; TI990/12 LOAD ROMs disassembly ; ;General background : ; These ROMs contain the handler for the LOAD/RESTART interrupt. This interrupt is called at ; start-up (instead of RESET, which is used for "warm reset", I think), so that the boot loader in ; ROMs can be executed. ; ; This interrupt can also be triggered by the programmer panel, and there is code to handle the ; panel functions. ; ;Description : ; We have one single 8kb ROM set (2 4k*8 ROMs). ; ; First 4kb contain TI990/12 machine code. They are paged in four 1kb pages. ; All these pages are always located at >FC00. ; ; Last 4kb make no sense. ; ; Page 0 includes programmer panel handling and boot strap code, and a small bit of auto-test code. ; Pages 1-3 include remaining auto-test code. ; ; These ROMs are a source of information on the boot process and TI990/12 hardware. ; ; If you want a starting point, you can have a look at the LOAD vector located at >FFFC (page 0). ; The LOAD routine starts at >FC44 (page 0). ; ; The ROMs are obviously an instance of the "universal ROM loader" as described in the ; Model 990 Universal ROM Loader User's Guide. ; You should read the Universal ROM Loader User's Guide before reading the disassembly. ; ; The ROM basically do the following : ; * handle programmer panel functions if applicable ; * perform extensive self-test ; * look for a MDU, and boot from it if present ; * if programmer panel disabled, boot from the first tape/disk unit it finds (using a MT3200/WD900 ; controller or equivalent) ; * if programmer panel enabled, boot from the unit designated in RO/R1/R2 (either ASR tape, ; FD800 single-sided disk, or tape/disk based on a MT3200/WD900 controller or equivalent) ; ;Conventions used : ; TMS9900 assembly conventions should have been respected. Particularily : ; * bit are numbered from MSB to LSB (unlike almost every other CPU) ; * format for TI990/12-specific instructions was mostly guessed, therefore it is unlikely to be ; very accurate. Specifically, operand order is probably wrong. ; ; Raphael Nabet, 2000/04/24 ; ; revision history : ; 2000/04/24 : explicited MT3200 tape unit support ; 2000/02/23 : fixed a few comments, clarified a few things with MDU support, found out what LCS does ; 2000/02/20 : initial release ; Notes on TI990/12 CPU ; ; TI990/12 should be backward compatible with TI990/10 & TMS9900. It includes the memory mapping ; feature, which is optionnal on TI990/10. Additionnally, it has many extra features and opcodes. ; Some of them are implemented in the tms99000 family. Many are not. ; ;Overview : ; ; * Multiple-byte / Extended (i.e. 32-bit) integers support ; * Multiple-byte ("string") move and compare operations ; * Floating-point real support (single-precision & double-precision) ; * Decimal ascii to/from binary conversion ; * "Writable Control Storage (WCS) - In the model 990/12 Computer, an area set aside that contains ; microcode that is executable by the user tasks via a an XOP instruction within the user program." ; (Source : Model 990 Computer DX10 Operating System Concept and Facilities Manual Volume 1 A-12, ; page 77) ; * Stack operations (I have no idea how they work - no SP register AFAIK) ; * Possibility to declare some memory areas as read-only, data or program, etc. ; * ... ; ; This makes more than 140 instruction types (vs. 69 on TMS9900, and 84 on TMS99105). ; Wow, THIS is a CISC processor :-) . ; ; ;Data types : ; ; Single-precision & double-precision real. ; ; Guessed format : ; 1 bit : sign S ; 7 bits : exponent E (binary, bias >40, power of 16) ; 7/3 bytes : fractional part of mantissa M (binary) (integer part = 0) ; so the number is S * 16^(E - >40) * 0.M ; ; The only difference between single-precision and double-precision appears to be the size of ; mantissa (24 bits vs. 56 bits). ; ; Of course, IEEE double lacks 2 bits to be able to represent TI990/12 double. Quite unpractical ; for those who want to emulate TI990/12 :-( . ; ;Instruction formats : ; ; "String" and "multiple arithmetic" instructions include a 4-bit immediate. ; It appears to be a byte count. ; They use a register, too. I don't know what it is used for, exactly. It is always set to >FFFF ; as input. It is used once as output, and tells how many bytes CS found to be similar. I guess ; it is incremented each time a byte is handled. Since it is always set to >FFFF before each ; string instruction, maybe it changes the operation mode, or provides a byte count. ; ; There are only few instances of field instructions and stack instructions, so I cannot say anything ; for sure. You can search for MVSK, IOF, XV if you like. ; ; ROM page 0. ; LOAD vector, programmer panel handling. ; error handler when the switch from ROM page 0 to page 1 fails (code at >FC40->FC42) FC00: 02E0 0080 LWPI >0080 FC04: 0206 0200 LI R6,>0200 ; return point when the self test was unsuccessful FC08: 020C 1FE0 LI R12,>1FE0 FC0C: 1F0E TB >000E FC0E: 1601 JNE >FC12 FC10: 1D0A SBO >000A FC12: 1D0B SBO >000B FC14: 3206 LDCR R6,8 ; display progress code FC16: 3220 008D LDCR @>008D,8 FC1A: 10FF JMP >FC1A ; stop ; return point when the self test was successful FC1C: 1068 JMP >FCEE ; entry point for self-test FC1E: 0360 RSET ; reset peripherals FC20: 020C 1FE0 LI R12,>1FE0 FC24: 1D0B SBO >000B FC26: 04C6 CLR R6 FC28: 3206 LDCR R6,8 ; clear panel FC2A: 3220 008D LDCR @>008D,8 FC2E: 02E0 0080 LWPI >0080 FC32: 002D EMD ; Execute Micro-Diagnostics : microcode test FC34: 020C 1FB4 LI R12,>1FB4 ; Page switch FC38: 0204 0100 LI R4,>0100 FC3C: 0205 FC00 LI R5,>FC00 FC40: 30C4 LDCR R4,3 ; switch to page #1 FC42: 0455 B *R5 ; jump to self test code at >FC00 ; LOAD vector entry point FC44: 020C 1FE0 LI R12,>1FE0 ; programmer panel CRU base FC48: 0221 6700 AI R1,>6700 ; look for magical value (>9900) FC4C: 1602 JNE >FC52 ; continue with normal vector if not found FC4E: 1D0A SBO >000A ; switch "Run" light on FC50: 0450 B *R0 ; branch to routine if found FC52: 0209 00A0 LI R9,>00A0 ; R9 points to free area in RAM ? FC56: 0700 SETO R0 ; R0 < 0 : use TILINE unit (tape, FD1000, hard disk) by default FC58: 0201 F800 LI R1,>F800 ; TILINE address for default disk unit FC5C: 0202 0800 LI R2,>0800 ; if programmer panel enabled, boot from drive unit 0 by default FC60: 1F0B TB >000B FC62: 13DD JEQ >FC1E ; if programmer panel disabled, jump to self-test FC64: C10E MOV R14,R4 ; load old PC to display it ; programmer panel scan : we have 4 rows of 8 switches ; 16 switches allow to toggle the display in R4. ; the 16 other switches allow to access programmer panel functions. ; ; register conventions here : ; R4 = data register ; R7 = memory address register ; R13 = WP ; R14 = PC ; R15 = ST ; keyscan loop start FC66: 3204 LDCR R4,8 ; display data register MSB FC68: 3220 0089 LDCR @>0089,8 ; display data register LSB FC6C: 0205 FCD0 LI R5,>FCD0 FC70: 0695 BL *R5 ; read current 8 switches from programmer panel to R3 MSB FC72: 16FE JNE >FC70 ; wait for all switches to be released FC74: 0695 BL *R5 FC76: 16FC JNE >FC70 ; test again to fix switch bounce problems FC78: 0695 BL *R5 FC7A: 16FA JNE >FC70 ; again FC7C: 04C3 CLR R3 FC7E: 1D08 SBO >0008 ; "Increment scan" bit -> select another row of switches FC80: 0695 BL *R5 FC82: 13FD JEQ >FC7E ; if no switch pressed, scan next row FC84: 0695 BL *R5 FC86: 13FB JEQ >FC7E ; fixes switch bounce problems FC88: 0695 BL *R5 FC8A: 13F9 JEQ >FC7E ; again FC8C: 1F09 TB >0009 ; scan count bit 0 -> is current switch row number odd or even ? FC8E: 1601 JNE >FC92 FC90: 06C3 SWPB R3 ; if odd, we read last 8 switches in 16 switches, so we rotate 8 bits FC92: 1F08 TB >0008 ; scan count bit 1 -> is this command switches or data switches ? FC94: 1302 JEQ >FC9A ; command switches -> jump to interpret command FC96: 2903 XOR R3,R4 ; data switches -> toggle the data on display as requested FC98: 10E6 JMP >FC66 ; update display and go back to scan routine FC9A: 04C5 CLR R5 FC9C: 05C5 INCT R5 FC9E: 0A13 SLA R3,1 FCA0: 17FD JNC >FC9C ; count first bit set to 1 in R3, i.e. first switch pressed FCA2: 04A5 FCA6 X @>FCA6(R5) ; execute command as needed FCA6: 10DF JMP >FC66 ; jump to display value if the X instruction did not jump ; Programmer panel instruction table. ; All jump offsets must be relative to FCA6 since this is the value of PC when the instruction ; is executed. FCA8: 1013 JMP *+>FCCC->FCA6 ; "Halt/SIE" switch FCAA: 1011 JMP *+>FCC8->FCA6 ; "Run" switch FCAC: 0360 RSET ; "Reset" switch FCAE: 10BC JMP *+>FC1E->FCA6 ; "Load" switch FCB0: C10D MOV R13,R4 ; "Display WP" switch FCB2: C10E MOV R14,R4 ; "Display PC" switch FCB4: C10F MOV R15,R4 ; "Display ST" switch FCB6: C107 MOV R7,R4 ; "Display MA" switch FCB8: C344 MOV R4,R13 ; "Enter WP" switch FCBA: C384 MOV R4,R14 ; "Enter PC" switch FCBC: C3C4 MOV R4,R15 ; "Enter ST" switch FCBE: C1C4 MOV R4,R7 ; "Enter MA" switch FCC0: C117 MOV *R7,R4 ; "MDD" switch ("Memory Data Display") FCC2: 05C7 INCT R7 ; "MAI" switch ("Memory Address Increment") FCC4: C5C4 MOV R4,*R7 ; "MDE" switch ("Memory Data Enter") FCC6: 04C4 CLR R4 ; "CLR" switch ; Code for run switch FCC8: 1D0A SBO >000A ; switch "Run" light on FCCA: 0380 RTWP ; code for "Halt/SIE" switch FCCC: 1D0E SBO >000E ; set "Single Instruction Execute" FCCE: 0380 RTWP ; Restart trap will occur after 2 instructions ; The second instruction executed will be an instruction from the program we interrupted. ; Pressing the HALT/SIE switch repetitively, you will trace the current program. ; this routine read a row of 8 switches from the programmer panel FCD0: 1D0D SBO >000D ; start panel timer FCD2: 1F0A TB >000A ; wait for timer active bit to be set FCD4: 16FE JNE >FCD2 FCD6: 3603 STCR R3,8 ; retrieve value FCD8: 045B B *R11 ; Real boot routine, called after the CPU self-test ; ; We can load from several devices : MDU (Maintenance Diagnostics Unit, with a tape reader), ; ASR (a data terminal with optionnal tape reader), a single-sided disk (dumb controller on CRU bus), ; a tape unit with MT3200 controller, a double-sided floppy disk or a hard disk with WD900 controller ; (intelligent controllers on TI-LINE memory bus). ; ; tape units (MDU, ASR and MT3200) use some object code encoded with alphanumeric and hexadecimal ; characters. ; Single-sided floppy uses a simple boot routine to fetch a binary start-up program. ; The routine for double-sided floppies and hard-disk is somewhat more complex. ; offset table for jumps in object code interpreter, used on >FD6C (offsets relative to >FD6C) FCDA: 302C 2A04 BYTE >FD9C->FD6C, >FD98->FD6C, >FD96->FD6C, >FD70->FD6C FCDE: 0404 041A BYTE >FD70->FD6C, >FD70->FD6C, >FD70->FD6C, >FD86->FD6C FCE2: E60C 0A12 BYTE >FD52->FD6C, >FD78->FD6C, >FD76->FD6C, >FD7E->FD6C FCE2: 1022 1E00 BYTE >FD7C->FD6C, >FD8E->FD6C, >FD8A->FD6C, >00 FCEA: 0404 30E6 BYTE >FD70->FD6C, >FD70->FD6C, >FD9C->FD6C, >FD52->FD6C ; actual boot routine FCEE: 0360 RSET ; RESET external peripherals FCF0: 0203 FEBE LI R3,>FEBE ; address of the start-up routine we jump to - defaults to error routine FCF4: 0205 F7FE LI R5,>F7FE ; last word before system memory space FCF8: C381 MOV R1,R14 ; if programmer panel enabled, TILINE peripheral to boot from FCFA: C3C2 MOV R2,R15 ; if programmer panel enabled, unit to load from ; simple memory test >F7FE -> >0000 FCFC: C555 MOV *R5,*R5 ; try to read and write current word FCFE: 0645 DECT R5 FD00: 18FD JOC >FCFC ; loop until we wrap around to >FFFE ; now real boot FD02: 020C 1FE0 LI R12,>1FE0 FD06: 1D0A SBO >000A ; switch "Run" light on FD08: 1F0E TB >000E ; this bit must tell a MDU is present FD0A: 1302 JEQ >FD10 ; jump if not present FD0C: 04C0 CLR R0 FD0E: 101D JMP >FD4A ; boot from the MDU ? FD10: C000 MOV R0,R0 ; read boot device type (defaults to -1) FD12: 114E JLT >FDB0 ; boot from TILINE tape or disk device (FD1000, hard disk...) FD14: 154C JGT >FDAE ; boot from FD800 single-sided floppy disk ; if (R0 == 0), boot from ASR terminal FD16: 04CC CLR R12 ; device address >000 : 733 ASR FD18: 1D09 SBO >0009 ; set-up device FD1A: 1D0A SBO >000A FD1C: 3220 FEB4 LDCR @>FEB4,8 ; effectively writes >11 ; entry point to boot from TILINE tape unit (MT3200 controller or equivalent) FD20: 04CD CLR R13 FD22: C000 MOV R0,R0 FD24: 1312 JEQ >FD4A ; skip if booting from ASR FD26: C183 MOV R3,R6 ; save R3, R5 FD28: C285 MOV R5,R10 FD2A: 04C0 CLR R0 ; meaningless FD2C: 04C1 CLR R1 ; meaningless FD2E: 04C2 CLR R2 ; read offset = 0 (read record from the beginning) FD30: 0203 0050 LI R3,>0050 ; char count = >0050 (max record lenght = 80 chars) ; It seems we cannot have more than 80 bytes of code ! FD34: 04C4 CLR R4 ; load at address 0 FD36: 0205 0400 LI R5,>0400 ; >4 : read binary forward command FD3A: E14F SOC R15,R5 ; set unit ID FD3C: 06A0 FF7E BL @>FF7E ; execute command on tape unit FD40: D920 FE99 0050 MOVB @>FE99,@>0050(R4) ; append carriage return after the data we read (@>FE99 = >0D) FD46: C0C6 MOV R6,R3 ; restore R3, R5 FD48: C14A MOV R10,R5 ; entry point to boot from MDU FD4A: 020B FEBC LI R11,>FEBC ; pointer to read routine FD4E: 04C7 CLR R7 ; clear checksum FD50: 058D INC R13 ; object code interpreter ; ; ASR, MDU and MT3200 tapes use object code, as described in the Model 990 Computer Programming Card. ; ; We receive characters from the boot device. These are interpreted as commands or as hexadecimal ; immediate operands. Note that we actually only use hexadecimal characters, and 'G','H',':'. ; ; Commands with 16-bit immediate (encoded in hexadecimal) : ; * '1' : Absolute Entry Address : boot routine address = IMM ; * '2' : Relocatable Entry Address : boot routine address = offset + IMM ; * '7' : Checksum : stops the machine if (sum of all data received since start of record) + IMM != 0 ; * '9' : Absolute Load Address : memory address pointer = IMM ; * 'A' : Relocatable Load Address : memory address pointer = offset + IMM ; * 'B' : Absolute Data : * (memory address pointer ++) = IMM ; * 'C' : Relocatable Data : * (memory address pointer ++) = offset + IMM ; * 'D' : Load Bias Or Offset : offset = IMM ; * 'E' : (no reference) : stop the machine ; ; Control commands (parameter-less) : ; * ':' : (no reference) : branch to boot routine address ; * 'F' : End Of Record : wait for next card to be inserted (does not really work) ; ; Unsupported commands with 16-bit immediate (encoded in hexadecimal) : ; * '8' : Ignore Checksum Value : does nothing ; * 'J' : (no reference) ; Unsupported commands with 16-bit immediate (encoded in hexadecimal) and 6-char symbol name : ; * '3', '4', '5', '6', 'G', 'H' (symbol-related commands) ; Unsupported commands with 16-bit immediate (encoded in hexadecimal) and 8-char program name : ; * '0' : Program Start ; * 'I' : (no reference) ; FD52: 069B BL *R11 ; read command number in R10 from tape (range 0-19) FD54: D0AA FCDA MOVB @>FCDA(R10),R2 ; read offset to routine in table FD58: 1327 JEQ >FDA8 ; handle 'F' command separately because it is parameter-less FD5A: 0882 SRA R2,8 ; convert to signed 16-bit offset FD5C: C207 MOV R7,R8 ; save checksum FD5E: 0201 0004 LI R1,>0004 ; 4*4 = 16 bits to read FD62: 069B BL *R11 ; read hex digit (4 bits) FD64: 0A46 SLA R6,4 ; shift digits we have already read FD66: A18A A R10,R6 ; and insert new digit in R6 FD68: 0601 DEC R1 FD6A: 16FB JNE >FD62 ; loop until we have read a 16-bit hex value FD6C: 0462 FD6C B @>FD6C(R2) ; jump to routine ; entry point for '3', '4', '5', '6','G','H' ; read 6 additional characters and ignore them FD70: 0201 0006 LI R1,>0006 ; read 6 chars FD74: 1015 JMP >FDA0 ; entry point for 'A' ; add offset to R6, set address pointer FD76: A189 A R9,R6 ; add offset to R6 (R9 set by 'D' command, defaults to >00A0) ; entry point for '9' ; set address pointer FD78: C146 MOV R6,R5 FD7A: 10EB JMP >FD52 ; next command ; entry point for 'C' ; add offset to R6, write two bytes FD7C: A189 A R9,R6 ; entry point for 'B' ; write two bytes FD7E: DD46 MOVB R6,*R5+ FD80: 06C6 SWPB R6 FD82: DD46 MOVB R6,*R5+ FD84: 10E6 JMP >FD52 ; entry point for '7' ; check checksum FD86: A206 A R6,R8 FD88: 13E4 JEQ >FD52 ; continue on if value matches checksum ; entry point for 'E' ; boot failure FD8A: 046B 0002 B @>0002(R11) ; jump to >FEBE (stop machine and blink fail LED) ; entry point for 'D' ; set bias/offset FD8E: C246 MOV R6,R9 ; set bias/offset value FD90: 0249 FFFE ANDI R9,>FFFE ; convert to word address FD94: 10DE JMP >FD52 ; entry point for '2' ; add offset to R6, set boot routine address FD96: A189 A R9,R6 ; entry point for '1' ; set boot routine address FD98: C0C6 MOV R6,R3 ; set boot routine address FD9A: 10DB JMP >FD52 ; entry point for '0','I' ; read 8 additionnal characters and ignore them FD9C: 0201 0008 LI R1,>0008 ; read 8 chars FDA0: 069B BL *R11 FDA2: 0601 DEC R1 FDA4: 16FD JNE >FDA0 FDA6: 10D5 JMP >FD52 ; entry point for 'F' command (parameter-less) ; wait for next record FDA8: 069B BL *R11 FDAA: 16FE JNE >FDA8 ; wait for next record FDAC: 10BA JMP >FD22 ; branch point to routine at >FE18 FDAE: 1034 JMP >FE18 ; Boot from a tape/disk unit using MD900/MT3200 controller or equivalent on the TILINE bus ; ; When programmer panel is available, the routine expect the unit mask to be in R15. ; ; When programmer panel is unavailable, the routine scans tape units 0-3, then disk units 0-3. ; It generally boots on the first unit which is ready ; however, when possible, it does not boot from ; a writable disk. The resulting priority order is : tape #0, ..., tape #3, ; disk #0 (write-protected), ..., disk #3 (write-protected), ; disk #0 (writable), ..., disk #3 (writable). When no unit is ready, it keeps scanning ; all units continuously, so that the user can insert a boot disk/tape after start-up. ; ; R1 = >F800 (?) ; R2 = >0800 (?) FDB0: 04CD CLR R13 FDB2: 1F0B TB >000B ; programmer panel... FDB4: 1306 JEQ >FDC2 ; if disabled, try each unit until we find a bootable one FDB6: C10F MOV R15,R4 ; current unit mask : 1 (and only 1) bit must be set FDB8: 0A44 SLA R4,4 FDBA: 13B2 JEQ >FD20 ; routine for tape unit FDBC: 102C JMP >FE16 ; routine for disk unit ; we end here when no tape or writable disk could be found. ; R13 may contain the ID of some write-protected disk. FDBE: C3CD MOV R13,R15 ; restore unit ID from R13 FDC0: 162A JNE >FE16 ; jump to boot routine if non-zero ; else, we start over, until someone insert a disk/tape ; Find a bootable tape/disk on the TILINE bus FDC2: 020C 1FC0 LI R12,>1FC0 ; Error interrupt register CRU base FDC6: 020F 0001 LI R15,>0001 FDCA: 020E F880 LI R14,>F880 ; TILINE base address for MT3200 tape controller FDCE: 1E0F SBZ >000F ; clear TIMEOUT (i.e. unimplemented memory) FDD0: 0B1F SRC R15,1 ; try next unit (try >8000 first, then >4000, etc) FDD2: 808F C R15,R2 ; compare with >0800 (support for up to 4 tape units) FDD4: 1B03 JH >FDDC ; jump if greater than >0800 FDD6: C381 MOV R1,R14 ; else use WD900 disk unit at base address >F800 FDD8: D3CF MOVB R15,R15 ; if R15 MSByte is NULL, we are done FDDA: 13F1 JEQ >FDBE ; jump to boot from writable disk, or retry FDDC: C21E MOV *R14,R8 ; load disc status FDDE: 1F0F TB >000F ; test RAM TIMEOUT FDE0: 13F6 JEQ >FDCE ; try next unit if no controller found on bus FDE2: C22E 000E MOV @>000E(R14),R8 ; load controller status FDE6: 1101 JLT >FDEA ; wait for IDLE status bit to be cleared FDE8: 10FC JMP >FDE2 FDEA: 04DE CLR *R14 ; clear disc status FDEC: CB8F 000C MOV R15,@>000C(R14) ; select unit FDF0: 808F C R15,R2 FDF2: 1204 JLE >FDFC ; skip 2 instructions if using disk unit FDF4: EB82 000C SOC R2,@>000C(R14) ; bits 4-7 = >8 : read transport status command FDF8: 04EE 000E CLR @>000E(R14) ; clear controller status FDFC: 0206 5E00 LI R6,>5E00 FE00: 0606 DEC R6 FE02: 16FE JNE >FE00 ; wait for about 10 or 20ms FE04: C21E MOV *R14,R8 ; read disk or tape transport status FE06: 11E3 JLT >FDCE ; try next unit if off-line status bit set (no unit or no tape/disk) FE08: 808F C R15,R2 FE0A: 1B8A JH >FD20 ; if this is a tape unit, jump to object code interpreter FE0C: C34D MOV R13,R13 FE0E: 1601 JNE >FE12 FE10: C34F MOV R15,R13 ; save R15 in R13 if it is the first bootable unit found FE12: 0A38 SLA R8,3 FE14: 17DC JNC >FDCE ; try next unit if the disk is not write-protected (?) FE16: 1061 JMP >FEDA ; jump to disk boot routine if the disk is write-protected (?) ; Complete boot routine to boot from a single-sided diskette ; Boots from FD800 unit at CRU address >80->A0 (i.e. >40->50) FE18: 020C 00A0 LI R12,>00A0 ; CRU base address for command register ? FE1C: 0702 SETO R2 ; R2 = >FFFF FE1E: 04C3 CLR R3 FE20: 3408 STCR R8,16 ; read 16 bits FE22: 1502 JGT >FE28 FE24: 0A68 SLA R8,6 ; if negative, test CRU bit >A5 FE26: 1814 JOC >FE50 ; if bit set, start over FE28: 1F0A TB >000A FE2A: 13FE JEQ >FE28 ; wait for something FE2C: 3002 LDCR R2,16 ; write all 1s FE2E: 0208 E000 LI R8,>E000 FE32: E203 SOC R3,R8 FE34: 1F0A TB >000A FE36: 13FE JEQ >FE34 ; wait again FE38: 3008 LDCR R8,16 ; write track number ??? FE3A: 1F0F TB >000F FE3C: 16FE JNE >FE3A FE3E: 3408 STCR R8,16 ; read 16 bits FE40: 0248 1BFC ANDI R8,>1BFC FE44: 1306 JEQ >FE52 ; start boot FE46: 0223 0400 AI R3,>0400 FE4A: 0283 1000 CI R3,>1000 FE4E: 1AEE JL >FE2C FE50: 10E3 JMP >FE18 ; start over FE52: 020C 0080 LI R12,>0080 ; CRU base address for data register ? FE56: C289 MOV R9,R10 ; R9 points to free area in RAM ? FE58: 0201 0080 LI R1,>0080 ; 256 bytes (= 128 words) in a data cluster ? FE5C: 1F11 TB >0011 ; data present bit (?) FE5E: 1306 JEQ >FE6C FE60: 1F1A TB >001A ; device error bit (?) FE62: 13FC JEQ >FE5C FE64: 020C 00A0 LI R12,>00A0 FE68: 3403 STCR R3,16 FE6A: 102A JMP >FEC0 ; stop the machine in error FE6C: 343A STCR *R10+,16 ; read 16 bits FE6E: 1E0F SBZ >000F FE70: 0641 DECT R1 FE72: 15F4 JGT >FE5C ; loop until read 256 bytes FE74: 064A DECT R10 ; point to last word FE76: 809A C *R10,R2 ; compare last word with >FFFF mark FE78: 16EF JNE >FE58 ; if different, keep 254 previous bytes and append another sector (?) FE7A: 0360 RSET ; else, jump to boot routine FE7C: 0200 FEC8 LI R0,>FEC8 FE80: CE43 MOV R3,*R9+ ; write device number FE82: 0459 B *R9 ; execute boot routine at offset 2 ; read routine ; Read ASCII character from 733 ASR located at >000, a MDU unit located at >FF0, or a MT3200 tape unit ; on TILINE bus, and translate it to one hexadecimal number. FE84: C000 MOV R0,R0 ; test device type flag FE86: 1105 JLT >FE92 ; jump if MT3200 FE88: 1F0C TB >000C FE8A: 16FE JNE >FE88 ; wait... FE8C: 1E0C SBZ >000C FE8E: 35CA STCR R10,7 ; read 7 bits FE90: 1001 JMP >FE94 FE92: D2B4 MOVB *R4+,R10 ; read byte from memory (MT3200 is DMA driven) FE94: 098A SRL R10,8 ; move MSB to LSB FE96: 028A 000D CI R10,>000D ; carriage return ? (appended at end of MT3200 record) FE9A: 130F JEQ >FEBA ; if so return FE9C: 028A 005A CI R10,>005A ; greater than 'Z' ? FEA0: 15F1 JGT >FE84 ; if so, ignore current char and read next char FEA2: 028A 0020 CI R10,>0020 ; control character (lower than ' ') ? FEA6: 11EE JLT >FE84 ; if so, ignore current char and read next char FEA8: A1CA A R10,R7 ; update checksum FEAA: 022A FFD0 AI R10,>FFD0 ; substract >30 (numeric character -> numeric value) FEAE: 028A 000A CI R10,>000A FEB2: 1307 JEQ >FEC2 ; jump to handler if it is ':' FEB4: 1102 JLT >FEBA ; if greater, it must be 'A'-'F' FEB6: 022A FFF9 AI R10,>FFF9 ; convert to hex value FEBA: 069B BL *R11 ; trick : return to the caller AND restore R11 to be >FEBC ; read routine entry point FEBC: 10E3 JMP >FE84 ; entry point for bad ':' (called when no '1' command has been executed before ':') FEBE: C0CD MOV R13,R3 FEC0: 1057 JMP >FF70 ; handler for ':' command FEC2: C000 MOV R0,R0 ; test boot device type flag FEC4: 1608 JNE >FED6 FEC6: 1E0B SBZ >000B ; clean-up ? FEC8: 1E0C SBZ >000C FECA: 0581 INC R1 FECC: 16FE JNE >FECA FECE: 1F0C TB >000C FED0: 13F8 JEQ >FEC2 FED2: 1E09 SBZ >0009 FED4: 1E0D SBZ >000D FED6: 0360 RSET ; reset all peripherals FED8: 0453 B *R3 ; jump to boot routine ; boot from a disk unit attached to a WD900 disk controller (or equivalent) whose address is in R14 FEDA: C14F MOV R15,R5 ; unit ID FEDC: 020C FF7E LI R12,>FF7E FEE0: 020D 0005 LI R13,>0005 ; retry count ? FEE4: 0200 0700 LI R0,>0700 ; restore command FEE8: 04C1 CLR R1 FEEA: 069C BL *R12 FEEC: 04C0 CLR R0 ; store register command FEEE: 0203 0006 LI R3,>0006 ; command returns 6 bytes FEF2: 0204 0200 LI R4,>0200 ; free area in RAM FEF6: 069C BL *R12 FEF8: C2A4 0004 MOV @>0004(R4),R10 FEFC: 09BA SRL R10,11 ; keep number of track per cylinder (i.e. number of heads) FEFE: 0200 0400 LI R0,>0400 ; read unformatted FF02: 04C2 CLR R2 ; cylinder 0 FF04: 069C BL *R12 ; read track/cylinder address, # of sectors per record, and sector lenght FF06: C004 MOV R4,R0 ; >0200 : read data (?) FF08: D064 0002 MOVB @>0002(R4),R1 ; set the "sectors per records" field FF0C: C0E4 0004 MOV @>0004(R4),R3 ; count = sector lenght FF10: 0A13 SLA R3,1 ; word count -> byte count FF12: 069C BL *R12 ; read record #0 FF14: C3E4 000E MOV @>000E(R4),R15 ; alternate boot program track address FF18: 890F 0024 C R15,@>0024(R4) ; compare with normal program track address FF1C: 130C JEQ >FF36 FF1E: C924 0024 000E MOV @>0024(R4),@>000E(R4) ; replace alternate boot program, with normal one ; so alternate program will be loaded only once FF24: 0200 0300 LI R0,>0300 ; write data FF28: 069C BL *R12 ; write record #0 FF2A: C924 001C 0018 MOV @>001C(R4),@>0018(R4) ; use alternate load point FF30: C924 001E 001A MOV @>001E(R4),@>001A(R4) ; and alternate length FF36: 0200 0400 LI R0,>0400 ; read unformatted FF3A: 0203 0006 LI R3,>0006 ; command returns 6 bytes FF3E: 06A0 FF72 BL @>FF72 ; compute cylinder/head address from track address in R15 FF42: 069C BL *R12 FF44: C064 0002 MOV @>0002(R4),R1 ; set format & sector according to value read from controller FF48: C004 MOV R4,R0 ; >0200 : read data FF4A: 06A0 FF72 BL @>FF72 FF4E: C3E4 0018 MOV @>0018(R4),R15 ; program load point FF52: C0E4 001A MOV @>001A(R4),R3 ; program length FF56: 130A JEQ >FF6C ; fail if null FF58: 0204 00A0 LI R4,>00A0 ; free area in RAM ? FF5C: 069C BL *R12 ; read boot program FF5E: 0200 ABC0 LI R0,>ABC0 ; magical value ? FF62: C04E MOV R14,R1 ; boot device address FF64: 04C2 CLR R2 FF66: D085 MOVB R5,R2 ; unit ID FF68: 0360 RSET ; Reset for things to be cleaner FF6A: 045F B *R15 ; jump to boot program ; exit point when boot program lenght is NULL FF6C: 0203 D001 LI R3,>D001 ; load error code FF70: 102E JMP >FFCE ; stop machine and blink the Fail LED ; compute cylinder & head address from "flat" track address ; input : ; R10 = number of heads ; R15 = track address ; returns : ; R2 = cylinder address ; R0 |= head address FF72: C24F MOV R15,R9 FF74: 04C8 CLR R8 FF76: 3E0A DIV R10,R8 ; compute R15/R10 FF78: C088 MOV R8,R2 ; R2 = quotient : cylinder address FF7A: E009 SOC R9,R0 ; R0 MSB = remainder : head address FF7C: 045B B *R11 ; execute some command on a WD900/WT3200 controller ; R0 -> W1 : command and surface register (WD900) ; R1 -> W2 : format and sector (MSByte : sectors per record ; LSByte : sector number) (WD900) ; R2 -> W3 : cylinder address (cylinder number) (WD900) / read offset (WT3200) ; R3 -> W4 : count (length to read/write) ; R4 -> W5 : address (destination/source address to read/write from, 16 LSBits) ; R5 -> W6 : WD900 : select and address (unit selection, 1 bit per unit, in LOW nibble of MSByte, and ; 4 MSBits of address in low nibble of LSByte) ; WT3200 : command and transport select (unit selection, 1 bit per unit, in HIGH nibble ; of MSByte, command in high nibble of LSByte, and 4 MSBits of address in low nibble of ; LSByte) ; ; R14 = controller address ; ; cf 990 Handbook, 5-23, page 188, and WD900/MT3200 general description, chapter 3 ; FF7E: C1CE MOV R14,R7 ; TILINE device address FF80: C227 000E MOV @>000E(R7),R8 FF84: 1101 JLT >FF88 FF86: 10FB JMP >FF7E ; wait for IDLE status bit to be cleared ; write device registers FF88: 04F7 CLR *R7+ ; disc status FF8A: CDC0 MOV R0,*R7+ FF8C: CDC1 MOV R1,*R7+ FF8E: CDC2 MOV R2,*R7+ FF90: CDC3 MOV R3,*R7+ FF92: CDC4 MOV R4,*R7+ FF94: CDC5 MOV R5,*R7+ FF96: 04D7 CLR *R7 ; controller status FF98: C217 MOV *R7,R8 FF9A: 1101 JLT >FF9E FF9C: 10FD JMP >FF98 ; wait for IDLE controller status bit to be cleared FF9E: C1C5 MOV R5,R7 FFA0: 09C7 SRL R7,12 ; 4 MSBits select unit on WT3200, and are unused on WD900 FFA2: 1603 JNE >FFAA ; skip if we are using a tape unit FFA4: C1DE MOV *R14,R7 ; disk status FFA6: 0A27 SLA R7,2 FFA8: 18FD JOC >FFA4 ; wait for NR (Not Ready) status bit to be cleared FFAA: 0248 01FF ANDI R8,>01FF ; test all individual error bits FFAE: 1602 JNE >FFB4 ; jump on error FFB0: 0700 SETO R0 FFB2: 045B B *R11 ; normal return ; error handler : FFB4: C1DE MOV *R14,R7 ; read disk status FFB6: 11E3 JLT >FF7E ; wait for OL (off-line) status bit to be set FFB8: C1C5 MOV R5,R7 FFBA: 09C7 SRL R7,12 FFBC: 1602 JNE >FFC2 ; skip if we are using a tape unit FFBE: 060D DEC R13 FFC0: 1691 JNE >FEE4 ; do a few retries before fail ? FFC2: 0288 0001 CI R8,>0001 ; check unit error / tape error in controller status FFC6: 1602 JNE >FFCC ; means an error condition is set in disk status / tape transport status FFC8: 04C8 CLR R8 FFCA: D21E MOVB *R14,R8 ; read error code in disk status / tape transport status register FFCC: C0C8 MOV R8,R3 ; error stop ; we jump to this routine when boot fails ; display R3 for diagnostics purpose, and blink the fail LED. FFCE: 020C 1FE0 LI R12,>1FE0 FFD2: 3203 LDCR R3,8 FFD4: 3220 0087 LDCR @>0087,8 FFD8: 1D0B SBO >000B FFDA: 05C1 INCT R1 FFDC: 15FD JGT >FFD8 FFDE: 1E0B SBZ >000B FFE0: 10FC JMP >FFDA ; spare room FFE2: 0000 DATA >0000 FFE4: 0000 DATA >0000 FFE6: 0000 DATA >0000 FFE8: 0000 DATA >0000 FFEA: 0000 DATA >0000 FFEC: 0000 DATA >0000 FFEE: 0000 DATA >0000 FFF0: 0000 DATA >0000 FFF2: 0000 DATA >0000 FFF4: 0000 DATA >0000 ; pointers to routines FFF6: FCF4 DATA >FCF4 ; boot loader FFF8: FCEE DATA >FCEE ; ditto FFFA: FD4A DATA >FD4A ; boot loader for MDU (?) ; LOAD vector FFFC: 0080 FC44 DATA >0080,>FC44 ; ROM page 1. FC00: 020C FE68 LI R12,>FE68 FC04: 00AC LCS R12 ; Load writable Control Store ; loads microcode to define some XOPs. FC06: 020C 1FE0 LI R12,>1FE0 FC0A: 0206 0100 LI R6,>0100 ; display progress code on programmer panel FC0E: 3206 LDCR R6,8 FC10: 3220 008D LDCR @>008D,8 FC14: 0206 0400 LI R6,>0400 FC18: 0286 0400 CI R6,>0400 FC1C: 1638 JNE >FC8E ; exit on error FC1E: 0546 INV R6 FC20: 0286 0400 CI R6,>0400 FC24: 1334 JEQ >FC8E ; exit on error FC26: 0546 INV R6 FC28: 02E0 0100 LWPI >0100 FC2C: 02C3 STST R3 FC2E: 0420 FC36 BLWP @>FC36 ; jump FC32: 0460 FFE0 B @>FFE0 ; error exit : we should not reach this line ; BLWP vector FC36: 0120 FC3A DATA >0120,FC3A ; BLWP routine entry point FC3A: 02C5 STST R5 ; copy current ST FC3C: 83C5 C R5,R15 ; saved ST FC3E: 1627 JNE >FC8E ; should equate FC40: 028D 0100 CI R13,>0100 ; old WP FC44: 1624 JNE >FC8E FC46: 028E FC32 CI R14,>FC32 ; old PC FC4A: 1621 JNE >FC8E FC4C: 020E FC56 LI R14,>FC56 ; set return PC to >FC56 FC50: 0380 RTWP ; return FC52: 0460 FFE0 B @>FFE0 ; error exit : we should not reach this line FC56: 02C4 STST R4 ; restored ST FC58: 8804 0106 C R4,@>0106 ; should equate ST before call FC5C: 1618 JNE >FC8E FC5E: 0208 4BF2 LI R8,>4BF2 FC62: 3A20 FEBA MPY @>FEBA,R8 ; times >E819 FC66: 0288 44DA CI R8,>44DA ; test MSWord FC6A: 1611 JNE >FC8E FC6C: 0289 BAA2 CI R9,>BAA2 ; test LSWord FC70: 160E JNE >FC8E FC72: 0202 0064 LI R2,>0064 FC76: 0206 05F5 LI R6,>05F5 FC7A: 0207 E0FF LI R7,>E0FF FC7E: 3DA2 FE58 DIV @>FE58(R2),R6 ; divide R6:R7 by @>FEBC = >15CB FC82: 0286 4604 CI R6,>4604 ; test quotient FC86: 1603 JNE >FC8E FC88: 0287 07D3 CI R7,>07D3 ; test remainder FC8C: 1302 JEQ >FC92 ; jump if OK ; error exit point FC8E: 0460 FFE0 B @>FFE0 FC92: 020A FCDC LI R10,>FCDC FC96: C1A0 FEBE MOV @>FEBE,R6 ; -> R6 = >FFFF FC9A: 04C7 CLR R7 FC9C: 049A X *R10 ; executes a MOVB R6,R7 FC9E: 0287 FF00 CI R7,>FF00 FCA2: 166A JNE >FD78 FCA4: C2A0 FCD6 MOV @>FCD6,R10 ; >0A59 : SLA R9,5 FCA8: C260 FEBA MOV @>FEBA,R9 ; -> R9 = >E819 FCAC: 048A X R10 ; executes a SLA R9,5 FCAE: 0289 0320 CI R9,>0320 FCB2: 1662 JNE >FD78 FCB4: C220 FEBA MOV @>FEBA,R8 ; -> R8 = >E819 FCB8: 04A0 FCD8 X @>FCD8 ; executes a SRC R8,3 FCBC: 0288 3D03 CI R8,>3D03 FCC0: 165B JNE >FD78 FCC2: 0205 0032 LI R5,>0032 FCC6: C120 FEBA MOV @>FEBA,R4 ; -> R4 = >E819 FCCA: 04A5 FCA8 X @>FCA8(R5) ; executes "INV R4" at @>FCDA FCCE: 0284 17E6 CI R4,>17E6 FCD2: 1652 JNE >FD78 FCD4: 1004 JMP >FCDE ; instruction table FCD6: 0A59 SLA R9,5 FCD8: 0B38 SRC R8,3 FCDA: 0544 INV R4 FCDC: D1C6 MOVB R6,R7 ; test, next part FCDE: 0205 0135 LI R5,>0135 FCE2: C560 FEB8 MOV @>FEB8,*R5 ; moves >1234 at address @>0134 (address LSBit ignored) FCE6: 0206 0015 LI R6,>0015 FCEA: 0203 FEAA LI R3,>FEAA ; empty (i.e. all-0s) map file FCEE: 0323 LMF R3,0 ; load as memory map FCF0: 020C 1FA0 LI R12,>1FA0 FCF4: 1D03 SBO >0003 ; change RAM set-up ? FCF6: 07A0 FEA6 LDS @>FEA6 ; this temporary memory map -> >120 offset on next source address FCFA: C816 017E MOV *R6,@>017E ; i.e. we actually read @>0009A * 2 = @>000134 FCFE: 8820 017E FEB8 C @>017E,@>FEB8 FD04: 16C4 JNE >FC8E FD06: 07E0 FEA6 LDD @>FEA6 ; same story with destination FD0A: C5A0 FEBA MOV @>FEBA,*R6 FD0E: 8560 FEBA C @>FEBA,*R5 FD12: 16BD JNE >FC8E FD14: C820 FEBE 017A MOV @>FEBE,@>017A ; @>017A = >FFFF FD1A: 0706 SETO R6 FD1C: 0066 5820 FEB8 0176 MOVS R6,@>FEB8,@>0176,5 ; move 5 bytes FD24: 0706 SETO R6 FD26: 0046 5820 FEB8 0176 CS R6,@>FEB8,@>0176,5 FD2E: 1624 JNE >FD78 FD30: 9820 017B FEBE CB @>017B,@>FEBE ; check we did not write an extra byte FD36: 1620 JNE >FD78 FD38: 04C0 CLR R0 FD3A: C820 FEB8 0176 MOV @>FEB8,@>0176 FD40: 0E00 0020 0176 IOF R0,@>0176 (?) ; Invert Order of Field FD46: 8820 0176 FEB6 C @>0176,@>FEB6 FD4C: 1615 JNE >FD78 FD4E: 8820 FEB8 FEB8 C @>FEB8,@>FEB8 ; should set Equal bit FD54: 02C3 STST R3 FD56: 0202 2000 LI R2,>2000 FD5A: 20C2 COC R2,R3 ; (R2 & R3) == R2 ? FD5C: 160D JNE >FD78 FD5E: 0202 C000 LI R2,>C000 FD62: 24C2 CZC R2,R3 ; (R2 & ~R3) == R2 ? FD64: 1609 JNE >FD78 FD66: 8820 FEBE FEAA C @>FEBE,@>FEAA FD6C: 02C7 STST R7 FD6E: 0247 E000 ANDI R7,>E000 FD72: 0287 8000 CI R7,>8000 ; H == 1, G & E == 0 FD76: 1302 JEQ >FD7C ; jump if OK ; error exit point FD78: 0460 FFE0 B @>FFE0 FD7C: 0023 2820 FE92 0176 BDC @>FE92,@>0176,2 ; Binary to Decimal ascii conversion FD84: 8820 0176 FE94 C @>0176,@>FE94 ; test first 2 chars FD8A: 16F6 JNE >FD78 FD8C: 8820 0178 FE96 C @>0178,@>FE96 ; test last 2 chars FD92: 16F2 JNE >FD78 FD94: 0706 SETO R6 FD96: 0046 4820 0176 FE94 CS R6,@>0176,@>FE94,4 ; compare string FD9E: 16EC JNE >FD78 FDA0: 05A0 0178 INC @>0178 ; alter last char FDA4: 0706 SETO R6 FDA6: 0046 4820 0176 FE94 CS R6,@>0176,@>FE94,4 ; compare string FDAE: 13E4 JEQ >FD78 ; should be different FDB0: 0286 0003 CI R6,>0003 ; first different char is third char (?) FDB4: 16E1 JNE >FD78 FDB6: 0024 2820 FE94 0176 DBC @>FE94,@>0176,2 ; Decimal ascii to Binary conversion FDBE: 8820 FE92 0176 C @>FE92,@>0176 FDC4: 16D9 JNE >FD78 FDC6: 0CA0 FE98 CIR @>FE98 ; Convert Integer to Real FDCA: 0706 SETO R6 FDCC: 0046 4800 FE9E CS R6,R0,@>FE9E,4 FDD2: 16D2 JNE >FD78 FDD4: 0CE0 FE9A SR @>FE9A FDD8: 0C00 CRI FDDA: 0280 0BB8 CI R0,>0BB8 FDDE: 16CC JNE >FD78 FDE0: 0C2A 30A0 FEBA XV 10,@>FEBA,R2,3 ; extract 10 bits from bit 3 in @>FEBA, store result in R2 (?) FDE6: 0282 0103 CI R2,>0103 FDEA: 16C6 JNE >FD78 FDEC: C820 FEBA 0176 MOV @>FEBA,@>0176 FDF2: C820 FEBC 0178 MOV @>FEBC,@>0178 ; load >E81915CB FDF8: 001C 3160 0176 SRAM @>0176,5,3 ; shift 3 bytes at @>0176 with 5 bits FDFE: 17BC JNC >FD78 FE00: 0706 SETO R6 FE02: 0046 4820 FEA2 0176 CS R6,@>FEA2,@>0176,4 ; >FF40C8CB FE0A: 16B6 JNE >FD78 FE0C: 0205 C7CB LI R5,>C7CB FE10: 9805 FEA4 CB R5,@>FEA4 FE14: 13B1 JEQ >FD78 FE16: 0207 C8AB LI R7,>C8AB FE1A: 9807 FEA4 CB R7,@>FEA4 FE1E: 16AC JNE >FD78 FE20: 02A5 STWP R5 FE22: 0285 0100 CI R5,>0100 FE26: 16A8 JNE >FD78 FE28: C0E0 FEBC MOV @>FEBC,R3 ; >15CB FE2C: 0200 AC0F LI R0,>AC0F ; - >53F1 FE30: 01C3 MPYS R3 FE32: 0706 SETO R6 FE34: 0046 4800 FE6E CS R6,R0,@>FE6E,4 ; >F8DAAAE5 = - >0725551B FE3A: 169E JNE >FD78 FE3C: 0709 SETO R9 FE3E: 0069 8020 FE72 MOVS R9,@>FE72,R0,8 ; >4226000000000000 FE44: 0F60 FE82 DD @>FE82 ; Divide Double-precision >C234000000000000 FE48: 0706 SETO R6 FE4A: 0046 8800 FE7A CS R6,R0,@>FE7A,8 ; >C0BB13B13B13B13B FE50: 1693 JNE >FD78 FE52: 0706 SETO R6 FE54: 0066 8020 FE8E MOVS R6,@>FE8E,R0,8 FE5A: 0C05 CDE ; convert double to extended (i.e. 32-bit) int FE5C: 070A SETO R10 FE5E: 004A 4800 FE8A CS R10,R0,@>FE8A,4 ; >FFA63E0D FE64: 1689 JNE >FD78 FE66: 102C JMP >FEC0 ; various tables ; table used by LCS. Too short to be complete microcoded instructions I guess, so these must be ; pointers. FE68: 0020 DATA >0020 FE6A: 0BE0 DATA >0BE0 FE6C: 0100 DATA >0100 FE6E: F8DA AAE5 DATA >F8DA,>AAE5 ; signed 4-byte int ; 64-bit floats FE72: 4226 0000 0000 0000 DATA >4226,>0000,>0000,>0000 FE7A: C0BB 13B1 3B13 B13B DATA >C0BB,>13B1,>3B13,>B13B FE82: C234 0000 0000 0000 DATA >C234,>0000,>0000,>0000 FE8A: FFA6 3E0D DATA >FFA6,>3E0D FE8E: C659 DATA >C659 FE90: C1F3 DATA >C1F3 FE92: 03CF DATA >03CF ; 975 FE94: 3937 352B BYTE '9','7','5','+' FE98: 2710 DATA >2710 FE9A: 441B DATA >441B FE9C: 5800 DATA >5800 FE9E: 4427 1000 DATA >4427,>1000 ; single-precision real FEA2: FF40 C8CB DATA >FF40,>C8CB ; simple memory map : adds a 9*32 = >120 offset to every address FEA6: 0000 DATA >0000 FEA8: 0009 DATA >0009 ; empty memory map FEAA: 0000 DATA >0000 FEAC: 0000 DATA >0000 FEAE: 0000 DATA >0000 FEB0: 0000 DATA >0000 FEB2: 0000 DATA >0000 FEB4: 0000 DATA >0000 FEB6: 2C48 DATA >2C48 ; >1234 reversed FEB8: 1234 DATA >1234 FEBA: E819 DATA >E819 FEBC: 15CB DATA >15CB FEBE: FFFF DATA >FFFF FEC0: 001D 2060 008C SLAM @>008C,1,2 ; update progress code in R6, Workspace >0080 FEC6: 0700 SETO R0 FEC8: 0202 FEFF LI R2,>FEFF FECC: 0204 EFFF LI R4,>EFFF FED0: 04C6 CLR R6 FED2: 04C7 CLR R7 FED4: 04C8 CLR R8 FED6: 04C9 CLR R9 FED8: 04CA CLR R10 FEDA: 02CC STST R12 FEDC: 026C 0010 ORI R12,>0010 ; enable writable control store to use custom XOP FEE0: 008C LST R12 FEE2: 020C 1FA0 LI R12,>1FA0 FEE6: 1E03 SBZ >0003 ; map test loop start FEE8: C067 FFA8 MOV @>FFA8(R7),R1 ; first table FEEC: C0E7 FFB0 MOV @>FFB0(R7),R3 ; second table FEF0: C167 FFB8 MOV @>FFB8(R7),R5 ; third table FEF4: 02E0 0120 LWPI >0120 FEF8: 020B 0100 LI R11,>0100 FEFC: 032B LMF R11,0 ; previous R0-R5 -> map file FEFE: 02E0 0100 LWPI >0100 FF02: C226 FFC0 MOV @>FFC0(R6),R8 ; load address we want to test from table FF06: C249 MOV R9,R9 FF08: C28A MOV R10,R10 FF0A: 2C40 XOP R0,1 ; this instruction must be defined by LCS. ; result : 16 LSBs of address in R9, 4 MSBs of address in 4 MSBs of R10 (all reversed and inverted) ; 4 next bits of R10 seem to be an index in the map table (????) FF0C: 100A JMP >FF22 ; loop test (we increment, and either loop or exit) FF0E: 05C7 INCT R7 ; try another map file FF10: 0287 0008 CI R7,>0008 FF14: 11E9 JLT >FEE8 FF16: 05C6 INCT R6 ; try another address to test mapping FF18: 04C7 CLR R7 FF1A: 0286 001E CI R6,>001E FF1E: 11E4 JLT >FEE8 FF20: 1062 JMP >FFE6 ; exit OK to next test on next ROM page ; map test loop (continued) FF22: C30A MOV R10,R12 FF24: 04C0 CLR R0 FF26: 0E00 000C IOF R0,R12 FF2A: 054C INV R12 FF2C: 024C 000F ANDI R12,>000F ; R12 = address 4 MSB FF30: 0E00 0009 IOF R0,R9 FF34: 0549 INV R9 ; R9 = address 16 LSB FF36: 0540 INV R0 FF38: 098A SRL R10,8 FF3A: 024A 000F ANDI R10,>000F FF3E: 0288 0100 CI R8,>0100 ; does B2 apply ? FF42: 150F JGT >FF62 ; case R8 < >0100 FF44: 028A 0006 CI R10,>0006 ; -> a >9 reversed and inverted ??? FF48: 162D JNE >FFA4 ; error... FF4A: C2C1 MOV R1,R11 FF4C: 09CB SRL R11,12 FF4E: 830B C R11,R12 ; compare 4 MSBs of address FF50: 1629 JNE >FFA4 FF52: C2C1 MOV R1,R11 FF54: 0A4B SLA R11,4 FF56: C308 MOV R8,R12 FF58: 091C SRL R12,1 FF5A: A2CC A R12,R11 FF5C: 824B C R11,R9 ; compare 16 LSBs of address FF5E: 1622 JNE >FFA4 FF60: 10D6 JMP >FF0E ; loop FF62: 0288 1000 CI R8,>1000 ; does B3 apply ? FF66: 150F JGT >FF86 FF68: 028A 000A CI R10,>000A ; -> a >A reversed and inverted ??? FF6C: 161B JNE >FFA4 FF6E: C2C3 MOV R3,R11 FF70: 09CB SRL R11,12 FF72: 830B C R11,R12 FF74: 1617 JNE >FFA4 FF76: C2C3 MOV R3,R11 FF78: 0A4B SLA R11,4 FF7A: C308 MOV R8,R12 FF7C: 091C SRL R12,1 FF7E: A2CC A R12,R11 FF80: 824B C R11,R9 FF82: 1610 JNE >FFA4 FF84: 10C4 JMP >FF0E ; loop ; no Bn bias register apply FF86: 028A 000C CI R10,>000C ; -> a >C reversed and inverted ??? FF8A: 160C JNE >FFA4 FF8C: C2C5 MOV R5,R11 FF8E: 09CB SRL R11,12 FF90: 830B C R11,R12 FF92: 1608 JNE >FFA4 FF94: C2C5 MOV R5,R11 FF96: 0A4B SLA R11,4 FF98: C308 MOV R8,R12 FF9A: 091C SRL R12,1 FF9C: A2CC A R12,R11 FF9E: 824B C R11,R9 FFA0: 1601 JNE >FFA4 FFA2: 10B5 JMP >FF0E ; error exit point FFA4: 0460 FFE0 B @>FFE0 ; map file table start ; L1, L2 & L3 are a fixed >FFFF, FEFF, EFFF (-> addresses >0000, >0100, >1000) ; B1 FFA8: 1111 DATA >1111 FFAA: 2222 DATA >2222 FFAC: 4444 DATA >4444 FFAE: 8888 DATA >8888 ; B2 FFB0: 1109 DATA >1109 FFB2: 221A DATA >221A FFB4: 443C DATA >443C FFB6: 8880 DATA >8880 ; B3 FFB8: 1091 DATA >1091 FFBA: 21A2 DATA >21A2 FFBC: 43C4 DATA >43C4 FFBE: 8808 DATA >8808 ; table with addresses we want to test FFC0: 000E DATA >000E FFC2: 0016 DATA >0016 FFC4: 001A DATA >001A FFC6: 001C DATA >001C FFC8: 001E DATA >001E FFCA: 010E DATA >010E FFCC: 0116 DATA >0116 FFCE: 011A DATA >011A FFD0: 011C DATA >011C FFD2: 011E DATA >011E FFD4: 100E DATA >100E FFD6: 1016 DATA >1016 FFD8: 101A DATA >101A FFDA: 101C DATA >101C FFDC: 101E DATA >101E FFDE: 0300 DATA >0300 ; error exit (cross-page jump) FFE0: 0205 FFE6 LI R5,>FFE6 FFE4: 1002 JMP >FFEA ; normal exit (cross-page jump) FFE6: 0205 FC00 LI R5,>FC00 FFEA: 0204 0200 LI R4,>0200 FFEE: 020C 1FB4 LI R12,>1FB4 FFF2: 30C4 LDCR R4,3 ; switch to page 2 ? FFF4: 0455 B *R5 FFF6: FFFF DATA >FFFF FFF8: FFFF DATA >FFFF FFFA: FFFF DATA >FFFF FFFC: FFFF DATA >FFFF FFFE: FFFF DATA >FFFF ; ROM page 2. FC00: 0206 0400 LI R6,>0400 FC04: C806 008C MOV R6,@>008C FC08: 0201 1234 LI R1,>1234 FC0C: C801 0176 MOV R1,@>0176 FC10: 0201 E819 LI R1,>E819 FC14: C801 0178 MOV R1,@>0178 FC18: 002A 4820 FC56 0176 SM @>FC56,@>0176,4 FC20: 0706 SETO R6 FC22: 0046 4820 FC5A 0176 CS R6,@>FC5A,@>0176,4 FC2A: 1613 JNE >FC52 FC2C: 0208 ABCD LI R8,>ABCD FC30: 0209 EF59 LI R9,>EF59 FC34: 0028 3220 FC56 ANDM @>FC56,R8,3 FC3A: 0027 3220 FC5A ORM @>FC5A,R8,3 FC40: 0026 3220 FC5E XORM @>FC5E,R8,3 FC46: 0288 1215 CI R8,>1215 FC4A: 1603 JNE >FC52 FC4C: 0289 0359 CI R9,>0359 FC50: 130A JEQ >FC66 FC52: 0460 FFE6 B @>FFE6 FC56: 4816 5800 DATA >4816,>5800 FC5A: 5A4B 4019 DATA >5A4B,>4019 FC5E: 485A 4B40 DATA >485A,>4B40 FC62: 1900 DATA >1900 FC64: 0000 DATA >0000 ; memory test FC66: 001D 20A0 008C SLAM @>008C,2,2 ; update progress code FC6C: 04C5 CLR R5 FC6E: 04C6 CLR R6 FC70: 02A4 STWP R4 FC72: C044 MOV R4,R1 FC74: 0221 000A AI R1,>000A ; R1 points to R5 FC78: 0202 FCEE LI R2,>FCEE FC7C: 020C 1FA0 LI R12,>1FA0 FC80: 04C3 CLR R3 FC82: 0322 LMF R2,0 ; map file loaded is empty, I think FC84: 1D03 SBO >0003 ; test loop FC86: 0286 0000 CI R6,>0000 FC8A: 161E JNE >FCC8 FC8C: 0283 F800 CI R3,>F800 FC90: 141F JHE >FCD0 ; cannot test >F800->FFFF (always maps to TILINE and ROM) FC92: 8103 C R3,R4 FC94: 1602 JNE >FC9A FC96: 0223 0020 AI R3,>0020 ; do not overwrite our workspace... FC9A: 0791 LDS *R1 FC9C: C013 MOV *R3,R0 ; save * (R6:R3) FC9E: 07D1 LDD *R1 FCA0: C4E0 FCF2 MOV @>FCF2,*R3 ; write >AAAA to * (R6:R3) FCA4: 0791 LDS *R1 FCA6: 8813 FCF2 C *R3,@>FCF2 FCAA: 1616 JNE >FCD8 ; exit in error if different FCAC: 0791 LDS *R1 FCAE: 0553 INV *R3 FCB0: 0791 LDS *R1 FCB2: 8813 FCF4 C *R3,@>FCF4 ; compare with >5555 = ~ >AAAA FCB6: 1610 JNE >FCD8 FCB8: 07D1 LDD *R1 FCBA: CCC0 MOV R0,*R3+ ; restore * (R6:R3), and increment R3 FCBC: 0283 0000 CI R3,>0000 FCC0: 16E2 JNE >FC86 ; loop if R3 has not wrapped around to 0 FCC2: 0226 0800 AI R6,>0800 ; else fix bias (B1) for LDS/LDD to point to next 64kb FCC6: 10DF JMP >FC86 ; and loop FCC8: 0286 1000 CI R6,>1000 ; jump here if R6 != 0 FCCC: 11E6 JLT >FC9A ; continue if not testing address over >020000 (>10000) FCCE: 1013 JMP >FCF6 ; else exit FCD0: 0226 0800 AI R6,>0800 ; skip system area (TPCS and ROM) FCD4: 04C3 CLR R3 ; and jump to >010000 (>08000) FCD6: 10E1 JMP >FC9A ; error exit : FCD8: 07D1 LDD *R1 FCDA: C4C0 MOV R0,*R3 ; try to restore memory data FCDC: C803 0094 MOV R3,@>0094 ; save current address FCE0: 09B6 SRL R6,11 FCE2: C806 0090 MOV R6,@>0090 ; save address MSBits. FCE6: 0A33 SLA R3,3 FCE8: 1306 JEQ >FCF6 ; if we are on a 8 kbyte boundary, we must have only ; reached end of memory, so we jump to normal exit FCEA: 0460 FFE6 B @>FFE6 ; exit in error to next page ; empty map file FCEE: 0000 0000 DATA >0000,>0000 ; L1 = ~ >FFFF, B1 = >0000 FCF2: AAAA 5555 DATA >AAAA,>5555 ; L2 = ~ >5555, B2 = >5555 ; Memory test exit point ; Error interrupt test ; The CPU triggers a level-2 interrupt on some error conditions : unimplemented memory, ; illegal instructions, overflow... FCF6: 001D 2060 008C SLAM 2,@>008C,1 ; update progress code FCFC: 020C 1FC0 LI R12,>1FC0 FD00: 04C1 CLR R1 FD02: 3001 LDCR R1,16 ; save current interrupt vectors to >0180 FD04: 0202 0180 LI R2,>0180 FD08: CCB1 MOV *R1+,*R2+ FD0A: 0281 0040 CI R1,>0040 FD0E: 11FC JLT >FD08 ; set all int vectors to default spurious int handler FD10: 04C1 CLR R1 FD12: 0202 0100 LI R2,>0100 FD16: 0203 FFE2 LI R3,>FFE2 FD1A: CC42 MOV R2,*R1+ FD1C: CC43 MOV R3,*R1+ FD1E: 0281 0040 CI R1,>0040 FD22: 11FB JLT >FD1A ; test timeout error FD24: 0201 FD38 LI R1,>FD38 FD28: C801 000A MOV R1,@>000A ; set int 2 routine FD2C: 0300 0002 LIMI >0002 ; allow int 2 (machine error) FD30: C060 FBFE MOV @>FBFE,R1 ; no memory there -> timeout error FD34: 0460 FFE2 B @>FFE2 ; error exit ; int 2 routine FD38: 0200 8000 LI R0,>8000 ; bit 0 = timeout bit FD3C: 06A0 FFC8 BL @>FFC8 ; clear ; test priviledge violation error FD40: 0201 FD5C LI R1,>FD5C FD44: C801 000A MOV R1,@>000A FD48: 0300 0002 LIMI >0002 ; allow int 2 FD4C: 02C1 STST R1 FD4E: 0261 0100 ORI R1,>0100 ; set ST_PR bit FD52: 0081 LST R1 ; -> switch to user mode FD54: 0300 0002 LIMI >0002 ; should trigger a priviledge violation error FD58: 0460 FFE2 B @>FFE2 ; int 2 routine FD5C: 0200 4000 LI R0,>4000 ; bit 1 = priviledge violation FD60: 06A0 FFC8 BL @>FFC8 ; test illegal opcode error FD64: 0201 FD76 LI R1,>FD76 FD68: C801 000A MOV R1,@>000A FD6C: 0300 0002 LIMI >0002 ; allow int 2 FD70: 0000 DATA >0000 ; illegal instruction FD72: 0460 FFE2 B @>FFE2 ; exit in error ; int 2 routine FD76: 0200 2000 LI R0,>2000 ; bit 2 = illegal instruction FD7A: 06A0 FFC8 BL @>FFC8 ; test memory parity error FD7E: 0201 FD9A LI R1,>FD9A FD82: C801 000A MOV R1,@>000A FD86: 020C 1FA0 LI R12,>1FA0 FD8A: 1D09 SBO >0009 ; enable parity checking ? FD8C: 0300 0002 LIMI >0002 FD90: C060 FC00 MOV @>FC00,R1 ; obviously triggers a parity error - why ? FD94: 1E09 SBZ >0009 FD96: 0460 FFE2 B @>FFE2 FD9A: 1E09 SBZ >0009 FD9C: 0200 1000 LI R0,>1000 ; bit 3 = Memory parity error FDA0: 06A0 FFC8 BL @>FFC8 ; test address beyond map error FDA4: 0201 FDE4 LI R1,>FDE4 FDA8: C801 000A MOV R1,@>000A FDAC: 0202 0000 LI R2,>0000 FDB0: 0542 INV R2 ; L1 = ~ >0000 FDB2: 04C3 CLR R3 ; B1 = 0 FDB4: 0204 EFFE LI R4,>EFFE FDB8: 0544 INV R4 ; L2 = ~ >EFFE FDBA: 04C5 CLR R5 ; B2 = 0 FDBC: 0206 0000 LI R6,>0000 FDC0: 0546 INV R6 ; L3 = ~ >0000 (-> will be ignored) FDC2: 04C7 CLR R7 ; B3 = 0 FDC4: 02A1 STWP R1 FDC6: 0221 0004 AI R1,>0004 ; points to R2 FDCA: 0321 LMF R1,0 ; load map file FDCC: 020C 1FA0 LI R12,>1FA0 FDD0: 1D03 SBO >0003 FDD2: 0300 0000 LIMI >0000 FDD6: C060 F020 MOV @>F020,R1 ; address not defined in memory map FDDA: 1E03 SBZ >0003 FDDC: 0300 0002 LIMI >0002 FDE0: 0460 FFE2 B @>FFE2 FDE4: 1E03 SBZ >0003 FDE6: 0200 8800 LI R0,>8800 ; bits 0 and 4 = timeout & Address beyond map bits FDEA: 06A0 FFC8 BL @>FFC8 ; test memory protection FDEE: 0201 FE30 LI R1,>FE30 FDF2: C801 000A MOV R1,@>000A FDF6: 0702 SETO R2 ; L1 = ~ >0000 FDF8: 04C3 CLR R3 ; B1 = 0 FDFA: 0204 FEE2 LI R4,>FEE2 ; L2 = ~ (>0100 | >1D) (5 LSBits ignored for address ; - must tell the memory is execution protected) ; B2 in R5 should still be 0, but maybe we don't care FDFE: 04C6 CLR R6 ; L3 = ~ >FFFF FE00: 04C7 CLR R7 ; B3 = 0 FE02: 02A1 STWP R1 FE04: 0221 0004 AI R1,>0004 FE08: 0321 LMF R1,0 ; load map file FE0A: 020C 1FA0 LI R12,>1FA0 FE0E: 1D03 SBO >0003 FE10: 0200 1000 LI R0,>1000 ; NOP instruction FE14: 02C1 STST R1 FE16: 0261 0040 ORI R1,>0040 ; memory management bit FE1A: 0081 LST R1 FE1C: 0300 0002 LIMI >0002 FE20: 04A0 0100 X @>0100 ; actually executes NOP in R0, I think FE24: 1E03 SBZ >0003 FE26: 0241 FFB1 ANDI R1,>FFB1 ; clear memory management bit FE2A: 0081 LST R1 FE2C: 0460 FFE2 B @>FFE2 FE30: 1E03 SBZ >0003 FE32: 0241 FFB1 ANDI R1,>FFB1 FE36: 0081 LST R1 FE38: 0200 0200 LI R0,>0200 ; bit 6 : execution in execute-protected memory FE3C: 06A0 FFC8 BL @>FFC8 FE40: 0201 FE82 LI R1,>FE82 FE44: C801 000A MOV R1,@>000A FE48: 0702 SETO R2 ; L1 = ~ >0000 FE4A: 04C3 CLR R3 FE4C: 0204 FEE1 LI R4,>FEE1 ; L2 = ~ (>0100 | >1E) (must tell memory is write-protected) FE50: 04C5 CLR R5 FE52: 04C6 CLR R6 FE54: 04C7 CLR R7 FE56: 02A1 STWP R1 FE58: 0221 0004 AI R1,>0004 FE5C: 0321 LMF R1,0 FE5E: 020C 1FA0 LI R12,>1FA0 FE62: 1D03 SBO >0003 FE64: 02C1 STST R1 FE66: 0261 0040 ORI R1,>0040 ; memory management bit FE6A: 0081 LST R1 FE6C: 0300 0002 LIMI >0002 FE70: C820 00E0 0100 MOV @>00E0,@>0100 FE76: 1E03 SBZ >0003 FE78: 0241 FFB1 ANDI R1,>FFB1 FE7C: 0081 LST R1 FE7E: 0460 FFE2 B @>FFE2 FE82: 1E03 SBZ >0003 FE84: 0241 FFB1 ANDI R1,>FFB1 FE88: 0081 LST R1 FE8A: 0200 0100 LI R0,>0100 ; bit 7 : write in write-protected memory FE8E: 06A0 FFC8 BL @>FFC8 FE92: 0201 FEB2 LI R1,>FEB2 FE96: C801 000A MOV R1,@>000A FE9A: 0703 SETO R3 FE9C: 0300 0002 LIMI >0002 FEA0: 00D3 6820 FEAC 0100 MVSK R3,@>FEAC,@>0100,6 ; move string from stack - whatever it does ; distinct from POPS - POP String from stack FEA8: 0460 FFE2 B @>FFE2 ; MAYBE the data that follow is a stack descriptor. ; Anyway, we need something like this, since I can't see any place where we set up a SP and ; stack bounds. Maybe these are hard-coded, but why should MVSK take 2 operands, then ? FEAC: 0102 DATA >0102 ; current stack pointer ? FEAE: 0100 DATA >0100 ; stack bottom ? (or stack growth limit ?) FEB0: 0104 DATA >0104 ; stack growth limit ? (or stack bottom ?) FEB2: 0200 0080 LI R0,>0080 ; bit 8 : stack overflow FEB6: 06A0 FFC8 BL @>FFC8 FEBA: 0201 FF2A LI R1,>FF2A FEBE: C801 000A MOV R1,@>000A FEC2: 04C1 CLR R1 FEC4: 0202 FCEE LI R2,>FCEE ; points on empty map file FEC8: 0322 LMF R2,0 ; load both map files FECA: 0332 LMF R2,1 ; test loop entry point FECC: 0281 000E CI R1,>000E ; index from >0*2 to >7*2 FED0: 1542 JGT >FF56 ; exit loop if greater FED2: C0E1 FF36 MOV @>FF36(R1),R3 ; read breakpoint generator operation mode ? FED6: 020C 1FAA LI R12,>1FAA FEDA: 30C3 LDCR R3,3 FEDC: 0203 0101 LI R3,>0101 ; breakpoint address, I guess - LSBit meaning unknown FEE0: 020C 1F80 LI R12,>1F80 FEE4: 3003 LDCR R3,16 FEE6: 02C2 STST R2 FEE8: 0281 0008 CI R1,>0008 FEEC: 1103 JLT >FEF4 FEEE: 0262 0080 ORI R2,>0080 ; -> use map file 1 FEF2: 1002 JMP >FEF8 FEF4: 0242 FF7F ANDI R2,>FF7F ; -> use map file 0 FEF8: 0082 LST R2 ; write in ST FEFA: 0300 0002 LIMI >0002 FEFE: C0A1 FF46 MOV @>FF46(R1),R2 ; load test routine address FF02: 020C 1FA0 LI R12,>1FA0 FF06: 1D03 SBO >0003 FF08: 0452 B *R2 ; jump FF0A: C820 0100 0104 MOV @>0100,@>0104 ; read from >0100 FF10: 0460 FFE2 B @>FFE2 FF14: 0200 1000 LI R0,>1000 ; NOP FF18: 04A0 0100 X @>0100 ; execute at >0100 FF1C: 0460 FFE2 B @>FFE2 FF20: C820 0104 0100 MOV @>0104,@>0100 ; write to >0100 FF26: 0460 FFE2 B @>FFE2 FF2A: 0200 0040 LI R0,>0040 ; breakpoint address encountered ? FF2E: 06A0 FFC8 BL @>FFC8 FF32: 05C1 INCT R1 FF34: 10CB JMP >FECC ; table 1 for test loop : breakpoint mode ? FF36: 0000 DATA >0000 ; break on read, map file 0 ? FF38: 0400 DATA >0400 ; break on execute ? FF3A: 0200 DATA >0200 ; break on write ? FF3C: 0600 DATA >0600 ; ??? FF3E: 0100 DATA >0100 ; same as above with map file 1 ? FF40: 0500 DATA >0500 FF42: 0300 DATA >0300 FF42: 0700 DATA >0700 ; table 2 for test loop : test code FF46: FF0A DATA >FF0A ; read FF48: FF14 DATA >FF14 ; execute FF4A: FF20 DATA >FF20 ; write FF4C: FF0A DATA >FF0A ; read FF4E: FF0A DATA >FF0A FF50: FF14 DATA >FF14 FF52: FF20 DATA >FF20 FF54: FF0A DATA >FF0A FF56: 020C 1FA0 LI R12,>1FA0 FF5A: 1E03 SBZ >0003 ; clock test FF5C: 0201 FF7E LI R1,>FF7E FF60: C801 000A MOV R1,@>000A FF64: 020C 1FA0 LI R12,>1FA0 FF68: 0300 0002 LIMI >0002 FF6C: 0202 1C00 LI R2,>1C00 FF70: 1D01 SBO >0001 ; enable clock ? FF72: 0602 DEC R2 ; wait for clock to trigger FF74: C082 MOV R2,R2 ; this loop should execute in about 12ms FF76: 15FD JGT >FF72 ; more than 1500000 instructions per second - not so bad FF78: 1E01 SBZ >0001 FF7A: 0460 FFE2 B @>FFE2 FF7E: 1E01 SBZ >0001 FF80: 0200 0020 LI R0,>0020 ; 12ms test clock FF84: 06A0 FFC8 BL @>FFC8 ; arithmetic overflow interrupt test FF88: 0201 FFA8 LI R1,>FFA8 FF8C: C801 000A MOV R1,@>000A FF90: 0201 7FFF LI R1,>7FFF FF94: C081 MOV R1,R2 FF96: 0300 0002 LIMI >0002 FF9A: 02C3 STST R3 FF9C: 0263 0020 ORI R3,>0020 ; arithmetic overflow enable FFA0: 0083 LST R3 FFA2: A081 A R1,R2 ; >7FFF + >7FFF = >FFFE, and overflow bit is set FFA4: 0460 FFE2 B @>FFE2 FFA8: 0243 F7D1 ANDI R3,>F7D1 FFAC: 0083 LST R3 FFAE: 0200 0010 LI R0,>0010 ; arithmetic overflow bit FFB2: 06A0 FFC8 BL @>FFC8 FFB6: 101A JMP >FFEC ; exit OK to next page FFB8: 04C1 CLR R1 FFBA: 0202 0180 LI R2,>0180 FFBE: CC72 MOV *R2+,*R1+ FFC0: 0281 0040 CI R1,>0040 FFC4: 11FC JLT >FFBE FFC6: 045B B *R11 ; This routine checks that R0 matches the error interrupt register. FFC8: 020C 1FC0 LI R12,>1FC0 FFCC: 3401 STCR R1,16 ; read error interrupt register FFCE: 0241 FFFE ANDI R1,>FFFE ; clear system type indicator ? FFD2: 04C3 CLR R3 FFD4: 3003 LDCR R3,16 ; clear error interrupt register FFD6: C0C0 MOV R0,R3 FFD8: 0027 20C1 ORM R1,R3,2 FFDC: 80C0 C R0,R3 ; are there extra error bits ? FFDE: 1601 JNE >FFE2 ; if so, exit in error FFE0: 045B B *R11 ; spurious interrupt handler, and error exit handler for the error interrupt test ; restore vectors, then jump to next page in error FFE2: 06A0 FFB8 BL @>FFB8 ; jump to next page in error FFE6: 0205 FE20 LI R5,>FE20 FFEA: 1002 JMP >FFF0 ; jump to next page OK FFEC: 0205 FC00 LI R5,>FC00 FFF0: 0204 0300 LI R4,>0300 FFF4: 020C 1FB4 LI R12,>1FB4 FFF8: 30C4 LDCR R4,3 ; jump to page 3 ? FFFA: 0455 B *R5 FFFC: FFFF DATA >FFFF FFFE: FFFF DATA >FFFF ; ROM page 3. ; Self-test routine (end) ; First an interrupt test FC00: 001D 2060 008C SLAM @>008C,1,2 ; update progress code in R6, Workspace >0080 FC06: 0300 0000 LIMI >0000 ; disable all interrupts FC0A: 0201 0104 LI R1,>0104 ; clear RAM from >0104 to >0180 FC0E: 04F1 CLR *R1+ FC10: 0281 017F CI R1,>017F FC14: 1AFC JL >FC0E FC16: 0200 0154 LI R0,>0154 FC1A: C800 0152 MOV R0,@>0152 ; set-up pointer used by our test interrupt vector FC1E: 04C2 CLR R2 ; set up vectors for all masked interrupt FC20: C4A2 FD82 MOV @>FD82(R2),*R2 ; with contents of a table at offset >FD82 FC24: 05C2 INCT R2 ; why on earth don't they use MOV @>FD82(R2),*R2+ ??? FC26: 0282 0040 CI R2,>0040 FC2A: 1AFA JL >FC20 FC2C: 020C 1FA0 LI R12,>1FA0 FC30: 1D08 SBO >0008 FC32: 020C 1F80 LI R12,>1F80 FC36: 1D0F SBO >000F ; so level-15 interrupt is pending FC38: 1D08 SBO >0008 ; and level-8 FC3A: 1D03 SBO >0003 ; and level-3 FC3C: C020 0154 MOV @>0154,R0 ; should still be 0, since interrupts are disabled FC40: 1637 JNE >FCB0 FC42: 0300 000F LIMI >000F ; enable all interrupts ; At this point, the 3 pending interrupts should execute in the order of their priority, and ; append their ID at the location pointed by @>0152 - initially >0154, so we should have : ;0154: 0003 0008 000F FC46: C020 0154 MOV @>0154,R0 ; test 1st word FC4A: 0280 0003 CI R0,>0003 FC4E: 1630 JNE >FCB0 ; jump on error FC50: C020 0156 MOV @>0156,R0 ; test 2nd word FC54: 0280 0008 CI R0,>0008 FC58: 162B JNE >FCB0 FC5A: C020 0158 MOV @>0158,R0 ; test 3rd word FC5E: 0280 000F CI R0,>000F FC62: 1626 JNE >FCB0 FC64: 020C 1F80 LI R12,>1F80 FC68: 05A0 0150 INC @>0150 ; set flag to ask level-3 routine to trigger level 3 and >F FC6C: 1D08 SBO >0008 ; trigger level 8 again FC6E: C020 015A MOV @>015A,R0 ; test word FC72: 0280 0008 CI R0,>0008 FC76: 161C JNE >FCB0 FC78: C020 015C MOV @>015C,R0 ; level 3 should follow FC7C: 0280 0003 CI R0,>0003 FC80: 1617 JNE >FCB0 FC82: C020 015E MOV @>015E,R0 ; then level >F FC86: 0280 000F CI R0,>000F FC8A: 1612 JNE >FCB0 FC8C: 04C1 CLR R1 FC8E: 05C1 INCT R1 FC90: 0281 0014 CI R1,>0014 ; 10 iterations FC94: 1B08 JH >FCA6 FC96: 04C2 CLR R2 FC98: 020C 1F80 LI R12,>1F80 FC9C: 04A1 FDC0 X @>FDC0(R1) ; trigger interrupt FCA0: 8042 C R2,R1 ; the interrupt routine should set R2 to the same value as R1 FCA2: 1606 JNE >FCB0 FCA4: 10F4 JMP >FC8E ; loop FCA6: C020 0160 MOV @>0160,R0 ; check we did not have spurious level 3,8 or >F interrupt FCAA: 1602 JNE >FCB0 FCAC: 0460 FDF2 B @>FDF2 ; everything is fine FCB0: 0460 FDEA B @>FDEA ; level-4 interrupt routine FCB4: 0202 0002 LI R2,>0002 ; set flag FCB8: 101A JMP >FCEE ; level-5 interrupt routine FCBA: 0202 0004 LI R2,>0004 FCBE: 1017 JMP >FCEE ; level-6 interrupt routine FCC0: 0202 0014 LI R2,>0014 FCC4: 1014 JMP >FCEE ; level-7 interrupt routine FCC6: 0202 0010 LI R2,>0010 FCCA: 1011 JMP >FCEE ; level-9 interrupt routine FCCC: 0202 0006 LI R2,>0006 FCD0: 100E JMP >FCEE ; level-10 interrupt routine FCD2: 0202 000A LI R2,>000A FCD6: 100B JMP >FCEE ; level-11 interrupt routine FCD8: 0202 000C LI R2,>000C FCDC: 1008 JMP >FCEE ; level-12 interrupt routine FCDE: 0202 0012 LI R2,>0012 FCE2: 1005 JMP >FCEE ; level-13 interrupt routine FCE4: 0202 0008 LI R2,>0008 FCE8: 1002 JMP >FCEE ; level-14 interrupt routine FCEA: 0202 000E LI R2,>000E FCEE: 04A1 FDD4 X @>FDD4(R1) ; disable interrupt FCF2: 0380 RTWP ; level-3 interrupt routine FCF4: 02C0 STST R0 FCF6: 0240 000F ANDI R0,>000F FCFA: 0280 0002 CI R0,>0002 ; value expected on a TMS9900 FCFE: 1675 JNE >FDEA FD00: C0E0 0152 MOV @>0152,R3 ; load pointer FD04: 0200 0003 LI R0,>0003 FD08: C4C0 MOV R0,*R3 ; append identifier FD0A: 05E0 0152 INCT @>0152 ; increment pointer FD0E: 020C 1F80 LI R12,>1F80 FD12: 1E03 SBZ >0003 ; clear interrupt FD14: 0380 RTWP ; level-8 interrupt routine - cf level 3 FD16: 02C0 STST R0 FD18: 0240 000F ANDI R0,>000F FD1C: 0280 0007 CI R0,>0007 FD20: 1664 JNE >FDEA FD22: C0E0 0152 MOV @>0152,R3 FD26: 0200 0008 LI R0,>0008 FD2A: C4C0 MOV R0,*R3 FD2C: 05E0 0152 INCT @>0152 FD30: 020C 1F80 LI R12,>1F80 FD34: C060 0150 MOV @>0150,R1 FD38: 1302 JEQ >FD3E FD3A: 1D0F SBO >000F FD3C: 1D03 SBO >0003 FD3E: 1E08 SBZ >0008 FD40: 0380 RTWP ; level-15 interrupt routine - cf level 3 FD42: 02C0 STST R0 FD44: 0240 000F ANDI R0,>000F FD48: 0280 000E CI R0,>000E FD4C: 164E JNE >FDEA FD4E: C0E0 0152 MOV @>0152,R3 FD52: 0200 000F LI R0,>000F FD56: C4C0 MOV R0,*R3 FD58: 05E0 0152 INCT @>0152 FD5C: 020C 1F80 LI R12,>1F80 FD60: 1E0F SBZ >000F FD62: 0380 RTWP ; level 0,1,2 interrupt routine FD64: 0460 FDEA B @>FDEA ; restore interrupt vector table with the table saved at >0180 FD68: 04C1 CLR R1 FD6A: 0202 0180 LI R2,>0180 FD6E: CC72 MOV *R2+,*R1+ FD70: 0281 0040 CI R1,>0040 FD74: 11FC JLT >FD6E FD76: 02E0 0100 LWPI >0100 FD7A: 020C 18A0 LI R12,>18A0 FD7E: 1E08 SBZ >0008 FD80: 045B B *R11 ; table with the interrupt vectors used by the test FD82: 0100 FD64 DATA >0100,>FD64 ; level-0 masked interrupt FD86: 0100 FD64 DATA >0100,>FD64 FD8A: 0100 FD64 DATA >0100,>FD64 FD8E: 0120 FCF4 DATA >0120,>FCF4 FD92: 0100 FCB4 DATA >0100,>FCB4 FD96: 0100 FCBA DATA >0100,>FCBA FD9A: 0100 FCC0 DATA >0100,>FCC0 FD9E: 0100 FCC6 DATA >0100,>FCC6 FDA2: 0128 FD16 DATA >0128,>FD16 FDA6: 0100 FCCC DATA >0100,>FCCC FDAA: 0100 FCD2 DATA >0100,>FCD2 FDAE: 0100 FCD8 DATA >0100,>FCD8 FDB2: 0100 FCDE DATA >0100,>FCDE FDB6: 0100 FCE4 DATA >0100,>FCE4 FDBA: 0100 FCEA DATA >0100,>FCEA FDBE: 0130 FD42 DATA >0130,>FD42 ; level-15 masked interrupt ; instruction table to enable interrupts FDC2: 1D04 SBO >0004 FDC4: 1D05 SBO >0005 FDC6: 1D09 SBO >0009 FDC8: 1D0D SBO >000D FDCA: 1D0A SBO >000A FDCC: 1D0B SBO >000B FDCE: 1D0E SBO >000E FDD0: 1D07 SBO >0007 FDD2: 1D0C SBO >000C FDD4: 1D06 SBO >0006 ; instruction table to disable interrupts FDD6: 1E04 SBZ >0004 FDD8: 1E05 SBZ >0005 FDDA: 1E09 SBZ >0009 FDDC: 1E0D SBZ >000D FDDE: 1E0A SBZ >000A FDE0: 1E0B SBZ >000B FDE2: 1E0E SBZ >000E FDE4: 1E07 SBZ >0007 FDE6: 1E0C SBZ >000C FDE8: 1E06 SBZ >0006 ; routine used by start-up code, and level 0,1,2 interrupt vectors FDEA: 06A0 FD68 BL @>FD68 FDEE: 0460 FE20 B @>FE20 FDF2: 06A0 FD68 BL @>FD68 FDF6: 0206 0400 LI R6,>0400 FDFA: C806 008C MOV R6,@>008C FDFE: 0706 SETO R6 FE00: 0066 4020 FE14 MOVS R6,@>FE14,R0,4 FE06: 0C07 CED ; Convert Extended integer to Double precision real FE08: 0706 SETO R6 FE0A: 0046 8800 FE18 CS R6,R0,@>FE18,8 ; test result FE10: 1607 JNE >FE20 FE12: 1009 JMP >FE26 ; 32 bit integer FE14: 5A4B 4019 DATA >5A4B,>4019 ; double precision real : FE18: 485A 4B40 1900 0000 DATA >485A,>4B40,>1900,>0000 ; error exit routine : handles a cross-page jump, yes sir FE20: 0205 FC08 LI R5,>FC08 ; error return address FE24: 1002 JMP >FE2A ; normal exit : same idea FE26: 0205 FC1C LI R5,>FC1C ; successful return address FE2A: 0204 0000 LI R4,>0000 FE2E: C804 0088 MOV R4,@>0088 ; move current R4 to future R4 FE32: C805 008A MOV R5,@>008A ; same story FE36: 02CC STST R12 FE38: 026C 0010 ORI R12,>0010 ; set "writable control store" bit in ST to use custom XOP FE3C: 008C LST R12 FE3E: 2D40 XOP R0,5 ; this instruction must be defined by LCS FE40: 02E0 0080 LWPI >0080 ; change WP FE44: 04CC CLR R12 FE46: 008C LST R12 ; clear ST FE48: 020C 1FB4 LI R12,>1FB4 FE4C: 30C4 LDCR R4,3 ; switch to page #0 ? FE4E: 0455 B *R5 ; The ROM is padded with 1s ; We have a lot of free space. Quite a change from TI990/4 ROMs. FE50: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FE60: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FE70: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FE80: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FE90: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FEA0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FEB0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FEC0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FED0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FEE0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FEF0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF00: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF10: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF20: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF30: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF40: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF50: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF60: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF70: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF80: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FF90: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FFA0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FFB0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FFC0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FFD0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FFE0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF FFF0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF ; The second half of this ROM makes strictly no sense as 990/12 machine code. ; Weird, weird... Maybe it is a microcode ROM, or a data ROM of some sort ? ; ; The data should obviously be grouped by 4 words. Consecutive sequences are often really close, ; too. ; 0000: 10F8 0002: 2F1D 0004: 0701 0006: 282E 0008: 1CF8 000A: 2F1D 000C: 0701 000E: 2809 0010: 10F8 0012: 2F1D 0014: 970F 0016: 2806 0018: 10F8 001A: 2F1D 001C: 970F 001E: 2807 0020: 10F8 0022: 2F1D 0024: 970F 0026: 2808 0028: 1CF8 002A: 2F1D 002C: 0701 002E: 281F 0030: 1CF8 0032: 2F1D 0034: 0701 0036: 282C 0038: 1CF8 003A: 2F1D 003C: 0701 003E: 282C 0040: 1CF8 0042: 2F1D 0044: 0701 0046: 282C 0048: 1029 004A: AC1E 004C: 970E 004E: 841F 0050: 1C29 0052: AF1D 0054: 0700 0056: 840F 0058: FC80 005A: 2F11 005C: 0500 005E: 84A6 0060: 1CF8 0062: 2E1D 0064: 2F00 0066: 840F 0068: 1C69 006A: EC1D 006C: 07B0 006E: 841F 0070: 48F8 0072: 2A1D 0074: 0400 0076: 840F 0078: 178F 007A: B71D 007C: 0710 007E: 840F 0080: 1CEF 0082: 0E1D 0084: 080E 0086: A910 0088: 1CF8 008A: 2C1D 008C: 07A0 008E: 840B 0090: 1CF8 0092: 2C1D 0094: 07F0 0096: 8400 0098: 1CF8 009A: 2C1D 009C: 0770 009E: 8401 00A0: 1CF8 00A2: 2F1C 00A4: 4700 00A6: 840F 00A8: 1CF8 00AA: 2F1D 00AC: 0701 00AE: 160F 00B0: 1CF8 00B2: 2C1E 00B4: 0700 00B6: 841F 00B8: FC40 00BA: 2F11 00BC: 0700 00BE: 84C8 00C0: 1C8F 00C2: AF9D 00C4: 0500 00C6: 840F 00C8: 0CF8 00CA: 2A9D 00CC: 2A00 00CE: A819 00D0: FC80 00D2: 2F11 00D4: 0500 00D6: 84A6 00D8: 0CF8 00DA: 2A1D 00DC: 2F00 00DE: 840F 00E0: 1748 00E2: AF1D 00E4: 0700 00E6: 840F 00E8: 4AF8 00E8: 2E1D 00EC: 0740 00EE: 840F 00F0: 49F8 00F2: 2D1D 00F4: 0741 00F6: 282C 00F8: FC01 00FA: 6F1D 00FC: 0700 00FE: 8480 0100: 107B 0102: 2F1D 0104: 0400 0106: 840F 0108: 1CF8 010A: 2C1E 010C: 0700 010E: 840B 0110: F380 0112: 2F11 0114: 6710 0116: 84E0 0118: 1CF8 011A: 2C1D 011C: 07B0 011E: 84F1 0120: 1388 0122: AF1D 0124: 0770 0126: 840F 0128: 1388 012A: 8F0D 012C: 17AE 012E: 09C0 0130: 10F8 0132: 2F1D 0134: 0700 0136: 840F 0138: 1588 013A: AF0D 013C: 17AE 013E: 840F 0140: 1E88 0142: AF9D 0144: 0070 0146: 840F 0148: 1688 014A: BF9D 014C: 9071 014E: E82A 0150: 1388 0152: 9F1D 0154: 8F10 0156: A924 0158: 1CF8 015A: 2F1D 015C: 6F01 015E: AC23 0160: 1C97 0162: 8F0D 0164: 0400 0166: 840F 0168: 1CF8 016A: 379C 016C: 0201 016E: 2001 0170: 1E8F 0172: AF1E 0174: 4711 0176: 082F 0178: 1D88 017A: AF19 017C: 0710 017E: 0843 0180: 1CF8 0182: 2F1D 0184: B70E 0186: 0856 0188: 1CF8 018A: 2F1D 018C: BF0F 018E: 2984 0190: 1CF8 0192: 2F1D 0194: B70E 0196: 0864 0198: 1CF8 019A: 2F1D 019C: BF0E 019E: 0873 01A0: 10F8 01A2: 2F1D 01A4: B70E 01A6: 0900 01A8: 10F8 01AA: 2F1D 01AC: BF0E 01AE: 09C1 01B0: 10F8 01B2: 2F1D 01B4: BF0E 01B6: 09EB 01B8: 1CF8 01BA: 2F1D 01BC: BF0E 01BE: 08C0 01C0: 1CF8 01C2: 2F1D 01C4: BF0E 01C6: 087C 01C8: 10F8 01CA: 2F1D 01CC: BF0E 01CE: 088C 01D0: 1009 01D2: EF05 01D4: BF0E 01D6: 9F02 01D8: 1E48 01DA: AF1D 01DC: 0700 01DE: 094A 01E0: 1F88 01E2: CF0D 01E4: 4F9E 01E6: 0976 01E8: 1D88 01EA: AF1F 01EC: 170E 01EE: 0974 01F0: 0629 01F2: E91D 01F4: 570F 01F6: E93F 01F8: FC61 01FA: EA1D 01FC: 07A0 01FE: 844F 0200: 1CF8 0202: 2C9D 0204: 00A0 0206: 8405 0208: 20EE 020A: AA9D 020C: 2801 020E: E842 0210: 1CF8 0212: 2F9C 0214: 4200 0216: 640F 0218: 1C09 021A: CF1D 021C: C700 021E: 0974 0220: FC81 0222: EF1D 0224: 0500 0226: 8429 0228: 1CDC 022A: AF0D 022C: 2FA0 022E: 094A 0230: 2CD6 0232: AF1D 0234: 0790 0236: 0947 0238: 2CD2 023A: AF1D 023C: 4D0E 023E: 0976 0240: 1009 0242: EC1D 0244: 179E 0246: 84F0 0248: 0EF8 024A: 2D1D 024C: 8F41 024E: C94D 0250: 1CED 0252: 2D1D 0254: 0780 0256: 084F 0258: 1CF8 025A: 2D1D 025C: 0780 025E: 084D 0260: 1C09 0262: EF1D 0264: 0781 0266: 284F 0268: 4C29 026A: EF1D 026C: 0700 026E: 0852 0270: 1EF8 0272: 2F1D 0274: 0700 0276: 6A4D 0278: 0CF8 027A: 291D 027C: 507E 027E: 840F 0280: 1C29 0282: FF1D 0284: 570E 0286: 0852 0288: 16F8 028A: 2F1D 028C: 0700 028E: 6A4F 0290: FC81 0292: EF1D 0294: 05F0 0296: 8429 0298: 0CEE 029A: 2A1D 029C: 2500 029E: 840F 02A0: 1CE5 02A2: AE1D 02A4: 2F00 02A6: 840F 02A8: 1CF8 02AA: 2F1D 02AC: 0700 02AE: 62FF 02B0: 1009 02B2: AF1D 02B4: 07A0 02B6: 0974 02B8: 1B08 02BA: AF0D 02BC: CF10 02BE: 094A 02C0: 11F8 02C2: 2D1D 02C4: 4D1E 02C6: 0976 02C8: 1CF8 02CA: 2F1D 02CC: 0700 02CE: 0947 02D0: 1CF8 02D2: 2F1D 02D4: 0700 02D6: 094F 02D8: 0029 02DA: A91D 02DC: 570E 02DE: 0947 02E0: 40EE 02E2: 2C1D 02E4: 0FBE 02E6: 8412 02E8: 10EE 02EA: 2E1D 02EC: 0F0E 02EE: A85D 02F0: 10EE 02F2: 2E1D 02F4: 0FDE 02F6: 840F 02F8: 10EE 02FA: 2E1D 02FC: 0F0E 02FE: A95F 0300: 1798 0302: 0E1D 0304: 0700 0306: 840F 0308: 2680 030A: 0F1D 030C: 0700 030E: A2FF 0310: 1B10 0312: 2F1D 0314: 0710 0316: A2FF 0318: 1C89 031A: EF1C 031C: 0700 031E: 6758 0320: 1009 0322: AF1D 0324: CF00 0326: 0974 0328: 1108 032A: AC0D 032C: 17AE 032E: 840F 0330: FC21 0332: CD1D 0334: 4D0E 0336: 8420 0338: 8C85 033A: 2F1D 033C: E7FE 033E: 086B 0340: 2E27 0342: 2F1D 0344: 9700 0346: A867 0348: 1E1B 034A: 2F1D 034C: 0700 034E: 840F 0350: 14F8 0352: 2F1D 0354: 0700 0356: 6766 0358: FC41 035A: EF1D 035C: 0700 035E: 841F 0360: 0C83 0362: 2F1D 0364: 0400 0366: 9F0E 0368: 0CA7 036A: EC1E 036C: 0700 036E: 8410 0370: 1C48 0372: AF05 0374: 0700 0376: A271 0378: 1C8E 037A: AF11 037C: 0700 037E: 840F 0380: 1CF8 0382: 2F1D 0384: 0700 0386: 62FF 0388: 1C8E 038A: AF11 038C: 0700 038E: 840F 0390: 1C50 0392: 2F0D 0394: 0701 0396: 62FF 0398: 1009 039A: EF1D 039C: 4D0E 039E: 0974 03A0: FC61 03A2: EF1D 03A4: C400 03A6: 8480 03A8: 1CF8 03AA: 301D 03AC: 07F0 03AE: 840F 03B0: 1CF8 03B2: 2C1D 03B4: 4D0E 03B6: 8480 03B8: 0001 03BA: EF1D 03BC: 0040 03BE: 840F 03C0: 0CCD 03C2: 6A1D 03C4: E77E 03C6: 840F 03C8: 1CF8 03CA: 3F1D 03CC: 0701 03CE: A2FF 03D0: 4083 03D2: 0F1D 03D4: 0700 03D6: 840F 03D8: 1CF8 03DA: 2F1D 03DC: 0700 03DE: 62FF 03E0: FC81 03E2: EF1D 03E4: CD00 03E6: 843F 03E8: FC01 03EA: EA1D 03EC: 2F00 03EE: 840F 03F0: 1C29 03F2: EF1D 03F4: 0700 03F6: 0889 03F8: 1CE5 03FA: AE1D 03FC: 0700 03FE: 0888 0400: F081 0402: EF1D 0404: 0710 0406: 8437 0408: F1F8 040A: 2A1D 040C: 0710 040E: 840C 0410: 10ED 0412: 4D1D 0414: 0700 0416: 08F0 0418: 1C29 041A: EF1D 041C: 0700 041E: 0889 0420: 1CE5 0422: AE1D 0424: 0700 0426: 0888 0428: F080 042A: 2F1D 042C: 0710 042E: 8402 0430: 1188 0432: 2F1D 0434: 0710 0436: 840F 0438: 1CF8 043A: 2F1D 043C: 0700 043E: 6282 0440: 1CF8 0442: 2D1D 0444: 0700 0446: 62FF 0448: FC41 044A: EF1D 044C: 07A0 044E: 8437 0450: 1CF8 0452: 2C9D 0454: 02A0 0456: 840B 0458: 1CEE 045A: 2E9D 045C: 2200 045E: 688B 0460: 1089 0462: EF1D 0464: CF10 0466: 840F 0468: 1C88 046A: AF0D 046C: 07A0 046E: 9F02 0470: 1288 0472: 8F0D 0474: 17AE 0476: 840F 0478: 1609 047A: AF1D 047C: 9710 047E: A88F 0480: 17DF 0482: 0F0D 0484: 0710 0486: 0974 0488: F681 048A: 6F1D 048C: 0710 048E: 84AA 0490: 1189 0492: EF1D 0494: 0710 0496: 0976 0498: 10F8 049A: 2F1D 049C: 0700 049E: 08BC 04A0: 10F8 04A2: 2F1D 04A4: 0700 04A6: 08BC 04A8: F681 04AA: 6F1D 04AC: 0710 04AE: 84AA 04B0: F181 04B2: 6F1D 04B4: 0710 04B6: 8455 04B8: F180 04BA: 2F15 04BC: 0710 04BE: 8450 04C0: 1CF8 04C2: 2F1D 04C4: 0700 04C6: 0976 04C8: 1089 04CA: CF1E 04CC: 0700 04CE: 08BC 04D0: F680 04D2: 2F11 04D4: 0710 04D6: 8455 04D8: F181 04DA: 6F1D 04DC: 0710 04DE: 84AA 04E0: F180 04E2: 2F15 04E4: 0710 04E6: 84A0 04E8: 1CF8 04EA: 2F1D 04EC: 0700 04EE: 0976 04F0: 10F8 04F2: 2F1D 04F4: 0700 04F6: 08BC 04F8: F7E0 04FA: 2F1D 04FC: 0700 04FE: 8401 0500: 1788 0502: 2F1D 0504: 0710 0506: A295 0508: 17DB 050A: 8F0D 050C: 0710 050E: 08BE 0510: 1108 0512: AF36 0514: 0700 0516: 08B8 0518: 1CE5 051A: AE1D 051C: 0700 051E: 08B7 0520: 1CF8 0522: 2F1D 0524: 0700 0526: 08B8 0528: 1CF8 052A: 2F1D 052C: 0700 052E: 08B5 0530: FC01 0532: 6E1D 0534: 0700 0536: 840A 0538: 1CE5 053A: AD1D 053C: 0700 053E: 08B7 0540: 1C08 0542: EF19 0544: 0700 0546: 08B8 0548: 1CE5 054A: AE1D 054C: 0700 054E: 08B7 0550: 1CF8 0552: 2F1D 0554: 0700 0556: 08B8 0558: 1CF8 055A: 2F1D 055C: 0700 055E: 08B5 0560: FC01 0562: 6E1D 0564: 0700 0566: 8405 0568: 1CE5 056A: AD1D 056C: 0700 056E: 08B7 0570: F7E0 0572: 2F1D 0574: 0700 0576: 8400 0578: 1788 057A: 2F1D 057C: 6710 057E: A2A2 0580: 1CF8 0582: 2F1D 0584: 0700 0586: 08B8 0588: FCE5 058A: 2E1D 058C: 0700 058E: 8455 0590: 1CF8 0592: 2F1D 0594: 0700 0596: A2FF 0598: 1CF8 059A: 2F1D 059C: 0700 059E: 08BE 05A0: 1CF8 05A2: 2F1D 05A4: 6F01 05A6: 6CB0 05A8: FC01 05AA: EF1D 05AC: 0700 05AE: 840F 05B0: 1CAA 05B2: 6F1D 05B4: 0700 05B6: 640F 05B8: 1CF8 05BA: 2D1D 05BC: 0700 05BE: 62FF 05C0: 1CF8 05C2: 2F1D 05C4: 0700 05C6: 08BE 05C8: FC41 05CA: EA1D 05CC: 07A0 05CE: 845F 05D0: 1C8F 05D2: AF9D 05D4: 0500 05D6: 840F 05D8: 1CEE 05DA: 2E9D 05DC: 2200 05DE: 68BB 05E0: 16F8 05E2: 2F1D 05E4: 0600 05E6: 840F 05E8: 1CF8 05EA: 2F1D 05EC: 2F0E 05EE: 640F 05F0: FC81 05F2: EF1D 05F4: 0500 05F6: 845F 05F8: 1CF8 05FA: 2F1D 05FC: 2F00 05FE: 640F 0600: F181 0602: EF1D 0604: CF10 0606: 847F 0608: F281 060A: EF1D 060C: 0710 060E: 8459 0610: F381 0612: EF1D 0614: 0710 0616: 8455 0618: F481 061A: EF1D 061C: 0710 061E: 8453 0620: F581 0622: EF1D 0624: 0710 0626: 8451 0628: F681 062A: EF1D 062C: 0710 062E: 844D 0630: F781 0632: EF1D 0634: 0710 0636: 8433 0638: FC81 063A: 6F1E 063C: 6F00 063E: 8440 0640: 1CF8 0642: 2F19 0644: 0700 0646: 9F02 0648: 12F8 064A: 2F1D 064C: 0700 064E: 08F1 0650: 13F8 0652: 2F1D 0654: 0700 0656: 08F0 0658: 1388 065A: AF1E 065C: 0700 065E: 840F 0660: F000 0662: 6F11 0664: 0710 0666: 8455 0668: 14F8 066A: 2F1D 066C: 0700 066E: 08F0 0670: 15F8 0672: 2F1D 0674: 0700 0676: 08F0 0678: 16F8 067A: 2F1D 067C: 0700 067E: 08F1 0680: 1C89 0682: AF1D 0684: 0400 0686: 840F 0688: 1CF8 068A: 371D 068C: 0700 068E: 08E7 0690: 10F8 0692: 2F1D 0694: 0600 0696: 840F 0698: 1CF8 069A: 371D 069C: 0700 069E: 08E5 06A0: 15F8 06A2: 2F1D 06A4: 0700 06A6: 08F1 06A8: 10F8 06AA: 2F1D 06AC: 0600 06AE: 840F 06B0: 1C89 06B2: F71F 06B4: 0700 06B6: 08E5 06B8: 14F8 06BA: 2F1D 06BC: 0700 06BE: 08F1 06C0: 10F8 06C2: 2F1D 06C4: 0600 06C6: 840F 06C8: 1CF8 06CA: 371D 06CC: 0700 06CE: 08E5 06D0: 15F8 06D2: 2F1D 06D4: 0700 06D6: 08F0 06D8: 10F8 06DA: 2F1D 06DC: 0600 06DE: 840F 06E0: 1CF8 06E2: 3F1D 06E4: 0700 06E6: 08E5 06E8: 1C9D 06EA: 4F1D 06EC: 0700 06EE: 840F 06F0: 1CF8 06F2: 2F1D 06F4: 0700 06F6: A2E0 06F8: 1088 06FA: CF1D 06FC: 0711 06FE: 28CD 0700: 1CF8 0702: 2F1D 0704: 0700 0706: 6CE1 0708: FC81 070A: 6F1E 070C: 6700 070E: 84C0 0710: 1CF8 0712: 2F19 0714: 0700 0716: 9F02 0718: 13F8 071A: 2F1D 071C: 0700 071E: 08F1 0720: 1CF8 0722: 2F1D 0724: 0701 0726: 28CB 0728: 1C29 072A: AF1D 072C: 0700 072E: 08EE 0730: 1C2D 0732: 4F1D 0734: 0700 0736: 08B7 0738: 17F8 073A: 2F1D 073C: 0600 073E: 08F0 0740: 1C29 0742: EF1D 0744: 0700 0746: 08EE 0748: 1C2D 074A: CF1D 074C: 0700 074E: 08B7 0750: 1028 0752: AC1D 0754: 07A0 0756: 840F 0758: FC41 075A: EF1D 075C: 0700 075E: 847F 0760: 1C8F 0762: AF9D 0764: 0500 0766: 840F 0768: 1CEE 076A: AE9D 076C: 2A00 076E: 68ED 0770: 17F8 0772: 2F1D 0774: 0700 0776: 840F 0778: 1CEE 077A: 2F1D 077C: 2700 077E: 640F 0780: 1C89 0782: EF1D 0784: 2F00 0786: 640F 0788: 1C89 078A: AF1D 078C: 2F00 078E: 640F 0790: 1C89 0792: AF1D 0794: 07A0 0796: 840F 0798: FC41 079A: EF1D 079C: 0500 079E: 843F 07A0: 1C57 07A2: 2F0D 07A4: 2D00 07A6: 68F4 07A8: 1CF8 07AA: 2F1D 07AC: 0701 07AE: 28FF 07B0: 1CF8 07B2: 2F1D 07B4: 0701 07B6: 28FF 07B8: 1CF8 07BA: 2F1D 07BC: 0701 07BE: 28FF 07C0: 1CF8 07C2: 2F1D 07C4: 0701 07C6: 28FF 07C8: 1CF8 07CA: 2F1D 07CC: 0701 07CE: 28FF 07D0: 1CF8 07D2: 2F1D 07D4: 0701 07D6: 28FF 07D8: 1CF8 07DA: 2F1D 07DC: 0701 07DE: 28FF 07E0: 1CF8 07E2: 2F1D 07E4: 0701 07E6: 28FF 07E8: 1CF8 07EA: 2F1D 07EC: 0701 07EE: 28FF 07F0: 1CF8 07F2: 2F1D 07F4: 0701 07F6: 28FF 07F8: 1CF8 07FA: 2F1D 07FC: 0700 07FE: E4FF 0800: 1B08 0802: 8F0D 0804: CF10 0806: 0974 0808: 1B88 080A: AF15 080C: 0710 080E: 08F2 0810: 1B88 0812: AC1D 0814: 07F0 0816: 8408 0818: 0BB4 081A: 2F1D 081C: 0711 081E: 7804 0820: 1C89 0822: AF1D 0824: 07A0 0826: 094A 0828: 1CF8 082A: 2F1D 082C: 0700 082E: 0947 0830: 10F8 0832: 2F1D 0834: 0700 0836: 0976 0838: 10F8 083A: 2F1D 083C: 0700 083E: 097A 0840: 10F8 0842: 2F1D 0844: 0700 0846: 097E 08A8: 10F8 084A: 2F1D 084C: 0700 084E: 0981 0850: 1CF8 0852: 2F1D 0854: 0700 0856: 0947 0858: FBA4 085A: EF1D 085C: 0700 085E: 84FF 0860: 1B91 0862: 2F1D 0864: 0711 0866: A21C 0868: 1C90 086A: 2F0D 086C: 0710 086E: 093E 0870: 1C88 0872: AC1D 0874: 07F0 0876: 8450 0878: 0CF8 087A: 2A1D 087C: 0791 087E: A21A 0880: 1C91 0882: 2F1D 0884: 0710 0886: 091D 0888: 1A89 088A: EF1D 088C: 0710 088E: 840F 0890: 1A08 0892: AF1D 0894: 0700 0896: 094F 0898: 1A08 089A: AF1D 089C: 0700 089E: 092A 08A0: 1CF8 08A2: 2F1D 08A4: 0700 08A6: 095F 08A8: 10F8 08AA: 2F1D 08AC: 0700 08AE: 096B 08B0: 1CF8 08B2: 2F1D 08B4: 0700 08B6: 094C 08B8: 1CF8 08BA: 2F1D 08BC: 8F00 08BE: A912 08C0: 1CF8 08C2: 2F1D 08C4: 0700 08C6: 0942 08C8: 10F8 08CA: 2F1D 08CC: 0701 08CE: 290E 08D0: 1CF8 08D2: 2F1D 08D4: 0700 08D6: 0934 08D8: 10F8 08DA: 2F1D 08DC: 0701 08DE: 290B 08E0: 1B89 08E2: EF1D 08E4: 0721 08E6: 2902 08E8: 10F8 08EA: 2F1D 08EC: 0700 08EE: 0947 08F0: 1B28 08F2: AF25 08F4: 0700 08F6: 840F 08F8: 1B91 08FA: 2F25 08FC: 0700 08FE: A222 0900: 10F8 0902: 2F1D 0904: 0700 0906: 0976 0908: 1CF8 090A: 2F1D 090C: 0701 090E: 2947 0910: 1C95 0912: 4F0D 0914: 0700 0916: A225 0918: 10F8 091A: 2F1D 091C: 0700 091E: 097A 0920: 1CF8 0922: 2F1D 0924: 0701 0926: 2947 0928: 1C95 092A: 6F0D 092C: 0700 092E: A228 0930: 10F8 0932: 2F1D 0934: 0700 0936: 097E 0938: 1CF8 093A: 2F1D 093C: 0701 093E: 2947 0940: 10F8 0942: 2F1D 0944: 0700 0946: 0981 0948: 1CF8 094A: 2F1D 094C: 0701 094E: 2947 0950: 1B28 0952: AC25 0954: DFF0 0956: 8480 0958: 1C8D 095A: 2F1D 095C: 0700 095E: A22F 0960: 1C89 0962: EF05 0964: 0700 0966: 9F02 0968: 1CF8 096A: 2D1D 096C: 0400 096E: 840F 0970: 1CF8 0972: 2F1D 0974: 2F0E 0976: 640F 0978: 1C95 097A: 4F0D 097C: 0700 097E: A232 0980: 0C81 0982: 6F05 0984: 0700 0986: 9F02 0988: 1CF8 098A: 2D1D 098C: 0401 098E: 292E 0990: 1CF8 0992: 2D1D 0994: 4C01 0996: A22E 0998: 1CF8 099A: 2F1D 099C: DF0F 099E: 2931 09A0: 10F8 09A2: 2F1D 09A4: 0700 09A6: 840F 09A8: 1228 09AA: AF1D 09AC: 0700 09AE: 840F 09B0: 10F8 09B2: 2E1D 09B4: 0710 09B6: 840F 09B8: 1428 09BA: AF1D 09BC: 0700 09BE: 840F 09C0: 12F8 09C2: 2E1D 09C4: 0710 09C6: 840F 09C8: 1491 09CA: 6C1E 09CC: 0700 09CE: 8411 09D0: 1491 09D2: 6F1D 09D4: 0701 09D6: A23D 09D8: 1490 09DA: 2F1D 09DC: 0710 09DE: 613C 09E0: 1489 09E2: AF1D 09E4: 0710 09E6: 640F 09E8: 1488 09EA: AF39 09EC: 0710 09EE: 640F 09F0: 11F8 09F2: 2C1E 09F4: 17AE 09F6: 8411 09F8: 1E28 09FA: AF39 09FC: 0710 09FE: 840F 0A00: 1EF8 0A02: 2F1D 0A04: 0700 0A06: 840F 0A08: 2625 0A0A: 2F1D 0A0C: 9710 0A0E: 6840 0A10: 1188 0A12: AF0D 0A14: 17AE 0A16: 840F 0A18: 1C28 0A1A: AF1D 0A1C: 0700 0A1E: 840F 0A20: 1CEE 0A22: 8F1D 0A24: 0700 0A26: 840F 0A28: 1EF8 0A2A: 2E1D 0A2C: 0710 0A2E: 840F 0A30: 1EF8 0A32: 2F1D 0A34: 9700 0A36: 6843 0A38: 1088 0A3A: AF0D 0A3C: 17AE 0A3E: 840F 0A40: 1E88 0A42: EF1D 0A44: 0710 0A46: 840F 0A48: 16F8 0A4A: 2F1D 0A4C: 9700 0A4E: 6848 0A50: 10F8 0A52: 2C1D 0A54: 17AE 0A56: 8405 0A58: 1689 0A5A: EF1D 0A5C: 9710 0A5E: 684B 0A60: 1A91 0A62: 6C1E 0A64: 0700 0A66: 840A 0A68: 1A90 0A6A: 2F1D 0A6C: 0711 0A6E: 624E 0A70: FA80 0A72: 2F11 0A74: 0710 0A76: 64A1 0A78: 1C2B 0A7A: AC1E 0A7C: 0780 0A7E: 84E0 0A80: 1C48 0A82: AC29 0A84: 07A0 0A86: 8404 0A88: 1CAB 0A8A: CF1D 0A8C: 0700 0A8E: 840F 0A90: 1EE6 0A92: AF1D 0A94: 0700 0A96: 840F 0A98: 1EF8 0A9A: 2F1D 0A9C: 0700 0A9E: A059 0AA0: 1EE6 0AA2: AF1D 0AA4: 0700 0AA6: 840F 0AA8: 1EF8 0AAA: 2F1D 0AAC: 0700 0AAE: A059 0AB0: 1EE6 0AB2: AF1D 0AB4: 0700 0AB6: 840F 0AB8: 1EF8 0ABA: 2F1D 0ABC: 0700 0ABE: A059 0AC0: 10F8 0AC2: 2F1D 0AC4: 6700 0AC6: 640F 0AC8: 1F29 0ACA: EE1D 0ACC: 6FD0 0ACE: 840F 0AD0: FCA1 0AD4: 4F1D 0AD4: 0700 0AD6: 8401 0AD8: 1CEF 0ADA: AF1D 0ADC: 9701 0ADE: E85C 0AE0: 1018 0AE2: 2F1D 0AE4: 0700 0AE6: 840F 0AE8: 16F8 0AEA: 2D1D 0AEC: 0710 0AEE: 840F 0AF0: 17F8 0AF2: 2E1D 0AF4: 0710 0AF6: 640F 0AF8: FC61 0AFA: CF1D 0AFC: 0500 0AFE: 8460 0B00: 1C89 0B02: EF1D 0B04: 28A0 0B06: 840F 0B08: 1CF8 0B0A: 2F9D 0B0C: 2800 0B0E: 840F 0B10: 1CEE 0B12: 2E9D 0B14: 2001 0B16: E863 0B18: FC61 0B1A: CE1D 0B1C: 07D0 0B1E: 8460 0B20: 1C89 0B22: EF1D 0B24: 00A0 0B26: 840F 0B28: 1CF8 0B2A: 2F9D 0B2C: 2800 0B2E: 840F 0B30: 1CEE 0B32: 2E9D 0B34: 2001 0B36: E867 0B38: 1091 0B3A: 4F0D 0B3C: 07A0 0B3E: 840F 0B40: 1CEF 0B42: AF1D 0B44: 9701 0B46: E869 0B48: 18F8 0B4A: 2D1D 0B4C: 0710 0B4E: 840F 0B50: 19F8 0B52: 2E1D 0B54: 0710 0B56: 640F 0B58: 1928 0B5A: AC1D 0B5C: 07D0 0B5E: 8480 0B60: 1CAE 0B62: EE1D 0B64: 07D1 0B66: AC73 0B68: 1728 0B6A: AF1D 0B6C: 0700 0B6E: A2FE 0B70: 1CCA 0B72: 2C1E 0B74: 0700 0B76: 84F0 0B78: 2CA4 0B7A: EF11 0B7C: 0700 0B7E: 840F 0B80: 1628 0B82: AF1D 0B84: 0700 0B86: A2FE 0B88: 28E0 0B8A: 2F1D 0B8C: 0700 0B8E: 840F 0B90: 1CF8 0B92: 2F1D 0B94: 0700 0B96: 62FE 0B98: 1728 0B9A: AF1D 0B9C: 0701 0B9E: 62FE 0BA0: FC81 0BA2: EF1D 0BA4: 0500 0BA6: 8459 0BA8: 1CF8 0BAA: 2D1D 0BAC: 2F00 0BAE: 640F 0BB0: 1C89 0BB2: EF1C 0BB4: E70E 0BB6: 840F 0BB8: 1FF8 0BBA: 2C1F 0BBC: 17AE 0BBE: 8406 0BC0: 1EF8 0BC2: 2F1D 0BC4: EF0E 0BC6: 840F 0BC8: 14F8 0BCA: 2F1D 0BCC: 0600 0BCE: 6878 0BD0: 1CF8 0BD2: 2C1C 0BD4: 0700 0BD6: 8410 0BD8: 1FF8 0BDA: 2C1F 0BDC: 17AE 0BDE: 8406 0BE0: 1EF8 0BE2: 2F1D 0BE4: EF0E 0BE6: 840F 0BE8: 14F8 0BEA: 2F1D 0BEC: 0600 0BEE: 687C 0BF0: 1FF8 0BF2: 2C1F 0BF4: 17AE 0BF6: 8406 0BF8: 1EF8 0BFA: 2F1D 0BFC: F70E 0BFE: 840F 0C00: 14F8 0C02: 2F1D 0C04: 0600 0C06: 687F 0C08: 1FF8 0C0A: 2C1F 0C0C: 17AE 0C0E: 8406 0C10: 1EF8 0C12: 2F1D 0C14: FF0E 0C16: 840F 0C18: 14F8 0C1A: 2F1D 0C1C: 0600 0C1E: 6882 0C20: 1C89 0C22: EF1D 0C24: C780 0C26: 840F 0C28: 46F8 0C2A: 2F1D 0C2C: 0700 0C2E: AA85 0C30: 10F8 0C32: 2C1E 0C34: 0710 0C36: 8408 0C38: FC80 0C3A: 2F11 0C3C: 97FE 0C3E: 8411 0C40: F1EC 0C42: 4F1D 0C44: 0710 0C46: 8480 0C48: 1CF8 0C4A: 2C1E 0C4C: 0700 0C4E: 8420 0C50: 0008 0C52: AF11 0C54: 0740 0C56: 840F 0C58: 0109 0C5A: ED1D 0C5C: 0740 0C5E: 840F 0C60: 0F89 0C62: AF1D 0C64: 0740 0C66: 840F 0C68: 0989 0C6A: AF1D 0C6C: 0740 0C6E: 840F 0C70: 10F8 0C72: 291F 0C74: 7F00 0C76: 29BD 0C78: 10F8 0C7A: 291D 0C7C: 0700 0C7E: 840F 0C80: 10F8 0C82: 291D 0C84: 0700 0C86: 29BD 0C88: 1089 0C8A: AF1D 0C8C: 07A0 0C8E: 29BB 0C90: 13F8 0C92: 2D1D 0C94: 170E 0C96: 29BF 0C98: 1C88 0C9A: 8F0D 0C9C: 0780 0C9E: 29BF 0CA0: 1089 0CA2: AF1D 0CA4: 07A0 0CA6: 29BB 0CA8: 13F8 0CAA: 2D1D 0CAC: 170E 0CAE: 29BF 0CB0: 1089 0CB2: AF1D 0CB4: 07A0 0CB6: 29BB 0CB8: 13F8 0CBA: 2D1D 0CBC: 170E 0CBE: 29BF 0CC0: 10F8 0CC2: 2F1D 0CC4: 0700 0CC6: 840F 0CC8: 4981 0CCA: 6F1D 0CCC: 0700 0CCE: 840F 0CD0: 4F81 0CD2: 6F1D 0CD4: 0701 0CD6: A2B1 0CD8: 10F8 0CDA: 291D 0CDC: 0701 0CDE: A2A8 0CE0: 4080 0CE2: 2F1F 0CE4: 0740 0CE6: BA90 0CE8: 1CF8 0CEA: 2F1D 0CEC: 7700 0CEE: AD90 0CF0: 4120 0CF2: 2F1D 0CF4: 0740 0CF6: 840F 0CF8: 00F8 0CFA: 2E1D 0CFC: 0740 0CFE: A78E 0D00: 1CF8 0D02: 2C1E 0D04: 0700 0D06: 8410 0D08: 0088 0D0A: AF11 0D0C: 0740 0D0E: 840F 0D10: F0EC 0D12: 4F1D 0D14: 0710 0D16: 8480 0D18: 1CF8 0D1A: 2C1E 0D1C: 0700 0D1E: 8404 0D20: 0188 0D22: AF11 0D24: 0740 0D26: 840F 0D28: 02F8 0D2A: 2C1D 0D2C: 0740 0D2E: 8410 0D30: 1CF8 0D32: 2F0D 0D34: 0700 0D36: 9F02 0D38: 0FF8 0D3A: 2F1D 0D3C: 0741 0D3E: 298E 0D40: 4180 0D42: 2F05 0D44: 0700 0D46: 9F02 0D48: 40F8 0D4A: 2A1D 0D4C: 0700 0D4E: A790 0D50: 4080 0D52: 2F1D 0D54: 0740 0D56: 840F 0D58: 4281 0D5A: 2F1D 0D5C: 0740 0D5E: 840F 0D60: 1CF8 0D62: 2F1D 0D64: 0700 0D66: A2A6 0D68: 09F8 0D6A: 2F1D 0D6C: 0740 0D6E: 840F 0D70: 10F8 0D72: 2C1D 0D74: 0710 0D76: 8408 0D78: 1CF8 0D7A: 2C1E 0D7C: 0700 0D7E: 8402 0D80: 0088 0D82: AF11 0D84: 0741 0D86: 298E 0D88: 4080 0D8A: 2F1E 0D8C: 0740 0D8E: 840F 0D90: FCE0 0D92: 2F11 0D94: 0700 0D96: 840C 0D98: 1CF8 0D9A: 2F1D 0D9C: 0700 0D9E: A28E 0DA0: 10F8 0DA2: 2C1E 0DA4: 0700 0DA6: 8408 0DA8: 1388 0DAA: 2F11 0DAC: 177E 0DAE: 29C0 0DB0: 10F8 0DB2: 2F1D 0DB4: 0701 0DB6: 09B7 0DB8: 1CF8 0DBA: 2F1D 0DBC: 0701 0DBE: 09B8 0DC0: 17E0 0DC2: AD1D 0DC4: 0701 0DC6: 09B9 0DC8: 1CF8 0DCA: 2F1D 0DCC: 0700 0DCE: A2FE 0DD0: 1C88 0DD2: 2F1D 0DD4: 0701 0DD6: 2832 0DD8: 1328 0DDA: AC1D 0DDC: 07A0 0DDE: 840A 0DE0: 0CF0 0DE2: 6D1D 0DE4: 9700 0DE6: 68BC 0DE8: 1CF8 0DEA: 2F1C 0DEC: 4700 0DEE: 840F 0DF0: 13F8 0DF2: 2F1D 0DF4: 170E 0DF6: 840F 0DF8: 1EF8 0DFA: 2C1D 0DFC: EF11 0DFE: 120F 0E00: 0EF8 0E02: 2C1D 0E04: EF11 0E06: 140F 0E08: 1549 0E0A: EC1D 0E0C: CF10 0E0E: 8403 0E10: 1389 0E12: 6F1D 0E14: 0710 0E16: 840F 0E18: 1CF8 0E1A: 2C1E 0E1C: 0700 0E1E: 84FE 0E20: F280 0E22: 2F11 0E24: 0710 0E26: 84FF 0E28: 1C68 0E2A: AC0D 0E2C: 07B0 0E2E: 8420 0E30: 1C8F 0E32: AF1D 0E34: 0500 0E36: 840F 0E38: 1CF8 0E3A: 2F1D 0E3C: 2700 0E3E: 840F 0E40: 1CEF 0E42: 0F1D 0E44: 080E 0E46: A9C8 0E48: 17F8 0E4A: 2E1D 0E4C: 0710 0E4E: 840F 0E50: 13E0 0E52: AD1D 0E54: 0700 0E56: 840F 0E58: 1708 0E5A: AF1D 0E5C: 0700 0E5E: A2FE 0E60: 12E0 0E62: AD1D 0E64: 0700 0E66: 840F 0E68: 1308 0E6A: AF1D 0E6C: 0700 0E6E: A2FE 0E70: 1228 0E72: AF1D 0E74: 0700 0E76: 840F 0E78: 1CEF 0E7A: 8F1D 0E7C: 0700 0E7E: 840F 0E80: 13F8 0E82: 2D1D 0E84: 0710 0E86: 840F 0E88: 12F8 0E8A: 2E1D 0E8C: 0710 0E8E: 840F 0E90: FC47 0E92: 2F1D 0E94: 0700 0E96: 8420 0E98: 1597 0E9A: 4F15 0E9C: 0700 0E9E: 840F 0EA0: 1CF8 0EA2: 2F1D 0EA4: 0700 0EA6: A2C5 0EA8: F781 0EAA: 6F1D 0EAC: 0710 0EAE: 8420 0EB0: 1C49 0EB2: CC1E 0EB4: 0700 0EB6: 84A0 0EB8: FC61 0EBA: 6F1D 0EBC: 0700 0EBE: 8406 0EC0: 1C29 0EC2: 6C1D 0EC4: 07A0 0EC6: 8400 0EC8: 1C8F 0ECA: AF1D 0ECC: 0500 0ECE: 840F 0ED0: 1CF8 0ED2: 2E1D 0ED4: 2700 0ED6: 840F 0ED8: 1CEE 0EDA: 2E1D 0EDC: 080E 0EDE: A8DB 0EE0: 1C17 0EE2: 2F11 0EE4: 0700 0EE6: 840F 0EE8: 1CED 0EEA: 6F1D 0EEC: 0700 0EEE: 840F 0EF0: 1CE5 0EF2: AE1D 0EF4: 0700 0EF6: 840F 0EF8: 1C0F 0EFA: AF1D 0EFC: 0700 0EFE: A2FE 0F00: 1CED 0F02: 8F1D 0F04: 0700 0F06: 840F 0F08: 17E0 0F0A: AD15 0F0C: 0700 0F0E: 840F 0F10: 1C59 0F12: 6F1D 0F14: 0700 0F16: A2D7 0F18: 1629 0F1A: EC1D 0F1C: 0710 0F1E: 8480 0F20: 1608 0F22: EC15 0F24: 07A0 0F26: 8400 0F28: FC61 0F2A: 6F1D 0F2C: 0700 0F2E: 8406 0F30: FC41 0F32: EF1D 0F34: 0500 0F36: 8401 0F38: 1CF8 0F3A: 2F1D 0F3C: 2F00 0F3E: 840F 0F40: 1CEE 0F42: 2E1D 0F44: 080E 0F46: A8E8 0F48: 1CE5 0F4A: AE1D 0F4C: 0700 0F4E: AEFE 0F50: 1CF8 0F52: 2F1D 0F54: 0700 0F56: 62FE 0F58: F001 0F5A: EF1D 0F5C: CF00 0F5E: 845F 0F60: FC41 0F62: EA1D 0F64: 0710 0F66: 841F 0F68: 1BF8 0F6A: 2C1D 0F6C: 0710 0F6E: 8404 0F70: FA81 0F72: EF1D 0F74: 0710 0F76: 8456 0F78: 1C29 0F7A: 6C1D 0F7C: 07A0 0F7E: 8400 0F80: 1C8F 0F82: AF1D 0F84: 0500 0F86: 840F 0F88: 1BF8 0F8A: 2E1D 0F8C: 2F00 0F8E: 840F 0F90: 1BEE 0F92: 2E1D 0F94: 0E0E 0F96: A8F2 0F98: 1CE5 0F9A: AE1D 0F9C: 0700 0F9E: 840F 0FA0: 1AE0 0FA2: AD1D 0FA4: 0700 0FA6: A2FE 0FA8: 1C0B 0FAA: 8F9D 0FAC: 0700 0FAE: A2EF 0FB0: 1C29 0FB2: EF1D 0FB4: 07A0 0FB6: 840F 0FB8: 1BF8 0FBA: 2E1D 0FBC: 2600 0FBE: 840F 0FC0: 1BEE 0FC2: 2E1D 0FC4: 0E0F 0FC6: E8F9 0FC8: FC01 0FCA: EF1D 0FCC: 0700 0FCE: 84B0 0FD0: 1CE5 0FD2: AE1D 0FD4: 0700 0FD6: 840F 0FD8: 1CF8 0FDA: 2F1D 0FDC: 0700 0FDE: 62FE 0FE0: 1CF8 0FE2: 2F1D 0FE4: 0701 0FE6: 29FE 0FE8: 1CF8 0FEA: 2F1D 0FEC: 0701 0FEE: 29FE 0FF0: 1CF8 0FF2: 2F1D 0FF4: 0700 0FF6: E4FE 0FF8: AAAA 0FFA: 5555 0FFC: 00AA 0FFE: E3C8