dwt: visual injection experiments via the returning rdebug jump

dwt/visual/probe_pc.lua

@@ -0,0 +1,46 @@
+-- probe_pc.lua -- sample PC/ST (IE flag) in the idle OS, and check that a
+-- bpset on a sampled address actually fires.  Investigation only.
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+local prog = cpu.spaces['program']
+if not dbg then print("ERROR: no debugger"); machine:exit(); return end
+local IE = 0x200000
+local START = tonumber(os.getenv("PC_START") or "3200")
+local STOP  = tonumber(os.getenv("PC_STOP") or "3300")
+local f = 0
+local armed = false
+local hist = {}
+local first = {}
+local rd = function(a) return prog:read_u16(a) end
+
+emu.register_frame_done(function()
+	f = f + 1
+	local pc = cpu.state['PC'].value
+	local st = cpu.state['ST'].value
+	hist[pc] = (hist[pc] or 0) + 1
+	if not first[pc] then first[pc] = f end
+	if f >= START and f <= STOP and f % 10 == 0 then
+		print(string.format("f%4d PC=%08X ST=%08X IE=%d DPYINT=%04X INTENB=%04X INTPEND=%04X",
+			f, pc, st, (st & IE) ~= 0 and 1 or 0, rd(0xc00000a0), rd(0xc0000110), rd(0xc0000120)))
+	end
+	if f == START and not armed then
+		armed = true
+		dbg:command(string.format('bpset %08X,,{ printf "PCHIT pc=%%08X\\n", pc ; g }', pc))
+		dbg:command('bpset 3F579870,,{ printf "PCHIT2 pc=%08X\\n", pc ; g }')
+		print(string.format("probe_pc: bpset on sampled idle PC %08X", pc))
+	end
+	if f >= STOP then
+		print("--- hottest PCs in window ---")
+		local list = {}
+		for k, c in pairs(hist) do list[#list + 1] = {k, c} end
+		table.sort(list, function(a, b) return a[2] > b[2] end)
+		for i = 1, math.min(10, #list) do
+			print(string.format("  PC=%08X samples=%d first=%d", list[i][1], list[i][2], first[list[i][1]]))
+		end
+		machine:exit()
+	end
+end, "vt1200-probe-pc")
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'