aiden/h8-536-decoder
1
0
Fork 0
Code Activity

traces

Browse Source
This commit is contained in:
Aiden
2026-05-27 11:50:10 +10:00
parent 0d099235c5
commit c0304c575c
55 changed files with 26035 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2919
build/panel_button_trace.json Normal file
View File

File diff suppressed because it is too large Load Diff

64
build/panel_button_trace.md Normal file
View File

@@ -0,0 +1,64 @@
# PT2 Known Button ROM Trace
This report follows the panel button edge path from the serial-visible reports back into the ROM input scanner.
The key table is the indirect handler table at `H'2706`, used by `loc_1C0E` after byte-level panel input changes are detected.
## Known Anchors
### CAM POWER
- Emitted selector: `0x0007`
- Handler: `H'1F40`
- Edge source: `F105 -> F6D4` via `F6F2.4`
- Trigger bit: `F6D4.3`
- Table slot: `H'274C` -> `H'1F40`
- Current-level tests: F6D4.3
- State writes: E80E
### CALL
- Emitted selector: `0x0015`
- Handler: `H'20A1`
- Edge source: `F006 -> F6DB` via `F6F3.3`
- Trigger bit: `F6DB.5`
- Table slot: `H'27C0` -> `H'20A1`
- Current-level tests: F6DB.5
- State writes: E82A
## Button Matrix Entries With Serial Reports
| Source | Shadow bit | Dirty | Handler | Selector(s) | State writes |
| --- | --- | --- | --- | --- | --- |
| `F105` | `F6D4.6` | `F6F2.4` | `H'2048` | `0x006B` | `E8D6` |
| `F105` | `F6D4.3` | `F6F2.4` | `H'1F40` | `0x0007` | `E80E` |
| `F105` | `F6D4.2` | `F6F2.4` | `H'1EDE` | `0x0017`, `0x0018` | `E82E`, `E830` |
| `F105` | `F6D4.1` | `F6F2.4` | `H'1EA9` | `0x00F8` | `E9F0` |
| `F105` | `F6D4.0` | `F6F2.4` | `H'1E20` | `0x00B7`, `0x00C4`, `0x00C6`, `0x0097` | `E96E`, `E988`, `E98C`, `E92E` |
| `F106` | `F6D3.7` | `F6F2.3` | `H'1DCE` | `0x0096` | `E92C` |
| `F106` | `F6D3.6` | `F6F2.3` | `H'1D87` | `0x0097` | `E92E` |
| `F106` | `F6D3.5` | `F6F2.3` | `H'1D56` | `0x001A` | `E834` |
| `F106` | `F6D3.4` | `F6F2.3` | `H'1D25` | `0x001A` | `E834` |
| `F106` | `F6D3.3` | `F6F2.3` | `H'1CF4` | `0x001A` | `E834` |
| `F106` | `F6D3.2` | `F6F2.3` | `H'1CCE` | `0x001A` | `E834` |
| `F106` | `F6D3.1` | `F6F2.3` | `H'1CB2` | `0x001A` | `E834` |
| `F109` | `F6D0.7` | `F6F2.0` | `H'24E8` | `0x008F` | `E91E` |
| `F109` | `F6D0.6` | `F6F2.0` | `H'252E` | `0x008F` | `E91E` |
| `F109` | `F6D0.3` | `F6F2.0` | `H'24A9` | `0x0083` | `E906` |
| `F109` | `F6D0.2` | `F6F2.0` | `H'2408` | `0x0083` | `E906` |
| `F109` | `F6D0.1` | `F6F2.0` | `H'2390` | `0x0083` | `E906` |
| `F005` | `F6DC.7` | `F6F3.4` | `H'20F1` | `0x00B9` | `E972` |
| `F005` | `F6DC.5` | `F6F3.4` | `H'2204` | `0x0093` | `E926` |
| `F005` | `F6DC.4` | `F6F3.4` | `H'226D` | `0x0093` | `E926` |
| `F005` | `F6DC.3` | `F6F3.4` | `H'22A6` | `0x0093` | `E926` |
| `F005` | `F6DC.1` | `F6F3.4` | `H'22FC` | `0x0093` | `E926` |
| `F005` | `F6DC.0` | `F6F3.4` | `H'2326` | `0x0093` | `E926` |
| `F006` | `F6DB.7` | `F6F3.3` | `H'200E` | `0x0013` | `E826` |
| `F006` | `F6DB.5` | `F6F3.3` | `H'20A1` | `0x0015` | `E82A` |
| `F006` | `F6DB.3` | `F6F3.3` | `H'20BE` | `0x009A` | `E934` |
## Practical Read
- CALL and CAM POWER do share the general panel edge path with many other buttons.
- The shared path is: panel byte snapshot -> shadow byte -> dirty bit -> `loc_1C0E` jump table -> handler -> `loc_3E54` report.
- Other buttons diverge in their handlers: many require `F731/F730/F791` session/menu gates, mutate page state, or emit different selectors.
- Some table entries are `H'1C25`, an immediate `RTS`, so those physical matrix positions are intentionally ignored in this firmware context.

433
build/rom_f109_handlers.asm Normal file
View File

@@ -0,0 +1,433 @@
; H8/536 ROM disassembly
; input: ROM\M27C512@DIP28_1.BIN
; bytes: 65536
; vector mode: min
; analysis: recursive trace from vectors
;
; Notes from the manual:
; - H8/536 uses the H8/500 CPU instruction set.
; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
; - The register field is H'FE80-H'FFFF; names below come from appendix B.
; - @aa:8 short absolute operands use BR as the upper address byte.
; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
; Memory Map
; H'0000-H'009F exception_vectors vectors
; H'00A0-H'00FF dtc_vectors dtc_vectors
; H'0100-H'F67F program_or_external program
; H'F680-H'FE7F on_chip_ram ram
; H'FE80-H'FFFF register_field registers
; Vectors
; H'0000 reset -> vec_reset_1000 (H'1000)
; H'0004 invalid_instruction -> vec_reset_1000 (H'1000)
; H'0006 zero_divide -> vec_reset_1000 (H'1000)
; H'0008 trap_vs -> vec_reset_1000 (H'1000)
; H'0010 address_error -> vec_reset_1000 (H'1000)
; H'0012 trace -> vec_reset_1000 (H'1000)
; H'0016 nmi -> vec_nmi_4393 (H'4393)
; H'0020 trapa_0 -> vec_reset_1000 (H'1000)
; H'0022 trapa_1 -> vec_reset_1000 (H'1000)
; H'0024 trapa_2 -> vec_reset_1000 (H'1000)
; H'0026 trapa_3 -> vec_reset_1000 (H'1000)
; H'0028 trapa_4 -> vec_reset_1000 (H'1000)
; H'002A trapa_5 -> vec_reset_1000 (H'1000)
; H'002C trapa_6 -> vec_reset_1000 (H'1000)
; H'002E trapa_7 -> vec_reset_1000 (H'1000)
; H'0030 trapa_8 -> vec_reset_1000 (H'1000)
; H'0032 trapa_9 -> vec_reset_1000 (H'1000)
; H'0034 trapa_a -> vec_reset_1000 (H'1000)
; H'0036 trapa_b -> vec_reset_1000 (H'1000)
; H'0038 trapa_c -> vec_reset_1000 (H'1000)
; H'003A trapa_d -> vec_reset_1000 (H'1000)
; H'003C trapa_e -> vec_reset_1000 (H'1000)
; H'003E trapa_f -> vec_reset_1000 (H'1000)
; H'0040 irq0 -> vec_reset_1000 (H'1000)
; H'0042 interval_timer -> vec_interval_timer_BFC4 (H'BFC4)
; H'0048 irq1 -> vec_reset_1000 (H'1000)
; H'0050 irq2 -> vec_reset_1000 (H'1000)
; H'0052 irq3 -> vec_irq3_3C30 (H'3C30)
; H'0058 irq4 -> vec_irq4_3AC7 (H'3AC7)
; H'005A irq5 -> vec_reset_1000 (H'1000)
; H'0062 frt1_ocia -> vec_frt1_ocia_BEEA (H'BEEA)
; H'006A frt2_ocia -> vec_frt2_ocia_BF23 (H'BF23)
; H'0080 sci1_eri -> vec_sci1_eri_BB57 (H'BB57)
; H'0082 sci1_rxi -> vec_sci1_rxi_BB67 (H'BB67)
; H'0084 sci1_txi -> vec_sci1_txi_BA84 (H'BA84)
; H'0090 ad_adi -> vec_ad_adi_3D99 (H'3D99)
; Symbols
; mem_E106 H'E106 program_or_external memory r=5 w=2 width=word
; mem_E110 H'E110 program_or_external memory r=7 w=0 width=word
; mem_E11E H'E11E program_or_external memory r=4 w=0 width=word
; mem_E506 H'E506 program_or_external memory r=2 w=0 width=word
; mem_E906 H'E906 program_or_external memory r=0 w=4 width=word
; mem_E91E H'E91E program_or_external memory r=0 w=2 width=word
; mem_E922 H'E922 program_or_external memory r=0 w=1 width=word
; mem_F404 H'F404 program_or_external memory r=11 w=0 width=byte
; ram_F6D0 H'F6D0 on_chip_ram ram r=13 w=0 width=byte
; ram_F6F4 H'F6F4 on_chip_ram ram r=0 w=2 width=word
; ram_F6F6 H'F6F6 on_chip_ram ram r=0 w=4 width=byte
; ram_F730 H'F730 on_chip_ram ram r=4 w=0 width=byte
; ram_F731 H'F731 on_chip_ram ram r=7 w=0 width=byte
; ram_F791 H'F791 on_chip_ram ram r=11 w=0 width=byte
; Board Profile
; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
; LCD/Text Scan
; search 'CONNECT': not literal, hits=0
; LCD text candidates
; ... 1 more LCD text candidates
2390: 15 F6 D0 F1 BTST.B #1, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
2394: 37 00 70 BEQ loc_2407 ; cycles=3/7 nt/t
2397: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
239C: 32 00 68 BHI loc_2407 ; cycles=3/7 nt/t
239F: 1D E1 10 FF BTST.W #15, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
23A3: 27 05 BEQ loc_23AA ; cycles=3/8 nt/t
23A5: 1E 03 40 BSR loc_26E8 ; cycles=14
23A8: 20 5D BRA loc_2407 ; cycles=7
loc_23AA:
23AA: 15 F6 D0 F2 BTST.B #2, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
23AE: 36 00 CF BNE loc_2480 ; cycles=3/7 nt/t
23B1: 15 F7 30 F7 BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=6
23B5: 27 35 BEQ loc_23EC ; cycles=3/8 nt/t
23B7: 1D E1 06 80 MOV:G.W @H'E106, R0 ; refs mem_E106 in program_or_external; cycles=6
loc_23BB:
23BB: A8 1B SHLR.W R0 ; cycles=3
loc_23BD:
23BD: A8 81 MOV:G.W R0, R1 ; cycles=3
23BF: 27 26 BEQ loc_23E7 ; cycles=3/8 nt/t
23C1: 1D E5 06 51 AND.W @H'E506, R1 ; refs mem_E506 in program_or_external; cycles=6
23C5: 0C FF C4 51 AND.W #H'FFC4, R1 ; cycles=4
23C9: 27 F0 BEQ loc_23BB ; cycles=3/8 nt/t
23CB: 1D E9 06 91 MOV:G.W R1, @H'E906 ; refs mem_E906 in program_or_external; cycles=6
23CF: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
23D1: 5B 00 83 MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
23D4: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
23D8: 27 08 BEQ loc_23E2 ; cycles=3/7 nt/t
23DA: 15 F4 04 F5 BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
23DE: 27 02 BEQ loc_23E2 ; cycles=3/7 nt/t
23E0: AB CE BSET.W #14, R3 ; cycles=3
loc_23E2:
23E2: 1E 1A 6F BSR loc_3E54 ; cycles=13
23E5: 20 20 BRA loc_2407 ; cycles=8
loc_23E7:
23E7: 58 00 04 MOV:I.W #H'0004, R0 ; dataflow R0=H'0004; cycles=3
23EA: 20 48 BRA loc_2434 ; cycles=7
loc_23EC:
23EC: 1D E1 06 D0 BCLR.W #0, @H'E106 ; refs mem_E106 in program_or_external; cycles=9
23F0: 5C 00 00 MOV:I.W #H'0000, R4 ; dataflow R4=H'0000; cycles=3
23F3: 5B 00 83 MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
23F6: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
23FA: 27 08 BEQ loc_2404 ; cycles=3/7 nt/t
23FC: 15 F4 04 F5 BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
2400: 27 02 BEQ loc_2404 ; cycles=3/7 nt/t
2402: AB CE BSET.W #14, R3 ; cycles=3
loc_2404:
2404: 1E F6 2E BSR loc_1A35 ; cycles=13
loc_2407:
2407: 19 RTS ; cycles=13
2408: 15 F6 D0 F2 BTST.B #2, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
240C: 37 00 70 BEQ loc_247F ; cycles=3/7 nt/t
240F: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
2414: 32 00 68 BHI loc_247F ; cycles=3/7 nt/t
2417: 1D E1 10 FF BTST.W #15, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
241B: 27 05 BEQ loc_2422 ; cycles=3/8 nt/t
241D: 1E 02 C8 BSR loc_26E8 ; cycles=14
2420: 20 5D BRA loc_247F ; cycles=7
loc_2422:
2422: 15 F6 D0 F1 BTST.B #1, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
2426: 26 58 BNE loc_2480 ; cycles=3/7 nt/t
2428: 15 F7 30 F7 BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=7
242C: 27 36 BEQ loc_2464 ; cycles=3/7 nt/t
242E: 1D E1 06 80 MOV:G.W @H'E106, R0 ; refs mem_E106 in program_or_external; cycles=7
loc_2432:
2432: A8 1A SHLL.W R0 ; cycles=3
loc_2434:
2434: A8 81 MOV:G.W R0, R1 ; cycles=3
2436: 27 26 BEQ loc_245E ; cycles=3/7 nt/t
2438: 1D E5 06 51 AND.W @H'E506, R1 ; refs mem_E506 in program_or_external; cycles=7
243C: 0C FF C4 51 AND.W #H'FFC4, R1 ; cycles=4
2440: 27 F0 BEQ loc_2432 ; cycles=3/7 nt/t
2442: 1D E9 06 91 MOV:G.W R1, @H'E906 ; refs mem_E906 in program_or_external; cycles=7
2446: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
2448: 5B 00 83 MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
244B: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=6
244F: 27 08 BEQ loc_2459 ; cycles=3/8 nt/t
2451: 15 F4 04 F5 BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=6
2455: 27 02 BEQ loc_2459 ; cycles=3/8 nt/t
2457: AB CE BSET.W #14, R3 ; cycles=3
loc_2459:
2459: 1E 19 F8 BSR loc_3E54 ; cycles=14
245C: 20 21 BRA loc_247F ; cycles=7
loc_245E:
245E: 58 80 00 MOV:I.W #H'8000, R0 ; dataflow R0=H'8000; cycles=3
2461: 30 FF 59 BRA loc_23BD ; cycles=8
loc_2464:
2464: 1D E1 06 D0 BCLR.W #0, @H'E106 ; refs mem_E106 in program_or_external; cycles=9
2468: 5C 00 01 MOV:I.W #H'0001, R4 ; dataflow R4=H'0001; cycles=3
246B: 5B 00 83 MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
246E: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
2472: 27 08 BEQ loc_247C ; cycles=3/7 nt/t
2474: 15 F4 04 F5 BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
2478: 27 02 BEQ loc_247C ; cycles=3/7 nt/t
247A: AB CE BSET.W #14, R3 ; cycles=3
loc_247C:
247C: 1E F5 B6 BSR loc_1A35 ; cycles=13
loc_247F:
247F: 19 RTS ; cycles=13
loc_2480:
2480: 15 F7 30 F7 BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=7
2484: 27 05 BEQ loc_248B ; cycles=3/7 nt/t
2486: 58 40 00 MOV:I.W #H'4000, R0 ; dataflow R0=H'4000; cycles=3
2489: 20 03 BRA loc_248E ; cycles=8
loc_248B:
248B: 58 00 20 MOV:I.W #H'0020, R0 ; dataflow R0=H'0020; cycles=3
loc_248E:
248E: 1D E9 06 90 MOV:G.W R0, @H'E906 ; refs mem_E906 in program_or_external; cycles=7
2492: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
2494: 5B 00 83 MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
2497: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=6
249B: 27 08 BEQ loc_24A5 ; cycles=3/8 nt/t
249D: 15 F4 04 F5 BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=6
24A1: 27 02 BEQ loc_24A5 ; cycles=3/8 nt/t
24A3: AB CE BSET.W #14, R3 ; cycles=3
loc_24A5:
24A5: 1E 19 AC BSR loc_3E54 ; cycles=14
24A8: 19 RTS ; cycles=12
24A9: 15 F6 D0 F3 BTST.B #3, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
24AD: 27 38 BEQ loc_24E7 ; cycles=3/8 nt/t
24AF: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
24B4: 22 31 BHI loc_24E7 ; cycles=3/7 nt/t
24B6: 1D E1 10 FF BTST.W #15, @H'E110 ; refs mem_E110 in program_or_external; cycles=7
24BA: 27 05 BEQ loc_24C1 ; cycles=3/7 nt/t
24BC: 1E 02 29 BSR loc_26E8 ; cycles=13
24BF: 20 26 BRA loc_24E7 ; cycles=8
loc_24C1:
24C1: 15 F7 30 F7 BTST.B #7, @H'F730 ; refs ram_F730 in on_chip_ram; cycles=6
24C5: 27 20 BEQ loc_24E7 ; cycles=3/8 nt/t
24C7: 1D E1 06 80 MOV:G.W @H'E106, R0 ; refs mem_E106 in program_or_external; cycles=6
24CB: A8 E0 BNOT.W #0, R0 ; cycles=3
24CD: 1D E9 06 90 MOV:G.W R0, @H'E906 ; refs mem_E906 in program_or_external; cycles=6
24D1: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
24D3: 5B 00 83 MOV:I.W #H'0083, R3 ; dataflow R3=H'0083; cycles=3
24D6: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
24DA: 27 08 BEQ loc_24E4 ; cycles=3/7 nt/t
24DC: 15 F4 04 F5 BTST.B #5, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
24E0: 27 02 BEQ loc_24E4 ; cycles=3/7 nt/t
24E2: AB CE BSET.W #14, R3 ; cycles=3
loc_24E4:
24E4: 1E 19 6D BSR loc_3E54 ; cycles=13
loc_24E7:
24E7: 19 RTS ; cycles=13
24E8: 15 F6 D0 F7 BTST.B #7, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
24EC: 27 3F BEQ loc_252D ; cycles=3/7 nt/t
24EE: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=7
24F3: 22 38 BHI loc_252D ; cycles=3/8 nt/t
24F5: 1D E1 10 FE BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
24F9: 27 05 BEQ loc_2500 ; cycles=3/8 nt/t
24FB: 1E 01 EA BSR loc_26E8 ; cycles=14
24FE: 20 2D BRA loc_252D ; cycles=7
loc_2500:
2500: 15 F6 F6 13 CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
2504: 1D E1 1E 80 MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=7
2508: A8 FF BTST.W #15, R0 ; cycles=3
250A: 26 05 BNE loc_2511 ; cycles=3/7 nt/t
250C: 58 80 00 MOV:I.W #H'8000, R0 ; dataflow R0=H'8000; cycles=3
250F: 20 02 BRA loc_2513 ; cycles=8
loc_2511:
2511: A8 13 CLR.W R0 ; dataflow R0=H'0000; cycles=3
loc_2513:
2513: 1D E9 1E 90 MOV:G.W R0, @H'E91E ; refs mem_E91E in program_or_external; cycles=6
2517: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
2519: 5B 00 8F MOV:I.W #H'008F, R3 ; dataflow R3=H'008F; cycles=3
251C: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
2520: 27 08 BEQ loc_252A ; cycles=3/7 nt/t
2522: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
2526: 27 02 BEQ loc_252A ; cycles=3/7 nt/t
2528: AB CE BSET.W #14, R3 ; cycles=3
loc_252A:
252A: 1E 19 27 BSR loc_3E54 ; cycles=13
loc_252D:
252D: 19 RTS ; cycles=13
252E: 15 F6 D0 F6 BTST.B #6, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
2532: 27 3F BEQ loc_2573 ; cycles=3/7 nt/t
2534: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=7
2539: 22 38 BHI loc_2573 ; cycles=3/8 nt/t
253B: 1D E1 10 FE BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=6
253F: 27 05 BEQ loc_2546 ; cycles=3/8 nt/t
2541: 1E 01 A4 BSR loc_26E8 ; cycles=14
2544: 20 2D BRA loc_2573 ; cycles=7
loc_2546:
2546: 15 F6 F6 13 CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
254A: 1D E1 1E 80 MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=7
254E: A8 FD BTST.W #13, R0 ; cycles=3
2550: 26 05 BNE loc_2557 ; cycles=3/7 nt/t
2552: 58 20 00 MOV:I.W #H'2000, R0 ; dataflow R0=H'2000; cycles=3
2555: 20 02 BRA loc_2559 ; cycles=8
loc_2557:
2557: A8 13 CLR.W R0 ; dataflow R0=H'0000; cycles=3
loc_2559:
2559: 1D E9 1E 90 MOV:G.W R0, @H'E91E ; refs mem_E91E in program_or_external; cycles=6
255D: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
255F: 5B 00 8F MOV:I.W #H'008F, R3 ; dataflow R3=H'008F; cycles=3
2562: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
2566: 27 08 BEQ loc_2570 ; cycles=3/7 nt/t
2568: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
256C: 27 02 BEQ loc_2570 ; cycles=3/7 nt/t
256E: AB CE BSET.W #14, R3 ; cycles=3
loc_2570:
2570: 1E 18 E1 BSR loc_3E54 ; cycles=13
loc_2573:
2573: 19 RTS ; cycles=13
2574: 15 F6 D0 F4 BTST.B #4, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
2578: 37 01 45 BEQ loc_26C0 ; cycles=3/7 nt/t
257B: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
2580: 22 51 BHI loc_25D3 ; cycles=3/7 nt/t
2582: 1D E1 10 FE BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=7
2586: 27 05 BEQ loc_258D ; cycles=3/7 nt/t
2588: 1E 01 5D BSR loc_26E8 ; cycles=13
258B: 20 46 BRA loc_25D3 ; cycles=8
loc_258D:
258D: 1D E1 1E 80 MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=6
2591: A8 FF BTST.W #15, R0 ; cycles=3
2593: 26 06 BNE loc_259B ; cycles=3/8 nt/t
2595: A8 FD BTST.W #13, R0 ; cycles=3
2597: 26 26 BNE loc_25BF ; cycles=3/8 nt/t
2599: 20 38 BRA loc_25D3 ; cycles=8
loc_259B:
259B: 15 F6 D0 F5 BTST.B #5, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
259F: 27 05 BEQ loc_25A6 ; cycles=3/8 nt/t
25A1: 1E 00 8F BSR loc_2633 ; cycles=14
25A4: 20 2D BRA loc_25D3 ; cycles=7
loc_25A6:
25A6: 5C 00 00 MOV:I.W #H'0000, R4 ; dataflow R4=H'0000; cycles=3
25A9: 5B 00 91 MOV:I.W #H'0091, R3 ; dataflow R3=H'0091; cycles=3
25AC: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
25B0: 27 08 BEQ loc_25BA ; cycles=3/7 nt/t
25B2: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
25B6: 27 02 BEQ loc_25BA ; cycles=3/7 nt/t
25B8: AB CE BSET.W #14, R3 ; cycles=3
loc_25BA:
25BA: 1E F4 78 BSR loc_1A35 ; cycles=13
25BD: 20 14 BRA loc_25D3 ; cycles=8
loc_25BF:
25BF: 15 F6 D0 F5 BTST.B #5, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
25C3: 27 05 BEQ loc_25CA ; cycles=3/8 nt/t
25C5: 1E 00 FF BSR loc_26C7 ; cycles=14
25C8: 20 09 BRA loc_25D3 ; cycles=7
loc_25CA:
25CA: 15 F6 F6 06 C0 MOV:G.B #H'C0, @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
25CF: 1D F6 F4 13 CLR.W @H'F6F4 ; refs ram_F6F4 in on_chip_ram; cycles=8
loc_25D3:
25D3: 19 RTS ; cycles=13
25D4: 15 F6 D0 F5 BTST.B #5, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
25D8: 37 00 E5 BEQ loc_26C0 ; cycles=3/7 nt/t
25DB: 15 F7 31 04 02 CMP:G.B #H'02, @H'F731 ; refs ram_F731 in on_chip_ram; cycles=6
25E0: 22 50 BHI loc_2632 ; cycles=3/7 nt/t
25E2: 1D E1 10 FE BTST.W #14, @H'E110 ; refs mem_E110 in program_or_external; cycles=7
25E6: 27 05 BEQ loc_25ED ; cycles=3/7 nt/t
25E8: 1E 00 FD BSR loc_26E8 ; cycles=13
25EB: 20 45 BRA loc_2632 ; cycles=8
loc_25ED:
25ED: 1D E1 1E 80 MOV:G.W @H'E11E, R0 ; refs mem_E11E in program_or_external; cycles=6
25F1: A8 FF BTST.W #15, R0 ; cycles=3
25F3: 26 06 BNE loc_25FB ; cycles=3/8 nt/t
25F5: A8 FD BTST.W #13, R0 ; cycles=3
25F7: 26 25 BNE loc_261E ; cycles=3/8 nt/t
25F9: 20 37 BRA loc_2632 ; cycles=8
loc_25FB:
25FB: 15 F6 D0 F4 BTST.B #4, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=6
25FF: 27 04 BEQ loc_2605 ; cycles=3/8 nt/t
2601: 0E 30 BSR loc_2633 ; cycles=14
2603: 20 2D BRA loc_2632 ; cycles=8
loc_2605:
2605: 5C 00 01 MOV:I.W #H'0001, R4 ; dataflow R4=H'0001; cycles=3
2608: 5B 00 91 MOV:I.W #H'0091, R3 ; dataflow R3=H'0091; cycles=3
260B: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=6
260F: 27 08 BEQ loc_2619 ; cycles=3/8 nt/t
2611: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=6
2615: 27 02 BEQ loc_2619 ; cycles=3/8 nt/t
2617: AB CE BSET.W #14, R3 ; cycles=3
loc_2619:
2619: 1E F4 19 BSR loc_1A35 ; cycles=14
261C: 20 14 BRA loc_2632 ; cycles=7
loc_261E:
261E: 15 F6 D0 F4 BTST.B #4, @H'F6D0 ; refs ram_F6D0 in on_chip_ram; cycles=7
2622: 27 05 BEQ loc_2629 ; cycles=3/7 nt/t
2624: 1E 00 A0 BSR loc_26C7 ; cycles=13
2627: 20 09 BRA loc_2632 ; cycles=8
loc_2629:
2629: 15 F6 F6 06 80 MOV:G.B #H'80, @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
262E: 1D F6 F4 13 CLR.W @H'F6F4 ; refs ram_F6F4 in on_chip_ram; cycles=9
loc_2632:
2632: 19 RTS ; cycles=12
loc_2633:
2633: 1D E9 22 07 80 00 MOV:G.W #H'8000, @H'E922 ; refs mem_E922 in program_or_external; cycles=9
2639: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
263B: 5B 00 91 MOV:I.W #H'0091, R3 ; dataflow R3=H'0091; cycles=3
263E: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
2642: 27 08 BEQ loc_264C ; cycles=3/7 nt/t
2644: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
2648: 27 02 BEQ loc_264C ; cycles=3/7 nt/t
264A: AB CE BSET.W #14, R3 ; cycles=3
loc_264C:
264C: 1E 18 05 BSR loc_3E54 ; cycles=13
264F: 19 RTS ; cycles=13

16353
build/rom_f109_handlers.json Normal file
View File

File diff suppressed because it is too large Load Diff

107
build/rom_f109_tail.asm Normal file
View File

@@ -0,0 +1,107 @@
; H8/536 ROM disassembly
; input: ROM\M27C512@DIP28_1.BIN
; bytes: 65536
; vector mode: min
; analysis: recursive trace from vectors
;
; Notes from the manual:
; - H8/536 uses the H8/500 CPU instruction set.
; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
; - The register field is H'FE80-H'FFFF; names below come from appendix B.
; - @aa:8 short absolute operands use BR as the upper address byte.
; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
; Memory Map
; H'0000-H'009F exception_vectors vectors
; H'00A0-H'00FF dtc_vectors dtc_vectors
; H'0100-H'F67F program_or_external program
; H'F680-H'FE7F on_chip_ram ram
; H'FE80-H'FFFF register_field registers
; Vectors
; H'0000 reset -> vec_reset_1000 (H'1000)
; H'0004 invalid_instruction -> vec_reset_1000 (H'1000)
; H'0006 zero_divide -> vec_reset_1000 (H'1000)
; H'0008 trap_vs -> vec_reset_1000 (H'1000)
; H'0010 address_error -> vec_reset_1000 (H'1000)
; H'0012 trace -> vec_reset_1000 (H'1000)
; H'0016 nmi -> vec_nmi_4393 (H'4393)
; H'0020 trapa_0 -> vec_reset_1000 (H'1000)
; H'0022 trapa_1 -> vec_reset_1000 (H'1000)
; H'0024 trapa_2 -> vec_reset_1000 (H'1000)
; H'0026 trapa_3 -> vec_reset_1000 (H'1000)
; H'0028 trapa_4 -> vec_reset_1000 (H'1000)
; H'002A trapa_5 -> vec_reset_1000 (H'1000)
; H'002C trapa_6 -> vec_reset_1000 (H'1000)
; H'002E trapa_7 -> vec_reset_1000 (H'1000)
; H'0030 trapa_8 -> vec_reset_1000 (H'1000)
; H'0032 trapa_9 -> vec_reset_1000 (H'1000)
; H'0034 trapa_a -> vec_reset_1000 (H'1000)
; H'0036 trapa_b -> vec_reset_1000 (H'1000)
; H'0038 trapa_c -> vec_reset_1000 (H'1000)
; H'003A trapa_d -> vec_reset_1000 (H'1000)
; H'003C trapa_e -> vec_reset_1000 (H'1000)
; H'003E trapa_f -> vec_reset_1000 (H'1000)
; H'0040 irq0 -> vec_reset_1000 (H'1000)
; H'0042 interval_timer -> vec_interval_timer_BFC4 (H'BFC4)
; H'0048 irq1 -> vec_reset_1000 (H'1000)
; H'0050 irq2 -> vec_reset_1000 (H'1000)
; H'0052 irq3 -> vec_irq3_3C30 (H'3C30)
; H'0058 irq4 -> vec_irq4_3AC7 (H'3AC7)
; H'005A irq5 -> vec_reset_1000 (H'1000)
; H'0062 frt1_ocia -> vec_frt1_ocia_BEEA (H'BEEA)
; H'006A frt2_ocia -> vec_frt2_ocia_BF23 (H'BF23)
; H'0080 sci1_eri -> vec_sci1_eri_BB57 (H'BB57)
; H'0082 sci1_rxi -> vec_sci1_rxi_BB67 (H'BB67)
; H'0084 sci1_txi -> vec_sci1_txi_BA84 (H'BA84)
; H'0090 ad_adi -> vec_ad_adi_3D99 (H'3D99)
; Symbols
; mem_E924 H'E924 program_or_external memory r=0 w=1 width=word
; mem_F404 H'F404 program_or_external memory r=1 w=0 width=byte
; ram_F6F6 H'F6F6 on_chip_ram ram r=0 w=2 width=byte
; ram_F732 H'F732 on_chip_ram ram r=1 w=1 width=word
; ram_F734 H'F734 on_chip_ram ram r=0 w=1 width=word
; ram_F791 H'F791 on_chip_ram ram r=1 w=0 width=byte
; ram_FB02 H'FB02 on_chip_ram ram r=0 w=1 width=byte
; ram_FB03 H'FB03 on_chip_ram ram r=1 w=1 width=byte
; Board Profile
; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
; LCD/Text Scan
; search 'CONNECT': not literal, hits=0
; LCD text candidates
; ... 1 more LCD text candidates
26C0: 15 F6 F6 13 CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
26C4: 30 FF 0C BRA loc_25D3 ; cycles=7
26C7: 15 F6 F6 13 CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=8
26CB: 1D E9 24 07 FF 80 MOV:G.W #H'FF80, @H'E924 ; refs mem_E924 in program_or_external; cycles=9
26D1: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
26D3: 5B 00 92 MOV:I.W #H'0092, R3 ; dataflow R3=H'0092; cycles=3
26D6: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
26DA: 27 08 BEQ loc_26E4 ; cycles=3/7 nt/t
26DC: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
26E0: 27 02 BEQ loc_26E4 ; cycles=3/7 nt/t
26E2: AB CE BSET.W #14, R3 ; cycles=3
loc_26E4:
26E4: 1E 17 6D BSR loc_3E54 ; cycles=13
26E7: 19 RTS ; cycles=13
26E8: 15 FB 03 C7 BSET.B #7, @H'FB03 ; refs ram_FB03 in on_chip_ram; cycles=9
26EC: 26 08 BNE loc_26F6 ; cycles=3/7 nt/t
26EE: 1D F7 32 81 MOV:G.W @H'F732, R1 ; refs ram_F732 in on_chip_ram; cycles=7
26F2: 1D F7 34 91 MOV:G.W R1, @H'F734 ; refs ram_F734 in on_chip_ram; cycles=7
loc_26F6:
26F6: 1D F7 32 07 1C 01 MOV:G.W #H'1C01, @H'F732 ; refs ram_F732 in on_chip_ram; cycles=11
26FC: 15 FB 02 06 14 MOV:G.B #H'14, @H'FB02 ; refs ram_FB02 in on_chip_ram; cycles=9
2701: 1E 21 F6 BSR loc_48FA ; cycles=14
2704: 19 RTS ; cycles=12

2076
build/rom_f109_tail.json Normal file
View File

File diff suppressed because it is too large Load Diff