/*
 * lance.c -- LANCE loopback probe using LOW-MEMORY rings.
 *
 * The OS's own init block (pointer at bit 0x23E7A0 -> byte 0xF80 on a live
 * boot) puts its rings at byte 0x0A80 / 0x0E80 and stores only the LENGTH in
 * the ring words' bits 13-15 (0xE000 / 0xA000), with no address bits above 16.
 * MAME's model packs address bits 16+ into that word; if the real C-LANCE does
 * not, a high ring address like 0x380028 is seen as 0x0028.  This payload
 * therefore places the block, rings and buffers below 64 KB.
 *
 * Memory used (BYTE addresses, well below 64 KB):
 *   0x3000 init block (24 B)   0x3020 RX ring (8 * 8 B)   0x3060 TX ring (8 B)
 *   0x3100 TX frame (24 B)     0x3200 RX buffer (2048 B)
 *
 * Result cells at 0x018C8000 (32-bit): 0x160/0x180 CSR0 samples,
 * 0x200 RX RMD1, 0x220 RX MCNT, 0x240 TX TMD1, 0x1A0 payload-found flag.
 *
 * Panel rows (real unit, 256-byte stride): y 670/700 = CSR0, 730 = TMD1,
 * 760 = RMD1, 790 = MCNT; blocks y 850: left = payload returned, right = TX done.
 */
#define RAP        0x05900000
#define RDP        0x05800000
#define MARK       0x018D0000   /* after .text (which now reaches 0x018CACD0) */
#define VRAM_BASE  0x04000000

#define MODE_LOOP  0x0004
#define MODE_INTL  0x0040
#define CSR0_STOP  0x0004
#define CSR0_STRT  0x0002
#define CSR0_INIT  0x0001
#define CSR0_TDMD  0x0008
#define CSR0_IDON  0x0100
#define RMD1_OWN   0x8000
#define TMD1_OWN   0x8000
#define TMD1_ENP   0x0100
#define TMD1_STP   0x0200

#define B(byte)    ((unsigned int)(byte) * 8)   /* bit address of a byte */
#define INITB      B(0x3000)
#define RXR        B(0x3020)
#define TXR        B(0x3060)
#define RXBUF      B(0x3200)
#define TXBUF      B(0x3180)

#define RING_ENTRIES 8

static void cell(off, v)
unsigned int off, v;
{
    *(unsigned int *)(MARK + off) = v;
}

static void w16(bit, v)
unsigned int bit, v;
{
    *(unsigned short *)bit = v;
}

static unsigned int r16(bit)
unsigned int bit;
{
    return *(unsigned short *)bit;
}

static void wb(bit, v)
unsigned int bit, v;
{
    *(unsigned char *)bit = v;
}

static void rect(x, y, w, h, v)
unsigned int x, y, w, h, v;
{
    unsigned int row, col;
    for (row = 0; row < h; row++) {
        for (col = 0; col < w; col = col + 8) {
            *(unsigned char *)(VRAM_BASE + (y + row) * 2048 + x + col) = v;
        }
    }
}

static void bits16(x, y, v)
unsigned int x, y, v;
{
    unsigned int b;
    for (b = 0; b < 16; b++) {
        rect(x + b * 30, y, 24, 24, (v & (1 << b)) ? 0xFF : 0x00);
    }
}

static void dot(n)
unsigned int n;
{
    rect(60, 650 + n * 44, 24, 24, 0xFF);
}

static void settle()
{
    unsigned int i;
    for (i = 0; i < 30; i++) {
    }
}

static void csr_w(reg, v)
unsigned int reg, v;
{
    *(unsigned short *)RAP = reg;
    settle();
    *(unsigned short *)RDP = v;
    settle();
}

static unsigned int csr_r(reg)
unsigned int reg;
{
    unsigned int v;
    *(unsigned short *)RAP = reg;
    settle();
    v = *(unsigned short *)RDP;
    settle();
    return v;
}

/* ---- 5x7 text -------------------------------------------------------
 * Glyphs are built at runtime: this toolchain never runs .cinit, so a
 * statically initialised table would arrive as zeros (same reason
 * harness/c-hello builds its font in code).
 */
static unsigned char glyph[36][7];
static unsigned char lab_csr0[5], lab_csr1[5], lab_tmd1[5], lab_rmd1[5];
static unsigned char lab_mcnt[5], lab_rest[5], lab_ok[3], lab_yes[4], lab_no[3];

static unsigned int gi(ch)
unsigned int ch;
{
    if (ch >= '0' && ch <= '9') {
        return ch - '0';
    }
    return 10 + (ch - 'A');
}

static void fset(i, r0, r1, r2, r3, r4, r5, r6)
unsigned int i, r0, r1, r2, r3, r4, r5, r6;
{
    glyph[i][0] = r0; glyph[i][1] = r1; glyph[i][2] = r2; glyph[i][3] = r3;
    glyph[i][4] = r4; glyph[i][5] = r5; glyph[i][6] = r6;
}

static void build_font()
{
    fset(0, 0x0E,0x11,0x13,0x15,0x19,0x11,0x0E);   /* 0 */
    fset(1, 0x04,0x0C,0x04,0x04,0x04,0x04,0x0E);   /* 1 */
    fset(2, 0x0E,0x11,0x01,0x02,0x04,0x08,0x1F);   /* 2 */
    fset(3, 0x1F,0x02,0x04,0x02,0x01,0x11,0x0E);   /* 3 */
    fset(4, 0x02,0x06,0x0A,0x12,0x1F,0x02,0x02);   /* 4 */
    fset(5, 0x1F,0x10,0x1E,0x01,0x01,0x11,0x0E);   /* 5 */
    fset(6, 0x06,0x08,0x10,0x1E,0x11,0x11,0x0E);   /* 6 */
    fset(7, 0x1F,0x01,0x02,0x04,0x08,0x08,0x08);   /* 7 */
    fset(8, 0x0E,0x11,0x11,0x0E,0x11,0x11,0x0E);   /* 8 */
    fset(9, 0x0E,0x11,0x11,0x0F,0x01,0x02,0x0C);   /* 9 */
    fset(gi('A'), 0x0E,0x11,0x11,0x1F,0x11,0x11,0x11);
    fset(gi('B'), 0x1E,0x11,0x11,0x1E,0x11,0x11,0x1E);
    fset(gi('C'), 0x0E,0x11,0x10,0x10,0x10,0x11,0x0E);
    fset(gi('D'), 0x1E,0x11,0x11,0x11,0x11,0x11,0x1E);
    fset(gi('E'), 0x1F,0x10,0x10,0x1E,0x10,0x10,0x1F);
    fset(gi('F'), 0x1F,0x10,0x10,0x1E,0x10,0x10,0x10);
    fset(gi('K'), 0x11,0x12,0x14,0x18,0x14,0x12,0x11);
    fset(gi('M'), 0x11,0x1B,0x15,0x15,0x11,0x11,0x11);
    fset(gi('N'), 0x11,0x19,0x19,0x15,0x13,0x13,0x11);
    fset(gi('O'), 0x0E,0x11,0x11,0x11,0x11,0x11,0x0E);
    fset(gi('R'), 0x1E,0x11,0x11,0x1E,0x14,0x12,0x11);
    fset(gi('S'), 0x0F,0x10,0x10,0x0E,0x01,0x01,0x1E);
    fset(gi('T'), 0x1F,0x04,0x04,0x04,0x04,0x04,0x04);
    fset(gi('Y'), 0x11,0x11,0x0A,0x04,0x04,0x04,0x04);
}

static void put4(a, c0, c1, c2, c3)
unsigned char *a;
unsigned int c0, c1, c2, c3;
{
    a[0] = c0; a[1] = c1; a[2] = c2; a[3] = c3; a[4] = 0;
}

static void draw_glyph(x, y, ch)
unsigned int x, y, ch;
{
    unsigned int r, c, row, idx;

    idx = gi(ch);
    for (r = 0; r < 7; r++) {
        row = glyph[idx][r];
        for (c = 0; c < 5; c++) {
            if (row & (1 << (4 - c))) {
                rect(x + c * 8, y + r * 3, 8, 3, 0xFF);
            }
        }
    }
}

static void draw_text(x, y, s)
unsigned int x, y;
unsigned char *s;
{
    while (*s) {
        if (*s != ' ') {
            draw_glyph(x, y, *s);
        }
        x = x + 48;
        s = s + 1;
    }
}

static void hex4(x, y, v)
unsigned int x, y, v;
{
    unsigned int d, nib;

    for (d = 0; d < 4; d++) {
        nib = (v >> ((3 - d) * 4)) & 0xF;
        if (nib < 10) {
            draw_glyph(x + d * 48, y, '0' + nib);
        } else {
            draw_glyph(x + d * 48, y, 'A' + nib - 10);
        }
    }
}

int main()
{
    unsigned int i, r, idle, ok, rxmd1, txmd1, mcnt;
    unsigned int s0[2];

    cell(0x000, 1);
    build_font();
    put4(lab_csr0, 'C', 'S', 'R', '0');
    put4(lab_csr1, 'C', 'S', 'R', '1');
    put4(lab_tmd1, 'T', 'M', 'D', '1');
    put4(lab_rmd1, 'R', 'M', 'D', '1');
    put4(lab_mcnt, 'M', 'C', 'N', 'T');
    put4(lab_rest, 'R', 'E', 'S', 'T');
    lab_ok[0] = 'O'; lab_ok[1] = 'K'; lab_ok[2] = 0;
    lab_yes[0] = 'Y'; lab_yes[1] = 'E'; lab_yes[2] = 'S'; lab_yes[3] = 0;
    lab_no[0] = 'N'; lab_no[1] = 'O'; lab_no[2] = 0;
    dot(0);
    csr_w(0, CSR0_STOP);

    rect(100, 650, 512, 256, 0x00);
    rect(100, 650, 512, 4, 0xFF);
    rect(100, 902, 512, 4, 0xFF);
    rect(100, 650, 8, 256, 0xFF);
    rect(608, 650, 8, 256, 0xFF);

    /* init block: mode, PADR, LADRF, RX addr/len, TX addr/len */
    w16(INITB + 0 * 16, MODE_LOOP | MODE_INTL);
    w16(INITB + 1 * 16, 0x0008);
    w16(INITB + 2 * 16, 0x162b);
    w16(INITB + 3 * 16, 0x5a4b);
    w16(INITB + 4 * 16, 0);
    w16(INITB + 5 * 16, 0);
    w16(INITB + 6 * 16, 0);
    w16(INITB + 7 * 16, 0);
    w16(INITB + 8 * 16, RXR >> 3 & 0xFFFF);      /* ring addr low 16 */
    w16(INITB + 9 * 16, 3 << 13);                /* length only: 2^3 = 8 */
    w16(INITB + 10 * 16, TXR >> 3 & 0xFFFF);
    w16(INITB + 11 * 16, 3 << 13);
    cell(0x040, INITB >> 3);
    cell(0x060, RXR >> 3);
    cell(0x080, TXR >> 3);

    /* RX descriptors: all point at the same buffer */
    for (i = 0; i < RING_ENTRIES; i++) {
        w16(RXR + i * 64 + 0, (RXBUF >> 3) & 0xFFFF);
        w16(RXR + i * 64 + 16, RMD1_OWN | (((RXBUF >> 3) >> 16) & 0xFF));
        w16(RXR + i * 64 + 32, 0xFA0A);          /* 0xF000 | -1526: top nibble must be ones */
        w16(RXR + i * 64 + 48, 0);
    }

    /* one 24-byte frame (MAME's loopback accepts 8..32 bytes) */
    wb(TXBUF + 0 * 8, 0x08); wb(TXBUF + 1 * 8, 0x00);
    wb(TXBUF + 2 * 8, 0x2b); wb(TXBUF + 3 * 8, 0x16);
    wb(TXBUF + 4 * 8, 0x4b); wb(TXBUF + 5 * 8, 0x5a);
    wb(TXBUF + 6 * 8, 0x02); wb(TXBUF + 7 * 8, 0x00);
    wb(TXBUF + 8 * 8, 0x00); wb(TXBUF + 9 * 8, 0x00);
    wb(TXBUF + 10 * 8, 0x00); wb(TXBUF + 11 * 8, 0x01);
    wb(TXBUF + 12 * 8, 0x88); wb(TXBUF + 13 * 8, 0xB5);
    wb(TXBUF + 14 * 8, 0xDE); wb(TXBUF + 15 * 8, 0xAD);
    wb(TXBUF + 16 * 8, 0xBE); wb(TXBUF + 17 * 8, 0xEF);
    for (i = 18; i < 24; i++) {
        wb(TXBUF + i * 8, i);
    }

    w16(TXR + 0, (TXBUF >> 3) & 0xFFFF);
    w16(TXR + 16, TMD1_OWN | TMD1_STP | TMD1_ENP | (((TXBUF >> 3) >> 16) & 0xFF));
    w16(TXR + 32, 0xFFE8);                       /* 0xF000 | -24: top nibble must be ones */
    w16(TXR + 48, 0);

    csr_w(1, (INITB >> 3) & 0xFFFF);
    csr_w(2, ((INITB >> 3) >> 16) & 0xFF);
    csr_w(3, 0);
    csr_w(0, CSR0_INIT);
    dot(1);

    r = 0;
    for (idle = 0; idle < 20000; idle++) {
        r = csr_r(0);
        if (r & CSR0_IDON) {
            break;
        }
    }
    cell(0x140, r);
    if (!(r & CSR0_IDON)) {
        cell(0x000, 0xEE);
        return 1;
    }
    dot(2);
    for (idle = 0; idle < 50000; idle++) {
    }

    csr_w(0, CSR0_STRT);
    for (idle = 0; idle < 50000; idle++) {
    }
    /* own the TX descriptor now, then kick with STRT|TDMD in ONE write:
     * CSR0 is a command shadow, a bare TDMD write clears STRT. */
    w16(TXR + 16, TMD1_OWN | TMD1_STP | TMD1_ENP | (((TXBUF >> 3) >> 16) & 0xFF));
    csr_w(0, CSR0_STRT | CSR0_TDMD);
    dot(3);
    s0[0] = csr_r(0);

    for (idle = 0; idle < 100000; idle++) {
        if (!(r16(RXR + 16) & RMD1_OWN)) {
            dot(4);
            break;
        }
        if (!(r16(TXR + 16) & TMD1_OWN)) {
            dot(4);
        }
    }
    s0[1] = csr_r(0);

    rxmd1 = r16(RXR + 16);
    mcnt = r16(RXR + 48) & 0x0FFF;
    txmd1 = r16(TXR + 16);
    ok = 0;
    if (*(unsigned char *)(RXBUF + 12 * 8) == 0x88 &&
        *(unsigned char *)(RXBUF + 13 * 8) == 0xB5 &&
        *(unsigned char *)(RXBUF + 14 * 8) == 0xDE) {
        ok = 1;
    }
    cell(0x160, s0[0]);
    cell(0x180, s0[1]);
    cell(0x200, rxmd1);
    cell(0x220, mcnt);
    cell(0x240, txmd1);
    cell(0x1A0, ok);

    draw_text(104, 654, lab_csr0); hex4(312, 654, s0[0]);
    draw_text(104, 686, lab_csr1); hex4(312, 686, s0[1]);
    draw_text(104, 718, lab_tmd1); hex4(312, 718, txmd1);
    draw_text(104, 750, lab_rmd1); hex4(312, 750, rxmd1);
    draw_text(104, 782, lab_mcnt); hex4(312, 782, mcnt);
    draw_text(104, 814, lab_ok);
    if (ok) {
        draw_text(312, 804, lab_yes);
    } else {
        draw_text(312, 804, lab_no);
    }
    /* the old white-box ok / tx-done indicators were here; the text panel
     * shows OK as YES/NO and they overlapped the REST row, so they are gone */

    /* Give the chip back to the OS.
     *
     * The firmware's own init (io5800_5900_init, 0x3FDDCBE0) writes
     * CSR0 = 0x7F41 = INIT | INEA | all status bits set (they are
     * write-1-to-clear), then its caller polls IDON and writes
     * 0x0042 = STRT | INEA.  Match that exactly -- a plain INIT (0x0001)
     * leaves INEA clear and the status bits latched, which is why the
     * network did not come back on the first attempt.
     */
    {
        unsigned int osblk, tries, csr0res;

        osblk = *(unsigned int *)0x23E7A0;      /* init block, BYTE address */
        csr0res = 0;
        if (osblk != 0) {
            for (tries = 0; tries < 2; tries++) {
                csr_w(0, CSR0_STOP);
                for (idle = 0; idle < 200; idle++) {
                }
                csr_w(1, osblk & 0xFFFF);
                csr_w(2, (osblk >> 16) & 0xFF);
                csr_w(3, 0);
                csr_w(0, 0x7F41);               /* INIT | INEA, clear status */
                for (idle = 0; idle < 20000; idle++) {
                    r = csr_r(0);
                    if (r & CSR0_IDON) {
                        break;
                    }
                }
                csr_w(0, 0x0042);               /* STRT | INEA */
                for (idle = 0; idle < 2000; idle++) {
                }
                csr0res = csr_r(0);
                if (csr0res & 0x0010) {         /* TXON: the chip is running */
                    break;
                }
            }
            /* NOTE: do not write 0x23CC50 -- it is the driver's RDP pointer
             * cell (0x05800000), not a CSR0 shadow.  The TX kick reads CSR0
             * back through it and ORs TDMD; storing here corrupts the pointer
             * and the next CSR access faults (illegal opcode). */
        }
        cell(0x260, csr0res);                   /* CSR0 after the restore */
        cell(0x280, osblk);                     /* init block we handed back */
        draw_text(104, 846, lab_rest); hex4(312, 846, csr0res);
    }
    return 0;
}