is +the half-duplex hub rather than the LANCE. `ERR|MISS` proves the ring overflowed +at 2000–4000 fps, which is sufficient to explain *loss*; it does not explain why +the *delivered* rate falls from 1165 fps to 12 fps as the offered rate rises — +that shape (rather than a plateau) is characteristic of collision collapse, but +the unit's side of the hub is not instrumented. + +### 71.2 A 64-deep ring crashed the unit + +Raising `NRX` to 64 (ring at `0x3020`–`0x321F`, TX ring and buffer moved to +`0x3240`/`0x3300`) ran correctly in MAME but died on the unit with an **illegal +opcode** during the first 60-byte burst. The 64 buffers grow the RX buffer pool +from 24 KB (`0x4000`–`0x9F78`) to 97 KB (`0x4000`–`0x1B78A`) of low RAM, and the +firmware's OS is still resident while the payload holds the chip. The payload was +reverted to the proven 16-deep layout; the illegal opcode is **not reproduced in +MAME**, so the memory hypothesis is an inference, not a demonstrated cause. + +## 72. peek / poke / jump / reboot, so a taken-over unit can be driven + +The command byte selects the operation; addresses are **bit** addresses +throughout, exactly like every pointer the TMS34010 uses. + +| cmd | name | request | reply | +|---|---|---|---| +| 1 | `read` / peek | `[17..20]` address, `[21..22]` length (≤ 64) | status, then the bytes | +| 2 | `stats` | — | `RXF`, `bytes`, `cmds`, `chained_dropped`, `txfull`, `csr0_err` | +| 3 | `poke` | `[17..20]` address, `[21..22]` length (≤ 1024), `[23..]` bytes | status, 2-byte count written | +| 4 | `jump` | `[17..20]` address | status, 4-byte target, **then control is transferred** | +| 5 | `reboot` | — | status, 4-byte target, **then control is transferred** | +| — | — | — | `0xE002` unknown, `0xE001` read too long, `0xE003` poke truncated | + +The reply is transmitted and its descriptor completion waited on **before** the +transfer, so the host always gets an acknowledgement. + +### 72.1 `jump` needs the entry point, not `.text` + +The COFF entry is **`0x018CBEB0`**; `0x018C0000` is only the start of `.text`. +Measured in MAME: + +* `jump 0x018C0000` → payload stops answering and does not come back; +* `jump 0x018CBEB0` → the payload restarts its own `crt` and answers again with + counters back to zero (`RXF=1`, i.e. just the `stats` request itself). + +### 72.2 `reboot` jumps to the ROM reset vector + +`reboot` reads a 32-bit word from bit `0xFFFFFFE0` and jumps there. On this ROM +that word is `0x3F200040`, the same entry the CPU takes at power-on. The first +instructions there are (`harness/mame/reset.dasm`): + +``` +3F200040: 0360 DINT +3F200050: 0550 SETF 10h,0,0 +3F200060: 0740 SETF 20h,0,1 +3F200070: 5600 CLR A0 +3F200080: 0580 00D0 0640 MOVE A0,@64000D0h,0 +... +``` + +`DINT` first, then the DUART control registers — so the entry does not depend on +the state a payload leaves behind, and at real power-on `SP` is undefined +anyway, which is the condition we reproduce. + +MAME evidence: after the reply, the PC leaves the payload (`0x018Cxxxx`) for ROM +(`0x3FB43E40` at the next sample) and the payload stops answering. What is **not** +shown yet is that the unit comes back *without a power cycle* — in MAME the OS +was never down, so a warm restart is indistinguishable from the OS continuing. +That test needs the real machine and is the reason the command exists. diff --git a/harness/udpstream/bench-sweep.sh b/harness/udpstream/bench-sweep.sh new file mode 100644 index 0000000..a4f69c1 --- /dev/null +++ b/harness/udpstream/bench-sweep.sh @@ -0,0 +1,37 @@ +#!/bin/sh +# bench-sweep.sh -- measure the receive path of the LANCE command payload +# (harness/udpstream/lance_cmd.c) across frame sizes and offered rates. +# +# ./bench-sweep.sh vt1200 # MAME (tap interface) +# sudo ./bench-sweep.sh enp197s0f3u1 08:00:2b:16:4b:5a # real unit +# +# Output is one CSV line per run: +# +# size,rate,seconds,sent,frames,bytes,fps,KiB/s,Mbit/s,delivery%,csr0_err,txfull,chained +# +# "delivery" below 100% means frames were offered and not received. csr0_err +# tells you which side lost them: MISS (0x1000) = the chip had no descriptor +# (ring too small or the loop too slow); no MISS = they never reached the chip +# (wire, switch, or the sender). +# +# The unpaced runs are deliberately last and slowest-to-recover: a 60-byte +# flood is far above both the wire and the loop, and it exists only to show +# where the ceiling is. +set -e + +IFACE=${1:-vt1200} +DST=${2:-ff:ff:ff:ff:ff:ff} +SECS=${SECS:-2} +HERE=$(cd "$(dirname "$0")" && pwd) + +echo "size,rate,seconds,sent,frames,bytes,fps,KiB/s,Mbit/s,delivery%,csr0_err,txfull,chained" + +for size in 60 200 500 1000 1514; do + for rate in 500 1000 2000 4000; do + python3 "$HERE/vtcmd.py" bench --iface "$IFACE" --dst "$DST" \ + --size "$size" --rate "$rate" --seconds "$SECS" --terse || break + done + # as fast as the host can send + python3 "$HERE/vtcmd.py" bench --iface "$IFACE" --dst "$DST" \ + --size "$size" --seconds "$SECS" --terse || break +done diff --git a/harness/udpstream/build/lance_cmd.coff b/harness/udpstream/build/lance_cmd.coff new file mode 100644 index 0000000..7d6b6f5 Binary files /dev/null and b/harness/udpstream/build/lance_cmd.coff differ diff --git a/harness/udpstream/lance_cmd.c b/harness/udpstream/lance_cmd.c new file mode 100644 index 0000000..556ee69 --- /dev/null +++ b/harness/udpstream/lance_cmd.c @@ -0,0 +1,520 @@ +/* + * lance.c -- LANCE loopback probe using LOW-MEMORY rings. + * + * The OS's own init block (pointer at bit 0x23E7A0 -> byte 0xF80 on a live + * boot) puts its rings at byte 0x0A80 / 0x0E80 and stores only the LENGTH in + * the ring words' bits 13-15 (0xE000 / 0xA000), with no address bits above 16. + * MAME's model packs address bits 16+ into that word; if the real C-LANCE does + * not, a high ring address like 0x380028 is seen as 0x0028. This payload + * therefore places the block, rings and buffers below 64 KB. + * + * Memory used (BYTE addresses, well below 64 KB): + * 0x3000 init block (24 B) 0x3020 RX ring (8 * 8 B) 0x3060 TX ring (8 B) + * 0x3100 TX frame (24 B) 0x3200 RX buffer (2048 B) + * + * Result cells at 0x018C8000 (32-bit): 0x160/0x180 CSR0 samples, + * 0x200 RX RMD1, 0x220 RX MCNT, 0x240 TX TMD1, 0x1A0 payload-found flag. + * + * Panel rows (real unit, 256-byte stride): y 670/700 = CSR0, 730 = TMD1, + * 760 = RMD1, 790 = MCNT; blocks y 850: left = payload returned, right = TX done. + */ +#define RAP 0x05900000 +#define RDP 0x05800000 +#define MARK 0x018D0000 /* after .text (which now reaches 0x018CACD0) */ +#define VRAM_BASE 0x04000000 + +#define MODE_LOOP 0x0004 +#define MODE_INTL 0x0040 +#define CSR0_STOP 0x0004 +#define CSR0_STRT 0x0002 +#define CSR0_INIT 0x0001 +#define CSR0_TDMD 0x0008 +#define CSR0_IDON 0x0100 +#define RMD1_OWN 0x8000 +#define RMD1_ENP 0x0100 +#define RMD1_STP 0x0200 +#define TMD1_OWN 0x8000 +#define TMD1_ENP 0x0100 +#define TMD1_STP 0x0200 + +/* Memory layout (BYTE addresses; the rings are 8-byte descriptors): + * + * 0x3000 init block (12 words = 24 B) + * 0x3020 RX ring, 16 entries -> 0x3020..0x309F + * 0x30C0 TX ring, 8 entries -> 0x30C0..0x30FF + * 0x3180 TX buffer + * 0x4000 RX buffers, RXBUFLEN apart + * + * The TX ring used to sit at 0x3060, which was fine while the RX ring had 8 + * entries (0x3020..0x305F) but silently overlapped once it grew to 16. The + * chip then set OWN in what we believed were our TX descriptors, so every + * reply was discarded as "owned but not start-of-packet" and never reached + * the wire. Keep the two rings apart: NRX*8 must not reach TXR. + */ +#define B(byte) ((unsigned int)(byte) * 8) /* bit address of a byte */ +#define INITB B(0x3000) +#define RXR B(0x3020) +#define TXR B(0x30C0) +#define RXBUF B(0x3200) +#define TXBUF B(0x3180) +#define NRX 16 +#define RXBUFLEN 1526 /* one full 1514-byte MTU frame + margin */ +#define ETHCMD 0x88B6 + +/* Compile-time guard: the RX ring must end before the TX ring starts. + * (Bit addresses: NRX descriptors of 64 bits each.) Violating this is what + * broke the first version of this payload, and it fails silently at runtime. */ +typedef char rx_tx_rings_do_not_overlap[(RXR + NRX * 64 <= TXR) ? 1 : -1]; + +/* Re-arm one RX descriptor the way NetBSD's am7990_rint() does: message count + * and length first, ownership last, so the chip cannot take the descriptor + * while its length field is stale. */ +#define REARM_RX(i, buf) do { \ + w16(RXR + (i) * 64 + 48, 0); \ + w16(RXR + (i) * 64 + 32, (0x10000 - RXBUFLEN) & 0xFFFF); \ + w16(RXR + (i) * 64 + 16, RMD1_OWN | (((buf) >> 16) & 0xFF)); \ +} while (0) + +#define RING_ENTRIES 8 + +static void cell(off, v) +unsigned int off, v; +{ + *(unsigned int *)(MARK + off) = v; +} + +static void w16(bit, v) +unsigned int bit, v; +{ + *(unsigned short *)bit = v; +} + +static unsigned int r16(bit) +unsigned int bit; +{ + return *(unsigned short *)bit; +} + +static unsigned int rb(bit) +unsigned int bit; +{ + return *(unsigned char *)bit; +} + +static void wb(bit, v) +unsigned int bit, v; +{ + *(unsigned char *)bit = v; +} + +static void rect(x, y, w, h, v) +unsigned int x, y, w, h, v; +{ + unsigned int row, col; + for (row = 0; row < h; row++) { + for (col = 0; col < w; col = col + 8) { + *(unsigned char *)(VRAM_BASE + (y + row) * 2048 + x + col) = v; + } + } +} + +static void bits16(x, y, v) +unsigned int x, y, v; +{ + unsigned int b; + for (b = 0; b < 16; b++) { + rect(x + b * 30, y, 24, 24, (v & (1 << b)) ? 0xFF : 0x00); + } +} + +static void dot(n) +unsigned int n; +{ + rect(60, 650 + n * 44, 24, 24, 0xFF); +} + +static void settle() +{ + unsigned int i; + for (i = 0; i < 30; i++) { + } +} + +static void csr_w(reg, v) +unsigned int reg, v; +{ + *(unsigned short *)RAP = reg; + settle(); + *(unsigned short *)RDP = v; + settle(); +} + +static unsigned int csr_r(reg) +unsigned int reg; +{ + unsigned int v; + *(unsigned short *)RAP = reg; + settle(); + v = *(unsigned short *)RDP; + settle(); + return v; +} + +/* ---- 5x7 text ------------------------------------------------------- + * Glyphs are built at runtime: this toolchain never runs .cinit, so a + * statically initialised table would arrive as zeros (same reason + * harness/c-hello builds its font in code). + */ +static unsigned char glyph[36][7]; +static unsigned char lab_csr0[5], lab_csr1[5], lab_tmd1[5], lab_rmd1[5]; +static unsigned char lab_mcnt[5], lab_rest[5], lab_ok[3], lab_yes[4], lab_no[3]; +static unsigned char lab_mac1[5], lab_mac2[5]; + +static unsigned int gi(ch) +unsigned int ch; +{ + if (ch >= '0' && ch <= '9') { + return ch - '0'; + } + return 10 + (ch - 'A'); +} + +static void fset(i, r0, r1, r2, r3, r4, r5, r6) +unsigned int i, r0, r1, r2, r3, r4, r5, r6; +{ + glyph[i][0] = r0; glyph[i][1] = r1; glyph[i][2] = r2; glyph[i][3] = r3; + glyph[i][4] = r4; glyph[i][5] = r5; glyph[i][6] = r6; +} + +static void build_font() +{ + fset(0, 0x0E,0x11,0x13,0x15,0x19,0x11,0x0E); /* 0 */ + fset(1, 0x04,0x0C,0x04,0x04,0x04,0x04,0x0E); /* 1 */ + fset(2, 0x0E,0x11,0x01,0x02,0x04,0x08,0x1F); /* 2 */ + fset(3, 0x1F,0x02,0x04,0x02,0x01,0x11,0x0E); /* 3 */ + fset(4, 0x02,0x06,0x0A,0x12,0x1F,0x02,0x02); /* 4 */ + fset(5, 0x1F,0x10,0x1E,0x01,0x01,0x11,0x0E); /* 5 */ + fset(6, 0x06,0x08,0x10,0x1E,0x11,0x11,0x0E); /* 6 */ + fset(7, 0x1F,0x01,0x02,0x04,0x08,0x08,0x08); /* 7 */ + fset(8, 0x0E,0x11,0x11,0x0E,0x11,0x11,0x0E); /* 8 */ + fset(9, 0x0E,0x11,0x11,0x0F,0x01,0x02,0x0C); /* 9 */ + fset(gi('A'), 0x0E,0x11,0x11,0x1F,0x11,0x11,0x11); + fset(gi('B'), 0x1E,0x11,0x11,0x1E,0x11,0x11,0x1E); + fset(gi('C'), 0x0E,0x11,0x10,0x10,0x10,0x11,0x0E); + fset(gi('D'), 0x1E,0x11,0x11,0x11,0x11,0x11,0x1E); + fset(gi('E'), 0x1F,0x10,0x10,0x1E,0x10,0x10,0x1F); + fset(gi('F'), 0x1F,0x10,0x10,0x1E,0x10,0x10,0x10); + fset(gi('K'), 0x11,0x12,0x14,0x18,0x14,0x12,0x11); + fset(gi('M'), 0x11,0x1B,0x15,0x15,0x11,0x11,0x11); + fset(gi('N'), 0x11,0x19,0x19,0x15,0x13,0x13,0x11); + fset(gi('O'), 0x0E,0x11,0x11,0x11,0x11,0x11,0x0E); + fset(gi('R'), 0x1E,0x11,0x11,0x1E,0x14,0x12,0x11); + fset(gi('S'), 0x0F,0x10,0x10,0x0E,0x01,0x01,0x1E); + fset(gi('T'), 0x1F,0x04,0x04,0x04,0x04,0x04,0x04); + fset(gi('X'), 0x11,0x11,0x0A,0x04,0x0A,0x11,0x11); + fset(gi('Y'), 0x11,0x11,0x0A,0x04,0x04,0x04,0x04); +} + +static void put4(a, c0, c1, c2, c3) +unsigned char *a; +unsigned int c0, c1, c2, c3; +{ + a[0] = c0; a[1] = c1; a[2] = c2; a[3] = c3; a[4] = 0; +} + +static void draw_glyph(x, y, ch) +unsigned int x, y, ch; +{ + unsigned int r, c, row, idx; + + idx = gi(ch); + for (r = 0; r < 7; r++) { + row = glyph[idx][r]; + for (c = 0; c < 5; c++) { + if (row & (1 << (4 - c))) { + rect(x + c * 8, y + r * 3, 8, 3, 0xFF); + } + } + } +} + +static void draw_text(x, y, s) +unsigned int x, y; +unsigned char *s; +{ + while (*s) { + if (*s != ' ') { + draw_glyph(x, y, *s); + } + x = x + 48; + s = s + 1; + } +} + +static void hex4(x, y, v) +unsigned int x, y, v; +{ + unsigned int d, nib; + + /* Wipe the field first. Only the glyph pixels were being written before, + * so 0005 drawn over 1234 left the tails of the old digits on screen. */ + rect(x, y, 200, 24, 0x00); + + for (d = 0; d < 4; d++) { + nib = (v >> ((3 - d) * 4)) & 0xF; + if (nib < 10) { + draw_glyph(x + d * 48, y, '0' + nib); + } else { + draw_glyph(x + d * 48, y, 'A' + nib - 10); + } + } +} + +int main() +{ + unsigned int i, n, idle, rxf, bytes, cmds, laststat, txslot, ncmd; + unsigned int buf, len, et, j, rmd1, chaindrop, txfull, errbits; + unsigned int jaddr, dojump; + + cell(0x000, 1); + build_font(); + put4(lab_csr0, 'R', 'X', 'F', ' '); + put4(lab_csr1, 'K', 'B', ' ', ' '); + put4(lab_tmd1, 'C', 'M', 'D', ' '); + put4(lab_rmd1, 'S', 'T', 'A', 'T'); + put4(lab_mcnt, 'C', 'S', 'R', '0'); + put4(lab_rest, 'R', 'E', 'S', 'T'); + dot(0); + + /* ---- chip: normal mode, our MAC, broadcast accepted ---- */ + csr_w(0, CSR0_STOP); + w16(INITB + 0 * 16, 0x0000); + w16(INITB + 1 * 16, 0x0008); + w16(INITB + 2 * 16, 0x162b); + w16(INITB + 3 * 16, 0x5a4b); + w16(INITB + 4 * 16, 0); w16(INITB + 5 * 16, 0); + w16(INITB + 6 * 16, 0); w16(INITB + 7 * 16, 0); + w16(INITB + 8 * 16, (RXR >> 3) & 0xFFFF); + w16(INITB + 9 * 16, 4 << 13); /* 16 RX descriptors */ + w16(INITB + 10 * 16, (TXR >> 3) & 0xFFFF); + w16(INITB + 11 * 16, 3 << 13); /* 8 TX descriptors */ + + for (i = 0; i < NRX; i++) { + buf = 0x4000 + i * RXBUFLEN; + w16(RXR + i * 64 + 0, buf & 0xFFFF); + w16(RXR + i * 64 + 16, RMD1_OWN | ((buf >> 16) & 0xFF)); + w16(RXR + i * 64 + 32, (0x10000 - RXBUFLEN) & 0xFFFF); + w16(RXR + i * 64 + 48, 0); + } + for (i = 0; i < 8; i++) { + w16(TXR + i * 64 + 0, (TXBUF >> 3) & 0xFFFF); + w16(TXR + i * 64 + 16, ((TXBUF >> 3) >> 16) & 0xFF); + w16(TXR + i * 64 + 32, 0xF000); + w16(TXR + i * 64 + 48, 0); + } + + csr_w(1, (INITB >> 3) & 0xFFFF); + csr_w(2, ((INITB >> 3) >> 16) & 0xFF); + csr_w(3, 0); + csr_w(0, 0x7F41); + for (idle = 0; idle < 20000; idle++) { + if (csr_r(0) & CSR0_IDON) { + break; + } + } + csr_w(0, 0x0042); + dot(1); + + /* the ring is live from here: draw the panel only now, so frames + * that arrive during the (slow) VRAM fill are not missed */ + rect(100, 650, 512, 256, 0x00); + rect(100, 650, 512, 4, 0xFF); + rect(100, 902, 512, 4, 0xFF); + rect(100, 650, 8, 256, 0xFF); + rect(608, 650, 8, 256, 0xFF); + + + + rxf = 0; bytes = 0; cmds = 0; laststat = 0xEEEE; txslot = 0; ncmd = 0; + chaindrop = 0; txfull = 0; errbits = 0; jaddr = 0; dojump = 0; + + /* ---- main loop: receive, count, and serve commands ---- */ + for (idle = 0; ; idle++) { + for (i = 0; i < NRX; i++) { + rmd1 = r16(RXR + i * 64 + 16); + if (rmd1 & RMD1_OWN) { + continue; + } + buf = 0x4000 + i * RXBUFLEN; + len = r16(RXR + i * 64 + 48) & 0x0FFF; + /* Every reference driver (4.4BSD pmax if_le.c, NetBSD am7990.c, + * Linux 7990.c) requires STP *and* ENP on the same descriptor and + * drops a frame that spans descriptors instead of reassembling it. + * Testing ENP alone would count the tail of a jumbo frame as a + * frame and parse it from the middle of the buffer. */ + if ((rmd1 & (RMD1_STP | RMD1_ENP)) != (RMD1_STP | RMD1_ENP)) { + chaindrop = chaindrop + 1; + REARM_RX(i, buf); + continue; + } + if (len < 60) { + len = 60; + } + rxf = rxf + 1; + /* the chip writes the 4-byte FCS into the buffer and includes it + * in RMD3; all three drivers subtract it (`mblength - 4`) */ + if (len > 4) { + bytes = bytes + len - 4; + } + et = (rb((buf + 12) * 8) << 8) | rb((buf + 13) * 8); + ncmd = ncmd + 1; + + /* command frame? ethertype 0x88B6, then 'K' 'S' ... */ + if (et == ETHCMD && rb((buf + 14) * 8) == 'K' && rb((buf + 15) * 8) == 'S') { + unsigned int cmd, addr, rlen, k, v; + cmd = rb((buf + 16) * 8); + addr = ((rb((buf + 17) * 8) << 24) | (rb((buf + 18) * 8) << 16) | + (rb((buf + 19) * 8) << 8) | rb((buf + 20) * 8)); + rlen = (rb((buf + 21) * 8) << 8) | rb((buf + 22) * 8); + cmds = cmds + 1; + laststat = 0; + + /* reply layout: [16]=cmd, [17..18]=status, [19..]=data */ + for (j = 0; j < 6; j++) { + wb(TXBUF + j * 8, rb((buf + 6 + j) * 8)); /* dst = requester */ + } + /* src = our own MAC. This used to copy the request's + * destination (a broadcast address) and a frame with a + * multicast source is dropped by the tap, so replies never + * arrived even though the command was handled. */ + wb(TXBUF + 6 * 8, 0x08); wb(TXBUF + 7 * 8, 0x00); + wb(TXBUF + 8 * 8, 0x2B); wb(TXBUF + 9 * 8, 0x16); + wb(TXBUF + 10 * 8, 0x4B); wb(TXBUF + 11 * 8, 0x5A); + wb(TXBUF + 12 * 8, 0x88); wb(TXBUF + 13 * 8, 0xB6); + wb(TXBUF + 14 * 8, 'K'); wb(TXBUF + 15 * 8, 'S'); + wb(TXBUF + 16 * 8, cmd); + + len = 60; + if (cmd == 1) { + /* read memory: addr is a bit address, rlen bytes */ + if (rlen > 64) { + rlen = 64; + laststat = 0xE001; + } + for (k = 0; k < 19 + rlen; k++) { + wb(TXBUF + (19 + k) * 8, 0); + } + for (k = 0; k < rlen; k++) { + v = rb(addr + k * 8); + wb(TXBUF + (19 + k) * 8, v); + } + if (19 + rlen > 60) { + len = 19 + rlen; + } + } else if (cmd == 2) { + /* statistics: rxf(4) bytes(4) cmds(2) chaindrop(2) txfull(2) */ + wb(TXBUF + 19 * 8, (rxf >> 24) & 0xFF); + wb(TXBUF + 20 * 8, (rxf >> 16) & 0xFF); + wb(TXBUF + 21 * 8, (rxf >> 8) & 0xFF); + wb(TXBUF + 22 * 8, rxf & 0xFF); + wb(TXBUF + 23 * 8, (bytes >> 24) & 0xFF); + wb(TXBUF + 24 * 8, (bytes >> 16) & 0xFF); + wb(TXBUF + 25 * 8, (bytes >> 8) & 0xFF); + wb(TXBUF + 26 * 8, bytes & 0xFF); + wb(TXBUF + 27 * 8, (cmds >> 8) & 0xFF); + wb(TXBUF + 28 * 8, cmds & 0xFF); + wb(TXBUF + 29 * 8, (chaindrop >> 8) & 0xFF); + wb(TXBUF + 30 * 8, chaindrop & 0xFF); + wb(TXBUF + 31 * 8, (txfull >> 8) & 0xFF); + wb(TXBUF + 32 * 8, txfull & 0xFF); + wb(TXBUF + 33 * 8, (errbits >> 8) & 0xFF); + wb(TXBUF + 34 * 8, errbits & 0xFF); + } else if (cmd == 3) { + /* poke: the request carries the bytes from [23] on. + * `addr` is a BIT address, like every other address in + * this payload, so a byte address must be sent as + * byte_addr * 8. */ + unsigned int wlen; + wlen = rlen; + if (wlen > 1024) { /* one frame holds this */ + wlen = 1024; + laststat = 0xE003; + } + for (k = 0; k < wlen; k++) { + wb(addr + k * 8, rb((buf + 23 + k) * 8)); + } + wb(TXBUF + 19 * 8, (wlen >> 8) & 0xFF); + wb(TXBUF + 20 * 8, wlen & 0xFF); + } else if (cmd == 4 || cmd == 5) { + /* jump (4) to an address, or reboot (5): jump to the ROM + * reset vector, which is the same entry the CPU takes at + * power-on. Its first instruction is DINT and it then + * initialises both DUARTs, so it does not depend on state + * this payload leaves behind. The reply is transmitted + * below, before control is transferred. */ + if (cmd == 5) { + jaddr = *(unsigned int *)0xFFFFFFE0; + } else { + jaddr = addr; + } + dojump = 1; + wb(TXBUF + 19 * 8, (jaddr >> 24) & 0xFF); + wb(TXBUF + 20 * 8, (jaddr >> 16) & 0xFF); + wb(TXBUF + 21 * 8, (jaddr >> 8) & 0xFF); + wb(TXBUF + 22 * 8, jaddr & 0xFF); + } else { + laststat = 0xE002; + } + wb(TXBUF + 17 * 8, (laststat >> 8) & 0xFF); + wb(TXBUF + 18 * 8, laststat & 0xFF); + + /* All the reference drivers check that the ring slot is free + * before reusing it (Linux stops the queue, NetBSD prints + * "missing buffer", 4.4BSD panics) -- we just skip. */ + if (r16(TXR + txslot * 64 + 16) & TMD1_OWN) { + txfull = txfull + 1; + } else { + w16(TXR + txslot * 64 + 48, 0); /* TMD3 */ + w16(TXR + txslot * 64 + 32, (0x10000 - len) & 0xFFFF); + w16(TXR + txslot * 64 + 16, + TMD1_OWN | TMD1_STP | TMD1_ENP | (((TXBUF >> 3) >> 16) & 0xFF)); + /* 4.4BSD/NetBSD/Linux all kick with TDMD|INEA only; a + * repeated start (STRT) is not part of any of them. */ + csr_w(0, 0x0040 | CSR0_TDMD); + for (j = 0; j < 20000; j++) { + if (!(r16(TXR + txslot * 64 + 16) & TMD1_OWN)) { + break; + } + } + } + txslot = (txslot + 1) & 7; + + if (dojump) { + /* the reply has been transmitted (or waited on) above; + * from here this payload does not return */ + void (*fp)(); + fp = (void (*)()) jaddr; + (*fp)(); + } + } + /* re-arm immediately (length and count first, ownership last, as + * NetBSD does: rmd1_bits = OWN; rmd2 = -LEBLEN|ONES; rmd3 = 0) */ + REARM_RX(i, buf); + } + /* sticky chip error bits: ERR|BABL|CERR|MISS|MERR. MISS set means + * the chip had no descriptor to receive into (ring too small / loop + * too slow); clear means the frames never reached the chip. */ + errbits = errbits | (csr_r(0) & 0xF800); + + /* publish counters as we go */ + cell(0x160, rxf); cell(0x180, bytes); cell(0x1A0, cmds); cell(0x200, laststat); + if ((idle & 0xFFF) == 0) { + draw_text(104, 654, lab_csr0); hex4(312, 654, rxf); + draw_text(104, 686, lab_csr1); hex4(312, 686, bytes >> 10); + draw_text(104, 718, lab_tmd1); hex4(312, 718, cmds); + draw_text(104, 750, lab_rmd1); hex4(312, 750, laststat); + draw_text(104, 782, lab_mcnt); hex4(312, 782, csr_r(0)); + } + } + return 0; +} diff --git a/harness/udpstream/vtcmd.py b/harness/udpstream/vtcmd.py new file mode 100644 index 0000000..8967cd1 --- /dev/null +++ b/harness/udpstream/vtcmd.py @@ -0,0 +1,293 @@ +#!/usr/bin/env python3 +"""vtcmd.py -- talk to the LANCE command payload (harness/udpstream/lance_cmd.c). + +The payload runs entirely on its own (no OS stack), so this is the only way to +inspect the machine while it owns the chip. + +Protocol, ethertype 0x88B6, both directions: + + [14] 'K' [15] 'S' [16] cmd + cmd 1 read : [17..20] address (32-bit big-endian BIT address), [21..22] len + cmd 2 stats: no arguments + cmd 3 poke : [17..20] address (BIT), [21..22] len, [23..] the bytes + cmd 4 jump : [17..20] address (BIT) -- reply is sent, then control moves + cmd 5 reboot: no arguments -- jumps to the ROM reset vector + reply : [16] cmd echoed, [17..18] status, [19..] data + +Every address in this protocol is a BIT address, the way the TMS34010 sees +memory. For a byte address, send byte_addr * 8. + +Usage: + + # one-off statistics (frames/bytes the payload has seen) + sudo python3 vtcmd.py stats --iface vt1200 + + # write 4 bytes at bit address 0x018D0300 (byte 0x31A60) + sudo python3 vtcmd.py poke --iface vt1200 --addr 0x018D0300 --data "de ad be ef" + + # run code at an address, or soft-reset the machine back into the firmware + sudo python3 vtcmd.py jump --iface vt1200 --addr 0x018C0000 + sudo python3 vtcmd.py reboot --iface vt1200 + + # read 32 bytes of memory at bit address 0x018D0000 + sudo python3 vtcmd.py read --iface vt1200 --addr 0x018D0000 --len 32 + + # throughput: blast N frames, then ask the payload how many it counted + sudo python3 vtcmd.py bench --iface vt1200 --count 4000 --size 1514 +""" +import argparse +import socket +import struct +import sys +import time + +ETHCMD = 0x88B6 +VT_MAC = bytes.fromhex("08002b164b5a") + + +def parse_mac(s): + return bytes(int(p, 16) for p in s.split(":")) + + +def iface_mac(iface): + with open("/sys/class/net/%s/address" % iface) as f: + return parse_mac(f.read().strip()) + + +def open_sock(iface): + s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(ETHCMD)) + s.bind((iface, 0)) + return s + + +def frame(iface, cmd, addr=0, length=0, size=60, payload=b""): + src = iface_mac(iface) + body = bytes([ord('K'), ord('S'), cmd]) + struct.pack(">I", addr) + \ + struct.pack(">H", length) + payload + body = body + bytes(max(0, size - 14 - len(body))) + return b"\xff" * 6 + src + struct.pack(">H", ETHCMD) + body + + +def request(sock, iface, cmd, addr=0, length=0, timeout=2.0, tries=3, + payload=b""): + """Send a command and wait for its reply. + + Retried because the first frame after the payload takes the chip over is + routinely lost: the ring is armed slightly before the receive loop runs. + """ + for attempt in range(tries): + sock.send(frame(iface, cmd, addr, length, + size=max(60, 23 + len(payload)), payload=payload)) + end = time.time() + timeout + sock.settimeout(0.2) + while time.time() < end: + try: + data, addr_in = sock.recvfrom(2048) + except socket.timeout: + continue + if len(data) < 19: + continue + if data[12:14] != struct.pack(">H", ETHCMD): + continue + if data[14:16] != b"KS": + continue + if data[16] != cmd: + continue + status = (data[17] << 8) | data[18] + return status, data[19:] + return None, None + + +def cmd_stats(sock, iface, quiet=False): + status, data = request(sock, iface, 2) + if status is None: + if not quiet: + print("no reply -- is the payload running and the link up?") + return None + rxf, nbytes, cmds, chaindrop, txfull, errbits = struct.unpack(">IIHHHH", data[:16]) + flags = [] + if errbits & 0x1000: + flags.append("MISS(no descriptor)") + if errbits & 0x0800: + flags.append("MERR") + if errbits & 0x4000: + flags.append("BABL") + if errbits & 0x2000: + flags.append("CERR") + if errbits & 0x8000: + flags.append("ERR") + if not quiet: + print("payload: RXF=%d bytes=%d cmds=%d chained_dropped=%d txfull=%d " + "csr0_err=%#06x%s status=%#06x" + % (rxf, nbytes, cmds, chaindrop, txfull, errbits, + (" [" + ",".join(flags) + "]") if flags else " [none]", status)) + return rxf, nbytes, cmds, chaindrop, txfull, errbits + + +def main(): + ap = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument("cmd", choices=["stats", "read", "poke", "jump", + "reboot", "bench"]) + ap.add_argument("--iface", default="vt1200") + ap.add_argument("--addr", type=lambda v: int(v, 0), default=0) + ap.add_argument("--len", type=int, default=32) + ap.add_argument("--data", default="", help="poke: bytes, e.g. 'de ad be ef'") + ap.add_argument("--file", default="", help="poke: read the bytes from a file") + ap.add_argument("--count", type=int, default=0, + help="send exactly N frames instead of a timed burst") + ap.add_argument("--seconds", type=float, default=3.0, + help="duration of the timed burst when --count is 0") + ap.add_argument("--size", type=int, default=1514) + ap.add_argument("--etype", type=lambda v: int(v, 0), default=0x88B7, + help="ethertype for benchmark frames (must NOT be 0x88B6, " + "or the payload answers every one of them)") + ap.add_argument("--dst", default="ff:ff:ff:ff:ff:ff", + help="destination MAC; unicast avoids the switch's " + "broadcast storm control") + ap.add_argument("--rate", type=float, default=0, + help="pace to at most N frames/s (0 = as fast as possible)") + ap.add_argument("--busy", action="store_true", + help="busy-wait instead of time.sleep while pacing; " + "sleep granularity is ~250us and bunches frames " + "into microbursts that the switch drops") + ap.add_argument("--terse", action="store_true", + help="one CSV line per run, for sweeps and for the report") + ap.add_argument("--timeout", type=float, default=2.0) + a = ap.parse_args() + + sock = open_sock(a.iface) + + if a.cmd == "stats": + return 0 if cmd_stats(sock, a.iface) else 1 + + if a.cmd == "read": + status, data = request(sock, a.iface, 1, a.addr, a.len, a.timeout) + if status is None: + print("no reply") + return 1 + print("read %#010x len %d status %#06x:" % (a.addr, a.len, status)) + for i in range(0, min(len(data), a.len), 16): + print(" %04x %s" % (i, data[i:i + 16].hex(" "))) + return 0 + + if a.cmd == "poke": + if a.file: + with open(a.file, "rb") as f: + blob = f.read() + else: + blob = bytes(int(b, 16) for b in a.data.replace(",", " ").split()) + if not blob: + print("nothing to poke: use --data or --file") + return 1 + status, data = request(sock, a.iface, 3, a.addr, len(blob), a.timeout, + payload=blob) + if status is None: + print("no reply") + return 1 + print("poked %d bytes at bit %#010x (byte %#x) status %#06x" + % (len(blob), a.addr, a.addr >> 3, status)) + return 0 + + if a.cmd in ("jump", "reboot"): + cmd = 4 if a.cmd == "jump" else 5 + status, data = request(sock, a.iface, cmd, a.addr, 0, a.timeout) + if status is None: + print("no reply") + return 1 + target = struct.unpack(">I", data[:4])[0] if len(data) >= 4 else 0 + print("%s: control -> bit %#010x (byte %#x), status %#06x" + % (a.cmd, target, target >> 3, status)) + print("the payload has handed control over; it will not answer again") + return 0 + + # bench: offer frames continuously for --seconds, then let the payload's + # counter settle. A fixed-duration burst makes the window long enough that + # the settle time is negligible, and retrying on ENOBUFS paces the host to + # whatever its socket buffer allows instead of aborting. + before = cmd_stats(sock, a.iface, quiet=a.terse) + size = max(a.size, 60) + body = bytes(size - 14) + f = parse_mac(a.dst) + iface_mac(a.iface) + struct.pack(">H", a.etype) + body + sent = 0 + t0 = time.time() + if a.count: + for i in range(a.count): + try: + sock.send(f) + sent += 1 + except OSError: + time.sleep(0.001) + sock.send(f) + sent += 1 + else: + while time.time() - t0 < a.seconds: + if a.rate: + want = sent / a.rate + behind = want - (time.time() - t0) + if behind > 0: + if a.busy: + end = time.time() + behind + while time.time() < end: + pass + else: + time.sleep(behind) + try: + sock.send(f) + sent += 1 + except OSError: + time.sleep(0.001) + t1 = time.time() + + # poll until the *data* counter is stable (each stats request is itself a + # received command frame, so comparing rxf alone would never settle) + after = before + quiet = 0 + last = before[0] - before[2] + deadline = time.time() + 15.0 + while time.time() < deadline: + time.sleep(0.2) + now = cmd_stats(sock, a.iface, quiet=a.terse) + if not now: + break + after = now + cur = now[0] - now[2] + if cur == last: + quiet += 1 + if quiet >= 2: + break + else: + quiet = 0 + last = cur + t2 = time.time() + + if before and after and after[0] >= before[0]: + dt = t1 - t0 + dcmds = after[2] - before[2] # our own stats frames + frames = (after[0] - before[0]) - dcmds + nbytes = (after[1] - before[1]) - 60 * dcmds + if a.terse: + print("%d,%g,%.2f,%d,%d,%d,%.0f,%.1f,%.2f,%.1f,%#06x,%d,%d" + % (size, a.rate, dt, sent, frames, nbytes, + frames / dt if dt else 0, + nbytes / 1024.0 / dt if dt else 0, + nbytes * 8 / dt / 1e6 if dt else 0, + 100.0 * frames / sent if sent else 0, + after[5], after[4], after[3])) + return 0 + print("sent %d frames of %d B over %.3f s (%.0f frames/s offered)" + % (sent, size, dt, sent / dt if dt else 0)) + print("payload received %d frames (%d bytes) while they were offered" + % (frames, nbytes)) + print(" receive rate: %.0f frames/s, %.1f KiB/s, %.1f Mbit/s" + % (frames / dt if dt else 0, + nbytes / 1024.0 / dt if dt else 0, + nbytes * 8 / dt / 1e6 if dt else 0)) + print(" delivery ratio: %.1f%% (below 100%% = the ring or the wire " + "could not keep up)" % (100.0 * frames / sent if sent else 0)) + print(" drain after the burst: %.2f s" % max(0.0, t2 - t1)) + return 0 + + +if __name__ == "__main__": + sys.exit(main())