From 9b3f02cf0294946721e726ecf65b91329a9c5819 Mon Sep 17 00:00:00 2001
From: Arti Zirk <arti.zirk@gmail.com>
Date: Fri, 30 Oct 2026 17:39:27 +0200
Subject: [PATCH] udpstream: DRAM benchmark writes to a .bss buffer, not a
 guessed address

cmd 9's first version wrote to 0x01A10000 (bits), chosen as "above MARK, below
.bss".  On the unit that was not usable RAM: no reply in 120 s and the machine
stopped answering ping and rdebug -- one power cycle.

The target is now `static unsigned char drambuf[512]`, placed by the linker
inside .bss, which the payload already relies on for its labels and strings.
Loop and store count are unchanged, so the per-store figure stays comparable.

Report 74.5 records it.
---
 harness/mame/NETWORK_REPORT.md         |  17 +++++++++++++++++
 harness/udpstream/build/lance_cmd.coff | Bin 9457 -> 9457 bytes
 harness/udpstream/lance_cmd.c          |  10 +++++++++-
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index 3dda0e9..2e2bd31 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -5021,3 +5021,20 @@ filled 300 frame(s) x 1024 rows (FILL L): 24576000 stores in 9.775 s
 9.8 s of full-screen black/white flash at ~31 fps — the operator's own
 description was "damn that's fast". It also shows the number is sustained, not a
 one-frame burst.
+
+### 74.5 A failed measurement that cost a power cycle
+
+`cmd 9` first wrote its 163,840 bytes to a hardcoded address, `0x01A10000`
+(bits) — chosen by arithmetic: above MARK (`0x01A00000`) and below `.bss`
+(`0x01C00000`). On the unit that address did **not** behave as RAM: the
+benchmark produced no reply within 120 s, and the machine stopped answering
+ping and rdebug, so it needed a power cycle.
+
+The lesson is the one this project keeps relearning in different clothes: an
+address that is inside a mapped region in the emulator is not evidence that it
+is usable on the board. The benchmark now writes into `static unsigned char
+drambuf[512]` — memory the linker places inside `.bss`, which the payload
+already depends on for every string and label it draws.
+
+Only the *target* changed; the loop and its store count are the same, so the
+per-store cost is still what the benchmark reports.
diff --git a/harness/udpstream/build/lance_cmd.coff b/harness/udpstream/build/lance_cmd.coff
index c88d29ffbbdb2b87f2f7d146826f4629d0647559..5599b99cee03ff359b956a27e17fc781363e8a7f 100644
GIT binary patch
delta 851
zcmez9`O#Bp0s{*J%e5z2&lDLLG#MBeWEhwkIT(*KY~Wx7@)#HtW=&L@&Nyr1u2iOa
zfdh=o_a6Aqz_5J#ga7TZ>f9P&kp)O124Il}BoPa+NCJ|G16afXNyGyzqJSh402W~Y
zioDz2z_6aP!61oq^E~F+EQ|u1tvF^dGBL1BzQU<nFL8j8Z&EyOfJG1E`NcdEeUtkp
zpW$?3=$ot~*f;qRrvXsj4@LeArwdfpN3?J96V3#niaxjs9ihI-IbuKzq;*94CO_kx
z0F*xmmp{X40MvbkGYDjcK;Pua4P5Mu5|cZ)<QXM4ui%p6<$A!Wz;J+(chdvr$p%t3
ze3l1#!h1J6Fl!xHyBjDZCK1JWVRE5_DC5D&>m|)M?~^cP1M2@GXAC4Y<jsL(f;@;l
z1x%ih_o!$1v!3&>K?0`(`#a7Dk_Q;i`o{BKaPMJE;Ou9AFcau_c7|C87~^>vX2saA
z2aBu&izK1RH>|=hA5a^MO@BSy0)x&tYzh$aLIrr`6|9=^%3s)n&4Kj@A3B`IrT`&d
z(1+Cra0fn+X~*jT2NiS=IIzc0?p2)3_+zr7k_)5c<TRy3AbCP5n-du1EWq5s%s6qP
R*ybSRTt>!OlMkpE0surVH(>w(

delta 822
zcmez9`O#Bp0s{-fuPaZoo+&agXfiM`$S^Q7axfle*ucRE<S{TPbWK#6&e*kaS1MCI
z!vV(Sdk_3)U|7EW!T<JHb#4u?$O0r01F%Q~l86OZBmqgp0W9KxB;o-UQ9u$20E;jH
zMc!?1U|7%DV35SQc^>m@7Dk56Rva@JnI14tzQU<n&vAf}Z&EyOfJG1E`NcdEeUtkp
zpW$?3=$ot~*f;qRrvXsj4@LeArwdfpN3?J96V3#niaxjs9ihI-IbuKzq;*94CO_kx
z0F*xmmp{X40MvbkGYDjcK;Pua4P5Mu9Fse^<QX|Oui%p6oopZ#z_O6>?WW0M5>b=y
zNj=#dA~~NGsN{>BF_6@dHwTgl@*wsUFnL1Wqh8_9dd|NF37ih>?>HZD9$-A{8_#>e
zy@xS@v!DGzC(wQD3|$8p<9Qio#n`V0i>w2SB%#SStimrJP#cR)e?8m+gU&c?3J~%_
z1$gBZteWx4U)Y1qf%OO<I-JI)03lz{ht&sg2R@K#$LjzG6?6|cu*XmCRh-QDeX^pG
n3nS;`G^Io!c|s|h6By(yzzo35IB}xb<{;%<M#iqm2UH9J*eEMa

diff --git a/harness/udpstream/lance_cmd.c b/harness/udpstream/lance_cmd.c
index 1fd5201..b309d23 100644
--- a/harness/udpstream/lance_cmd.c
+++ b/harness/udpstream/lance_cmd.c
@@ -64,6 +64,10 @@
 /* read by vram.asm (symbol _vram_pattern) */
 unsigned int vram_pattern;
 
+/* DRAM store benchmark target: 512 bytes is enough to measure the per-store
+ * cost, and the linker guarantees it is memory we own. */
+static unsigned char drambuf[512];
+
 extern void vram_fill_();
 
 /* Compile-time guard: the RX ring must end before the TX ring starts.
@@ -510,6 +514,10 @@ int main()
                      * CPU's store rate is measured without the VRAM arbiter.
                      * This is the number that sizes a frame-expansion stage. */
                     unsigned int nd, fd, yd, xd, od, rd, st;
+                    /* write into a linker-placed .bss buffer: an arbitrary DRAM
+                     * address outside .bss made the unit hang for >120 s, which
+                     * means it was not RAM we own */
+                    unsigned char *db = drambuf;
                     nd = rlen;
                     if (nd > 100) {
                         nd = 100;
@@ -521,7 +529,7 @@ int main()
                     st = 0;
                     for (fd = 0; fd < nd; fd++) {
                         for (yd = 0; yd < rd; yd++) {
-                            od = 0x01A10000 + yd * 2048;
+                            od = (unsigned int)db;
                             for (xd = 0; xd < 160; xd++) {
                                 *(unsigned char *)(od + xd * 8) =
                                     (unsigned char)(yd + xd + fd);