-- VT1200: dump RAM tables that the static analysis says hold the remote-debug
-- command dispatcher and the DWT console command table.
--
--   VT1200_SKIP_LEVEL1=1 <mame> vt1200 -rompath harness/mame/roms -video none \
--       -sound none -nothrottle -debug -debugger none \
--       -autoboot_script dwt/probe_ram.lua -autoboot_delay 0
--
-- Addresses are TMS34010 *bit* addresses (the program space unit is 1 bit),
-- so read_u32(0x1bb830) reads the 4 bytes at physical byte 0x37706.
-- Diagnostic only: reads memory, writes nothing.

local machine = manager.machine
local cpu = machine.devices[':maincpu']
local dbg = machine.debugger
local space = cpu.spaces['program']

if not dbg then
	print("ERROR: debugger not enabled; pass -debug")
	machine:exit()
	return
end

local FRAME = tonumber(os.getenv("PROBE_FRAME") or "2600")
local frames = 0

local function u32(a) return space:read_u32(a) end
local function u16(a) return space:read_u16(a) end
local function u8(a)  return space:read_u8(a) end

local function dump32(label, base, n)
	print(string.format("--- %s  bit=0x%08X byte=0x%06X", label, base, math.floor(base / 8)))
	for i = 0, n - 1 do
		local v = u32(base + i * 32)
		print(string.format("  [%2d] bit=0x%08X = 0x%08X", i, base + i * 32, v))
	end
end

local function dumpbytes(label, base, n)
	print(string.format("--- %s  bit=0x%08X byte=0x%06X", label, base, math.floor(base / 8)))
	local line = {}
	for i = 0, n - 1 do
		line[#line + 1] = string.format("%02X", u8(base + i * 8))
		if (#line == 16) then
			print("  " .. table.concat(line, " "))
			line = {}
		end
	end
	if #line > 0 then print("  " .. table.concat(line, " ")) end
end

emu.register_frame_done(function()
	frames = frames + 1
	if frames ~= FRAME then return end

	print(string.format("=== frame %d", frames))
	-- remote-debug dispatch table (dispatcher: ADDI 0x1bb830 + opcode*0x20 bits)
	dump32("rdebug command table @ bit 0x1bb830", 0x1bb830, 12)
	dump32("neighbouring globals @ bit 0x1bb7f0", 0x1bb7f0, 6)
	-- DWT console command table (12-byte entries, dispatched at 0xa5c20)
	dump32("DWT console table @ bit 0xa5c00", 0xa5c00, 12)
	-- the 16-byte block dwt_prf renders/copies from
	dumpbytes("dwt_prf source @ bit 0x1be810", 0x1be810, 64)
	-- configuration words consulted by the debug/network accept paths
	print(string.format("--- config @0xaecd0 = 0x%04X   @0xaecd2 = 0x%04X",
		u16(0xaecd0), u16(0xaecd2)))
	machine:exit()
end, "vt1200-probe-ram")

dbg.visible_cpu = cpu
dbg.execution_state = 'run'