mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-31 12:05:05 +02:00
63 lines
2.3 KiB
Lua
63 lines
2.3 KiB
Lua
-- gate_branch.lua -- does the *real* gate code take the accept branch?
|
|
--
|
|
-- The static note read the gate as "u16 at 0xAECD2, reject when non-zero".
|
|
-- The listing actually does SETF 2 (a 2-BIT field) then MOVE @0xAECD2, so the
|
|
-- compared value is bits 2..3 of the word at 0xAECD0. This script samples that
|
|
-- field, then at frame 1000 arms a breakpoint on the instruction the CPU is
|
|
-- currently executing and uses its action to set PC to the gate sequence
|
|
-- (0x3F58B280 = SETF 2 / MOVE @0xAECD2,A7 / JREQ). Breakpoints at both
|
|
-- targets tell us which way the firmware's own compare goes.
|
|
--
|
|
-- `go <addr>` cannot be used: MAME's go() sets a *stop* address, not the PC.
|
|
-- Breakpoints must be armed from a frame callback; debugger printf needs
|
|
-- -debuglog.
|
|
local machine = manager.machine
|
|
local cpu = machine.devices[':maincpu']
|
|
local dbg = machine.debugger
|
|
local space = cpu.spaces['program']
|
|
if not dbg then machine:exit(); return end
|
|
dbg.visible_cpu = cpu
|
|
|
|
local samples = { [0]=true, [1]=true, [10]=true, [50]=true, [100]=true, [200]=true,
|
|
[300]=true, [600]=true, [1000]=true, [3000]=true }
|
|
local f = 0
|
|
local armed = false
|
|
local jumped = false
|
|
|
|
local function field()
|
|
local w = space:read_u16(0xaecd0)
|
|
return (w >> 2) & 3, w
|
|
end
|
|
|
|
emu.register_frame_done(function()
|
|
f = f + 1
|
|
if f == 1 and not armed then
|
|
armed = true
|
|
dbg:command('bpset 3F58B2D0,,{ printf "GATE-TARGET REJECT pc=%08X a7=%08X\\n", pc, a7 ; g }')
|
|
dbg:command('bpset 3F58B430,,{ printf "GATE-TARGET ACCEPT pc=%08X a7=%08X\\n", pc, a7 ; g }')
|
|
print("armed gate-target breakpoints at frame 1")
|
|
end
|
|
if samples[f] then
|
|
local v, w = field()
|
|
print(string.format("SAMPLE frame %5d word@0xAECD0=%04X field(bits2..3)=%d", f, w, v))
|
|
end
|
|
if f == 1000 and not jumped then
|
|
jumped = true
|
|
local pc = cpu.state['PC'].value
|
|
local bytes = {}
|
|
for i = 0, 15 do
|
|
bytes[#bytes+1] = string.format("%02X", space:read_u8(0xaec80 + i * 8))
|
|
end
|
|
print("BYTES @bit 0xAEC80 (byte 0x" .. string.format("%X", 0xaec80 >> 3) .. "): " ..
|
|
table.concat(bytes, " "))
|
|
print(string.format("ARM redirect at current pc=%08X -> 3F58B280", pc))
|
|
dbg:command(string.format(
|
|
'bpset %08X,,{ printf "REDIRECT from %%08X\\n", pc ; pc = 3F58B280 ; g }', pc))
|
|
end
|
|
if f >= 1100 then
|
|
print("--- timed out without hitting a gate target")
|
|
machine:exit()
|
|
end
|
|
end, "gate-branch")
|
|
dbg.execution_state = 'run'
|