-- gate_branch.lua -- does the *real* gate code take the accept branch?
--
-- The static note read the gate as "u16 at 0xAECD2, reject when non-zero".
-- The listing actually does SETF 2 (a 2-BIT field) then MOVE @0xAECD2, so the
-- compared value is bits 2..3 of the word at 0xAECD0.  This script samples that
-- field, then at frame 1000 arms a breakpoint on the instruction the CPU is
-- currently executing and uses its action to set PC to the gate sequence
-- (0x3F58B280 = SETF 2 / MOVE @0xAECD2,A7 / JREQ).  Breakpoints at both
-- targets tell us which way the firmware's own compare goes.
--
-- `go <addr>` cannot be used: MAME's go() sets a *stop* address, not the PC.
-- Breakpoints must be armed from a frame callback; debugger printf needs
-- -debuglog.
local machine = manager.machine
local cpu = machine.devices[':maincpu']
local dbg = machine.debugger
local space = cpu.spaces['program']
if not dbg then machine:exit(); return end
dbg.visible_cpu = cpu

local samples = { [0]=true, [1]=true, [10]=true, [50]=true, [100]=true, [200]=true,
	[300]=true, [600]=true, [1000]=true, [3000]=true }
local f = 0
local armed = false
local jumped = false

local function field()
	local w = space:read_u16(0xaecd0)
	return (w >> 2) & 3, w
end

emu.register_frame_done(function()
	f = f + 1
	if f == 1 and not armed then
		armed = true
		dbg:command('bpset 3F58B2D0,,{ printf "GATE-TARGET REJECT pc=%08X a7=%08X\\n", pc, a7 ; g }')
		dbg:command('bpset 3F58B430,,{ printf "GATE-TARGET ACCEPT pc=%08X a7=%08X\\n", pc, a7 ; g }')
		print("armed gate-target breakpoints at frame 1")
	end
	if samples[f] then
		local v, w = field()
		print(string.format("SAMPLE frame %5d word@0xAECD0=%04X field(bits2..3)=%d", f, w, v))
	end
	if f == 1000 and not jumped then
		jumped = true
		local pc = cpu.state['PC'].value
		local bytes = {}
		for i = 0, 15 do
			bytes[#bytes+1] = string.format("%02X", space:read_u8(0xaec80 + i * 8))
		end
		print("BYTES @bit 0xAEC80 (byte 0x" .. string.format("%X", 0xaec80 >> 3) .. "): " ..
			table.concat(bytes, " "))
		print(string.format("ARM redirect at current pc=%08X -> 3F58B280", pc))
		dbg:command(string.format(
			'bpset %08X,,{ printf "REDIRECT from %%08X\\n", pc ; pc = 3F58B280 ; g }', pc))
	end
	if f >= 1100 then
		print("--- timed out without hitting a gate target")
		machine:exit()
	end
end, "gate-branch")
dbg.execution_state = 'run'