The 1987 DOS toolchain (GSPA/GSPLNK/GSPROM) runs under DOSBox and
reassembles 32 KB of the v2.2 ROM byte-for-byte after five documented
fixups to smart34010 output. The 1990 r5.01 tools are OS/2 NE and do
not run in DOS. Adds the converter, round-trip script, and the
DOSBox/dosemu benchmark.
Add the Am7990 Technical Manual and Am79C90 datasheet to
reference/lance-datasheet/ and a report, reference/lance-loopback-fcs.md,
that answers whether MAME's am79c90 receive() FCS condition
(!(MODE_LOOP) || MODE_DTCR) is inverted.
Verdict: MAME is right. The CRC generator and checker share one circuit,
so with LOOP=1 the receiver can only check the FCS when DTCR=1 -- exactly
what MAME does. The proposed inversion would be wrong in both loopback
cases. No MAME change made.
Answers the five sub-questions from the service guide, the linear dis34 dump,
the existing reports, and one empirical capture:
* level 1 runs unconditionally at power-up; the boot calls the level-1 runner
at bit 0x3F204400 (calla L3FDF72D0). The only conditional at the call site is
the DUART1 IP3 hardware input bit (firmware @0x64000D0 bit 3), not a stored
value.
* the host-port test has no 'not installed' sense; only SIMMs (@0x5000000) and
the Image Option (@0x62000D0 bit 5) have presence checks.
* no persistent test-selection record: the power-up test set is a hard-coded
ROM immediate (0x10FEFD80) written into a RAM descriptor; the interactive
menu and NCP P3 only modify a run. NVRAM is read only by the user-settings
code, never on the level-1 path.
* a level-1 failure wedges the boot in the board-LED code loop (0x3F208060,
jruc itself); transcript = LEVEL1/2 TESTING, HOST PORT - 15, TYPE 'GO' TO
CONTINUE, then the LED loop.
* the one in-ROM bypass (0x3F2043B0 -> OS cold-start 0x3F5788C0) is a
board-input gate (IP3 high + no 0x55 signature); it skips all of level 1,
not just the host port, and is not a firmware setting.
Verdict: no persistent/configurable skip; harness must pass level 1 or assert
DUART1 IP3 (0x0640000D bit 3) to take the OS branch.
Evidence + scratch: reference/l1probe/.
Download the SCN2681 (Philips 1995), SCC2681, SCN68681 and MC68HC681 UM
datasheets into reference/duart-datasheet/ with pdftotext extractions, and
audit each claimed justification against them:
Claim 1 (TxRDY asserted in tra_complete, not tra_callback): REFUTED.
The quoted p.7 sentence is real, but SCN2681 p.22 says explicitly
'TxRDY sets at the end of the start bit time' -- which is exactly the
removed upstream behaviour. Upstream was right.
Claim 2 (overrun latched on the start bit, not completion): CONFIRMED.
'the overrun error status bit (SR[4]) will be set upon receipt of the
start bit of the new (overrunning) character' (p.8, also SRA[4] p.14).
Caveats: p.8 also says errors are 'strobed ... at the received
character boundary' (internal tension); and a valid start bit is
validated ~half a bit after the falling edge, not at it.
Claim 3 (3-deep FIFO, 4th held, overrun on 5th; MAME faithful): CONFIRMED.
'capacity of three characters' + 4th held in the shift register (p.8);
MAME's SIZE+1 guard overruns exactly on the 5th.
Also snapshot the worker's uncommitted MAME diff and upstream 0.289 code.
SDD