fix DAP disassembler reads D-space instead of I-space with split I/D

When the kernel runs with PTM=1 (split I/D), the DAP disassembler and
instruction-scanning helpers read memory through the runtime MMS path
which can resolve to D-space.  This causes overlay code disassembly to
show garbage (D-space data/BSS content) instead of actual instructions.

Fix:
- Add Dbg_MapVirtualToPhysical() that explicitly selects I-space (PT)
  or D-space (APT) from the PCR, bypassing the STS_PTM+UseAPT logic.
  No traps generated, no PGU/WIP side effects.
- New functions: Dbg_ReadVirtualMemoryISpace/DSpace,
  Dbg_WriteVirtualMemoryISpace/DSpace
- cmd_disassemble and all instruction-scanning code now uses
  Dbg_ReadVirtualMemoryISpace() for instruction fetches
- cmd_read_memory/cmd_write_memory support ispace:/dspace: address
  prefixes (via updated libdap) alongside existing phys: prefix
- Update libdap submodule with I-space/D-space enum + prefix parsing

Author: Ronny Hansen

external/libdap

@@ -960,5 +960,108 @@ int Dbg_WritePhysicalMemory(uint32_t physicalAddress, uint16_t value)
     return 0;
 }
 
+// ---------------------------------------------------------------------------
+// Debugger-only I-space / D-space virtual memory reads.
+//
+// These explicitly select the instruction (PT) or data (APT) page table
+// from the current level's PCR, bypassing the STS_PTM + UseAPT logic in
+// mapVirtualToPhysical.  No traps are generated and PGU/WIP bits are not
+// modified, so these are safe to call from debugger command handlers
+// without disturbing CPU state.
+//
+// This fixes the split I/D (PTM=1) debugger bug where disassembly of
+// overlay code showed D-space garbage instead of I-space instructions.
+// ---------------------------------------------------------------------------
+static int Dbg_MapVirtualToPhysical(uint virtualAddress, bool useAPT)
+{
+    virtualAddress &= 0xFFFF;
+
+    if (!pt.isInitialized)
+        return -1;
+
+    uint16_t pcr = gReg->reg_PCR[CurrLEVEL];
+    uint8_t ring = pcr & 0x03;
+
+    // Ring 3 shadow RAM access (same check as mapVirtualToPhysical)
+    if ((ring == 3) && (IsAddressShadowMemory(virtualAddress, false)))
+        return (int)virtualAddress;
+
+    // No paging = identity map
+    if (!STS_PONI)
+        return (int)(virtualAddress & 0xFFFF);
+
+    uint DIP = virtualAddress & 0x3FF;
+    uint VPN = (virtualAddress >> 10) & 0x3F;
+    uint pageTable;
+    PageTableMode ptm;
+
+    if (useAPT) {
+        // D-space: APT field
+        if ((pcr & (1 << 2)) != 0 && (mmsType == MMS2)) {
+            pageTable = (pcr >> 7) & 0xF;
+            ptm = Sixteen;
+        } else {
+            pageTable = (pcr >> 7) & 0x03;
+            ptm = Four;
+        }
+    } else {
+        // I-space: PT field
+        if ((pcr & (1 << 2)) != 0 && (mmsType == MMS2)) {
+            pageTable = (pcr >> 11) & 0xF;
+            ptm = Sixteen;
+        } else {
+            pageTable = (pcr >> 9) & 0x03;
+            ptm = Four;
+        }
+    }
+
+    uint32_t pageTableEntry = GetPageTableEntry(pageTable, VPN, ptm);
+
+    // Check if page is present (any permission bit set)
+    if ((pageTableEntry & (7L << 29)) == 0)
+        return -1;
+
+    uint16_t PPN;
+    if (STS_SEXI)
+        PPN = (uint16_t)(pageTableEntry & 0x3FFF);
+    else
+        PPN = (uint16_t)(pageTableEntry & 0x1FF);
+
+    int physicalAddress = ((PPN << 10) | DIP) & 0xFFFFFF;
+
+    if (physicalAddress >= ND_Memsize)
+        return -1;
+
+    return physicalAddress;
+}
+
+int Dbg_ReadVirtualMemoryISpace(uint virtualAddress)
+{
+    int pa = Dbg_MapVirtualToPhysical(virtualAddress, false);
+    if (pa < 0) return -1;
+    return Dbg_ReadPhysicalMemory((uint32_t)pa);
+}
+
+int Dbg_ReadVirtualMemoryDSpace(uint virtualAddress)
+{
+    int pa = Dbg_MapVirtualToPhysical(virtualAddress, true);
+    if (pa < 0) return -1;
+    return Dbg_ReadPhysicalMemory((uint32_t)pa);
+}
+
+int Dbg_WriteVirtualMemoryISpace(uint virtualAddress, uint16_t value)
+{
+    int pa = Dbg_MapVirtualToPhysical(virtualAddress, false);
+    if (pa < 0) return -1;
+    return Dbg_WritePhysicalMemory((uint32_t)pa, value);
+}
+
+int Dbg_WriteVirtualMemoryDSpace(uint virtualAddress, uint16_t value)
+{
+    int pa = Dbg_MapVirtualToPhysical(virtualAddress, true);
+    if (pa < 0) return -1;
+    return Dbg_WritePhysicalMemory((uint32_t)pa, value);
+}
+
 // Check if privileged instruction execution is allowed
 

src/cpu/cpu_mms.c

@@ -568,7 +568,7 @@ static uint16_t get_jpl_target_address(uint16_t pc, uint16_t operand)
 static bool is_c_function_prologue(uint16_t pc)
 {
     // Read the instruction at current PC
-    uint16_t operand = ReadVirtualMemory(pc, false);
+    uint16_t operand = Dbg_ReadVirtualMemoryISpace(pc);
 
     // ND-100 C calling convention uses ENTR instruction to enter stack frames
     // ENTR opcode: 0140135 (octal)
@@ -591,7 +591,7 @@ static bool is_c_function_prologue(uint16_t pc)
 static bool is_c_function_epilogue(uint16_t pc)
 {
     // Read the instruction at current PC
-    uint16_t operand = ReadVirtualMemory(pc, false);
+    uint16_t operand = Dbg_ReadVirtualMemoryISpace(pc);
 
     // LEAVE instruction - Normal return from structured stack frame
     // Opcode: 0140136 (octal)
@@ -765,7 +765,7 @@ int step_cpu(DAPServer *server, StepType step_type)
         }
 
         // Check if current instruction is a procedure call (JPL)
-        uint16_t current_operand = ReadVirtualMemory(current_pc, false);
+        uint16_t current_operand = Dbg_ReadVirtualMemoryISpace(current_pc);
         if (is_procedure_call(current_operand)) {
             // Resolve JPL target to determine return address.
             // C calls via csav: JPL sets L = pc+1 (pointing to .word NNN),
@@ -878,7 +878,7 @@ int step_cpu(DAPServer *server, StepType step_type)
             uint16_t jpl_operand = 0;
 
             for (uint16_t addr = current_pc; addr < scan_limit; addr++) {
-                uint16_t operand = ReadVirtualMemory(addr, false);
+                uint16_t operand = Dbg_ReadVirtualMemoryISpace(addr);
                 if (is_procedure_call(operand)) {
                     jpl_addr = addr;
                     jpl_operand = operand;
@@ -3894,16 +3894,27 @@ static int cmd_read_memory(DAPServer *server)
 
     memset(data, 0, byteCount);
 
-    // For physical reads we use Dbg_ReadPhysicalMemory which bypasses the
-    // MMU, watchpoints, and protection traps - this is what the BSD kernel
-    // team needs to reach data above 64K (PPN 64+) on split I/D builds.
-    // For virtual reads we use ReadVirtualMemory which honors PT/APT and
-    // PTM via the current CPU state.
+    // Address space selection:
+    //   physical - bypass MMU entirely (Dbg_ReadPhysicalMemory)
+    //   ispace   - explicit I-space via PT field of PCR (instruction page table)
+    //   dspace   - explicit D-space via APT field of PCR (data page table)
+    //   virtual  - default: ReadVirtualMemory with UseAPT=false
+    bool is_ispace = (server->current_command.context.read_memory.address_space
+                      == DAP_DATA_BP_ADDR_ISPACE);
+    bool is_dspace = (server->current_command.context.read_memory.address_space
+                      == DAP_DATA_BP_ADDR_DSPACE);
 
     for (size_t i = 0; i < byteCount / 2; i++)
     {
-        int word = is_physical ? Dbg_ReadPhysicalMemory(address)
-                               : ReadVirtualMemory(address, false);
+        int word;
+        if (is_physical)
+            word = Dbg_ReadPhysicalMemory(address);
+        else if (is_ispace)
+            word = Dbg_ReadVirtualMemoryISpace(address);
+        else if (is_dspace)
+            word = Dbg_ReadVirtualMemoryDSpace(address);
+        else
+            word = ReadVirtualMemory(address, false);
         if (word == -1)
         {
             server->current_command.context.read_memory.unreadable_bytes = byteCount - i * 2;
@@ -3991,13 +4002,23 @@ static int cmd_write_memory(DAPServer *server)
     int words_written = 0;
     bool is_physical = (server->current_command.context.write_memory.address_space
                         == DAP_DATA_BP_ADDR_PHYSICAL);
+    bool is_ispace = (server->current_command.context.write_memory.address_space
+                      == DAP_DATA_BP_ADDR_ISPACE);
+    bool is_dspace = (server->current_command.context.write_memory.address_space
+                      == DAP_DATA_BP_ADDR_DSPACE);
 
     /* Write word-by-word (ND-100 is word-addressed, 2 bytes per word) */
     for (int i = 0; i + 1 < byte_count; i += 2) {
         uint16_t word = ((uint16_t)buf[i] << 8) | buf[i + 1];
         if (is_physical) {
             if (Dbg_WritePhysicalMemory(addr, word) < 0)
                 break;
+        } else if (is_ispace) {
+            if (Dbg_WriteVirtualMemoryISpace(addr, word) < 0)
+                break;
+        } else if (is_dspace) {
+            if (Dbg_WriteVirtualMemoryDSpace(addr, word) < 0)
+                break;
         } else {
             WriteVirtualMemory(addr, word, false, WRITEMODE_WORD);
         }
@@ -4084,7 +4105,7 @@ static int cmd_disassemble(DAPServer *server)
         else
         {
 
-            uint16_t operand = ReadVirtualMemory(virtualAddress, false);
+            uint16_t operand = Dbg_ReadVirtualMemoryISpace(virtualAddress);
 
             // Get the address of the instruction (DAP SPEC says it must be hex)
             char address_str[10];
@@ -4553,7 +4574,7 @@ void debugger_kbd_input(char c)
         for (int i = 0; i < 10; i++)
         {
 
-            uint16_t operand = ReadVirtualMemory(virtualAddress, false);
+            uint16_t operand = Dbg_ReadVirtualMemoryISpace(virtualAddress);
 
             // Get the address of the instruction (DAP SPEC says it must be hex)
             printf("[%06o] ", virtualAddress);