; H8/536 ROM disassembly
; input: ROM\M27C512@DIP28_1.BIN
; bytes: 65536
; vector mode: min
; analysis: linear sweep
;
; Notes from the manual:
; - H8/536 uses the H8/500 CPU instruction set.
; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
; - The register field is H'FE80-H'FFFF; names below come from appendix B.
; - @aa:8 short absolute operands use BR as the upper address byte.
; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.

; Memory Map
; H'0000-H'009F exception_vectors  vectors
; H'00A0-H'00FF dtc_vectors        dtc_vectors
; H'0100-H'F67F program_or_external program
; H'F680-H'FE7F on_chip_ram        ram
; H'FE80-H'FFFF register_field     registers

; Vectors
; H'0000 reset                    -> vec_reset_1000 (H'1000)
; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
; H'0010 address_error            -> vec_reset_1000 (H'1000)
; H'0012 trace                    -> vec_reset_1000 (H'1000)
; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
; H'0040 irq0                     -> vec_reset_1000 (H'1000)
; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
; H'0048 irq1                     -> vec_reset_1000 (H'1000)
; H'0050 irq2                     -> vec_reset_1000 (H'1000)
; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
; H'005A irq5                     -> vec_reset_1000 (H'1000)
; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)

; Symbols
; ram_F738         H'F738 on_chip_ram        ram      r=0 w=2 width=word
; ram_F73A         H'F73A on_chip_ram        ram      r=0 w=2 width=word
; ram_F73C         H'F73C on_chip_ram        ram      r=0 w=2 width=word
; ram_F73E         H'F73E on_chip_ram        ram      r=0 w=3 width=word
; ram_F740         H'F740 on_chip_ram        ram      r=0 w=2 width=word
; ram_F742         H'F742 on_chip_ram        ram      r=0 w=3 width=word
; ram_F754         H'F754 on_chip_ram        ram      r=0 w=3 width=word

; Board Profile
; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.

; LCD/Text Scan
; search 'CONNECT': not literal, hits=0
;   near: H'A025 'COMPLETED', H'9F98 'COPY', H'A008 'COPY'
; LCD text regions
; region H'9F98-H'A033 count=4   'COPY', 'IN PROGRESS', 'COPY', 'COMPLETED'
; LCD text candidates
; text H'9F98   len=14  medium 'COPY' xrefs=2
; text H'9FB5   len=14  medium 'IN PROGRESS' xrefs=2
; text H'A008   len=14  medium 'COPY' xrefs=2
; text H'A025   len=14  medium 'COMPLETED' xrefs=2

9F80: 40 06          CMP:E #H'06, R0 ; cycles=2
9F82: 00             NOP ; cycles=2
9F83: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
9F88: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
9F8D: 1D F7 54 06 00 MOV:G.W #H'00, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
9F92: 1E C1 71       BSR loc_6106 ; cycles=13
9F95: 20 10          BRA loc_9FA7 ; cycles=8
9F97: 06             .db H'06
9F98: 20 20          BRA loc_9FBA ; cycles=7
9F9A: 20 20          BRA loc_9FBC ; cycles=7
9F9C: 20 43          BRA loc_9FE1 ; cycles=7
9F9E: 4F 50 59       CMP:I #H'5059, R7 ; cycles=3
9FA1: 20 20          BRA loc_9FC3 ; cycles=8
9FA3: 20 20          BRA loc_9FC5 ; cycles=8
9FA5: 20 07          BRA loc_9FAE ; cycles=8

loc_9FA7:
9FA7: 58 9F 97       MOV:I.W #H'9F97, R0 ; LCD text xref H'9F98 'COPY'; dataflow R0=H'9F97; cycles=3
9FAA: 1E BA E4       BSR loc_5A91 ; cycles=13
9FAD: 55 01          MOV:E.B #H'01, R5 ; dataflow R5=H'01; cycles=2
9FAF: 1E 9F 1A       BSR loc_3ECC ; cycles=14
9FB2: 20 10          BRA loc_9FC4 ; cycles=7
9FB4: 06             .db H'06
9FB5: 20 49          BRA loc_A000 ; cycles=8
9FB7: 4E 20 50       CMP:I #H'2050, R6 ; cycles=3

loc_9FBA:
9FBA: 52 4F          MOV:E.B #H'4F, R2 ; dataflow R2=H'4F; cycles=2

loc_9FBC:
9FBC: 47 52          CMP:E #H'52, R7 ; cycles=2
9FBE: 45 53          CMP:E #H'53, R5 ; cycles=2
9FC0: 53 20          MOV:E.B #H'20, R3 ; dataflow R3=H'20; cycles=2
9FC2: 20 07          BRA loc_9FCB ; cycles=7

loc_9FC4:
9FC4: 58 9F B4       MOV:I.W #H'9FB4, R0 ; LCD text xref H'9FB5 'IN PROGRESS'; dataflow R0=H'9FB4; cycles=3
9FC7: 1E BA C7       BSR loc_5A91 ; cycles=14
9FCA: 55 02          MOV:E.B #H'02, R5 ; dataflow R5=H'02; cycles=2
9FCC: 1E 9E FD       BSR loc_3ECC ; cycles=13
9FCF: 1E C1 6A       BSR loc_613C ; cycles=14
9FD2: 1E BA 2F       BSR loc_5A04 ; cycles=13
9FD5: 19             RTS ; cycles=13
9FD6: 00             NOP ; cycles=2
9FD7: 00             NOP ; cycles=2
9FD8: 00             NOP ; cycles=2
9FD9: FF 1D F7 36    SUB.W @(H'1DF7,R7), R6 ; cycles=6
9FDD: 06             .db H'06
9FDE: 00             NOP ; cycles=2
9FDF: 1D F7 38 06 00 MOV:G.W #H'00, @H'F738 ; refs ram_F738 in on_chip_ram; cycles=9
9FE4: 1D F7 3A 06 00 MOV:G.W #H'00, @H'F73A ; refs ram_F73A in on_chip_ram; cycles=11
9FE9: 1D F7 3C 06 00 MOV:G.W #H'00, @H'F73C ; refs ram_F73C in on_chip_ram; cycles=9
9FEE: 1D F7 40 06 00 MOV:G.W #H'00, @H'F740 ; refs ram_F740 in on_chip_ram; cycles=11
9FF3: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
9FF8: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
9FFD: 1D F7 54 06 00 MOV:G.W #H'00, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
A002: 1E C1 01       BSR loc_6106 ; cycles=13
A005: 20 10          BRA loc_A017 ; cycles=8
A007: 06             .db H'06
A008: 20 20          BRA loc_A02A ; cycles=7
A00A: 20 20          BRA loc_A02C ; cycles=7
A00C: 20 43          BRA loc_A051 ; cycles=7
A00E: 4F 50 59       CMP:I #H'5059, R7 ; cycles=3
A011: 20 20          BRA loc_A033 ; cycles=8
A013: 20 20          BRA loc_A035 ; cycles=8
A015: 20 07          BRA loc_A01E ; cycles=8

loc_A017:
A017: 58 A0 07       MOV:I.W #H'A007, R0 ; LCD text xref H'A008 'COPY'; dataflow R0=H'A007; cycles=3
A01A: 1E BA 74       BSR loc_5A91 ; cycles=13
A01D: 55 01          MOV:E.B #H'01, R5 ; dataflow R5=H'01; cycles=2
A01F: 1E 9E AA       BSR loc_3ECC ; cycles=14
A022: 20 10          BRA loc_A034 ; cycles=7
A024: 06             .db H'06
A025: 20 20          BRA loc_A047 ; cycles=8
A027: 43 4F          CMP:E #H'4F, R3 ; cycles=2
A029: 4D 50 4C       CMP:I #H'504C, R5 ; cycles=3

loc_A02C:
A02C: 45 54          CMP:E #H'54, R5 ; cycles=2
A02E: 45 44          CMP:E #H'44, R5 ; cycles=2
A030: 20 20          BRA loc_A052 ; cycles=7
A032: 20 07          BRA loc_A03B ; cycles=7

loc_A034:
A034: 58 A0 24       MOV:I.W #H'A024, R0 ; LCD text xref H'A025 'COMPLETED'; dataflow R0=H'A024; cycles=3
A037: 1E BA 57       BSR loc_5A91 ; cycles=14
A03A: 55 02          MOV:E.B #H'02, R5 ; dataflow R5=H'02; cycles=2
A03C: 1E 9E 8D       BSR loc_3ECC ; cycles=13
A03F: 1E C0 FA       BSR loc_613C ; cycles=14
A042: 1E B9 BF       BSR loc_5A04 ; cycles=13
A045: 19             RTS ; cycles=13
A046: 00             NOP ; cycles=2

loc_A047:
A047: 00             NOP ; cycles=2
A048: 00             NOP ; cycles=2
A049: FF 1E C2 FB    BTST.W #11, @(H'1EC2,R7) ; cycles=6
A04D: 19             RTS ; cycles=13
A04E: 00             NOP ; cycles=2
A04F: 00             NOP ; cycles=2
A050: 00             NOP ; cycles=2

loc_A051:
A051: FF 1D F7 36    SUB.W @(H'1DF7,R7), R6 ; cycles=6
A055: 06             .db H'06
A056: 00             NOP ; cycles=2
A057: 1D F7 38 06 00 MOV:G.W #H'00, @H'F738 ; refs ram_F738 in on_chip_ram; cycles=9
A05C: 1D F7 3A 06 00 MOV:G.W #H'00, @H'F73A ; refs ram_F73A in on_chip_ram; cycles=11
A061: 1D F7 3C 06 00 MOV:G.W #H'00, @H'F73C ; refs ram_F73C in on_chip_ram; cycles=9
A066: 1D F7 40 06 00 MOV:G.W #H'00, @H'F740 ; refs ram_F740 in on_chip_ram; cycles=11
A06B: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
A070: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
A075: 1D F7 54 07 00 B9 MOV:G.W #H'00B9, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
A07B: 59 00 A9       MOV:I.W #H'00A9, R1 ; dataflow R1=H'00A9; cycles=3
A07E: 58 00 00       MOV:I.W #H'0000, R0 ; dataflow R0=H'0000; cycles=3
