mirror of
https://git.k-space.ee/arti/vt1200.git
synced 2026-10-30 12:03:54 +02:00
SDD
03e6a88b22
Call site (not a register snapshot): 3FA84FB0 calla L3FA6E4B0; 3FA84FE0 stores a8; 3FA85000 move a8,a8 / 3FA85010 jreq; the nonzero path ends at 3FA85360-3FA853A0 with a11 = 0x400 returned. Live breakpoint confirms code=0x400 enters the HOST PORT handler 3FDE9D70. So the quantity to zero is L3FA6E4B0's return value (all five descriptor fields zero). Polarity resolved: L3FA71BC0/L3FA753D0 return their 32-bit flag word, which is 0 iff all their checks pass, so L3FA6E4B0's bits are failure bits. My earlier "L3FA753D0 returns 0x408 while its checks pass" was a misread -- the same 32-bit word also carries the setf-4/setf-2 fields at a13(0xc4/c8/ca/cc). The checks are therefore the right quantity. Loopback-clock deviation (SCN2681 p.12 item 2): real but NOT the cause. CSRA=0x88 gives TX==RX==2400 baud, so the clock source changes only the sampling phase, not the bit count or the completion time; and the received bytes are already correct, so MAME samples the TX bit centres. Not changed (would be banking a green). Measured residual: a ~1-bit write->receive offset (completion at W+1.07 char vs a 1.00-char write interval), sourced from the ~1 bit between a THRA write and the first transmitted bit; forcing it to zero corrupted the sampling phase, so the half-bit TX offset is load-bearing. Model vs datasheet items 3/4/5: matches (loopback fills the FIFO with the receiver disabled, which is what CRA=5 then CRA=0xA relies on). Regression holds.
24 lines
1.1 KiB
Lua
24 lines
1.1 KiB
Lua
-- hp_disp.lua -- what code value actually reaches the HOST PORT handler?
|
|
-- Dispatcher reads the status code from bit 0x16F0 (CODE22_REPORT). HOST PORT
|
|
-- handler = 3FDE9D70. Also log the host-port caller's 0x400 return site.
|
|
local machine = manager.machine
|
|
local cpu = machine.devices[':maincpu']
|
|
local dbg = machine.debugger
|
|
if not dbg then print("ERROR: no debugger"); machine:exit(); return end
|
|
local function bp(addr, body)
|
|
dbg:command('bpset ' .. addr .. ',,{ ' .. body .. ' ; g }')
|
|
end
|
|
bp("3fde9d70", 'printf "HOSTPORT-HANDLER code=%08X\\n", d@16F0')
|
|
bp("3fa84fb0", 'printf "CALL-L3FA6E4B0\\n"')
|
|
bp("3fa84fe0", 'printf "AFTER-CALL a8=%08X\\n", a8')
|
|
bp("3fa853a0", 'printf "CALLER-ERR-RET a8=%08X a11=%08X\\n", a8, a11')
|
|
bp("3fa853d0", 'printf "CALLER-OK-PATH code=%08X\\n", d@16F0')
|
|
bp("3fdf0630", 'printf "DISPATCH-READ code=%08X\\n", d@16F0')
|
|
local n = 0
|
|
emu.register_frame_done(function()
|
|
n = n + 1
|
|
if n >= tonumber(os.getenv("HP_FRAMES") or "700") then print("done "..n); machine:exit() end
|
|
end, "vt1200-hp-disp")
|
|
dbg.visible_cpu = cpu
|
|
dbg.execution_state = 'run'
|