-
So this is something I did a little while ago, but I figured people here might find it useful, or at least interesting.
The 859xE series analyzers made by HP/Agilent have a number of installable options. One of these options is Option 105, the gate option. For the A series analyzers, this is a card. However, for the E series analyzers, HP actually built the gate circuitry into the motherboard. Interestingly, they then provided two ways of adding option 105: one is to send the analyzer back to HP, where they will turn on the internal gate option. If this is too difficult, they can also send out a whole gate card that the customer can install. The internal option shows up as GATE rev B, while the card shows up as GATE rev A.
I figured it would be interesting to figure out how to turn on the gate option in the analyzer as installing a whole option card is rather redundant.
First, the recon: the internal gate module itself just appears as a pair of SMB connectors on the motherboard that must be connected to the back panel with SMB to BNC cables. Then, the module must be enabled in the firmware somehow. These analyzers have a small amount of battery-backed NVRAM, the perfect place to store calibration data and possibly this sort of a 'sofware switch.' The service manual also lists some procedures for when the internal memory is erased. For most analyzers, nothing special is required as the firmware can detect what analyzer it's running in. However, there are a couple of cases where this doesn't work and manual intervention is required. First, there is apparently no detectable difference between the 8595E and the 8596E, so the unit will pop up a box and ask. However, the procedure for an 8591C is different: it will initialize as an 8591E, and then the manual asks you to send the analyzer FACTSET 11023,1 to switch it to 8591C.
That's a very pretty looking magic number, there. I wonder if there are any more of those?
So, I bought an EPROM programmer, read out all four EPROMs, pieced them together into one, and opened the shebang up in a hex editor. I searched for FACTSET. I found exactly one hit at address 0007E3E0, in what appeared to be some sort of command data structure. That's not going to do me a whole lot of good, so I converted the magic number 11023 to hex (2B 0F) and searched for that. I got exactly one hit, at address 0001978E. This one appeared to be buried in some instructions as well - more interesting! Off to the disassembler....
Right around that address, we find this very interesting piece of code:
(please note that the comments and names have been added by me, they were not originally in the disassembly!)
ROM:0001974C ; =============== S U B R O U T I N E =======================================
ROM:0001974C
ROM:0001974C ; Attributes: bp-based frame
ROM:0001974C
ROM:0001974C process_factset: ; CODE XREF: j_process_factsetj
ROM:0001974C
ROM:0001974C var_4 = -4
ROM:0001974C arg_0 = 8
ROM:0001974C
ROM:0001974C ; FUNCTION CHUNK AT ROM:0001977A SIZE 00000082 BYTES
ROM:0001974C
ROM:0001974C link a6,#-2
ROM:00019750 move.w d0,(sp)
ROM:00019752 bra.s loc_1977A
ROM:00019752 ; End of function process_factset
ROM:00019752
ROM:00019754
ROM:00019754 ; =============== S U B R O U T I N E =======================================
ROM:00019754
ROM:00019754
ROM:00019754 update_bff6: ; CODE XREF: process_factset+3Cp
ROM:00019754 ; process_factset+4Cp ...
ROM:00019754 btst #0,9(a6)
ROM:0001975A beq.s loc_19768
ROM:0001975C move.w ($FFFFBFF6).w,d6
ROM:00019760 move.w -4(a6),d0
ROM:00019764 bset d0,d6
ROM:00019766 bra.s loc_19774
ROM:00019768 ; ---------------------------------------------------------------------------
ROM:00019768
ROM:00019768 loc_19768: ; CODE XREF: update_bff6+6j
ROM:00019768 move.w ($FFFFBFF6).w,d0
ROM:0001976C move.w -4(a6),d6
ROM:00019770 bclr d6,d0
ROM:00019772 move.w d0,d6
ROM:00019774
ROM:00019774 loc_19774: ; CODE XREF: update_bff6+12j
ROM:00019774 move.w d6,($FFFFBFF6).w
ROM:00019778 rts
ROM:00019778 ; End of function update_bff6
ROM:00019778
ROM:0001977A ; ---------------------------------------------------------------------------
ROM:0001977A ; START OF FUNCTION CHUNK FOR process_factset
ROM:0001977A
ROM:0001977A loc_1977A: ; CODE XREF: process_factset+6j
ROM:0001977A subq.l #2,sp
ROM:0001977C cmp.w #$3421,d0
ROM:00019780 bne.s loc_1978C
ROM:00019782 move.w #$A,var_4(a6)
ROM:00019788 bsr.s update_bff6
ROM:0001978A bra.s loc_197F4
ROM:0001978C ; ---------------------------------------------------------------------------
ROM:0001978C
ROM:0001978C loc_1978C: ; CODE XREF: process_factset+34j
ROM:0001978C cmp.w #$2B0F,d0
ROM:00019790 bne.s loc_1979C
ROM:00019792 move.w #9,var_4(a6)
ROM:00019798 bsr.s update_bff6
ROM:0001979A bra.s loc_197F4
ROM:0001979C ; ---------------------------------------------------------------------------
ROM:0001979C
ROM:0001979C loc_1979C: ; CODE XREF: process_factset+44j
ROM:0001979C cmp.w #$2B44,d0
ROM:000197A0 bne.s loc_197AC
ROM:000197A2 move.w #$E,var_4(a6)
ROM:000197A8 bsr.s update_bff6
ROM:000197AA bra.s loc_197F4
ROM:000197AC ; ---------------------------------------------------------------------------
ROM:000197AC
ROM:000197AC loc_197AC: ; CODE XREF: process_factset+54j
ROM:000197AC cmp.w #$30E,d0
ROM:000197B0 bne.s loc_197BA
ROM:000197B2 move.w arg_0(a6),($FFFF9FBC).w
ROM:000197B8 bra.s loc_197F4
ROM:000197BA ; ---------------------------------------------------------------------------
ROM:000197BA
ROM:000197BA loc_197BA: ; CODE XREF: process_factset+64j
ROM:000197BA cmp.w #$30F,d0
ROM:000197BE bne.s loc_197C8
ROM:000197C0 move.w arg_0(a6),($FFFF9FBE).w
ROM:000197C6 bra.s loc_197F4
ROM:000197C8 ; ---------------------------------------------------------------------------
ROM:000197C8
ROM:000197C8 loc_197C8: ; CODE XREF: process_factset+72j
ROM:000197C8 cmp.w #$310,d0
ROM:000197CC bne.s loc_197D6
ROM:000197CE move.w arg_0(a6),($FFFF9FC0).w
ROM:000197D4 bra.s loc_197F4
ROM:000197D6 ; ---------------------------------------------------------------------------
ROM:000197D6
ROM:000197D6 loc_197D6: ; CODE XREF: process_factset+80j
ROM:000197D6 cmp.w #$311,d0
ROM:000197DA bne.s loc_197E4
ROM:000197DC move.w arg_0(a6),($FFFF9FC2).w
ROM:000197E2 bra.s loc_197F4
ROM:000197E4 ; ---------------------------------------------------------------------------
ROM:000197E4
ROM:000197E4 loc_197E4: ; CODE XREF: process_factset+8Ej
ROM:000197E4 cmp.w #$44,d0 ; 'D'
ROM:000197E8 bne.s loc_197F4
ROM:000197EA move.w #6,var_4(a6)
ROM:000197F0 bsr.w update_bff6
ROM:000197F4
ROM:000197F4 loc_197F4: ; CODE XREF: process_factset+3Ej
ROM:000197F4 ; process_factset+4Ej ...
ROM:000197F4 unlk a6
ROM:000197F6 movea.l (sp)+,a0
ROM:000197F8 addq.l #2,sp
ROM:000197FA jmp (a0)
ROM:000197FA ; END OF FUNCTION CHUNK FOR process_factset
This code appears to take two arguments, where one is compared with several 'magic numbers' and the other is then either compared with zero to set/clear a bit or is directly written to a memory location. After some experimentation, it became clear that this code is definitely called by the factset command somehow. This is what these magic numbers do:
FACTSET 13345,1 sets a bit in NVRAM with unknown effect
FACTSET 11023,1 sets the analyzer to C series
FACTSET 11076,1 sets the analyzer to L series
FACTSET 782,n sets the FM demod zero to n
FACTSET 783,n sets the FM demod slope to n
FACTSET 784,n sets the FM demod narrow bw setting to n
FACTSET 785,n sets the FM demod wide bw setting to n
FACTSET 68,1 sets a bit in NVRAM with unknown effect
The memory addresses that 782-785 write to correspond with NVRAM registers for the FM demodulator. I do not know why FACTSET can access them, I presume it is for calibration or debugging, but these commands do not appear in the calibration guide. Searching on the addresses eventually yielded the corresponding strings where the values are displayed in the 'cal data' screens. Two of the bits that FACTSET can change in location FFFFBFF6 have unknown functions, while two of them change the analyzer to C or L series.
None of this has anything to do with the gate module, though! Or does it? Hmm....
Next step is to search for what is displayed when the gate is enabled - "GATE rev B". I found this in the middle of a string table:
ROM:0002B50A aHpib: dc.b 4,'HPIB' ; DATA XREF: ROM:00027A96o
ROM:0002B50F dc.b $20
ROM:0002B510 aRs232: dc.b 5,'RS232' ; DATA XREF: ROM:00027A9Ao
ROM:0002B516 aOven: dc.b 4,'OVEN' ; DATA XREF: ROM:off_27A9Eo
ROM:0002B51B dc.b $20
ROM:0002B51C aFadc: dc.b 4,'FADC' ; DATA XREF: ROM:off_27AA2o
ROM:0002B521 dc.b $20
ROM:0002B522 aOcsl: dc.b 4,'OCSL' ; DATA XREF: ROM:00027AAAo
ROM:0002B527 dc.b $20
ROM:0002B528 aDrts: dc.b 4,'DRTS' ; DATA XREF: ROM:00027AAEo
ROM:0002B52D dc.b $20
ROM:0002B52E aFmd: dc.b 3,'FMD' ; DATA XREF: ROM:00027AB2o
ROM:0002B532 aIo: dc.b 2,'IO' ; DATA XREF: ROM:00027AB6o
ROM:0002B535 dc.b $20
ROM:0002B536 aBands: dc.b 5,'BANDS' ; DATA XREF: ROM:00027ABAo
ROM:0002B53C aGate: dc.b 4,'GATE' ; DATA XREF: ROM:00027ABEo
ROM:0002B541 dc.b $20
ROM:0002B542 aNbw: dc.b 3,'NBW' ; DATA XREF: ROM:off_27AC2o
ROM:0002B546 aNoise: dc.b 5,'NOISE' ; DATA XREF: ROM:off_27AC6o
ROM:0002B54C aRfps: dc.b 4,'RFPS' ; DATA XREF: ROM:00027ACAo
ROM:0002B551 dc.b $20
ROM:0002B552 aDdfadc: dc.b 6,'DDFADC' ; DATA XREF: ROM:00027ACEo
ROM:0002B559 dc.b $20
ROM:0002B55A aTgatten: dc.b 7,'TGATTEN' ; DATA XREF: ROM:00027AD2o
ROM:0002B562 aFast: dc.b 4,'FAST' ; DATA XREF: ROM:00027AD6o
ROM:0002B567 dc.b $20
ROM:0002B568 aTvtun: dc.b 5,'TVTUN' ; DATA XREF: ROM:off_27ADAo
ROM:0002B56E aAtv: dc.b 3,'ATV' ; DATA XREF: ROM:00027ADEo
ROM:0002B572 aCage: dc.b 4,'CAGE' ; DATA XREF: ROM:00027AE2o
ROM:0002B577 dc.b $20
ROM:0002B578 aFrqext: dc.b 6,'FRQEXT' ; DATA XREF: ROM:off_27AE6o
ROM:0002B57F dc.b $20
ROM:0002B580 aLoOutput: dc.b 9,'LO OUTPUT' ; DATA XREF: ROM:off_27AEAo
ROM:0002B58A aComb_0: dc.b 4,'COMB' ; DATA XREF: ROM:00027AEEo
ROM:0002B58F dc.b $20
ROM:0002B590 aGrdly: dc.b 5,'GRDLY' ; DATA XREF: ROM:off_27AF2o
ROM:0002B596 aGatea: dc.b 5,'GATEA' ; DATA XREF: ROM:off_27AF6o
ROM:0002B59C aGateb: dc.b 5,'GATEB' ; DATA XREF: ROM:off_27AFAo
ROM:0002B5A2 aNbwcount: dc.b 8,'NBWCOUNT' ; DATA XREF: ROM:00027AFEo
ROM:0002B5AB dc.b $20
ROM:0002B5AC aProto: dc.b 5,'PROTO' ; DATA XREF: ROM:00027B02o
ROM:0002B5B2 aUfp: dc.b 3,'UFP' ; DATA XREF: ROM:off_27B06o
ROM:0002B5B2 ; ROM:000281A4o
ROM:0002B5B6 aDdfw: dc.b 4,'DDFW' ; DATA XREF: ROM:00027B0Ao
ROM:0002B5BB dc.b $20
ROM:0002B5BC aDdfwrev: dc.b 7,'DDFWREV' ; DATA XREF: ROM:00027B0Eo
ROM:0002B5C4 aDect: dc.b 4,'DECT' ; DATA XREF: ROM:00027B12o
ROM:0002B5C9 dc.b $20
ROM:0002B5CA aUfpa: dc.b 4,'UFPA' ; DATA XREF: ROM:off_27B16o
ROM:0002B5CF dc.b $20
ROM:0002B5D0 aParallel: dc.b 8,'PARALLEL' ; DATA XREF: ROM:off_27B1Ao
ROM:0002B5D9 dc.b $20
ROM:0002B5DA aHpiba: dc.b 5,'HPIBA' ; DATA XREF: ROM:00027B1Eo
ROM:0002B5E0 aHpibb: dc.b 5,'HPIBB' ; DATA XREF: ROM:00027B22o
ROM:0002B5E6 aRs232a: dc.b 6,'RS232A' ; DATA XREF: ROM:00027B26o
ROM:0002B5ED dc.b $20
ROM:0002B5EE aRs232b: dc.b 6,'RS232B' ; DATA XREF: ROM:00027B2Ao
ROM:0002B5F5 dc.b $20
ROM:0002B5F6 aTvpict: dc.b 6,'TVPICT' ; DATA XREF: ROM:off_27B2Eo
ROM:0002B5FD dc.b $20
ROM:0002B5FE asc_2B5FE: dc.b 2,': ' ; DATA XREF: sub_27F62+4Ao
ROM:0002B601 dc.b $20
ROM:0002B602 aDemodTv: dc.b 8,'DEMOD/TV' ; DATA XREF: ROM:00028046o
ROM:0002B60B dc.b $20
ROM:0002B60C aDemodQpd: dc.b 9,'DEMOD/QPD' ; DATA XREF: ROM:00028068o
ROM:0002B616 aGateRevA: dc.b $A ; DATA XREF: ROM:0002808Ao
ROM:0002B616 dc.b 'GATE Rev A'
ROM:0002B621 dc.b $20
ROM:0002B622 aGateRevB: dc.b $A ; DATA XREF: ROM:000280ACo
ROM:0002B622 ; ROM:00028280o
ROM:0002B622 dc.b 'GATE Rev B'
ROM:0002B62D dc.b $20
ROM:0002B62E aGroupDelay: dc.b $B,'GROUP DELAY' ; DATA XREF: ROM:000280F6o
ROM:0002B63A aDdFadc: dc.b 7,'DD/FADC' ; DATA XREF: ROM:0002815Ao
ROM:0002B642 aDdfwRev: dc.b 9,'DDFW rev ' ; DATA XREF: ROM:0002816Ao
ROM:0002B64C aUfpA: dc.b 5,'UFP A' ; DATA XREF: ROM:000281CAo
ROM:0002B652 aTvPicture: dc.b $A ; DATA XREF: ROM:000281F0o
ROM:0002B652 dc.b 'TV Picture'
ROM:0002B65D dc.b $20
ROM:0002B65E aDeleteCnt: dc.b $A ; DATA XREF: ROM:0002825Eo
ROM:0002B65E dc.b 'Delete CNT'
ROM:0002B669 dc.b $20
ROM:0002B66A unk_2B66A: dc.b 3 ; DATA XREF: ROM:00028298o
ROM:0002B66B dc.b $37 ; 7
ROM:0002B66C dc.b $35 ; 5
ROM:0002B66D dc.b $FA ;
ROM:0002B66E aDectSource: dc.b $B,'DECT Source' ; DATA XREF: ROM:000282F0o
ROM:0002B67A aHpibParallel: dc.b $F,'HPIB + Parallel' ; DATA XREF: ROM:0002835Eo
ROM:0002B68A aRs232Parallel: dc.b $10,'RS232 + Parallel' ; DATA XREF: ROM:00028374o
ROM:0002B69B dc.b $20
(continued...)
-
It turns out that a bunch of these are then referenced in a list of addresses in another part of the code, followed by a function which I will call check_installed_options. Interestingly, the number of items in the string table exactly match the number of entries in the jump table. Creepy. After figuring out how the jump_table_call routine works, and with the first few entries commented with the corresponding string table entry, the code looks like this:
ROM:00027A84 ; ---------------------------------------------------------------------------
ROM:00027A86 off_27A86: dc.l aCnt ; DATA XREF: check_installed_options+14o
ROM:00027A86 ; ROM:00028244o ...
ROM:00027A86 ; "\x03CNT"
ROM:00027A8A off_27A8A: dc.l aTv ; DATA XREF: ROM:00028032r
ROM:00027A8A ; "\x02TV"
ROM:00027A8E off_27A8E: dc.l aQpd ; DATA XREF: ROM:00028054r
ROM:00027A8E ; "\x03QPD"
ROM:00027A92 off_27A92: dc.l aTg_0 ; DATA XREF: ROM:000282A6r
ROM:00027A92 ; ROM:000282C4r ...
ROM:00027A92 ; "\x02TG"
ROM:00027A96 dc.l aHpib ; "\x04HPIB"
ROM:00027A9A dc.l aRs232 ; "\x05RS232"
ROM:00027A9E off_27A9E: dc.l aOven ; DATA XREF: ROM:00027FEAr
ROM:00027A9E ; ROM:00028002r
ROM:00027A9E ; "\x04OVEN"
ROM:00027AA2 off_27AA2: dc.l aFadc ; DATA XREF: ROM:0002800Er
ROM:00027AA2 ; ROM:00028026r
ROM:00027AA2 ; "\x04FADC"
ROM:00027AA6 off_27AA6: dc.l aCard_0 ; DATA XREF: ROM:00028202r
ROM:00027AA6 ; ROM:0002821Ar
ROM:00027AA6 ; "\x04CARD"
ROM:00027AAA dc.l aOcsl ; "\x04OCSL"
ROM:00027AAE dc.l aDrts ; "\x04DRTS"
ROM:00027AB2 dc.l aFmd ; "\x03FMD"
ROM:00027AB6 dc.l aIo ; "\x02IO"
ROM:00027ABA dc.l aBands ; "\x05BANDS"
ROM:00027ABE dc.l aGate ; "\x04GATE"
ROM:00027AC2 off_27AC2: dc.l aNbw ; DATA XREF: ROM:0002812Cr
ROM:00027AC2 ; ROM:00028144r
ROM:00027AC2 ; "\x03NBW"
ROM:00027AC6 off_27AC6: dc.l aNoise ; DATA XREF: ROM:00028104r
ROM:00027AC6 ; ROM:00028120r
ROM:00027AC6 ; "\x05NOISE"
ROM:00027ACA dc.l aRfps ; "\x04RFPS"
ROM:00027ACE dc.l aDdfadc ; "\x06DDFADC"
ROM:00027AD2 dc.l aTgatten ; "\aTGATTEN"
ROM:00027AD6 dc.l aFast ; "\x04FAST"
ROM:00027ADA off_27ADA: dc.l aTvtun ; DATA XREF: ROM:000280BAr
ROM:00027ADA ; ROM:000280D2r
ROM:00027ADA ; "\x05TVTUN"
ROM:00027ADE dc.l aAtv ; "\x03ATV"
ROM:00027AE2 dc.l aCage ; "\x04CAGE"
ROM:00027AE6 off_27AE6: dc.l aFrqext ; DATA XREF: ROM:0002839Er
ROM:00027AE6 ; ROM:000283B6r
ROM:00027AE6 ; "\x06FRQEXT"
ROM:00027AEA off_27AEA: dc.l aLoOutput ; DATA XREF: ROM:00028300r
ROM:00027AEA ; ROM:00028314r
ROM:00027AEA ; "\tLO OUTPUT"
ROM:00027AEE dc.l aComb_0 ; "\x04COMB"
ROM:00027AF2 off_27AF2: dc.l aGrdly ; DATA XREF: ROM:000280DEr
ROM:00027AF2 ; "\x05GRDLY"
ROM:00027AF6 off_27AF6: dc.l aGatea ; DATA XREF: ROM:00028076r
ROM:00027AF6 ; "\x05GATEA"
ROM:00027AFA off_27AFA: dc.l aGateb ; DATA XREF: ROM:00028098r
ROM:00027AFA ; ROM:0002826Cr
ROM:00027AFA ; "\x05GATEB"
ROM:00027AFE dc.l aNbwcount ; "\bNBWCOUNT"
ROM:00027B02 dc.l aProto ; "\x05PROTO"
ROM:00027B06 off_27B06: dc.l aUfp ; DATA XREF: ROM:0002818Cr
ROM:00027B06 ; "\x03UFP"
ROM:00027B0A dc.l aDdfw ; "\x04DDFW"
ROM:00027B0E dc.l aDdfwrev ; "\aDDFWREV"
ROM:00027B12 dc.l aDect ; "\x04DECT"
ROM:00027B16 off_27B16: dc.l aUfpa ; DATA XREF: ROM:000281B2r
ROM:00027B16 ; "\x04UFPA"
ROM:00027B1A off_27B1A: dc.l aParallel ; DATA XREF: ROM:00028392r
ROM:00027B1A ; "\bPARALLEL"
ROM:00027B1E dc.l aHpiba ; "\x05HPIBA"
ROM:00027B22 dc.l aHpibb ; "\x05HPIBB"
ROM:00027B26 dc.l aRs232a ; "\x06RS232A"
ROM:00027B2A dc.l aRs232b ; "\x06RS232B"
ROM:00027B2E off_27B2E: dc.l aTvpict ; DATA XREF: ROM:000281D8r
ROM:00027B2E ; "\x06TVPICT"
ROM:00027B32 word_27B32: dc.w $D ; DATA XREF: ROM:0002823Eo
ROM:00027B32 ; ROM:00028334o
ROM:00027B34 word_27B34: dc.w $66 ; DATA XREF: ROM:00028042r
ROM:00027B36 word_27B36: dc.w $67 ; DATA XREF: ROM:00028064r
ROM:00027B38 dc.w $A
ROM:00027B3A dc.w $15
ROM:00027B3C dc.w $17
ROM:00027B3E word_27B3E: dc.w 4 ; DATA XREF: ROM:00027FFAr
ROM:00027B40 word_27B40: dc.w $65 ; DATA XREF: ROM:0002801Er
ROM:00027B42 word_27B42: dc.w 3 ; DATA XREF: ROM:00028212r
ROM:00027B44 dc.w 0
ROM:00027B46 dc.w 0
ROM:00027B48 dc.w 0
ROM:00027B4A dc.w 0
ROM:00027B4C dc.w 0
ROM:00027B4E dc.w $69
ROM:00027B50 word_27B50: dc.w $82 ; DATA XREF: ROM:0002813Cr
ROM:00027B52 word_27B52: dc.w $77 ; DATA XREF: ROM:00028118r
ROM:00027B54 dc.w 0
ROM:00027B56 dc.w 0
ROM:00027B58 dc.w 0
ROM:00027B5A dc.w 0
ROM:00027B5C word_27B5C: dc.w $6B ; DATA XREF: ROM:000280CAr
ROM:00027B5E dc.w 0
ROM:00027B60 dc.w 0
ROM:00027B62 word_27B62: dc.w $1A ; DATA XREF: ROM:000283AEr
ROM:00027B64 dc.w 9
ROM:00027B66 dc.w 0
ROM:00027B68 word_27B68: dc.w $6F ; DATA XREF: ROM:000280F2r
ROM:00027B6A word_27B6A: dc.w $69 ; DATA XREF: ROM:00028086r
ROM:00027B6C word_27B6C: dc.w $69 ; DATA XREF: ROM:000280A8r
ROM:00027B6C ; ROM:0002827Cr
ROM:00027B6E dc.w 0
ROM:00027B70 dc.w 0
ROM:00027B72 word_27B72: dc.w $3D ; DATA XREF: ROM:000281A0r
ROM:00027B72 ; ROM:000281C6r
ROM:00027B74 dc.w 0
ROM:00027B76 dc.w 0
ROM:00027B78 dc.w $3C
ROM:00027B7A dc.w $3D
ROM:00027B7C word_27B7C: dc.w $18 ; DATA XREF: ROM:0002838Ar
ROM:00027B7E dc.w 0
ROM:00027B80 dc.w $29
ROM:00027B82 dc.w 0
ROM:00027B84 dc.w $2B
ROM:00027B86 word_27B86: dc.w $B4 ; DATA XREF: ROM:000281ECr
-
Half of the corresponding subroutine:
ROM:00027B88 ; =============== S U B R O U T I N E =======================================
ROM:00027B88
ROM:00027B88 ; Attributes: bp-based frame
ROM:00027B88
ROM:00027B88 check_installed_options: ; CODE XREF: ROM:000014D4j
ROM:00027B88 ; ROM:00027FEEp ...
ROM:00027B88
ROM:00027B88 var_11 = -$11
ROM:00027B88 var_6 = -6
ROM:00027B88 var_4 = -4
ROM:00027B88
ROM:00027B88 link a6,#-4
ROM:00027B8C move.l d0,(sp)
ROM:00027B8E subq.l #2,sp
ROM:00027B90 clr.l d0
ROM:00027B92 move.l d0,-(sp)
ROM:00027B94 move.w #$2B,-(sp) ; '+'
ROM:00027B98 move.l var_4(a6),-(sp)
ROM:00027B9C lea off_27A86,a0
ROM:00027BA0 jsr sub_862
ROM:00027BA4 move.w d0,var_6(a6)
ROM:00027BA8 tst.w d0
ROM:00027BAA blt.w loc_27F5C
ROM:00027BAE bra.w loc_27F58
ROM:00027BB2 ; ---------------------------------------------------------------------------
ROM:00027BB2 jsr sub_22668
ROM:00027BB6 btst #0,d0
ROM:00027BBA beq.s loc_27BD6
ROM:00027BBC jsr sub_2267C
ROM:00027BC0 btst #0,d0
ROM:00027BC4 beq.s loc_27BCE
ROM:00027BC6 move.l #3,(sp)
ROM:00027BCC bra.s loc_27BD4
ROM:00027BCE ; ---------------------------------------------------------------------------
ROM:00027BCE
ROM:00027BCE loc_27BCE: ; CODE XREF: check_installed_options+3Cj
ROM:00027BCE move.l #1,(sp)
ROM:00027BD4
ROM:00027BD4 loc_27BD4: ; CODE XREF: check_installed_options+44j
ROM:00027BD4 bra.s loc_27BD8
ROM:00027BD6 ; ---------------------------------------------------------------------------
ROM:00027BD6
ROM:00027BD6 loc_27BD6: ; CODE XREF: check_installed_options+32j
ROM:00027BD6 clr.l (sp)
ROM:00027BD8
ROM:00027BD8 loc_27BD8: ; CODE XREF: check_installed_options:loc_27BD4j
ROM:00027BD8 bra.w loc_27F5C
ROM:00027BDC ; ---------------------------------------------------------------------------
ROM:00027BDC jsr sub_98E
ROM:00027BE0 btst #0,d0
ROM:00027BE4 beq.s loc_27C10
ROM:00027BE6 btst #$B,($FFFFB072).w
ROM:00027BEC beq.s loc_27BFE
ROM:00027BEE btst #$D,($FFFFB072).w
ROM:00027BF4 beq.s loc_27BFE
ROM:00027BF6 move.w #3,var_6(a6)
ROM:00027BFC bra.s loc_27C04
ROM:00027BFE ; ---------------------------------------------------------------------------
ROM:00027BFE
ROM:00027BFE loc_27BFE: ; CODE XREF: check_installed_options+64j
ROM:00027BFE ; check_installed_options+6Cj
ROM:00027BFE move.w #1,var_6(a6)
ROM:00027C04
ROM:00027C04 loc_27C04: ; CODE XREF: check_installed_options+74j
ROM:00027C04 move.w ($FFFFB07C).w,d6
ROM:00027C08 lsl.w #5,d6
ROM:00027C0A or.w d6,var_6(a6)
ROM:00027C0E bra.s loc_27C14
ROM:00027C10 ; ---------------------------------------------------------------------------
ROM:00027C10
ROM:00027C10 loc_27C10: ; CODE XREF: check_installed_options+5Cj
ROM:00027C10 clr.w var_6(a6)
ROM:00027C14
ROM:00027C14 loc_27C14: ; CODE XREF: check_installed_options+86j
ROM:00027C14 move.w var_6(a6),d0
ROM:00027C18 ext.l d0
ROM:00027C1A move.l d0,(sp)
ROM:00027C1C bra.w loc_27F5C
ROM:00027C20 ; ---------------------------------------------------------------------------
ROM:00027C20 jsr sub_958
ROM:00027C24 ext.w d0
ROM:00027C26 ext.l d0
ROM:00027C28 move.l d0,(sp)
ROM:00027C2A bra.w loc_27F5C
ROM:00027C2E ; ---------------------------------------------------------------------------
ROM:00027C2E move.w ($FFFFAD4C).w,d6
ROM:00027C32 ext.l d6
ROM:00027C34 move.l d6,(sp)
ROM:00027C36 bra.w loc_27F5C
ROM:00027C3A ; ---------------------------------------------------------------------------
ROM:00027C3A tst.b ($FFFFBF09).w
ROM:00027C3E seq d0
ROM:00027C40 cmpi.b #4,($FFFFBF09).w
ROM:00027C46 seq d6
ROM:00027C48 or.b d0,d6
ROM:00027C4A ext.w d6
ROM:00027C4C ext.l d6
ROM:00027C4E move.l d6,(sp)
ROM:00027C50 bra.w loc_27F5C
ROM:00027C54 ; ---------------------------------------------------------------------------
ROM:00027C54 cmpi.b #1,($FFFFBF09).w
ROM:00027C5A seq d0
ROM:00027C5C cmpi.b #8,($FFFFBF09).w
ROM:00027C62 seq d6
ROM:00027C64 or.b d0,d6
ROM:00027C66 ext.w d6
ROM:00027C68 ext.l d6
ROM:00027C6A move.l d6,(sp)
ROM:00027C6C bra.w loc_27F5C
ROM:00027C70 ; ---------------------------------------------------------------------------
ROM:00027C70 jsr sub_227BA
ROM:00027C74 ext.l d0
ROM:00027C76 move.l d0,(sp)
ROM:00027C78 bra.w loc_27F5C
ROM:00027C7C ; ---------------------------------------------------------------------------
ROM:00027C7C jsr sub_1EA
ROM:00027C80 ext.w d0
ROM:00027C82 ext.l d0
ROM:00027C84 move.l d0,(sp)
ROM:00027C86 bra.w loc_27F5C
ROM:00027C8A ; ---------------------------------------------------------------------------
ROM:00027C8A bsr.w sub_2689C
ROM:00027C8E andi.b #1,d0
ROM:00027C92 move.w d0,-(sp)
ROM:00027C94 bsr.w sub_268AA
ROM:00027C98 lsl.b #1,d0
ROM:00027C9A add.b $12+var_11(sp),d0
ROM:00027C9E addq.w #2,sp
ROM:00027CA0 ext.w d0
ROM:00027CA2 ext.l d0
ROM:00027CA4 move.l d0,(sp)
ROM:00027CA6 bra.w loc_27F5C
ROM:00027CAA ; ---------------------------------------------------------------------------
ROM:00027CAA bsr.w sub_261FC
ROM:00027CAE ext.w d0
ROM:00027CB0 ext.l d0
ROM:00027CB2 move.l d0,(sp)
ROM:00027CB4 bra.w loc_27F5C
ROM:00027CB8 ; ---------------------------------------------------------------------------
ROM:00027CB8 jsr sub_976
ROM:00027CBC ext.w d0
ROM:00027CBE ext.l d0
ROM:00027CC0 move.l d0,(sp)
ROM:00027CC2 bra.w loc_27F5C
ROM:00027CC6 ; ---------------------------------------------------------------------------
ROM:00027CC6 jsr sub_8F8
ROM:00027CCA ext.w d0
ROM:00027CCC ext.l d0
ROM:00027CCE move.l d0,(sp)
ROM:00027CD0 bra.w loc_27F5C
ROM:00027CD4 ; ---------------------------------------------------------------------------
ROM:00027CD4 cmpi.b #$F,($FFFF9B20).w
ROM:00027CDA sne d6
ROM:00027CDC ext.w d6
ROM:00027CDE ext.l d6
ROM:00027CE0 move.l d6,(sp)
ROM:00027CE2 bra.w loc_27F5C
ROM:00027CE6 ; ---------------------------------------------------------------------------
ROM:00027CE6 move.w ($FFFF9FB4).w,d0
ROM:00027CEA ext.l d0
ROM:00027CEC move.l d0,(sp)
ROM:00027CEE bra.w loc_27F5C
ROM:00027CF2 ; ---------------------------------------------------------------------------
ROM:00027CF2 jsr check_gate_option
ROM:00027CF6 andi.b #1,d0
ROM:00027CFA sne d6
ROM:00027CFC ext.w d6
ROM:00027CFE ext.l d6
ROM:00027D00 move.l d6,(sp)
ROM:00027D02 bra.w loc_27F5C
ROM:00027D06 ; ---------------------------------------------------------------------------
ROM:00027D06 jsr sub_20DD6
ROM:00027D0A ext.w d0
ROM:00027D0C ext.l d0
ROM:00027D0E move.l d0,(sp)
ROM:00027D10 bra.w loc_27F5C
ROM:00027D14 ; ---------------------------------------------------------------------------
ROM:00027D14 moveq #$FFFFFFFB,d0
ROM:00027D16 bsr.w sub_28506
ROM:00027D1A cmp.w #$FFFF,d0
ROM:00027D1E sne d6
ROM:00027D20 ext.w d6
ROM:00027D22 ext.l d6
ROM:00027D24 move.l d6,(sp)
ROM:00027D26 bra.w loc_27F5C
ROM:00027D2A ; ---------------------------------------------------------------------------
ROM:00027D2A clr.l (sp)
ROM:00027D2C bra.w loc_27F5C
ROM:00027D30 ; ---------------------------------------------------------------------------
ROM:00027D30 jsr sub_8F2
ROM:00027D34 ext.l d0
ROM:00027D36 move.l d0,(sp)
ROM:00027D38 bra.w loc_27F5C
ROM:00027D3C ; ---------------------------------------------------------------------------
ROM:00027D3C jsr sub_24B64
ROM:00027D40 ext.w d0
ROM:00027D42 ext.l d0
ROM:00027D44 move.l d0,(sp)
ROM:00027D46 bra.w loc_27F5C
ROM:00027D4A ; ---------------------------------------------------------------------------
ROM:00027D4A jsr sub_15A
ROM:00027D4E move.w d0,-(sp)
ROM:00027D50 jsr sub_1EA
ROM:00027D54 or.b $12+var_11(sp),d0
ROM:00027D58 addq.w #2,sp
ROM:00027D5A ext.w d0
ROM:00027D5C ext.l d0
ROM:00027D5E move.l d0,(sp)
ROM:00027D60 bra.w loc_27F5C
ROM:00027D64 ; ---------------------------------------------------------------------------
ROM:00027D64 jsr sub_93A
ROM:00027D68 ext.w d0
ROM:00027D6A ext.l d0
ROM:00027D6C move.l d0,(sp)
ROM:00027D6E bra.w loc_27F5C
ROM:00027D72 ; ---------------------------------------------------------------------------
ROM:00027D72 jsr sub_93A
ROM:00027D76 move.w d0,-(sp)
ROM:00027D78 jsr sub_98E
ROM:00027D7C or.b $12+var_11(sp),d0
ROM:00027D80 addq.w #2,sp
ROM:00027D82 ext.w d0
ROM:00027D84 ext.l d0
ROM:00027D86 move.l d0,(sp)
ROM:00027D88 bra.w loc_27F5C
ROM:00027D8C ; ---------------------------------------------------------------------------
ROM:00027D8C move.w ($FFFFAFCE).w,d6
ROM:00027D90 ext.l d6
ROM:00027D92 move.l d6,(sp)
ROM:00027D94 bra.w loc_27F5C
ROM:00027D98 ; ---------------------------------------------------------------------------
ROM:00027D98 cmpi.w #$2190,($FFFFBFEE).w
ROM:00027D9E seq d0
ROM:00027DA0 cmpi.w #$2191,($FFFFBFEE).w
ROM:00027DA6 seq d6
ROM:00027DA8 or.b d0,d6
ROM:00027DAA ext.w d6
ROM:00027DAC and.w ($FFFFA2E2).w,d6
ROM:00027DB0 ext.l d6
ROM:00027DB2 move.l d6,(sp)
ROM:00027DB4 bra.w loc_27F5C
ROM:00027DB8 ; ---------------------------------------------------------------------------
ROM:00027DB8 btst #0,($FFFFAD4E).w
ROM:00027DBE sne d0
ROM:00027DC0 ext.w d0
ROM:00027DC2 ext.l d0
ROM:00027DC4 move.l d0,(sp)
ROM:00027DC6 bra.w loc_27F5C
ROM:00027DCA ; ---------------------------------------------------------------------------
ROM:00027DCA move.w ($FFFFA2E4).w,d6
ROM:00027DCE ext.l d6
ROM:00027DD0 move.l d6,(sp)
ROM:00027DD2 bra.w loc_27F5C
ROM:00027DD6 ; ---------------------------------------------------------------------------
-
And the other half:
ROM:00027DD6 moveq #$FFFFFFFD,d0 ; aGrdly?
ROM:00027DD8 bsr.w sub_28506
ROM:00027DDC cmp.w #$FFFF,d0
ROM:00027DE0 sne d6
ROM:00027DE2 ext.w d6
ROM:00027DE4 ext.l d6
ROM:00027DE6 move.l d6,(sp)
ROM:00027DE8 bra.w loc_27F5C
ROM:00027DEC ; ---------------------------------------------------------------------------
ROM:00027DEC jsr check_gate_option ; aGateA?
ROM:00027DF0 andi.b #2,d0 ; set Z of d0.1 is zero
ROM:00027DF4 sne d6 ; set d6 if NE (Z = 0) (d0.1 set)
ROM:00027DF6 ext.w d6
ROM:00027DF8 ext.l d6
ROM:00027DFA move.l d6,(sp)
ROM:00027DFC bra.w loc_27F5C
ROM:00027E00 ; ---------------------------------------------------------------------------
ROM:00027E00 jsr check_gate_option ; aGateB?
ROM:00027E04 andi.b #4,d0 ; set Z if d0.2 is zero
ROM:00027E08 sne d6 ; set d6 if NE (Z = 0) (d0.2 set)
ROM:00027E0A ext.w d6
ROM:00027E0C ext.l d6
ROM:00027E0E move.l d6,(sp)
ROM:00027E10 bra.w loc_27F5C
ROM:00027E14 ; ---------------------------------------------------------------------------
ROM:00027E14 jsr sub_20DD6 ; aNbwCount?
ROM:00027E18 btst #5,($FFFFBFF7).w
ROM:00027E1E sne d6
ROM:00027E20 and.b d0,d6
ROM:00027E22 ext.w d6
ROM:00027E24 ext.l d6
ROM:00027E26 move.l d6,(sp)
ROM:00027E28 bra.w loc_27F5C
ROM:00027E2C ; ---------------------------------------------------------------------------
ROM:00027E2C jsr sub_2B3A ; aProto?
ROM:00027E30 tst.l d0
ROM:00027E32 slt d6
ROM:00027E34 ext.w d6
ROM:00027E36 ext.l d6
ROM:00027E38 move.l d6,(sp)
ROM:00027E3A bra.w loc_27F5C
ROM:00027E3E ; ---------------------------------------------------------------------------
ROM:00027E3E moveq #$FFFFFFF5,d0 ; aUfp?
ROM:00027E40 bsr.w sub_28506
ROM:00027E44 cmp.w #$FFFF,d0
ROM:00027E48 sne d6
ROM:00027E4A ext.w d6
ROM:00027E4C ext.l d6
ROM:00027E4E move.l d6,(sp)
ROM:00027E50 bra.w loc_27F5C
ROM:00027E54 ; ---------------------------------------------------------------------------
ROM:00027E54 jsr sub_940 ; aDdfw?
ROM:00027E58 ext.l d0
ROM:00027E5A move.l d0,(sp)
ROM:00027E5C bra.w loc_27F5C
ROM:00027E60 ; ---------------------------------------------------------------------------
ROM:00027E60 jsr sub_9A0 ; aDdfwrev?
ROM:00027E64 move.l d0,(sp)
ROM:00027E66 bra.w loc_27F5C
ROM:00027E6A ; ---------------------------------------------------------------------------
ROM:00027E6A moveq #$FFFFFFEF,d0 ; aDect?
ROM:00027E6C bsr.w sub_28506
ROM:00027E70 cmp.w #$FFFF,d0
ROM:00027E74 sne d6
ROM:00027E76 ext.w d6
ROM:00027E78 ext.l d6
ROM:00027E7A move.l d6,(sp)
ROM:00027E7C bra.w loc_27F5C
ROM:00027E80 ; ---------------------------------------------------------------------------
ROM:00027E80 moveq #$FFFFFFF3,d0 ; aUfpa?
ROM:00027E82 bsr.w sub_28506
ROM:00027E86 cmp.w #$FFFF,d0
ROM:00027E8A sne d6
ROM:00027E8C ext.w d6
ROM:00027E8E ext.l d6
ROM:00027E90 move.l d6,(sp)
ROM:00027E92 bra.w loc_27F5C
ROM:00027E96 ; ---------------------------------------------------------------------------
ROM:00027E96 cmpi.b #2,($FFFF9B20).w ; aParallel?
ROM:00027E9C seq d0
ROM:00027E9E ext.w d0
ROM:00027EA0 ext.l d0
ROM:00027EA2 move.l d0,(sp)
ROM:00027EA4 bra.w loc_27F5C
ROM:00027EA8 ; ---------------------------------------------------------------------------
ROM:00027EA8 tst.b ($FFFFBF09).w ; aHpibA?
ROM:00027EAC seq d6
ROM:00027EAE ext.w d6
ROM:00027EB0 ext.l d6
ROM:00027EB2 move.l d6,(sp)
ROM:00027EB4 bra.w loc_27F5C
ROM:00027EB8 ; ---------------------------------------------------------------------------
ROM:00027EB8 cmpi.b #4,($FFFFBF09).w ; aHpibB?
ROM:00027EBE seq d0
ROM:00027EC0 ext.w d0
ROM:00027EC2 ext.l d0
ROM:00027EC4 move.l d0,(sp)
ROM:00027EC6 bra.w loc_27F5C
ROM:00027ECA ; ---------------------------------------------------------------------------
ROM:00027ECA cmpi.b #1,($FFFFBF09).w ; aRs232a?
ROM:00027ED0 seq d6
ROM:00027ED2 ext.w d6
ROM:00027ED4 ext.l d6
ROM:00027ED6 move.l d6,(sp)
ROM:00027ED8 bra.w loc_27F5C
ROM:00027EDC ; ---------------------------------------------------------------------------
ROM:00027EDC cmpi.b #8,($FFFFBF09).w ; aRs232b?
ROM:00027EE2 seq d0
ROM:00027EE4 ext.w d0
ROM:00027EE6 ext.l d0
ROM:00027EE8 move.l d0,(sp)
ROM:00027EEA bra.s loc_27F5C
ROM:00027EEC ; ---------------------------------------------------------------------------
ROM:00027EEC moveq #$FFFFFFDF,d0 ; aTvpict?
ROM:00027EEE bsr.w sub_28506
ROM:00027EF2 cmp.w #$FFFF,d0
ROM:00027EF6 sne d6
ROM:00027EF8 ext.w d6
ROM:00027EFA ext.l d6
ROM:00027EFC move.l d6,(sp)
ROM:00027EFE bra.s loc_27F5C
ROM:00027EFE ; ---------------------------------------------------------------------------
ROM:00027F00 dc.w $FF90
ROM:00027F02 dc.w $FF80
ROM:00027F04 dc.w $FF6E
ROM:00027F06 dc.w $FF5C
ROM:00027F08 dc.w $FF4C
ROM:00027F0A dc.w $FF3A
ROM:00027F0C dc.w $FF24
ROM:00027F0E dc.w $FF0E
ROM:00027F10 dc.w $FF04
ROM:00027F12 dc.w $FEF8
ROM:00027F14 dc.w $FEE2
ROM:00027F16 dc.w $FED0
ROM:00027F18 dc.w $FEB8
ROM:00027F1A dc.w $FEA4
ROM:00027F1C dc.w $FE90
ROM:00027F1E dc.w $FE7A
ROM:00027F20 dc.w $FE6E
ROM:00027F22 dc.w $FE5C
ROM:00027F24 dc.w $FE3C
ROM:00027F26 dc.w $FE30
ROM:00027F28 dc.w $FE16
ROM:00027F2A dc.w $FE08
ROM:00027F2C dc.w $FDEE
ROM:00027F2E dc.w $FDE0
ROM:00027F30 dc.w $FDD4
ROM:00027F32 dc.w $FDCE
ROM:00027F34 dc.w $FDB8
ROM:00027F36 dc.w $FDAA
ROM:00027F38 dc.w $FD96
ROM:00027F3A dc.w $FD8A
ROM:00027F3C dc.w $FD78
ROM:00027F3E dc.w $FD6A
ROM:00027F40 dc.w $FD5C
ROM:00027F42 dc.w $FD4E
ROM:00027F44 dc.w $FD2E
ROM:00027F46 dc.w $FD20
ROM:00027F48 dc.w $FD14
ROM:00027F4A dc.w $FCF8
ROM:00027F4C dc.w $FCDE
ROM:00027F4E dc.w $FCD2
ROM:00027F50 dc.w $FCC4
ROM:00027F52 dc.w $FC80
ROM:00027F54 dc.w $FC56
ROM:00027F56 dc.w $2B
ROM:00027F58 ; ---------------------------------------------------------------------------
ROM:00027F58
ROM:00027F58 loc_27F58: ; CODE XREF: check_installed_options+26j
ROM:00027F58 jsr relative_jump_table_call
ROM:00027F5C
ROM:00027F5C loc_27F5C: ; CODE XREF: check_installed_options+22j
ROM:00027F5C ; check_installed_options:loc_27BD8j ...
ROM:00027F5C move.l (sp)+,d0
ROM:00027F5E unlk a6
ROM:00027F60 rts
ROM:00027F60 ; End of function check_installed_options
After correcting a few off-by-one errors (sigh), it turns out that both gate options call the same function, which I will call check_gate_option. The Gate rev A call looks at bit 1 if the returned word, while gate rev B looks at bit 2. Very interesting. Now, let's have a look at this new function:
ROM:0002F498 check_gate_option: ; CODE XREF: j_check_gate_optionj
ROM:0002F498 ; check_installed_options+16Ap ...
ROM:0002F498 link a6,#0
ROM:0002F49C move.l ($FFFFBF2A).w,d6 ; read register $FFFFBF2A (32 bit) into d6
ROM:0002F4A0 not.l d6 ; invert d6
ROM:0002F4A2 btst #$19,d6 ; check if d6.25 is zero (Z=1 if addr.25 is 1)
ROM:0002F4A6 sne d0 ; set d0 if not zero (d0 set if addr.25 = 0)
ROM:0002F4A8 andi.b #3,d0 ; and with 3 so only lowest 2 bits set if set
ROM:0002F4AC btst #4,($FFFFBFF7).w ; check if $FFFFBFF7.4 is zero (Z = 0 if addr.4 is 1)
ROM:0002F4B2 sne d1 ; set d1 if not zero (d1 set if addr.4 is 1)
ROM:0002F4B4 andi.b #5,d1 ; and with 5 for set pattern of 101 in LSBs
ROM:0002F4B8 or.b d0,d1 ; OR and place in d0
ROM:0002F4BA move.b d1,d0 ; d0.0 = GATE present
ROM:0002F4BA ; d0.1 = GATEA present
ROM:0002F4BA ; d0.2 = GATEB present
ROM:0002F4BC unlk a6
ROM:0002F4BE rts
ROM:0002F4BE ; End of function check_gate_option
-
This is what we call short and sweet. That FFFFBFF7 reference looks very similar - doesn't FACTSET modify FFFFBFF6? This part is 16 bit, so FFFFBFF7 is just the MSB of FFFFBFF6. The plot thickens. This routine checks bit 4 of FFFFBFF7, corresponding to bit 12 of FFFFBFF6. Let's see where that might take place. Interestingly, it's not far away. Literally, the next function down in the ROM.
ROM:0002F4C0 process_gatesel: ; CODE XREF: j_process_gateselj
ROM:0002F4C0 link a6,#-2
ROM:0002F4C4 move.w d0,(sp) ; d0 contains first argument, save it on stack
ROM:0002F4C6 tst.w d0
ROM:0002F4C8 bne.s loc_2F4DA ; skip if argument is nonzero
ROM:0002F4CA btst #4,($FFFFBFF7).w ; Check Gate B
ROM:0002F4D0 beq.s loc_2F4D8
ROM:0002F4D2 bset #$F,($FFFFB116).w ; Set bit if gate B present
ROM:0002F4D8
ROM:0002F4D8 loc_2F4D8: ; CODE XREF: process_gatesel+10j
ROM:0002F4D8 bra.s process_gatesel_ret
ROM:0002F4DA ; ---------------------------------------------------------------------------
ROM:0002F4DA
ROM:0002F4DA loc_2F4DA: ; CODE XREF: process_gatesel+8j
ROM:0002F4DA cmp.w #1,d0
ROM:0002F4DE bne.s loc_2F4F0 ; continue only if arg = 1
ROM:0002F4E0 bsr.s check_gate_option
ROM:0002F4E2 btst #1,d0 ; check if any gate present
ROM:0002F4E6 beq.s loc_2F4EE ; branch if no gate present
ROM:0002F4E8 bclr #$F,($FFFFB116).w ; if some gate present, clear bit
ROM:0002F4EE
ROM:0002F4EE loc_2F4EE: ; CODE XREF: process_gatesel+26j
ROM:0002F4EE bra.s process_gatesel_ret
ROM:0002F4F0 ; ---------------------------------------------------------------------------
ROM:0002F4F0
ROM:0002F4F0 loc_2F4F0: ; CODE XREF: process_gatesel+1Ej
ROM:0002F4F0 cmp.w #2,d0
ROM:0002F4F4 bne.s loc_2F51A ; continue only if arg = 2
ROM:0002F4F6 movem.l dword_2FF9A,d0-d1 ; load d0 (0x00000000) and d1 (0x00002001)
ROM:0002F4FC jsr negate_bcd_16dig ; negate 16 digit BCD number in d0 and d1
ROM:0002F4FC ; d0:d1 = 0x0000000000002001 (2001)
ROM:0002F4FC ; becomes
ROM:0002F4FC ; d0:d1 = 0x9999999999997999 (-2001)
ROM:0002F500 jsr load_comp_swp_64bit_next_abs
ROM:0002F500 ; ---------------------------------------------------------------------------
ROM:0002F504 dc.w $B060 ; argument for previous function
ROM:0002F504 ; reference to 0xFFFFB060 (center frequency)
ROM:0002F506 ; ---------------------------------------------------------------------------
ROM:0002F506 bne.s loc_2F518 ; skip if center frequency does not match -2001
ROM:0002F508 bsr.w check_gate_b_present
ROM:0002F50C btst #0,d0
ROM:0002F510 beq.s loc_2F518
ROM:0002F512 bset #4,($FFFFBFF7).w ; Enable Gate B
ROM:0002F518
ROM:0002F518 loc_2F518: ; CODE XREF: process_gatesel+46j
ROM:0002F518 ; process_gatesel+50j
ROM:0002F518 bra.s process_gatesel_ret
ROM:0002F51A ; ---------------------------------------------------------------------------
ROM:0002F51A
ROM:0002F51A loc_2F51A: ; CODE XREF: process_gatesel+34j
ROM:0002F51A cmp.w #3,d0
ROM:0002F51E bne.s process_gatesel_ret ; continue only if arg = 3
ROM:0002F520 movem.l dword_2FF9A,d0-d1 ; load d0 (0x00000000) and d1 (0x00002001)
ROM:0002F526 jsr negate_bcd_16dig ; negate 16 digit BCD number in d0 and d1
ROM:0002F526 ; d0:d1 = 0x0000000000002001 (2001)
ROM:0002F526 ; becomes
ROM:0002F526 ; d0:d1 = 0x9999999999997999 (-2001)
ROM:0002F52A jsr load_comp_swp_64bit_next_abs
ROM:0002F52A ; ---------------------------------------------------------------------------
ROM:0002F52E dc.w $B060 ; argument for previous function
ROM:0002F52E ; reference to 0xFFFFB060 (center frequency)
ROM:0002F530 ; ---------------------------------------------------------------------------
ROM:0002F530 bne.s process_gatesel_ret ; skip if center frequency does not match -2001
ROM:0002F532 bclr #4,($FFFFBFF7).w ; Disable Gate B
ROM:0002F538
ROM:0002F538 process_gatesel_ret: ; CODE XREF: process_gatesel:loc_2F4D8j
ROM:0002F538 ; process_gatesel:loc_2F4EEj ...
ROM:0002F538 unlk a6 ; restore stack and return
ROM:0002F53A rts
ROM:0002F53A ; End of function process_gatesel
ROM:0002F53A
This appears to be what we are looking for. The function takes one of several paths, depending on the value of the argument in d0. If it is zero, it checks bit 4 of FFFFBFF7 (gate B) sets bit 15 of FFFFB116 if gate B is present. It is unclear what bit 15 of FFFFB116 is responsible for.
If d0 is 1, then it clears bit 15 of FFFFB116 if some gate is present. Odd.
If d0 is 2, then it does some magic, and if all of that is correct, it enables gate B.
If d0 is 3, then it does some magic, and if all of that is correct, it disables gate B.
Now, all of this 'magic' is checking to see of the center frequency is -2001 Hz. This was not at all clear without going and looking at several of these methods. This was also not all that clear because it is using BCD arithmetic instead of regular binary (2001 in BCD is 0x2001).
Now, this methid is definitely the ticket. However, how the heck is it called? Finding the code is all well and good, but if you can't call it, it might as well not be there. Well, let's compare the command list in memory with the manual. Under sweep, there is GATE, GATECTL, GC, GD, GL, GP, and a bunch thatstart with GDR. These are all in the ROM table. However, there is an interesting one in the ROM table: GATESEL. This does not appear in the manual. Could it really be this easy? Well, no harm in trying it out....aaand, it works.
So after all of this BS, the result is very simple:
to eanble Gate rev B, send the following commands:
CF -2001 Hz
GATESEL 2
And to disable Gate rev B, send the following commands:
CF -2001 Hz
GATESEL 3
Hopefully somebody finds this useful.
Also, an alternative set of instructions from Agilent are also available publicly here: http://www.home.agilent.com/owc_discussions/thread.jspa?messageID=114410 (http://www.home.agilent.com/owc_discussions/thread.jspa?messageID=114410)
These involve pushing some unmarked softkeys to do the same thing, after properly setting the center frequency.
-
Someone posted a ebay auction linking to the Agilent forums where the instructions were posted to enable opt 105
warning not to buy the instructions off ebay as someone was trying to sell them for $1000
http://www.home.agilent.com/owc_discussions/thread.jspa?threadID=33120&tstart=0 (http://www.home.agilent.com/owc_discussions/thread.jspa?threadID=33120&tstart=0)