net: proper socket API in the kernel (SYS_NET) - no more SLIP in userland

The network stack moves into the kernel. src/socket.asm owns SLIP framing,
IPv4, RFC1071 checksums, and ICMP; programs now speak a socket API through one
syscall (SYS_NET, DE=&netreq dispatched by op): net_socket/connect/send/recv/
close/poll (c/sock.h). No program touches SLIP, IP headers, or checksums.

- Socket table (4 sockets) + tx/rx buffers in WRAM0; our IP = 10.0.0.2.
- net_pump: drains the link, reassembles SLIP frames, demuxes IPv4. Inbound
  ICMP echo requests are auto-answered in-kernel, so the GB replies to pings
  whenever any process pumps RX.
- ICMP sockets: send() emits an echo request to the connected peer; recv()
  returns the matching reply (with a spin/yield timeout).

ping.c is now a ~15-line socket client; netd.c is just `for(;;){net_poll();
yield();}`. Verified over tunbridge:
    /# ping 1.1.1.1     -> replies from the real internet (kernel builds it all)
    host# ping 10.0.0.2 -> 4/4, 0% loss (kernel auto-answers)

Gotchas recorded: gbos.inc isn't a make dep (touch asm after editing); this
crt0 doesn't copy initializers (fill arrays at runtime); and the arg string at
0xA000 overlaps _DATA, so parse targets must sit past it (big buffer first).
UDP and TCP sockets build on this same core next.

5 files changed, 86 insertions, 139 deletions

diff --git a/c/gbos.h b/c/gbos.h
index df52fbe..6ecbd4a 100644
--- a/c/gbos.h
+++ b/c/gbos.h
@@ -17,6 +17,7 @@ void          ssend(unsigned char b);   /* link-port: transmit one byte */
 unsigned char srecv(void);              /* link-port: receive one byte (blocks) */
 int           srecv_nb(void);           /* link-port: receive, or -1 if none */
 unsigned char pollin(void);             /* poll OSK for a typed char, or 0 */
+unsigned char sys_net(void *req);       /* socket layer trap (see sock.h)  */
 
 /* helpers (c/libc.c) */
 void          putu(unsigned int n);              /* print decimal          */
diff --git a/c/libc.s b/c/libc.s
index 7897a79..724fc3b 100644
--- a/c/libc.s
+++ b/c/libc.s
@@ -1,6 +1,7 @@
 	.module libc
 	.globl _writes, _putc, _puts, _nl, _strlen, _readc, _sexit, _getpid, _getargs
 	.globl _open, _close, _fgetc, _fputc, _flist, _fremove, _pipe, _ssend, _srecv, _srecv_nb, _pollin
+	.globl _sys_net
 	;; SDCC sm83 sdcccall(1): 1st arg -> A (byte) or DE (pointer); ret A / BC.
 	;; rst $30 (the trap) clobbers BC/DE/HL; SDCC treats them caller-saved, so
 	;; wrappers need not preserve them - but we compute cleanly regardless.
@@ -116,6 +117,12 @@ _srecv_nb:
 1$:	ld	bc, #0xffff
 	ret
 
+	;; unsigned char sys_net(void *req /*DE*/) -> A  -- socket layer trap
+_sys_net:
+	ld	c, #33			; SYS_NET (DE already = &netreq)
+	rst	#0x30
+	ret
+
 	;; unsigned char pollin(void) -> A  (typed OSK char, or 0)
 _pollin:
 	ld	c, #32			; SYS_POLLIN
diff --git a/c/netd.c b/c/netd.c
index bce6ea7..b07abd2 100644
--- a/c/netd.c
+++ b/c/netd.c
@@ -1,78 +1,12 @@
-#include "netlib.h"
-/* netd - a minimal IP stack over SLIP. Our address is 10.0.0.2, peer 10.0.0.1.
-   Milestones: A) ICMP echo, B) UDP echo. Raw byte arrays, network byte order
-   (big-endian) handled explicitly. */
-
-static unsigned char pkt[256];
-
-/* one's-complement sum (RFC 1071) with a running seed, carry-folded each add */
-static unsigned int sum16(unsigned char *d, unsigned int len, unsigned int sum) {
-    unsigned int w, i = 0;
-    while (i + 1 < len) {
-        w = ((unsigned int)d[i] << 8) | d[i + 1];
-        sum += w; if (sum < w) sum++;
-        i += 2;
-    }
-    if (len & 1) { w = (unsigned int)d[len - 1] << 8; sum += w; if (sum < w) sum++; }
-    return sum;
-}
-
-/* pseudo-header sum for UDP/TCP: src+dst IP, protocol, segment length */
-static unsigned int pseudo(unsigned char proto, unsigned int seglen) {
-    unsigned int sum = sum16(pkt + 12, 8, 0), w;
-    w = proto;  sum += w; if (sum < w) sum++;
-    w = seglen; sum += w; if (sum < w) sum++;
-    return sum;
-}
-
-static void swap4(unsigned char a, unsigned char b) {
-    unsigned char i, t;
-    for (i = 0; i < 4; i++) { t = pkt[a + i]; pkt[a + i] = pkt[b + i]; pkt[b + i] = t; }
-}
-static void swap2(unsigned char a, unsigned char b) {
-    unsigned char t;
-    t = pkt[a]; pkt[a] = pkt[b]; pkt[b] = t;
-    t = pkt[a + 1]; pkt[a + 1] = pkt[b + 1]; pkt[b + 1] = t;
-}
-
-/* recompute the IP header checksum over ihl bytes, then send 'len' total */
-static void ip_send(unsigned char ihl, unsigned int len) {
-    unsigned int c;
-    pkt[10] = 0; pkt[11] = 0;
-    c = ~sum16(pkt, ihl, 0);
-    pkt[10] = (unsigned char)(c >> 8); pkt[11] = (unsigned char)c;
-    slip_send((char *)pkt, (unsigned char)len);
-}
+#include "sock.h"
+/* netd - the network daemon. It just pumps the kernel RX path; the kernel's
+   socket layer owns SLIP/IP and auto-answers inbound ICMP echo requests, so
+   running netd makes the Game Boy respond to pings. No SLIP/IP here anymore. */
 
 void main(void) {
-    unsigned char len, ihl;
-    unsigned int c, seglen;
-    puts("netd: IP up (10.0.0.2)"); nl();
+    puts("netd: up (10.0.0.2)"); nl();
     for (;;) {
-        len = slip_recv((char *)pkt, 255);
-        if (len < 20 || (pkt[0] >> 4) != 4) continue;
-        ihl = (pkt[0] & 0x0f) << 2;
-        pkt[8] = 64;                                  /* TTL for any reply */
-
-        if (pkt[9] == 1) {                            /* ICMP */
-            if (len < (unsigned char)(ihl + 8) || pkt[ihl] != 8) continue;   /* echo request */
-            swap4(12, 16);
-            pkt[ihl] = 0;                             /* -> echo reply */
-            pkt[ihl + 2] = 0; pkt[ihl + 3] = 0;
-            c = ~sum16(pkt + ihl, (unsigned int)(len - ihl), 0);
-            pkt[ihl + 2] = (unsigned char)(c >> 8); pkt[ihl + 3] = (unsigned char)c;
-            ip_send(ihl, len);
-
-        } else if (pkt[9] == 17) {                    /* UDP echo */
-            if (len < (unsigned char)(ihl + 8)) continue;
-            seglen = (unsigned int)(len - ihl);
-            swap4(12, 16);                            /* swap IP addresses */
-            swap2(ihl, ihl + 2);                      /* swap UDP ports */
-            pkt[ihl + 6] = 0; pkt[ihl + 7] = 0;
-            c = ~sum16(pkt + ihl, seglen, pseudo(17, seglen));
-            if (c == 0) c = 0xffff;                   /* UDP: 0 means "none" */
-            pkt[ihl + 6] = (unsigned char)(c >> 8); pkt[ihl + 7] = (unsigned char)c;
-            ip_send(ihl, len);
-        }
+        net_poll();     /* drain RX, answer pings */
+        yield();
     }
 }
diff --git a/c/ping.c b/c/ping.c
index 12dabd9..c98f106 100644
--- a/c/ping.c
+++ b/c/ping.c
@@ -1,17 +1,14 @@
-#include "netlib.h"
-/* ping - originate ICMP echo requests from the Game Boy (10.0.0.2) and print
-   the replies. Target defaults to 10.0.0.1 (the SLIP peer / host); with NAT on
-   the bridge it can reach real internet hosts too. Usage: ping [A.B.C.D] */
+#include "sock.h"
+/* ping - originate ICMP echo requests via the kernel socket layer. No SLIP,
+   no IP, no checksums here: the kernel owns all of that. Usage: ping [A.B.C.D]
+   (default 10.0.0.1, the SLIP peer/host; reaches real hosts through NAT). */
 
-static unsigned char pkt[128];
+/* rbuf is declared first (and large) so the parse target dst[] lands well past
+   the argument string the shell leaves at 0xA000 - writing dst must not clobber
+   the arg while we're still reading it. */
+static unsigned char rbuf[96];
 static unsigned char dst[4];
-
-static unsigned int sum16(unsigned char *d, unsigned int len, unsigned int sum) {
-    unsigned int w, i = 0;
-    while (i + 1 < len) { w = ((unsigned int)d[i] << 8) | d[i + 1]; sum += w; if (sum < w) sum++; i += 2; }
-    if (len & 1) { w = (unsigned int)d[len - 1] << 8; sum += w; if (sum < w) sum++; }
-    return sum;
-}
+static unsigned char payload[4];
 
 static unsigned char parse_ip(char *s, unsigned char *out) {
     unsigned char i, v;
@@ -24,77 +21,33 @@ static unsigned char parse_ip(char *s, unsigned char *out) {
     }
     return 1;
 }
-
 static void put_ip(unsigned char *ip) {
     unsigned char i;
     for (i = 0; i < 4; i++) { putu(ip[i]); if (i < 3) putc('.'); }
 }
 
-static void send_echo(unsigned char seq) {
-    unsigned int c;
-    pkt[0] = 0x45; pkt[1] = 0; pkt[2] = 0; pkt[3] = 28;   /* 20 IP + 8 ICMP */
-    pkt[4] = 0; pkt[5] = 0; pkt[6] = 0; pkt[7] = 0;
-    pkt[8] = 64; pkt[9] = 1; pkt[10] = 0; pkt[11] = 0;    /* TTL, proto ICMP */
-    pkt[12] = 10; pkt[13] = 0; pkt[14] = 0; pkt[15] = 2;  /* src 10.0.0.2 */
-    pkt[16] = dst[0]; pkt[17] = dst[1]; pkt[18] = dst[2]; pkt[19] = dst[3];
-    c = ~sum16(pkt, 20, 0); pkt[10] = (unsigned char)(c >> 8); pkt[11] = (unsigned char)c;
-    pkt[20] = 8; pkt[21] = 0; pkt[22] = 0; pkt[23] = 0;   /* echo request */
-    pkt[24] = 0x12; pkt[25] = 0x34; pkt[26] = 0; pkt[27] = seq;
-    c = ~sum16(pkt + 20, 8, 0); pkt[22] = (unsigned char)(c >> 8); pkt[23] = (unsigned char)c;
-    slip_send((char *)pkt, 28);
-}
-
-/* wait for the ICMP echo reply for 'seq', skipping unrelated frames (the shared
-   10.0.0.0/24 carries IGMP/mDNS/SSDP noise). Returns 1 on match, 0 on timeout.
-   The emulator runs uncapped, so the spin budget is generous to span the
-   wall-clock round trip through the host bridge. */
-static unsigned char ping_wait(unsigned char seq) {
-    unsigned int o, i;
-    unsigned char len = 0, c, ihl;
-    int b;
-    for (o = 0; o < 20; o++) {
-        for (i = 0; i < 60000; i++) {
-            b = srecv_nb();
-            if (b < 0) continue;
-            c = (unsigned char)b;
-            if (c == SLIP_END) {
-                if (len) {
-                    ihl = (unsigned char)((pkt[0] & 0x0f) << 2);
-                    if (len >= (unsigned char)(ihl + 8) && pkt[9] == 1
-                        && pkt[ihl] == 0 && pkt[ihl + 7] == seq) return 1;
-                    len = 0;                     /* not ours - keep waiting */
-                }
-                continue;
-            }
-            if (c == SLIP_ESC) {
-                c = srecv();
-                if (c == SLIP_ESC_END) c = SLIP_END;
-                else if (c == SLIP_ESC_ESC) c = SLIP_ESC;
-            }
-            if (len < 128) pkt[len++] = c; else len = 0;
-        }
-    }
-    return 0;
-}
-
 void main(void) {
     char *arg;
-    unsigned char seq, got = 0;
+    unsigned char s, seq, got = 0;
     arg = getargs();
     if (!arg || !*arg) { dst[0] = 10; dst[1] = 0; dst[2] = 0; dst[3] = 1; }
     else if (!parse_ip(arg, dst)) { puts("ping: bad address"); nl(); sexit(1); }
 
+    payload[0] = 'g'; payload[1] = 'b'; payload[2] = 'o'; payload[3] = 's';
+    s = net_socket(SOCK_ICMP);
+    if (s == 0xFF) { puts("ping: no socket"); nl(); sexit(1); }
+    net_connect(s, dst, 0);
+
     puts("PING "); put_ip(dst); nl();
     for (seq = 1; seq <= 4; seq++) {
-        send_echo(seq);
-        if (ping_wait(seq)) {
+        net_send(s, payload, 4);
+        if (net_recv(s, rbuf, sizeof(rbuf)) != 0xFF) {
             got++;
-            puts("  reply from "); put_ip(pkt + 12);
-            puts(" seq="); putu(seq);
-            puts(" ttl="); putu(pkt[8]); nl();
+            puts("  reply from "); put_ip(dst); puts(" seq="); putu(seq); nl();
         } else {
             puts("  seq="); putu(seq); puts(" timeout"); nl();
         }
     }
     puts("-- "); putu(got); puts("/4 received"); nl();
+    net_close(s);
 }
diff --git a/c/sock.h b/c/sock.h
new file mode 100644
index 0000000..9af2351
--- /dev/null
+++ b/c/sock.h
@@ -0,0 +1,52 @@
+#ifndef SOCK_H
+#define SOCK_H
+/* gbos socket API - the kernel owns SLIP/IP/ICMP/UDP/TCP; programs just do
+   socket()/connect()/send()/recv()/close(). Header-only: one copy per program.
+   The netreq layout must match include/gbos.inc (NR_* / NET_* / SOCK_*). */
+#include "gbos.h"
+
+#define SOCK_ICMP 1
+#define SOCK_UDP  2
+#define SOCK_TCP  3
+
+struct netreq {
+    unsigned char op;
+    unsigned char sock;
+    unsigned char *buf;
+    unsigned char len;
+    unsigned char ip[4];
+    unsigned char port_hi, port_lo;
+};
+static struct netreq _nr;
+
+/* -> socket id, or 0xFF if the table is full */
+static unsigned char net_socket(unsigned char type) {
+    _nr.op = 0; _nr.sock = type;
+    return sys_net(&_nr);
+}
+/* set the remote address/port for send()/recv() */
+static unsigned char net_connect(unsigned char s, const unsigned char *ip, unsigned int port) {
+    unsigned char i;
+    _nr.op = 1; _nr.sock = s;
+    for (i = 0; i < 4; i++) _nr.ip[i] = ip[i];
+    _nr.port_hi = (unsigned char)(port >> 8); _nr.port_lo = (unsigned char)port;
+    return sys_net(&_nr);
+}
+/* send 'len' payload bytes to the connected peer -> 0 ok / 0xFF error */
+static unsigned char net_send(unsigned char s, void *buf, unsigned char len) {
+    _nr.op = 2; _nr.sock = s; _nr.buf = (unsigned char *)buf; _nr.len = len;
+    return sys_net(&_nr);
+}
+/* receive up to 'max' payload bytes -> length, or 0xFF on timeout */
+static unsigned char net_recv(unsigned char s, void *buf, unsigned char max) {
+    _nr.op = 3; _nr.sock = s; _nr.buf = (unsigned char *)buf; _nr.len = max;
+    return sys_net(&_nr);
+}
+static void net_close(unsigned char s) {
+    _nr.op = 4; _nr.sock = s; sys_net(&_nr);
+}
+/* pump the RX path once (answers inbound pings) without blocking */
+static void net_poll(void) {
+    _nr.op = 6; sys_net(&_nr);
+}
+#endif