; This is designed to be serial-line downloaded to cdcode.
;
; Our memory map:
;
;	[8c000000,8c010000)	Stack (r15 set by cdcode)
;	[8c010000,8c01????)	cdcode
;	[8c020000,8c02????)	Us

; This code is heavy on the magic numbers.  All the other BBA-driving
;  code I've found is at least as bad. :-(

	.include "regs.s"

	.include "maple-bits.s"

; Layout within the gapspci bridge bounce buffer area.
. = 0x01840000
rxbuff_bounce:
	.space	16384 + 16
txbuff_bounce:
	.space	2000

. = 0x8c020000

	.sz	any
	.pr	any
	SETS.L	#main,r0
	jmp	@r0
	 nop
	SETCONST

	; Our "data segment".

MIN_ETHER_LEN = 32 ; I think 64 is the actual value, not sure
MAX_ETHER_LEN = 1600
	.align	4
rxcfg:
	.space	4
top_sp:
	.space	4
ipkt:
	.space	4+MAX_ETHER_LEN
opkt_0:
	.space	4+MAX_ETHER_LEN
opkt_1:
	.space	4+MAX_ETHER_LEN
opkt_2:
	.space	4+MAX_ETHER_LEN
opkt_3:
	.space	4+MAX_ETHER_LEN
opkt_busy:
	.space	1
MAC:
	.space	6

	; End of "data segment".

	; Our "text segment".

; The only things startup.s sets up that cdcode hasn't already done for
;  us are (1) fpscr and (2) clearing bss.  We don't have bss because we
;  aren't linked by a conventional linker, and we don't use floating
;  point so we don't care about fpscr.  We do, however, need to set up
;  the VBR.  We also save r10-r14 against returning to cdcode.
	.align	2
main:
	mov.l	r14,@-r15
	mov.l	r13,@-r15
	mov.l	r12,@-r15
	mov.l	r11,@-r15
	mov.l	r10,@-r15
	ldc	r14,gbr
	stc	sr,r1
	SETS.L	#~[SR_FD|SR_RB|SR_BL],r2
	and	r2,r1
	ldc	r1,sr
	; Note that r0-r7 may have just changed if we switched banks.
	mov	#0,r1
	lds	r1,fpscr
	.sz	0
	.pr	0
	SETS.L	#intvec,r0
	ldc	r0,vbr
; Real code begins here.
	; Make sure all interrupts are blocked.
	stc	sr,r0
	or	#0xf0,r0
	ldc	r0,sr
	; Set up the PCI bridge.
	bsr	init_gapspci
	 nop
	bt	fail
	; Initialize the Ethernet itself.
	bsr	init_ether
	 nop
	bt	fail
	bsr	await_link
	 nop
	bsr	init_ether
	 nop
	bt	fail
	bsr	report_mac
	 nop
	bsr	await_link
	 nop
;	bsr	enable_interrupts
;	 nop
	SETS.L	#top_sp,r0
	mov.l	r15,@r0
	bsr	init_data
	 nop
1:	bsr	check_recv_packet
	 nop
	bsr	check_serial
	 nop
	bra	1b
	 nop
failmsg:
	.asciz	"Setup failed"(13,10)
	.align	2
fail:
	SETS.L	#failmsg,r1
	bsr	putstr
	 nop
done:
	bsr	putchar
	 mov	#13,r1
	bsr	putchar
	 mov	#10,r1
	SETS.L	#top_sp,r0
	mov.l	@r0,r15
	mov.l	@r15+,r10
	mov.l	@r15+,r11
	lds	r11,pr
	mov.l	@r15+,r12
	mov.l	@r15+,r13
	mov.l	@r15+,r14
	rts
	 nop

report_mac:
	sts	pr,r4
	SETS.L	#5,r3
	SETS.L	#MAC,r2
2:	mov.b	@r2+,r1
	bsr	printhexN
	 mov	#2,r0
	bsr	putchar
	 mov	#':,r1
1:	dt	r3
	bf	2b
	mov.b	@r2+,r1
	bsr	printhexN
	 mov	#2,r0
	bsr	putchar
	 mov	#13,r1
	lds	r4,pr
	bra	putchar
	 mov	#10,r1

g2_lock:
	; This is conceptually what NetBSD and libronin call G2_LOCK().
	;  It returns a cookie in r0 which needs to be passed to
	;  g2_unlock.
	;
	; This saves and restores all other registers it uses.
	;
	mov.l	r1,@-r15
	stc	sr,r0
	mov.l	r0,@-r15
	.if	@IS_UB[SR_IMASK_MASK<<SR_IMASK_SHIFT]
	or	#SR_IMASK_MASK<<SR_IMASK_SHIFT,r0
	.else
	SETS.L	#SR_IMASK_MASK<<SR_IMASK_SHIFT,r1
	or	r1,r0
	.endif
	ldc	r0,sr
	SETS.L	#0xa05f688c,r1
1:	mov.l	@r1,r0
	tst	#0x20,r0
	bf	1b
	mov.l	@r15+,r0
	rts
	 mov.l	@r15+,r1

g2_unlock:
	; This is conceptually what NetBSD and libronin call
	;  G2_UNLOCK().  Like those versions, all we do is reenable
	;  interrupts disabled by g2_lock.
	;
	; This saves and restores all other registers it uses.
	;
	mov.l	r1,@-r15
	mov.l	r2,@-r15
	stc	sr,r1
	SETS.L	#SR_IMASK_MASK<<SR_IMASK_SHIFT,r2
	and	r2,r0
	not	r2,r2
	and	r2,r1
	or	r1,r0
	mov.l	@r15+,r2
	ldc	r0,sr
	rts
	 mov.l	@r15+,r1

GAPSPCI_BRIDGE_2_constant:
	.ascii	"GAPSPCI_BRIDGE_2"
	.align	2
init_gapspci:
	sts.l	pr,@-r15
	SETS.L	#0xa1001400,r9
	SETS.L	#0xa1001600,r8
	bsr	g2_lock
	 nop
	mov	r0,r5
	; Check the GAPSPCI_BRIDGE_2 constant.
	SETS.L	#GAPSPCI_BRIDGE_2_constant,r2
	mov	r9,r3
	SETS.L	#16,r4
1:	mov.b	@r2+,r0
	mov.b	@r3+,r1
	cmp/eq	r0,r1
	bf	initfail_nomagic
	dt	r4
	bf	1b
	; OK, GAPSPCI_BRIDGE2 is there.
	; I assume this is some kind of magic "please init" value.
	SETS.L	#0x5a14a501,r0
	mov	r9,r1
	add	#0x18,r1
	mov.l	r0,@r1
	bsr	g2_unlock
	 mov	r5,r0
	; Why 1000000?  Because that's what libronin and NetBSD do. :(
	SETS.L	#1000000,r0
1:	dt	r0
	bf	1b
	bsr	g2_lock
	 nop
	mov	r0,r5
	; I assume this is some kind of "init completed OK" check.
	; The "not responding" description of failure (see
	;  failmsg_noresp, as referenced from the code at
	;  initfail_noresp) is from NetBSD.
	mov.l	@r1,r0
	cmp/eq	#1,r0
	bf	initfail_noresp
	; Offsets 20, 24, 14, and 34 are unknown to me.
	; NetBSD field member names imply 28 is a DMA base address
	;  register and 2c is a DMA area end pointer.  It appears the
	;  reason we can just shove a fixed address in there is that
	;  DMA is rather restricted; it goes to the gapspci bridge,
	;  which has some 32k of RAM available for bounce buffering
	;  packets, and this RAM is at 01840000.  Why we have to
	;  configure the bridge with these values, I don't know.  Maybe
	;  the bridge can be configured to let the BBA access only some
	;  of it?
	SETS.L	#0x01840000,r0
	SETS.L	#0x01000000,r1
	mov.l	r1,@(0x20,r9)
	mov.l	r1,@(0x24,r9)
	mov.l	r0,@(0x28,r9)
	SETS.L	#0x01848000,r0
	mov.l	r0,@(0x2c,r9)
	SETS.L	#1,r0
	mov.l	r0,@(0x14,r9)
	mov.l	r0,@(0x34,r9)
	; In libronin, these are all opaque magic numbers.  NetBSD has
	;  a bus_space_map call that implies a1001600 is PCI
	;  configuration space and thus these are PCI registers.  Based
	;  on NetBSD's dev/pci/pcireg.h and the libronin code, I've
	;  commented this code with guesses as to what's what.
	; 0x06 - PCI status (top half of command/status at 0x04)
	; 0xf900 - Turn on PARITY_DETECT, SPECIAL_ERROR, MASTER_ABORT,
	;  MASTER_TARGET_ABORT, TARGET_TARGET_ABORT, and PARITY_ERROR.
	;  Set DEVSEL_MASK to DEVSEL_FAST and turn off
	;  BACKTOBACK_SUPPORT, UDF_SUPPORT, 66MHZ_SUPPORT and
	;  CAPLIST_SUPPORT.  (All names from NetBSD.)  The 0x000f bits
	;  have no definitions in dev/pci/pcireg.h.
	; The reason I think this is the _top_ half, not the _bottom_
	;  half, of the PCI register is twofold: (1) PCI tends to come
	;  from a peecee perspective, which means little-endian, and
	;  (2) in view of the NetBSD names for the bits, the code makes
	;  a lot more sense this way than with the halves swapped.
	SETS.W	#0xf900,r0
	mov.w	r0,@(0x06,r8)
	; Not sure.  ROM mapping register maybe?  (PCI_MAPREG_ROM)
	SETS.L	#0,r0
	mov.l	r0,@(0x30,r8)
	; Interrupt line?  (Low byte of PCI_INTERRUPT_REG)
	mov	r8,r1
	add	#0x3c,r1
	mov.b	r0,@r1
	; LAT timer, whatever that is?
	; (Second-low byte of PCI_BHLC_REG)
	mov	#0xf0,r0
	mov.b	r0,@(0x0d,r8)
	; Set MEM_ENABLE and MASTER_ENABLE in PCI command (low half of
	;  command/status - see above)
	mov.w	@(0x04,r8),r0
	or	#0x06,r0
	mov.w	r0,@(0x04,r8)
	; Not sure.  More mapping stuff?  (PCI_MAPREG_PCB_END)
	SETS.L	#0x01000000,r1
	mov.l	r1,@(0x14,r8)
	; Don't know _what_ this is.
	mov	r8,r1
	add	#0x50,r1
	mov.b	@r1,r0
	tst	#1,r0
	bf	initfail_dunno
	; It all looks good.
	bsr	g2_unlock
	 mov	r5,r0
	lds.l	@r15+,pr
	rts
	 clrt
failmsg_nomagic:
	.asciz	"PCI bridge magic string not found"(13,10)
failmsg_noresp:
	.asciz	"PCI bridge not responding"(13,10)
failmsg_dunno:
	.asciz	"PCI bridge not working (offset 0x50)"(13,10)
	.align	2
initfail_nomagic:
	bsr	g2_unlock
	 mov	r5,r0
	SETS.L	#failmsg_nomagic,r1
	bra	1f
	 nop
initfail_noresp:
	bsr	g2_unlock
	 mov	r5,r0
	SETS.L	#failmsg_noresp,r1
	bra	1f
	 nop
initfail_dunno:
	bsr	g2_unlock
	 mov	r5,r0
	SETS.L	#failmsg_dunno,r1
1:	bsr	putstr
	 nop
	lds.l	@r15+,pr
	rts
	 sett

; Input register offset in r1, output in r0.
; Trashes r1 and any part of r0 not filled with read data.
	.macro	rd_body wd
		mov.l	r2,@-r15
		sts.l	pr,@-r15
		bsr	g2_lock
		 nop
		mov.l	r0,@-r15
		SETS.L	#BBA_BASE,r0
		add	r0,r1
		mov.$(wd) @r1,r2
		bsr	g2_unlock
		 mov.l	@r15+,r0
		mov	r2,r0
		lds.l	@r15+,pr
		rts
		 mov.l	@r15+,r2
	.endm
rd_b:
	rd_body b
rd_w:
	rd_body w
rd_l:
	rd_body l

; Input register offset in r1, data in r0.  Trashes both.
	.macro	wr_body wd
		mov.l	r2,@-r15
		sts.l	pr,@-r15
		mov	r0,r2
		bsr	g2_lock
		 nop
		mov.l	r0,@-r15
		SETS.L	#BBA_BASE,r0
		add	r0,r1
		mov.$(wd) r2,@r1
		bsr	g2_unlock
		 mov.l	@r15+,r0
		lds.l	@r15+,pr
		rts
		 mov.l	@r15+,r2
	.endm
wr_b:
	wr_body	b
wr_w:
	wr_body	w
wr_l:
	wr_body	l

	SETCONST

init_ether:
	; libronin and NetBSD do things in different orders.  In
	;  particular, libronin does part of the chip setup before
	;  setting up the rx and tx memory areas; NetBSD does the
	;  memory setup before fiddling the chip.
	sts.l	pr,@-r15
	; Reset the chip.
	mov	#BBA_RTK_COMMAND_RESET,r0
	bsr	wr_b
	 mov	#BBA_RTK_COMMAND,r1
	; Wait, if necessary, for the chip to finish reset.
	; libronin loops 1000000 times here.  NetBSD loops only 1000
	;  times, but does a DELAY(10) inside the loop.  We do the
	;  former, to avoid needing to build a DELAY().
	SETS.L	#1000000,r2
1:	bsr	rd_b
	 mov	#BBA_RTK_COMMAND,r1
	tst	#BBA_RTK_COMMAND_RESET,r0
	bt	1f
	dt	r2
	bf	1b
	; At this point, libronin charges blindly ahead.  NetBSD prints
	;  a message and charges blindly ahead.  The latter strikes me
	;  as saner.
	SETS.L	#reset_fail_msg,r1
	bsr	putstr
	 nop
1:	; I'm not sure what the NetBSD analog of this, if any, is.  It
	;  looks somewhat like the "Enter EEPROM access mode" code, but
	;  the value written there by NetBSD is 0x80, not 0xc0, which
	;  is the PROGRAM mode, not the CONFIG mode.
	mov	#BBA_RTK_EECMD_MODE_CONFIG<<BBA_RTK_EECMD_MODE_SHIFT,r0
	bsr	wr_b
	 mov	#BBA_RTK_EECMD,r1
	; Fetch our MAC address and save it.
	bsr	rd_l
	 mov	#BBA_RTK_MAC,r1
	mov	r0,r3
	bsr	rd_w
	 mov	#BBA_RTK_MAC+4,r1
	SETS.L	#MAC,r2
	mov.b	r0,@(4,r2)
	SHXR	#8,r0
	mov.b	r0,@(5,r2)
	mov	r3,r0
	mov.b	r0,@r2
	SHXR	#8,r0
	mov.b	r0,@(1,r2)
	SHXR	#8,r0
	mov.b	r0,@(2,r2)
	SHXR	#8,r0
	mov.b	r0,@(3,r2)
	; Set up the RX buffer pointer.
	SETS.L	#rxbuff_bounce,r0
	bsr	wr_l
	 mov	#BBA_RTK_RXSTART,r1
	; Clear all the txaddrs.
	mov	#BBA_RTK_TXADDR,r2
	mov	#4,r3
1:	SETS.L	#0,r0
	bsr	wr_l
	 mov	r2,r1
	add	#4,r2
	dt	r3
	bf	1b
	; Turn off early interrupts.
	SETS.L	#0,r0
	bsr	wr_w
	 mov	#BBA_RTK_MULTI_INTR,r1
	; "Must enable Tx/Rx before setting transfer thresholds!" says
	;  libronin; NetBSD doesn't comment any ordering dependency,
	;  but does this enable before doing the TX and RX config.
	SETS.L	#BBA_RTK_COMMAND_ENABLE_TX|BBA_RTK_COMMAND_ENABLE_RX,r0
	bsr	wr_b
	 mov	#BBA_RTK_COMMAND,r1
	; libronin sets just the DMA burst size, with all other bits 0,
	;  but says "Check this value: the documentation for IFG
	;  contradicts ifself.".  The libronin comment on the IFG bits
	;  says that "Enabling these bits violates IEEE 802.3".  NetBSD
	;  comments them as "interframe gap" and "8169 only", with no
	;  indication of any 802.3 violation, and sets both of them.
	;  The 8139C doc sais that _clearing_ them violates 802.3;
	;  perhaps the libronin comment is thinking of them as
	;  active-low.  We set them, for compliant IFGs.
	SETS.L	#[BBA_RTK_TXCFG_MAXDMA_1024<<BBA_RTK_TXCFG_MAXDMA_SHIFT]|[BBA_RTK_TXCFG_IFG_MASK<<BBA_RTK_TXCFG_IFG_SHIFT],r0
	bsr	wr_l
	 mov	#BBA_RTK_TXCFG,r1
	; libronin sets FIFOTHRESH_1024, BUFSIZE_16400, and MAXDMA_1024.
	;  (Later, it also sets RX_INDIVIDUAL and RX_ALL_BCAST.)
	;  NetBSD sets FIFOTHRESH_256, MAXDMA_256, and BUFSIZE_16400 (for
	;  dreamcast, 65552 for others).  Note that check_recv_packet
	;  knows we use a 16K buffer.
	SETS.L	#[BBA_RTK_RXCFG_DMABURST_1024 << BBA_RTK_RXCFG_DMABURST_SHIFT] | [BBA_RTK_RXCFG_BUFSIZ_16400 << BBA_RTK_RXCFG_BUFSIZ_SHIFT] | [BBA_RTK_RXCFG_FIFOTHRESH_1024 << BBA_RTK_RXCFG_FIFOTHRESH_SHIFT] | BBA_RTK_RXCFG_ALL_BCAST | BBA_RTK_RXCFG_MY_UCAST, r0
	SETS.L	#rxcfg,r1
	mov.l	r0,@r1
	bsr	wr_l
	 mov	#BBA_RTK_RXCFG,r1
	; We don't use multicast, so clear the multicast filter.
	SETS.L	#0,r0
	bsr	wr_l
	 mov	#BBA_RTK_MULTI_FILTER,r1
	SETS.L	#0,r0
	bsr	wr_l
	 mov	#BBA_RTK_MULTI_FILTER+4,r1
	lds.l	@r15+,pr
	rts
	 clrt

reset_fail_msg:
	.asciz	"Warning: BBA RTK reset never completed!"(13)(10)

send_contents:
	.byte	0x00, 0x16, 0xe6, 0x37, 0x3d, 0x47	; dst MAC (backstop)
	.byte	0x00, 0xd0, 0xf1, 0x03, 0x4e, 0xc0	; src MAC
	.byte	0x06, 0x54				; ethertype
	.ascii	"Hello, world!"
send_contents_len = . - send_contents

	.align	2

await_link:
	sts.l	pr,@-r15
	bsr	putchar
	 mov	#'L,r1
1:	bsr	rd_b
	 mov	#BBA_RTK_MEDIA_STATUS,r1
	tst	#BBA_RTK_MEDIA_STATUS_NOLINK,r0
	bt	1f
	bsr	nbgetchar
	 nop
	cmp/pz	r0
	bf	1b
1:	lds.l	@r15+,pr
	bra	putchar
	 mov	#'.,r1

; This code does not actually work; we don't get interrupts.  I don't
;  know why not.
;
;enable_interrupts:
;	sts.l	pr,@-r15
;	bsr	rd_w
;	 mov	#BBA_RTK_INTR_STAT,r1
;	SETS.L	#BBA_RTK_INTR_SYSERR | BBA_RTK_INTR_TIMEOUT | BBA_RTK_INTR_LENCHG | BBA_RTK_INTR_RXFOVF | BBA_RTK_INTR_UND_LINK | BBA_RTK_INTR_RXBOVF | BBA_RTK_INTR_TXERR | BBA_RTK_INTR_TXOK | BBA_RTK_INTR_RXERR | BBA_RTK_INTR_RXOK, r0
;	bsr	wr_w
;	 mov	#BBA_RTK_INTR_MASK,r1
;	stc	sr,r0
;	SETS.L	#~[SR_BL|[SR_IMASK_MASK<<SR_IMASK_SHIFT]],r1
;	and	r1,r0
;	ldc	r0,sr
;	lds.l	@r15+,pr
;	rts
;	 nop

init_data:
	SETS.L	#opkt_busy,r0
	SETS.L	#0,r1
	rts
	 mov.b	r1,@r0

;check_send_packet:
;	SETS.L	#send_q,r1
;	mov.l	@r1,r0
;	tst	r0,r0
;	bt	9f
;	sts.l	pr,@-r15
;	SETS.L	#txbuff_bounce,r5
;	SETS.L	#0xa0000000,r0
;	or	r5,r0
;	SETS.L	#send_contents,r1
;	SETS.L	#send_contents_len,r2
;1:	mov.b	@r1+,r3
;	mov.b	r3,@r0
;	dt	r2
;	bf/s	1b
;	 add	#1,r0
;	.if	send_contents_len < 70
;	SETS.L	#70-send_contents_len,r2
;1:	mov.b	r2,@r0
;	dt	r2
;	bf/s	1b
;	 add	#1,r0
;	len_to_send = 70
;	.else
;	len_to_send = send_contents_len
;	.endif
;	mov	r5,r0
;	bsr	wr_l
;	 mov	#BBA_RTK_TXADDR,r1
;	SETS.L	#[BBA_RTK_TXSTAT_EARLYTXTHRESH_MASK<<BBA_RTK_TXSTAT_EARLYTXTHRESH_SHIFT]|len_to_send,r0
;	bsr	wr_l
;	 mov	#BBA_RTK_TXSTAT,r1
;	lds.l	@r15+,pr
;9:	rts
;	 nop

; The 8139C PDF I have does not document how packet reception works.
;  Based on the NetBSD source, the chip DMAs packets into the ring
;  buffer; each packet is preceded by a 32-bit status word and followed
;  by 0-3 bytes of padding so the next packet begins on a 32-bit
;  boundary.  Seen as a long, this status word has the packet length in
;  the high 16 bits; the low 16 bits correspond to the "RX status in
;  packet header" bits in bits-8139C.s.  The CUR_PKT_READ register plus
;  16 (why plus 16? go ask Realtek!) is where we should start reading;
;  the CUR_RX_PTR register is where we should stop.  (The PDF makes it
;  sound as though this holds the number of bytes in the ring buffer;
;  it doesn't.)  Just as additional little surprise to trip us up,
;  while the chip is stuffing the packet in the buffer, the length is
;  0xfff0 - this from the NetBSD driver's comments, which say it's
;  undocumented elsewhere.
check_recv_packet:
	sts.l	pr,@-r15
;		bsr	putchar2
;		 mov	#'R,r1
	SETS.W	#BBA_RTK_INTR_RXOK,r2
	bsr	rd_w
	 mov	#BBA_RTK_INTR_STAT,r1
	tst	r2,r0
.if 0
	bt	9f
.else
	bf	7f
	bra	9f
	 nop
7:
.endif
;		bsr	putchar2
;		 mov	#'a,r1
	; We always use a 16K buffer.
4:	SETS.L	#16384-1,r2
;		bsr	putchar2
;		 mov	#'T,r1
	bsr	rd_b
	 mov	#BBA_RTK_COMMAND,r1
	tst	#BBA_RTK_COMMAND_RXBUF_EMPTY,r0
.if 0
	bf	9f
.else
	bt	7f
;	bsr	putchar2
;	 mov	#'E,r1
	bra	9f
	 nop
7:
.endif
	bsr	rd_w
	 mov	#BBA_RTK_CUR_PKT_READ,r1
		mov.l	r0,@-r15
		bsr	putchar
		 mov	#'<,r1
		mov.l	@r15,r1
		bsr	printhexN
		 mov	#4,r0
		bsr	putchar
		 mov	#',,r1
		mov.l	@r15+,r0
	add	#16,r0
	and	r2,r0
	mov	r0,r3
	bsr	rd_w
	 mov	#BBA_RTK_CUR_RX_PTR,r1
		mov.l	r0,@-r15
		mov	r0,r1
		bsr	printhexN
		 mov	#4,r0
		bsr	putchar
		 mov	#'>,r1
		bsr	putchar
		 mov	#'.,r1
		mov.l	@r15+,r0
	sub	r3,r0
	and	r2,r0
	mov	r0,r4
		bsr	putchar
		 mov	#'[,r1
		bsr	printdec
		 mov	r3,r1
		bsr	putchar
		 mov	#',,r1
		bsr	printdec
		 mov	r4,r1
		bsr	putchar
		 mov	#'],r1
		bsr	putchar
		 mov	#'.,r1
	; In the code below:
	;	r0 = scratch
	;	r1 = scratch
	;	r2 = buffersize mask (16K-1), already set up
	;	r3 = index into ring buffer, already set up
	;	r4 = max bytes to read, already set up
	;	r5 = base of bounce buffer
	;	r6 = 0xfff0 "unfinished packet" length value
	;	r7 = scratch / ipkt pointer
	;	r8 = length/status word
	SETS.L	#rxbuff_bounce|P2_BITS,r5
	SETS.L	#0xfff0,r6
	mov	r5,r0
	mov.l	@(r0,r3),r8
		bsr	printhex8
		 mov	r8,r1
		bsr	putchar2
		 mov	#'.,r1
	mov	r8,r1
	SHLR	#16,r1/r7
	cmp/eq	r1,r6
.if 0
	bt	1f ; if unfinished packet
.else
	bf	7f
	mov.l	r1,@-r15
	bsr	putchar2
	 mov	#'U,r1
	bra	1f
	 mov.l	@r15+,r1
7:
.endif
	add	#4+3,r1 ; 4 for len/stat, 3 for roundup
	shlr2	r1
	shll2	r1
	cmp/hi	r4,r1
.if 0
	bt	1f ; if overruns available space
.else
	bf	7f
	mov.l	r1,@-r15
	bsr	putchar
	 mov	#'O,r1
	bsr	printdec
	 mov.l	@r15,r1
	bsr	putchar
	 mov	#'>,r1
	bsr	printdec
	 mov	r4,r1
	bsr	putchar2
	 mov	#'.,r1
	bra	1f
	 mov.l	@r15+,r1
7:
.endif
	SETS.L	#BBA_RTK_RXSTAT_RXOK,r0
	tst	r0,r8
.if 0
	bt	2f ; if RXOK not set
.else
	bf	7f
	mov.l	r1,@-r15
	bsr	putchar2
	 mov	#'N,r1
	bra	2f
	 mov.l	@r15+,r1
7:
.endif
	; Prepare to copy it to ibuf.
	add	#4,r3
	and	r2,r3
	add	#-4,r4
	add	#-4,r1
	shlr2	r1
	SETS.L	#MIN_ETHER_LEN>>2,r0
	cmp/hi	r1,r0
.if 0
	bt	1f ; if too short
.else
	bf	7f
	mov.l	r1,@-r15
	mov.l	r0,@-r15
	bsr	putchar
	 mov	#'S,r1
	bsr	printdec
	 mov.l	@r15+,r1
	bsr	putchar
	 mov	#'>,r1
	bsr	printdec
	 mov.l	@r15,r1
	bsr	putchar2
	 mov	#'.,r1
	bra	1f
	 mov.l	@r15+,r1
7:
.endif
	SETS.L	#MAX_ETHER_LEN>>2,r0
	cmp/hi	r0,r1
.if 0
	bt	1f ; if too long
.else
	bf	7f
	mov.l	r1,@-r15
	mov.l	r0,@-r15
	bsr	putchar
	 mov	#'L,r1
	bsr	printdec
	 mov.l	@r15+,r1
	bsr	putchar
	 mov	#'<,r1
	bsr	printdec
	 mov.l	@r15,r1
	bsr	putchar2
	 mov	#'.,r1
	bra	1f
	 mov.l	@r15+,r1
7:
.endif
		mov.l	r1,@-r15
		bsr	putchar2
		 mov	#'C,r1
		mov.l	@r15+,r1
	; Now, r1 has longs-to-copy; r3/r4 have been updated to skip
	;  the header word.
	SETS.L	#ipkt,r7
	mov	r8,r0
	SHLR	#16,r0
	mov.l	r0,@r7
3:	mov	r5,r0
	add	#4,r7
	mov.l	@(r0,r3),r0
	mov.l	r0,@r7
	add	#4,r3
	and	r2,r3
	dt	r1
	bf/s	3b
	 add	#-4,r4
	; Packet copied to ibuf.  Update the chip's registers, process
	;  the packet, and go back to see if we (then) have another
	;  packet.
		bsr	putchar2
		 mov	#'.,r1
	bsr	8f
	 nop
		bsr	putchar2
		 mov	#'P,r1
	bsr	process_packet
	 nop
		bsr	putchar2
		 mov	#'.,r1
	bra	4b
	 nop
1:	bsr	8f
	 nop
9:	lds.l	@r15+,pr
;		bra	putchar
;		 mov	#'z,r1
	rts
	 nop
2:	SHLR	#16,r8/r0
		bsr	putchar2
		 mov	#'S,r1
	add	#4+3,r0 ; 4 for len/stat, 3 for roundup
	shlr2	r0
	shll2	r0
	add	r0,r3
	and	r2,r3
	sub	r0,r4
		bsr	putchar2
		 mov	#'.,r1
	bsr	8f
	 nop
	bra	4b
	 nop
8:	add	#-16,r3
	mov	r3,r0
	and	r2,r0
	bra	wr_w
	 mov	#BBA_RTK_CUR_PKT_READ,r1

process_packet:
	sts.l	pr,@-r15
	SETS.L	#ipkt,r2
	mov.l	@r2+,r3
	bsr	printdec
	 mov	r3,r1
	bsr	putchar
	 mov	#':,r1
1:	bsr	putchar
	 mov	#' ,r1
	mov.b	@r2+,r1
	bsr	printhexN
	 mov	#2,r0
	dt	r3
	bf	1b
	bsr	putchar
	 mov	#13,r1
	lds.l	@r15+,pr
	bra	putchar
	 mov	#10,r1

check_serial:
	sts.l	pr,@-r15
	bsr	nbgetchar
	 nop
	cmp/pz	r0
	bf	1f
	bra	done
	 nop
1:	lds.l	@r15+,pr
	rts
	 nop

; Input number is in r1.  Trashes r1 and r0; preserves others.
printdec:
	mov.l	r2,@-r15
	mov.l	r3,@-r15
	mov.l	r4,@-r15
	sts.l	pr,@-r15
	mov	#-1,r0
	mov.l	r0,@-r15
	SETS.L	#10,r0
	; Dividing by 10 is a pain.  But multiplying by 0xcccccccd and
	;  then shifting right by 35 bits produces the same result and
	;  is much less of a pain - and is lots faster, too.
	SETS.L	#0xcccccccd,r2
1:	cmp/hi	r1,r0
	bt	1f
	dmulu.l	r2,r1
	sts	mach,r3
	SHLR	#3,r3
	; r3 is now floor(r1/10)
	dmulu.l	r3,r0
	sts	macl,r4
	sub	r4,r1
	mov.l	r1,@-r15
	bra	1b
	 mov	r3,r1
1:	bsr	putchar
	 add	#'0,r1
	mov.l	@r15+,r1
	cmp/pz	r1
	bt	1b
	lds.l	@r15+,pr
	mov.l	@r15+,r4
	mov.l	@r15+,r3
	rts
	 mov.l	@r15+,r2

printhex8:
	mov	#8,r0
printhexN:
	mov.l	r4,@-r15
	mov	r0,r4
	add	#-8,r0
	neg	r0,r0
	SHLL	#2,r0
	shld	r0,r1
	mov.l	r3,@-r15
	mov.l	r2,@-r15
	sts.l	pr,@-r15
	mova	9f,r0
	mov	r0,r3
	mov	r1,r2
1:	mov	r2,r0
	SHLR	#28,r0
	SHLL	#4,r2
	add	r3,r0
	bsr	putchar
	 mov.b	@r0,r1
	dt	r4
	bf	1b
	lds.l	@r15+,pr
	mov.l	@r15+,r2
	mov.l	@r15+,r3
	rts
	 mov.l	@r15+,r4
	.align	4
9:	.ascii	"0123456789abcdef"
	.align	2
putchar2:
	sts.l	pr,@-r15
	bsr	putchar
	 mov.l	r1,@-r15
	mov.l	@r15+,r1
	 lds.l	@r15+,pr
putchar:
1:	mov.w	@(SCFDR2-SCIF_BASE,gbr),r0
	SHXR	#SCFDR2_TX_SHIFT,r0
	and	#SCFDR2_TX_MASK,r0
	cmp/eq	#16,r0
	bt	1b
	mov	r1,r0
	mov.b	r0,@(SCFTDR2-SCIF_BASE,gbr)
1:	mov.w	@(SCFDR2-SCIF_BASE,gbr),r0
	SHXR	#SCFDR2_TX_SHIFT,r0
	tst	#SCFDR2_TX_MASK,r0
	bf	1b
	rts
	 nop
putstr:
1:	mov.w	@(SCFDR2-SCIF_BASE,gbr),r0
	SHXR	#SCFDR2_TX_SHIFT,r0
	and	#SCFDR2_TX_MASK,r0
	cmp/eq	#16,r0
	bt	1b
	mov.b	@r1+,r0
	tst	r0,r0
	bt	1f
	bra	1b
	 mov.b	r0,@(SCFTDR2-SCIF_BASE,gbr)
1:	; don't bother waiting for drain here; we do a putchar call,
	;  which will drain everything, after all putstr calls and
	;  before anything for which it matters.
	rts
	 nop
nbgetchar:
	mov.w	@(SCFDR2-SCIF_BASE,gbr),r0
	SHXR	#SCFDR2_RX_SHIFT,r0/r1
	tst	#SCFDR2_RX_MASK,r0
	bt	1f
	mov.b	@(SCFRDR2-SCIF_BASE,gbr),r0
	extu.b	r0,r1
	mov.w	@(SCLSR2-SCIF_BASE,gbr),r0
	mov	#0,r0
	mov.w	r0,@(SCLSR2-SCIF_BASE,gbr)
	rts
	 mov	r1,r0
1:	rts
	 mov	#-1,r0

	SETCONST

	; Not sure we actually need to align the VBR; the only reason I
	;  have to suspect we might is that it's the kind of thing I've
	;  seen relatively often before - interrupt/trap vector tables
	;  often need to be aligned, not infrequently to a remarkably
	;  strict boundary.  I see no indication in the manuals that
	;  the SH requires _any_ alignment, but it's easy to do and
	;  definitely won't hurt anything.  (No explicit indication,
	;  that is.  It is implicit in the execution of code at
	;  VBR+0x100, VBR+0x400, and VBR+0x600 that VBR must be even.)
	.align	0x10000
	; Exception handling consists of:
	;	- Save PC and SR in SPC and SSR
	;	- Set SR bit BL to 1 (block exceptions/interrupts)
	;	- Set SR bit MD to 1 (privileged mode)
	;	- Set SR bit RB to 1 (r0-r7 bank 1)
	;	- Write code to EXPEVT or INTEVT
	;	- Set PC to vector addr, resume execution
intvec = .
. = intvec + 0x100
	SETS.L	#0x100,r2
	SETS.L	#EXPEVT,r0
	mov.l	@r0,r3
	SETS.L	#INTEVT,r0
	SETS.L	#regdump,r1
	jmp	@r1
	 mov.l	@r0,r4
	SETCONST
. = intvec + 0x400
	SETS.L	#0x400,r2
	SETS.L	#EXPEVT,r0
	mov.l	@r0,r3
	SETS.L	#INTEVT,r0
	SETS.L	#regdump,r1
	jmp	@r1
	 mov.l	@r0,r4
	SETCONST
. = intvec + 0x600
	SETS.L	#0x600,r2
	SETS.L	#EXPEVT,r0
	mov.l	@r0,r3
	SETS.L	#INTEVT,r0
	SETS.L	#regdump,r1
	jmp	@r1
	 mov.l	@r0,r4
	SETCONST
. = intvec + 0x1000
crash_msg_0:
	.asciz	(13,10,10)"FATAL TRAP"(13,10)"R0  "
crash_msg_1:
	.asciz	"   R1  "
crash_msg_2:
	.asciz	"   R2  "
crash_msg_3:
	.asciz	"   R3  "
crash_msg_4:
	.asciz	(13,10)"R4  "
crash_msg_5:
	.asciz	"   R5  "
crash_msg_6:
	.asciz	"   R6  "
crash_msg_7:
	.asciz	"   R7  "
crash_msg_8:
	.asciz	(13,10)"R8  "
crash_msg_9:
	.asciz	"   R9  "
crash_msg_10:
	.asciz	"   R10 "
crash_msg_11:
	.asciz	"   R11 "
crash_msg_12:
	.asciz	(13,10)"R12 "
crash_msg_13:
	.asciz	"   R13 "
crash_msg_14:
	.asciz	"   R14 "
crash_msg_15:
	.asciz	"   R15 "
crash_msg_gbr:
	.asciz	(13,10)"GBR "
crash_msg_sr:
	.asciz	"   SR  "
crash_msg_pc:
	.asciz	"   PC  "
crash_msg_mach:
	.asciz	(13,10)"MACH"
crash_msg_macl:
	.asciz	"   MACL"
crash_msg_pr:
	.asciz	"   PR  "
crash_msg_vec:
	.asciz	(13,10)"vector"
crash_msg_expevt:
	.asciz	"   EXPEVT"
crash_msg_intevt:
	.asciz	"   INTEVT"
crash_msg_done:
	.asciz	(13,10)
crash_msg_equal:
	.asciz	" = "
	.align	4
crash_msgs:
	.long	crash_msg_0
	.long	crash_msg_1
	.long	crash_msg_2
	.long	crash_msg_3
	.long	crash_msg_4
	.long	crash_msg_5
	.long	crash_msg_6
	.long	crash_msg_7
	.long	crash_msg_8
	.long	crash_msg_9
	.long	crash_msg_10
	.long	crash_msg_11
	.long	crash_msg_12
	.long	crash_msg_13
	.long	crash_msg_14
	.long	crash_msg_15
	.long	crash_msg_gbr
	.long	crash_msg_sr
	.long	crash_msg_pc
	.long	crash_msg_mach
	.long	crash_msg_macl
	.long	crash_msg_pr
	.long	crash_msg_vec
	.long	crash_msg_expevt
	.long	crash_msg_intevt
	.long	0
	.align	2
regdump:
	mov	r15,r5
	SETS.L	#intstacktop,r15
	mov.l	r4,@-r15
	mov.l	r3,@-r15
	mov.l	r2,@-r15
	sts.l	pr,@-r15
	sts.l	macl,@-r15
	sts.l	mach,@-r15
	stc.l	spc,@-r15
	stc.l	ssr,@-r15
	stc.l	gbr,@-r15
	mov.l	r5,@-r15
	mov.l	r14,@-r15
	mov.l	r13,@-r15
	mov.l	r12,@-r15
	mov.l	r11,@-r15
	mov.l	r10,@-r15
	mov.l	r9,@-r15
	mov.l	r8,@-r15
	stc.l	r7_bank,@-r15
	stc.l	r6_bank,@-r15
	stc.l	r5_bank,@-r15
	stc.l	r4_bank,@-r15
	stc.l	r3_bank,@-r15
	stc.l	r2_bank,@-r15
	stc.l	r1_bank,@-r15
	stc.l	r0_bank,@-r15
	SETS.L	#SCIF_BASE,r14
	SETS.L	#crash_msgs,r9
	SETS.L	#putstr,r8
	SETS.L	#printhex8,r7
	SETS.L	#putchar,r6
1:	mov.l	@r9+,r1
	tst	r1,r1
	bt	1f
	jsr	@r8
	 nop
	SETS.L	#crash_msg_equal,r1
	jsr	@r8
	 nop
	jsr	@r7
	 mov.l	@r15+,r1
	bra	1b
	 nop
1:	SETS.L	#crash_msg_done,r1
	jsr	@r8
	 nop
	jsr	@r6
	 mov	#0,r1
	SETS.L	#0xa0000000,r0	; hard-reset vector
	jmp	@r0
	 nop
	SETCONST
	.align	4
	.space	0x1000
intstacktop = .