/*
 * vidstream.c -- terminal side of the VT1200 video stream.
 *
 * Task 3 claimed the working set with ONE malloc at startup and published
 * where it landed.  Task 4 added the receive representation: two 24 KB frame
 * slots at the head of that pool and a poll loop that hands a completed frame
 * to fp_parse() (frame_parse.c, shared with the host unit test) and counts what
 * it accepted.  Task 5 blits an accepted strip frame to the screen: one
 * PIXBLT B,XY per source row, repeated down the row `stretch` times by
 * SPTCH=0 (vram_b.asm).  Task 6 adds the back-channel: the LANCE is taken over
 * for transmit and a KIND_STATUS frame is built and sent every 64 accepted
 * frames (send_status() below).  Task 7 replaces Task 4's debugger-injected
 * buffer with the payload's own LANCE RX ring: sixteen descriptors whose
 * buffers tile a slot, armed per slot, consumed in ring order, so the chip
 * DMAs the wire bytes into the memory fp_parse() and the blit read.
 *
 * Pool layout inside the single allocation (POOL_BYTES = 249856 = 244 KB):
 *
 *      +0x00000   frame slot A   24576 bytes   (16 x 1526 B RX buffers)
 *      +0x06000   frame slot B   24576 bytes   (16 x 1526 B RX buffers)
 *      +0x0C000   framebuffer   163840 bytes   (scheme A, Task 5)
 *      +0x34000   dictionary     32768 bytes
 *      +0x3C000   LANCE block     4096 bytes   (init block, TX ring, status
 *                                               frame, RX ring)
 *
 * The LANCE block is what was slack.  Its ring bases are aligned at run time
 * (lance_start() explains why the offset alone is not enough), and the status
 * frame sits right after the 8 TX descriptors, the RX ring after that.
 *
 * A slot is 16 packet buffers of RXBUFLEN = 1526 bytes (16 x 1526 = 24416, so
 * it fits 24576 with 160 bytes to spare).  The chip writes ONE Ethernet frame
 * per buffer -- 14-byte header, the VS frame's chunk, and the FCS it appends --
 * so a VS frame arrives as a series of datagrams in ring order, and the frame's
 * bytes are NOT contiguous in the slot: they are 14 bytes into each buffer,
 * 1526 bytes apart.  This payload therefore keeps a fragment table (offset,
 * buffer, length per datagram) and `paint()` reads each source row across the
 * fragments that hold it; there is no per-frame CPU copy of the picture (the
 * design's "DMA, no CPU copy" -- spec 8.1).  fp_parse() runs over the first
 * fragment's body, which holds the VS header, with the accumulated length as
 * its bound.
 *
 * Descriptors are re-armed per slot: when a frame completes, all 16 are pointed
 * at the OTHER slot BEFORE the picture is painted, so the chip can fill N+1
 * while we draw N and can never write into the slot being painted.  A frame
 * that needs more than 16 datagrams cannot be received at all: the ring is
 * exhausted, the partial frame is dropped and counted (RX_RING_DROPS).  128
 * rows of 160 bytes is 20,496 bytes = 15 datagrams, so the design's strip frame
 * fits with one descriptor to spare.
 *
 * Screen geometry.  VRAM is at bit 0x04000000 and a screen row is 0x800 bits
 * (256 bytes), the real unit's pitch (harness/c-hello/README.md).  MAME's own
 * renderer decodes the same memory at 128 bytes a row; that difference is a
 * property of the harness, so the draw test compares VRAM as memory, not the
 * rendered picture.
 *
 * OS repaint canary (spec 8.9).  The blit covers screen rows 0..1023 and
 * columns 0..1279 only.  One 16-bit sentinel word sits in the unused right
 * edge of the last screen row (row 1023, column 1280), outside every pixel the
 * blit writes.  If something else -- the resident OS -- paints over us it also
 * disturbs that corner; OS_TOUCH counts how often that was seen.  This
 * decoder has no partial update: an accepted frame repaints the whole screen
 * anyway, so detecting the touch and repainting are the same act here, and
 * OS_TOUCH is the record.
 *
 * Marker layout: see the table in frame_parse.h.  Markers are 32-bit cells on
 * the byte-aligned page at bit 0x01810000, 0x20 bits (4 bytes) apart.  The
 * design plan names them 0x01810020, 0x01810024, ... but the TMS34010 is
 * bit-addressed, so 0x01810024 is four BITS after 0x01810020 -- inside the
 * same cell.  The plan's numbers are byte offsets into the page; the rule is
 *
 *      marker named 0x018100NN  ->  bit 0x01810000 + NN * 8
 *
 * (POOL_PTR = 0x01810100, ...).  Task 5's OS_TOUCH is 0x01810220 (ruling R12),
 * i.e. cell 0x44 -- free between the RX_* counters and Task 4's retired
 * injection cells.  Task 7's ring record takes cells 0x10, 0x14, 0x18, 0x1c,
 * 0x40 and 0x48 (the free page prefix R12 left for the RX work, at the same
 * four-byte spacing every other cell uses); vidstream.lua uses the same rule.
 *
 * K&R C only: no prototypes, no '//', declarations before statements.
 */
#include "romapi.h"
#include "poolcfg.h"		/* POOL_BYTES, written by build-stream.sh */
#include "frmpsr.h"		/* frame_parse.h under an 8.3 name; see that file */

#define HEAP_FREE   0x1E8BA0	/* firmware free-byte counter, IN BITS     */
#define MARK        0x01A00000	/* .text must end before this bit address  */

#define STATIC_BYTES 249856	/* the designed working set, 244 KB        */

/* Screen memory and the strip geometry (see the header comment). */
#define VRAM_BASE   0x04000000	/* video RAM, bit address                  */
#define VRAM_ROW    0x800	/* 2048 bits = 256 bytes a screen row      */
#define SCREEN_ROWS 1024	/* rows in the framebuffer                 */
#define ROW_PIXELS  1280	/* a strip row is 1280 pixels              */
#define ROW_BYTES   160		/* 1280 pixels, 1 bpp                      */

/*
 * The sentinel word: last screen row, first column past the 1280 the blit
 * writes.  Outside the blitted area by construction, inside mapped VRAM (the
 * next 256-byte row would be bit 0x06000000, which the driver maps as the NVR,
 * not as video memory).
 */
#define SENT_ADDR   (VRAM_BASE + (SCREEN_ROWS - 1) * VRAM_ROW + ROW_PIXELS)
#define SENT_VALUE  0xA5C3

/*
 * The two frame slots.  SLOT_BYTES is the plan's 24 KB: a 128-row strip frame
 * (128 x 160 B + 16 B header = 20,496 B = 15 packets) fits, and so does any
 * smaller strip.  Slot addresses are bit addresses, because that is what a
 * pointer holds in this toolchain (see harness/c-hello/README.md: "pointers
 * are bit addresses").
 */
#define SLOT_BYTES  24576

/*
 * Task 6: the terminal's status frame.
 *
 * The payload takes the LANCE over -- STOP, its own init block, RX and TX
 * rings, INIT, IDON, STRT -- and every 64 accepted frames builds a 60-byte
 * Ethernet frame in its own buffer and hands it to the chip with a TX
 * descriptor.  The descriptor setup is lance.c's (harness/udpstream/lance.c):
 * the ring words are TMD0/TMD1/TMD2/TMD3 at byte offsets 0/2/4/6, the buffer
 * address's high byte lives in TMD1, and the length is (0x10000 - bytes) in
 * TMD2.  This is NOT a second driver: it is the same init/descriptor sequence,
 * with one buffer instead of a loopback probe's.
 *
 * Where the pieces live: the pool's last 4 KB was slack, so the LANCE block
 * goes there -- 24 bytes of init block, 64 bytes of TX ring (8 descriptors), the
 * 60-byte status frame and the RX ring (16 descriptors), all aligned at run
 * time in lance_start().  All of it is memory this payload owns, which is the
 * point: the firmware's own rings are in low memory with 32 descriptors (see
 * lance.c's note on the OS init block), and arming a slot in a ring whose
 * position the chip owns is not something this payload can do reliably.
 *
 * Task 7 arms the receiver (MODE = 0, so CSR0's STRT sets RXON) against those
 * 16 descriptors.  `drops` in the status body is three counts, all meaning "a
 * frame that arrived and did not reach the screen": the chip's CSR0 MISS bit,
 * counted once per report window in which it was latched (the bit cannot
 * distinguish two misses in one window, and send_status() says so), plus the
 * payload's own count of frames the ring was too small to finish
 * (RX_RING_DROPS), plus the datagrams the chip flagged bad (RX_FCS_DROP) --
 * those deliver no bytes at all, so without the third count a body-corrupting
 * packet would be invisible.  The chip's field is not replaced, and the
 * payload's own counts are added to it rather than invented.
 */
#define LANCE_RAP    0x05900000	/* bit address of the register-select port  */
#define LANCE_RDP    0x05800000	/* bit address of the data port             */

#define CSR0_INIT    0x0001
#define CSR0_STRT    0x0002
#define CSR0_STOP    0x0004
#define CSR0_TDMD    0x0008
#define CSR0_IDON    0x0100
#define CSR0_MISS    0x1000	/* no RX descriptor: a missed-packet event  */

#define TMD1_OWN     0x8000
#define TMD1_ENP     0x0100
#define TMD1_STP     0x0200

/*
 * The RX ring (Task 7).  RX_DESC descriptors of 8 bytes each, each pointing at
 * its own RXBUFLEN-byte buffer inside the armed slot.  RXBUFLEN is one full
 * 1514-byte Ethernet frame plus margin, the figure lance_cmd.c uses on the
 * unit: a datagram from vidsrc.py is 14 + 1450 = 1464 bytes, the chip appends
 * the 4-byte FCS, writes it after the frame and reports the total in RMD3.
 * RX_DESC * RXBUFLEN = 24416 bytes, which fits a 24576-byte slot.
 */
#define RX_DESC      16
#define RXBUFLEN     1526

#define RMD1_OWN     0x8000	/* the chip owns the descriptor             */
#define RMD1_ENP     0x0100	/* end of packet                            */
#define RMD1_STP     0x0200	/* start of packet                          */
#define RMD1_BUFF    0x0400	/* buffer (descriptor) error                */
#define RMD1_CRC     0x0800	/* CRC/FCS error                            */
#define RMD1_OFLO    0x1000	/* overflow error                           */
#define RMD1_FRAM    0x2000	/* framing error                            */
#define RMD1_ERR     0x4000	/* any of the above: the datagram is bad    */

#define ETH_FCS      4		/* the chip stores this after the frame     */

#define L_INIT_OFF   0x3C000	/* 12-word init block (24 bytes)            */
#define L_RING_OFF   0x3C040	/* 8 TX descriptors, 8 bytes each           */
#define L_RING_LEN   8		/* TLEN code 3 = 2^3 descriptors            */

#define STATUS_EVERY 64		/* frames per status report                 */
#define STATUS_LEN   60		/* Ethernet minimum; the chip adds the FCS  */

/* Offset of the VS header inside the Ethernet frame, and of the body. */
#define ETH_HDR_LEN  14
#define STAT_BODY    (ETH_HDR_LEN + FP_HEADER_SIZE)

/*
 * Static fallback.  pool_static is global so the linker map names it and the
 * MAME check can assert the exact address a failed malloc falls back to.
 * stack_cushion and the five VRAM words below sit between it and ENTRY.ASM's
 * _cstack: TMS34010 pushes grow downward, so the 4 KB stack spills into those
 * 4 KB, never into the pool.
 */
unsigned int pool_static[STATIC_BYTES / 4];
unsigned int stack_cushion[1024];

/*
 * VRAM.ASM's externals.  vram.asm is linked into every payload in this
 * directory; the C side owns the values.  vram_b.asm (PIXBLT B,XY) shares
 * blit_src/blit_daddr/blit_dydx and ignores blit_sptch, because its SPTCH is
 * always 0 -- that is what makes one source row fill `stretch` screen rows.
 */
unsigned int vram_pattern;
unsigned int blit_src, blit_sptch, blit_daddr, blit_dydx;

extern void vram_blit_b_();	/* vram_b.asm: PIXBLT B,XY, SPTCH = 0       */
extern void vid_dint_();	/* vram_b.asm: DINT                          */
extern void vid_eint_();	/* vram_b.asm: EINT                          */

/*
 * The firmware's free-space counter is a 32-bit count IN BITS at
 * 0x1E8BA0 (dwt/notes/HEAP.md).  POOL_FREE reports bytes, because the
 * marker is for humans and the check compares against POOL_BYTES.
 */
static unsigned int heap_bytes()
{
	return *(unsigned int *)HEAP_FREE / 8;
}

/*
 * Task 6 state.  The toolchain never runs .cinit, so main() clears these
 * before they are used (same rule as the markers).
 */
static unsigned int lance_ok;		/* 1 once the LANCE is ours         */
static unsigned int lance_txring;	/* bit address of the TX ring       */
static unsigned int lance_rxring;	/* bit address of the RX ring       */
static unsigned int status_buf;		/* bit address of the status frame  */
static unsigned int lance_txslot;	/* next TX descriptor to arm        */
static unsigned int status_seq;		/* reports sent, the status frame_no*/
static unsigned int status_seen;	/* frames_rx at the last report     */
static unsigned int drops_total;	/* CSR0 MISS windows, lower bound on misses */

/*
 * Task 7 receive state.
 *
 *   rx_armed   the slot the ring's 16 descriptors point into (0 = A, 1 = B).
 *              Only ever written together with a full re-arm, so a descriptor
 *              never points at a slot the payload is not expecting.
 *   rx_pos     the next descriptor the consumer expects.  The chip fills
 *              descriptors strictly in ring order (am79c90.cpp's
 *              recv_complete_cb advances m_rx_ring_pos by one per packet and
 *              INIT resets it to 0), and this payload consumes them in that
 *              same order, so rx_pos *is* the chip's position -- there is no
 *              second, shadow copy of it that could drift.  It is published as
 *              RX_RING_POS so the MAME check can inject at the right descriptor
 *              without guessing.
 *   rx_acc     bytes of the current VS frame accumulated so far, i.e. the sum
 *              of the delivered datagram bodies.  It doubles as the "still
 *              receiving" flag: 0 means no frame is in progress.
 *   rx_nfrag   fragments recorded for the frame being received.
 *   rx_frag_*  one entry per datagram: where its body sits in the slot, which
 *              frame byte it starts at, and how many body bytes it delivered.
 *              paint() walks this instead of copying the picture into a
 *              contiguous buffer.
 * RX_RING_DROPS counts frames abandoned because the ring ran out of descriptors
 * before the frame completed: a frame larger than 16 datagrams cannot be
 * received at all, so it is dropped and reported rather than half-painted.
 * RX_FCS_DROP counts datagrams the chip flagged bad (RMD1_ERR) whose ethertype
 * says they are ours: they deliver no bytes at all -- the chip writes RMD3 = 0
 * for them -- so without this cell a body-corrupting packet would be invisible
 * to both crc_err and drops.  Each one abandons the frame it belongs to.
 */
static unsigned int rx_armed;
static unsigned int rx_pos;
static unsigned int rx_acc;
static unsigned int rx_nfrag;
static unsigned int rx_frag_off[RX_DESC];
static unsigned int rx_frag_ptr[RX_DESC];
static unsigned int rx_frag_len[RX_DESC];

/*
 * blit_row(src, daddr_xy, dydx)
 *
 * One PIXBLT B,XY.  The three values are published where vram_b.asm reads
 * them (see the note there on the calling form; the assembly entry point takes
 * no arguments).  `src` is the packed 1-bpp source row as a bit address,
 * `daddr_xy` is the screen position as (y << 16) | x, and `dydx` is the
 * rectangle as (screen rows << 16) | pixels.  The primitive always sets
 * SPTCH = 0, so the "screen rows" dimension reads the same source row that
 * many times: that is the vertical stretch.
 */
static void blit_row(src, daddr_xy, dydx)
unsigned int src;
unsigned int daddr_xy;
unsigned int dydx;
{
	blit_src = src;
	blit_daddr = daddr_xy;
	blit_dydx = dydx;
	vram_blit_b_();
}

/*
 * paint(h) -- draw one accepted strip frame from the fragment table.
 *
 * Source row r goes down screen rows r*stretch .. r*stretch+stretch-1.  The
 * frame's bytes do not sit contiguously in the slot (each datagram's body is 14
 * bytes into its own buffer), so a row is cut into the pieces the fragments
 * hold it in: the row starts at frame byte payload_off + r*ROW_BYTES, and each
 * piece is one PIXBLT from the fragment that holds it, with the destination x
 * advanced by the bytes already drawn.  A 1450-byte datagram holds 9 rows and a
 * fraction, so only about one row in nine is split at all.
 *
 * A frame the screen cannot hold is not drawn: zero rows or zero stretch, more
 * than SCREEN_ROWS screen rows, or a payload shorter than the rows it claims
 * (fp_parse() and the accumulator have already proved that payload_len body
 * bytes arrived, so that bound is real).  A refused frame never touches VRAM,
 * so a malformed header cannot paint garbage over a good one.
 *
 * The whole burst runs with interrupts masked (spec 8.9) so the resident OS
 * cannot repaint between two of our source rows and tear the picture.
 */
static void paint(h)
fp_header *h;
{
	unsigned int r, rows, stretch, sent, pos, done, k, f, room, n;

	rows = h->rows;
	stretch = h->stretch;
	if (h->kind != FP_KIND_STRIP || rows == 0 || stretch == 0) {
		return;
	}
	if (rows * stretch > SCREEN_ROWS) {
		return;
	}
	if (rows * ROW_BYTES > h->payload_len) {
		return;
	}
	if (rx_nfrag == 0) {
		return;
	}

	/* The canary word lives outside every pixel this frame writes.  If it
	 * is not ours any more, something else painted VRAM: count it and put
	 * it back.  There is no partial update here -- this frame repaints the
	 * whole screen anyway -- so OS_TOUCH is the record, not a trigger. */
	sent = (unsigned int)*(unsigned short *)SENT_ADDR;
	if (sent != SENT_VALUE) {
		*(unsigned int *)OS_TOUCH = *(unsigned int *)OS_TOUCH + 1;
		*(unsigned short *)SENT_ADDR = SENT_VALUE;
	}

	vid_dint_();
	pos = h->payload_off;		/* the frame's first body byte */
	k = 0;
	for (r = 0; r < rows; r++) {
		done = 0;
		while (done < ROW_BYTES) {
			while (k < rx_nfrag
			       && pos >= rx_frag_off[k] + rx_frag_len[k]) {
				k = k + 1;
			}
			if (k >= rx_nfrag) {
				vid_eint_();
				return;		/* truncated: stop drawing */
			}
			if (pos < rx_frag_off[k]) {
				vid_eint_();
				return;		/* a gap: never paint across it */
			}
			f = pos - rx_frag_off[k];
			room = rx_frag_len[k] - f;
			n = ROW_BYTES - done;
			if (room < n) {
				n = room;
			}
			blit_row(rx_frag_ptr[k] + f * 8,
				 ((r * stretch) << 16) | (done * 8),
				 (stretch << 16) | (n * 8));
			done = done + n;
			pos = pos + n;
		}
	}
	vid_eint_();
}

/*
 * The LANCE, transmit only.  The sequence is lance.c's, and the comment on
 * each step names what makes it necessary (harness/mame/README.md rule 4: a
 * step taken from another driver carries its source).
 */
static void w16(bit, v)
unsigned int bit, v;
{
	*(unsigned short *)bit = v;
}

static unsigned int r16(bit)
unsigned int bit;
{
	return *(unsigned short *)bit;
}

static void wb(bit, v)
unsigned int bit, v;
{
	*(unsigned char *)bit = v;
}

/*
 * The chip's register file takes a select write (RAP) then a data access
 * (RDP), and needs a settle between them: am79c90.cpp's regs_w consumes the
 * address register on the next access, and lance.c measured that a store
 * immediately after the select lands in the wrong register.  Same 30-pass
 * settle as lance.c.
 */
static void lance_settle()
{
	unsigned int i;

	for (i = 0; i < 30; i++) {
	}
}

static void lance_csr_w(reg, v)
unsigned int reg, v;
{
	*(unsigned short *)LANCE_RAP = reg;
	lance_settle();
	*(unsigned short *)LANCE_RDP = v;
	lance_settle();
}

static unsigned int lance_csr_r(reg)
unsigned int reg;
{
	unsigned int v;

	*(unsigned short *)LANCE_RAP = reg;
	lance_settle();
	v = *(unsigned short *)LANCE_RDP;
	lance_settle();
	return v;
}

/* The two slots' bit addresses, published by main() and never changed. */
static unsigned int slot_base[2];

/*
 * rx_arm(slot) -- point all 16 descriptors at `slot`, ownership set last.
 *
 * The chip masks the ring ADDRESS it is given (RING_ADDR_MASK 0xFFFFF8,
 * am79c90.h) but uses a descriptor's buffer address as written, in RMD1 bits
 * 0-7 (high byte) and RMD0 (low 16).  NetBSD's am7990_rint() re-arms a used
 * descriptor with "length first, ownership last" and leaves the address alone;
 * here the address changes on every frame (the slot alternates), so the whole
 * descriptor is rewritten, and RMD1 is written FIRST with OWN CLEAR.
 *
 * The order is not cosmetic: the chip fetches RMD1 BEFORE the address.  In
 * am79c90.cpp's receive path it reads `m_rx_md[1] = m_dma_in_cb(ring_address |
 * 2)` and only then `m_rx_md[0] = m_dma_in_cb(ring_address | 0)` and
 * `m_rx_md[2] = ... | 4`.  With OWN set in the same write that carries the new
 * high byte, a fetch inside the window pairs the NEW slot's high byte with the
 * PREVIOUS slot's RMD0 -- a mixed buffer address.  That is harmless only while
 * both slots share a 64 KB page; on the unit a 48 KB slot pair can cross one,
 * and the chip would then DMA into memory outside the pool.
 *
 * Publishing the address and length under OWN clear closes it: a fetch inside
 * the window reads OWN clear and the packet is a missed packet
 * (recv_complete_cb() case -2 latches CSR0 MISS), so it is counted and dropped
 * instead of being written somewhere wrong.  OWN is then set in the last write.
 *
 * RMD2 is the buffer size as a negative two's complement count (0x10000 -
 * RXBUFLEN), the form am79c90's get_buf_length() decodes and lance_cmd.c arms
 * with.  RMD3 is the message count the chip fills in; zeroing it first means a
 * descriptor completed by anything but the chip reads as a zero-length packet
 * rather than as the previous frame's length.
 */
static void rx_arm(slot)
unsigned int slot;
{
	unsigned int i, cb, base;

	base = slot_base[slot];
	for (i = 0; i < RX_DESC; i++) {
		cb = (base >> 3) + i * RXBUFLEN;
		/* OWN clear, with the new high byte: a fetch here is a MISS. */
		w16(lance_rxring + i * 64 + 16, (cb >> 16) & 0xFF);
		w16(lance_rxring + i * 64 + 0, cb & 0xFFFF);
		w16(lance_rxring + i * 64 + 32, (0x10000 - RXBUFLEN) & 0xFFFF);
		w16(lance_rxring + i * 64 + 48, 0);
		/* Ownership last, over a complete descriptor. */
		w16(lance_rxring + i * 64 + 16,
		     RMD1_OWN | ((cb >> 16) & 0xFF));
	}
}

/*
 * rx_switch() -- arm the other slot.  Called at the end of a frame, before the
 * picture is drawn, so the chip can fill N+1 while we paint N and can never
 * write into the slot being read (spec 8.1's overlap).
 */
static void rx_switch()
{
	rx_armed = 1 - rx_armed;
	rx_arm(rx_armed);
}

/*
 * rx_dgram(i) -- consume descriptor i, which the chip has completed.
 *
 * One Ethernet frame per buffer, so STP and ENP must both be set.  A packet
 * longer than one buffer would be chained across descriptors, and every
 * reference driver (4.4BSD pmax if_le.c, NetBSD am7990.c, Linux 7990.c) drops a
 * chained frame rather than reassembling it -- lance_cmd.c cites the same rule
 * -- so a chained descriptor contributes nothing here.  RMD3 is the delivered
 * length INCLUDING the 4-byte FCS the chip appends, so the body is RMD3 minus
 * the Ethernet header and the FCS.
 *
 * The datagram is appended to the fragment table and the frame's own
 * payload_len decides when the frame is complete (spec 8.1: payload_len plus
 * the bytes actually delivered are authoritative, not the descriptor count).
 * RMD3 is per datagram here, because each datagram is its own Ethernet packet.
 */
static void rx_dgram(i)
unsigned int i;
{
	unsigned int rmd1, mlen, len, src, plen, total, lim, slot;
	fp_header h;

	rmd1 = r16(lance_rxring + i * 64 + 16);
	mlen = r16(lance_rxring + i * 64 + 48) & 0x0FFF;
	src = slot_base[rx_armed] + i * RXBUFLEN * 8 + ETH_HDR_LEN * 8;
	len = 0;
	if (rmd1 & RMD1_ERR) {
		/*
		 * A datagram the chip flagged -- CRC/FCS, buffer, overflow or
		 * framing -- delivers NO bytes: am79c90.cpp's
		 * recv_complete_cb() writes RMD3 as
		 *   (m_rx_md[1] & RMD1_ERR) ? 0 : (result & RMD3_MCNT)
		 * so the length checks below would drop it silently and a
		 * body-corrupting packet would never appear in any counter.
		 *
		 * The bytes ARE in the buffer (dma_out() ran before the FCS
		 * was checked), so a datagram of ours is still identifiable by
		 * its ethertype -- the Ethernet header is written before the
		 * body, so a body-corrupting error leaves it intact.  Count one
		 * drop for the frame it breaks, abandon that frame and re-arm
		 * the other slot: with a datagram missing the accumulation can
		 * never reach the frame's payload_len, and letting later
		 * datagrams keep appending would mix two frames into one
		 * picture.  Traffic that is not ours is ignored, exactly as at
		 * a frame start.
		 *
		 * If the corruption landed on the ethertype the datagram cannot
		 * be attributed and is not counted.  That is the limit of what
		 * the chip leaves readable; it is stated in the report rather
		 * than papered over.
		 */
		if (*(unsigned char *)(src - ETH_HDR_LEN * 8 + 12 * 8) == 0x88
		    && *(unsigned char *)(src - ETH_HDR_LEN * 8 + 13 * 8) == 0xB7) {
			*(unsigned int *)RX_FCS_DROP =
				*(unsigned int *)RX_FCS_DROP + 1;
			rx_acc = 0;
			rx_nfrag = 0;
			rx_switch();
		}
		return;
	}
	if ((rmd1 & (RMD1_STP | RMD1_ENP)) == (RMD1_STP | RMD1_ENP)
	    && mlen > ETH_HDR_LEN + ETH_FCS
	    && mlen - ETH_HDR_LEN - ETH_FCS <= RXBUFLEN - ETH_HDR_LEN) {
		len = mlen - ETH_HDR_LEN - ETH_FCS;
	}
	if (len == 0) {
		return;			/* runt or chained: nothing appended */
	}
	if (rx_acc == 0) {
		/* A frame starts here.  Only a VS frame is ours: the chip
		 * accepts broadcast and its own address, so other traffic can
		 * land in this ring, and fp_parse() would count every such
		 * datagram as a bad frame.  Resync on the magic instead. */
		if (len < 2
		    || *(unsigned char *)src != FP_MAGIC0
		    || *(unsigned char *)(src + 8) != FP_MAGIC1) {
			return;
		}
	}

	rx_frag_off[rx_nfrag] = rx_acc;
	rx_frag_ptr[rx_nfrag] = src;
	rx_frag_len[rx_nfrag] = len;
	rx_nfrag = rx_nfrag + 1;
	rx_acc = rx_acc + len;

	if (rx_acc < FP_HEADER_SIZE) {
		return;
	}
	plen = (unsigned int)*(unsigned char *)(rx_frag_ptr[0] + 6 * 8)
	     | ((unsigned int)*(unsigned char *)(rx_frag_ptr[0] + 7 * 8) << 8);
	total = FP_HEADER_SIZE + plen;
	if (total > SLOT_BYTES) {
		/* The header claims a frame larger than the slot: it can never be
		 * completed, and no part of it is drawn.  Reject it now, then hand
		 * the OTHER slot to the chip: all 16 descriptors are re-armed,
		 * including the one this datagram arrived in, so the sender's next
		 * frame starts on a clean ring.  What is left of the rejected frame
		 * is ignored, exactly as any frame that does not open with the
		 * magic is. */
		*(unsigned int *)RX_BAD = *(unsigned int *)RX_BAD + 1;
		rx_acc = 0;
		rx_nfrag = 0;
		rx_switch();
		return;
	}
	if (rx_acc < total) {
		return;			/* still arriving */
	}

	/* The frame is complete.  Hand the OTHER slot to the chip first, so
	 * nothing it receives from now on lands in the picture below. */
	slot = rx_armed;
	rx_switch();

	/*
	 * Task 4 finding (b): the length handed to fp_parse() is clamped to the
	 * slot.  rx_acc is bounded by RX_DESC * RXBUFLEN and the claim above,
	 * but fp_parse() walks a caller-supplied length, and a slot-sized bound
	 * is the contract both of them can be read against.
	 */
	lim = rx_acc;
	if (lim > SLOT_BYTES) {
		lim = SLOT_BYTES;
	}
	if (fp_parse((unsigned char *)rx_frag_ptr[0], lim, &h)) {
		*(unsigned int *)RX_LAST_LEN = h.payload_len;
		*(unsigned int *)RX_SLOT = slot;
		paint(&h);
		/* Published after the paint: a reader that sees RX_OK move
		 * sees a picture that is already on the screen. */
		*(unsigned int *)RX_OK = *(unsigned int *)RX_OK + 1;
	} else {
		*(unsigned int *)RX_BAD = *(unsigned int *)RX_BAD + 1;
	}
	rx_acc = 0;
	rx_nfrag = 0;
}

/*
 * rx_poll() -- drain every descriptor the chip has completed, in ring order.
 *
 * Task 4 finding (a): there is no level-triggered "frame ready" cell any more.
 * The handshake is the OWN bit, per descriptor: the chip clears it when the
 * packet is in the buffer and this side sets it again (in rx_arm) only after
 * reading the descriptor's data, so there is no shared flag for two writers to
 * race on.  `rx_pos` is the only cursor and it advances only after a descriptor
 * has been read; the chip advances its own position by one per packet and INIT
 * resets both to 0, so consuming in ring order keeps the two in step.
 *
 * A frame that uses the whole ring without completing is dropped: the ring
 * cannot hold it, so it can never complete, and leaving the partial frame in
 * place would make every later frame look like its tail.
 */
static void rx_poll()
{
	unsigned int i, n;

	for (n = 0; n < RX_DESC; n++) {
		i = rx_pos;
		if (r16(lance_rxring + i * 64 + 16) & RMD1_OWN) {
			break;		/* the chip has not completed it */
		}
		rx_pos = (i + 1) & (RX_DESC - 1);
		*(unsigned int *)RX_DGRAM = *(unsigned int *)RX_DGRAM + 1;
		rx_dgram(i);
		if (rx_nfrag == RX_DESC && rx_acc != 0) {
			*(unsigned int *)RX_RING_DROPS =
				*(unsigned int *)RX_RING_DROPS + 1;
			rx_acc = 0;
			rx_nfrag = 0;
			rx_switch();
		}
	}
	*(unsigned int *)RX_RING_POS = rx_pos;
	*(unsigned int *)RX_RING_ACC = rx_acc;
	*(unsigned int *)RX_RING_ARMED = rx_armed;
}

/*
 * lance_start(ptr) -- take the LANCE over for receive and transmit.  1 on
 * success.
 *
 * STOP comes first because the init block address (CSR1/CSR2/CSR3) is only
 * writable while the chip is stopped -- am79c90.cpp regs_w guards each of them
 * with "if (m_csr[0] & CSR0_STOP)" -- and because STOP resets the chip, which
 * clears INEA: the network interrupt is off before this payload touches
 * anything, so the firmware's ISR cannot act on a half-programmed ring.  The
 * caller also masks interrupts for the whole sequence.
 *
 * The init block's words are the C-LANCE's own order: MODE, PADR (three
 * words), LADRF (four), RX ring address/length, TX ring address/length.  A
 * ring word is the address's bits 16-23 in its low byte and the length code
 * (2^code descriptors) in bits 13-15; the pool sits above 64 KB, so unlike
 * lance.c's low-memory rings the high byte is not zero and has to be written.
 *
 * Task 7 removed MODE_DRX and gave the receiver a ring, because that is what a
 * receive path is: MODE = 0 (no loopback, no transmitter disable, FCS kept and
 * appended) and STRT afterwards sets RXON as well as TXON (am79c90.cpp's STRT
 * handler: "if (m_mode & MODE_DRX) clear RXON else set RXON").  The descriptors
 * are armed for slot A before INIT, so the chip's first packet -- which can
 * arrive the instant STRT lands -- finds a buffer.
 */
static int lance_start(ptr)
unsigned int ptr;
{
	unsigned int init, ring, buf, rxring, cb, i, idon;

	/*
	 * Alignment is the CHIP's requirement, not a convenience.  The Am7990
	 * masks what it is given: INIT_ADDR_MASK 0xFFFFFE for the init block and
	 * RING_ADDR_MASK 0xFFFFF8 for a ring (am79c90.h), because a descriptor
	 * is eight bytes.  The pool base is only word-aligned (0x0090C8D0 is
	 * byte 0x12191A), so a fixed offset does NOT give a ring the chip can
	 * find: the first run of this code put the ring at byte 0x15D93A, the
	 * chip masked that to 0x15D938 and read our TMD0 word as TMD1 -- it never
	 * fetched the status buffer at all (proved from VT1200_LANCE_DMA_LOG:
	 * no read of the buffer address, and the chip writing 0x599A into our
	 * TMD0 words).  Round up to the alignment the chip will keep.
	 */
	init = (ptr + L_INIT_OFF * 8 + 0x0F) & 0xFFFFFFF0;	/* 16-bit words */
	ring = (ptr + L_RING_OFF * 8 + 0x3F) & 0xFFFFFFC0;	/* 8-byte      */
	buf = ring + L_RING_LEN * 64;				/* after the ring */
	rxring = (buf + STATUS_LEN * 8 + 0x3F) & 0xFFFFFFC0;	/* after status */
	lance_txring = ring;
	status_buf = buf;
	lance_rxring = rxring;

	lance_csr_w(0, CSR0_STOP);

	w16(init + 0 * 16, 0);			/* MODE: no loopback, FCS on */
	w16(init + 1 * 16, 0x0008);		/* PADR 08:00:2b:16:4b:5a    */
	w16(init + 2 * 16, 0x162b);
	w16(init + 3 * 16, 0x5a4b);
	w16(init + 4 * 16, 0);			/* LADRF: physical + broadcast */
	w16(init + 5 * 16, 0);
	w16(init + 6 * 16, 0);
	w16(init + 7 * 16, 0);
	cb = rxring >> 3;			/* BYTE address of the RX ring */
	w16(init + 8 * 16, cb & 0xFFFF);
	w16(init + 9 * 16, ((cb >> 16) & 0xFF) | (4 << 13));	/* 16 desc */
	cb = ring >> 3;				/* BYTE address of the ring  */
	w16(init + 10 * 16, cb & 0xFFFF);
	w16(init + 11 * 16, ((cb >> 16) & 0xFF) | (3 << 13));

	/* Every TX descriptor points at the one status buffer; TMD1's OWN stays
	 * clear until a frame is ready, and TMD2 holds the length as a two's
	 * complement (0x10000 - 60), lance.c's descriptor layout. */
	cb = buf >> 3;
	for (i = 0; i < L_RING_LEN; i++) {
		w16(ring + i * 64 + 0, cb & 0xFFFF);
		w16(ring + i * 64 + 16, (cb >> 16) & 0xFF);
		w16(ring + i * 64 + 32, (0x10000 - STATUS_LEN) & 0xFFFF);
		w16(ring + i * 64 + 48, 0);
	}
	for (i = 0; i < STATUS_LEN; i++) {
		wb(buf + i * 8, 0);
	}

	/* The RX ring, armed for slot A: this is the state the first packet
	 * finds, and it is what the MAME ring check asserts. */
	rx_armed = 0;
	rx_arm(rx_armed);
	*(unsigned int *)RX_RING_BASE = rxring;

	lance_csr_w(1, (init >> 3) & 0xFFFF);
	lance_csr_w(2, ((init >> 3) >> 16) & 0xFF);
	lance_csr_w(3, 0);
	lance_csr_w(0, CSR0_INIT);

	idon = 0;
	for (i = 0; i < 20000; i++) {
		idon = lance_csr_r(0);
		if (idon & CSR0_IDON) {
			break;
		}
	}
	*(unsigned int *)ST_INIT = idon;
	if (!(idon & CSR0_IDON)) {
		return 0;
	}

	/* STRT turns the receiver and the transmitter on; no INEA, so no
	 * interrupt reaches the firmware's network ISR while this payload owns
	 * the chip.  RXON is what makes the descriptors armed above live. */
	lance_csr_w(0, CSR0_STRT);
	for (i = 0; i < 30; i++) {
	}
	return 1;
}

/*
 * send_status(frames_rx) -- build and transmit one status frame.
 *
 * The frame is an ordinary Ethernet frame: broadcast destination (the LANCE
 * accepts broadcast with an empty LADRF, and the host's capture sees it), the
 * terminal's own address from its Ethernet ROM, the stream's ethertype 0x88B7
 * (frame.py ETHERTYPE), then the same 16-byte VS header every other frame
 * carries, with rows and stretch zero because a status has no geometry.  The
 * body is 12 bytes, LITTLE-endian as frame.py's pack_status() writes it:
 * frames_rx u32, crc_err u16, drops u16, csr0 u16, heap_free_kb u16.  (The
 * command protocol in lance_cmd.c is big-endian; this one is not, and getting
 * it backwards reads 64 frames as 0x40000000 -- which is how the Task 6
 * MAME run first found it.)
 *
 * crc_err is RX_BAD: the frames fp_parse() rejected (header CRC, magic,
 * version or length).  Since ruling R14 a corrupted *body* cannot appear
 * here -- the LANCE validated each datagram's FCS before the bytes were
 * stored -- so this is the only CRC error the terminal can count.  A datagram
 * whose FCS the CHIP rejected is not a frame at all: it delivers no bytes
 * (RMD3 = 0) and is counted in drops, via RX_FCS_DROP.
 *
 * drops is three counts of frames that arrived and did not reach the screen:
 *
 *   drops_total   CSR0 MISS, counted per REPORT WINDOW in which the latched bit
 *                 was set -- the chip gives no per-packet count, so this is one
 *                 per window at most (a lower bound, see send_status()).
 *   RX_RING_DROPS frames too large for the 16 descriptors (Task 7).
 *   RX_FCS_DROP   datagrams the chip flagged bad; each abandons its frame.
 *
 * Neither number is inferred from another.
 *
 * Returns 1 when the frame was handed to the chip, 0 when the ring slot was
 * still owned and nothing was armed.  Overwriting a descriptor the chip still
 * owns is what every reference driver refuses to do (Linux stops the queue,
 * NetBSD prints "missing buffer"), and the caller must not count a report it
 * never sent: it advances status_seen only on 1.
 */
static int send_status(frames_rx)
unsigned int frames_rx;
{
	unsigned int i, crc, csr0, tmd1, off, hb, miss, bad, rdrops, fdrops,
		     free_kb;

	hb = status_buf;

	/* Ethernet header. */
	for (i = 0; i < 6; i++) {
		wb(hb + i * 8, 0xFF);
	}
	wb(hb + 6 * 8, 0x08);  wb(hb + 7 * 8, 0x00);
	wb(hb + 8 * 8, 0x2B);  wb(hb + 9 * 8, 0x16);
	wb(hb + 10 * 8, 0x4B); wb(hb + 11 * 8, 0x5A);
	wb(hb + 12 * 8, 0x88); wb(hb + 13 * 8, 0xB7);

	/* The VS header, laid out exactly as frame.py's pack_header() does. */
	off = hb + ETH_HDR_LEN * 8;
	wb(off + 0 * 8, FP_MAGIC0);
	wb(off + 1 * 8, FP_MAGIC1);
	wb(off + 2 * 8, FP_VERSION);
	wb(off + 3 * 8, FP_KIND_STATUS);
	wb(off + 4 * 8, status_seq & 0xFF);
	wb(off + 5 * 8, (status_seq >> 8) & 0xFF);
	wb(off + 6 * 8, FP_STATUS_SIZE);
	wb(off + 7 * 8, 0);
	wb(off + 8 * 8, 0);			/* rows: none */
	wb(off + 9 * 8, 0);			/* stretch: none */
	wb(off + 10 * 8, 0);			/* reserved */
	wb(off + 11 * 8, 0);
	crc = fp_crc((unsigned char *)off, FP_PREFIX_SIZE);
	wb(off + 12 * 8, crc & 0xFF);
	wb(off + 13 * 8, (crc >> 8) & 0xFF);
	wb(off + 14 * 8, 0);
	wb(off + 15 * 8, 0);

	/* The chip's status word, and the missed-packet bit it latches.  CSR0
	 * MISS is ONE BIT: am79c90.cpp's recv_complete_cb() only ORs it in
	 * (case -2), so two missed packets inside one report window look exactly
	 * like one.  drops_total therefore counts report windows in which at
	 * least one packet was missed -- a lower bound on missed packets, not an
	 * event count -- and the bit is cleared here after the report is built
	 * (write-1-to-clear) so the next window starts clean.  The status field
	 * is a "something was missed" indicator, and this comment says so
	 * instead of claiming a count the hardware cannot give. */
	csr0 = lance_csr_r(0);
	miss = 0;
	if (csr0 & CSR0_MISS) {
		drops_total = drops_total + 1;
		miss = 1;
	}

	bad = *(unsigned int *)RX_BAD;
	/* The three drop counts described above: the chip's MISS windows, the
	 * payload's count of frames too large for the ring, and the datagrams
	 * the chip flagged bad (they carry no bytes, so nothing else sees
	 * them). */
	rdrops = *(unsigned int *)RX_RING_DROPS;
	fdrops = *(unsigned int *)RX_FCS_DROP;
	free_kb = heap_bytes() >> 10;
	off = hb + STAT_BODY * 8;
	wb(off + 0 * 8, frames_rx & 0xFF);
	wb(off + 1 * 8, (frames_rx >> 8) & 0xFF);
	wb(off + 2 * 8, (frames_rx >> 16) & 0xFF);
	wb(off + 3 * 8, (frames_rx >> 24) & 0xFF);
	wb(off + 4 * 8, bad & 0xFF);
	wb(off + 5 * 8, (bad >> 8) & 0xFF);
	wb(off + 6 * 8, (drops_total + rdrops + fdrops) & 0xFF);
	wb(off + 7 * 8, ((drops_total + rdrops + fdrops) >> 8) & 0xFF);
	wb(off + 8 * 8, csr0 & 0xFF);
	wb(off + 9 * 8, (csr0 >> 8) & 0xFF);
	wb(off + 10 * 8, free_kb & 0xFF);
	wb(off + 11 * 8, (free_kb >> 8) & 0xFF);

	/* Arm the next descriptor: TMD3, then the length, then ownership last,
	 * so the chip cannot take a descriptor whose length is still stale
	 * (lance_cmd.c does the same, and NetBSD's am7990_rint() says why). */
	off = lance_txring + lance_txslot * 64;
	for (i = 0; i < 10000; i++) {
		if (!(r16(off + 16) & TMD1_OWN)) {
			break;
		}
	}
	if (r16(off + 16) & TMD1_OWN) {
		return 0;			/* still the chip's: arm nothing */
	}
	w16(off + 48, 0);
	w16(off + 32, (0x10000 - STATUS_LEN) & 0xFFFF);
	w16(off + 16, TMD1_OWN | TMD1_STP | TMD1_ENP
	     | ((status_buf >> 3 >> 16) & 0xFF));
	/* Where the harness must look to watch the chip finish this frame. */
	*(unsigned int *)ST_TMLAST = off + 16;

	/* One write: a bare TDMD would clear STRT (CSR0 is a command shadow;
	 * lance.c's comment and every reference driver agree). */
	lance_csr_w(0, CSR0_STRT | CSR0_TDMD);

	tmd1 = 0;
	for (i = 0; i < 20000; i++) {
		tmd1 = r16(off + 16);
		if (!(tmd1 & TMD1_OWN)) {
			break;
		}
	}

	lance_txslot = (lance_txslot + 1) & (L_RING_LEN - 1);
	status_seq = status_seq + 1;
	*(unsigned int *)ST_FRAMES = frames_rx;
	*(unsigned int *)ST_TMD1 = tmd1;
	/* ST_SENT last: a reader that sees it move reads a frame that was
	 * built, transmitted and recorded, never one in progress. */
	*(unsigned int *)ST_SENT = *(unsigned int *)ST_SENT + 1;

	if (miss) {
		lance_csr_w(0, CSR0_MISS);
	}
	return 1;
}

int main()
{
	unsigned int before, after, ptr, frames, sent;

	*(unsigned int *)VID_ALIVE = 0;
	*(unsigned int *)POOL_PTR = 0;
	*(unsigned int *)POOL_FREEB = 0;
	*(unsigned int *)POOL_FREEA = 0;

	/* Receive record: counters and the two slots are cleared before anything
	 * is published, so a reader never sees a counter from a previous run or a
	 * slot address that has no allocation behind it.  The ring record is
	 * published by lance_start() once the descriptors are armed. */
	*(unsigned int *)RX_OK = 0;
	*(unsigned int *)RX_BAD = 0;
	*(unsigned int *)RX_LAST_LEN = 0;
	*(unsigned int *)RX_SLOT = 0;
	*(unsigned int *)RX_SLOT_A = 0;
	*(unsigned int *)RX_SLOT_B = 0;
	*(unsigned int *)RX_RING_BASE = 0;
	*(unsigned int *)RX_RING_POS = 0;
	*(unsigned int *)RX_RING_ACC = 0;
	*(unsigned int *)RX_RING_ARMED = 0;
	*(unsigned int *)RX_RING_DROPS = 0;
	*(unsigned int *)RX_FCS_DROP = 0;
	*(unsigned int *)RX_DGRAM = 0;
	*(unsigned int *)OS_TOUCH = 0;

	/* Arm the VRAM canary before any frame is accepted, so a repaint
	 * between now and the first blit is counted rather than mistaken for
	 * our own last frame. */
	*(unsigned short *)SENT_ADDR = SENT_VALUE;

	before = heap_bytes();
	ptr = malloc_(POOL_BYTES);	/* malloc_ takes BYTES, returns BITS */
	after = heap_bytes();

	if (ptr == 0) {
		/* The fallback is the 244 KB static pool by definition; a larger
		 * request still reports the failure through the low-bit flag. */
		ptr = (unsigned int)pool_static;
		*(unsigned int *)POOL_FREEB = before | 1;
	} else {
		*(unsigned int *)POOL_FREEB = before;
	}
	*(unsigned int *)POOL_FREEA = after;

	/* Slot B follows slot A in the same pool.  Both are published before
	 * POOL_PTR so the harness can find them from either one. */
	slot_base[0] = ptr;
	slot_base[1] = ptr + SLOT_BYTES * 8;
	*(unsigned int *)RX_SLOT_A = slot_base[0];
	*(unsigned int *)RX_SLOT_B = slot_base[1];
	*(unsigned int *)POOL_PTR = ptr;	/* publish last: a complete record */

	/* Task 6: the status back-channel.  The record starts empty, then the
	 * LANCE is taken over for receive and transmit with interrupts masked --
	 * the OS's drivers were using this chip a moment ago, and a network ISR
	 * running in the middle of the ring setup would see a half-written
	 * descriptor. */
	*(unsigned int *)RX_EOF = 0;
	*(unsigned int *)ST_SENT = 0;
	*(unsigned int *)ST_FRAMES = 0;
	*(unsigned int *)ST_BUF = 0;
	*(unsigned int *)ST_TMD1 = 0;
	*(unsigned int *)ST_INIT = 0;
	*(unsigned int *)ST_TMLAST = 0;

	lance_txslot = 0;
	status_seq = 0;
	status_seen = 0;
	drops_total = 0;
	rx_armed = 0;
	rx_pos = 0;
	rx_acc = 0;
	rx_nfrag = 0;

	vid_dint_();
	lance_ok = lance_start(ptr);
	vid_eint_();
	*(unsigned int *)ST_BUF = status_buf;

	for (;;) {
		*(unsigned int *)VID_ALIVE = *(unsigned int *)VID_ALIVE + 1;
		rx_poll();

		/* Report every STATUS_EVERY accepted frames, and -- once the
		 * harness says the sender has stopped -- for every further
		 * accepted frame, so a finite run ends with a report whose
		 * frames_rx is the final count rather than the last multiple
		 * of 64 (RX_EOF is harness-only; see frame_parse.h). */
		frames = *(unsigned int *)RX_OK;
		if (!lance_ok) {
			continue;
		}
		if (frames - status_seen >= STATUS_EVERY
		    || (*(unsigned int *)RX_EOF != 0 && frames != status_seen)) {
			vid_dint_();
			sent = send_status(frames);
			vid_eint_();
			if (sent) {
				status_seen = frames;
			}
		}
	}
}