108 lines
5.5 KiB
NASM
108 lines
5.5 KiB
NASM
; H8/536 ROM disassembly
|
|
; input: ROM\M27C512@DIP28_1.BIN
|
|
; bytes: 65536
|
|
; vector mode: min
|
|
; analysis: recursive trace from vectors
|
|
;
|
|
; Notes from the manual:
|
|
; - H8/536 uses the H8/500 CPU instruction set.
|
|
; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
|
|
; - The register field is H'FE80-H'FFFF; names below come from appendix B.
|
|
; - @aa:8 short absolute operands use BR as the upper address byte.
|
|
; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
|
|
; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
|
|
; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
|
|
; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
|
|
|
|
; Memory Map
|
|
; H'0000-H'009F exception_vectors vectors
|
|
; H'00A0-H'00FF dtc_vectors dtc_vectors
|
|
; H'0100-H'F67F program_or_external program
|
|
; H'F680-H'FE7F on_chip_ram ram
|
|
; H'FE80-H'FFFF register_field registers
|
|
|
|
; Vectors
|
|
; H'0000 reset -> vec_reset_1000 (H'1000)
|
|
; H'0004 invalid_instruction -> vec_reset_1000 (H'1000)
|
|
; H'0006 zero_divide -> vec_reset_1000 (H'1000)
|
|
; H'0008 trap_vs -> vec_reset_1000 (H'1000)
|
|
; H'0010 address_error -> vec_reset_1000 (H'1000)
|
|
; H'0012 trace -> vec_reset_1000 (H'1000)
|
|
; H'0016 nmi -> vec_nmi_4393 (H'4393)
|
|
; H'0020 trapa_0 -> vec_reset_1000 (H'1000)
|
|
; H'0022 trapa_1 -> vec_reset_1000 (H'1000)
|
|
; H'0024 trapa_2 -> vec_reset_1000 (H'1000)
|
|
; H'0026 trapa_3 -> vec_reset_1000 (H'1000)
|
|
; H'0028 trapa_4 -> vec_reset_1000 (H'1000)
|
|
; H'002A trapa_5 -> vec_reset_1000 (H'1000)
|
|
; H'002C trapa_6 -> vec_reset_1000 (H'1000)
|
|
; H'002E trapa_7 -> vec_reset_1000 (H'1000)
|
|
; H'0030 trapa_8 -> vec_reset_1000 (H'1000)
|
|
; H'0032 trapa_9 -> vec_reset_1000 (H'1000)
|
|
; H'0034 trapa_a -> vec_reset_1000 (H'1000)
|
|
; H'0036 trapa_b -> vec_reset_1000 (H'1000)
|
|
; H'0038 trapa_c -> vec_reset_1000 (H'1000)
|
|
; H'003A trapa_d -> vec_reset_1000 (H'1000)
|
|
; H'003C trapa_e -> vec_reset_1000 (H'1000)
|
|
; H'003E trapa_f -> vec_reset_1000 (H'1000)
|
|
; H'0040 irq0 -> vec_reset_1000 (H'1000)
|
|
; H'0042 interval_timer -> vec_interval_timer_BFC4 (H'BFC4)
|
|
; H'0048 irq1 -> vec_reset_1000 (H'1000)
|
|
; H'0050 irq2 -> vec_reset_1000 (H'1000)
|
|
; H'0052 irq3 -> vec_irq3_3C30 (H'3C30)
|
|
; H'0058 irq4 -> vec_irq4_3AC7 (H'3AC7)
|
|
; H'005A irq5 -> vec_reset_1000 (H'1000)
|
|
; H'0062 frt1_ocia -> vec_frt1_ocia_BEEA (H'BEEA)
|
|
; H'006A frt2_ocia -> vec_frt2_ocia_BF23 (H'BF23)
|
|
; H'0080 sci1_eri -> vec_sci1_eri_BB57 (H'BB57)
|
|
; H'0082 sci1_rxi -> vec_sci1_rxi_BB67 (H'BB67)
|
|
; H'0084 sci1_txi -> vec_sci1_txi_BA84 (H'BA84)
|
|
; H'0090 ad_adi -> vec_ad_adi_3D99 (H'3D99)
|
|
|
|
; Symbols
|
|
; mem_E924 H'E924 program_or_external memory r=0 w=1 width=word
|
|
; mem_F404 H'F404 program_or_external memory r=1 w=0 width=byte
|
|
; ram_F6F6 H'F6F6 on_chip_ram ram r=0 w=2 width=byte
|
|
; ram_F732 H'F732 on_chip_ram ram r=1 w=1 width=word
|
|
; ram_F734 H'F734 on_chip_ram ram r=0 w=1 width=word
|
|
; ram_F791 H'F791 on_chip_ram ram r=1 w=0 width=byte
|
|
; ram_FB02 H'FB02 on_chip_ram ram r=0 w=1 width=byte
|
|
; ram_FB03 H'FB03 on_chip_ram ram r=1 w=1 width=byte
|
|
|
|
; Board Profile
|
|
; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
|
|
; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
|
|
; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
|
|
; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
|
|
|
|
; LCD/Text Scan
|
|
; search 'CONNECT': not literal, hits=0
|
|
; LCD text candidates
|
|
; ... 1 more LCD text candidates
|
|
|
|
26C0: 15 F6 F6 13 CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=9
|
|
26C4: 30 FF 0C BRA loc_25D3 ; cycles=7
|
|
26C7: 15 F6 F6 13 CLR.B @H'F6F6 ; refs ram_F6F6 in on_chip_ram; cycles=8
|
|
26CB: 1D E9 24 07 FF 80 MOV:G.W #H'FF80, @H'E924 ; refs mem_E924 in program_or_external; cycles=9
|
|
26D1: 52 80 MOV:E.B #H'80, R2 ; dataflow R2=H'80; cycles=2
|
|
26D3: 5B 00 92 MOV:I.W #H'0092, R3 ; dataflow R3=H'0092; cycles=3
|
|
26D6: 15 F7 91 F7 BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
|
|
26DA: 27 08 BEQ loc_26E4 ; cycles=3/7 nt/t
|
|
26DC: 15 F4 04 F4 BTST.B #4, @H'F404 ; refs mem_F404 in program_or_external; cycles=7
|
|
26E0: 27 02 BEQ loc_26E4 ; cycles=3/7 nt/t
|
|
26E2: AB CE BSET.W #14, R3 ; cycles=3
|
|
|
|
loc_26E4:
|
|
26E4: 1E 17 6D BSR loc_3E54 ; cycles=13
|
|
26E7: 19 RTS ; cycles=13
|
|
26E8: 15 FB 03 C7 BSET.B #7, @H'FB03 ; refs ram_FB03 in on_chip_ram; cycles=9
|
|
26EC: 26 08 BNE loc_26F6 ; cycles=3/7 nt/t
|
|
26EE: 1D F7 32 81 MOV:G.W @H'F732, R1 ; refs ram_F732 in on_chip_ram; cycles=7
|
|
26F2: 1D F7 34 91 MOV:G.W R1, @H'F734 ; refs ram_F734 in on_chip_ram; cycles=7
|
|
|
|
loc_26F6:
|
|
26F6: 1D F7 32 07 1C 01 MOV:G.W #H'1C01, @H'F732 ; refs ram_F732 in on_chip_ram; cycles=11
|
|
26FC: 15 FB 02 06 14 MOV:G.B #H'14, @H'FB02 ; refs ram_FB02 in on_chip_ram; cycles=9
|
|
2701: 1E 21 F6 BSR loc_48FA ; cycles=14
|
|
2704: 19 RTS ; cycles=12
|